cpuidlfence · September 4, 2025 16:37
diff --git a/mov_gs_60 b/mov_gs_60
 // list of mov rax, gs:[60h] candidates in all modules on Windows
 //
 // mentioned in this tweet : https://x.com/dudeperfectdog/status/1963625066215727320
 // 
 // use +0x0 as your search to find candidates with it at the beginning of the function
 // 
 // code will come later!

 [[IN]] C:\Windows\System32\aadauthhelper.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x45590)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x455c0)

 [[IN]] C:\Windows\System32\aadcloudap.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xb1750)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xb1780)

 [[IN]] C:\Windows\System32\aadtb.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xb6430)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xb6450)

 [[IN]] C:\Windows\System32\aadWamExtension.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x14bd0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x14c00)

 [[IN]] C:\Windows\System32\AboutSettingsHandlers.dll
    ==> ?IsWorkstationDomainLicenseBitEnabled@DataModel@SystemSettings@@YA_NK@Z+0x660 (RVA: 0xc318)
    ==> ?Initialize@SystemEulaLink@DataModel@SystemSettings@@AEAAJXZ+0x71f (RVA: 0x2818f)
    ==> ?get_IsApplicable@SystemProducerName@DataModel@SystemSettings@@UEAAJPEAE@Z+0x672 (RVA: 0x3d4c2)
    ==> ?IsGSKU@@YA_NXZ+0x650 (RVA: 0x54878)

 [[IN]] C:\Windows\System32\accessibilitycpl.dll
    ==> ?IsPersonalizationFeatureEnabled@AccessibilityCplCore@@AEAA_NXZ+0x669 (RVA: 0xcd69)

 [[IN]] C:\Windows\System32\AcGenral.dll
    ==> ??2@YAPEAX_K@Z+0x0 (RVA: 0x328c)
    ==> ??_V@YAXPEAX@Z+0x0 (RVA: 0x57d4)

 [[IN]] C:\Windows\System32\AcLayers.dll
    ==> ??3@YAXPEAX@Z+0x0 (RVA: 0x5d70)
    ==> ?FthClientAttemptConnection@NS_FaultTolerantHeap@@YAHPEAU__FTH_CLIENT@1@@Z+0x58e (RVA: 0xbe8a)
    ==> ?FthClientInitialize@NS_FaultTolerantHeap@@YAHPEAU__FTH_CLIENT@1@PEAD@Z+0x14c (RVA: 0xc19c)
    ==> ?FthClientInitialize@NS_FaultTolerantHeap@@YAHPEAU__FTH_CLIENT@1@PEAD@Z+0x1c8 (RVA: 0xc218)

 [[IN]] C:\Windows\System32\acmigration.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2f (RVA: 0x10ccb)
    ==> ?CheckMatchingText@@YA_N_KAEBU_FileAttributesStrs@@@Z+0x175 (RVA: 0x1aef5)
    ==> ?CheckMatchingText@@YA_N_KAEBU_FileAttributesStrs@@@Z+0x25d (RVA: 0x1afdd)
    ==> ?GetWStringFromStringStream@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AEAV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@2@W4_Encoding@@@Z+0x10d (RVA: 0x24f11)
    ==> ?GetWStringFromStringStream@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AEAV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@2@W4_Encoding@@@Z+0x1b8 (RVA: 0x24fbc)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x8ec (RVA: 0x2591c)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x1092 (RVA: 0x260c2)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x17d3 (RVA: 0x26803)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x183f (RVA: 0x2686f)
    ==> ?InventoryMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x16f (RVA: 0x27caf)
    ==> <lambda_7d2b954ce3991a02628587bf12cb1b82>::operator()+0x557 (RVA: 0x2837b)
    ==> ?SampleGenerateMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x3770f)
    ==> ?MigrateVCRuntimeEmptyMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x3941f)
    ==> ?RealCloudPlayerMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x39d2f)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xb85 (RVA: 0x3ed5d)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xc95 (RVA: 0x3ee6d)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xdbd (RVA: 0x3ef95)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xf43 (RVA: 0x3f11b)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x133 (RVA: 0x3f7a3)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x296 (RVA: 0x3f906)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x2ba (RVA: 0x3f92a)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x4d27f)
    ==> AslTelemetryFlush+0x18c (RVA: 0x4dbcc)
    ==> AslTelemetryFlush+0x1c4 (RVA: 0x4dc04)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x4e80a)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x4e918)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x4e969)
    ==> AslRegistryGetString+0xb4 (RVA: 0x4f100)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x4f2de)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x4f39a)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x4f50a)
    ==> AslLogCreate+0x36 (RVA: 0x5049e)
    ==> AslLogCreate+0x77 (RVA: 0x504df)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x50f29)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x511d4)
    ==> AslStringDuplicateA+0x91 (RVA: 0x51345)
    ==> AslStringDuplicate+0xb5 (RVA: 0x5154d)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x516fc)
    ==> AslFileMappingCreate+0x55 (RVA: 0x51d31)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x535e7)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x53f2e)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x57089)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x570bd)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x5738a)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x57655)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x57696)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x57ea2)
    ==> AslEnvBuildBasic+0xbd0 (RVA: 0x58ec8)
    ==> AslEnvBuildBasic+0x10c9 (RVA: 0x593c1)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x59b7c)
    ==> SdbOpenDatabaseEx+0x4b (RVA: 0x5afe3)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0x5b1e0)
    ==> SdbRegisterDatabaseEx+0xf7 (RVA: 0x5c1bf)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x5cb7a)
    ==> ?AcmEngineCreate@@YAJPEAPEAX@Z+0x540 (RVA: 0x5d7f0)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0x2a (RVA: 0x5de3a)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0xc5 (RVA: 0x5ded5)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0x175 (RVA: 0x5df85)

 [[IN]] C:\Windows\System32\acppage.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xa (RVA: 0x7eea)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x6e (RVA: 0x7f4e)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xc2 (RVA: 0x7fa2)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x10021)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x10055)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x1031a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x11f22)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x123a1)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x12f4d)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x1345b)
    ==> AslRegistryGetString+0xb4 (RVA: 0x13aec)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x13cca)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x13d86)
    ==> AslStringDuplicate+0xb5 (RVA: 0x13f79)

 [[IN]] C:\Windows\System32\AcSpecfc.dll
    ==> ??3@YAXPEAX@Z+0x0 (RVA: 0x4904)

 [[IN]] C:\Windows\System32\ActionQueue.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x1b446)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x1b494)

 [[IN]] C:\Windows\System32\ActivationManager.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x4ab60)
    ==> MIDL_user_free+0x0 (RVA: 0x4ab90)

 [[IN]] C:\Windows\System32\AdobePDF.dll
    ==> RVA: .text+0x131b2
    ==> RVA: .text+0x1655d
    ==> RVA: .text+0x165a4

 [[IN]] C:\Windows\System32\AdobePDFUI.dll
    ==> RVA: .text+0x65ba
    ==> RVA: .text+0x9980

 [[IN]] C:\Windows\System32\advapi32.dll
    ==> ReportInitiateShutdownHelperTelemetry+0x37 (RVA: 0x1f96b)
    ==> ReportInitiateShutdownHelperTelemetry+0x1a1 (RVA: 0x1fad5)
    ==> 0x296f9 (no symbol)
    ==> SaferpLevelObjpCleanupEntry+0x14 (RVA: 0x3e060)

 [[IN]] C:\Windows\System32\aeinv.dll
    ==> std::basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >::_Copy+0x100 (RVA: 0x5010)
    ==> AslLogGlobalLogger::AslLogGlobalLogger+0x6b (RVA: 0x605b)
    ==> AslLogGlobalLogger::AslLogGlobalLogger+0xa9 (RVA: 0x6099)
    ==> AslTelemetryCreate+0x2b (RVA: 0x63fb)
    ==> AslTelemetryCreate+0x165 (RVA: 0x6535)
    ==> AslTelemetryCreate+0x356 (RVA: 0x6726)
    ==> AslTelemetryCreate+0x433 (RVA: 0x6803)
    ==> AslRegistryBuildMachinePath+0x63 (RVA: 0x6a93)
    ==> AslpTelemetryProcessError+0xc7 (RVA: 0x1ab1f)
    ==> AslRegistryGetString+0xb4 (RVA: 0x1c0cc)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x1c29e)
    ==> AslRegistryGetStringExpand+0x159 (RVA: 0x1c351)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x1cbe5)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2d (RVA: 0x1ce55)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5f (RVA: 0x1ce87)
    ==> PiiFilterCreate+0xf (RVA: 0x1d22b)
    ==> PiiFilterCreate+0x76 (RVA: 0x1d292)
    ==> PiiFilterCreate+0xca (RVA: 0x1d2e6)
    ==> PiiFilterEmbeddedPathsExecute+0x65 (RVA: 0x1d405)
    ==> PiiFilterEmbeddedPathsExecute+0x9f (RVA: 0x1d43f)
    ==> AslPathWildcardFindFirst+0x116 (RVA: 0x1de0e)
    ==> AslPathWildcardFindFirst+0x1fe (RVA: 0x1def6)
    ==> AslPathWildcardFindFirst+0x277 (RVA: 0x1df6f)
    ==> AslPathWildcardFindNext+0x9d (RVA: 0x1e339)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x1ef7c)
    ==> AslpAllocMatchNode+0xf (RVA: 0x1f0c3)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x1f2d0)
    ==> AslpProcessMatchRegNode+0x9b (RVA: 0x1f803)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x1fc2d)
    ==> AslEnvBuildBasic+0xc13 (RVA: 0x2080f)
    ==> AslEnvBuildBasic+0x109d (RVA: 0x20c99)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x21637)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0xdf (RVA: 0x3c77f)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x59dce)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x59ec8)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x59f9a)
    ==> 0x5c11e (no symbol)
    ==> AslTelemetryFlush+0x40 (RVA: 0x6a994)
    ==> AslTelemetryFlush+0x6d (RVA: 0x6a9c1)
    ==> AslTelemetryFlush+0x93 (RVA: 0x6a9e7)
    ==> AslTelemetryFlush+0xb6 (RVA: 0x6aa0a)
    ==> AslTelemetryFlush+0xd9 (RVA: 0x6aa2d)
    ==> AslTelemetryFlush+0xfc (RVA: 0x6aa50)
    ==> AslTelemetryFlush+0x11f (RVA: 0x6aa73)
    ==> AslTelemetryFlush+0x13e (RVA: 0x6aa92)
    ==> AslTelemetryFlush+0x1a0 (RVA: 0x6aaf4)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x6b2b0)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x6b301)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x6b790)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x6c4b9)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x6c68c)
    ==> AslStringDuplicate+0x7d (RVA: 0x6c7e9)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x6cc7b)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x6dabe)
    ==> AslFileMappingCreate+0x5f (RVA: 0x6e557)
    ==> AslFileAttributeToString+0x57 (RVA: 0x6f8bf)
    ==> AslpFileGetVersionBlock+0x468 (RVA: 0x71774)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x72df8)
    ==> ??0RtlStringArray@@QEAA@XZ+0x24 (RVA: 0x730f0)
    ==> ?Initialize@?$RtlArray@URTL_STRING_ITEM@RtlStringArray@@@@QEAAJPEAX_K1H@Z+0x31 (RVA: 0x73aa5)
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x893d8)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x460 (RVA: 0x8af40)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x523 (RVA: 0x8b003)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xe8 (RVA: 0x8c7f0)
    ==> ?FaddpAllocInitContextData@@YAJPEAPEAU_FADD_CONTEXT_DATA@@@Z+0xf (RVA: 0x9b9c3)
    ==> ?InitializeFromBuffer@RtlMemoryStream@@QEAAJQEAX_K@Z+0x4a (RVA: 0x9cd72)
    ==> FaddExecute+0x163 (RVA: 0x9d0f7)
    ==> FaddExecute+0x1fc (RVA: 0x9d190)
    ==> FaddExecute+0x245 (RVA: 0x9d1d9)
    ==> FaddLoadFromBuffer+0x18 (RVA: 0x9d784)
    ==> FaddLoadFromBuffer+0x241 (RVA: 0x9d9ad)
    ==> FaddLoadFromBuffer+0x2b4 (RVA: 0x9da20)
    ==> FaddSaveToBuffer+0x1d (RVA: 0x9db1d)
    ==> FaddSaveToBuffer+0xad (RVA: 0x9dbad)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x9e792)
    ==> SdbReleaseDatabase+0xcc (RVA: 0x9ea2c)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x9eaf3)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x9ec83)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0x9ef31)
    ==> SdbpGetProcessHistory+0x17b (RVA: 0xa0407)
    ==> SdbResolveDatabaseEx+0x160 (RVA: 0xa0770)
    ==> SdbInitDatabaseEx+0x78 (RVA: 0xa1af0)
    ==> SdbpCheckMatchingTextEntry+0x278 (RVA: 0xa4080)
    ==> SdbpCreateSearchDBContext+0x5e (RVA: 0xa460a)
    ==> SdbpCreateSearchDBContext+0x117 (RVA: 0xa46c3)
    ==> SdbpCreateSearchDBContext+0x244 (RVA: 0xa47f0)
    ==> SdbpCreateSearchDBContext+0x269 (RVA: 0xa4815)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0xa4b5f)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0xa50f9)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0xa58f9)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0xa6012)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0xa6191)

 [[IN]] C:\Windows\System32\aemarebackup.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2f (RVA: 0x5643)
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x12f (RVA: 0x5743)
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x15318)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x29f8b)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x9d (RVA: 0x2a019)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf1 (RVA: 0x2a06d)
    ==> AslLogCreate+0x3b (RVA: 0x2aeb3)
    ==> AslLogCreate+0x7c (RVA: 0x2aef4)
    ==> AslLogCreate+0xa6 (RVA: 0x2af1e)
    ==> AslTelemetryFlush+0x40 (RVA: 0x2c530)
    ==> AslTelemetryFlush+0x6d (RVA: 0x2c55d)
    ==> AslTelemetryFlush+0x9a (RVA: 0x2c58a)
    ==> AslTelemetryFlush+0xbd (RVA: 0x2c5ad)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x2c5d0)
    ==> AslTelemetryFlush+0x103 (RVA: 0x2c5f3)
    ==> AslTelemetryFlush+0x123 (RVA: 0x2c613)
    ==> AslTelemetryFlush+0x142 (RVA: 0x2c632)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x2c697)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x2d2a1)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x2d3b0)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x2d401)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0x2d6e0)
    ==> AslRegistryGetString+0xb4 (RVA: 0x2dba0)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x2dd7e)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x2de3a)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x2dfaa)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x2f041)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x2f075)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x2f342)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x2f9d1)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x2fa12)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x30558)
    ==> AslStringDuplicateA+0x91 (RVA: 0x306c9)
    ==> AslStringDuplicate+0xb5 (RVA: 0x308d1)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x30a28)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x3116a)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x315f1)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x3219d)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x326ab)
    ==> AslFileMappingCreate+0x5e (RVA: 0x32a1e)
    ==> AslFileAttributeToString+0x57 (RVA: 0x33c23)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x34653)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x34f9a)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x37a60)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x24 (RVA: 0x52f9c)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x7b (RVA: 0x52ff3)
    ==> ?ReadSavedSettingsFromRegistry@OneSettingsQuery@Telemetry@Base@OneCore@@AEAAJXZ+0x13c (RVA: 0x54be0)
    ==> ?ParseJsonResult@OneSettingsQuery@Telemetry@Base@OneCore@@AEAAJPEAD@Z+0xe9 (RVA: 0x54e71)
    ==> ?ReadJsonObjectAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonKeyValuePair@@@@@Z+0x5b (RVA: 0x583cf)
    ==> ?ReadJsonObjectAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonKeyValuePair@@@@@Z+0xc1 (RVA: 0x58435)
    ==> ?ReadJsonValueListAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonValue@@@@@Z+0x54 (RVA: 0x589e0)
    ==> ?ReadJsonValueListAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonValue@@@@@Z+0xb8 (RVA: 0x58a44)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x58c57)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8e (RVA: 0x5d68e)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x4b (RVA: 0x5dcbb)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x119 (RVA: 0x5dd89)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x335 (RVA: 0x5e3d5)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x279 (RVA: 0x5e7a9)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3e9 (RVA: 0x5e919)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x562 (RVA: 0x5ea92)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd8 (RVA: 0x5f848)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x8ea (RVA: 0x6095a)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x9eb (RVA: 0x60a5b)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xec (RVA: 0x61c30)

 [[IN]] C:\Windows\System32\aepic.dll
    ==> AslFileMappingCreate+0x5f (RVA: 0x56af)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8e (RVA: 0x5ae2)
    ==> AslpFileGetVersionBlock+0x1c6 (RVA: 0x668e)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xef (RVA: 0x7b1b)
    ==> ??2@YAPEAX_K@Z+0x36 (RVA: 0x11c22)
    ==> ?_New_node@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@AEAAPEAV_Node_base@23@W4_Node_type@23@@Z+0x77 (RVA: 0x11cb7)
    ==> std::tr1::_Builder<unsigned short const *,unsigned short,std::tr1::regex_traits<unsigned short> >::_Add_char_to_bitmap+0x9d (RVA: 0x11d9d)
    ==> Windows::Compat::Shared::Telemetry::TelemetryProvider::TelemetryProvider+0x16e (RVA: 0x12b1a)
    ==> AslRegistryGetStringExpand+0x7d (RVA: 0x12e01)
    ==> AslTelemetryFlush+0x2d (RVA: 0x1350d)
    ==> AslTelemetryFlush+0x57 (RVA: 0x13537)
    ==> AslTelemetryFlush+0x79 (RVA: 0x13559)
    ==> AslTelemetryFlush+0x9c (RVA: 0x1357c)
    ==> AslTelemetryFlush+0xc0 (RVA: 0x135a0)
    ==> AslTelemetryFlush+0xe4 (RVA: 0x135c4)
    ==> AslTelemetryFlush+0x101 (RVA: 0x135e1)
    ==> AslTelemetryFlush+0x11d (RVA: 0x135fd)
    ==> AslTelemetryFlush+0x19d (RVA: 0x1367d)
    ==> AslEnvBuildBasic+0x43 (RVA: 0x14a03)
    ==> AslEnvBuildBasic+0x576 (RVA: 0x14f36)
    ==> AslEnvBuildBasic+0x7e3 (RVA: 0x151a3)
    ==> AslRegistryGetString+0x85 (RVA: 0x15315)
    ==> AslStringDuplicate+0x6c (RVA: 0x1544c)
    ==> PiiFilterpAddEnvironment+0x3f (RVA: 0x1555f)
    ==> AslTelemetryCreate+0x2a (RVA: 0x15bba)
    ==> AslTelemetryCreate+0xff (RVA: 0x15c8f)
    ==> PiiFilterCreate+0xf (RVA: 0x15deb)
    ==> PiiFilterCreate+0x74 (RVA: 0x15e50)
    ==> PiiFilterCreate+0xc4 (RVA: 0x15ea0)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x1607a)
    ==> AslLogCreate+0x36 (RVA: 0x1612a)
    ==> AslLogCreate+0x71 (RVA: 0x16165)
    ==> AslStringDuplicateA+0x6d (RVA: 0x16531)
    ==> PiiFilterpAddProfiles+0x36 (RVA: 0x16b36)
    ==> PiiFilterpAddProfiles+0x5b (RVA: 0x16b5b)
    ==> AslpTelemetryAppend+0xf2 (RVA: 0x17b12)
    ==> ?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z+0xd4 (RVA: 0x180c4)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x2bcb3)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0xdf (RVA: 0x32ebf)
    ==> `std::basic_string<unsigned short,std::char_traits<unsigned short>,std::allocator<unsigned short> >::_Copy'::`1'::catch$1+0x49 (RVA: 0x34689)
    ==> 0x37cf1 (no symbol)
    ==> 0x37e62 (no symbol)
    ==> 0x38686 (no symbol)
    ==> 0x38899 (no symbol)
    ==> 0x388e2 (no symbol)
    ==> 0x38937 (no symbol)
    ==> 0x389df (no symbol)
    ==> 0x38a87 (no symbol)
    ==> 0x38b9e (no symbol)
    ==> 0x38d2a (no symbol)
    ==> 0x38d4b (no symbol)
    ==> 0x38d8e (no symbol)
    ==> 0x38df7 (no symbol)
    ==> 0x38e3e (no symbol)
    ==> 0x38edf (no symbol)
    ==> 0x38f25 (no symbol)
    ==> 0x39394 (no symbol)
    ==> 0x39487 (no symbol)
    ==> 0x3ac66 (no symbol)
    ==> 0x3baee (no symbol)
    ==> 0x3bc94 (no symbol)
    ==> 0x3c38c (no symbol)
    ==> ?CompleteItem@CDesktopAppReceiver@Inventory@System@Windows@@AEAAJXZ+0x32 (RVA: 0x4489e)
    ==> ?_Buy@?$vector@PEBVIFileInfo@Inventory@Compat@Windows@@V?$allocator@PEBVIFileInfo@Inventory@Compat@Windows@@@std@@@std@@IEAA_N_K@Z+0x5e (RVA: 0x48812)
    ==> ?reserve@?$vector@PEAUDesktopAppInfo@Inventory@System@Windows@@V?$allocator@PEAUDesktopAppInfo@Inventory@System@Windows@@@std@@@std@@QEAAX_K@Z+0x6b (RVA: 0x490a7)
    ==> ??0?$_Tree_val@V?$_Tset_traits@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@U?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@$0A@@std@@@std@@QEAA@AEBU?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@1@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@1@@Z+0x1f (RVA: 0x49533)
    ==> ??0?$_Tree_val@V?$_Tset_traits@VFile@@U?$less@VFile@@@std@@V?$allocator@VFile@@@3@$0A@@std@@@std@@QEAA@AEBU?$less@VFile@@@1@V?$allocator@VFile@@@1@@Z+0x1f (RVA: 0x495db)
    ==> ?UpdateSoftwareInventoryTC2@@YAJPEBD_N10@Z+0x69c (RVA: 0x4ab9c)
    ==> ?UpdateSoftwareInventoryTC2@@YAJPEBD_N10@Z+0x845 (RVA: 0x4ad45)
    ==> ?_Buy@?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@IEAA_N_K@Z+0x5e (RVA: 0x4b80a)
    ==> ?_Buynode@?$_Tree_val@V?$_Tset_traits@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@U?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@$0A@@std@@@std@@QEAAPEAU_Node@?$_Tree_nod@V?$_Tset_traits@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@U?$less@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@$0A@@std@@@2@XZ+0x15 (RVA: 0x4b909)
    ==> ?_Buynode@?$_Tree_val@V?$_Tset_traits@VFile@@U?$less@VFile@@@std@@V?$allocator@VFile@@@3@$0A@@std@@@std@@QEAAPEAU_Node@?$_Tree_nod@V?$_Tset_traits@VFile@@U?$less@VFile@@@std@@V?$allocator@VFile@@@3@$0A@@std@@@2@XZ+0x15 (RVA: 0x4b999)
    ==> ?reserve@?$vector@VFile@@V?$allocator@VFile@@@std@@@std@@QEAAX_K@Z+0x8c (RVA: 0x4cd60)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x4d194)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x4d1e5)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x4d3e1)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x4dabc)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x4dc88)
    ==> AslFileAttributeToString+0x57 (RVA: 0x4ded3)
    ==> PiiFilterEmbeddedPathsExecute+0x64 (RVA: 0x4f7c4)
    ==> PiiFilterEmbeddedPathsExecute+0x9c (RVA: 0x4f7fc)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x4ffb8)
    ==> ??$_Allocate@D@std@@YAPEAD_KPEAD@Z+0x1c (RVA: 0x54d78)
    ==> ??$_Insert@PEAG@?$vector@GV?$allocator@G@std@@@std@@QEAAXV?$_Vector_const_iterator@V?$_Vector_val@GV?$allocator@G@std@@@std@@@1@PEAG1Uforward_iterator_tag@1@@Z+0xbc (RVA: 0x552e0)
    ==> ??$_Insert@V?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@?$vector@GV?$allocator@G@std@@@std@@QEAAXV?$_Vector_const_iterator@V?$_Vector_val@GV?$allocator@G@std@@@std@@@1@V?$_String_iterator@GU?$char_traits@G@std@@V?$allocator@G@2@@1@1Uforward_iterator_tag@1@@Z+0xc6 (RVA: 0x554de)
    ==> ?_Add_backreference@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXI@Z+0x25 (RVA: 0x58251)
    ==> ?_Add_char_to_array@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@AEAAXG@Z+0x60 (RVA: 0x583d0)
    ==> ?_Add_class@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXXZ+0x25 (RVA: 0x5848d)
    ==> ?_Add_elts@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@AEAAXPEAV?$_Node_class@GV?$regex_traits@G@tr1@std@@@23@FAEBV?$regex_traits@G@23@@Z+0x53 (RVA: 0x5858b)
    ==> ?_Add_equiv@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXPEBG0_J@Z+0xa7 (RVA: 0x586c3)
    ==> ?_Add_rep@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXHH_N@Z+0x6c (RVA: 0x58844)
    ==> ?_Add_rep@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXHH_N@Z+0xe5 (RVA: 0x588bd)
    ==> ?_Add_str_node@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@AEAAXXZ+0x1e (RVA: 0x589ca)
    ==> ?_Begin_assert_group@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAPEAV_Node_base@23@_N@Z+0x29 (RVA: 0x58b2d)
    ==> ?_Begin_assert_group@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAPEAV_Node_base@23@_N@Z+0xa7 (RVA: 0x58bab)
    ==> ?_Begin_capture_group@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAPEAV_Node_base@23@I@Z+0x25 (RVA: 0x58cad)
    ==> ?_Begin_if@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAPEAV_Node_base@23@PEAV423@@Z+0x2f (RVA: 0x58d73)
    ==> ?_Begin_if@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAPEAV_Node_base@23@PEAV423@@Z+0xa8 (RVA: 0x58dec)
    ==> ?_Char_to_elts@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@AEAAXPEBG0_JPEAPEAU?$_Sequence@G@23@@Z+0x6a (RVA: 0x58fee)
    ==> ?_Else_if@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXPEAV_Node_base@23@0@Z+0x58 (RVA: 0x597a0)
    ==> ?_End_group@?$_Builder@PEBGGV?$regex_traits@G@tr1@std@@@tr1@std@@QEAAXPEAV_Node_base@23@@Z+0x4d (RVA: 0x59899)
    ==> ?_Getcat@?$collate@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z+0x56 (RVA: 0x59986)
    ==> ?reserve@?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@QEAAX_K@Z+0x7b (RVA: 0x5b297)
    ==> ?OnChange@Application@@UEAAKXZ+0xcd (RVA: 0x5e0fd)
    ==> ?OnRemove@Application@@UEAAKXZ+0xa3 (RVA: 0x5ed43)
    ==> ?reserve@?$vector@GV?$allocator@G@std@@@std@@QEAAX_K@Z+0x6a (RVA: 0x61206)
    ==> ?reserve@?$vector@PEBVIFileInfo@Inventory@Compat@Windows@@V?$allocator@PEBVIFileInfo@Inventory@Compat@Windows@@@std@@@std@@QEAAX_K@Z+0x6b (RVA: 0x61347)
    ==> ?reserve@?$vector@VApplication@@V?$allocator@VApplication@@@std@@@std@@QEAAX_K@Z+0x89 (RVA: 0x614a9)
    ==> ??0_bstr_t@@QEAA@PEBG@Z+0x26 (RVA: 0x6450a)
    ==> ??4_bstr_t@@QEAAAEAV0@PEBG@Z+0x32 (RVA: 0x647fa)

 [[IN]] C:\Windows\System32\apphelp.dll
    ==> SE_InitializeEngine+0x70 (RVA: 0x29a0)
    ==> SeSdbProcessLayers+0x6e (RVA: 0x2ce2)
    ==> SeSdbProcessLayers+0x87 (RVA: 0x2cfb)
    ==> AslLogPublishToPeb+0x0 (RVA: 0x2fac)
    ==> AslLogCreate+0x4f (RVA: 0x30c3)
    ==> AslLogCreate+0x95 (RVA: 0x3109)
    ==> AslLogCreate+0xbf (RVA: 0x3133)
    ==> AslUnicodeStringDuplicateAsString+0x44 (RVA: 0x3988)
    ==> AslTelemetryCreate+0x8e (RVA: 0x3b1e)
    ==> AslTelemetryCreate+0x168 (RVA: 0x3bf8)
    ==> AslStringDuplicateA+0x81 (RVA: 0x3d85)
    ==> SdbInitDatabaseEx+0x78 (RVA: 0x4c78)
    ==> SdbReleaseDatabase+0x6d (RVA: 0x4ddd)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x509a)
    ==> AslFileMappingCreate+0x63 (RVA: 0x547f)
    ==> AslStringDuplicate+0x69 (RVA: 0x572d)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x5e2e)
    ==> RtlArray<_ASL_TELEMETRY_EVENT>::Initialize+0x3f (RVA: 0x5fd7)
    ==> SeQuirkManagerExecute+0x65 (RVA: 0x74a5)
    ==> SeQuirkManagerExecute+0x7c (RVA: 0x74bc)
    ==> TraceQueryResultRac+0x13c (RVA: 0x81e8)
    ==> TraceQueryResultRac+0x152 (RVA: 0x81fe)
    ==> TraceQueryResultRac+0x169 (RVA: 0x8215)
    ==> SdbQueryToLayerExeTagrefArray+0x61 (RVA: 0xa345)
    ==> SeSdbReadInEx+0x29 (RVA: 0xa691)
    ==> SdbQueryDataExTagID+0x3b (RVA: 0xb25b)
    ==> SeComRouterCreate+0x57 (RVA: 0xbf47)
    ==> SeComRouterCreate+0x78 (RVA: 0xbf68)
    ==> SeComRouterCreate+0xa8 (RVA: 0xbf98)
    ==> SeComRouterCreate+0xc6 (RVA: 0xbfb6)
    ==> SeComRouterCreate+0xfa (RVA: 0xbfea)
    ==> SeComRouterCreate+0x1ba (RVA: 0xc0aa)
    ==> SeInExCreate+0x57 (RVA: 0xc11b)
    ==> SeInExCreate+0x69 (RVA: 0xc12d)
    ==> SeInExCreate+0x91 (RVA: 0xc155)
    ==> SeInExCreate+0xaf (RVA: 0xc173)
    ==> SeModuleTrackerCreate+0x5e (RVA: 0xc3da)
    ==> SeModuleTrackerCreate+0x7f (RVA: 0xc3fb)
    ==> SeHookManagerCreate+0x55 (RVA: 0xc585)
    ==> SeHookManagerCreate+0x7f (RVA: 0xc5af)
    ==> SeHookManagerCreate+0xf6 (RVA: 0xc626)
    ==> SeHookManagerCreate+0x118 (RVA: 0xc648)
    ==> SeShimManagerCreate+0x3d (RVA: 0xc6c1)
    ==> SeShimManagerCreate+0x5d (RVA: 0xc6e1)
    ==> SeShimManagerCreate+0x7d (RVA: 0xc701)
    ==> SeShimManagerCreate+0x9b (RVA: 0xc71f)
    ==> SeQuirkManagerCreate+0x3a (RVA: 0xc79e)
    ==> SeQuirkManagerCreate+0x5a (RVA: 0xc7be)
    ==> SeFlagManagerCreate+0x3a (RVA: 0xc82e)
    ==> SeFlagManagerCreate+0x5a (RVA: 0xc84e)
    ==> SE_LdrResolveDllName+0x54 (RVA: 0xed14)
    ==> SE_LdrResolveDllName+0x63 (RVA: 0xed23)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0xf1d8)
    ==> AslPathIsTemporaryInternetFile+0x119 (RVA: 0xf2ad)
    ==> AslFileOpen+0x44 (RVA: 0xf5d4)
    ==> AslTelemetryFlush+0x40 (RVA: 0x10128)
    ==> AslTelemetryFlush+0x6d (RVA: 0x10155)
    ==> AslTelemetryFlush+0x96 (RVA: 0x1017e)
    ==> AslTelemetryFlush+0xb9 (RVA: 0x101a1)
    ==> AslTelemetryFlush+0xdc (RVA: 0x101c4)
    ==> AslTelemetryFlush+0xff (RVA: 0x101e7)
    ==> AslTelemetryFlush+0x11f (RVA: 0x10207)
    ==> AslTelemetryFlush+0x140 (RVA: 0x10228)
    ==> AslTelemetryFlush+0x1aa (RVA: 0x10292)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x136cf)
    ==> 0x151e2 (no symbol)
    ==> 0x151f5 (no symbol)
    ==> 0x15205 (no symbol)
    ==> 0x19af6 (no symbol)
    ==> 0x1b799 (no symbol)
    ==> 0x1dac8 (no symbol)
    ==> 0x1dbb2 (no symbol)
    ==> 0x1dd74 (no symbol)
    ==> CompatCacheLookupDll+0x25 (RVA: 0x20e29)
    ==> SdbDeclareIndexEx+0x1f4 (RVA: 0x21db4)
    ==> SdbQueryResultsToMiniDb+0x35 (RVA: 0x22145)
    ==> SdbWriteBinaryTagFromFile+0xc2 (RVA: 0x229d2)
    ==> SdbpCreateDatabaseInMemory+0x6 (RVA: 0x233d6)
    ==> SdbpWriteBufferedData+0x68 (RVA: 0x23770)
    ==> SdbGetMatchingExeEx+0x1bb (RVA: 0x23ff3)
    ==> SdbPackCmdLineInfo+0x55 (RVA: 0x245ad)
    ==> SdbpGetFlagCmdLine+0xd5 (RVA: 0x25529)
    ==> SdbpGetProcessHistory+0x146 (RVA: 0x25b86)
    ==> SdbCreateHelpCenterURL+0x112 (RVA: 0x264d2)
    ==> SdbCreateHelpCenterURL+0x1da (RVA: 0x2659a)
    ==> SdbCreateHelpCenterURL+0x2b0 (RVA: 0x26670)
    ==> SdbCreateHelpCenterURL+0x352 (RVA: 0x26712)
    ==> SdbCreateURL+0xba (RVA: 0x269fa)
    ==> SdbOpenApphelpInformation+0x124 (RVA: 0x26f94)
    ==> SdbOpenApphelpInformationByID+0x2a (RVA: 0x270da)
    ==> SdbpAddResourceStringToTable+0x6b (RVA: 0x27f0b)
    ==> SdbpAddStringTableToPDB+0xe7 (RVA: 0x280db)
    ==> SdbpAddStringTableToPDB+0x208 (RVA: 0x281fc)
    ==> SdbpEscapeQuoteInMsg+0x58 (RVA: 0x287a4)
    ==> SdbGetDatabaseVersion+0x2a (RVA: 0x2adda)
    ==> SdbInitDatabaseInMemory+0xf (RVA: 0x2af4f)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x2b0df)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x2b2ff)
    ==> SdbCreateMsiTransformFile+0x89 (RVA: 0x2be29)
    ==> SdbRegisterDatabaseEx+0xf6 (RVA: 0x2e166)
    ==> SdbGetFileAttributes+0xe1 (RVA: 0x2ecf1)
    ==> SdbGetFileAttributes+0x17c (RVA: 0x2ed8c)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x2f091)
    ==> SdbResolveDatabaseEx+0x177 (RVA: 0x2fbdf)
    ==> SdbpCreateSDBLookupEntry+0x9a (RVA: 0x30016)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x3241e)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x32518)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x325ea)
    ==> SdbpCheckMatchingTextEntry+0x283 (RVA: 0x32acb)
    ==> SdbpCreateSearchDBContext+0x66 (RVA: 0x335b2)
    ==> SdbpCreateSearchDBContext+0x126 (RVA: 0x33672)
    ==> SdbpCreateSearchDBContext+0x1bc (RVA: 0x33708)
    ==> SdbpCreateSearchDBContext+0x23a (RVA: 0x33786)
    ==> SdbpCreateSearchDBContext+0x264 (RVA: 0x337b0)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x33b7f)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x340a5)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x34a0d)
    ==> SdbGrabMatchingInfoEx+0xe9 (RVA: 0x35369)
    ==> SdbpGrabMatchingInfoDir+0x95 (RVA: 0x35779)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x36a6e)
    ==> SdbpWriteCompressedDatabase+0x144 (RVA: 0x36ccc)
    ==> ParseCobaltModFlagsFromQueryResult+0x257 (RVA: 0x38e3f)
    ==> SE_COM_AddServer+0x49 (RVA: 0x39629)
    ==> ?AddDeviceGuid@NS_PrivLogMicrophone@@YAXAEAU_GUID@@@Z+0x58 (RVA: 0x3cc14)
    ==> ?AddDeviceGuid@NS_PrivLogMicrophone@@YAXAEAU_GUID@@@Z+0x7f (RVA: 0x3cc3b)
    ==> LUMakeModuleUnloadLast+0x0 (RVA: 0x418f8)
    ==> AslEnvBuildBasic+0x32 (RVA: 0x451de)
    ==> AslEnvBuildBasic+0xd40 (RVA: 0x45eec)
    ==> AslEnvBuildBasic+0x1295 (RVA: 0x46441)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x468ee)
    ==> AslFileMappingCreateFromImageView+0x4d (RVA: 0x474b5)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x47d1d)
    ==> AslHashAddString+0x62 (RVA: 0x47f66)
    ==> AslHashCreateEx+0x42 (RVA: 0x4808e)
    ==> AslHashCreateEx+0xd1 (RVA: 0x4811d)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x199 (RVA: 0x48555)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1b8 (RVA: 0x4882c)
    ==> AslPathWildcardFindFirst+0x119 (RVA: 0x49219)
    ==> AslPathWildcardFindFirst+0x1ff (RVA: 0x492ff)
    ==> AslPathWildcardFindFirst+0x26a (RVA: 0x4936a)
    ==> AslPathWildcardFindNext+0x9c (RVA: 0x49738)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x4a14c)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x4a318)
    ==> AslRegistryGetString+0xb4 (RVA: 0x4a52c)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x4a70a)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x4a7c6)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x4aab4)
    ==> AslStringReplace+0x106 (RVA: 0x4afbe)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x4b443)
    ==> AslpAllocMatchNode+0xf (RVA: 0x4b6b7)
    ==> AslpFileGetVersionBlock+0x468 (RVA: 0x4d500)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x4de14)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x4f048)
    ==> AslpProcessMatchRegNode+0x9e (RVA: 0x4f57a)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x500d5)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0x50356)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0x50388)
    ==> AslTelemetryTrackError+0x4c (RVA: 0x50bdc)
    ==> AslTelemetryTrackError+0x9d (RVA: 0x50c2d)
    ==> AslTelemetryTrackErrorLean+0x78 (RVA: 0x50de8)
    ==> AslTelemetryTrackErrorLean+0xa8 (RVA: 0x50e18)
    ==> AslTelemetryTrackErrorLean+0xd5 (RVA: 0x50e45)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x5161a)
    ==> PiiFilterCreate+0xf (RVA: 0x516ef)
    ==> PiiFilterCreate+0x7a (RVA: 0x5175a)
    ==> PiiFilterCreate+0xca (RVA: 0x517aa)
    ==> PiiFilterEmbeddedPathsExecute+0x62 (RVA: 0x51886)
    ==> PiiFilterEmbeddedPathsExecute+0x99 (RVA: 0x518bd)

 [[IN]] C:\Windows\System32\appidsvc.dll
    ==> MIDL_user_free+0x0 (RVA: 0xa4a0)

 [[IN]] C:\Windows\System32\AppLockerCSP.dll
    ==> ??1?$unique_ptr@$$BY0A@EU?$Deleter@Uaifree_tag@release@@@release@@@std@@QEAA@XZ+0x0 (RVA: 0x9ca0)

 [[IN]] C:\Windows\System32\AppManagementConfiguration.dll
    ==> RVA: .text+0x6b41

 [[IN]] C:\Windows\System32\appraiser.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x18453)
    ==> AslTelemetryCreate+0x32 (RVA: 0x189f6)
    ==> AslTelemetryFlush+0x40 (RVA: 0x18d2c)
    ==> AslTelemetryFlush+0x6d (RVA: 0x18d59)
    ==> AslTelemetryFlush+0x9a (RVA: 0x18d86)
    ==> AslTelemetryFlush+0xbd (RVA: 0x18da9)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x18dcc)
    ==> AslTelemetryFlush+0x103 (RVA: 0x18def)
    ==> AslTelemetryFlush+0x123 (RVA: 0x18e0f)
    ==> AslTelemetryFlush+0x142 (RVA: 0x18e2e)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x18e93)
    ==> AslpTelemetryProcessError+0xd1 (RVA: 0x19aa9)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x19bbc)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x19c0d)
    ==> AslRegistryGetString+0xb4 (RVA: 0x1a6c4)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x1a8a2)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x1a95e)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x1aace)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x1ac14)
    ==> AslLogCreate+0x36 (RVA: 0x1bd4e)
    ==> AslLogCreate+0x77 (RVA: 0x1bd8f)
    ==> AslLogCreate+0xa1 (RVA: 0x1bdb9)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x1cb39)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x1cb6d)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x1ce3a)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x1d4d1)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x1d512)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x1db65)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x1de10)
    ==> AslStringDuplicateA+0x96 (RVA: 0x1df86)
    ==> AslStringDuplicate+0xb5 (RVA: 0x1e18d)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x1e33c)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x1e4bf)
    ==> AslPathWildcardFindFirst+0xed (RVA: 0x1f791)
    ==> AslPathWildcardFindFirst+0x1d8 (RVA: 0x1f87c)
    ==> AslPathWildcardFindNext+0x84 (RVA: 0x1fc90)
    ==> AslpPathWildcardAllocMatchNode+0x90 (RVA: 0x20714)
    ==> AslpAllocMatchNode+0xf (RVA: 0x20b1b)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0x20d10)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x21902)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x21d89)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x22935)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x22e43)
    ==> AslFileMappingCreate+0x55 (RVA: 0x23451)
    ==> AslFileAttributeToString+0x57 (RVA: 0x2464f)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x2507f)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x259c6)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x2848c)
    ==> ?WriteLogV@Appraiser@Compat@Windows@@YAX_NKPEBD1J1PEAD@Z+0x298 (RVA: 0x2cb48)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0xd5e4f)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0xd6b72)
    ==> SdbpWriteCompressedDatabase+0x144 (RVA: 0xd6e0c)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0xd8ad1)
    ==> SdbInitDatabaseEx+0x7c (RVA: 0xd934c)
    ==> SdbpCreateSearchDBContextForApp+0x45 (RVA: 0xd9df1)
    ==> SdbpCreateSearchDBContextForApp+0xe0 (RVA: 0xd9e8c)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0xd9fdc)
    ==> SdbpCreateSearchDBContext+0x114 (RVA: 0xda090)
    ==> SdbpCreateSearchDBContext+0x20d (RVA: 0xda189)
    ==> SdbpCreateSearchDBContext+0x23a (RVA: 0xda1b6)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0xda2dd)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0xda82f)
    ==> SdbpCheckMatchingRegistryValue+0xd5 (RVA: 0xdae15)
    ==> SdbpCheckMatchingRegistryValue+0x1cf (RVA: 0xdaf0f)
    ==> SdbpCheckMatchingRegistryValue+0x2a1 (RVA: 0xdafe1)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0xdb129)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0xdb7b7)
    ==> SdbpCheckMatchingTextEntry+0x230 (RVA: 0xdbb50)
    ==> SdbpRetrieveBackupApplicationAttributes+0xe6 (RVA: 0xddab6)
    ==> SdbpRetrieveBackupApplicationAttributes+0x19d (RVA: 0xddb6d)
    ==> SdbpRetrieveBackupApplicationAttributes+0x40a (RVA: 0xdddda)
    ==> SdbpRetrieveBackupApplicationAttributes+0x58c (RVA: 0xddf5c)
    ==> SdbReleaseDatabase+0xde (RVA: 0xde80a)
    ==> SdbDuplicateSdbHandle+0x53 (RVA: 0xde883)
    ==> SdbOpenDatabaseEx+0x5f (RVA: 0xdee97)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0xdf0bc)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0xdf553)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0xe0771)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0xe1949)
    ==> SdbpWriteBufferedData+0x68 (RVA: 0xe1c00)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x102023)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0x1764c7)
    ==> AslPathIsTemporaryInternetFile+0x41 (RVA: 0x176795)
    ==> AslPathIsTemporaryInternetFile+0x169 (RVA: 0x1768bd)
    ==> AslPathIsTemporaryInternetFile+0x203 (RVA: 0x176957)
    ==> AslPathIsTemporaryInternetFile+0x336 (RVA: 0x176a8a)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x1c0 (RVA: 0x176dec)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1f4 (RVA: 0x1770fc)
    ==> SdbCustomDbRegInfoEnumerate+0x36a (RVA: 0x178042)
    ==> SdbFileInfoGet+0x77 (RVA: 0x1784a3)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8e (RVA: 0x17b41a)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x327 (RVA: 0x17bf17)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x28e (RVA: 0x17c2fe)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3fe (RVA: 0x17c46e)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x577 (RVA: 0x17c5e7)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd8 (RVA: 0x17d3a8)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x8dc (RVA: 0x17e4bc)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x9e8 (RVA: 0x17e5c8)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xec (RVA: 0x17f73c)

 [[IN]] C:\Windows\System32\AppReadiness.dll
    ==> ?EnableLogging@Logging@AppReadiness@@YAXXZ+0xe1 (RVA: 0x4cd3d)

 [[IN]] C:\Windows\System32\appsruprov.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x21310)
    ==> MIDL_user_free+0x0 (RVA: 0x21340)

 [[IN]] C:\Windows\System32\AppVEntSubsystems64.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x1226ee)
    ==> __acrt_get_begin_thread_init_policy+0x19 (RVA: 0x128c01)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x128c4c)

 [[IN]] C:\Windows\System32\AppxAllUserStore.dll
    ==> ?CommonHeapReAllocDefault@@YAJPEAX_K1PEAPEAX@Z+0x5b (RVA: 0x738b)
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x45 (RVA: 0x35571)

 [[IN]] C:\Windows\System32\AppXDeploymentClient.dll
    ==> Common::ReportFatalException+0x45 (RVA: 0x7f39d)

 [[IN]] C:\Windows\System32\AppXDeploymentExtensions.desktop.dll
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x3d (RVA: 0xca75d)

 [[IN]] C:\Windows\System32\AppXDeploymentExtensions.onecore.dll
    ==> <lambda_54a1c1f1be6defad31f3425c2822efbe>::operator()+0x3d7 (RVA: 0x964af)
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x3d (RVA: 0x13c8f5)
    ==> ?CoCreateInstanceInSessionHelper@Deployment@Common@@YAJKAEBU_GUID@@K0PEAPEAX@Z+0x12 (RVA: 0x15a01a)

 [[IN]] C:\Windows\System32\AppXDeploymentServer.dll
    ==> RVA: .text+0xa2479
    ==> RVA: .text+0xe2cf6

 [[IN]] C:\Windows\System32\AppxPackaging.dll
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x3d (RVA: 0xb60f5)

 [[IN]] C:\Windows\System32\AppxSip.dll
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x3d (RVA: 0x35bf1)

 [[IN]] C:\Windows\System32\AppxSysprep.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x1074c)
    ==> ?ReAlloc@GlobalHeap@Common@@SAJPEAX_KPEAPEAX@Z+0x18 (RVA: 0x107a4)
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x45 (RVA: 0x10859)

 [[IN]] C:\Windows\System32\AsIO2.dll
    ==> RVA: .text+0x6fb6
    ==> RVA: .text+0x8678

 [[IN]] C:\Windows\System32\AsIO3.dll
    ==> RVA: .text+0x33ada
    ==> RVA: .text+0x41465
    ==> RVA: .text+0x414ac

 [[IN]] C:\Windows\System32\AssignedAccessCsp.dll
    ==> ?IsFeatureEnabled@LicenseHelper@AssignedAccess@Internal@Windows@@SA_NPEBG_N@Z+0x680 (RVA: 0x59ec)

 [[IN]] C:\Windows\System32\AudioEndpointBuilder.dll
    ==> 0x22094 (no symbol)
    ==> SLGetWindowsInformationDWORD+0x644 (RVA: 0x819b0)

 [[IN]] C:\Windows\System32\AudioSes.dll
    ==> ?PerformLicenseCheck@AtmosLicenseCheck@@QEAAJXZ+0x66d (RVA: 0xe49f5)
    ==> ?ScanForInstalledSpatialAudioSubtypeAppServices@@YAJPEAUSpatialAudioFormatSubtypeInfo@@HPEA_N@Z+0x6be (RVA: 0xf0856)

 [[IN]] C:\Windows\System32\audiosrv.dll
    ==> ??0AtmosCheck@@QEAA@XZ+0x882 (RVA: 0x394a2)
    ==> 0x9134a (no symbol)
    ==> 0xa358b (no symbol)

 [[IN]] C:\Windows\System32\AudioSrvPolicyManager.dll
    ==> ?GetTsAudioProtocol@@YAIK@Z+0x68 (RVA: 0x36770)

 [[IN]] C:\Windows\System32\auditpolcore.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xb0a0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xb0d0)

 [[IN]] C:\Windows\System32\authui.dll
    ==> ?RuntimeClassInitialize@CSlideToShutDownScreen@@QEAAJXZ+0x6e (RVA: 0x114be)

 [[IN]] C:\Windows\System32\authz.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x266b0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x266e0)

 [[IN]] C:\Windows\System32\basesrv.dll
    ==> ServerDllInitialization+0x3d (RVA: 0x184d)
    ==> ServerDllInitialization+0x97 (RVA: 0x18a7)
    ==> BaseSrvLaunchProcess+0x18e (RVA: 0xb822)

 [[IN]] C:\Windows\System32\bcastdvruserservice.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xa (RVA: 0x5ecca)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x6e (RVA: 0x5ed2e)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xc2 (RVA: 0x5ed82)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0xda199)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0xda1cd)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0xda48a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0xdb0a6)
    ==> AslEnvBuildBasic+0x31 (RVA: 0xdb525)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0xdc0d1)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0xdc5df)
    ==> AslRegistryGetString+0xb4 (RVA: 0xdcc70)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0xdce4e)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0xdcf0a)
    ==> AslStringDuplicate+0xb5 (RVA: 0xdd0fd)
    ==> `dynamic atexit destructor for 'Windows::Media::Capture::Internal::TraceHelper::s_piiFilter''+0x23 (RVA: 0xe4833)

 [[IN]] C:\Windows\System32\bcrypt.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x19c20)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x19c50)

 [[IN]] C:\Windows\System32\bcryptprimitives.dll
    ==> MSCryptAlloc+0x0 (RVA: 0x138e0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x439f0)

 [[IN]] C:\Windows\System32\bdesvc.dll
    ==> 0x16740 (no symbol)

 [[IN]] C:\Windows\System32\BFE.DLL
    ==> BfeSessionCreate+0x285 (RVA: 0x8769)
    ==> WfpMemInit+0x2b (RVA: 0x23c67)

 [[IN]] C:\Windows\System32\bi.dll
    ==> BiFreeMemory+0x0 (RVA: 0x2010)
    ==> MIDL_user_allocate+0x0 (RVA: 0x2a30)

 [[IN]] C:\Windows\System32\BioCredProv.dll
    ==> ?GetInSessionUserSid@@YAJPEAPEAX@Z+0x1c (RVA: 0x23f88)
    ==> ?IsBioLogonDisallowed@@YAJPEA_NPEAPEAG@Z+0x56 (RVA: 0x24eda)

 [[IN]] C:\Windows\System32\bisrv.dll
    ==> CempHeapAllocate+0x0 (RVA: 0x16a50)
    ==> MIDL_user_free+0x0 (RVA: 0x17260)
    ==> BipMain+0x44 (RVA: 0x36c44)

 [[IN]] C:\Windows\System32\biwinrt.dll
    ==> BiRtFreeMemory+0x0 (RVA: 0xca20)
    ==> MIDL_user_allocate+0x0 (RVA: 0xcb60)

 [[IN]] C:\Windows\System32\BootMenuUX.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x39716)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x397a4)

 [[IN]] C:\Windows\System32\BrokerLib.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x1b90)
    ==> MIDL_user_free+0x0 (RVA: 0x1bc0)
    ==> std::tr1::_Ref_count_obj<Broker::BILayer::WnfNotification>::_Destroy+0x12 (RVA: 0x11302)

 [[IN]] C:\Windows\System32\cabapi.dll
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x39 (RVA: 0xf419)

 [[IN]] C:\Windows\System32\capauthz.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x2f0e6)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x2f174)

 [[IN]] C:\Windows\System32\catsrvut.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x17de0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x17e10)

 [[IN]] C:\Windows\System32\cdp.dll
    ==> cdp::GetCurrentUserContextToken+0x25 (RVA: 0xb0f1)

 [[IN]] C:\Windows\System32\cdprt.dll
    ==> ?GetCurrentUserContextToken@cdp@@YAJAEA_K@Z+0x24 (RVA: 0x107ab8)

 [[IN]] C:\Windows\System32\cdpsvc.dll
    ==> ?GetCurrentUserContextToken@cdp@@YAJAEA_K@Z+0x25 (RVA: 0x37a75)

 [[IN]] C:\Windows\System32\cdpusersvc.dll
    ==> cdp::GetCurrentUserContextToken+0x28 (RVA: 0x8c58)

 [[IN]] C:\Windows\System32\cfgmgr32.dll
    ==> GetClientLogonId+0x46 (RVA: 0x766e)
    ==> CMP_WaitNoPendingInstallEvents+0xb4 (RVA: 0x11b74)

 [[IN]] C:\Windows\System32\cflapi.dll
    ==> ?SetupAuthEnvironment@CflApi@@YAJPEAPEAEPEAK@Z+0x7e (RVA: 0xa79e)

 [[IN]] C:\Windows\System32\clbcatq.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x6a790)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x6a7c0)

 [[IN]] C:\Windows\System32\cldapi.dll
    ==> CfExecute+0x272 (RVA: 0xb1d2)
    ==> TlmInitializeFirstRunExpStatus+0x19 (RVA: 0xf9c9)
    ==> TlmiUpdateFirstRunExpStatus+0x2d (RVA: 0xfd89)
    ==> TlmiRunawayHydrationWorker+0x4d (RVA: 0x107ad)
    ==> TlmiHydrationPerformanceWorker+0x4b (RVA: 0x10deb)
    ==> TlmLogApiReliability+0x73 (RVA: 0x117bf)
    ==> TlmLogSyncProcessCallback+0x74 (RVA: 0x12340)
    ==> TlmInitialize+0xa7 (RVA: 0x13177)

 [[IN]] C:\Windows\System32\ClipSVC.dll
    ==> RVA: .text+0x57c4
    ==> RVA: .text+0xc0de0
    ==> RVA: .text+0xc0e10

 [[IN]] C:\Windows\System32\clipwinrt.dll
    ==> ?CallSLIsWindowsGenuineLocal@@YAJPEAW4_SL_GENUINE_STATE@@@Z+0x6b8 (RVA: 0x4c5c)
    ==> ?GetSubscriptionEditionName@SubscriptionsManager@Clip@Internal@System@Windows@@UEAAJPEAPEAUHSTRING__@@@Z+0xa5f6 (RVA: 0x24b66)
    ==> ?GetSubscriptionPFN@?$CSubscriptionStatusT@VCEmptyType@@@@SAJPEAPEAG@Z+0x1167 (RVA: 0x2eb0b)
    ==> ??$CreateActivationFactory@V?$SimpleSealedActivationFactory@VActivationManager@Clip@Internal@System@Windows@@$0A@@WRL@Microsoft@@@Details@WRL@Microsoft@@YAJPEAIPEBUCreatorMap@012@AEBU_GUID@@PEAPEAUIUnknown@@@Z+0x112 (RVA: 0x41f52)

 [[IN]] C:\Windows\System32\cloudAP.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x613b0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x613e0)

 [[IN]] C:\Windows\System32\CloudDomainJoinDataModelServer.dll
    ==> ?IsWorkstationDomainLicenseBitEnabled@@YA_NK@Z+0x666 (RVA: 0xb73a)

 [[IN]] C:\Windows\System32\CloudExperienceHost.dll
    ==> ?GetProvidersAllowedByPolicy@@YA?AW4SignInIdentityProviders@CloudExperienceHostAPI@@XZ+0x6c7 (RVA: 0x12907)

 [[IN]] C:\Windows\System32\CloudExperienceHostCommon.dll
    ==> ?get_Edition@EnvironmentDefaultImpl@@UEAAJPEAPEAUHSTRING__@@@Z+0x6b8 (RVA: 0x12a68)
    ==> ?get_IsCloudPolicyEnforced@EnvironmentDefaultImpl@@UEAAJPEAE@Z+0x674 (RVA: 0x25964)
    ==> ?GetProvidersAllowedByLicensingPolicy@SignInIdentitiesDefaultImpl@@CA?AW4SignInIdentityProviders@CloudExperienceHostAPI@@XZ+0x663 (RVA: 0x2fb3f)
    ==> ?GetContentDeliverySkuPolicy@Policy@CreativeFramework@@YA?AW4ContentDeliverySkuPolicy@?A0xa3cfba7b@@XZ+0x669 (RVA: 0x3cc95)
    ==> ?IsSpeechAllowedByPolicy@SpeechRecognitionController@Speech@CloudExperienceHostAPI@@UEAAJPEAE@Z+0xc9a (RVA: 0x7acda)
    ==> ?get_DisabledSkipNetwork@UtilStaticsCore@CloudExperienceHostAPI@@UEAAJPEAE@Z+0x6b5 (RVA: 0xa7c55)
    ==> ?GetLicensingPolicyValue@UtilStaticsCore@CloudExperienceHostAPI@@UEAAJPEAUHSTRING__@@PEAK@Z+0x680 (RVA: 0xb24d0)
    ==> ?IsAadjSupported@UtilStaticsCore@CloudExperienceHostAPI@@AEAAJPEAE@Z+0x674 (RVA: 0xbc9d4)

 [[IN]] C:\Windows\System32\clusapi.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x8a606)
    ==> __acrt_get_begin_thread_init_policy+0x19 (RVA: 0x8adc1)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x8ae0c)

 [[IN]] C:\Windows\System32\colbact.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xcff0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xd020)

 [[IN]] C:\Windows\System32\combase.dll
    ==> `dynamic initializer for 'g_hHeap''+0x0 (RVA: 0x1570)
    ==> CRpcResolver::ResolveProcessDesktopNoUser+0xf (RVA: 0x1b78b)
    ==> CRpcResolver::GetThreadWinstaDesktop+0x51 (RVA: 0x1c335)
    ==> CachedCallEvent::GetOne+0x59 (RVA: 0x35761)
    ==> ClientCall::CreateTransportCallObject+0xba (RVA: 0x3684a)
    ==> ClientCall::CreateTransportCallObject+0x467 (RVA: 0x36bf7)
    ==> CClientChannel::InitCallObject+0x6d6 (RVA: 0x37eb6)
    ==> CClientChannel::InitCallObject+0x875 (RVA: 0x38055)
    ==> ObjectLibrary::Details::AddComReferenceCounting_StandardReferenceCountingLayer<SyncServerCall,ObjectLibrary::Details::AddComReferenceCounting_ReferenceCountLayer<SyncServerCall,ObjectLibrary::Details::Allocation_SealedClassDeleteSelfLayer<SyncServerCall,ObjectLibrary::Details::MixinBase<SyncServerCall,ObjectLibrary::Details::Mixins_BaseForwarderLayer<ObjectLibrary::ForwardedBases<StandardComServerCall> > > > > >::Release+0x76 (RVA: 0x39ed6)
    ==> CAsyncCall::GetAllocationLookaside+0x12 (RVA: 0x3a042)
    ==> DisableAllCallObjectCaching+0x38 (RVA: 0x3a118)
    ==> CSyncClientCall::GetAllocationLookaside+0x12 (RVA: 0x3cc92)
    ==> ICoGetClassObject+0x4e8 (RVA: 0x41288)
    ==> ICoCreateInstanceEx+0x51c (RVA: 0x41d5c)
    ==> CompatCacheIsComHooked+0x0 (RVA: 0x441c4)
    ==> CStaticMarshaler::MarshalInterface+0x40 (RVA: 0x64cf0)
    ==> IsValidInterface+0x5 (RVA: 0x6a43d)
    ==> CCliModalLoop::HandleWakeForMsg+0x179 (RVA: 0x79e8d)
    ==> utGetAppIdForModule+0x49 (RVA: 0x8145d)
    ==> EventPoolEntry::WaitForReaderEvent+0x1a (RVA: 0x874c2)
    ==> EventPoolEntry::WaitForWriterEvent+0x5d (RVA: 0x87575)
    ==> NdrExtInterfacePointerUnmarshall+0x121 (RVA: 0xb68a1)
    ==> ComVerifierSettings::ComVerifierSettings+0x1d (RVA: 0xb7ba5)
    ==> Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCompletion+0x84 (RVA: 0xb85d4)
    ==> Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCompletion+0xde (RVA: 0xb862e)
    ==> Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCreation+0xe7 (RVA: 0xb8767)
    ==> Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::TraceOperationCreation+0x14f (RVA: 0xb87cf)
    ==> IUpdateResolverBindings+0x18 (RVA: 0xbb590)
    ==> CStaticMarshaler::GetMarshalSizeMax+0x6c (RVA: 0xc0e6c)
    ==> CFreeMarshaler::DisconnectObject+0x30 (RVA: 0xd55b0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xd5e80)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xd5eb0)
    ==> FeatureDevelopmentProperties::GetDefaultOverride<enum FeatureDevelopmentProperties::BoolProperty,FeatureDevelopmentProperties::<unnamed-type-g_boolPropertyDefaultOverrideRecords>,2>+0x93 (RVA: 0xd6737)
    ==> AddRestrictedSidInCoInitializeSecurity+0x0 (RVA: 0xe5ba0)
    ==> ImagePath::GetFileName+0xa (RVA: 0xe8872)
    ==> 0x14fa7e (no symbol)
    ==> 0x15071e (no symbol)
    ==> 0x150995 (no symbol)
    ==> 0x18540a (no symbol)
    ==> 0x1875b9 (no symbol)
    ==> ObjectLibrary::Details::LogicalError+0x1c (RVA: 0x19571c)
    ==> CSuspendMonitor::Start+0x3e (RVA: 0x1c8dce)
    ==> FeatureDevelopmentProperties::OpenPerExeSubkey+0x21 (RVA: 0x20fb41)

 [[IN]] C:\Windows\System32\comdlg32.dll
    ==> CFileOpenSave::_MapFolderToPreferredLocation+0x242 (RVA: 0xd372)

 [[IN]] C:\Windows\System32\coml2.dll
    ==> `dynamic initializer for 'g_hHeap''+0x0 (RVA: 0x10b0)
    ==> CFileStream::Init_GetNtOpenFlags+0xe8 (RVA: 0x1d188)
    ==> IsValidInterface+0x5 (RVA: 0x22291)
    ==> `IsValidStgInterface'::`1'::filt$0+0x5 (RVA: 0x24845)
    ==> `CheckName'::`1'::filt$0+0x5 (RVA: 0x24875)
    ==> StgGetIFillLockBytesOnFile+0x13 (RVA: 0x54e23)
    ==> StgGetIFillLockBytesOnILockBytes+0xf (RVA: 0x54fbf)
    ==> StgOpenAsyncDocfileOnIFillLockBytes+0x1b (RVA: 0x5509b)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x59a20)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x59a50)

 [[IN]] C:\Windows\System32\compatrel\acmigration.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x32 (RVA: 0x871e)
    ==> ?CheckMatchingText@@YA_N_KAEBU_FileAttributesStrs@@@Z+0x175 (RVA: 0x1100d)
    ==> ?CheckMatchingText@@YA_N_KAEBU_FileAttributesStrs@@@Z+0x25b (RVA: 0x110f3)
    ==> ?GetWStringFromStringStream@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AEAV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@2@W4_Encoding@@@Z+0x109 (RVA: 0x1b4a9)
    ==> ?GetWStringFromStringStream@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AEAV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@2@W4_Encoding@@@Z+0x1b4 (RVA: 0x1b554)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x906 (RVA: 0x1bec6)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x1228 (RVA: 0x1c7e8)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x1971 (RVA: 0x1cf31)
    ==> ?InboxUtilityMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x19dd (RVA: 0x1cf9d)
    ==> ?InventoryMatchingPlugin@@YAHPEAHPEAXPEAU_DB@@KKPEBG1@Z+0x173 (RVA: 0x1e3a3)
    ==> <lambda_7d2b954ce3991a02628587bf12cb1b82>::operator()+0x531 (RVA: 0x1ea49)
    ==> ?SampleGenerateMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x2deaf)
    ==> ?MigrateVCRuntimeEmptyMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x2fbbf)
    ==> ?RealCloudPlayerMigXml@@YAJPEAPEAGPEBGPEAX@Z+0xf (RVA: 0x304cf)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xc85 (RVA: 0x359ad)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xd9c (RVA: 0x35ac4)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0xec6 (RVA: 0x35bee)
    ==> ?ParseCommandLine@@YAHPEBGPEAU_GenericSetRegBeforeUpgREG1@@@Z+0x1051 (RVA: 0x35d79)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x136 (RVA: 0x36426)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x295 (RVA: 0x36585)
    ==> ?GenericSetRegBeforeUpgMigrationShimCollect@@YAJPEAHPEBG1PEAX@Z+0x2b9 (RVA: 0x365a9)
    ==> <lambda_d36eafcd468222f69638f564e6dc5740>::operator()+0x145 (RVA: 0x36e0d)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x449af)
    ==> AslTelemetryFlush+0x177 (RVA: 0x44e0b)
    ==> AslTelemetryFlush+0x1af (RVA: 0x44e43)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x45922)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x45a30)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x45a81)
    ==> AslRegistryGetString+0xb4 (RVA: 0x46218)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x463f6)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x464b2)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x46622)
    ==> AslLogCreate+0x37 (RVA: 0x475e7)
    ==> AslLogCreate+0x82 (RVA: 0x47632)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x48209)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x484b4)
    ==> AslStringDuplicateA+0x93 (RVA: 0x48627)
    ==> AslStringDuplicate+0xb8 (RVA: 0x48834)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x489e8)
    ==> AslFileMappingCreate+0x5e (RVA: 0x48ea2)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x4a64f)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x4d309)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x4d33d)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x4d60a)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0x4d8d9)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0x4d91a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x4e112)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x4f145)
    ==> AslEnvBuildBasic+0x10e6 (RVA: 0x4f64e)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x4fdd7)
    ==> SdbOpenDatabaseEx+0x4f (RVA: 0x511c7)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x513a3)
    ==> SdbRegisterDatabaseEx+0xf7 (RVA: 0x5233b)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x52cea)
    ==> ?AcmEngineCreate@@YAJPEAPEAX@Z+0x35 (RVA: 0x52e85)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0x23 (RVA: 0x52f73)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0xc6 (RVA: 0x53016)
    ==> ?AcmEngineGetCapabilityList@@YAJPEAPEBQEBGPEAKPEAX@Z+0x16c (RVA: 0x530bc)

 [[IN]] C:\Windows\System32\compatrel\aeinv.dll
    ==> AslRegistryBuildMachinePath+0x63 (RVA: 0x5cf3)
    ==> AslTelemetryCreate+0x2b (RVA: 0x5e6b)
    ==> AslTelemetryCreate+0x15f (RVA: 0x5f9f)
    ==> AslTelemetryCreate+0x350 (RVA: 0x6190)
    ==> AslTelemetryCreate+0x42d (RVA: 0x626d)
    ==> AslLogCreate+0x37 (RVA: 0x66ef)
    ==> AslLogCreate+0x82 (RVA: 0x673a)
    ==> AslLogCreate+0xac (RVA: 0x6764)
    ==> AslpTelemetryProcessError+0xc7 (RVA: 0x10823)
    ==> AslRegistryGetString+0xb4 (RVA: 0x10c80)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x10e52)
    ==> AslRegistryGetStringExpand+0x159 (RVA: 0x10f05)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x116c9)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2d (RVA: 0x11939)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5f (RVA: 0x1196b)
    ==> PiiFilterCreate+0xf (RVA: 0x11cdf)
    ==> PiiFilterCreate+0x76 (RVA: 0x11d46)
    ==> PiiFilterCreate+0xca (RVA: 0x11d9a)
    ==> PiiFilterEmbeddedPathsExecute+0x65 (RVA: 0x11eb9)
    ==> PiiFilterEmbeddedPathsExecute+0xa1 (RVA: 0x11ef5)
    ==> AslPathWildcardFindFirst+0x116 (RVA: 0x128ae)
    ==> AslPathWildcardFindFirst+0x1fe (RVA: 0x12996)
    ==> AslPathWildcardFindFirst+0x277 (RVA: 0x12a0f)
    ==> AslPathWildcardFindNext+0x9d (RVA: 0x12dd9)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x13a1c)
    ==> AslpAllocMatchNode+0xf (RVA: 0x13b63)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x13d70)
    ==> AslpProcessMatchRegNode+0x9b (RVA: 0x142a3)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x14fa1)
    ==> AslEnvBuildBasic+0xbda (RVA: 0x15b4a)
    ==> AslEnvBuildBasic+0x10b9 (RVA: 0x16029)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0xdf (RVA: 0x37997)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x517a6)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x518a0)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x51972)
    ==> AslTelemetryFlush+0x40 (RVA: 0x5e830)
    ==> AslTelemetryFlush+0x6d (RVA: 0x5e85d)
    ==> AslTelemetryFlush+0x93 (RVA: 0x5e883)
    ==> AslTelemetryFlush+0xb6 (RVA: 0x5e8a6)
    ==> AslTelemetryFlush+0xd9 (RVA: 0x5e8c9)
    ==> AslTelemetryFlush+0xf9 (RVA: 0x5e8e9)
    ==> AslTelemetryFlush+0x116 (RVA: 0x5e906)
    ==> AslTelemetryFlush+0x135 (RVA: 0x5e925)
    ==> AslTelemetryFlush+0x18d (RVA: 0x5e97d)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x5f030)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x5f081)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x5f4cc)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x60269)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x6043c)
    ==> AslStringDuplicate+0x7d (RVA: 0x60599)
    ==> AslStringUpcaseToMultiByteN+0x3b (RVA: 0x60803)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x615ee)
    ==> AslFileMappingCreate+0x5f (RVA: 0x62087)
    ==> AslFileAttributeToString+0x57 (RVA: 0x63323)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x64f8c)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x667bb)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x460 (RVA: 0x79fb0)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x523 (RVA: 0x7a073)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc2 (RVA: 0x7b5c2)
    ==> ?FaddpAddFilesFromImportTables@@YAJ_KPEAU_FADD_FRAMEWORK_RETRIEVAL_STATE@@@Z+0x14 (RVA: 0x88800)
    ==> ?FaddpAllocInitContextData@@YAJPEAPEAU_FADD_CONTEXT_DATA@@@Z+0xf (RVA: 0x88f6b)
    ==> ?Initialize@?$RtlArray@URTL_STRING_ITEM@RtlStringArray@@@@QEAAJPEAX_K1H@Z+0x31 (RVA: 0x8a399)
    ==> ?InitializeFromBuffer@RtlMemoryStream@@QEAAJQEAX_K@Z+0x4a (RVA: 0x8a412)
    ==> FaddExecute+0x168 (RVA: 0x8a79c)
    ==> FaddExecute+0x201 (RVA: 0x8a835)
    ==> FaddExecute+0x24a (RVA: 0x8a87e)
    ==> FaddLoadFromBuffer+0x18 (RVA: 0x8ae60)
    ==> FaddLoadFromBuffer+0x241 (RVA: 0x8b089)
    ==> FaddLoadFromBuffer+0x2b4 (RVA: 0x8b0fc)
    ==> FaddSaveToBuffer+0x1d (RVA: 0x8b1f9)
    ==> FaddSaveToBuffer+0xad (RVA: 0x8b289)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x8be6e)
    ==> SdbReleaseDatabase+0xcc (RVA: 0x8c108)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x8c1cf)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x8c35f)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0x8c611)
    ==> SdbpGetProcessHistory+0x17b (RVA: 0x8dae7)
    ==> SdbResolveDatabaseEx+0x160 (RVA: 0x8de50)
    ==> SdbInitDatabaseEx+0x43 (RVA: 0x8f1eb)
    ==> SdbpCheckMatchingTextEntry+0x278 (RVA: 0x91760)
    ==> SdbpCreateSearchDBContext+0x5e (RVA: 0x91aba)
    ==> SdbpCreateSearchDBContext+0x117 (RVA: 0x91b73)
    ==> SdbpCreateSearchDBContext+0x244 (RVA: 0x91ca0)
    ==> SdbpCreateSearchDBContext+0x269 (RVA: 0x91cc5)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x92007)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x925a1)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x92d11)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x9342a)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x935a9)

 [[IN]] C:\Windows\System32\compatrel\aemarebackup.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x32 (RVA: 0x4d96)
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x132 (RVA: 0x4e96)
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0xc820)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x2bbfb)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x9d (RVA: 0x2bc89)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf1 (RVA: 0x2bcdd)
    ==> AslLogCreate+0x37 (RVA: 0x2cd33)
    ==> AslLogCreate+0x82 (RVA: 0x2cd7e)
    ==> AslLogCreate+0xac (RVA: 0x2cda8)
    ==> AslTelemetryFlush+0x40 (RVA: 0x2df74)
    ==> AslTelemetryFlush+0x6d (RVA: 0x2dfa1)
    ==> AslTelemetryFlush+0x9a (RVA: 0x2dfce)
    ==> AslTelemetryFlush+0xbd (RVA: 0x2dff1)
    ==> AslTelemetryFlush+0xdd (RVA: 0x2e011)
    ==> AslTelemetryFlush+0xfa (RVA: 0x2e02e)
    ==> AslTelemetryFlush+0x117 (RVA: 0x2e04b)
    ==> AslTelemetryFlush+0x136 (RVA: 0x2e06a)
    ==> AslTelemetryFlush+0x192 (RVA: 0x2e0c6)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x2ebad)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x2ecbc)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x2ed0d)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0x2efec)
    ==> AslRegistryGetString+0xb4 (RVA: 0x2f478)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x2f656)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x2f712)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x2f882)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x3091d)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x30951)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x30c1e)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0x312b1)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0x312f2)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x32620)
    ==> AslStringDuplicateA+0x93 (RVA: 0x32793)
    ==> AslStringDuplicate+0xb8 (RVA: 0x329a0)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x32af8)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x331c2)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x33649)
    ==> AslEnvBuildBasic+0xbea (RVA: 0x34202)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0x34720)
    ==> AslFileMappingCreate+0x5e (RVA: 0x34a92)
    ==> AslFileAttributeToString+0x57 (RVA: 0x35bcb)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x365ab)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x38bb3)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x24 (RVA: 0x54650)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x7b (RVA: 0x546a7)
    ==> ?ReadSavedSettingsFromRegistry@OneSettingsQuery@Telemetry@Base@OneCore@@AEAAJXZ+0x137 (RVA: 0x5622f)
    ==> ?ParseJsonResult@OneSettingsQuery@Telemetry@Base@OneCore@@AEAAJPEAD@Z+0xb3 (RVA: 0x56483)
    ==> ?ReadJsonObjectAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonKeyValuePair@@@@@Z+0x60 (RVA: 0x59974)
    ==> ?ReadJsonObjectAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonKeyValuePair@@@@@Z+0xc4 (RVA: 0x599d8)
    ==> ?ReadJsonValueListAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonValue@@@@@Z+0x58 (RVA: 0x59f44)
    ==> ?ReadJsonValueListAlloc@JsonReader@@QEAAJPEAPEAV?$RtlArray@PEAUJsonValue@@@@@Z+0xbc (RVA: 0x59fa8)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x5a1a7)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x74 (RVA: 0x5e804)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x3a (RVA: 0x5ed6a)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x101 (RVA: 0x5ee31)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x2f9 (RVA: 0x5f3e9)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x264 (RVA: 0x5f7a4)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3bf (RVA: 0x5f8ff)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x523 (RVA: 0x5fa63)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd0 (RVA: 0x604c0)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x884 (RVA: 0x61504)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x983 (RVA: 0x61603)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc7 (RVA: 0x6292b)

 [[IN]] C:\Windows\System32\compatrel\aepic.dll
    ==> AslLogGlobalLogger::AslLogGlobalLogger+0x96 (RVA: 0x3b26)
    ==> AslLogGlobalLogger::AslLogGlobalLogger+0x195 (RVA: 0x3c25)
    ==> Windows::Compat::Shared::Telemetry::TelemetryProvider::TelemetryProvider+0xa3 (RVA: 0x3db3)
    ==> AslLogCreate+0x3a (RVA: 0x425a)
    ==> AslLogCreate+0x82 (RVA: 0x42a2)
    ==> AslLogCreate+0x2f0 (RVA: 0x4510)
    ==> AslLogCreate+0x4a4 (RVA: 0x46c4)
    ==> AslAnsiStringCreate+0x57 (RVA: 0x4ba7)
    ==> AslLogGlobalLogger::~AslLogGlobalLogger+0x11b (RVA: 0x4d9b)
    ==> AslLogGlobalLogger::~AslLogGlobalLogger+0x157 (RVA: 0x4dd7)
    ==> AslLogGlobalLogger::~AslLogGlobalLogger+0x215 (RVA: 0x4e95)
    ==> AslTelemetryFlush+0x2d (RVA: 0x4f2d)
    ==> AslTelemetryFlush+0x57 (RVA: 0x4f57)
    ==> AslTelemetryFlush+0x79 (RVA: 0x4f79)
    ==> AslTelemetryFlush+0x9c (RVA: 0x4f9c)
    ==> AslTelemetryFlush+0xc3 (RVA: 0x4fc3)
    ==> AslTelemetryFlush+0xe7 (RVA: 0x4fe7)
    ==> AslTelemetryFlush+0x10b (RVA: 0x500b)
    ==> AslTelemetryFlush+0x12f (RVA: 0x502f)
    ==> AslTelemetryFlush+0x1aa (RVA: 0x50aa)
    ==> 0xa92b (no symbol)
    ==> 0xacc4 (no symbol)
    ==> 0xaf94 (no symbol)
    ==> ??$_Allocate@D@std@@YAPEAD_KPEAD@Z+0x1c (RVA: 0xb874)
    ==> ??$_Allocate@G@std@@YAPEAG_KPEAG@Z+0x2b (RVA: 0xef9b)
    ==> ?CompleteItem@CDesktopAppReceiver@Inventory@System@Windows@@AEAAJXZ+0x32 (RVA: 0x147fe)
    ==> ?_Buy@?$vector@PEBVIFileInfo@Inventory@Compat@Windows@@V?$allocator@PEBVIFileInfo@Inventory@Compat@Windows@@@std@@@std@@IEAA_N_K@Z+0x56 (RVA: 0x184aa)
    ==> ?_Reallocate@?$vector@PEAUDesktopAppInfo@Inventory@System@Windows@@V?$allocator@PEAUDesktopAppInfo@Inventory@System@Windows@@@std@@@std@@IEAAX_K@Z+0x4a (RVA: 0x186ce)
    ==> ?GetAppInventory@@YAJPEAVIInventoryDataReceiver@Inventory@Compat@Windows@@PEAUInventoryControlParams@234@PEBD@Z+0x202 (RVA: 0x1bc4a)
    ==> ?GetAppInventory@@YAJPEAVIInventoryDataReceiver@Inventory@Compat@Windows@@PEAUInventoryControlParams@234@PEBD@Z+0x35c (RVA: 0x1bda4)
    ==> ?UpdateSoftwareInventoryTC2@@YAJPEBD_N10@Z+0x207 (RVA: 0x1f977)
    ==> ?UpdateSoftwareInventoryTC2@@YAJPEBD_N10@Z+0x3c6 (RVA: 0x1fb36)
    ==> ?_Buy@?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@IEAA_N_K@Z+0x59 (RVA: 0x208ad)
    ==> ?_Buyheadnode@?$_Tree_alloc@$0A@U?$_Tree_base_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@std@@QEAAPEAU?$_Tree_node@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@PEAX@2@XZ+0x1e (RVA: 0x20922)
    ==> ?_Buyheadnode@?$_Tree_alloc@$0A@U?$_Tree_base_types@VFile@@V?$allocator@VFile@@@std@@@std@@@std@@QEAAPEAU?$_Tree_node@VFile@@PEAX@2@XZ+0x1e (RVA: 0x209b6)
    ==> ?_Buynode0@?$_Tree_buy@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@QEAAPEAU?$_Tree_node@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@PEAX@2@XZ+0x1e (RVA: 0x20a4a)
    ==> ?_Buynode0@?$_Tree_buy@VFile@@V?$allocator@VFile@@@std@@@std@@QEAAPEAU?$_Tree_node@VFile@@PEAX@2@XZ+0x1e (RVA: 0x20ae6)
    ==> ??2@YAPEAX_K@Z+0x17 (RVA: 0x22597)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x22ee8)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x22f39)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x2351d)
    ==> AslRegistryGetString+0xb4 (RVA: 0x23828)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x23a06)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x23ac2)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x24de1)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0x2506a)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0x2509c)
    ==> PiiFilterCreate+0xf (RVA: 0x2544f)
    ==> PiiFilterCreate+0x7a (RVA: 0x254ba)
    ==> PiiFilterCreate+0xca (RVA: 0x2550a)
    ==> PiiFilterEmbeddedPathsExecute+0x63 (RVA: 0x2562f)
    ==> PiiFilterEmbeddedPathsExecute+0x9b (RVA: 0x25667)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x258fc)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x25b24)
    ==> AslStringDuplicate+0xb8 (RVA: 0x25cbc)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x260a5)
    ==> AslEnvBuildBasic+0xbec (RVA: 0x26c60)
    ==> AslEnvBuildBasic+0x110a (RVA: 0x2717e)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x27642)
    ==> AslFileMappingCreate+0x5f (RVA: 0x27e3f)
    ==> AslFileAttributeToString+0x57 (RVA: 0x29057)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x2ac6c)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x2c513)
    ==> ?SetBaseFileInfoForPic@File@@IEAAX_N00@Z+0x1fb (RVA: 0x35daf)
    ==> ?SetBaseFileInfoForPic@File@@IEAAX_N00@Z+0x3ce (RVA: 0x35f82)
    ==> ?_Reallocate@?$vector@VFile@@V?$allocator@VFile@@@std@@@std@@IEAAX_K@Z+0x4e (RVA: 0x3727a)
    ==> ??0?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAA@AEBV?$regex_traits@G@1@W4syntax_option_type@regex_constants@1@@Z+0x26 (RVA: 0x39962)
    ==> ?_Add_backreference@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXI@Z+0x25 (RVA: 0x3da6d)
    ==> ?_Add_char_to_array@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAXG@Z+0x60 (RVA: 0x3dbec)
    ==> ?_Add_char_to_bitmap@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAXG@Z+0x60 (RVA: 0x3dcc0)
    ==> ?_Add_class@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXXZ+0x25 (RVA: 0x3dd89)
    ==> ?_Add_elts@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAXPEAV?$_Node_class@GV?$regex_traits@G@std@@@2@FAEBV?$regex_traits@G@2@@Z+0x53 (RVA: 0x3de87)
    ==> ?_Add_equiv@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXPEBG0_J@Z+0xac (RVA: 0x3dfc4)
    ==> ?_Add_range@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXGG@Z+0xa0 (RVA: 0x3e17c)
    ==> ?_Add_range@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXGG@Z+0x139 (RVA: 0x3e215)
    ==> ?_Add_rep@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXHH_N@Z+0x6f (RVA: 0x3e32f)
    ==> ?_Add_rep@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXHH_N@Z+0xe2 (RVA: 0x3e3a2)
    ==> ?_Add_str_node@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAXXZ+0x1e (RVA: 0x3e4ca)
    ==> ?_Begin_assert_group@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAPEAV_Node_base@2@_N@Z+0x29 (RVA: 0x3e8dd)
    ==> ?_Begin_assert_group@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAPEAV_Node_base@2@_N@Z+0xa7 (RVA: 0x3e95b)
    ==> ?_Begin_capture_group@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAPEAV_Node_base@2@I@Z+0x25 (RVA: 0x3ea5d)
    ==> ?_Begin_if@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAPEAV_Node_base@2@PEAV32@@Z+0x2f (RVA: 0x3eb23)
    ==> ?_Begin_if@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAPEAV_Node_base@2@PEAV32@@Z+0xa8 (RVA: 0x3eb9c)
    ==> ?_Buy@?$vector@IV?$allocator@_N@std@@@std@@IEAA_N_K@Z+0x4c (RVA: 0x3eda4)
    ==> ?_Buy@?$vector@U_Grp_t@?$_Tgt_state_t@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@G@std@@@std@@@std@@@std@@V?$allocator@U_Grp_t@?$_Tgt_state_t@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@G@std@@@std@@@std@@@std@@@3@@std@@IEAA_N_K@Z+0x4f (RVA: 0x3ee4f)
    ==> ?_Char_to_elts@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAXPEBG0_JPEAPEAU?$_Sequence@G@2@@Z+0x63 (RVA: 0x3ef0b)
    ==> ?_Else_if@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXPEAV_Node_base@2@0@Z+0x58 (RVA: 0x401c8)
    ==> ?_End_group@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@QEAAXPEAV_Node_base@2@@Z+0x4d (RVA: 0x402c1)
    ==> ?_Getcat@?$collate@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z+0x5d (RVA: 0x403b5)
    ==> ?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z+0x4b (RVA: 0x40553)
    ==> ?_Insert_n@?$vector@IV?$allocator@_N@std@@@std@@IEAA?AV?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@I@std@@@std@@@2@V?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@I@std@@@std@@@2@_KAEBI@Z+0xc4 (RVA: 0x40a94)
    ==> ?_New_node@?$_Builder@PEBGGV?$regex_traits@G@std@@@std@@AEAAPEAV_Node_base@2@W4_Node_type@2@@Z+0x25 (RVA: 0x416dd)
    ==> ?_Reallocate@?$vector@U_Grp_t@?$_Tgt_state_t@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@G@std@@@std@@@std@@@std@@V?$allocator@U_Grp_t@?$_Tgt_state_t@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@G@std@@@std@@@std@@@std@@@3@@std@@IEAAX_K@Z+0x4a (RVA: 0x418d6)
    ==> ?_Reallocate@?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@IEAAX_K@Z+0x4e (RVA: 0x419de)
    ==> ?OnChange@Application@@UEAAKXZ+0xbe (RVA: 0x464be)
    ==> ?OnRemove@Application@@UEAAKXZ+0xa3 (RVA: 0x46d53)
    ==> ?_Reallocate@?$vector@PEBVIFileInfo@Inventory@Compat@Windows@@V?$allocator@PEBVIFileInfo@Inventory@Compat@Windows@@@std@@@std@@IEAAX_K@Z+0x4a (RVA: 0x493b2)
    ==> ?_Reallocate@?$vector@VApplication@@V?$allocator@VApplication@@@std@@@std@@IEAAX_K@Z+0x4e (RVA: 0x494ba)
    ==> ??$_Insert@V?$move_iterator@V?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@@std@@@std@@@?$vector@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@QEAAXV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@@1@V?$move_iterator@V?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@@std@@@1@1Uforward_iterator_tag@1@@Z+0xd4 (RVA: 0x4a334)
    ==> ??0_bstr_t@@QEAA@PEBG@Z+0x26 (RVA: 0x4d642)
    ==> ??4_bstr_t@@QEAAAEAV0@PEBG@Z+0x32 (RVA: 0x4d99a)
    ==> ?_Reallocate@?$vector@U?$pair@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V12@@std@@@2@@std@@IEAAX_K@Z+0x4e (RVA: 0x522e6)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x74 (RVA: 0x57da0)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x466 (RVA: 0x58556)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x56e (RVA: 0x5865e)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc8 (RVA: 0x59c9c)

 [[IN]] C:\Windows\System32\compatrel\appraiser.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x9cab)
    ==> AslTelemetryCreate+0x32 (RVA: 0x9d82)
    ==> AslTelemetryFlush+0x40 (RVA: 0xa0a8)
    ==> AslTelemetryFlush+0x6d (RVA: 0xa0d5)
    ==> AslTelemetryFlush+0x9a (RVA: 0xa102)
    ==> AslTelemetryFlush+0xbd (RVA: 0xa125)
    ==> AslTelemetryFlush+0xdd (RVA: 0xa145)
    ==> AslTelemetryFlush+0xfa (RVA: 0xa162)
    ==> AslTelemetryFlush+0x117 (RVA: 0xa17f)
    ==> AslTelemetryFlush+0x136 (RVA: 0xa19e)
    ==> AslTelemetryFlush+0x192 (RVA: 0xa1fa)
    ==> AslpTelemetryProcessError+0xd1 (RVA: 0xaced)
    ==> AslTelemetryTrackError+0x48 (RVA: 0xae00)
    ==> AslTelemetryTrackError+0x99 (RVA: 0xae51)
    ==> AslRegistryGetString+0xb4 (RVA: 0xb908)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0xbae6)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0xbba2)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xbd12)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0xbe58)
    ==> AslLogCreate+0x37 (RVA: 0xcfcf)
    ==> AslLogCreate+0x82 (RVA: 0xd01a)
    ==> AslLogCreate+0xac (RVA: 0xd044)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0xdead)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0xdee1)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0xe1ae)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0xe849)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0xe88a)
    ==> AslGuidToString_UStr+0x29 (RVA: 0xeef9)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0xf1a4)
    ==> AslStringDuplicateA+0x9a (RVA: 0xf31e)
    ==> AslStringDuplicate+0xb8 (RVA: 0xf528)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0xf6dc)
    ==> AslStringUpcaseToMultiByteN+0x3b (RVA: 0xf843)
    ==> AslPathWildcardFindFirst+0xf1 (RVA: 0x1109d)
    ==> AslPathWildcardFindFirst+0x1e0 (RVA: 0x1118c)
    ==> AslPathWildcardFindNext+0x94 (RVA: 0x115b4)
    ==> AslpPathWildcardAllocMatchNode+0x8d (RVA: 0x12051)
    ==> AslpAllocMatchNode+0xf (RVA: 0x12457)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0x1264c)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x13252)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x136d9)
    ==> AslEnvBuildBasic+0xbea (RVA: 0x14292)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0x147b0)
    ==> AslFileMappingCreate+0x5e (RVA: 0x14daa)
    ==> AslFileAttributeToString+0x57 (RVA: 0x15ee3)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x168c3)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x18ecb)
    ==> ?WriteLogV@Appraiser@Compat@Windows@@YAX_NKPEBD1J1PEAD@Z+0x297 (RVA: 0x22767)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0xcf193)
    ==> SdbpOpenCompressedDatabase+0xc4 (RVA: 0xcfea8)
    ==> SdbpWriteCompressedDatabase+0x144 (RVA: 0xd0140)
    ==> SdbInitDatabaseEx+0x46 (RVA: 0xd075e)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0xd2c81)
    ==> SdbpCreateSearchDBContextForApp+0x45 (RVA: 0xd30d9)
    ==> SdbpCreateSearchDBContextForApp+0xe0 (RVA: 0xd3174)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0xd32c4)
    ==> SdbpCreateSearchDBContext+0x114 (RVA: 0xd3378)
    ==> SdbpCreateSearchDBContext+0x20d (RVA: 0xd3471)
    ==> SdbpCreateSearchDBContext+0x23a (RVA: 0xd349e)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0xd35bd)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0xd3b0f)
    ==> SdbpCheckMatchingRegistryValue+0xd5 (RVA: 0xd40f5)
    ==> SdbpCheckMatchingRegistryValue+0x1cf (RVA: 0xd41ef)
    ==> SdbpCheckMatchingRegistryValue+0x2a1 (RVA: 0xd42c1)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0xd4409)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0xd4a97)
    ==> SdbpCheckMatchingTextEntry+0x1fd (RVA: 0xd4dfd)
    ==> SdbpRetrieveBackupApplicationAttributes+0xe6 (RVA: 0xd6be6)
    ==> SdbpRetrieveBackupApplicationAttributes+0x19d (RVA: 0xd6c9d)
    ==> SdbpRetrieveBackupApplicationAttributes+0x40a (RVA: 0xd6f0a)
    ==> SdbpRetrieveBackupApplicationAttributes+0x58c (RVA: 0xd708c)
    ==> SdbReleaseDatabase+0xde (RVA: 0xd7742)
    ==> SdbDuplicateSdbHandle+0x53 (RVA: 0xd77bb)
    ==> SdbOpenDatabaseEx+0x5e (RVA: 0xd7de2)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0xd7ff8)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0xd844b)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0xd964d)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0xda855)
    ==> SdbpWriteBufferedData+0x68 (RVA: 0xdab0c)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0xf8eaf)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0x15a8e7)
    ==> AslPathIsTemporaryInternetFile+0x41 (RVA: 0x15abb5)
    ==> AslPathIsTemporaryInternetFile+0x169 (RVA: 0x15acdd)
    ==> AslPathIsTemporaryInternetFile+0x203 (RVA: 0x15ad77)
    ==> AslPathIsTemporaryInternetFile+0x33d (RVA: 0x15aeb1)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x1c0 (RVA: 0x15b21c)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1f7 (RVA: 0x15b52f)
    ==> SdbCustomDbRegInfoEnumerate+0x36f (RVA: 0x15c4a3)
    ==> SdbFileInfoGet+0x77 (RVA: 0x15c8d3)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x74 (RVA: 0x15f46c)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x2eb (RVA: 0x15fe1b)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x279 (RVA: 0x1601e9)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3d4 (RVA: 0x160344)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x538 (RVA: 0x1604a8)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd0 (RVA: 0x160f10)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x87c (RVA: 0x161f4c)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x988 (RVA: 0x162058)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc7 (RVA: 0x1632f3)

 [[IN]] C:\Windows\System32\compatrel\dcntel.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x32 (RVA: 0x1517e)
    ==> ?GetGenuineState_WindowsCore@COsInfo@@CAIXZ+0x650 (RVA: 0x31930)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x58b5f)
    ==> AslTelemetryFlush+0x40 (RVA: 0x58db4)
    ==> AslTelemetryFlush+0x6d (RVA: 0x58de1)
    ==> AslTelemetryFlush+0x9a (RVA: 0x58e0e)
    ==> AslTelemetryFlush+0xbd (RVA: 0x58e31)
    ==> AslTelemetryFlush+0xdd (RVA: 0x58e51)
    ==> AslTelemetryFlush+0xfa (RVA: 0x58e6e)
    ==> AslTelemetryFlush+0x117 (RVA: 0x58e8b)
    ==> AslTelemetryFlush+0x136 (RVA: 0x58eaa)
    ==> AslTelemetryFlush+0x192 (RVA: 0x58f06)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x599e6)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x59af4)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x59b45)
    ==> AslRegistryGetString+0xb4 (RVA: 0x5a268)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x5a446)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x5a502)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x5a672)
    ==> AslLogCreate+0x37 (RVA: 0x5b623)
    ==> AslLogCreate+0x82 (RVA: 0x5b66e)
    ==> AslLogCreate+0xac (RVA: 0x5b698)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x5c495)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x5c4c9)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x5c78e)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0x5ca5d)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0x5ca9e)
    ==> AslStringDuplicateA+0x93 (RVA: 0x5d1e7)
    ==> AslStringDuplicate+0xb8 (RVA: 0x5d3f4)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x5d54c)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x5dd22)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x5e1a9)
    ==> AslEnvBuildBasic+0xbea (RVA: 0x5ed62)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0x5f280)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x7cf83)

 [[IN]] C:\Windows\System32\compatrel\devinv.dll
    ==> CreateDeviceInventory+0x54e (RVA: 0x659e)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x74 (RVA: 0x4d1c0)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x2f9 (RVA: 0x4db69)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x279 (RVA: 0x4df39)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3d4 (RVA: 0x4e094)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x538 (RVA: 0x4e1f8)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd7 (RVA: 0x4ec67)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x884 (RVA: 0x4fcb4)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x97c (RVA: 0x4fdac)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc7 (RVA: 0x510cf)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x56d33)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x76 (RVA: 0x56d9a)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xca (RVA: 0x56dee)
    ==> AslTelemetryCreate+0x32 (RVA: 0x56eca)
    ==> AslTelemetryCreate+0x139 (RVA: 0x56fd1)
    ==> AslTelemetryFlush+0x40 (RVA: 0x571f0)
    ==> AslTelemetryFlush+0x6d (RVA: 0x5721d)
    ==> AslTelemetryFlush+0x9a (RVA: 0x5724a)
    ==> AslTelemetryFlush+0xbd (RVA: 0x5726d)
    ==> AslTelemetryFlush+0xdd (RVA: 0x5728d)
    ==> AslTelemetryFlush+0xfa (RVA: 0x572aa)
    ==> AslTelemetryFlush+0x117 (RVA: 0x572c7)
    ==> AslTelemetryFlush+0x136 (RVA: 0x572e6)
    ==> AslTelemetryFlush+0x192 (RVA: 0x57342)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x57e59)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x57f68)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x57fb9)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0x5828c)
    ==> AslRegistryGetString+0xb4 (RVA: 0x58718)
    ==> AslRegistryGetStringExpand+0x9f (RVA: 0x588ef)
    ==> AslRegistryGetStringExpand+0x15b (RVA: 0x589ab)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x58b1a)
    ==> AslLogCreate+0x37 (RVA: 0x59727)
    ==> AslLogCreate+0x82 (RVA: 0x59772)
    ==> AslLogCreate+0xac (RVA: 0x5979c)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x5a444)
    ==> AslStringDuplicateA+0x9a (RVA: 0x5a5be)
    ==> AslStringDuplicate+0xb8 (RVA: 0x5a7c8)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x5a920)
    ==> AslFileMappingCreate+0x5e (RVA: 0x5abd2)
    ==> AslFileAttributeToString+0x57 (RVA: 0x5bd07)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x5c6e0)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x5ef7d)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x5efb1)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x5f26e)
    ==> PiiFilterEmbeddedPathsExecute+0x66 (RVA: 0x5f47e)
    ==> PiiFilterEmbeddedPathsExecute+0xa7 (RVA: 0x5f4bf)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x5fefa)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x60379)
    ==> AslEnvBuildBasic+0xc0d (RVA: 0x60f55)
    ==> AslEnvBuildBasic+0x1132 (RVA: 0x6147a)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x6199b)

 [[IN]] C:\Windows\System32\compatrel\generaltel.dll
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0xbd (RVA: 0x238e9)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x115 (RVA: 0x23941)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x16b (RVA: 0x23997)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x1cd (RVA: 0x239f9)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x21f (RVA: 0x23a4b)
    ==> ?DetectOfficeInstallation@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@00AEAK@Z+0x46b (RVA: 0x247bf)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x29b27)
    ==> ?GetCITDataForNamespaceTelemetryPoints@@YAJAEAVPiiFilter@@PEBG@Z+0x147 (RVA: 0x31b33)
    ==> ?GetCITDataForNamespaceTelemetryPoints@@YAJAEAVPiiFilter@@PEBG@Z+0x929 (RVA: 0x32315)
    ==> ?GetCitModuleVersionInfo@@YAJPEBG_KPEAG@Z+0xc6 (RVA: 0x327ae)
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x32 (RVA: 0x3edde)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x47de9)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x47e1d)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x480da)
    ==> PiiFilterEmbeddedPathsExecute+0x66 (RVA: 0x48692)
    ==> PiiFilterEmbeddedPathsExecute+0xa7 (RVA: 0x486d3)
    ==> AslFileMappingCreate+0x5e (RVA: 0x48cfe)
    ==> AslFileAttributeToString+0x54 (RVA: 0x49e30)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x4a7a4)
    ==> AslRegistryGetString+0xb4 (RVA: 0x4d184)
    ==> AslRegistryGetStringExpand+0x9f (RVA: 0x4d35b)
    ==> AslRegistryGetStringExpand+0x15b (RVA: 0x4d417)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x4d586)
    ==> AslTelemetryFlush+0x40 (RVA: 0x4ea00)
    ==> AslTelemetryFlush+0x6d (RVA: 0x4ea2d)
    ==> AslTelemetryFlush+0x9a (RVA: 0x4ea5a)
    ==> AslTelemetryFlush+0xbd (RVA: 0x4ea7d)
    ==> AslTelemetryFlush+0xdd (RVA: 0x4ea9d)
    ==> AslTelemetryFlush+0xfa (RVA: 0x4eaba)
    ==> AslTelemetryFlush+0x117 (RVA: 0x4ead7)
    ==> AslTelemetryFlush+0x136 (RVA: 0x4eaf6)
    ==> AslTelemetryFlush+0x192 (RVA: 0x4eb52)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x4f661)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x4f770)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x4f7c1)
    ==> AslLogCreate+0x37 (RVA: 0x4fd3b)
    ==> AslLogCreate+0x82 (RVA: 0x4fd86)
    ==> AslLogCreate+0xac (RVA: 0x4fdb0)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x50a58)
    ==> AslStringDuplicateA+0x93 (RVA: 0x50bcb)
    ==> AslStringDuplicate+0xb8 (RVA: 0x50dd8)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x50f30)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x515f6)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x51a75)
    ==> AslEnvBuildBasic+0xbea (RVA: 0x5262e)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0x52b4c)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x5330f)

 [[IN]] C:\Windows\System32\compatrel\invagent.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x32 (RVA: 0xd15e)
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x132 (RVA: 0xd25e)
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0xd3d4)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x13213)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x9d (RVA: 0x132a1)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf1 (RVA: 0x132f5)
    ==> AslTelemetryFlush+0x40 (RVA: 0x1351c)
    ==> AslTelemetryFlush+0x6d (RVA: 0x13549)
    ==> AslTelemetryFlush+0x9a (RVA: 0x13576)
    ==> AslTelemetryFlush+0xbd (RVA: 0x13599)
    ==> AslTelemetryFlush+0xdd (RVA: 0x135b9)
    ==> AslTelemetryFlush+0xfa (RVA: 0x135d6)
    ==> AslTelemetryFlush+0x117 (RVA: 0x135f3)
    ==> AslTelemetryFlush+0x136 (RVA: 0x13612)
    ==> AslTelemetryFlush+0x192 (RVA: 0x1366e)
    ==> AslTelemetryTrackMessageVPrintf+0x44 (RVA: 0x140d4)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x14251)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x14360)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x143b1)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0x14690)
    ==> AslRegistryGetString+0xb4 (RVA: 0x14b60)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x14d3e)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x14dfa)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x14f6a)
    ==> AslLogCreate+0x37 (RVA: 0x15f2f)
    ==> AslLogCreate+0x82 (RVA: 0x15f7a)
    ==> AslLogCreate+0xac (RVA: 0x15fa4)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x16c00)
    ==> AslStringDuplicateA+0x93 (RVA: 0x16d73)
    ==> AslStringDuplicate+0xb8 (RVA: 0x16f80)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x170d8)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x17629)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x1765d)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x1792a)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0x17bf9)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0x17c3a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x1883a)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x18cc1)
    ==> AslEnvBuildBasic+0xbea (RVA: 0x1987a)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0x19d98)
    ==> AslFileMappingCreate+0x5e (RVA: 0x1a10a)
    ==> AslFileAttributeToString+0x57 (RVA: 0x1b243)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x1bc23)
    ==> AslpFileLargeMapCreate+0x27 (RVA: 0x1e22b)
    ==> ??0RtlStringArray@@QEAA@XZ+0x29 (RVA: 0x4de49)
    ==> ??0RtlStringArray@@QEAA@XZ+0x81 (RVA: 0x4dea1)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x24 (RVA: 0x4df04)
    ==> ??0RtlNameValueArray@@QEAA@XZ+0x7b (RVA: 0x4df5b)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x74 (RVA: 0x4e468)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x2eb (RVA: 0x4ed7b)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x264 (RVA: 0x4f134)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3bf (RVA: 0x4f28f)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x523 (RVA: 0x4f3f3)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xc9 (RVA: 0x4fe39)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x884 (RVA: 0x50e74)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x96a (RVA: 0x50f5a)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xc7 (RVA: 0x52233)
    ==> FaddInitialize+0x19 (RVA: 0x52f05)
    ==> FaddLoadFromBuffer+0x1e (RVA: 0x530ca)
    ==> FaddLoadFromBuffer+0xaa (RVA: 0x53156)
    ==> FaddLoadFromBuffer+0x27d (RVA: 0x53329)
    ==> FaddLoadFromBuffer+0x2f4 (RVA: 0x533a0)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x4c7 (RVA: 0x54677)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x524 (RVA: 0x546d4)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x6f6 (RVA: 0x548a6)
    ==> SdbReleaseDatabase+0xde (RVA: 0x558e6)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0x55ab1)

 [[IN]] C:\Windows\System32\compatrel\Win32AppInventoryCSP.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2b (RVA: 0x3017)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x42fb)
    ==> AslTelemetryFlush+0x40 (RVA: 0x462c)
    ==> AslTelemetryFlush+0x6d (RVA: 0x4659)
    ==> AslTelemetryFlush+0x9a (RVA: 0x4686)
    ==> AslTelemetryFlush+0xbd (RVA: 0x46a9)
    ==> AslTelemetryFlush+0xdd (RVA: 0x46c9)
    ==> AslTelemetryFlush+0xfa (RVA: 0x46e6)
    ==> AslTelemetryFlush+0x117 (RVA: 0x4703)
    ==> AslTelemetryFlush+0x136 (RVA: 0x4722)
    ==> AslTelemetryFlush+0x192 (RVA: 0x477e)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x521a)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x5328)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x5379)
    ==> AslRegistryGetString+0xb4 (RVA: 0x5aa8)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x5c86)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x5d42)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x5eb2)
    ==> AslLogCreate+0x37 (RVA: 0x6e6b)
    ==> AslLogCreate+0x82 (RVA: 0x6eb6)
    ==> AslLogCreate+0xac (RVA: 0x6ee0)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x7d55)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x7d89)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x8056)
    ==> PiiFilterEmbeddedPathsExecute+0x6d (RVA: 0x827d)
    ==> PiiFilterEmbeddedPathsExecute+0xae (RVA: 0x82be)
    ==> AslStringDuplicateA+0x93 (RVA: 0x892b)
    ==> AslStringDuplicate+0xb8 (RVA: 0x8b38)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x8c90)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x9466)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x98ed)
    ==> AslEnvBuildBasic+0xbea (RVA: 0xa4a6)
    ==> AslEnvBuildBasic+0x1108 (RVA: 0xa9c4)

 [[IN]] C:\Windows\System32\comsnap.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x29a70)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x29aa0)

 [[IN]] C:\Windows\System32\comsvcs.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x7c7f0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x7c820)

 [[IN]] C:\Windows\System32\ConhostV1.dll
    ==> InitializeCustomCP+0xa (RVA: 0x36c2)
    ==> InitSideBySide+0x21 (RVA: 0x5d5d)

 [[IN]] C:\Windows\System32\container.dll
    ==> CiFreeCatalogHint+0x0 (RVA: 0x28ba8)

 [[IN]] C:\Windows\System32\ContentDeliveryManager.Utilities.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6f (RVA: 0x2ddd7)
    ==> ?GetCurrentUserSidString@Actions@CreativeFramework@@YAJPEAPEA_W@Z+0x75 (RVA: 0x99265)

 [[IN]] C:\Windows\System32\CredProv2faHelper.dll
    ==> ?WriteLastLoggedOnProvider@@YAXPEBG@Z+0xa1 (RVA: 0xf895)

 [[IN]] C:\Windows\System32\credprovhost.dll
    ==> CStartCredProvsJob::_StartCredProvsForUsageScenario+0xd8 (RVA: 0x9ff8)
    ==> WriteLastLoggedOnProvider+0x87 (RVA: 0xf53b)
    ==> CCredentialProviderFramework::InitializeAsync+0x1c1 (RVA: 0xfd81)
    ==> CCredentialProviderThread::_vThreadProc+0x51 (RVA: 0x125d1)
    ==> CCredentialProviderThread::_vThreadProc+0x66 (RVA: 0x125e6)
    ==> 0x1e2e7 (no symbol)
    ==> 0x2408a (no symbol)
    ==> _SetLastLoggedOnUsername+0x200 (RVA: 0x2a144)
    ==> ?WriteLoggedOnUserinfo@@YAXPEBG00@Z+0xb2 (RVA: 0x398c2)
    ==> ?GetInSessionDisplayname@@YAJPEBGPEAPEAG@Z+0x1f (RVA: 0x39b67)

 [[IN]] C:\Windows\System32\credprovs.dll
    ==> ?GetInSessionDisplayname@@YAJPEBGPEAPEAG@Z+0x1f (RVA: 0x3a683)
    ==> ?WriteUPNUserName@@YAXPEBG@Z+0x80 (RVA: 0x3ad2c)

 [[IN]] C:\Windows\System32\credprovslegacy.dll
    ==> ?RuntimeClassInitialize@CCredentialProviderUserArray@@QEAAJW4_CREDENTIAL_PROVIDER_USAGE_SCENARIO@@KPEAUIAutoLogonManager@@@Z+0x265 (RVA: 0xdc8d)
    ==> ?GetInSessionDisplayname@@YAJPEBGPEAPEAG@Z+0x1f (RVA: 0x1cebb)

 [[IN]] C:\Windows\System32\credui.dll
    ==> ?IsRunningInSvchost@@YAHXZ+0x4a (RVA: 0x39e6)
    ==> ?ReportImpersonationStatus@@YAXPEBD@Z+0xad (RVA: 0x4cb9)

 [[IN]] C:\Windows\System32\crypt32.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x104900)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x104930)

 [[IN]] C:\Windows\System32\cryptcatsvc.dll
    ==> `anonymous namespace'::OurRtlAllocateStringRoutine+0x0 (RVA: 0x18d30)
    ==> `anonymous namespace'::OurRtlFreeStringRoutine+0x0 (RVA: 0x18d54)
    ==> `anonymous namespace'::OurRtlReallocateStringRoutine+0x0 (RVA: 0x18d78)

 [[IN]] C:\Windows\System32\CryptoWinRT.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x30fc0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x30ff0)

 [[IN]] C:\Windows\System32\cryptsvc.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x10c20)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x10c50)

 [[IN]] C:\Windows\System32\cryptxml.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x14bb0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x14be0)

 [[IN]] C:\Windows\System32\csrsrv.dll
    ==> CsrProcessLazyRegister+0x124 (RVA: 0x14d4)
    ==> CsrServerInitialization+0x87 (RVA: 0x3887)
    ==> CsrSetDirectorySecurity+0xd3 (RVA: 0x3b83)
    ==> CsrParseServerCommandLine+0x4e (RVA: 0x43de)
    ==> CsrSbCreateProcess+0x2c7 (RVA: 0x9897)

 [[IN]] C:\Windows\System32\d3d11.dll
    ==> NDXGI::CDevice::LLOCompleteLayerConstruction+0xc0 (RVA: 0x3d030)

 [[IN]] C:\Windows\System32\d3d9.dll
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x49877)
    ==> QueryFinalGPUPreferenceDecision+0xc2 (RVA: 0x4c732)
    ==> ?SetAdvancedAdapterEnumeration@CRemoteSettings@@UEAAJH@Z+0x669 (RVA: 0xa8fb9)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0xfa445)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0xfa6da)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0xfa70c)
    ==> PiiFilterCreate+0xa (RVA: 0xfab0a)
    ==> PiiFilterCreate+0x72 (RVA: 0xfab72)
    ==> PiiFilterCreate+0xc2 (RVA: 0xfabc2)
    ==> AslEnvBuildBasic+0x31 (RVA: 0xfaf19)
    ==> AslEnvBuildBasic+0xcda (RVA: 0xfbbc2)
    ==> AslEnvBuildBasic+0x11a1 (RVA: 0xfc089)
    ==> AslEnvExpandStrings2+0xce (RVA: 0xfc4f6)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xfd3aa)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0xfd4f0)
    ==> AslRegistryGetString+0xb4 (RVA: 0xfd838)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0xfda16)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0xfdad2)
    ==> AslGuidToString_UStr+0x29 (RVA: 0xfe0fd)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0xfe2d0)
    ==> AslStringDuplicate+0x7d (RVA: 0xfe42d)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0xfe967)
    ==> AslPathWildcardFindFirst+0x118 (RVA: 0xff974)
    ==> AslPathWildcardFindFirst+0x1fe (RVA: 0xffa5a)
    ==> AslPathWildcardFindFirst+0x26c (RVA: 0xffac8)
    ==> AslPathWildcardFindNext+0x9d (RVA: 0xffef5)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x100b4c)
    ==> AslpAllocMatchNode+0xf (RVA: 0x100c93)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x100ea0)
    ==> AslpProcessMatchRegNode+0x9b (RVA: 0x1013f3)
    ==> AslFileMappingCreate+0x5f (RVA: 0x101927)
    ==> AslpFileGetVersionBlock+0x46f (RVA: 0x10463b)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x105d54)
    ==> SdbGetMatchingExeEx+0x186 (RVA: 0x106696)
    ==> SdbpGetProcessHistory+0x14d (RVA: 0x107b91)
    ==> SdbInitDatabaseEx+0x78 (RVA: 0x108340)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0x109ab0)
    ==> SdbpCheckMatchingRegistryValue+0xd5 (RVA: 0x10aa45)
    ==> SdbpCheckMatchingRegistryValue+0x1cf (RVA: 0x10ab3f)
    ==> SdbpCheckMatchingRegistryValue+0x2a1 (RVA: 0x10ac11)
    ==> SdbpCheckMatchingTextEntry+0x278 (RVA: 0x10b0e0)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0x10bbac)
    ==> SdbpCreateSearchDBContext+0x115 (RVA: 0x10bc61)
    ==> SdbpCreateSearchDBContext+0x20e (RVA: 0x10bd5a)
    ==> SdbpCreateSearchDBContext+0x23b (RVA: 0x10bd87)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x10c0db)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x10c675)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x10cfdd)
    ==> SdbpRetrievePackageAttributes+0x4a (RVA: 0x10d1f2)
    ==> SdbpRetrievePackageAttributes+0x16d (RVA: 0x10d315)
    ==> SdbpRetrievePackageAttributes+0x255 (RVA: 0x10d3fd)
    ==> SdbpRetrievePackageAttributes+0x3f1 (RVA: 0x10d599)
    ==> SdbpRetrievePackageAttributes+0x7ea (RVA: 0x10d992)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x10ede6)
    ==> SdbReleaseDatabase+0xcc (RVA: 0x10f080)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x10f147)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x10f2d7)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x10f545)
    ==> SdbResolveDatabaseEx+0x160 (RVA: 0x10fd54)
    ==> SdbpCreateSDBLookupEntry+0x9a (RVA: 0x1100a6)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x11215e)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x186 (RVA: 0x142082)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1c1 (RVA: 0x142361)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0x142723)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0x1429ec)
    ==> AslPathIsTemporaryInternetFile+0x194 (RVA: 0x142b3c)
    ==> AslPathIsTemporaryInternetFile+0x22e (RVA: 0x142bd6)
    ==> AslPathIsTemporaryInternetFile+0x353 (RVA: 0x142cfb)

 [[IN]] C:\Windows\System32\dab.dll
    ==> 0x1354c (no symbol)
    ==> 0x13b52 (no symbol)

 [[IN]] C:\Windows\System32\daxexec.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x2ed00)
    ==> MIDL_user_free+0x0 (RVA: 0x2ed30)
    ==> ?RuntimeClassInitialize@CentennialLifetimeManagerConsoleOperator@@QEAAJXZ+0x2f (RVA: 0x36763)

 [[IN]] C:\Windows\System32\dcntel.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2f (RVA: 0x1e04b)
    ==> ?GetGenuineState_WindowsCore@COsInfo@@CAIXZ+0x64c (RVA: 0x2771c)
    ==> AslRegistryGetString+0xb4 (RVA: 0x66ac8)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x66ca6)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x66d62)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x66ed2)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x68237)
    ==> AslTelemetryFlush+0x40 (RVA: 0x68968)
    ==> AslTelemetryFlush+0x6d (RVA: 0x68995)
    ==> AslTelemetryFlush+0x9a (RVA: 0x689c2)
    ==> AslTelemetryFlush+0xbd (RVA: 0x689e5)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x68a08)
    ==> AslTelemetryFlush+0x103 (RVA: 0x68a2b)
    ==> AslTelemetryFlush+0x123 (RVA: 0x68a4b)
    ==> AslTelemetryFlush+0x142 (RVA: 0x68a6a)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x68acf)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x696d9)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x697e8)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x69839)
    ==> AslLogCreate+0x3b (RVA: 0x69d67)
    ==> AslLogCreate+0x7c (RVA: 0x69da8)
    ==> AslLogCreate+0xa6 (RVA: 0x69dd2)
    ==> AslStringDuplicateA+0x91 (RVA: 0x6ab6d)
    ==> AslStringDuplicate+0xb5 (RVA: 0x6ad75)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x6aecc)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x6b522)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x6b9a9)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x6c555)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x6ca63)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x6d089)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x6d0bd)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x6d382)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x6d64d)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x6d68e)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x79577)

 [[IN]] C:\Windows\System32\ddisplay.dll
    ==> ?CreateTaskPool@CDDisplayDevice@@UEAAJPEAPEAUIDisplayTaskPool@Core@Display@Devices@Windows@@@Z+0x33 (RVA: 0x18093)

 [[IN]] C:\Windows\System32\deviceaccess.dll
    ==> DllGetClassObject+0x117 (RVA: 0x2137)
    ==> 0x6bd4 (no symbol)
    ==> ?GetHeap@ReservedForLocalUse@@YAPEAXXZ+0xc (RVA: 0x1bd24)

 [[IN]] C:\Windows\System32\devicengccredprov.dll
    ==> ?QueryFUSDisabledSetting@DeviceNgcScenarioLogonUI@@KAJPEBGPEA_N@Z+0xb1 (RVA: 0xf955)

 [[IN]] C:\Windows\System32\deviceregistration.dll
    ==> IsRegistrationAvailable+0x6ae (RVA: 0x1242e)

 [[IN]] C:\Windows\System32\DevicesFlowBroker.dll
    ==> ?GetProjectionAvailability@@YAJPEAW4PROJECTION_TOPOLOGY_FLAGS@@_N@Z+0x855 (RVA: 0x54825)

 [[IN]] C:\Windows\System32\DeviceSoftwareInstallationClient.dll
    ==> ?InstallerTypeAllowedOnSku@@YAHXZ+0x653 (RVA: 0xa10f)

 [[IN]] C:\Windows\System32\DeviceUpdateCenterCsp.dll
    ==> ?IsEnabled@DeviceUpdateCenterCsp@@AEBA_NXZ+0x676 (RVA: 0x9d42)

 [[IN]] C:\Windows\System32\devinv.dll
    ==> AslLogCreate+0x3b (RVA: 0xf3cf)
    ==> AslLogCreate+0x7c (RVA: 0xf410)
    ==> AslLogCreate+0xa6 (RVA: 0xf43a)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x103bb)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x76 (RVA: 0x10422)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xca (RVA: 0x10476)
    ==> AslTelemetryCreate+0x32 (RVA: 0x10da2)
    ==> AslTelemetryCreate+0x139 (RVA: 0x10ea9)
    ==> AslTelemetryFlush+0x40 (RVA: 0x110d8)
    ==> AslTelemetryFlush+0x6d (RVA: 0x11105)
    ==> AslTelemetryFlush+0x9a (RVA: 0x11132)
    ==> AslTelemetryFlush+0xbd (RVA: 0x11155)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x11178)
    ==> AslTelemetryFlush+0x103 (RVA: 0x1119b)
    ==> AslTelemetryFlush+0x123 (RVA: 0x111bb)
    ==> AslTelemetryFlush+0x142 (RVA: 0x111da)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x1123f)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x11e72)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x11f80)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x11fd1)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0x122b0)
    ==> AslRegistryGetString+0xb4 (RVA: 0x1273c)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x1291a)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x129d6)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x12b46)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x139f5)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x13a29)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x13cee)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x13f11)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x13f52)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x14694)
    ==> AslStringDuplicateA+0x96 (RVA: 0x1480a)
    ==> AslStringDuplicate+0xb5 (RVA: 0x14a11)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x14b68)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x152ae)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x15735)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x162e1)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x167ef)
    ==> AslFileMappingCreate+0x5e (RVA: 0x16b62)
    ==> AslFileAttributeToString+0x57 (RVA: 0x17d5b)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x18784)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x190ca)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x1bb88)
    ==> CreateDeviceInventory+0xc51 (RVA: 0x21ce1)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8a (RVA: 0x8e92e)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x335 (RVA: 0x8f415)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x279 (RVA: 0x8f7e9)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3e9 (RVA: 0x8f959)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x562 (RVA: 0x8fad2)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd1 (RVA: 0x90891)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x8dc (RVA: 0x9198c)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x9e8 (RVA: 0x91a98)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xec (RVA: 0x92bf0)

 [[IN]] C:\Windows\System32\Dism\AppxProvider.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x1dac0)
    ==> ?ReAlloc@GlobalHeap@Common@@SAJPEAX_KPEAPEAX@Z+0x18 (RVA: 0x1db18)

 [[IN]] C:\Windows\System32\Dism\CbsProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x84446)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x84494)

 [[IN]] C:\Windows\System32\Dism\DismCore.dll
    ==> ?DismCreateObjectInHostFromCLSID@@YAJPEBG00AEBU_GUID@@1PEAUIDismLogger@@PEAU_PROCESS_INFORMATION@@PEAPEAUIUnknown@@4@Z+0x644 (RVA: 0x2b5b0)

 [[IN]] C:\Windows\System32\Dism\FfuProvider.dll
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x65194)

 [[IN]] C:\Windows\System32\Dism\ProvProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x84116)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x841a4)

 [[IN]] C:\Windows\System32\Dism\SmiProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x2e266)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x2e2b4)

 [[IN]] C:\Windows\System32\Dism\TransmogProvider.dll
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x3976a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x3bb4f)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x57954)

 [[IN]] C:\Windows\System32\Dism\UnattendProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x24376)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x243c4)

 [[IN]] C:\Windows\System32\Dism\VhdProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x3cb56)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x3cbe4)

 [[IN]] C:\Windows\System32\Dism\WimProvider.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x5b926)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x5b974)

 [[IN]] C:\Windows\System32\DismApi.dll
    ==> `anonymous namespace'::OurRtlAllocateStringRoutine+0x0 (RVA: 0x20990)
    ==> `anonymous namespace'::OurRtlFreeStringRoutine+0x0 (RVA: 0x209b4)
    ==> `anonymous namespace'::OurRtlReallocateStringRoutine+0x0 (RVA: 0x209d8)

 [[IN]] C:\Windows\System32\dmcfgutils.dll
    ==> ?_IsCurrentUserAdministrator@@YAJPEAH@Z+0x65d (RVA: 0x801d)

 [[IN]] C:\Windows\System32\downlevel\ucrtbase.dll
    ==> exit_or_terminate_process+0xd (RVA: 0x1ffa5)
    ==> thread_start<unsigned int (__cdecl*)(void *),1>+0x57 (RVA: 0x21557)
    ==> thread_start<void (__cdecl*)(void *),0>+0x34 (RVA: 0x248f4)
    ==> 0x56d7c (no symbol)
    ==> __acrt_can_show_message_box+0x2a (RVA: 0x6e526)
    ==> common_show_message_box<char>+0x4b (RVA: 0x708eb)
    ==> common_show_message_box<char>+0xbc (RVA: 0x7095c)
    ==> common_show_message_box<wchar_t>+0x4c (RVA: 0x70a3c)
    ==> common_show_message_box<wchar_t>+0xbd (RVA: 0x70aad)

 [[IN]] C:\Windows\System32\dpx.dll
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x6ea2a)

 [[IN]] C:\Windows\System32\drivers\UMDF\SDFLauncher.dll
    ==> SrlpCreateSecureProcess+0x15f (RVA: 0x1997)

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\adobepdf.inf_amd64_b7f4492e18ad270b\Amd64\ADUIGP.DLL
    ==> RVA: .text+0x14c8e
    ==> RVA: .text+0x1c4f0

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\adobepdf.inf_amd64_b7f4492e18ad270b\Amd64Vista\AdobePdf.dll
    ==> RVA: .text+0x131b2
    ==> RVA: .text+0x1655d
    ==> RVA: .text+0x165a4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\adobepdf.inf_amd64_b7f4492e18ad270b\Amd64Vista\AdobePDFUI.dll
    ==> RVA: .text+0x65ba
    ==> RVA: .text+0x9980

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\appleusb.inf_amd64_58854158183af679\AppleUsbFilter.dll
    ==> RVA: .text+0x58e6
    ==> RVA: .text+0x7370

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\JHI64.dll
    ==> RVA: .text+0x18cca
    ==> RVA: .text+0x25480

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\TEEManagement64.dll
    ==> RVA: .text+0x19a2e
    ==> RVA: .text+0x241cc

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b5484efd38adbe8d\JHI64.dll
    ==> RVA: .text+0x18cca
    ==> RVA: .text+0x25480

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b5484efd38adbe8d\TEEManagement64.dll
    ==> RVA: .text+0x19a2e
    ==> RVA: .text+0x241cc

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\ftdibus.inf_amd64_27ad3b85ed46c2a0\amd64\ftd2xx64.dll
    ==> RVA: .text+0x4b6e1
    ==> RVA: .text+0x4b7b1

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\hpygid31_v4.inf_amd64_23382921ab214353\amd64\hpbuio.dll
    ==> RVA: .text+0xd4bd2
    ==> RVA: .text+0xda929
    ==> RVA: .text+0xda970

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\hpygid31_v4.inf_amd64_23382921ab214353\amd64\hpbuiodm.dll
    ==> RVA: .text+0xa053a
    ==> RVA: .text+0xaa321
    ==> RVA: .text+0xaa368

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\hpygid31_v4.inf_amd64_23382921ab214353\amd64\hpbxpsv431.dll
    ==> RVA: .text+0x4188a6
    ==> RVA: .text+0x421c61
    ==> RVA: .text+0x421ca8

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\hpygid31_v4.inf_amd64_23382921ab214353\amd64\hpygiddrv31.dll
    ==> RVA: .text+0x5d2b2
    ==> RVA: .text+0x6d254

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\IntelWifiIhv04.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0xb95a)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xed40)

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\IntelWifiIhv06.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0xc606)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xf720)

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\IntelWifiIhv08.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0xa0256)
    ==> get_cached_win_policy<`__acrt_get_begin_thread_init_policy'::`2'::begin_thread_init_policy_properties>+0x16 (RVA: 0xb2f16)
    ==> get_cached_win_policy<`__acrt_get_developer_information_policy'::`2'::developer_information_policy_properties>+0x16 (RVA: 0xb2f62)
    ==> get_cached_win_policy<`__acrt_get_windowing_model_policy'::`2'::windowing_model_policy_properties>+0x12 (RVA: 0xb2faa)
    ==> get_win_policy<`__acrt_get_process_end_policy'::`2'::process_end_policy_properties>+0xc (RVA: 0xb3010)
    ==> __acrt_get_begin_thread_init_policy+0x19 (RVA: 0xb30c1)
    ==> __acrt_get_developer_information_policy+0x19 (RVA: 0xb3115)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xb315c)
    ==> __acrt_get_windowing_model_policy+0x19 (RVA: 0xb31a5)

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\NvcDispCorePlugin.dll
    ==> RVA: .text+0x37c86
    ==> RVA: .text+0x4655e
    ==> RVA: .text+0x465aa
    ==> RVA: .text+0x465f2
    ==> RVA: .text+0x46658
    ==> RVA: .text+0x46709
    ==> RVA: .text+0x4675d
    ==> RVA: .text+0x467a4
    ==> RVA: .text+0x467ed

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\NvcDispWatchdog.dll
    ==> RVA: .text+0x68d66
    ==> RVA: .text+0x799da
    ==> RVA: .text+0x79a26
    ==> RVA: .text+0x79a6e
    ==> RVA: .text+0x79ad4
    ==> RVA: .text+0x79b85
    ==> RVA: .text+0x79bd9
    ==> RVA: .text+0x79c20
    ==> RVA: .text+0x79c69

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\NvXDCore.dll
    ==> RVA: .text+0xf0892
    ==> RVA: .text+0xfd1c1
    ==> RVA: .text+0xfd208

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\wksServicePluginZ.dll
    ==> RVA: .text+0x1e602
    ==> RVA: .text+0x22580

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\_DisplayDriverRAS.dll
    ==> RVA: .text+0x1b4ebe
    ==> RVA: .text+0x1b4f6a
    ==> RVA: .text+0x1c4496
    ==> RVA: .text+0x1c44e2
    ==> RVA: .text+0x1c452a
    ==> RVA: .text+0x1c4590
    ==> RVA: .text+0x1c4641
    ==> RVA: .text+0x1c4695
    ==> RVA: .text+0x1c46dc
    ==> RVA: .text+0x1c4725

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\LocalSystem\_nvtopps.dll
    ==> RVA: .text+0x8f252a
    ==> RVA: .text+0x8f2576
    ==> RVA: .text+0x8f25be
    ==> RVA: .text+0x8f2624
    ==> RVA: .text+0x8f26d5
    ==> RVA: .text+0x8f2729
    ==> RVA: .text+0x8f2770
    ==> RVA: .text+0x8f27b9

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\Session\nvxdsyncplugin.dll
    ==> RVA: .text+0xdd122
    ==> RVA: .text+0xebfa1
    ==> RVA: .text+0xebfe8

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\Session\wksServicePlugin.dll
    ==> RVA: .text+0x1d4e6
    ==> RVA: .text+0x21a20

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\Display.NvContainer\plugins\Session\_NvGSTPlugin.dll
    ==> RVA: .text+0x19c906
    ==> RVA: .text+0x1a99da
    ==> RVA: .text+0x1a9a26
    ==> RVA: .text+0x1a9a6e
    ==> RVA: .text+0x1a9ad4
    ==> RVA: .text+0x1a9b85
    ==> RVA: .text+0x1a9bd9
    ==> RVA: .text+0x1a9c20
    ==> RVA: .text+0x1a9c69

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nv3dappshext.dll
    ==> RVA: .text+0x84fe6
    ==> RVA: .text+0x8ebf8

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\NvCamera\NvCamera64.dll
    ==> RVA: .text+0x3b3d8a
    ==> RVA: .text+0x3c2f19
    ==> RVA: .text+0x3c2f60

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\NvCamera\NvCameraAllowlisting64.dll
    ==> RVA: .text+0x597fe
    ==> RVA: .text+0x67e48

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvcpl.dll
    ==> RVA: .text+0x34e15a
    ==> RVA: .text+0x358f25
    ==> RVA: .text+0x358f6c

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvcuda64.dll
    ==> RVA: .text+0x1790b9a
    ==> RVA: .text+0x17a8392
    ==> RVA: .text+0x17a83de
    ==> RVA: .text+0x17a8426
    ==> RVA: .text+0x17a848c
    ==> RVA: .text+0x17a853d
    ==> RVA: .text+0x17a8591
    ==> RVA: .text+0x17a85d8
    ==> RVA: .text+0x17a8621

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvcuda_loader64.dll
    ==> RVA: .text+0x364cee
    ==> RVA: .text+0x383fe2
    ==> RVA: .text+0x38402e
    ==> RVA: .text+0x384076
    ==> RVA: .text+0x3840dc
    ==> RVA: .text+0x38418d
    ==> RVA: .text+0x3841e1
    ==> RVA: .text+0x384228
    ==> RVA: .text+0x384271

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvdevtools.dll
    ==> RVA: .text+0x256c42
    ==> RVA: .text+0x261c99
    ==> RVA: .text+0x261ce0

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvdisps.dll
    ==> RVA: .text+0x39daaa
    ==> RVA: .text+0x3a9c41
    ==> RVA: .text+0x3a9c88

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvdxgdmal64.dll
    ==> RVA: .text+0x4c2a2
    ==> RVA: .text+0x5b00a
    ==> RVA: .text+0x5b056
    ==> RVA: .text+0x5b09e
    ==> RVA: .text+0x5b104
    ==> RVA: .text+0x5b1b5
    ==> RVA: .text+0x5b209
    ==> RVA: .text+0x5b250
    ==> RVA: .text+0x5b299

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvgames.dll
    ==> RVA: .text+0x3e6ebe
    ==> RVA: .text+0x3f0ff9
    ==> RVA: .text+0x3f1040

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvgpucomp64.dll
    ==> RVA: .text+0x1d2ad5
    ==> RVA: .text+0x1d2b1c

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvlicensings.dll
    ==> RVA: .text+0x25c6e2
    ==> RVA: .text+0x267749
    ==> RVA: .text+0x267790

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvml.dll
    ==> RVA: .text+0x138f8e
    ==> RVA: .text+0x14094d
    ==> RVA: .text+0x140994

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvml_loader.dll
    ==> RVA: .text+0x10d19a
    ==> RVA: .text+0x1121f0

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvngx.dll
    ==> RVA: .text+0x189fa
    ==> RVA: .text+0x19712
    ==> RVA: .text+0x1975e
    ==> RVA: .text+0x197a6
    ==> RVA: .text+0x1980c
    ==> RVA: .text+0x198bd
    ==> RVA: .text+0x19911
    ==> RVA: .text+0x19958
    ==> RVA: .text+0x199a1

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvngx_dlss.dll
    ==> RVA: .text+0xad9b4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvngx_dlssg.dll
    ==> RVA: .text+0x13e555
    ==> RVA: .text+0x13e59c

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvoglv64.dll
    ==> RVA: .text+0xa08338
    ==> RVA: .text+0xa1a194
    ==> RVA: .text+0xa1cc0b

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvopencl64.dll
    ==> RVA: .text+0x17bc0be
    ==> RVA: .text+0x17e34d6
    ==> RVA: .text+0x17e3522
    ==> RVA: .text+0x17e356a
    ==> RVA: .text+0x17e35d0
    ==> RVA: .text+0x17e3681
    ==> RVA: .text+0x17e36d5
    ==> RVA: .text+0x17e371c
    ==> RVA: .text+0x17e3765

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvptxJitCompiler64.dll
    ==> RVA: .text+0x123d73e
    ==> RVA: .text+0x124b20d
    ==> RVA: .text+0x124b254
    ==> RVA: .text+0x124b29d

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvshext.dll
    ==> RVA: .text+0x64b2
    ==> RVA: .text+0x7b00

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvsmartmax64.dll
    ==> RVA: .text+0x4206
    ==> RVA: .text+0x6830

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvsvc64.dll
    ==> RVA: .text+0xe4e52
    ==> RVA: .text+0xf0dd4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvsvs.dll
    ==> RVA: .text+0x288c9a
    ==> RVA: .text+0x293865
    ==> RVA: .text+0x2938ac

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\NvTelemetry64.dll
    ==> RVA: .text+0x1ed6be
    ==> RVA: .text+0x1f015d
    ==> RVA: .text+0x1f01a4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvui.dll
    ==> RVA: .text+0x2ac262
    ==> RVA: .text+0x2b7b69
    ==> RVA: .text+0x2b7bb0

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvvitvs.dll
    ==> RVA: .text+0x298a32
    ==> RVA: .text+0x2a3a85
    ==> RVA: .text+0x2a3acc

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvvkscv64.dll
    ==> RVA: .text+0x40fead
    ==> RVA: .text+0x41e5e4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvvm64.dll
    ==> RVA: .text+0xca26a
    ==> RVA: .text+0xd6ddd
    ==> RVA: .text+0xd6e24

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvvm70.dll
    ==> RVA: .text+0xe7472
    ==> RVA: .text+0xf0dd1
    ==> RVA: .text+0xf0e18

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvwgf2umx.dll
    ==> RVA: .text+0xf0d551
    ==> RVA: .text+0xf0d598

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvwss.dll
    ==> RVA: .text+0x3e5fba
    ==> RVA: .text+0x3f2c09
    ==> RVA: .text+0x3f2c50

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvxdapix.dll
    ==> RVA: .text+0x551852
    ==> RVA: .text+0x55b6d9
    ==> RVA: .text+0x55b720

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvxdbat.dll
    ==> RVA: .text+0xdc916
    ==> RVA: .text+0xeb4b4

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\nvxdplcy.dll
    ==> RVA: .text+0xfd22a
    ==> RVA: .text+0x107d8c

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_a991e39d9975490a\OpenCL64.dll
    ==> RVA: .text+0x2e136
    ==> RVA: .text+0x3af22
    ==> RVA: .text+0x3af6e
    ==> RVA: .text+0x3afb6
    ==> RVA: .text+0x3b01c
    ==> RVA: .text+0x3b0cd
    ==> RVA: .text+0x3b121
    ==> RVA: .text+0x3b168
    ==> RVA: .text+0x3b1b1

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNoteFilter.dll
    ==> RVA: .text+0x8130

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\rz0064dev.inf_amd64_49ebe8d923c2f9db\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\rz0064dev.inf_amd64_a3b1e1bff0daf56e\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\rz0064dev.inf_amd64_bbf4002e52c305a6\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\rz00b2dev.inf_amd64_a112d8b4e657edb6\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\rz0287dev.inf_amd64_cb2b34ad3f4fa004\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_1ea082c6cf8f6982\SDFLauncher.dll
    ==> SrlpCreateSecureProcess+0x15f (RVA: 0x1997)

 [[IN]] C:\Windows\System32\drprov.dll
    ==> NPAddConnection3+0xfb (RVA: 0x123b)
    ==> NPCancelConnection+0xab (RVA: 0x151b)
    ==> CreateConnectionName+0xac (RVA: 0x2d60)
    ==> NPGetConnection+0xef (RVA: 0x31df)
    ==> NPGetResourceInformation+0x24d (RVA: 0x357d)
    ==> ValidateRemoteName+0x46 (RVA: 0x3f82)
    ==> DrEnumConnectionInfo+0x82 (RVA: 0x42e2)
    ==> DrEnumServerInfo+0x68 (RVA: 0x45e4)
    ==> DrEnumShareInfo+0x93 (RVA: 0x47af)

 [[IN]] C:\Windows\System32\dssenh.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x18bd0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x18c00)

 [[IN]] C:\Windows\System32\dssvc.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x6d74)

 [[IN]] C:\Windows\System32\DucUpdateAgent.dll
    ==> ?IsDUCSupported@@YA_NXZ+0x67f (RVA: 0x9467)

 [[IN]] C:\Windows\System32\dwmapi.dll
    ==> DwmExtendFrameIntoClientArea+0x29f (RVA: 0x2f8f)
    ==> DwmExtendFrameIntoClientArea+0x2b1 (RVA: 0x2fa1)
    ==> ?SendRequest@CApiPortClient@@QEAAJPEBXFPEAJPEAXF@Z+0x1ba (RVA: 0x3bda)
    ==> ?SendRequest@CApiPortClient@@QEAAJPEBXFPEAJPEAXF@Z+0x1cc (RVA: 0x3bec)
    ==> ?EnsureConnected@CApiPortClient@@AEAAJXZ+0x121 (RVA: 0x4701)
    ==> ?EnsureConnected@CApiPortClient@@AEAAJXZ+0x133 (RVA: 0x4713)
    ==> DwmpAllocateSecurityDescriptor+0x40 (RVA: 0x63d0)

 [[IN]] C:\Windows\System32\dwmcore.dll
    ==> ?OpenDxBltEvent@@YAJ_KPEAPEAX@Z+0xe2 (RVA: 0x21b7fe)

 [[IN]] C:\Windows\System32\dwminit.dll
    ==> ?MapDwmVirtualAccountAndAdjustPrivileges@@YAJXZ+0x4d (RVA: 0x1d49)
    ==> ?MapDwmVirtualAccountAndAdjustPrivileges@@YAJXZ+0x14f (RVA: 0x1e4b)
    ==> DwmpSignalSessionShutdown+0x2c (RVA: 0x3edc)
    ==> ?EnsureConnected@CApiPortClient@@AEAAJXZ+0xd6 (RVA: 0x4542)
    ==> ?EnsureConnected@CApiPortClient@@AEAAJXZ+0xe8 (RVA: 0x4554)

 [[IN]] C:\Windows\System32\dwmredir.dll
    ==> CSessionPort::InitializePort+0xaf (RVA: 0xc697)
    ==> CSessionPort::InitializePort+0xc6 (RVA: 0xc6ae)

 [[IN]] C:\Windows\System32\dxdiagn.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xa (RVA: 0x48592)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x6e (RVA: 0x485f6)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xc2 (RVA: 0x4864a)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x4913d)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x49171)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x4942e)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x4a052)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x4a4d1)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x4b07d)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x4b58b)
    ==> AslRegistryGetString+0xb4 (RVA: 0x4c2bc)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x4c49a)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x4c556)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x4c6c6)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x4c80c)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x4cb31)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x4cddc)
    ==> AslStringDuplicate+0xb5 (RVA: 0x4cf71)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x4d11f)
    ==> AslPathWildcardFindFirst+0xed (RVA: 0x4e3c5)
    ==> AslPathWildcardFindFirst+0x1d8 (RVA: 0x4e4b0)
    ==> AslPathWildcardFindFirst+0x250 (RVA: 0x4e528)
    ==> AslPathWildcardFindNext+0x87 (RVA: 0x4e8d3)
    ==> AslpPathWildcardAllocMatchNode+0x90 (RVA: 0x4f358)
    ==> AslpAllocMatchNode+0xf (RVA: 0x4f757)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0x4f94c)
    ==> AslFileMappingCreate+0x55 (RVA: 0x50075)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x51930)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x52276)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x54d28)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0x5591b)
    ==> SdbGetMatchingExeEx+0x1c1 (RVA: 0x569cd)
    ==> SdbInitDatabaseEx+0x7c (RVA: 0x571e0)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0x587ac)
    ==> SdbpCreateSearchDBContext+0x115 (RVA: 0x58861)
    ==> SdbpCreateSearchDBContext+0x20e (RVA: 0x5895a)
    ==> SdbpCreateSearchDBContext+0x23b (RVA: 0x58987)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x58ab5)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0x59007)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x595e6)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x596e0)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x597b2)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0x598fd)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x59f87)
    ==> SdbpCheckMatchingTextEntry+0x230 (RVA: 0x5a320)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0x5c770)
    ==> SdbReleaseDatabase+0xde (RVA: 0x5d162)
    ==> SdbOpenDatabaseEx+0x4b (RVA: 0x5d3df)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0x5d5dc)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x5da67)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0x5de31)
    ==> SdbpCreateSDBLookupEntry+0x9e (RVA: 0x5e51a)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0x5f6f5)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x608de)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0x60aaf)
    ==> AslPathIsTemporaryInternetFile+0x41 (RVA: 0x60d6d)
    ==> AslPathIsTemporaryInternetFile+0x169 (RVA: 0x60e95)
    ==> AslPathIsTemporaryInternetFile+0x203 (RVA: 0x60f2f)
    ==> AslPathIsTemporaryInternetFile+0x321 (RVA: 0x6104d)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x1b9 (RVA: 0x6138d)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1ed (RVA: 0x61695)

 [[IN]] C:\Windows\System32\dxgi.dll
    ==> ?DoesProcessHaveAnyAdapterBlockList@@YAHXZ+0x0 (RVA: 0x96f0)
    ==> CDXGIFactory::Initialize+0x25 (RVA: 0xb47d)
    ==> CDXGIAdapter::EnumOutputsImpl+0x43 (RVA: 0xfeb7)
    ==> ?IsCurrent@CDXGIFactory@@UEAAHXZ+0xf (RVA: 0x1d22f)
    ==> CDriverBlockList::QueryBlockListDatabase+0x23 (RVA: 0x1e69f)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x2b2fb)
    ==> QueryFinalGPUPreferenceDecision+0xc2 (RVA: 0x2e7ee)
    ==> ?CheckDxgiDebugDll@@YAXXZ+0x3b (RVA: 0x59b7f)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x8059d)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0x80832)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0x80864)
    ==> PiiFilterCreate+0xa (RVA: 0x80c62)
    ==> PiiFilterCreate+0x72 (RVA: 0x80cca)
    ==> PiiFilterCreate+0xc2 (RVA: 0x80d1a)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x81071)
    ==> AslEnvBuildBasic+0xcda (RVA: 0x81d1a)
    ==> AslEnvBuildBasic+0x11a1 (RVA: 0x821e1)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x8264e)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x83502)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x83648)
    ==> AslRegistryGetString+0xb4 (RVA: 0x83990)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x83b6e)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x83c2a)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x84255)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x84428)
    ==> AslStringDuplicate+0x7d (RVA: 0x84585)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x84abf)
    ==> AslPathWildcardFindFirst+0x118 (RVA: 0x85af0)
    ==> AslPathWildcardFindFirst+0x1fe (RVA: 0x85bd6)
    ==> AslPathWildcardFindFirst+0x26c (RVA: 0x85c44)
    ==> AslPathWildcardFindNext+0x9d (RVA: 0x86071)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x86c70)
    ==> AslpAllocMatchNode+0xf (RVA: 0x86db7)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x86fc4)
    ==> AslpProcessMatchRegNode+0x9b (RVA: 0x87517)
    ==> AslFileMappingCreate+0x5f (RVA: 0x87a4b)
    ==> AslpFileGetVersionBlock+0x46f (RVA: 0x8a75f)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x8be78)
    ==> SdbGetMatchingExeEx+0x186 (RVA: 0x8c7b2)
    ==> SdbpGetProcessHistory+0x14d (RVA: 0x8dca9)
    ==> SdbInitDatabaseEx+0x78 (RVA: 0x8e458)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0x8fbd0)
    ==> SdbpCheckMatchingRegistryValue+0xd5 (RVA: 0x90b65)
    ==> SdbpCheckMatchingRegistryValue+0x1cf (RVA: 0x90c5f)
    ==> SdbpCheckMatchingRegistryValue+0x2a1 (RVA: 0x90d31)
    ==> SdbpCheckMatchingTextEntry+0x278 (RVA: 0x91200)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0x91ccc)
    ==> SdbpCreateSearchDBContext+0x115 (RVA: 0x91d81)
    ==> SdbpCreateSearchDBContext+0x20e (RVA: 0x91e7a)
    ==> SdbpCreateSearchDBContext+0x23b (RVA: 0x91ea7)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x921fb)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x92795)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x930fd)
    ==> SdbpRetrievePackageAttributes+0x4a (RVA: 0x93312)
    ==> SdbpRetrievePackageAttributes+0x16d (RVA: 0x93435)
    ==> SdbpRetrievePackageAttributes+0x255 (RVA: 0x9351d)
    ==> SdbpRetrievePackageAttributes+0x3f1 (RVA: 0x936b9)
    ==> SdbpRetrievePackageAttributes+0x7ea (RVA: 0x93ab2)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x94f06)
    ==> SdbReleaseDatabase+0xcc (RVA: 0x951a0)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x95267)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x953f7)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x95665)
    ==> SdbResolveDatabaseEx+0x160 (RVA: 0x95e74)
    ==> SdbpCreateSDBLookupEntry+0x9a (RVA: 0x961c6)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x9827e)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x186 (RVA: 0x9851e)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1c1 (RVA: 0x987fd)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0x98bbf)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0x98e88)
    ==> AslPathIsTemporaryInternetFile+0x194 (RVA: 0x98fd8)
    ==> AslPathIsTemporaryInternetFile+0x22e (RVA: 0x99072)
    ==> AslPathIsTemporaryInternetFile+0x353 (RVA: 0x99197)

 [[IN]] C:\Windows\System32\eapphost.dll
    ==> ??1RunTimeInitializer@@QEAA@XZ+0x10 (RVA: 0x5ae4)
    ==> ??0RunTimeInitializer@@QEAA@XZ+0x14 (RVA: 0x5bb0)

 [[IN]] C:\Windows\System32\edgeangle.dll
    ==> DllMain+0x1e (RVA: 0x9ff7e)

 [[IN]] C:\Windows\System32\EdgeContent.dll
    ==> LCIEStartAsContentProcess+0x328 (RVA: 0x645c8)
    ==> _CreateSharedHandleACL+0x15 (RVA: 0x2330a1)

 [[IN]] C:\Windows\System32\EdgeManager.dll
    ==> EnsureServiceWorkerEnvironmentForWebView+0x38 (RVA: 0x502d8)

 [[IN]] C:\Windows\System32\EditionUpgradeHelper.dll
    ==> SLGetWindowsInformation+0x69a (RVA: 0x7336)
    ==> SLGetWindowsInformationDWORD+0x67e (RVA: 0x1a172)

 [[IN]] C:\Windows\System32\EditionUpgradeManagerObj.dll
    ==> SLGetWindowsInformationDWORD+0x67e (RVA: 0x181da)

 [[IN]] C:\Windows\System32\edputil.dll
    ==> EdpGetEnterpriseIdForUIEnforcementFromProcess+0x40 (RVA: 0x8010)
    ==> EdpUtilGetEnterpriseContextByProcess+0x39 (RVA: 0x8c59)

 [[IN]] C:\Windows\System32\eeprov.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x14060)
    ==> MIDL_user_free+0x0 (RVA: 0x14090)

 [[IN]] C:\Windows\System32\efscore.dll
    ==> EfsIsNonEfsSKU+0x672 (RVA: 0x2661e)
    ==> SLGetWindowsInformationDWORD+0x671 (RVA: 0x5331d)

 [[IN]] C:\Windows\System32\efswrt.dll
    ==> DllMain+0x12b (RVA: 0x5a5f)
    ==> CdplIsAppDataProtectionSupported+0x79f (RVA: 0xf3df)
    ==> ??R<lambda_30938a3c66eea5ea19febd13b0110289>@@QEBAXAEBU_EDP_DPL_WNF_KEYS_STATE_DATA@@@Z+0x10 (RVA: 0x3bd98)

 [[IN]] C:\Windows\System32\energyprov.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x1e5c0)
    ==> MIDL_user_free+0x0 (RVA: 0x1e5f0)

 [[IN]] C:\Windows\System32\enterprisecsps.dll
    ==> ?GetOSEdition@OSCspNode@@AEAAJPEAK@Z+0xc98 (RVA: 0xb61d8)
    ==> ?GetStatus@@YAJPEAW4_VBSCSPStatus@@PEAW4_CredGuardCSPStatus@@@Z+0x6e9 (RVA: 0xce805)
    ==> ?GetStatus@@YAJPEAW4_VBSCSPStatus@@PEAW4_CredGuardCSPStatus@@@Z+0xa38c (RVA: 0xd84a8)

 [[IN]] C:\Windows\System32\es.dll
    ==> EsVerifierSettings::EsVerifierSettings+0xf (RVA: 0x1bb17)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x3c730)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x3c760)

 [[IN]] C:\Windows\System32\eShims.dll
    ==> IEShims_Initialize+0x38 (RVA: 0x2038)
    ==> IEShims_Initialize+0x48 (RVA: 0x2048)
    ==> ?LUGetNextLoadedModule@@YAKPEAPEAXPEAUtagLU_MODULE_INFO@@@Z+0x0 (RVA: 0x3c28)
    ==> CShimBindings::OnModuleLoaded+0x30 (RVA: 0x3d40)

 [[IN]] C:\Windows\System32\EtwRundown.dll
    ==> EtwpLogCpuInfo+0x1f1 (RVA: 0x7f79)

 [[IN]] C:\Windows\System32\EventAggregation.dll
    ==> MIDL_user_free+0x0 (RVA: 0x8910)
    ==> MIDL_user_allocate+0x0 (RVA: 0xbab0)

 [[IN]] C:\Windows\System32\evr.dll
    ==> 0x307f8 (no symbol)

 [[IN]] C:\Windows\System32\ExecModelClient.dll
    ==> ForegroundTaskManagerProxy::RegisterWithServer+0x28 (RVA: 0x46a8)
    ==> CreateForegroundManagerTestProxy+0x77 (RVA: 0xcbb7)
    ==> ?RegisterWithServer@ForegroundAppNotificationClient@@AEAAJXZ+0xc5 (RVA: 0x207c5)
    ==> MIDL_user_allocate+0x0 (RVA: 0x39610)
    ==> MIDL_user_free+0x0 (RVA: 0x39640)

 [[IN]] C:\Windows\System32\F12\msdbg2.dll
    ==> RVA: .text+0x3379

 [[IN]] C:\Windows\System32\F12\pdm.dll
    ==> RVA: .text+0x4ba2e
    ==> RVA: .text+0x4eef0

 [[IN]] C:\Windows\System32\F12\pdmproxy100.dll
    ==> RVA: .text+0x2ef9

 [[IN]] C:\Windows\System32\facecredentialprovider.dll
    ==> RVA: .text+0x540b0
    ==> RVA: .text+0x546cd

 [[IN]] C:\Windows\System32\Facilitator.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x81b96)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x81c24)
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x9838a)

 [[IN]] C:\Windows\System32\fcon.dll
    ==> FcPalFree+0x0 (RVA: 0x50c08)

 [[IN]] C:\Windows\System32\feclient.dll
    ==> ?CdplIsSupportedInl@@YAJPEAH@Z+0x6f9 (RVA: 0x7311)

 [[IN]] C:\Windows\System32\fhcpl.dll
    ==> ?_PopulateLocationInfo@CHubPage@@AEAAX_N0@Z+0x913 (RVA: 0xb647)

 [[IN]] C:\Windows\System32\FlightSettings.dll
    ==> ?GetValueAlloc@LicensingProvider@@QEAAJPEAPEAG@Z+0x690 (RVA: 0x3c5bc)

 [[IN]] C:\Windows\System32\fphc.dll
    ==> DllMain+0x59 (RVA: 0x14f5)

 [[IN]] C:\Windows\System32\FrameServer.dll
    ==> ?IsSKUHeadless@@YAHXZ+0x653 (RVA: 0x6b8a3)

 [[IN]] C:\Windows\System32\ftd2xx.dll
    ==> RVA: .text+0x4b6e1
    ==> RVA: .text+0x4b7b1

 [[IN]] C:\Windows\System32\fveapibase.dll
    ==> SLGetWindowsInformationDWORD+0x671 (RVA: 0x4055d)

 [[IN]] C:\Windows\System32\fvecpl.dll
    ==> ?IsPremiumSKU@CFveCplCore@@SA_NXZ+0x669 (RVA: 0x5edd)
    ==> ?IsBlockRevertEnabled@CFveCplCore@@SA_NXZ+0x669 (RVA: 0xf8e5)
    ==> SLGetWindowsInformationDWORD+0x671 (RVA: 0x2ae0d)

 [[IN]] C:\Windows\System32\fveui.dll
    ==> ?SLGetWindowsInformationDWORDWrapper@DeviceEncryptionSupportLevel@@CAJPEBGPEAK@Z+0x671 (RVA: 0x14ec1)

 [[IN]] C:\Windows\System32\fvewiz.dll
    ==> ?FveuipCheckSku@@YAXPEAH0@Z+0x679 (RVA: 0x15c85)
    ==> ?FveuipCheckSku@@YAXPEAH0@Z+0xa2c4 (RVA: 0x1f8d0)
    ==> ?FveuipIsNotPremiumDeEnabledSKU@@YA_NXZ+0x65b (RVA: 0x2a23b)
    ==> ?FveuipIsNotPremiumDeEnabledSKU@@YA_NXZ+0xa1d4 (RVA: 0x33db4)

 [[IN]] C:\Windows\System32\GameInputInbox.dll
    ==> ?Initialize@GameInputClient@@AEAAJXZ+0x167 (RVA: 0x9acb)
    ==> ??2@YAPEAX_KAEBUnothrow_t@std@@@Z+0x0 (RVA: 0xab30)
    ==> GameInputFailFast+0xc (RVA: 0xbf24)
    ==> ??0AlpcPortString@@QEAA@AEBU_GUID@@W4SIPC_SERVICE_BOUNDARY@@@Z+0x68 (RVA: 0x25378)
    ==> SipcFailFast+0x8 (RVA: 0x260ec)

 [[IN]] C:\Windows\System32\gdi32full.dll
    ==> GdiProcessSetup+0x178 (RVA: 0x22c88)
    ==> GdiProcessSetup+0x191 (RVA: 0x22ca1)
    ==> GdiProcessSetup+0x4a5 (RVA: 0x22fb5)
    ==> GdiProcessSetup+0x4f8 (RVA: 0x23008)
    ==> LpkCheckForMirrorSignature+0x25 (RVA: 0x23d29)
    ==> GdiIsUMPDSandboxingEnabled+0xf3 (RVA: 0x2b193)

 [[IN]] C:\Windows\System32\generaltel.dll
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0xcb (RVA: 0x2b1cf)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x123 (RVA: 0x2b227)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x179 (RVA: 0x2b27d)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x1db (RVA: 0x2b2df)
    ==> ?GetMetaDataFromPortableExecutableFile@@YAXAEAU_OFFICE_ADDINS_INFO@@@Z+0x22d (RVA: 0x2b331)
    ==> ?DetectOfficeInstallation@@YAJAEAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@00AEAK@Z+0x4aa (RVA: 0x2be92)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x3368f)
    ==> ?GetCITDataForNamespaceTelemetryPoints@@YAJAEAVPiiFilter@@PEBG@Z+0x146 (RVA: 0x3e616)
    ==> ?GetCITDataForNamespaceTelemetryPoints@@YAJAEAVPiiFilter@@PEBG@Z+0x908 (RVA: 0x3edd8)
    ==> ?GetCitModuleVersionInfo@@YAJPEBG_KPEAG@Z+0xc6 (RVA: 0x3f276)
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2f (RVA: 0x4c34b)
    ==> AslRegistryGetString+0xb4 (RVA: 0x55b38)
    ==> AslRegistryGetStringExpand+0x9f (RVA: 0x55d0f)
    ==> AslRegistryGetStringExpand+0x15b (RVA: 0x55dcb)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x55f3a)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x57481)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x574b5)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x57772)
    ==> PiiFilterEmbeddedPathsExecute+0x62 (RVA: 0x57d26)
    ==> PiiFilterEmbeddedPathsExecute+0xa3 (RVA: 0x57d67)
    ==> AslFileMappingCreate+0x55 (RVA: 0x58391)
    ==> AslFileAttributeToString+0x54 (RVA: 0x595c8)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x59f8c)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x5a8d2)
    ==> AslTelemetryFlush+0x40 (RVA: 0x5db00)
    ==> AslTelemetryFlush+0x6d (RVA: 0x5db2d)
    ==> AslTelemetryFlush+0x9a (RVA: 0x5db5a)
    ==> AslTelemetryFlush+0xbd (RVA: 0x5db7d)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x5dba0)
    ==> AslTelemetryFlush+0x103 (RVA: 0x5dbc3)
    ==> AslTelemetryFlush+0x123 (RVA: 0x5dbe3)
    ==> AslTelemetryFlush+0x142 (RVA: 0x5dc02)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x5dc67)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x5e899)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x5e9a8)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x5e9f9)
    ==> AslLogCreate+0x36 (RVA: 0x5ef42)
    ==> AslLogCreate+0x77 (RVA: 0x5ef83)
    ==> AslLogCreate+0xa1 (RVA: 0x5efad)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x5fb3c)
    ==> AslStringDuplicateA+0x91 (RVA: 0x5fcad)
    ==> AslStringDuplicate+0xb5 (RVA: 0x5feb5)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x6000c)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x609da)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x60e59)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x61a05)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x61f13)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x62448)

 [[IN]] C:\Windows\System32\gpedit.dll
    ==> ?GetDomainIncapableSystemSLPolicy@@YAJPEAH@Z+0x67b (RVA: 0x517d7)

 [[IN]] C:\Windows\System32\hascsp.dll
    ==> ?Execute@CHealthAttestationNode@@UEAAJUtagVARIANT@@@Z+0x70b (RVA: 0x234b)

 [[IN]] C:\Windows\System32\hgcpl.dll
    ==> ?Start@CHomeGroupSSO@@UEAAJIPEAPEAXPEAI@Z+0x685 (RVA: 0x25415)
    ==> ?_s_IsDisabledByPolicy@CHomeGroupUIStatus@@CAJPEAW4HGUI_STATUS_FLAGS@@@Z+0x660 (RVA: 0x33918)
    ==> IsHomeGroupCreateEnabled+0x640 (RVA: 0x4e9e8)

 [[IN]] C:\Windows\System32\hnetcfg.dll
    ==> ?IsHomenetModuleOSType@@YAHW4_ENUM_HNET_MODULE@@@Z+0x651 (RVA: 0xf7a9)

 [[IN]] C:\Windows\System32\HttpsDataSource.dll
    ==> ?ReportFatalException@Common@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@1@K@Z+0x3d (RVA: 0x31145)

 [[IN]] C:\Windows\System32\hvsigpext.dll
    ==> ?HvsiLicenseType@HvsiSystem@@SAKXZ+0x669 (RVA: 0x96b9)

 [[IN]] C:\Windows\System32\iasacct.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xdca0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xdcd0)

 [[IN]] C:\Windows\System32\iasads.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x94c0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x94f0)

 [[IN]] C:\Windows\System32\iashlpr.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xc0f0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xc120)

 [[IN]] C:\Windows\System32\iasnap.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x15f50)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x15f80)

 [[IN]] C:\Windows\System32\iaspolcy.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x6190)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x61c0)

 [[IN]] C:\Windows\System32\iasrad.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x262c0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x262f0)

 [[IN]] C:\Windows\System32\iassam.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x22aa0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x22ad0)

 [[IN]] C:\Windows\System32\iassvcs.dll
    ==> IASGetProductLimitsForSKU+0x761 (RVA: 0x32b1)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x138c0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x138f0)

 [[IN]] C:\Windows\System32\icsigd.dll
    ==> CSharedAccessInternetGatewayDevice_CreateInstance+0x674 (RVA: 0x1964)

 [[IN]] C:\Windows\System32\icsvc.dll
    ==> ?GetLeapSecondDataForFT@@YAXPEAH00_K@Z+0xa (RVA: 0x2224e)

 [[IN]] C:\Windows\System32\ieframe.dll
    ==> _CreateSharedHandleACL+0x1a (RVA: 0x1241f6)

 [[IN]] C:\Windows\System32\iertutil.dll
    ==> _CreateSharedHandleACL+0x15 (RVA: 0x53d59)

 [[IN]] C:\Windows\System32\IKEEXT.DLL
    ==> IkeLicensingInit+0x980 (RVA: 0x1dc0)
    ==> IkeLicensingInit+0xd13d (RVA: 0xe57d)
    ==> WfpMemInit+0x2b (RVA: 0x2b2d3)

 [[IN]] C:\Windows\System32\imapi2fs.dll
    ==> ??2@YAPEAX_K@Z+0x0 (RVA: 0x76434)

 [[IN]] C:\Windows\System32\imm32.dll
    ==> ImmLockClientImc+0x183 (RVA: 0x3ab3)
    ==> CtfImmTIMActivate+0xd9 (RVA: 0x4779)
    ==> CtfImmDispatchDefImeMessage+0x2f (RVA: 0x5f3f)
    ==> LoadImeDpi+0xbb (RVA: 0x647b)
    ==> ISPY_PreUninitialize+0x21 (RVA: 0x6b41)
    ==> 0x8ddc (no symbol)

 [[IN]] C:\Windows\System32\IntelWifiIhv08.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0xa0256)
    ==> get_cached_win_policy<`__acrt_get_begin_thread_init_policy'::`2'::begin_thread_init_policy_properties>+0x16 (RVA: 0xb2f16)
    ==> get_cached_win_policy<`__acrt_get_developer_information_policy'::`2'::developer_information_policy_properties>+0x16 (RVA: 0xb2f62)
    ==> get_cached_win_policy<`__acrt_get_windowing_model_policy'::`2'::windowing_model_policy_properties>+0x12 (RVA: 0xb2faa)
    ==> get_win_policy<`__acrt_get_process_end_policy'::`2'::process_end_policy_properties>+0xc (RVA: 0xb3010)
    ==> __acrt_get_begin_thread_init_policy+0x19 (RVA: 0xb30c1)
    ==> __acrt_get_developer_information_policy+0x19 (RVA: 0xb3115)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xb315c)
    ==> __acrt_get_windowing_model_policy+0x19 (RVA: 0xb31a5)

 [[IN]] C:\Windows\System32\invagent.dll
    ==> ?Initialize@AslTelemetry@@QEAAHPEBD@Z+0x2f (RVA: 0x17ffb)
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x182fc)
    ==> AslRegistryGetString+0xb4 (RVA: 0x1e9c8)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x1eba6)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x1ec62)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x1edd2)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x2017f)
    ==> AslTelemetryFlush+0x40 (RVA: 0x20980)
    ==> AslTelemetryFlush+0x6d (RVA: 0x209ad)
    ==> AslTelemetryFlush+0x9a (RVA: 0x209da)
    ==> AslTelemetryFlush+0xbd (RVA: 0x209fd)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x20a20)
    ==> AslTelemetryFlush+0x103 (RVA: 0x20a43)
    ==> AslTelemetryFlush+0x123 (RVA: 0x20a63)
    ==> AslTelemetryFlush+0x142 (RVA: 0x20a82)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x20ae7)
    ==> AslTelemetryTrackMessageVPrintf+0x44 (RVA: 0x21670)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x217ed)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x218fc)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x2194d)
    ==> AslLogCreate+0x36 (RVA: 0x21f26)
    ==> AslLogCreate+0x77 (RVA: 0x21f67)
    ==> AslLogCreate+0xa1 (RVA: 0x21f91)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x22ae8)
    ==> AslStringDuplicateA+0x91 (RVA: 0x22c59)
    ==> AslStringDuplicate+0xb5 (RVA: 0x22e61)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x22fb8)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x2389a)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x23d21)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x248cd)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x24ddb)
    ==> AslFileMappingCreate+0x55 (RVA: 0x25145)
    ==> AslFileAttributeToString+0x57 (RVA: 0x2634b)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x26d7b)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x276c2)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x2a205)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x2a239)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x2a506)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x2a7d1)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x2a812)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x2b018)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8e (RVA: 0x59002)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x4b (RVA: 0x5963b)
    ==> ?DuplicateFileAttributes@Far@@SAJQEAUtagFILEATTRIBUTE@@PEAPEAU2@@Z+0x119 (RVA: 0x59709)
    ==> ?_AttributesFromPath@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x32e (RVA: 0x59d4e)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x279 (RVA: 0x5a129)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x3e9 (RVA: 0x5a299)
    ==> ?_AttributesFromSignatureInfo@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x562 (RVA: 0x5a412)
    ==> ?_AttributesFromFindDataEtc@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0xd1 (RVA: 0x5b1c1)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x8ea (RVA: 0x5c2ca)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x9b2 (RVA: 0x5c392)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xec (RVA: 0x5d568)
    ==> FaddInitialize+0x19 (RVA: 0x5e1e5)
    ==> FaddLoadFromBuffer+0x1e (RVA: 0x5e3aa)
    ==> FaddLoadFromBuffer+0xaa (RVA: 0x5e436)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x6ec (RVA: 0x5fa9c)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x74e (RVA: 0x5fafe)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0xe1f (RVA: 0x601cf)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0xe4b (RVA: 0x601fb)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x10a8 (RVA: 0x60458)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x1117 (RVA: 0x604c7)
    ==> ?Execute@Telecommand_Azure@@UEAAJPEBGH@Z+0x13b5 (RVA: 0x60765)
    ==> SdbReleaseDatabase+0xde (RVA: 0x623a2)
    ==> InitOnceOfflineRuntimePlatformData+0xa1 (RVA: 0x62561)

 [[IN]] C:\Windows\System32\IPHLPAPI.DLL
    ==> 0xe409 (no symbol)
    ==> GetOwnerModuleFromPidAndInfo+0x30 (RVA: 0x19240)

 [[IN]] C:\Windows\System32\ipnathlp.dll
    ==> ?IsAllowedBeaconOSType@@YAHXZ+0x673 (RVA: 0x5988b)

 [[IN]] C:\Windows\System32\iscsidsc.dll
    ==> DllMain+0x16 (RVA: 0x1026)

 [[IN]] C:\Windows\System32\iscsiexe.dll
    ==> DiscpCleanupService+0x53e (RVA: 0x135c6)
    ==> DiscpServiceStart+0x95 (RVA: 0x141bd)

 [[IN]] C:\Windows\System32\iscsium.dll
    ==> DiscpFreeProcessMemory+0x0 (RVA: 0x37b0)

 [[IN]] C:\Windows\System32\ISM.dll
    ==> AlpcPortString::AlpcPortString+0x62 (RVA: 0x30682)

 [[IN]] C:\Windows\System32\iumbase.dll
    ==> IsSecureProcess+0x0 (RVA: 0x1240)

 [[IN]] C:\Windows\System32\JHI64.dll
    ==> RVA: .text+0x18cca
    ==> RVA: .text+0x25480

 [[IN]] C:\Windows\System32\joinutil.dll
    ==> NetpDoDomainJoinLicensingCheckWorker+0x668 (RVA: 0x53e0)
    ==> NetpDoDomainJoinLicensingCheckWorker+0xa2ca (RVA: 0xf042)

 [[IN]] C:\Windows\System32\keepaliveprovider.dll
    ==> InitializeGlobals+0x692 (RVA: 0x1a52)

 [[IN]] C:\Windows\System32\KerbClientShared.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x25e60)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x25e90)

 [[IN]] C:\Windows\System32\kerberos.dll
    ==> _InitDebugTracingEx+0x17 (RVA: 0x252ef)
    ==> ?TelemetryAllocate@SspTelemetry@@YAPEAX_K@Z+0x0 (RVA: 0x45cf4)
    ==> ?TelemetryFree@SspTelemetry@@YAXPEAX@Z+0x0 (RVA: 0x45d1c)
    ==> _DeleteDebugTracing+0x14 (RVA: 0xbc1d4)

 [[IN]] C:\Windows\System32\kernel.appcore.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x4730)
    ==> MIDL_user_free+0x0 (RVA: 0x4760)

 [[IN]] C:\Windows\System32\kernel32.dll
    ==> GetShortPathNameW+0x375 (RVA: 0x6775)
    ==> QuirkIsEnabledWorker+0x55 (RVA: 0x9175)
    ==> QuirkIsEnabledWorker+0x87 (RVA: 0x91a7)
    ==> CptpQuirksInitOnce+0xa0 (RVA: 0x9464)
    ==> CptpQuirkInitDebugMode+0x37 (RVA: 0x9577)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0xe4c4)
    ==> AslPathIsTemporaryInternetFile+0x119 (RVA: 0xe599)
    ==> AslStringDuplicate+0x64 (RVA: 0xeb10)
    ==> AslRegistryBuildUserPath+0x72 (RVA: 0xf416)
    ==> AslFileMappingCreate+0x5f (RVA: 0x103bb)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x106fa)
    ==> SdbReleaseDatabase+0x6d (RVA: 0x11631)
    ==> SdbReleaseDatabase+0x134 (RVA: 0x116f8)
    ==> SdbInitDatabaseEx+0x6a (RVA: 0x1193e)
    ==> BasepProbeForDllManifest+0x7a (RVA: 0x1549a)
    ==> BasepProbeForDllManifest+0xde (RVA: 0x154fe)
    ==> QuirkIsEnabled3Worker+0xf (RVA: 0x160af)
    ==> BasepGetAppCompatData+0x150 (RVA: 0x162a0)
    ==> _BaseDllInitialize+0x117 (RVA: 0x1755f)
    ==> _BaseDllInitialize+0x127 (RVA: 0x1756f)
    ==> _BaseDllInitialize+0x13b (RVA: 0x17583)
    ==> _Kernel32LegacyLib_BaseDllInitialize+0x28 (RVA: 0x177f4)
    ==> _Kernel32LegacyLib_BaseDllInitialize+0x38 (RVA: 0x17804)
    ==> _Kernel32LegacyLib_BaseDllInitialize+0x4c (RVA: 0x17818)
    ==> LoadAppInitDllsImplementation+0x17 (RVA: 0x182e7)
    ==> GetStartupInfoA+0x14 (RVA: 0x21cb4)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x281eb)
    ==> 0x304cd (no symbol)
    ==> 0x3201e (no symbol)
    ==> 0x3211d (no symbol)
    ==> 0x322f6 (no symbol)
    ==> 0x33bfe (no symbol)
    ==> 0x347ae (no symbol)
    ==> 0x347c4 (no symbol)
    ==> 0x347da (no symbol)
    ==> 0x37120 (no symbol)
    ==> BasepProcessInvalidImage+0x1a2 (RVA: 0x3af42)
    ==> RaiseInvalid16BitExeError+0xd6 (RVA: 0x3bbd6)
    ==> BaseCheckVDM+0xd3 (RVA: 0x40047)
    ==> BaseCheckVDMp+0x133 (RVA: 0x40287)
    ==> GetCompatFlags+0x3e (RVA: 0x69a46)
    ==> ConsoleCallServer+0x4 (RVA: 0x6cd48)
    ==> ConsoleCallServerWithBuffers+0x4 (RVA: 0x6cefc)
    ==> QuirkIsEnabled2Worker+0xf (RVA: 0x7287f)
    ==> AslFileOpen+0x44 (RVA: 0x72ea0)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x73176)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x194 (RVA: 0x73724)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1ba (RVA: 0x739fe)
    ==> AslPathWildcardFindFirst+0x118 (RVA: 0x7421c)
    ==> AslPathWildcardFindFirst+0x1fe (RVA: 0x74302)
    ==> AslPathWildcardFindFirst+0x265 (RVA: 0x74369)
    ==> AslPathWildcardFindNext+0x9d (RVA: 0x7478d)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x753e4)
    ==> AslpAllocMatchNode+0xf (RVA: 0x7552b)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x75738)
    ==> AslpProcessMatchRegNode+0x91 (RVA: 0x75c59)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x76251)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x76424)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x76aaa)
    ==> AslpFileGetVersionBlock+0x468 (RVA: 0x798d0)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x7af50)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0x7bbf7)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x7bce7)
    ==> SdbResolveDatabaseEx+0x160 (RVA: 0x7c000)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x7d3be)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x7d4b8)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x7d58a)
    ==> SdbpCheckMatchingTextEntry+0x278 (RVA: 0x7da60)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x7e653)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x7eb79)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x7f04d)
    ==> SdbpGetProcessHistory+0x146 (RVA: 0x7f3e6)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x7f5fe)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x7f77d)

 [[IN]] C:\Windows\System32\KernelBase.dll
    ==> ARI::Globals::Initialize+0x37 (RVA: 0xa43f)
    ==> ?GetHeap@ReservedForLocalUse@@YAPEAXXZ+0xe (RVA: 0xb84e)
    ==> IsDebuggerPresent+0x0 (RVA: 0x16dc0)
    ==> LoadStringBaseExW+0x123 (RVA: 0x19123)
    ==> GetShortPathNameW+0x35d (RVA: 0x1cead)
    ==> GetShortPathNameW+0x36b (RVA: 0x1cebb)
    ==> GetConsoleOutputCP+0x1e (RVA: 0x209ae)
    ==> WaitForSingleObjectEx+0xcf (RVA: 0x28adf)
    ==> WaitForSingleObjectEx+0xe2 (RVA: 0x28af2)
    ==> WaitForSingleObjectEx+0xf5 (RVA: 0x28b05)
    ==> BasepMapModuleHandle+0x17 (RVA: 0x2dfcf)
    ==> BasepLoadLibraryAsDataFileInternal+0x2aa (RVA: 0x2f91a)
    ==> CreateFileInternal+0x4b2 (RVA: 0x311d2)
    ==> GetTokenInformation+0x4f (RVA: 0x31d0f)
    ==> DeleteFileW+0x17 (RVA: 0x37cc7)
    ==> GetModuleHandleA+0x44 (RVA: 0x39014)
    ==> GetModuleHandleW+0x5f (RVA: 0x3908f)
    ==> GetSystemInfoInternal+0x82 (RVA: 0x3ae3a)
    ==> KernelbasePostInit+0x15 (RVA: 0x40225)
    ==> KernelbasePostInit+0x21 (RVA: 0x40231)
    ==> CreateProcessInternalA+0x48 (RVA: 0x483f8)
    ==> IsProcessInJob+0x1a (RVA: 0x4896a)
    ==> CreateProcessInternalW+0x336 (RVA: 0x49336)
    ==> CreateProcessInternalW+0x17c9 (RVA: 0x4a7c9)
    ==> ConsoleAllocate+0x3f (RVA: 0x4fb8b)
    ==> BasepGetNamedObjectDirectoryForToken+0x1de (RVA: 0x501d2)
    ==> BasepGetNamedObjectDirectoryForToken+0x1ee (RVA: 0x501e2)
    ==> BasepGetNamedObjectDirectoryForToken+0x202 (RVA: 0x501f6)
    ==> BasepGetNamedObjectDirectoryForToken+0x212 (RVA: 0x50206)
    ==> BasepGetNamedObjectDirectoryForToken+0x222 (RVA: 0x50216)
    ==> BasepGetNamedObjectDirectoryForToken+0x23e (RVA: 0x50232)
    ==> BasepGetNamedObjectDirectoryForToken+0x49f (RVA: 0x50493)
    ==> BasepGetNamedObjectDirectoryForToken+0x4af (RVA: 0x504a3)
    ==> BasepGetNamedObjectDirectoryForToken+0x4c3 (RVA: 0x504b7)
    ==> BasepGetNamedObjectDirectoryForToken+0x4d3 (RVA: 0x504c7)
    ==> BasepGetNamedObjectDirectoryForToken+0x4e3 (RVA: 0x504d7)
    ==> BasepGetNamedObjectDirectoryForToken+0x4ff (RVA: 0x504f3)
    ==> ConsoleCommitState+0xa (RVA: 0x50786)
    ==> _KernelBaseBaseDllInitialize+0x207 (RVA: 0x50c5b)
    ==> _KernelBaseBaseDllInitialize+0x217 (RVA: 0x50c6b)
    ==> _KernelBaseBaseDllInitialize+0x22b (RVA: 0x50c7f)
    ==> _KernelBaseBaseDllInitialize+0x27d (RVA: 0x50cd1)
    ==> _KernelBaseBaseDllInitialize+0x28d (RVA: 0x50ce1)
    ==> _KernelBaseBaseDllInitialize+0x2a1 (RVA: 0x50cf5)
    ==> _KernelBaseBaseDllInitialize+0x2b1 (RVA: 0x50d05)
    ==> _KernelBaseBaseDllInitialize+0x2c1 (RVA: 0x50d15)
    ==> _KernelBaseBaseDllInitialize+0x2dd (RVA: 0x50d31)
    ==> _KernelBaseBaseDllInitialize+0x320 (RVA: 0x50d74)
    ==> _KernelBaseBaseDllInitialize+0x330 (RVA: 0x50d84)
    ==> _KernelBaseBaseDllInitialize+0x344 (RVA: 0x50d98)
    ==> _KernelBaseBaseDllInitialize+0x354 (RVA: 0x50da8)
    ==> _KernelBaseBaseDllInitialize+0x364 (RVA: 0x50db8)
    ==> _KernelBaseBaseDllInitialize+0x380 (RVA: 0x50dd4)
    ==> ConsoleCallServerWithBuffers+0x4 (RVA: 0x513ac)
    ==> ConsoleCallServer+0x4 (RVA: 0x51608)
    ==> GetConsoleTitleInternal+0x28 (RVA: 0x516cc)
    ==> SetConsoleMode+0xf (RVA: 0x5175f)
    ==> WriteConsoleW+0xb (RVA: 0x517eb)
    ==> ConsoleInitialize+0x1f (RVA: 0x51a7b)
    ==> InitExeName+0x1f (RVA: 0x51c47)
    ==> SetupMainNlsFiles+0x9 (RVA: 0x5213d)
    ==> CsrBaseClientConnectToServer+0x1a (RVA: 0x52466)
    ==> KernelBaseDllInitializeMemoryManager+0x6 (RVA: 0x524ae)
    ==> ConsoleLaunchServerProcess+0xf (RVA: 0x52dc3)
    ==> LoadResource+0x12 (RVA: 0x57582)
    ==> FindResourceExW+0x8c (RVA: 0x5767c)
    ==> SizeofResource+0x12 (RVA: 0x57902)
    ==> GetProcessHeap+0x0 (RVA: 0x5b650)
    ==> WaitForMultipleObjectsEx+0x7b (RVA: 0x5ba7b)
    ==> GetEnvironmentStringsW+0xf (RVA: 0x5cecf)
    ==> GetModuleHandleExW+0x14d (RVA: 0x5e52d)
    ==> SwitchedCloseHandleNoRaiseUMException_WinBLUE+0x6 (RVA: 0x5f036)
    ==> BaseInitializeFiberContext+0x34 (RVA: 0x5f554)
    ==> GetProcAddressForCaller+0xcb (RVA: 0x5facb)
    ==> GetConsoleMode+0x25 (RVA: 0x5fb15)
    ==> SwitchedRegCloseKeyNoRaiseUMException_WinBLUE+0x6 (RVA: 0x60276)
    ==> MoveFileWithProgressTransactedW+0x202 (RVA: 0x61042)
    ==> QueryFullProcessImageNameW+0x53 (RVA: 0x65873)
    ==> GetDiskFreeSpaceW+0x120 (RVA: 0x65ca0)
    ==> ProcessIdToSessionId+0x2c (RVA: 0x6734c)
    ==> ?CommonHeapReAllocDefault@@YAJPEAX_K1PEAPEAX@Z+0x55 (RVA: 0x67679)
    ==> GetEnvironmentStrings+0x14 (RVA: 0x67ac4)
    ==> GetStdHandle+0xb (RVA: 0x6a6eb)
    ==> GetStdHandle+0x24 (RVA: 0x6a704)
    ==> GetStdHandle+0x4e (RVA: 0x6a72e)
    ==> GetStdHandle+0x66 (RVA: 0x6a746)
    ==> GetStdHandle+0x7f (RVA: 0x6a75f)
    ==> GetStartupInfoW+0x0 (RVA: 0x6c3e0)
    ==> SetStdHandle+0x9 (RVA: 0x6eb99)
    ==> SetStdHandle+0x2a (RVA: 0x6ebba)
    ==> SetStdHandle+0x46 (RVA: 0x6ebd6)
    ==> ?RtlFreeProcessHeap@details@wil@@YAXPEAX@Z+0x0 (RVA: 0x6ef00)
    ==> SetConsoleCtrlHandler+0x6c (RVA: 0x7350c)
    ==> SetConsoleCtrlHandler+0x8a (RVA: 0x7352a)
    ==> K32EnumProcesses+0x2b (RVA: 0x7656b)
    ==> RemoveDirectoryW+0x1c (RVA: 0x7783c)
    ==> FindVolumeClose+0x4 (RVA: 0x80354)
    ==> malloc+0x0 (RVA: 0x80490)
    ==> PerfpAllocate+0x0 (RVA: 0x8c010)
    ==> CtrlRoutine+0xc9 (RVA: 0x8c2d9)
    ==> ConsoleSanitizeStandardIoObjects+0x29 (RVA: 0x8ca4d)
    ==> ReadConsoleOutputInternal+0x10a (RVA: 0x8cc3e)
    ==> WriteConsoleOutputInternal+0x175 (RVA: 0x8cf19)
    ==> ?TipHookProcessLifecycle@@YAXXZ+0x22 (RVA: 0xaf0d6)
    ==> ?RtlAllocateFastFailOnErr@details_abi@tip@@YAPEAX_K@Z+0x4 (RVA: 0xb3824)
    ==> ?RtlFreeFastFailOnErr@details_abi@tip@@YAXPEAX@Z+0x4 (RVA: 0xb387c)
    ==> GetSystemGlobalData+0x22 (RVA: 0xb3b6e)
    ==> GetSystemTimeAndBias+0x32 (RVA: 0xb3bd2)
    ==> 0xb9f14 (no symbol)
    ==> 0xc83aa (no symbol)
    ==> 0xc83c0 (no symbol)
    ==> 0xc83d6 (no symbol)
    ==> 0xc84a0 (no symbol)
    ==> 0xc84b6 (no symbol)
    ==> 0xc84cc (no symbol)
    ==> 0xcdf09 (no symbol)
    ==> 0xcdf19 (no symbol)
    ==> 0xcdf2d (no symbol)
    ==> 0xcdf3d (no symbol)
    ==> 0xcdf4d (no symbol)
    ==> 0xcdf69 (no symbol)
    ==> 0xd0be0 (no symbol)
    ==> 0xd0bf6 (no symbol)
    ==> 0xd0c0c (no symbol)
    ==> 0xd0f6c (no symbol)
    ==> 0xd1544 (no symbol)
    ==> 0xd155a (no symbol)
    ==> 0xd1570 (no symbol)
    ==> 0xd3d36 (no symbol)
    ==> 0xd3d4c (no symbol)
    ==> 0xd3d62 (no symbol)
    ==> 0xd401a (no symbol)
    ==> 0xd4030 (no symbol)
    ==> 0xd4046 (no symbol)
    ==> 0xd5516 (no symbol)
    ==> 0xd552c (no symbol)
    ==> 0xd5542 (no symbol)
    ==> 0xd5721 (no symbol)
    ==> 0xd595c (no symbol)
    ==> 0xd5972 (no symbol)
    ==> 0xd5988 (no symbol)
    ==> 0xd5a72 (no symbol)
    ==> 0xdd5fc (no symbol)
    ==> 0xdd66a (no symbol)
    ==> QueryFullProcessImageNameA+0x3f (RVA: 0xde54f)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x196 (RVA: 0x113dc6)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x241 (RVA: 0x113e71)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x2a5 (RVA: 0x113ed5)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x6ea (RVA: 0x11431a)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0xd88 (RVA: 0x1149b8)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0xdc6 (RVA: 0x1149f6)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0xe16 (RVA: 0x114a46)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0xe9c (RVA: 0x114acc)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x10d7 (RVA: 0x114d07)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x12ee (RVA: 0x114f1e)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x1526 (RVA: 0x115156)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x1574 (RVA: 0x1151a4)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x15cc (RVA: 0x1151fc)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x1621 (RVA: 0x115251)
    ==> ?CheckIfRepairNeeded@ZuneMusicRepairer@@CAJPEBGPEA_N@Z+0x1e84 (RVA: 0x115ab4)
    ==> TelpReadUsersPolicySetting+0x1c2 (RVA: 0x11a656)
    ==> ConsoleAttachOrAllocate+0x21 (RVA: 0x11d1e1)
    ==> WriteConsoleInternal+0xd (RVA: 0x11f215)
    ==> SignalObjectAndWait+0x7b (RVA: 0x123e6b)
    ==> SignalObjectAndWait+0x8e (RVA: 0x123e7e)
    ==> SignalObjectAndWait+0xa1 (RVA: 0x123e91)
    ==> TerminateThread+0x32 (RVA: 0x127812)
    ==> SetStdHandleEx+0x2a (RVA: 0x12bb3a)
    ==> SetStdHandleEx+0x41 (RVA: 0x12bb51)
    ==> SetStdHandleEx+0x58 (RVA: 0x12bb68)
    ==> UnhandledExceptionFilter+0x51d (RVA: 0x12c79d)
    ==> CsrpLocalSetupForSecureProcess+0x31 (RVA: 0x12c9e5)

 [[IN]] C:\Windows\System32\KeyboardFilterShim.dll
    ==> ??3@YAXPEAX@Z+0x0 (RVA: 0x2d24)

 [[IN]] C:\Windows\System32\keyiso.dll
    ==> MSCryptFree+0x0 (RVA: 0x18c0)

 [[IN]] C:\Windows\System32\LicenseManager.dll
    ==> ?StoreAppsAreDisabled@@YA_NXZ+0x624 (RVA: 0x29dc4)

 [[IN]] C:\Windows\System32\LicensingDiagSpp.dll
    ==> ?Gather@CDesktopCollectionState@@UEAAJXZ+0x698 (RVA: 0xad28)
    ==> ?Gather@CDesktopCollectionState@@UEAAJXZ+0x12e06 (RVA: 0x1d496)
    ==> ?InitLicensingStatusParameters@?$CGenuineInformationStateT@VCEmptyType@@@@AEAAJXZ+0x81b (RVA: 0x2cbbf)
    ==> ?InitSlcProtectedLocalGenuineStatus@?$CGenuineInformationStateT@VCEmptyType@@@@AEAAJXZ+0x66d (RVA: 0x3fda5)

 [[IN]] C:\Windows\System32\localspl.dll
    ==> ALLOCMEM+0x6 (RVA: 0xc722)

 [[IN]] C:\Windows\System32\LockHostingFramework.dll
    ==> ?CheckBreakOnStart@@YAXXZ+0xa2 (RVA: 0x1a65a)
    ==> ?ForciblyTerminateLockAppHost@@YAXXZ+0x4 (RVA: 0x1b66c)

 [[IN]] C:\Windows\System32\LogonController.dll
    ==> WriteLoggedOnUserinfo+0x93 (RVA: 0x7733)
    ==> CProcessStateManager::_InitializeUserSid+0x58 (RVA: 0x8d74)
    ==> ?_InitializeSessionData@CProcessStateManager@@AEAAXXZ+0xfb (RVA: 0xf8af)
    ==> CProcessStateManager::GetSessionLangID+0x1f (RVA: 0xfd5b)
    ==> ?_OnWTSSessionChange@CUserSettingChangeMonitor@@AEAAX_K_J@Z+0x80 (RVA: 0x14388)
    ==> WluipStartServer+0x145 (RVA: 0x195d9)
    ==> WluirNotifyUserIsLoggedOn+0x16 (RVA: 0x2e406)
    ==> ?IsUserLoggedOn@@YA_NXZ+0x11 (RVA: 0x6b161)
    ==> ??1CProcessStateManager@@MEAA@XZ+0x6e (RVA: 0x7270a)
    ==> ?get_ShouldLaunchFirstSignInAnimationInUserSession@CProcessStateManager@@UEAAJPEAE@Z+0x17 (RVA: 0x745b7)
    ==> ?put_ShouldLaunchFirstSignInAnimationInUserSession@CProcessStateManager@@UEAAJE@Z+0x15 (RVA: 0x74645)
    ==> ?GetCurrentSessionUserSid@@YAJPEAPEAG@Z+0x22 (RVA: 0x792fa)

 [[IN]] C:\Windows\System32\lsasrv.dll
    ==> LsapFree+0x0 (RVA: 0x2f830)
    ==> LsapAllocate+0x0 (RVA: 0x36e90)
    ==> LsapAllocateNoZero+0x0 (RVA: 0x49bb0)
    ==> LsapSetupTuningParameters+0xa (RVA: 0x4f72a)
    ==> LsapInitializeScavenger+0x178 (RVA: 0x57da0)
    ==> LoadPackages+0x202 (RVA: 0x5a6fa)
    ==> LsapDbInitializeSLAPIPolicies+0x6f7 (RVA: 0x5d0db)
    ==> SpmpInitializePackageControl+0x1a (RVA: 0x6f662)
    ==> 0x99d2d (no symbol)
    ==> LsapIsCredentialIsolationEnablementLicensed+0x623 (RVA: 0xd281f)

 [[IN]] C:\Windows\System32\lxss\wslclient.dll
    ==> ?LaunchProcess@SvcComm@helpers@lx@@QEAAKPEBU_GUID@@PEBGHQEAPEBGK11K@Z+0x4c4 (RVA: 0x2164c)

 [[IN]] C:\Windows\System32\mcicda.dll
    ==> CheckDllLoaderLockHeld+0x65 (RVA: 0x700d)

 [[IN]] C:\Windows\System32\MFCaptureEngine.dll
    ==> ?Initialize@CCameraSoundAudioPlayerWrapper@@AEAAJK@Z+0x7b7 (RVA: 0x5bdf3)
    ==> ?GetAppsCapabilityAccess@CapabilityManagerHelper@@YAJPEBG@Z+0x676 (RVA: 0x6785a)

 [[IN]] C:\Windows\System32\mfcore.dll
    ==> ??0CMediaSession@@QEAA@PEAUIMFPMPHost@@PEAUIMFPMPHostApp@@PEAUIMFPMPServer@@PEAUIMFComponentCreator@@PEAVCPolicyEngine@@PEAUIMFPresentationClock@@PEAUIMFAttributes@@PEAJ@Z+0x155c (RVA: 0xb105c)

 [[IN]] C:\Windows\System32\MFMediaEngine.dll
    ==> 0x7f428 (no symbol)
    ==> 0x8c9b9 (no symbol)

 [[IN]] C:\Windows\System32\mfnetcore.dll
    ==> RVA: .text+0xe4ead

 [[IN]] C:\Windows\System32\mfplat.dll
    ==> MFGetMFTMerit+0x68c (RVA: 0x86a3c)
    ==> ?GetCurrentUser@@YAJPEAPEAUIUser@System@Windows@@@Z+0x7ab (RVA: 0xc150b)

 [[IN]] C:\Windows\System32\mfsvr.dll
    ==> 0x67f87 (no symbol)
    ==> 0x7b1dd (no symbol)

 [[IN]] C:\Windows\System32\Microsoft.Uev.AppAgent.dll
    ==> ?ReadLicenseValue@productionSlapiProxy@SlapiWrapper@Shared@AppMan@@UEAAJPEB_WPEAK@Z+0x671 (RVA: 0x45311)

 [[IN]] C:\Windows\System32\Microsoft.Uev.CommonBridge.dll
    ==> ?ReadLicenseValue@productionSlapiProxy@SlapiWrapper@Shared@AppMan@@UEAAJPEB_WPEAK@Z+0x671 (RVA: 0x33331)

 [[IN]] C:\Windows\System32\Microsoft.Uev.ModernAppAgent.dll
    ==> ?ReadLicenseValue@productionSlapiProxy@SlapiWrapper@Shared@AppMan@@UEAAJPEB_WPEAK@Z+0x671 (RVA: 0x418c1)

 [[IN]] C:\Windows\System32\migration\AppManMigrationPlugin.dll
    ==> ?ReadLicenseValue@productionSlapiProxy@SlapiWrapper@Shared@AppMan@@UEAAJPEB_WPEAK@Z+0x671 (RVA: 0x145b1)

 [[IN]] C:\Windows\System32\migration\AppxUpgradeMigrationPlugin.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x2ddcc)
    ==> ?ReAlloc@GlobalHeap@Common@@SAJPEAX_KPEAPEAX@Z+0x18 (RVA: 0x2de24)

 [[IN]] C:\Windows\System32\migration\sppmig.dll
    ==> ?Gather@?$CSPPMigrationPlugInT@VCEmptyType@@@@EEAAJPEAUIMigrationContext@@@Z+0x6b5 (RVA: 0x29a5)
    ==> ?SLGetWindowsInformationWrapper@?$CGenuineUtilsT@VCEmptyType@@@@SAJPEBGPEAW4_tagSLDATATYPE@@PEAIPEAPEAE@Z+0x69a (RVA: 0x1764a)

 [[IN]] C:\Windows\System32\migration\WsUpgrade.dll
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x153b4)
    ==> exit_or_terminate_process+0x12 (RVA: 0x18d7e)

 [[IN]] C:\Windows\System32\MirrorDrvCompat.dll
    ==> ?DuplicateDesktop@CMitigationManagement@@AEAAJXZ+0x402 (RVA: 0x303e)

 [[IN]] C:\Windows\System32\mlang.dll
    ==> CCpMRU::Init+0x2b (RVA: 0x18a3)

 [[IN]] C:\Windows\System32\modernexecserver.dll
    ==> Execution::ForegroundManagerMUX::InitRPCServer+0x3f (RVA: 0x4523)
    ==> Execution::ForegroundManagerMUX::InitRPCServer+0x65 (RVA: 0x4549)
    ==> Execution::ForegroundManagerMUX::InitRPCServer+0x8b (RVA: 0x456f)
    ==> ?RPCSecurityCallback@ForegroundManagerMUX@Execution@@KAJPEAX0@Z+0x6 (RVA: 0xca96)
    ==> 0x24ca0 (no symbol)
    ==> ?UnInitRPCServer@ForegroundManagerMUX@Execution@@IEAAJXZ+0x6 (RVA: 0x3a72e)
    ==> ?UnInitRPCServer@ForegroundManagerMUX@Execution@@IEAAJXZ+0x27 (RVA: 0x3a74f)
    ==> ?UnInitRPCServer@ForegroundManagerMUX@Execution@@IEAAJXZ+0x48 (RVA: 0x3a770)

 [[IN]] C:\Windows\System32\mprapi.dll
    ==> InitializePorts+0x67f (RVA: 0xb0f3)
    ==> GetRestrictedPortCount+0x665 (RVA: 0x1a5f1)
    ==> HashTabFree+0x0 (RVA: 0x33e00)

 [[IN]] C:\Windows\System32\mprddm.dll
    ==> HashTabFree+0x0 (RVA: 0x86030)

 [[IN]] C:\Windows\System32\MrmCoreR.dll
    ==> ?DebugBreakIfAppropriate@Resources@Microsoft@@YAXXZ+0x2e (RVA: 0x90012)

 [[IN]] C:\Windows\System32\MSAMRNBDecoder.dll
    ==> SLGetWindowsInformationDWORD+0x67e (RVA: 0xa27a)

 [[IN]] C:\Windows\System32\MSAMRNBEncoder.dll
    ==> SLGetWindowsInformationDWORD+0x67e (RVA: 0x1b61a)

 [[IN]] C:\Windows\System32\MSAMRNBSource.dll
    ==> SLGetWindowsInformationDWORD+0x67e (RVA: 0x738a)

 [[IN]] C:\Windows\System32\msctf.dll
    ==> TF_CanUninitialize+0x3b (RVA: 0x655b)
    ==> ?LOGN@@YAXW4DEBUGLEVEL@@PEBDZZ+0x34 (RVA: 0x10cbc)
    ==> TF_Notify+0x4ea (RVA: 0x1bdba)
    ==> TF_Notify+0x512 (RVA: 0x1bde2)
    ==> TF_Notify+0x561 (RVA: 0x1be31)
    ==> SYSTHREAD::LockThreadMessageWindow+0xca (RVA: 0x1c50a)
    ==> ?_SetFocus@CThreadInputMgr@@QEAAJPEAUIDocumentInputManagerPrivate@@H@Z+0x5d (RVA: 0x1dcfd)
    ==> ?_SetFocus@CThreadInputMgr@@QEAAJPEAUIDocumentInputManagerPrivate@@H@Z+0x7c (RVA: 0x1dd1c)
    ==> CCtfServerPort::ProcessConnectionRequest+0xd8 (RVA: 0x21218)
    ==> TF_GetAppCompatFlags+0x1f (RVA: 0x2576f)
    ==> ??0CThreadInputMgr@@QEAA@PEAUSYSTHREAD@@@Z+0x531 (RVA: 0x262d1)
    ==> CThreadInputMgr::_StartAccFocusTracking+0x40 (RVA: 0x284e0)
    ==> _ImeSetActiveContext+0x22e (RVA: 0x3162e)
    ==> ?GetAppCompatFlags@CThreadInputMgr@@UEAAKXZ+0x2f (RVA: 0x3665f)
    ==> ?_OwnedLoaderLockBySomeone@@YAHXZ+0x0 (RVA: 0x3c018)
    ==> ?_InsideLoaderLock@@YAHXZ+0x0 (RVA: 0x3ce6c)
    ==> 0x4a3d8 (no symbol)
    ==> 0x57cc2 (no symbol)
    ==> 0x57ce6 (no symbol)

 [[IN]] C:\Windows\System32\msdia140.dll
    ==> RVA: .text+0x9fd41

 [[IN]] C:\Windows\System32\msdtclog.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x16aa0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x16ad0)

 [[IN]] C:\Windows\System32\msdtcprx.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x81f10)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x81f40)

 [[IN]] C:\Windows\System32\msdtctm.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xb5fa0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xb5fd0)

 [[IN]] C:\Windows\System32\mskeyprotcli.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x17ed0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x17f00)

 [[IN]] C:\Windows\System32\mskeyprotect.dll
    ==> MsKeyProtCloseProtector+0x1a (RVA: 0x1f3a)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xbbd0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xbc00)

 [[IN]] C:\Windows\System32\MSMPEG2ENC.DLL
    ==> RVA: .text+0x78aea

 [[IN]] C:\Windows\System32\mstask.dll
    ==> ?SaveP@CJob@@QEAAJPEBGHK@Z+0x7c6 (RVA: 0xa942)

 [[IN]] C:\Windows\System32\msv1_0.dll
    ==> SpLsaModeInitialize+0x26b (RVA: 0x2658b)
    ==> ?TelemetryAllocate@SspTelemetry@@YAPEAX_K@Z+0x0 (RVA: 0x2cb8c)
    ==> ?TelemetryFree@SspTelemetry@@YAXPEAX@Z+0x0 (RVA: 0x2cbb4)
    ==> SLGetWindowsInformationDWORD+0x63a (RVA: 0x2d99e)

 [[IN]] C:\Windows\System32\mswsock.dll
    ==> MSWSOCK_Initialize+0x7b (RVA: 0xa807)
    ==> MSWSOCK_Initialize+0x2cb (RVA: 0xaa57)
    ==> DllMain+0x222 (RVA: 0x1385e)

 [[IN]] C:\Windows\System32\mtxclu.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x36ec0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x36ef0)

 [[IN]] C:\Windows\System32\ncbservice.dll
    ==> 0x12d30 (no symbol)

 [[IN]] C:\Windows\System32\ncrypt.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x165c0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x165f0)

 [[IN]] C:\Windows\System32\ncryptprov.dll
    ==> _PkcsFree+0x0 (RVA: 0x1e7d0)
    ==> MSCryptAlloc+0x0 (RVA: 0x3b750)

 [[IN]] C:\Windows\System32\ncryptsslp.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x14020)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x14050)

 [[IN]] C:\Windows\System32\negoexts.dll
    ==> SpInitialize+0x10d (RVA: 0x3a6d)

 [[IN]] C:\Windows\System32\netjoin.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x144a0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x144d0)

 [[IN]] C:\Windows\System32\netlogon.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x77180)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x771b0)

 [[IN]] C:\Windows\System32\netprovfw.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x6e00)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x6e30)

 [[IN]] C:\Windows\System32\netshell.dll
    ==> ?IsHomenetModuleOSType@@YAHW4_ENUM_HNET_MODULE@@@Z+0x651 (RVA: 0x145ad)

 [[IN]] C:\Windows\System32\NgcCtnrSvc.dll
    ==> `anonymous namespace'::MakeUniqueProcessParameters+0xab (RVA: 0x59dbb)

 [[IN]] C:\Windows\System32\nshwfp.dll
    ==> DllMain+0x62 (RVA: 0x11e6)

 [[IN]] C:\Windows\System32\ntdll.dll
    ==> RtlpLowFragHeapFlushCaches+0x20d (RVA: 0x3a95)
    ==> RtlpLowFragHeapFlushCaches+0x2cb (RVA: 0x3b53)
    ==> CsrClientCallServer+0x5b (RVA: 0x89fb)
    ==> CsrClientCallServer+0x179 (RVA: 0x8b19)
    ==> CsrClientConnectToServer+0x42 (RVA: 0x8e62)
    ==> CsrClientConnectToServer+0x176 (RVA: 0x8f96)
    ==> RtlDestroyHeap+0x79 (RVA: 0x96f9)
    ==> RtlDestroyHeap+0x1a7 (RVA: 0x9827)
    ==> RtlDeleteTimer+0x1f (RVA: 0x9c1f)
    ==> RtlCreateTimer+0x38 (RVA: 0x9d88)
    ==> RtlpSubSegmentInitialize+0x2fe (RVA: 0xa38e)
    ==> RtlCreateHeap+0x59 (RVA: 0xa909)
    ==> RtlCreateHeap+0x47a (RVA: 0xad2a)
    ==> RtlDeregisterWaitEx+0x18 (RVA: 0xb5c8)
    ==> RtlQueueWorkItem+0x4c (RVA: 0xb7cc)
    ==> RtlQueueWorkItem+0x333 (RVA: 0xbab3)
    ==> RtlpInitializeHeapSegment+0x23 (RVA: 0xbb77)
    ==> RtlRegisterWait+0x35 (RVA: 0xbea5)
    ==> TpAllocWait+0x4e (RVA: 0xdf8e)
    ==> TpAllocTimer+0x40 (RVA: 0xf010)
    ==> TppWorkpValidateWork+0x25 (RVA: 0xf239)
    ==> TppWorkpValidateWork+0x48 (RVA: 0xf25c)
    ==> TpAllocWork+0x50 (RVA: 0xf330)
    ==> LdrpQueueWork+0x60 (RVA: 0xf480)
    ==> TpSimpleTryPost+0x3e (RVA: 0x10c1e)
    ==> RtlInitializeResource+0x2a (RVA: 0x1130a)
    ==> RtlpAddDebugInfoToCriticalSection+0x21 (RVA: 0x11861)
    ==> TppWaitpValidateWait+0x28 (RVA: 0x12060)
    ==> TppIopValidateIo+0x31 (RVA: 0x12889)
    ==> TpPostWork+0x24 (RVA: 0x128e4)
    ==> TppTimerpValidateTimer+0x31 (RVA: 0x12945)
    ==> TppTimerpValidateTimer+0x53 (RVA: 0x12967)
    ==> TppWorkPost+0x67 (RVA: 0x12a1f)
    ==> RtlpGetActivationContextData+0x3a (RVA: 0x133ae)
    ==> TppPoolpReferenceGlobalPool+0x36 (RVA: 0x1381a)
    ==> RtlpFreeDebugInfo+0x1a (RVA: 0x13e1a)
    ==> LdrpShouldModuleImportBeRedirected+0x1a (RVA: 0x14296)
    ==> LdrpFindDllActivationContext+0x23 (RVA: 0x14ea3)
    ==> RtlpQueryEnvironmentCache+0x176 (RVA: 0x15f36)
    ==> LdrpSnapKernelBaseExtensions+0x61 (RVA: 0x16f45)
    ==> LdrpLoadDependentModule+0x348 (RVA: 0x17f28)
    ==> LdrpLoadDependentModule+0x11ac (RVA: 0x18d8c)
    ==> LdrpLoadDependentModule+0x16d5 (RVA: 0x192b5)
    ==> LdrpLoadDependentModule+0x16f1 (RVA: 0x192d1)
    ==> LdrpLoadDependentModule+0x1710 (RVA: 0x192f0)
    ==> LdrpLogDllState+0xf (RVA: 0x1a6db)
    ==> RtlDosApplyFileIsolationRedirection_Ustr+0x1f3 (RVA: 0x1abd3)
    ==> RtlDosApplyFileIsolationRedirection_Ustr+0x202 (RVA: 0x1abe2)
    ==> RtlpDosPathNameToRelativeNtPathName+0x4aa (RVA: 0x1b3fa)
    ==> RtlGetFullPathName_Ustr+0x729 (RVA: 0x1bb59)
    ==> RtlGetFullPathName_Ustr+0x807 (RVA: 0x1bc37)
    ==> RtlGetFullPathName_Ustr+0x833 (RVA: 0x1bc63)
    ==> RtlpGrowBlockInPlace+0x227 (RVA: 0x1f857)
    ==> RtlpGrowBlockInPlace+0x3b4 (RVA: 0x1f9e4)
    ==> TppAlpcpExecuteCallback+0x178 (RVA: 0x20248)
    ==> TppAlpcpExecuteCallback+0x260 (RVA: 0x20330)
    ==> TppAlpcpExecuteCallback+0x35c (RVA: 0x2042c)
    ==> RtlSetThreadSubProcessTag+0x38 (RVA: 0x205a8)
    ==> RtlInitializeCriticalSectionEx+0xca (RVA: 0x20c8a)
    ==> RtlpReAllocateHeap+0x26b (RVA: 0x21c4f)
    ==> RtlpReAllocateHeap+0x284 (RVA: 0x21c68)
    ==> RtlpReAllocateHeap+0x2a7 (RVA: 0x21c8b)
    ==> RtlpReAllocateHeap+0x764 (RVA: 0x22148)
    ==> RtlpReAllocateHeap+0x7e1 (RVA: 0x221c5)
    ==> RtlpReAllocateHeap+0x932 (RVA: 0x22316)
    ==> RtlpReAllocateHeap+0x9be (RVA: 0x223a2)
    ==> RtlpReAllocateHeap+0x9cd (RVA: 0x223b1)
    ==> RtlpReAllocateHeap+0xbb9 (RVA: 0x2259d)
    ==> RtlpReAllocateHeap+0xec3 (RVA: 0x228a7)
    ==> RtlpReAllocateHeap+0xedc (RVA: 0x228c0)
    ==> RtlpReAllocateHeap+0xeff (RVA: 0x228e3)
    ==> RtlDeleteBoundaryDescriptor+0x0 (RVA: 0x22e70)
    ==> RtlpIsSubSegmentReuseThresholdExceeded+0x18 (RVA: 0x235b8)
    ==> RtlpIsSubSegmentReuseThresholdExceeded+0x3f (RVA: 0x235df)
    ==> RtlpHpReAllocateHeap+0x584 (RVA: 0x23f14)
    ==> RtlGetCurrentServiceSessionId+0x0 (RVA: 0x24850)
    ==> RtlpHpFreeHeap+0x3ba (RVA: 0x24cda)
    ==> RtlpHpFreeHeap+0x668 (RVA: 0x24f88)
    ==> RtlpFreeHeapInternal+0x1c4 (RVA: 0x258d4)
    ==> RtlpFreeHeap+0xc9 (RVA: 0x25cc9)
    ==> RtlpFreeHeap+0xe3 (RVA: 0x25ce3)
    ==> RtlpFreeHeap+0x110 (RVA: 0x25d10)
    ==> RtlpFreeHeap+0x2e5 (RVA: 0x25ee5)
    ==> RtlpFreeHeap+0x125b (RVA: 0x26e5b)
    ==> RtlpFreeHeap+0x12d7 (RVA: 0x26ed7)
    ==> RtlpFreeHeap+0x1340 (RVA: 0x26f40)
    ==> RtlpFreeHeap+0x1366 (RVA: 0x26f66)
    ==> RtlpFreeHeap+0x1381 (RVA: 0x26f81)
    ==> RtlpFreeHeap+0x13e3 (RVA: 0x26fe3)
    ==> RtlpFreeHeap+0x1412 (RVA: 0x27012)
    ==> RtlpHpSegFree+0x241 (RVA: 0x27c31)
    ==> RtlpHpSegFree+0x299 (RVA: 0x27c89)
    ==> RtlpAllocateHeapInternal+0x72f (RVA: 0x2b14f)
    ==> RtlpAllocateHeapInternal+0x749 (RVA: 0x2b169)
    ==> RtlpAllocateHeapInternal+0x774 (RVA: 0x2b194)
    ==> RtlpAllocateHeapInternal+0x816 (RVA: 0x2b236)
    ==> RtlpAllocateHeapInternal+0xacf (RVA: 0x2b4ef)
    ==> RtlpAllocateHeapInternal+0xae9 (RVA: 0x2b509)
    ==> RtlpAllocateHeapInternal+0xb10 (RVA: 0x2b530)
    ==> RtlpAllocateHeapInternal+0xbc2 (RVA: 0x2b5e2)
    ==> RtlpAllocateHeap+0x177 (RVA: 0x2d2d7)
    ==> RtlpAllocateHeap+0x1c27 (RVA: 0x2ed87)
    ==> RtlpAllocateHeap+0x1c6e (RVA: 0x2edce)
    ==> RtlpAllocateHeap+0x1df1 (RVA: 0x2ef51)
    ==> RtlpAllocateHeap+0x1e12 (RVA: 0x2ef72)
    ==> RtlpAllocateHeap+0x1e48 (RVA: 0x2efa8)
    ==> RtlpAllocateHeap+0x1e69 (RVA: 0x2efc9)
    ==> RtlpAllocateHeap+0x1e84 (RVA: 0x2efe4)
    ==> RtlpAllocateHeap+0x1ed1 (RVA: 0x2f031)
    ==> RtlpAllocateHeap+0x1efb (RVA: 0x2f05b)
    ==> RtlpAllocateHeap+0x1f58 (RVA: 0x2f0b8)
    ==> RtlpAllocateHeap+0x204e (RVA: 0x2f1ae)
    ==> RtlpAllocateHeap+0x2068 (RVA: 0x2f1c8)
    ==> RtlpEnterCriticalSectionContended+0x10c (RVA: 0x2fbfc)
    ==> RtlpNewSecurityObject+0x5d (RVA: 0x38bd9)
    ==> RtlpInheritAcl+0x1f (RVA: 0x39ebf)
    ==> LdrpSendPostSnapNotifications+0x3a (RVA: 0x3dc46)
    ==> SbUpdateSwitchContextBasedOnDll+0x18 (RVA: 0x3de1c)
    ==> SbSelectProcedure+0x21 (RVA: 0x3e101)
    ==> SbSelectProcedure+0x5d (RVA: 0x3e13d)
    ==> SbSelectProcedure+0xf1 (RVA: 0x3e1d1)
    ==> SbSelectProcedure+0x143 (RVA: 0x3e223)
    ==> RtlpLogCapabilityCheckLatency+0x2d (RVA: 0x42391)
    ==> RtlpCreateLowFragHeap+0x48 (RVA: 0x44830)
    ==> RtlpActivateLowFragmentationHeap+0x3d (RVA: 0x44ab9)
    ==> RtlpAssemblyStorageMapResolutionDefaultCallback+0x77 (RVA: 0x47707)
    ==> RtlpAssemblyStorageMapResolutionDefaultCallback+0x91 (RVA: 0x47721)
    ==> RtlpAssemblyStorageMapResolutionDefaultCallback+0xeb (RVA: 0x4777b)
    ==> RtlpAssemblyStorageMapResolutionDefaultCallback+0xf8 (RVA: 0x47788)
    ==> RtlpAssemblyStorageMapResolutionDefaultCallback+0x10f (RVA: 0x4779f)
    ==> EtwpStartUmLogger+0x36f (RVA: 0x4861f)
    ==> RtlCreateProcessParametersInternal+0x3b (RVA: 0x4aa2b)
    ==> RtlpInitEnvironmentBlock+0x14 (RVA: 0x4afcc)
    ==> RtlCreateEnvironmentEx+0x12e (RVA: 0x4b34e)
    ==> TpReleaseCleanupGroupMembers+0x28 (RVA: 0x4cce8)
    ==> TppWorkerThread+0x7b (RVA: 0x4d18b)
    ==> TppWorkerThread+0x609 (RVA: 0x4d719)
    ==> TppWorkerThread+0x8e5 (RVA: 0x4d9f5)
    ==> TppWorkerThread+0x973 (RVA: 0x4da83)
    ==> TppCallbackCheckThreadAfterCallback+0xa1 (RVA: 0x4e0ed)
    ==> TppCallbackCheckThreadAfterCallback+0x13c (RVA: 0x4e188)
    ==> TpReleasePool+0x3a (RVA: 0x4f2da)
    ==> TpReleasePool+0x1f2 (RVA: 0x4f492)
    ==> vDbgPrintExWithPrefixInternal+0x5c (RVA: 0x51b64)
    ==> vDbgPrintExWithPrefixInternal+0x1d0 (RVA: 0x51cd8)
    ==> vDbgPrintExWithPrefixInternal+0x1e4 (RVA: 0x51cec)
    ==> RtlRaiseException+0x30 (RVA: 0x52100)
    ==> RtlRaiseException+0x1bd (RVA: 0x5228d)
    ==> RtlDispatchException+0x30 (RVA: 0x52340)
    ==> LdrpHandleTlsData+0xac (RVA: 0x5463c)
    ==> LdrpAllocateTls+0x21 (RVA: 0x54aed)
    ==> LdrResSearchResource+0xc2 (RVA: 0x55572)
    ==> LdrResSearchResource+0xf2 (RVA: 0x555a2)
    ==> LdrResSearchResource+0x6a1 (RVA: 0x55b51)
    ==> LdrResSearchResource+0x6cc (RVA: 0x55b7c)
    ==> LdrpResSearchResourceInsideDirectory+0x529 (RVA: 0x56c31)
    ==> LdrpResSearchResourceInsideDirectory+0x1001 (RVA: 0x57709)
    ==> LdrpResGetMappingSize+0x5e (RVA: 0x5792e)
    ==> LdrpResGetMappingSize+0x94 (RVA: 0x57964)
    ==> LdrpResGetMappingSize+0x249 (RVA: 0x57b19)
    ==> LdrpResGetMappingSize+0x277 (RVA: 0x57b47)
    ==> RtlpTimeFieldsToTime+0x12 (RVA: 0x5c582)
    ==> RtlpTimeFieldsToTime+0x3f (RVA: 0x5c5af)
    ==> RtlpTimeToTimeFields+0x12 (RVA: 0x5c8b2)
    ==> RtlpTimeToTimeFields+0x41 (RVA: 0x5c8e1)
    ==> RtlSetCurrentDirectory_U+0x19 (RVA: 0x5e549)
    ==> LdrShutdownProcess+0x121 (RVA: 0x5f0c1)
    ==> RtlReportSilentProcessExit+0x7c (RVA: 0x5f48c)
    ==> RtlUnlockProcessHeapOnProcessTerminate+0x4 (RVA: 0x5f5a4)
    ==> RtlLockHeap+0x4d (RVA: 0x5f9ad)
    ==> RtlUnlockHeap+0x4d (RVA: 0x5fa4d)
    ==> RtlpInitCurrentDir+0x6 (RVA: 0x5fc8e)
    ==> LdrpMapDllNtFileName+0xa9 (RVA: 0x6114d)
    ==> SbCleanupTrace+0xa (RVA: 0x6170e)
    ==> RtlDetectHeapLeaks+0x6 (RVA: 0x61766)
    ==> RtlDetectHeapLeaks+0x1b (RVA: 0x6177b)
    ==> RtlInitializeCriticalSection+0x35 (RVA: 0x62a65)
    ==> RtlInitializeCriticalSection+0x66 (RVA: 0x62a96)
    ==> TpSetPoolMaxThreads+0x15 (RVA: 0x62c05)
    ==> TpSetPoolWorkerThreadIdleTimeout+0x13 (RVA: 0x62c73)
    ==> TpAllocPool+0xe (RVA: 0x62cce)
    ==> TpAllocPoolInternal+0x69 (RVA: 0x62d6d)
    ==> TppWorkpExecuteCallback+0x1d (RVA: 0x6360d)
    ==> TppWorkpExecuteCallback+0x70 (RVA: 0x63660)
    ==> TppWorkpExecuteCallback+0x130 (RVA: 0x63720)
    ==> TppWorkpExecuteCallback+0x1a8 (RVA: 0x63798)
    ==> RtlpWnfWalkUserSubscriptionList+0x2cf (RVA: 0x6433f)
    ==> RtlpWaitOnCriticalSection+0x1b2 (RVA: 0x64af2)
    ==> RtlInitializeCriticalSectionAndSpinCount+0x36 (RVA: 0x65e36)
    ==> RtlInitializeCriticalSectionAndSpinCount+0x6f (RVA: 0x65e6f)
    ==> RtlCreateAndSetSD+0x22 (RVA: 0x67e72)
    ==> RtlpGetDefaultsSubjectContext+0x4b (RVA: 0x682d7)
    ==> RtlpGetDefaultTrustSubjectContext+0x43 (RVA: 0x6850b)
    ==> RtlAddFunctionTable+0x87 (RVA: 0x69117)
    ==> RtlInstallFunctionTableCallback+0xd0 (RVA: 0x699a0)
    ==> RtlAddGrowableFunctionTable+0x61 (RVA: 0x69c41)
    ==> RtlpComputeExePath+0xa (RVA: 0x6d46a)
    ==> RtlpComputeSearchPath+0xa (RVA: 0x6d4fa)
    ==> RtlpComputeDllPathWithOptions+0xa2 (RVA: 0x6d642)
    ==> RtlpComputeDllPath+0x14 (RVA: 0x6d6e4)
    ==> NtdllpAllocateStringRoutine+0x0 (RVA: 0x6ebb0)
    ==> SbAtomicCaptureContextGuid+0xf (RVA: 0x6faf3)
    ==> TpDereferenceGlobalPool+0x11 (RVA: 0x70f39)
    ==> LdrpFreeTls+0x24 (RVA: 0x714dc)
    ==> LdrpCleanupThreadTlsData+0x29 (RVA: 0x7159d)
    ==> RtlGetAssemblyStorageRoot+0x22 (RVA: 0x72f92)
    ==> RtlSetHeapInformation+0x47 (RVA: 0x74df7)
    ==> _LdrpInitialize+0x372 (RVA: 0x75ffe)
    ==> RtlAreLongPathsEnabled+0x0 (RVA: 0x762b0)
    ==> TpAllocIoCompletion+0x66 (RVA: 0x76d06)
    ==> TpBindFileToDirect+0x1a (RVA: 0x76eb2)
    ==> RtlpSetSecurityObject+0x112 (RVA: 0x778be)
    ==> ApiSetQueryApiSetPresence+0x15 (RVA: 0x77eb5)
    ==> TppAlpcpValidateAlpc+0x35 (RVA: 0x7a781)
    ==> TppAllocAlpcCompletion+0x66 (RVA: 0x7a83a)
    ==> TppAllocAlpcCompletion+0x182 (RVA: 0x7a956)
    ==> RtlpQueryExtendedInformationHeap+0x11d (RVA: 0x7ba0d)
    ==> RtlpHpHeapReportCounters+0x8e (RVA: 0x7bb72)
    ==> SbpRetrieveCompatibilityManifest+0x1c (RVA: 0x7c7d4)
    ==> TpInitializePackage+0x6e (RVA: 0x7da0a)
    ==> RtlCreateTagHeap+0x30 (RVA: 0x7da70)
    ==> RtlpValidOwnerSubjectContext+0x50 (RVA: 0x7dd90)
    ==> RtlDeleteSecurityObject+0x4 (RVA: 0x7e0c4)
    ==> RtlDestroyProcessParameters+0x4 (RVA: 0x7e114)
    ==> LdrpLogRelativePathWithAlteredSearchError+0x1c (RVA: 0x7e2b0)
    ==> TpAllocCleanupGroup+0x1a (RVA: 0x7f1ca)
    ==> SbObtainTraceHandle+0x1d (RVA: 0x7f291)
    ==> TppJobpValidateJob+0x32 (RVA: 0x7fdca)
    ==> TpAllocJobNotification+0x62 (RVA: 0x7fe62)
    ==> LdrpInitializePolicy+0xa (RVA: 0x80422)
    ==> RtlSetProtectedPolicy+0x27c (RVA: 0x8179c)
    ==> TpSetPoolMaxThreadsSoftLimit+0x11 (RVA: 0x819c1)
    ==> RtlpAddVectoredHandler+0x148 (RVA: 0x821c8)
    ==> RtlpAddVectoredHandler+0x1fa (RVA: 0x8227a)
    ==> TpReleaseCleanupGroup+0xc (RVA: 0x8235c)
    ==> RtlUpdateTimer+0x27 (RVA: 0x823f7)
    ==> LdrpInitializeImportRedirection+0x29 (RVA: 0x8250d)
    ==> RtlpRemoveVectoredHandler+0xf1 (RVA: 0x82961)
    ==> RtlCreateTimerQueue+0x13 (RVA: 0x83023)
    ==> RtlSetEnvironmentStrings+0x13 (RVA: 0x831d3)
    ==> TpSetPoolMinThreads+0x1a (RVA: 0x83c0a)
    ==> RtlpInitializeStaticCriticalSection+0x29 (RVA: 0x83f59)
    ==> AVrfDllLoadNotification+0x14 (RVA: 0x84ce0)
    ==> RtlDeleteTimerQueueEx+0x23 (RVA: 0x84d53)
    ==> LdrpLogCFGModuleInfoTelemetry+0x25 (RVA: 0x8539d)
    ==> EtwCheckCoverage+0x0 (RVA: 0x86170)
    ==> RtlpQueryPseudoEnvironmentVariable+0x1eb (RVA: 0x89907)
    ==> RtlpQueryPseudoEnvironmentVariable+0x233 (RVA: 0x8994f)
    ==> RtlpCheckDeviceName+0x18 (RVA: 0x8abe4)
    ==> RtlSetCurrentEnvironment+0x19 (RVA: 0x8c1b9)
    ==> RtlGetSystemTimeAndBias+0x22 (RVA: 0x9cbd2)
    ==> RtlGetNtGlobalFlags+0x0 (RVA: 0x9cd20)
    ==> KiUserCallbackDispatcherHandler+0x4 (RVA: 0xa12c4)
    ==> KiUserCallbackDispatch+0xe (RVA: 0xa135e)
    ==> RtlRaiseNoncontinuableException+0x41 (RVA: 0xa1e51)
    ==> LdrpCallInitRoutine$fin$0+0x15 (RVA: 0xa509b)
    ==> LdrpCallInitRoutine$fin$0+0x3a (RVA: 0xa50c0)
    ==> LdrpCallInitRoutine$fin$0+0x55 (RVA: 0xa50db)
    ==> 0xa6e32 (no symbol)
    ==> 0xa6e4e (no symbol)
    ==> 0xa6e6d (no symbol)
    ==> 0xa6f3c (no symbol)
    ==> 0xa70d1 (no symbol)
    ==> 0xa70ed (no symbol)
    ==> 0xa713a (no symbol)
    ==> 0xa7156 (no symbol)
    ==> 0xa7197 (no symbol)
    ==> 0xa71b3 (no symbol)
    ==> 0xa721c (no symbol)
    ==> 0xa74a6 (no symbol)
    ==> 0xa74c9 (no symbol)
    ==> 0xa82ae (no symbol)
    ==> 0xa8394 (no symbol)
    ==> 0xa84c2 (no symbol)
    ==> 0xa84de (no symbol)
    ==> 0xa8566 (no symbol)
    ==> 0xa8589 (no symbol)
    ==> 0xa8829 (no symbol)
    ==> 0xa8845 (no symbol)
    ==> 0xa89f2 (no symbol)
    ==> 0xa8a1d (no symbol)
    ==> 0xa8a35 (no symbol)
    ==> 0xa8a54 (no symbol)
    ==> 0xa8ae1 (no symbol)
    ==> 0xa8fe4 (no symbol)
    ==> 0xa9000 (no symbol)
    ==> 0xa9035 (no symbol)
    ==> 0xa95af (no symbol)
    ==> 0xa95cb (no symbol)
    ==> 0xa974c (no symbol)
    ==> 0xa9768 (no symbol)
    ==> 0xa9803 (no symbol)
    ==> 0xa983a (no symbol)
    ==> 0xa9852 (no symbol)
    ==> 0xa9871 (no symbol)
    ==> 0xa9a31 (no symbol)
    ==> 0xa9a40 (no symbol)
    ==> 0xa9afb (no symbol)
    ==> 0xa9b4b (no symbol)
    ==> 0xa9b63 (no symbol)
    ==> 0xa9b82 (no symbol)
    ==> 0xa9bbf (no symbol)
    ==> 0xa9be0 (no symbol)
    ==> 0xa9c1d (no symbol)
    ==> 0xa9d6e (no symbol)
    ==> 0xa9d8a (no symbol)
    ==> 0xa9ec9 (no symbol)
    ==> 0xa9ed9 (no symbol)
    ==> 0xaa08e (no symbol)
    ==> 0xaa09d (no symbol)
    ==> 0xaa180 (no symbol)
    ==> 0xaa19c (no symbol)
    ==> 0xaa249 (no symbol)
    ==> 0xaa265 (no symbol)
    ==> 0xaa284 (no symbol)
    ==> 0xaa2c0 (no symbol)
    ==> 0xaa2e5 (no symbol)
    ==> 0xaa320 (no symbol)
    ==> 0xaa495 (no symbol)
    ==> 0xaa4b8 (no symbol)
    ==> 0xaae98 (no symbol)
    ==> 0xaaea8 (no symbol)
    ==> 0xaaee0 (no symbol)
    ==> 0xaaef0 (no symbol)
    ==> 0xaafa7 (no symbol)
    ==> 0xaafbf (no symbol)
    ==> 0xaaff4 (no symbol)
    ==> 0xab034 (no symbol)
    ==> 0xab055 (no symbol)
    ==> 0xab095 (no symbol)
    ==> 0xab147 (no symbol)
    ==> 0xab157 (no symbol)
    ==> 0xab1b7 (no symbol)
    ==> 0xab1d3 (no symbol)
    ==> 0xab216 (no symbol)
    ==> 0xab232 (no symbol)
    ==> 0xab251 (no symbol)
    ==> 0xab290 (no symbol)
    ==> 0xab2b1 (no symbol)
    ==> 0xab2f5 (no symbol)
    ==> 0xab305 (no symbol)
    ==> 0xab3a4 (no symbol)
    ==> 0xab3b4 (no symbol)
    ==> 0xab449 (no symbol)
    ==> 0xab45d (no symbol)
    ==> 0xab483 (no symbol)
    ==> 0xab49b (no symbol)
    ==> 0xab4cd (no symbol)
    ==> 0xab4e5 (no symbol)
    ==> 0xab504 (no symbol)
    ==> 0xab540 (no symbol)
    ==> 0xab561 (no symbol)
    ==> 0xab853 (no symbol)
    ==> 0xab895 (no symbol)
    ==> 0xac1ea (no symbol)
    ==> 0xac206 (no symbol)
    ==> 0xac225 (no symbol)
    ==> 0xacb3d (no symbol)
    ==> 0xacb72 (no symbol)
    ==> 0xacba2 (no symbol)
    ==> 0xacbd4 (no symbol)
    ==> 0xacc47 (no symbol)
    ==> 0xacd89 (no symbol)
    ==> 0xacde3 (no symbol)
    ==> 0xace4e (no symbol)
    ==> 0xacf9f (no symbol)
    ==> 0xacfcc (no symbol)
    ==> 0xacff6 (no symbol)
    ==> 0xad026 (no symbol)
    ==> 0xad084 (no symbol)
    ==> 0xad236 (no symbol)
    ==> 0xad252 (no symbol)
    ==> 0xad271 (no symbol)
    ==> 0xad2d4 (no symbol)
    ==> 0xad2f0 (no symbol)
    ==> 0xad30f (no symbol)
    ==> 0xad354 (no symbol)
    ==> 0xad379 (no symbol)
    ==> 0xad39f (no symbol)
    ==> 0xad3bb (no symbol)
    ==> 0xad3da (no symbol)
    ==> 0xad94c (no symbol)
    ==> 0xad96d (no symbol)
    ==> 0xad993 (no symbol)
    ==> 0xad9ab (no symbol)
    ==> 0xad9ca (no symbol)
    ==> 0xadb1e (no symbol)
    ==> 0xadd2a (no symbol)
    ==> 0xae2ba (no symbol)
    ==> 0xae2d6 (no symbol)
    ==> 0xae2fa (no symbol)
    ==> 0xae344 (no symbol)
    ==> 0xae360 (no symbol)
    ==> 0xae37f (no symbol)
    ==> 0xaf7a8 (no symbol)
    ==> 0xaf7b7 (no symbol)
    ==> 0xaf81f (no symbol)
    ==> 0xaf82f (no symbol)
    ==> 0xaf8bd (no symbol)
    ==> 0xaf8d5 (no symbol)
    ==> 0xaf911 (no symbol)
    ==> 0xaf920 (no symbol)
    ==> 0xaf98f (no symbol)
    ==> 0xaf9a7 (no symbol)
    ==> 0xaf9ca (no symbol)
    ==> 0xafa16 (no symbol)
    ==> 0xafa37 (no symbol)
    ==> 0xafa5e (no symbol)
    ==> 0xafab4 (no symbol)
    ==> 0xafad0 (no symbol)
    ==> 0xafb0e (no symbol)
    ==> 0xafb1e (no symbol)
    ==> 0xafb8b (no symbol)
    ==> 0xafba7 (no symbol)
    ==> 0xafbc6 (no symbol)
    ==> 0xafc12 (no symbol)
    ==> 0xafc4a (no symbol)
    ==> 0xafc5a (no symbol)
    ==> 0xafccc (no symbol)
    ==> 0xafcdb (no symbol)
    ==> 0xafdb5 (no symbol)
    ==> 0xafdc4 (no symbol)
    ==> 0xb0202 (no symbol)
    ==> 0xb021e (no symbol)
    ==> 0xb0520 (no symbol)
    ==> 0xb0674 (no symbol)
    ==> 0xb06cf (no symbol)
    ==> 0xb070f (no symbol)
    ==> 0xb07ae (no symbol)
    ==> 0xb07c6 (no symbol)
    ==> 0xb07f8 (no symbol)
    ==> 0xb0810 (no symbol)
    ==> 0xb082f (no symbol)
    ==> 0xb0876 (no symbol)
    ==> 0xb0897 (no symbol)
    ==> 0xb08de (no symbol)
    ==> 0xb08ee (no symbol)
    ==> 0xb0942 (no symbol)
    ==> 0xb095e (no symbol)
    ==> 0xb09ac (no symbol)
    ==> 0xb09c8 (no symbol)
    ==> 0xb09ff (no symbol)
    ==> 0xb0ab6 (no symbol)
    ==> 0xb0ace (no symbol)
    ==> 0xb0b04 (no symbol)
    ==> 0xb0b1c (no symbol)
    ==> 0xb0b64 (no symbol)
    ==> 0xb0b88 (no symbol)
    ==> 0xb0c0f (no symbol)
    ==> 0xb0c51 (no symbol)
    ==> 0xb0ccc (no symbol)
    ==> 0xb0ce8 (no symbol)
    ==> 0xb0d07 (no symbol)
    ==> 0xb0d40 (no symbol)
    ==> 0xb0d5c (no symbol)
    ==> 0xb0d7b (no symbol)
    ==> 0xb0dde (no symbol)
    ==> 0xb0e03 (no symbol)
    ==> 0xb0e5f (no symbol)
    ==> 0xb0e84 (no symbol)
    ==> 0xb11df (no symbol)
    ==> 0xb11fb (no symbol)
    ==> 0xb127c (no symbol)
    ==> 0xb12a1 (no symbol)
    ==> 0xb12bd (no symbol)
    ==> 0xb140c (no symbol)
    ==> 0xb1b27 (no symbol)
    ==> 0xb1b43 (no symbol)
    ==> 0xb1e26 (no symbol)
    ==> 0xb1e42 (no symbol)
    ==> 0xb1e8a (no symbol)
    ==> 0xb1eca (no symbol)
    ==> 0xb1ee6 (no symbol)
    ==> 0xb216c (no symbol)
    ==> 0xb2193 (no symbol)
    ==> 0xb2256 (no symbol)
    ==> 0xb2272 (no symbol)
    ==> 0xb2383 (no symbol)
    ==> 0xb239f (no symbol)
    ==> 0xb302a (no symbol)
    ==> 0xb3046 (no symbol)
    ==> 0xb31db (no symbol)
    ==> 0xb31f7 (no symbol)
    ==> 0xb33de (no symbol)
    ==> 0xb33fa (no symbol)
    ==> 0xb4623 (no symbol)
    ==> 0xb4648 (no symbol)
    ==> 0xb47dd (no symbol)
    ==> 0xb5e8e (no symbol)
    ==> 0xb5ea6 (no symbol)
    ==> 0xb65e7 (no symbol)
    ==> 0xb672e (no symbol)
    ==> 0xb68b8 (no symbol)
    ==> 0xb68d4 (no symbol)
    ==> 0xb68f3 (no symbol)
    ==> 0xb693e (no symbol)
    ==> 0xb695a (no symbol)
    ==> 0xb6979 (no symbol)
    ==> 0xb69e0 (no symbol)
    ==> 0xb69ff (no symbol)
    ==> 0xb7254 (no symbol)
    ==> 0xb7dc5 (no symbol)
    ==> 0xb7ddd (no symbol)
    ==> 0xb7dfc (no symbol)
    ==> 0xb9a44 (no symbol)
    ==> 0xb9a81 (no symbol)
    ==> 0xb9d6a (no symbol)
    ==> 0xba1c4 (no symbol)
    ==> 0xba5f3 (no symbol)
    ==> 0xbb2de (no symbol)
    ==> 0xbb309 (no symbol)
    ==> 0xbb5cf (no symbol)
    ==> 0xbb5f8 (no symbol)
    ==> 0xbb62c (no symbol)
    ==> 0xbb65e (no symbol)
    ==> 0xbb6a2 (no symbol)
    ==> 0xbb6c7 (no symbol)
    ==> 0xbb6fc (no symbol)
    ==> 0xbb732 (no symbol)
    ==> 0xbb848 (no symbol)
    ==> 0xbb86d (no symbol)
    ==> 0xbb95f (no symbol)
    ==> 0xbb984 (no symbol)
    ==> 0xbb9ae (no symbol)
    ==> 0xbb9d3 (no symbol)
    ==> 0xbba02 (no symbol)
    ==> 0xbba27 (no symbol)
    ==> 0xbba5c (no symbol)
    ==> 0xbba86 (no symbol)
    ==> 0xbbac2 (no symbol)
    ==> 0xbbaeb (no symbol)
    ==> 0xbbd9c (no symbol)
    ==> 0xbbdc1 (no symbol)
    ==> 0xbca2a (no symbol)
    ==> 0xbca78 (no symbol)
    ==> 0xbcbbc (no symbol)
    ==> 0xbce54 (no symbol)
    ==> 0xbcf24 (no symbol)
    ==> 0xbcf40 (no symbol)
    ==> 0xbcfae (no symbol)
    ==> 0xbcfbe (no symbol)
    ==> 0xbd02c (no symbol)
    ==> 0xbd088 (no symbol)
    ==> 0xbd0c8 (no symbol)
    ==> 0xbd0d8 (no symbol)
    ==> 0xbd4b4 (no symbol)
    ==> 0xbd4d9 (no symbol)
    ==> 0xbd4ff (no symbol)
    ==> 0xbd51b (no symbol)
    ==> 0xbd53a (no symbol)
    ==> 0xbd618 (no symbol)
    ==> 0xbd634 (no symbol)
    ==> 0xbd653 (no symbol)
    ==> 0xbd720 (no symbol)
    ==> 0xbd801 (no symbol)
    ==> 0xbd81d (no symbol)
    ==> 0xbd83c (no symbol)
    ==> 0xbda90 (no symbol)
    ==> 0xbdaac (no symbol)
    ==> 0xbdacb (no symbol)
    ==> 0xbdb65 (no symbol)
    ==> 0xbdb75 (no symbol)
    ==> 0xbdc03 (no symbol)
    ==> 0xbdc1c (no symbol)
    ==> 0xbdc77 (no symbol)
    ==> 0xbdde0 (no symbol)
    ==> 0xbe402 (no symbol)
    ==> 0xbe41e (no symbol)
    ==> 0xbe455 (no symbol)
    ==> 0xbe48a (no symbol)
    ==> 0xbe589 (no symbol)
    ==> 0xbe6f6 (no symbol)
    ==> 0xbe74b (no symbol)
    ==> 0xbe848 (no symbol)
    ==> 0xbe990 (no symbol)
    ==> 0xbe9d8 (no symbol)
    ==> 0xbe9f4 (no symbol)
    ==> 0xbea36 (no symbol)
    ==> 0xbea50 (no symbol)
    ==> 0xbeb63 (no symbol)
    ==> 0xbeb7f (no symbol)
    ==> 0xbeb95 (no symbol)
    ==> 0xbebae (no symbol)
    ==> 0xbf06c (no symbol)
    ==> 0xbf088 (no symbol)
    ==> 0xbf0bf (no symbol)
    ==> 0xc0a00 (no symbol)
    ==> 0xc0a3b (no symbol)
    ==> 0xc0a7c (no symbol)
    ==> 0xc0abe (no symbol)
    ==> 0xc0b14 (no symbol)
    ==> 0xc0b9a (no symbol)
    ==> 0xc0bbf (no symbol)
    ==> 0xc0c15 (no symbol)
    ==> 0xc0e52 (no symbol)
    ==> 0xc0e90 (no symbol)
    ==> 0xc0ece (no symbol)
    ==> 0xc10ae (no symbol)
    ==> 0xc10ec (no symbol)
    ==> 0xc112a (no symbol)
    ==> 0xc1168 (no symbol)
    ==> 0xc1184 (no symbol)
    ==> 0xc11a3 (no symbol)
    ==> 0xc1b4a (no symbol)
    ==> 0xc1b6f (no symbol)
    ==> 0xc1b95 (no symbol)
    ==> 0xc1bb1 (no symbol)
    ==> 0xc1bd0 (no symbol)
    ==> 0xc2783 (no symbol)
    ==> 0xc2ecd (no symbol)
    ==> 0xc2f35 (no symbol)
    ==> 0xc4673 (no symbol)
    ==> 0xc46dd (no symbol)
    ==> 0xc4a34 (no symbol)
    ==> 0xc4a50 (no symbol)
    ==> 0xc4b38 (no symbol)
    ==> 0xc4d6f (no symbol)
    ==> 0xc5116 (no symbol)
    ==> 0xc6bf2 (no symbol)
    ==> 0xc765a (no symbol)
    ==> 0xc771e (no symbol)
    ==> 0xc7962 (no symbol)
    ==> 0xc79a9 (no symbol)
    ==> 0xc82fa (no symbol)
    ==> 0xc8316 (no symbol)
    ==> 0xc8335 (no symbol)
    ==> 0xc8518 (no symbol)
    ==> 0xc853d (no symbol)
    ==> 0xc8593 (no symbol)
    ==> 0xc92ec (no symbol)
    ==> 0xc9379 (no symbol)
    ==> 0xc953c (no symbol)
    ==> 0xc99ba (no symbol)
    ==> 0xc9b03 (no symbol)
    ==> 0xc9bad (no symbol)
    ==> 0xcace6 (no symbol)
    ==> 0xcad10 (no symbol)
    ==> 0xcae00 (no symbol)
    ==> 0xcae25 (no symbol)
    ==> CsrVerifyRegion+0x17 (RVA: 0xcb4e7)
    ==> DbgUiRemoteBreakin+0x4 (RVA: 0xcca34)
    ==> LdrpTryAcquireLoaderLock+0x2d (RVA: 0xcdc3d)
    ==> LdrpTryAcquireLoaderLock+0x59 (RVA: 0xcdc69)
    ==> LdrpTryAcquireLoaderLock+0x74 (RVA: 0xcdc84)
    ==> LdrpTryAcquireLoaderLock+0xc9 (RVA: 0xcdcd9)
    ==> LdrpTryAcquireLoaderLock+0xe1 (RVA: 0xcdcf1)
    ==> LdrpTryAcquireLoaderLock+0xfc (RVA: 0xcdd0c)
    ==> LdrpTryAcquireLoaderLock+0x140 (RVA: 0xcdd50)
    ==> LdrpTryAcquireLoaderLock+0x158 (RVA: 0xcdd68)
    ==> LdrpTryAcquireLoaderLock+0x173 (RVA: 0xcdd83)
    ==> LdrpCheckComponentOnDemandEtwEvent+0x61 (RVA: 0xcebc1)
    ==> LdrpLogEtwDllSearchResults+0xa4 (RVA: 0xcef08)
    ==> LdrpLogEtwDllSearchResults+0x215 (RVA: 0xcf079)
    ==> LdrpLogEtwEvent+0x11c (RVA: 0xcf22c)
    ==> LdrpLogFatalUserCallbackException+0xc9 (RVA: 0xcf489)
    ==> LdrpLogImportRedirectionTelemetry+0x20 (RVA: 0xcf574)
    ==> LdrpLogNewDllLoadInternal+0xa3 (RVA: 0xcfb83)
    ==> LdrpLogVsmEnclaveLdrCreateEnclaveTelemetry+0x25 (RVA: 0xcfd65)
    ==> LdrpLogVsmEnclaveLdrDeleteEnclaveTelemetry+0x1b (RVA: 0xcfe5f)
    ==> LdrpLogVsmEnclaveLdrInitializeEnclaveTelemetry+0x1b (RVA: 0xcff3f)
    ==> LdrpLogVsmEnclaveLdrLoadEnclaveModuleTelemetry+0x1b (RVA: 0xd001f)
    ==> LdrpInitializationFailure+0x49 (RVA: 0xd0a11)
    ==> LdrpInitializeApplicationVerifierPackage+0x1ca (RVA: 0xd0c3a)
    ==> LdrpInitializeExecutionOptions+0x33e (RVA: 0xd125a)
    ==> LdrpInitializeExecutionOptions+0x5c7 (RVA: 0xd14e3)
    ==> LdrpInitializeExecutionOptions+0x7dd (RVA: 0xd16f9)
    ==> LdrpInitializeExecutionOptions+0xac7 (RVA: 0xd19e3)
    ==> LdrpInitializeProcess+0x911 (RVA: 0xd2661)
    ==> LdrpInitializeProcess+0x141d (RVA: 0xd316d)
    ==> LdrpInitializeProcess+0x1d40 (RVA: 0xd3a90)
    ==> LdrpInitializeProcess+0x1d69 (RVA: 0xd3ab9)
    ==> LdrpQueryIllegalCWDDevices+0xdb (RVA: 0xd46eb)
    ==> NtdllpReallocateStringRoutine+0x0 (RVA: 0xd48b8)
    ==> LdrpCheckRedirection+0x137 (RVA: 0xd5047)
    ==> LdrpUnlockTlsDelayedReclaimTable+0x18 (RVA: 0xd527c)
    ==> LdrpGenericExceptionFilter+0xbb (RVA: 0xd54d7)
    ==> LdrpGenericExceptionFilter+0xe8 (RVA: 0xd5504)
    ==> RtlComputePrivatizedDllName_U+0xd6 (RVA: 0xd5666)
    ==> RtlComputePrivatizedDllName_U+0xe3 (RVA: 0xd5673)
    ==> RtlComputePrivatizedDllName_U+0xf5 (RVA: 0xd5685)
    ==> RtlComputePrivatizedDllName_U+0x10c (RVA: 0xd569c)
    ==> RtlpProcessReflectionStartup+0x256 (RVA: 0xd6226)
    ==> RtlCreateUserSecurityObject+0xa (RVA: 0xd689a)
    ==> RtlQueryProcessHeapInformation+0x1d (RVA: 0xd7c3d)
    ==> AVrfDllUnloadNotification+0xf (RVA: 0xd9723)
    ==> AVrfInitializeVerifier+0x125 (RVA: 0xd98fd)
    ==> AVrfInitializeVerifier+0x139 (RVA: 0xd9911)
    ==> AVrfInitializeVerifier+0x3e8 (RVA: 0xd9bc0)
    ==> AVrfInitializeVerifier+0x5c9 (RVA: 0xd9da1)
    ==> AVrfInitializeVerifier+0x777 (RVA: 0xd9f4f)
    ==> AVrfInitializeVerifier+0x8ed (RVA: 0xda0c5)
    ==> AVrfInternalHeapFreeNotification+0x14 (RVA: 0xda254)
    ==> AVrfpEnableHeapVerifier+0xa (RVA: 0xda982)
    ==> AVrfpEnableHeapVerifier+0x19 (RVA: 0xda991)
    ==> AVrfpEnableVerifierOptions+0x5b (RVA: 0xdaa3f)
    ==> AVrfpEnableVerifierOptions+0x6a (RVA: 0xdaa4e)
    ==> AVrfpParseVerifierDllsString+0x1d (RVA: 0xdaf7d)
    ==> AVrfpQueryProcessVerifierOptions+0x12 (RVA: 0xdb106)
    ==> AVrfpSetProcessVerifierOptions+0x4 (RVA: 0xdb1c0)
    ==> AvrfMiniLoadDll+0x1b1 (RVA: 0xdb711)
    ==> RtlApplicationVerifierStop+0x4 (RVA: 0xdbe64)
    ==> SetAssertBufferPtrinPeb+0x35 (RVA: 0xddd99)
    ==> WerEscalationLazyInit+0xbf (RVA: 0xde107)
    ==> WerEscalationLazyInit+0xd1 (RVA: 0xde119)
    ==> RtlpWnfETWEventCallback+0x5f (RVA: 0xde857)
    ==> RtlpWnfETWEventNameSubRundown+0x41 (RVA: 0xde8e9)
    ==> RtlpWnfETWEventPublish+0x40 (RVA: 0xde978)
    ==> RtlpWnfETWEventSubscribe+0x5a (RVA: 0xdea22)
    ==> RtlpWnfETWEventUnsubscribe+0x5a (RVA: 0xdeace)
    ==> LdrpMUIEtwOutput+0x109 (RVA: 0xe1445)
    ==> RtlpQueryEafPlusModuleList+0x42 (RVA: 0xe398a)
    ==> LdrpResFileSize+0x5b (RVA: 0xe40bb)
    ==> LdrpResFileSize+0x8a (RVA: 0xe40ea)
    ==> LdrpResFileSize+0x100 (RVA: 0xe4160)
    ==> LdrpResFileSize+0x125 (RVA: 0xe4185)
    ==> LdrpResMapFile+0x65 (RVA: 0xe4239)
    ==> LdrpResMapFile+0x94 (RVA: 0xe4268)
    ==> LdrpResMapFile+0x301 (RVA: 0xe44d5)
    ==> LdrpResMapFile+0x327 (RVA: 0xe44fb)
    ==> LdrpResSearchResourceHandle+0xe5 (RVA: 0xe46e1)
    ==> LdrpResSearchResourceHandle+0x119 (RVA: 0xe4715)
    ==> LdrpResSearchResourceHandle+0x41f (RVA: 0xe4a1b)
    ==> LdrpResSearchResourceHandle+0x449 (RVA: 0xe4a45)
    ==> LdrpResValidateFilePath+0x64 (RVA: 0xe4dec)
    ==> LdrpResValidateFilePath+0x93 (RVA: 0xe4e1b)
    ==> LdrpResValidateFilePath+0x193 (RVA: 0xe4f1b)
    ==> LdrpResValidateFilePath+0x1b9 (RVA: 0xe4f41)
    ==> RtlGetSessionProperties+0x61 (RVA: 0xe64c1)
    ==> RtlpComputeMergedAcl+0x1c (RVA: 0xe739c)
    ==> RtlpConvertAclToAutoInherit+0x70 (RVA: 0xe7824)
    ==> RtlpConvertToAutoInheritSecurityObject+0x38 (RVA: 0xe8010)
    ==> RtlEnableEarlyCriticalSectionEventCreation+0x0 (RVA: 0xe8d00)
    ==> RtlEnableEarlyCriticalSectionEventCreation+0xf (RVA: 0xe8d0f)
    ==> RtlpNotOwnerCriticalSection+0x9 (RVA: 0xe8fa9)
    ==> RtlpNotOwnerCriticalSection+0x7f (RVA: 0xe901f)
    ==> RtlInitializeHeapManager+0x13f (RVA: 0xf2663)
    ==> RtlQueryTagHeap+0x43 (RVA: 0xf29a3)
    ==> RtlpWalkHeap+0x76e (RVA: 0xf552a)
    ==> RtlpWalkHeap+0x827 (RVA: 0xf55e3)
    ==> RtlpWalkHeap+0x84a (RVA: 0xf5606)
    ==> RtlpCheckBusyBlockTail+0x1ad (RVA: 0xf6ac5)
    ==> RtlpCheckBusyBlockTail+0x1bd (RVA: 0xf6ad5)
    ==> RtlExecuteUmsThread+0xad (RVA: 0xf729d)
    ==> RtlExecuteUmsThread+0x13d (RVA: 0xf732d)
    ==> RtlDebugAllocateHeap+0x1ab (RVA: 0xf8a1b)
    ==> RtlDebugAllocateHeap+0x1c8 (RVA: 0xf8a38)
    ==> RtlDebugAllocateHeap+0x25b (RVA: 0xf8acb)
    ==> RtlDebugAllocateHeap+0x26a (RVA: 0xf8ada)
    ==> RtlDebugAllocateHeap+0x2c5 (RVA: 0xf8b35)
    ==> RtlDebugAllocateHeap+0x2d4 (RVA: 0xf8b44)
    ==> RtlDebugCreateHeap+0x2b (RVA: 0xf8dab)
    ==> RtlDebugCreateHeap+0x3b (RVA: 0xf8dbb)
    ==> RtlDebugCreateHeap+0x8a (RVA: 0xf8e0a)
    ==> RtlDebugCreateHeap+0x9a (RVA: 0xf8e1a)
    ==> RtlDebugCreateHeap+0xe8 (RVA: 0xf8e68)
    ==> RtlDebugCreateHeap+0xf8 (RVA: 0xf8e78)
    ==> RtlDebugCreateHeap+0x1c5 (RVA: 0xf8f45)
    ==> RtlDebugCreateHeap+0x1d5 (RVA: 0xf8f55)
    ==> RtlDebugCreateHeap+0x227 (RVA: 0xf8fa7)
    ==> RtlDebugCreateHeap+0x237 (RVA: 0xf8fb7)
    ==> RtlDebugDestroyHeap+0x6 (RVA: 0xf91be)
    ==> RtlDebugDestroyHeap+0x18 (RVA: 0xf91d0)
    ==> RtlDebugDestroyHeap+0x28 (RVA: 0xf91e0)
    ==> RtlDebugFreeHeap+0xcd (RVA: 0xf9349)
    ==> RtlDebugFreeHeap+0xe5 (RVA: 0xf9361)
    ==> RtlDebugFreeHeap+0x1cd (RVA: 0xf9449)
    ==> RtlDebugFreeHeap+0x1dc (RVA: 0xf9458)
    ==> RtlDebugReAllocateHeap+0x128 (RVA: 0xf9988)
    ==> RtlDebugReAllocateHeap+0x140 (RVA: 0xf99a0)
    ==> RtlDebugReAllocateHeap+0x22b (RVA: 0xf9a8b)
    ==> RtlDebugReAllocateHeap+0x23a (RVA: 0xf9a9a)
    ==> RtlDebugReAllocateHeap+0x377 (RVA: 0xf9bd7)
    ==> RtlDebugReAllocateHeap+0x394 (RVA: 0xf9bf4)
    ==> RtlDebugReAllocateHeap+0x41e (RVA: 0xf9c7e)
    ==> RtlDebugReAllocateHeap+0x42d (RVA: 0xf9c8d)
    ==> RtlDebugReAllocateHeap+0x488 (RVA: 0xf9ce8)
    ==> RtlDebugReAllocateHeap+0x497 (RVA: 0xf9cf7)
    ==> RtlpBreakPointHeap+0x0 (RVA: 0xfa47c)
    ==> RtlpValidateHeap+0x1c1 (RVA: 0xfa665)
    ==> RtlpValidateHeap+0x1d3 (RVA: 0xfa677)
    ==> RtlpValidateHeap+0x213 (RVA: 0xfa6b7)
    ==> RtlpValidateHeap+0x225 (RVA: 0xfa6c9)
    ==> RtlpValidateHeap+0x3b0 (RVA: 0xfa854)
    ==> RtlpValidateHeap+0x3bf (RVA: 0xfa863)
    ==> RtlpValidateHeap+0x40e (RVA: 0xfa8b2)
    ==> RtlpValidateHeap+0x41d (RVA: 0xfa8c1)
    ==> RtlpValidateHeap+0x509 (RVA: 0xfa9ad)
    ==> RtlpValidateHeap+0x518 (RVA: 0xfa9bc)
    ==> RtlpValidateHeap+0x570 (RVA: 0xfaa14)
    ==> RtlpValidateHeap+0x57f (RVA: 0xfaa23)
    ==> RtlpValidateHeapHeaders+0xa9 (RVA: 0xfab2d)
    ==> RtlpValidateHeapHeaders+0xb9 (RVA: 0xfab3d)
    ==> RtlpValidateHeapHeaders+0x14c (RVA: 0xfabd0)
    ==> RtlpValidateHeapHeaders+0x15c (RVA: 0xfabe0)
    ==> RtlpValidateHeapSegment+0x4c0 (RVA: 0xfb100)
    ==> RtlpValidateHeapSegment+0x4d0 (RVA: 0xfb110)
    ==> RtlpValidateHeapSegment+0x51a (RVA: 0xfb15a)
    ==> RtlpValidateHeapSegment+0x529 (RVA: 0xfb169)
    ==> RtlpValidateHeapSegment+0x58c (RVA: 0xfb1cc)
    ==> RtlpValidateHeapSegment+0x59b (RVA: 0xfb1db)
    ==> RtlpValidateHeapSegment+0x610 (RVA: 0xfb250)
    ==> RtlpValidateHeapSegment+0x61f (RVA: 0xfb25f)
    ==> RtlpValidateHeapSegment+0x65f (RVA: 0xfb29f)
    ==> RtlpValidateHeapSegment+0x66e (RVA: 0xfb2ae)
    ==> RtlpValidateHeapSegment+0x6e6 (RVA: 0xfb326)
    ==> RtlpValidateHeapSegment+0x6f5 (RVA: 0xfb335)
    ==> RtlpValidateHeapSegment+0x746 (RVA: 0xfb386)
    ==> RtlpValidateHeapSegment+0x755 (RVA: 0xfb395)
    ==> RtlGetConsoleSessionForegroundProcessId+0x17 (RVA: 0xfcde7)
    ==> RtlHeapTrkInitialize+0x1b3 (RVA: 0xfdb73)
    ==> RtlpHeapTrkDumpOutstandingAllocs+0x65 (RVA: 0xfdf8d)
    ==> RtlpHeapTrkDumpOutstandingAllocs+0x83 (RVA: 0xfdfab)
    ==> RtlpHeapTrkLeakCallback+0x152 (RVA: 0xfe6b2)
    ==> RtlpHeapTrkLeakCallback+0x161 (RVA: 0xfe6c1)
    ==> RtlQueryProcessPlaceholderCompatibilityMode+0x0 (RVA: 0xff1e0)
    ==> RtlIsAnyDebuggerPresent+0x0 (RVA: 0xff230)
    ==> RtlUnhandledExceptionFilter2+0x1f (RVA: 0x10081f)
    ==> RtlpHeapLogRangeCreate+0x4d (RVA: 0x10816d)
    ==> RtlpHeapLogRangeDestroy+0x38 (RVA: 0x1081f4)
    ==> RtlpHeapLogRangeRelease+0x47 (RVA: 0x10828b)
    ==> RtlpHeapLogRangeReserve+0x47 (RVA: 0x108323)
    ==> RtlpLogHeapAffinityManagerEnable+0x3c (RVA: 0x109c98)
    ==> RtlpLogHeapAffinitySlotAssign+0x47 (RVA: 0x109d2f)
    ==> RtlpLogHeapAllocateEvent+0x39 (RVA: 0x109db9)
    ==> RtlpLogHeapCommit+0x5a (RVA: 0x109e62)
    ==> RtlpLogHeapDecommit+0x5a (RVA: 0x10a046)
    ==> RtlpLogHeapFreeEvent+0x35 (RVA: 0x10a17d)
    ==> RtlpLogHeapLockEvent+0x2b (RVA: 0x10a1f7)
    ==> RtlpLogHeapReallocateEvent+0x5a (RVA: 0x10a2a2)
    ==> RtlpLogHeapReuseThresholdActivate+0x47 (RVA: 0x10a33b)
    ==> RtlpLogHeapSubSegmentActivate+0x42 (RVA: 0x10a3ce)
    ==> RtlpLogHeapSubSegmentAlloc+0x5b (RVA: 0x10a47b)
    ==> RtlpLogHeapSubSegmentAllocCached+0x5b (RVA: 0x10a52b)
    ==> RtlpLogHeapSubSegmentFree+0x5b (RVA: 0x10a5db)
    ==> RtlpLogHeapSubSegmentFreeCached+0x5b (RVA: 0x10a68b)
    ==> RtlpLogHeapSubSegmentInitialize+0x69 (RVA: 0x10a749)
    ==> RtlpLogHeapUnlockEvent+0x2b (RVA: 0x10a7cb)
    ==> RtlpLogHeapValidateEvent+0x2b (RVA: 0x10a847)
    ==> RtlpLogHeapWalkEvent+0x2b (RVA: 0x10a8c3)
    ==> RtlpPrintErrorInformation+0x14 (RVA: 0x10a928)
    ==> RtlpPrintErrorInformation+0x3a (RVA: 0x10a94e)
    ==> RtlpPrintErrorInformation+0x17b (RVA: 0x10aa8f)
    ==> RtlpPrintErrorInformation+0x18a (RVA: 0x10aa9e)
    ==> RtlpPrintErrorInformation+0x1cf (RVA: 0x10aae3)
    ==> RtlpPrintErrorInformation+0x1de (RVA: 0x10aaf2)
    ==> RtlpPrintErrorInformation+0x221 (RVA: 0x10ab35)
    ==> RtlpPrintErrorInformation+0x230 (RVA: 0x10ab44)
    ==> RtlpPrintErrorInformation+0x273 (RVA: 0x10ab87)
    ==> RtlpPrintErrorInformation+0x282 (RVA: 0x10ab96)
    ==> RtlpPrintErrorInformation+0x2ce (RVA: 0x10abe2)
    ==> RtlpPrintErrorInformation+0x2dd (RVA: 0x10abf1)
    ==> RtlpPrintErrorInformation+0x31e (RVA: 0x10ac32)
    ==> RtlpPrintErrorInformation+0x32d (RVA: 0x10ac41)
    ==> RtlpSubSegmentDebugInitialize+0x25f (RVA: 0x10bc2b)
    ==> RtlpSubSegmentDebugInitialize+0x282 (RVA: 0x10bc4e)
    ==> RtlpHpLargeAllocationDestroy+0x93 (RVA: 0x10e723)
    ==> RtlpHpLargeReAlloc+0x23f (RVA: 0x10ea3b)
    ==> TppIopCancelPendingCallbacks+0x32 (RVA: 0x111b02)
    ==> TppWorkUnposted+0x24 (RVA: 0x111fb4)
    ==> TppETWCallbackCancel+0x54 (RVA: 0x112468)
    ==> TppETWCallbackDequeue+0x49 (RVA: 0x112505)
    ==> TppETWCallbackEnqueue+0x49 (RVA: 0x1125a1)
    ==> TppETWCallbackStart+0x49 (RVA: 0x11263d)
    ==> TppETWCallbackStop+0x49 (RVA: 0x1126d9)
    ==> TppETWPoolClose+0x2b (RVA: 0x112757)
    ==> TppETWPoolCreate+0x2b (RVA: 0x1127d3)
    ==> TppETWPoolThreadMax+0x2f (RVA: 0x112853)
    ==> TppETWPoolThreadMin+0x2f (RVA: 0x1128d3)
    ==> TppETWTimerCancelNtTimer+0x2b (RVA: 0x11294f)
    ==> TppETWTimerCancelled+0x30 (RVA: 0x1129d0)
    ==> TppETWTimerExpiration+0x50 (RVA: 0x112a70)
    ==> TppETWTimerExpirationBegin+0x2b (RVA: 0x112aeb)
    ==> TppETWTimerSet+0x63 (RVA: 0x112b9f)
    ==> TppETWTimerSetNtTimer+0x35 (RVA: 0x112c29)
    ==> TppETWWorkerNodeSwitch+0x60 (RVA: 0x112cd8)
    ==> RtlSetIoCompletionCallback+0x20 (RVA: 0x112e60)
    ==> RtlpTpIoCallback+0x55 (RVA: 0x1131e5)
    ==> RtlpTpIoCallback+0xd3 (RVA: 0x113263)
    ==> RtlTpETWCallbackDequeue+0x49 (RVA: 0x113755)

 [[IN]] C:\Windows\System32\nvcpl.dll
    ==> RVA: .text+0x34e15a
    ==> RVA: .text+0x358f25
    ==> RVA: .text+0x358f6c

 [[IN]] C:\Windows\System32\nvcuda.dll
    ==> RVA: .text+0x364cee
    ==> RVA: .text+0x383fe2
    ==> RVA: .text+0x38402e
    ==> RVA: .text+0x384076
    ==> RVA: .text+0x3840dc
    ==> RVA: .text+0x38418d
    ==> RVA: .text+0x3841e1
    ==> RVA: .text+0x384228
    ==> RVA: .text+0x384271

 [[IN]] C:\Windows\System32\nvml.dll
    ==> RVA: .text+0x10d19a
    ==> RVA: .text+0x1121f0

 [[IN]] C:\Windows\System32\nvspcap64.dll
    ==> RVA: .text+0x1d977e
    ==> RVA: .text+0x1ec63e
    ==> RVA: .text+0x1ec69e
    ==> RVA: .text+0x1ec6fa
    ==> RVA: .text+0x1ec778
    ==> RVA: .text+0x1ec849
    ==> RVA: .text+0x1ec8b1
    ==> RVA: .text+0x1ec90c
    ==> RVA: .text+0x1ec965

 [[IN]] C:\Windows\System32\OcpUpdateAgent.dll
    ==> ?IsDUCSupported@@YA_NXZ+0x67f (RVA: 0x9807)

 [[IN]] C:\Windows\System32\ole32.dll
    ==> `dynamic initializer for 'g_hHeap''+0x0 (RVA: 0x12f0)
    ==> IsValidInterface+0x5 (RVA: 0xf845)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x21f40)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x21f70)
    ==> `anonymous namespace'::OurRtlReallocateStringRoutine+0x0 (RVA: 0xc46a0)
    ==> IsTaskName+0x38 (RVA: 0xcba3c)

 [[IN]] C:\Windows\System32\oleaut32.dll
    ==> ?ErrOpenFile@@YAJPEBGPEAHPEAG@Z+0x21 (RVA: 0x32535)

 [[IN]] C:\Windows\System32\oledlg.dll
    ==> OleUIAddVerbMenuA+0x2b (RVA: 0x1e4b)
    ==> OleUIInsertObjectA+0x71 (RVA: 0x1fc1)
    ==> OleUIPasteSpecialA+0x7a (RVA: 0x222a)
    ==> OleUIEditLinksA+0x5f (RVA: 0x2a6f)
    ==> OleUIConvertA+0x6a (RVA: 0x2e3a)
    ==> OleUIConvertA+0xa0 (RVA: 0x2e70)
    ==> OleUIUpdateLinksA+0x38 (RVA: 0x3288)
    ==> OleUIUpdateLinksA+0x71 (RVA: 0x32c1)
    ==> OleUIObjectPropertiesA+0x29 (RVA: 0x3829)
    ==> OleUIObjectPropertiesA+0x73 (RVA: 0x3873)
    ==> OleUIObjectPropertiesA+0xb2 (RVA: 0x38b2)
    ==> OleUIChangeSourceA+0x89 (RVA: 0x3ad9)
    ==> OleUIChangeSourceA+0x1e8 (RVA: 0x3c38)
    ==> OleUIAddVerbMenuW+0x1fb (RVA: 0x46db)
    ==> OleUIAddVerbMenuW+0x249 (RVA: 0x4729)
    ==> OleUIAddVerbMenuW+0x283 (RVA: 0x4763)
    ==> OleUIUpdateLinksW+0x4f (RVA: 0x53df)
    ==> OleUIUpdateLinksW+0x9c (RVA: 0x542c)
    ==> ?FBusyInit@@YAHPEAUHWND__@@_K_J@Z+0x4d (RVA: 0x5841)
    ==> ?FBusyInit@@YAHPEAUHWND__@@_K_J@Z+0x15f (RVA: 0x5953)
    ==> OleUIConvertW+0x106 (RVA: 0x5cf6)
    ==> OleUIConvertW+0x13c (RVA: 0x5d2c)
    ==> OleUIConvertW+0x17e (RVA: 0x5d6e)
    ==> ?FConvertInit@@YAHPEAUHWND__@@_K_J@Z+0x64e (RVA: 0x6d1e)
    ==> OleUIChangeSourceW+0x92 (RVA: 0x9a42)
    ==> OleUIEditLinksW+0x36 (RVA: 0xa346)
    ==> OleUIInsertObjectW+0x4f (RVA: 0xc3af)
    ==> OleUIInsertObjectW+0x97 (RVA: 0xc3f7)
    ==> OleUIInsertObjectW+0xdc (RVA: 0xc43c)
    ==> OleUIInsertObjectW+0x119 (RVA: 0xc479)
    ==> OleUIInsertObjectW+0x156 (RVA: 0xc4b6)
    ==> OleUIInsertObjectW+0x193 (RVA: 0xc4f3)
    ==> ?InternalObjectProperties@@YAIPEAUtagOLEUIOBJECTPROPSW@@H@Z+0x54 (RVA: 0xf0f4)
    ==> ?InternalObjectProperties@@YAIPEAUtagOLEUIOBJECTPROPSW@@H@Z+0x94 (RVA: 0xf134)
    ==> ValidateObjectProperties+0x1a (RVA: 0xf346)
    ==> ValidateObjectProperties+0x87 (RVA: 0xf3b3)
    ==> ValidateObjectProperties+0xb6 (RVA: 0xf3e2)
    ==> ValidateObjectProperties+0xef (RVA: 0xf41b)
    ==> ValidateObjectProperties+0x133 (RVA: 0xf45f)
    ==> ValidateObjectProperties+0x165 (RVA: 0xf491)
    ==> ValidateObjectProperties+0x204 (RVA: 0xf530)
    ==> ValidateObjectProperties+0x26e (RVA: 0xf59a)
    ==> ValidateObjectProperties+0x2b5 (RVA: 0xf5e1)
    ==> OleUIPasteSpecialW+0x3d (RVA: 0x11b0d)
    ==> OleUIPasteSpecialW+0x7d (RVA: 0x11b4d)
    ==> OleUIPasteSpecialW+0xbc (RVA: 0x11b8c)
    ==> OleUIPasteSpecialW+0xff (RVA: 0x11bcf)
    ==> ?UStandardValidation@@YAIPEAUtagOLEUISTANDARD@@IPEAPEAX@Z+0x2b (RVA: 0x14a2f)
    ==> ?UStandardValidation@@YAIPEAUtagOLEUISTANDARD@@IPEAPEAX@Z+0x98 (RVA: 0x14a9c)
    ==> ?UStandardValidation@@YAIPEAUtagOLEUISTANDARD@@IPEAPEAX@Z+0xd6 (RVA: 0x14ada)
    ==> ?UStandardValidation@@YAIPEAUtagOLEUISTANDARD@@IPEAPEAX@Z+0x122 (RVA: 0x14b26)
    ==> ?IsValidMetaPict@@YAHPEAX@Z+0x28 (RVA: 0x178b4)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x22070)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x220a0)

 [[IN]] C:\Windows\System32\oobe\cmisetup.dll
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x76c84)
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x7939a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x7b77f)

 [[IN]] C:\Windows\System32\oobe\winsetup.dll
    ==> SdbInitDatabaseEx+0x7d (RVA: 0xb3291)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0xb4cc9)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0xb521b)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0xb57fa)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0xb58f4)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0xb59c6)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0xb5b11)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0xb61a7)
    ==> SdbpCheckMatchingTextEntry+0x230 (RVA: 0xb6540)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0xb83c0)
    ==> SdbReleaseDatabase+0xde (RVA: 0xb8baa)
    ==> SdbOpenDatabaseEx+0x4b (RVA: 0xb8e27)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0xb9024)
    ==> SdbpCreateSearchPathPartsFromPath+0x7c (RVA: 0xb94a8)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0xba165)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0xba50f)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0xbb801)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0xbbe3a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0xbc3fe)
    ==> AslPathWildcardFindFirst+0xed (RVA: 0xbd535)
    ==> AslPathWildcardFindFirst+0x1d8 (RVA: 0xbd620)
    ==> AslPathWildcardFindFirst+0x24e (RVA: 0xbd696)
    ==> AslPathWildcardFindNext+0x87 (RVA: 0xbda43)
    ==> AslpPathWildcardAllocMatchNode+0x90 (RVA: 0xbe4c8)
    ==> AslpAllocMatchNode+0xf (RVA: 0xbe8a7)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0xbea9c)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xbf642)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0xbf788)
    ==> AslGuidToString_UStr+0x29 (RVA: 0xbfb0d)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0xbfdb8)
    ==> AslStringDuplicate+0xb5 (RVA: 0xbff4d)
    ==> AslFileMappingCreate+0x55 (RVA: 0xc03f1)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0xc1d84)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0xc26ca)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0xc5188)
    ==> SclExeMalloc+0x0 (RVA: 0x1532f0)
    ==> SclExeFree+0x0 (RVA: 0x153320)

 [[IN]] C:\Windows\System32\OpenCL.dll
    ==> RVA: .text+0x2e136
    ==> RVA: .text+0x3af22
    ==> RVA: .text+0x3af6e
    ==> RVA: .text+0x3afb6
    ==> RVA: .text+0x3b01c
    ==> RVA: .text+0x3b0cd
    ==> RVA: .text+0x3b121
    ==> RVA: .text+0x3b168
    ==> RVA: .text+0x3b1b1

 [[IN]] C:\Windows\System32\opengl32.dll
    ==> QueryFinalGPUPreferenceDecision+0xc2 (RVA: 0xbfe2e)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xa (RVA: 0xc347e)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x6e (RVA: 0xc34e2)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xc2 (RVA: 0xc3536)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0xc407d)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0xc40b1)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0xc437e)
    ==> AslEnvExpandStrings2+0xce (RVA: 0xc4fde)
    ==> AslEnvBuildBasic+0x31 (RVA: 0xc5465)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0xc6011)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0xc651f)
    ==> AslRegistryGetString+0xb4 (RVA: 0xc7258)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0xc7436)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0xc74f2)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xc7662)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0xc77a8)
    ==> AslGuidToString_UStr+0x29 (RVA: 0xc7ad5)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0xc7d80)
    ==> AslStringDuplicate+0xb5 (RVA: 0xc7f15)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0xc80c3)
    ==> AslPathWildcardFindFirst+0xed (RVA: 0xc93bd)
    ==> AslPathWildcardFindFirst+0x1d8 (RVA: 0xc94a8)
    ==> AslPathWildcardFindFirst+0x250 (RVA: 0xc9520)
    ==> AslPathWildcardFindNext+0x87 (RVA: 0xc98cb)
    ==> AslpPathWildcardAllocMatchNode+0x90 (RVA: 0xca350)
    ==> AslpAllocMatchNode+0xf (RVA: 0xca757)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0xca94c)
    ==> AslFileMappingCreate+0x55 (RVA: 0xcb079)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0xcc943)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0xcd28a)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0xcfd50)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0xd0943)
    ==> SdbGetMatchingExeEx+0x1c1 (RVA: 0xd1a05)
    ==> SdbInitDatabaseEx+0x7c (RVA: 0xd2358)
    ==> SdbpCreateSearchDBContext+0x60 (RVA: 0xd391c)
    ==> SdbpCreateSearchDBContext+0x115 (RVA: 0xd39d1)
    ==> SdbpCreateSearchDBContext+0x20e (RVA: 0xd3aca)
    ==> SdbpCreateSearchDBContext+0x23b (RVA: 0xd3af7)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0xd3c25)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0xd4177)
    ==> SdbpCheckMatchingRegistryValue+0xd5 (RVA: 0xd475d)
    ==> SdbpCheckMatchingRegistryValue+0x1cf (RVA: 0xd4857)
    ==> SdbpCheckMatchingRegistryValue+0x2a1 (RVA: 0xd4929)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0xd4a71)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0xd5107)
    ==> SdbpCheckMatchingTextEntry+0x230 (RVA: 0xd54a0)
    ==> SdbpRetrievePackageAttributes+0x46 (RVA: 0xd71be)
    ==> SdbpRetrievePackageAttributes+0xc4 (RVA: 0xd723c)
    ==> SdbpRetrievePackageAttributes+0x1af (RVA: 0xd7327)
    ==> SdbpRetrievePackageAttributes+0x263 (RVA: 0xd73db)
    ==> SdbpRetrievePackageAttributes+0x6d3 (RVA: 0xd784b)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0xd86f0)
    ==> SdbReleaseDatabase+0xde (RVA: 0xd9102)
    ==> SdbOpenDatabaseEx+0x4b (RVA: 0xd937f)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0xd957c)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0xd9a07)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0xd9dd1)
    ==> SdbpCreateSDBLookupEntry+0x9e (RVA: 0xda4be)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0xdb6b5)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0xdc89e)
    ==> AslPathGetLongFileNameLongpath+0xb7 (RVA: 0xdea3b)
    ==> AslPathIsTemporaryInternetFile+0x41 (RVA: 0xded01)
    ==> AslPathIsTemporaryInternetFile+0x169 (RVA: 0xdee29)
    ==> AslPathIsTemporaryInternetFile+0x203 (RVA: 0xdeec3)
    ==> AslPathIsTemporaryInternetFile+0x328 (RVA: 0xdefe8)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x1b9 (RVA: 0xdf335)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1ed (RVA: 0xdf63d)

 [[IN]] C:\Windows\System32\p2pnetsh.dll
    ==> ?IsComponentEnabledInSku@@YAHPEBG@Z+0x687 (RVA: 0xe4d3)

 [[IN]] C:\Windows\System32\p9np.dll
    ==> ?CreateConnectionName@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@V?$basic_string_view@GU?$char_traits@G@std@@@2@0@Z+0xfb (RVA: 0x9143)

 [[IN]] C:\Windows\System32\PayloadRestrictions.dll
    ==> MitLibInitialize+0x16e (RVA: 0x38a3e)
    ==> MitLibProtectOurModules+0x55 (RVA: 0x39cbd)

 [[IN]] C:\Windows\System32\pcacli.dll
    ==> PcaTracePrintf+0x4a (RVA: 0x1e8a)
    ==> AslTelemetryCreate+0xd7 (RVA: 0x20c7)
    ==> AslTelemetryCreate+0x1ba (RVA: 0x21aa)
    ==> AslTelemetryCreate+0x2bc (RVA: 0x22ac)
    ==> PcaTraceCreate+0x3b (RVA: 0x240b)
    ==> PcaTraceCreate+0xcf (RVA: 0x249f)
    ==> PcaTraceCreate+0x28c (RVA: 0x265c)
    ==> AslRegistryBuildMachinePath+0x63 (RVA: 0x2883)
    ==> AslLogCreate+0x45 (RVA: 0x2945)
    ==> AslLogCreate+0x8d (RVA: 0x298d)
    ==> AslTelemetryFlush+0x1aa (RVA: 0x393a)
    ==> AslTelemetryFlush+0x1df (RVA: 0x396f)
    ==> ?PcapTraceDebugCallback@@YAXW4ASL_LOG_LEVEL@@PEBD_K1PEAD@Z+0x5a (RVA: 0xea1a)
    ==> AslTelemetryTrackError+0x4c (RVA: 0xfc48)
    ==> AslTelemetryTrackError+0x9d (RVA: 0xfc99)
    ==> AslpTelemetryProcessError+0xc7 (RVA: 0x10287)
    ==> AslRegistryGetString+0xb4 (RVA: 0x104d8)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x106b6)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x10772)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x10a38)
    ==> AslStringDuplicate+0x88 (RVA: 0x10b30)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x11041)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0x112d6)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0x11308)
    ==> PiiFilterCreate+0xf (RVA: 0x116bf)
    ==> PiiFilterCreate+0x7a (RVA: 0x1172a)
    ==> PiiFilterCreate+0xca (RVA: 0x1177a)
    ==> PiiFilterEmbeddedPathsExecute+0x64 (RVA: 0x118a0)
    ==> PiiFilterEmbeddedPathsExecute+0x9c (RVA: 0x118d8)
    ==> AslEnvBuildBasic+0xd01 (RVA: 0x12851)
    ==> AslEnvBuildBasic+0x1120 (RVA: 0x12c70)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x1300a)

 [[IN]] C:\Windows\System32\pcadm.dll
    ==> PcaTracePrintf+0x4a (RVA: 0x176a)
    ==> AslLogCreate+0x36 (RVA: 0xc86a)
    ==> AslLogCreate+0x77 (RVA: 0xc8ab)
    ==> AslTelemetryCreate+0x2b (RVA: 0xd65f)
    ==> AslTelemetryFlush+0x192 (RVA: 0xdae2)
    ==> AslTelemetryFlush+0x1cd (RVA: 0xdb1d)
    ==> AslTelemetryTrackError+0x48 (RVA: 0xe2e4)
    ==> AslTelemetryTrackError+0x99 (RVA: 0xe335)
    ==> AslpTelemetryProcessError+0xc7 (RVA: 0xe923)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xed9e)
    ==> AslRegistryGetString+0xb4 (RVA: 0xf014)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0xf1f2)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0xf2ae)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x106a5)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2a (RVA: 0x1093a)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5c (RVA: 0x1096c)
    ==> PiiFilterCreate+0xf (RVA: 0x10d23)
    ==> PiiFilterEmbeddedPathsExecute+0x64 (RVA: 0x10f10)
    ==> PiiFilterEmbeddedPathsExecute+0x9c (RVA: 0x10f48)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x112d0)
    ==> AslStringDuplicate+0x88 (RVA: 0x11424)
    ==> AslStringDuplicateA+0x81 (RVA: 0x1159d)
    ==> AslEnvBuildBasic+0xb2d (RVA: 0x12299)
    ==> AslEnvBuildBasic+0xf50 (RVA: 0x126bc)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x12a5a)

 [[IN]] C:\Windows\System32\pcasvc.dll
    ==> AslTelemetryCreate+0x2a (RVA: 0x472a)
    ==> AslStringDuplicateA+0x6d (RVA: 0x4971)
    ==> AslLogPublishToPeb+0x0 (RVA: 0x5298)
    ==> AslLogCreate+0x49 (RVA: 0x551d)
    ==> AslLogCreate+0x89 (RVA: 0x555d)
    ==> AslTelemetryTrackError+0x4c (RVA: 0x7e7c)
    ==> AslTelemetryTrackError+0x9d (RVA: 0x7ecd)
    ==> PcapTraceDebugCallback+0x75 (RVA: 0x8475)
    ==> PcaTracePrintf+0x4a (RVA: 0x8eda)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xe2fe)
    ==> ?Siuf_EtwFromDM@@YAKW4_PCA_EVENT_TYPE@@PEAX@Z+0x220 (RVA: 0xf2f0)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0x120cc)
    ==> AslFileOpen+0x44 (RVA: 0x12278)
    ==> AslStringDuplicate+0x64 (RVA: 0x12678)
    ==> ?ControlPanelApplet_Delete@@YAX_K@Z+0x0 (RVA: 0x2d100)
    ==> AslPathWildcardFindFirst+0x115 (RVA: 0x3d041)
    ==> AslPathWildcardFindFirst+0x1fc (RVA: 0x3d128)
    ==> AslPathWildcardFindNext+0x9a (RVA: 0x3d4aa)
    ==> AslRegWildcardFindFirst+0x20 (RVA: 0x3df3c)
    ==> AslpAllocMatchNode+0xf (RVA: 0x3e083)
    ==> AslpPathWildcardAllocMatchNode+0xd4 (RVA: 0x3e290)
    ==> AslpProcessMatchRegNode+0x9e (RVA: 0x3e7b6)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x2d (RVA: 0x3ed45)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5f (RVA: 0x3ed77)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x3f3dd)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x3f973)
    ==> AslpFileGetVersionBlockImageOnly+0x1cb (RVA: 0x40593)
    ==> SdbpGetProcessHistory+0x17b (RVA: 0x43187)
    ==> SdbInitDatabaseEx+0x70 (RVA: 0x4380c)
    ==> SdbResolveDatabaseEx+0x15e (RVA: 0x4440a)
    ==> SdbpRemoveSDBLookupEntry+0x3b (RVA: 0x4500f)
    ==> SdbInitDatabaseInMemory+0xf (RVA: 0x453cb)
    ==> SdbOpenDatabaseEx+0x52 (RVA: 0x4550a)
    ==> SdbReleaseDatabase+0xcc (RVA: 0x45798)
    ==> SdbpCreateSearchPathPartsFromPath+0x7c (RVA: 0x45850)
    ==> SdbpOpenDatabaseInMemory+0xf (RVA: 0x459df)
    ==> SdbQueryDataExTagID+0x218 (RVA: 0x48014)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x4937e)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x49478)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x4954a)
    ==> SdbpCheckMatchingTextEntry+0x25a (RVA: 0x499d6)
    ==> SdbpCreateSearchDBContext+0x5e (RVA: 0x4a52e)
    ==> SdbpCreateSearchDBContext+0x117 (RVA: 0x4a5e7)
    ==> SdbpCreateSearchDBContext+0x232 (RVA: 0x4a702)
    ==> SdbpCreateSearchDBContext+0x257 (RVA: 0x4a727)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x4ab8f)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x4b121)
    ==> SdbpResolveMatchingFile+0x175 (RVA: 0x4b9a5)
    ==> SdbGetFileAttributes+0xd9 (RVA: 0x4c161)
    ==> SdbGetFileAttributes+0x174 (RVA: 0x4c1fc)
    ==> SdbpCheckAllAttributes+0x65 (RVA: 0x4c489)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0x4cf96)
    ==> 0x59de9 (no symbol)
    ==> 0x5cf5a (no symbol)
    ==> 0x5cfe1 (no symbol)
    ==> 0x5d0ff (no symbol)
    ==> 0x5d32c (no symbol)
    ==> ?WicaPostInstallp_ShowApphelps@@YAKPEAU_ExeEntry@@@Z+0x71 (RVA: 0x70a25)
    ==> ?UtcEvents_InstallerComplete@@YAKW4_PCA_EVENT_TYPE@@PEAX@Z+0x33f (RVA: 0x7498f)
    ==> ?UtcEvents_InstallerComplete@@YAKW4_PCA_EVENT_TYPE@@PEAX@Z+0x786 (RVA: 0x74dd6)
    ==> ?UtcEventsp_EncodeProgramInfo@@YAKPEAPEAGPEBG@Z+0xfc (RVA: 0x751cc)
    ==> ?UtcEventsp_EncodeProgramInfo@@YAKPEAPEAGPEBG@Z+0x15c (RVA: 0x7522c)
    ==> ?UtcEventsp_EncodeProgramInfo@@YAKPEAPEAGPEBG@Z+0x1bc (RVA: 0x7528c)
    ==> ?UtcEventsp_EncodeProgramInfo@@YAKPEAPEAGPEBG@Z+0x40d (RVA: 0x754dd)
    ==> ?PushApphelpp_ShowApphelp@@YAKPEAU_PUSHAPPHELP_PAYLOAD@@@Z+0x6d (RVA: 0x75cb1)
    ==> AslTelemetryFlush+0x18c (RVA: 0x7ede0)
    ==> AslTelemetryFlush+0x1c7 (RVA: 0x7ee1b)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0x7f764)
    ==> AslRegistryGetString+0xb4 (RVA: 0x7f8bc)
    ==> AslRegistryGetStringExpand+0x9f (RVA: 0x7fa93)
    ==> AslRegistryGetStringExpand+0x15b (RVA: 0x7fb4f)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x17f (RVA: 0x80c53)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1ac (RVA: 0x80f1c)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x810a9)
    ==> PiiFilterCreate+0xf (RVA: 0x8139f)
    ==> PiiFilterEmbeddedPathsExecute+0x58 (RVA: 0x814dc)
    ==> PiiFilterEmbeddedPathsExecute+0x92 (RVA: 0x81516)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x818e8)
    ==> AslEnvBuildBasic+0xb2d (RVA: 0x826c9)
    ==> AslEnvBuildBasic+0xf50 (RVA: 0x82aec)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x82e8a)
    ==> AslFileMappingCreate+0x62 (RVA: 0x8366e)
    ==> AslFileAttributeToString+0x57 (RVA: 0x84983)
    ==> AslpFileGetVersionBlock+0x468 (RVA: 0x867e4)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x87e4c)
    ==> ?RetrieveSpecifiedFileAttributes@Far@@SAJPEAPEAUtagFILEATTRIBUTE@@PEAKPEBG_KW4FAR_MODE_FLAGS@@@Z+0x8e (RVA: 0x9248a)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x466 (RVA: 0x92ca6)
    ==> ?_AttributesFromBOE@@YAJAEAVAslFileMapping@@PEAUtagFILEATTRIBUTE@@_KW4FAR_MODE_FLAGS@@@Z+0x567 (RVA: 0x92da7)
    ==> ?_SetFileAttributeValue@@YAJPEBXKW4FILEATTRID@@PEAUtagFILEATTRIBUTE@@@Z+0xef (RVA: 0x94537)
    ==> ?_ListFiles@FileList@@AEAAJPEBG0K@Z+0x10c (RVA: 0x955b4)
    ==> ?_ListFiles@FileList@@AEAAJPEBG0K@Z+0x2a2 (RVA: 0x9574a)
    ==> ?_PopulateSetupScriptList@FileList@@AEAAJXZ+0x37 (RVA: 0x958c7)

 [[IN]] C:\Windows\System32\pcaui.dll
    ==> ??0AslLogGlobalLogger@@QEAA@PEBDI@Z+0x6e (RVA: 0x616a)
    ==> ??0AslLogGlobalLogger@@QEAA@PEBDI@Z+0x168 (RVA: 0x6264)
    ==> AslStringDuplicateA+0x91 (RVA: 0x7ec5)
    ==> AslStringDuplicate+0xb5 (RVA: 0x80cd)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x8224)
    ==> AslLogCreate+0x3b (RVA: 0x8713)
    ==> AslLogCreate+0x7c (RVA: 0x8754)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x94b7)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x76 (RVA: 0x951e)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xca (RVA: 0x9572)
    ==> AslTelemetryFlush+0x18c (RVA: 0xe408)
    ==> AslTelemetryFlush+0x1c4 (RVA: 0xe440)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0xf009)
    ==> AslTelemetryTrackError+0x48 (RVA: 0xf118)
    ==> AslTelemetryTrackError+0x99 (RVA: 0xf169)
    ==> ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJ_K0@Z+0x50 (RVA: 0xf448)
    ==> AslRegistryGetString+0xb4 (RVA: 0x106fc)
    ==> AslRegistryGetStringExpand+0x9f (RVA: 0x108d3)
    ==> AslRegistryGetStringExpand+0x15b (RVA: 0x1098f)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x10afe)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x11c91)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x11cc5)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x11f82)
    ==> PiiFilterEmbeddedPathsExecute+0x62 (RVA: 0x12196)
    ==> PiiFilterEmbeddedPathsExecute+0xa3 (RVA: 0x121d7)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x12c36)
    ==> AslEnvBuildBasic+0xb41 (RVA: 0x13bcd)
    ==> AslEnvBuildBasic+0xf64 (RVA: 0x13ff0)

 [[IN]] C:\Windows\System32\pcwutl.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0xd9ff)
    ==> ??0AslLogGlobalLogger@@QEAA@PEBDI@Z+0x55 (RVA: 0xdbc1)
    ==> AslFileMappingCreate+0x55 (RVA: 0x15e6d)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x17b6f)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x184b6)
    ==> AslRegistryGetString+0xb4 (RVA: 0x1b390)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x1b56e)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x1b62a)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x1b79a)
    ==> AslTelemetryFlush+0x18c (RVA: 0x1cbe0)
    ==> AslTelemetryFlush+0x1c4 (RVA: 0x1cc18)
    ==> AslpTelemetryProcessError+0xc5 (RVA: 0x1d7b1)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x1d8c0)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x1d911)
    ==> AslLogCreate+0x3b (RVA: 0x1ddbb)
    ==> AslLogCreate+0x7c (RVA: 0x1ddfc)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x1ea91)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x1eac5)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x1ed8a)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x1f405)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x1f446)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x1f848)
    ==> AslStringDuplicateA+0x91 (RVA: 0x1f9b9)
    ==> AslStringDuplicate+0xb5 (RVA: 0x1fbc1)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x1fd18)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x20184)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x20ec2)
    ==> AslEnvBuildBasic+0xbd0 (RVA: 0x21ee8)
    ==> AslEnvBuildBasic+0x10c9 (RVA: 0x223e1)

 [[IN]] C:\Windows\System32\PeerDistCacheProvider.dll
    ==> ?IsLicenseEnabled@@YA_NPEBG@Z+0x6ad (RVA: 0x78cc5)

 [[IN]] C:\Windows\System32\PeerDistCleaner.dll
    ==> ?IsLicenseEnabled@@YA_NPEBG@Z+0x6ad (RVA: 0x16be5)

 [[IN]] C:\Windows\System32\PeerDistSh.dll
    ==> ?IsLicenseEnabled@@YA_NPEBG@Z+0x6ad (RVA: 0x15035)

 [[IN]] C:\Windows\System32\PersonalizationCSP.dll
    ==> IsPersonalizationCSPAllowed+0x66e (RVA: 0xbf46)

 [[IN]] C:\Windows\System32\PlaySndSrv.dll
    ==> PlaySoundServerInitialize+0x40 (RVA: 0x1930)

 [[IN]] C:\Windows\System32\pmcsnap.dll
    ==> ?VerifySLLicense@@YAHXZ+0x673 (RVA: 0x7f8f)

 [[IN]] C:\Windows\System32\policymanager.dll
    ==> ?SlapiPivot@@YAKXZ+0x633 (RVA: 0x11ec3)
    ==> ?GetStringSLAPIPolicyValue@@YAJPEBGPEAPEAEPEAI@Z+0x67c (RVA: 0x3042c)

 [[IN]] C:\Windows\System32\policymanagerprecheck.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x1a150)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x1a180)

 [[IN]] C:\Windows\System32\prnfldr.dll
    ==> IsSharingRestricted+0x65d (RVA: 0x1717d)

 [[IN]] C:\Windows\System32\profapi.dll
    ==> _SetUserEnvironment+0x3c3 (RVA: 0x3f53)

 [[IN]] C:\Windows\System32\ProxifierShellExt.dll
    ==> RVA: .text+0xb67e
    ==> RVA: .text+0xd218

 [[IN]] C:\Windows\System32\PsmServiceExtHost.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x3760)
    ==> MIDL_user_free+0x0 (RVA: 0x37c20)
    ==> 0x55191 (no symbol)

 [[IN]] C:\Windows\System32\psmsrv.dll
    ==> MIDL_user_free+0x0 (RVA: 0x12400)
    ==> MIDL_user_allocate+0x0 (RVA: 0x12430)

 [[IN]] C:\Windows\System32\ptpprov.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x19310)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x19340)

 [[IN]] C:\Windows\System32\PushToInstall.dll
    ==> ?InitStoreAppsAreDisabled@@YAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z+0x667 (RVA: 0x9de7)

 [[IN]] C:\Windows\System32\qwave.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x373f0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x37420)

 [[IN]] C:\Windows\System32\rasapi32.dll
    ==> RasScriptDisabled+0x642 (RVA: 0x1cdc6)
    ==> DwIsdnDisabled+0x668 (RVA: 0x75590)
    ==> RasMobileCore+0x676 (RVA: 0x8f21e)
    ==> DwDialupDisabled+0x663 (RVA: 0xb615f)

 [[IN]] C:\Windows\System32\rascustom.dll
    ==> ?IsMobileCore@LibInterface@@AEAAHXZ+0x695 (RVA: 0x554d)
    ==> ?RasMobileCore@@YAHXZ+0x698 (RVA: 0x3ef04)

 [[IN]] C:\Windows\System32\rasmontr.dll
    ==> GetRestrictedPortCount+0x665 (RVA: 0x2cb55)

 [[IN]] C:\Windows\System32\rasplap.dll
    ==> ?ReportResult@CRasCredential@@UEAAJJJPEAPEAGPEAW4_CREDENTIAL_PROVIDER_STATUS_ICON@@@Z+0x12f (RVA: 0x54af)

 [[IN]] C:\Windows\System32\rastapi.dll
    ==> InitializeDialInRestriction+0x661 (RVA: 0x3fd5)
    ==> GetRestrictedPortCount+0x665 (RVA: 0x1797d)

 [[IN]] C:\Windows\System32\RazerS3CoinstallerEx.dll
    ==> RVA: .text+0x9565

 [[IN]] C:\Windows\System32\rdpcore.dll
    ==> ?SendDesktopSASInternal@CRDPENCWin32DesktopProxy@@IEAAKXZ+0xf (RVA: 0x8c73)

 [[IN]] C:\Windows\System32\rdpendp.dll
    ==> ?IsAudioCaptureEnabledByLicense@@YAHK@Z+0x6c6 (RVA: 0x294aa)

 [[IN]] C:\Windows\System32\rdpnano.dll
    ==> exit_or_terminate_process+0x11 (RVA: 0x129189)

 [[IN]] C:\Windows\System32\rdpsharercom.dll
    ==> ?SendDesktopSASInternal@CRDPENCWin32DesktopProxy@@IEAAKXZ+0xf (RVA: 0x164f3)

 [[IN]] C:\Windows\System32\ReAgent.dll
    ==> `anonymous namespace'::OurRtlAllocateStringRoutine+0x0 (RVA: 0x72fc8)
    ==> `anonymous namespace'::OurRtlFreeStringRoutine+0x0 (RVA: 0x72fec)
    ==> `anonymous namespace'::OurRtlReallocateStringRoutine+0x0 (RVA: 0x73010)

 [[IN]] C:\Windows\System32\regapi.dll
    ==> RegGetLicensePolicyID+0x801 (RVA: 0x12ca1)
    ==> RegSetLicensePolicyID+0x65c (RVA: 0x1d90c)

 [[IN]] C:\Windows\System32\regsvc.dll
    ==> RegSvcContextFree+0x0 (RVA: 0x1fec)

 [[IN]] C:\Windows\System32\ReInfo.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x1c9b6)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x1ca44)

 [[IN]] C:\Windows\System32\remotepg.dll
    ==> ?SLGetWindowsInformationDWORDWrapper@@YAJPEBGPEAK@Z+0x671 (RVA: 0x2235)

 [[IN]] C:\Windows\System32\ResBParser.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x7bc2)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x91d4)

 [[IN]] C:\Windows\System32\reseteng.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0xbb0b6)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0xbb144)

 [[IN]] C:\Windows\System32\ResourceMapper.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x491b6)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x49774)

 [[IN]] C:\Windows\System32\ResourcePolicyServer.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x3640)
    ==> MIDL_user_free+0x0 (RVA: 0x3670)

 [[IN]] C:\Windows\System32\resutils.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x48856)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x4cd08)

 [[IN]] C:\Windows\System32\rmclient.dll
    ==> CrmActivityFreeWindowClosedReasons+0x0 (RVA: 0x8ca0)
    ==> MIDL_user_allocate+0x0 (RVA: 0x8e00)

 [[IN]] C:\Windows\System32\RMSRoamingSecurity.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x6030)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x6060)

 [[IN]] C:\Windows\System32\RoamingSecurity.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x6430)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x6460)

 [[IN]] C:\Windows\System32\rpcrt4.dll
    ==> `NdrpClientCall2'::`1'::filt$0+0x51 (RVA: 0x2b41)
    ==> ?NdrpPointerUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@PEAPEAEPEAEPEAJPEBE@Z+0x1f6 (RVA: 0x42e6)
    ==> ?Dispatch@NDR64_UNMRSHL_POINTER_QUEUE_ELEMENT@@UEAAXPEAU_MIDL_STUB_MESSAGE@@@Z+0x3c5 (RVA: 0xc025)
    ==> ?Ndr64TopLevelPointerUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@PEAPEAEPEBX_N@Z+0x392 (RVA: 0xd9d2)
    ==> ?Ndr64EmbeddedPointerUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@PEAPEAEPEBX_N@Z+0x3be (RVA: 0xeebe)
    ==> ?Ndr64pPointerUnmarshallInternal@@YAXPEAU_MIDL_STUB_MESSAGE@@_JPEAPEAEPEAEPEBX@Z+0x3ad (RVA: 0xf60d)
    ==> NdrpServerUnMarshal+0x6e2 (RVA: 0x136b2)
    ==> NdrPointerUnmarshall+0x259 (RVA: 0x15569)
    ==> NdrComplexStructUnmarshall+0x816 (RVA: 0x18686)
    ==> ?NdrpComplexArrayUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@PEAPEAEPEBEEE@Z+0xa48 (RVA: 0x1d6d8)
    ==> ?NdrpUnionUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@PEAPEAEPEBEE2@Z+0x51e (RVA: 0x21002)
    ==> RPC_SERVER::FindOrCreateInterfaceInternal+0xce (RVA: 0x24a16)
    ==> LRPC_SCALL::GetBuffer+0x5c (RVA: 0x46efc)
    ==> LRPC_ADDRESS::NewConnectionRequest+0xdd (RVA: 0x4914d)
    ==> PerformRpcInitialization+0x1e9 (RVA: 0x50479)
    ==> PerformRpcInitialization+0x207 (RVA: 0x50497)
    ==> PerformRpcInitialization+0x225 (RVA: 0x504b5)
    ==> ?SetAutoPolicySettings@@YAXW4tagStateInformationPolicyValues@@@Z+0x6a (RVA: 0x507e2)
    ==> InitializeRpcAllocator+0xf (RVA: 0x51b5f)
    ==> InitializeRpcAllocator+0x49 (RVA: 0x51b99)
    ==> LRPC_ADDRESS::ActuallySetupAddress+0xb8 (RVA: 0x64760)
    ==> 0x931d5 (no symbol)
    ==> 0x932f2 (no symbol)
    ==> ?ReallocPipeBuffer@LRPC_SCALL@@UEAAJPEAU_RPC_MESSAGE@@I@Z+0x28 (RVA: 0xa2708)
    ==> ?FwFilter@OSF_SCALL@@QEAAJPEAU_GUID@@GPEAGPEAH@Z+0x88 (RVA: 0xae688)
    ==> ?SendReceive@LRPC_SCALL@@UEAAJPEAU_RPC_MESSAGE@@@Z+0x2a (RVA: 0xbb69a)
    ==> ?Dispatch@NDR_UNMRSHL_POINTER_QUEUE_ELEMENT@@UEAAXPEAU_MIDL_STUB_MESSAGE@@@Z+0x26c (RVA: 0xc5b8c)
    ==> ?NdrpGetDisableClientHardeningAndLog@@YAHXZ+0x2b (RVA: 0xc8fcb)
    ==> ?NdrpGetLHBackwardCompatOption@@YAKK@Z+0x0 (RVA: 0xc8fec)
    ==> ?NdrpDisableClientHarden@@YAHXZ+0x4e (RVA: 0xcd45a)
    ==> ?Ndr64pPointerUnmarshall@@YAXPEAU_MIDL_STUB_MESSAGE@@_JPEAPEAEPEAEPEBX@Z+0x393 (RVA: 0xd8663)

 [[IN]] C:\Windows\System32\rpcss.dll
    ==> `dynamic initializer for 'g_hHeap''+0x0 (RVA: 0x12a0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x55300)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x55330)
    ==> ?LogicalError@Details@ObjectLibrary@@YAXJPEBX@Z+0x16 (RVA: 0xbbf5e)
    ==> ??$GetDefaultOverride@W4BoolProperty@FeatureDevelopmentProperties@@U<unnamed-type-g_boolPropertyDefaultOverrideRecords>@2@$01@FeatureDevelopmentProperties@@YA_NW4BoolProperty@0@AEAY01$$CBU<unnamed-type-g_boolPropertyDefaultOverrideRecords>@0@PEA_N@Z+0x85 (RVA: 0xe8761)
    ==> ?OpenPerExeSubkey@FeatureDevelopmentProperties@@YAJAEBVRegistryKey@@AEAV2@@Z+0x21 (RVA: 0xe9531)

 [[IN]] C:\Windows\System32\rsaenh.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x25ef0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x25f20)

 [[IN]] C:\Windows\System32\rshx32.dll
    ==> ?IsSimpleUI@@YAHXZ+0x680 (RVA: 0xb348)

 [[IN]] C:\Windows\System32\RstrtMgr.dll
    ==> ?ConsoleCtrlEvent@ActionStrategy@@AEAAKPEAVRMProcInfoInternal@@@Z+0xb3 (RVA: 0x1bb7b)
    ==> ?ConsoleCtrlEvent@ActionStrategy@@AEAAKPEAVRMProcInfoInternal@@@Z+0xdf (RVA: 0x1bba7)
    ==> ?ConsoleCtrlEvent@ActionStrategy@@AEAAKPEAVRMProcInfoInternal@@@Z+0x2cf (RVA: 0x1bd97)
    ==> ?ExecuteTask@ActionStrategy@@QEAAKK@Z+0x151 (RVA: 0x1cc71)
    ==> ?ExecuteTask@ActionStrategy@@QEAAKK@Z+0x7e0 (RVA: 0x1d300)
    ==> ?ExecuteTask@ActionStrategy@@QEAAKK@Z+0x87b (RVA: 0x1d39b)

 [[IN]] C:\Windows\System32\RTWorkQ.dll
    ==> WorkItem::Cancel+0xe1 (RVA: 0x945d)
    ==> RtwqPutWorkItem+0x67 (RVA: 0xa117)
    ==> ?PutWorkItem@CPlatform@@QEAAJKJPEAUIMFAsyncResult@@@Z+0x40 (RVA: 0x16a9c)

 [[IN]] C:\Windows\System32\samsrv.dll
    ==> 0x42e31 (no symbol)
    ==> ShouldDisableAccountByDefault+0x658 (RVA: 0x65db8)

 [[IN]] C:\Windows\System32\sas.dll
    ==> SendSAS+0x15 (RVA: 0x1025)
    ==> WlSecureDesktopSimulateSAS+0xc (RVA: 0x1160)

 [[IN]] C:\Windows\System32\scecli.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x38a20)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x38a50)

 [[IN]] C:\Windows\System32\scesrv.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x63f30)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x63f60)

 [[IN]] C:\Windows\System32\schannel.dll
    ==> _DeleteDebugTracing+0x14 (RVA: 0x15e80)
    ==> _InitDebugTracingEx+0x18 (RVA: 0x22c6c)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x75ec0)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x75ef0)

 [[IN]] C:\Windows\System32\sdengin2.dll
    ==> ?SdGetFeatureEnabledOnSKU@@YAJPEBGPEAH@Z+0x6d6 (RVA: 0x86346)

 [[IN]] C:\Windows\System32\sdohlp.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x22af0)

 [[IN]] C:\Windows\System32\sechost.dll
    ==> ScCreateAndSetSD+0x3f (RVA: 0x1c40f)
    ==> 0x23cd6 (no symbol)
    ==> 0x23cf2 (no symbol)
    ==> 0x23d0e (no symbol)
    ==> 0x23d5d (no symbol)
    ==> 0x23d9f (no symbol)
    ==> 0x23dde (no symbol)
    ==> 0x243f2 (no symbol)
    ==> 0x2440e (no symbol)
    ==> 0x2442a (no symbol)
    ==> 0x24482 (no symbol)
    ==> 0x244c7 (no symbol)
    ==> 0x2450d (no symbol)
    ==> CreateSystemCapabilitySecurityDescriptor+0x74a (RVA: 0x327e6)

 [[IN]] C:\Windows\System32\secur32.dll
    ==> ?CollectLsaPerformanceData@@YAKPEAGPEAPEAXPEAK2@Z+0x20 (RVA: 0x30c0)

 [[IN]] C:\Windows\System32\SecureTimeAggregator.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x111a0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x111d0)

 [[IN]] C:\Windows\System32\SEMgrSvc.dll
    ==> ?_Destroy@?$_Ref_count_obj@VWnfNotification@BILayer@Broker@@@std@@EEAAXXZ+0x6 (RVA: 0x87d36)

 [[IN]] C:\Windows\System32\ServicingUAPI.dll
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x39 (RVA: 0x12d59)

 [[IN]] C:\Windows\System32\SessEnv.dll
    ==> 0x1dea5 (no symbol)

 [[IN]] C:\Windows\System32\SettingsEnvironment.Desktop.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x76 (RVA: 0x3d3e2)

 [[IN]] C:\Windows\System32\SettingsHandlers_ContentDeliveryManager.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6f (RVA: 0x13963)

 [[IN]] C:\Windows\System32\SettingsHandlers_Gpu.dll
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x1ab5b)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0x76 (RVA: 0x1abc2)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xca (RVA: 0x1ac16)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x24599)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x245cd)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x2488a)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x254aa)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x25929)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x264d5)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x269e3)
    ==> AslRegistryGetString+0xb4 (RVA: 0x270b8)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x27296)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x27352)
    ==> AslStringDuplicate+0xb5 (RVA: 0x27545)
    ==> SdbReleaseDatabase+0xde (RVA: 0x28222)
    ==> `SystemSettings::Gaming::AdvancedGraphicsTelemetrySingleton::GetInstance'::`2'::`dynamic atexit destructor for 'instance''+0x23 (RVA: 0x2ba43)

 [[IN]] C:\Windows\System32\SettingsHandlers_ManagePhone.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6f (RVA: 0x21bbf)

 [[IN]] C:\Windows\System32\SettingsHandlers_nt.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6f (RVA: 0x112673)

 [[IN]] C:\Windows\System32\SettingSyncCore.dll
    ==> ??0?$vector@PEBGV?$allocator@PEBG@std@@@std@@QEAA@AEBV01@@Z+0xc4 (RVA: 0x4818c)

 [[IN]] C:\Windows\System32\setup\comsetup.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x1ebf0)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x1ec20)

 [[IN]] C:\Windows\System32\setup\msdtcstp.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xab90)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xabc0)

 [[IN]] C:\Windows\System32\setupapi.dll
    ==> IsInteractiveWindowStation+0x18 (RVA: 0x4fec)
    ==> IsInteractiveWindowStation+0x2f (RVA: 0x5003)
    ==> pSpSignGetIsInteractive+0x18 (RVA: 0x2f9e0)
    ==> pSpSignGetIsInteractive+0x5a (RVA: 0x2fa22)
    ==> pSpSignGetIsInteractive+0x6a (RVA: 0x2fa32)
    ==> pSpSignGetIsInteractive+0x7a (RVA: 0x2fa42)
    ==> pSpSignGetIsInteractive+0x91 (RVA: 0x2fa59)
    ==> 0x38cb6 (no symbol)
    ==> 0x38cca (no symbol)
    ==> 0x38ce5 (no symbol)

 [[IN]] C:\Windows\System32\setupcl.dll
    ==> SclExeMalloc+0x0 (RVA: 0x10af0)
    ==> SclExeFree+0x0 (RVA: 0x10b20)

 [[IN]] C:\Windows\System32\sfc_os.dll
    ==> CipRtlAllocateStringRoutine+0x0 (RVA: 0x3760)
    ==> ?CipRtlReallocateStringRoutine@@YAPEAX_KPEAX@Z+0x0 (RVA: 0x51e0)

 [[IN]] C:\Windows\System32\SHCore.dll
    ==> _CreateSharedHandleACL+0x1d (RVA: 0x1cc99)
    ==> 0x4a654 (no symbol)

 [[IN]] C:\Windows\System32\shell32.dll
    ==> AuxUlibIsDLLSynchronizationHeld+0x4c (RVA: 0x641ec)
    ==> ?_InitSource@CAssocProgidElement@@MEAAJXZ+0x6b (RVA: 0xa2e4b)
    ==> _SHCoCreateInstance+0xc1 (RVA: 0xbcee5)
    ==> _CreateSharedHandleACL+0x19 (RVA: 0xd8139)
    ==> RegenerateUserEnvironment+0x417 (RVA: 0x1d85b7)
    ==> ?ApphelpHookCOM@@YAXAEBU_GUID@@0PEAPEAX@Z+0x24 (RVA: 0x2ab8b8)

 [[IN]] C:\Windows\System32\shsvcs.dll
    ==> CreateHardwareEventMoniker+0x11 (RVA: 0x12a1)

 [[IN]] C:\Windows\System32\slwga.dll
    ==> 0x2fa9 (no symbol)

 [[IN]] C:\Windows\System32\SmartcardCredentialProvider.dll
    ==> ?GetCurrentRegKey@@YAJPEAPEAG@Z+0x80 (RVA: 0x1684c)
    ==> ?GetSerialization@CCredential@@MEAAJPEAW4_CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE@@PEAU_CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION@@PEAPEAGPEAW4_CREDENTIAL_PROVIDER_STATUS_ICON@@@Z+0x7e (RVA: 0x1723e)
    ==> ?ReportResult@CCredential@@MEAAJJJPEAPEAGPEAW4_CREDENTIAL_PROVIDER_STATUS_ICON@@@Z+0xb8 (RVA: 0x18578)
    ==> ?GetCredentialCount@CProvider@@EEAAJPEAK0PEAH@Z+0xb0 (RVA: 0x29d40)
    ==> ?_BuildCredentialList@CProvider@@EEAAJXZ+0x9e (RVA: 0x2cede)

 [[IN]] C:\Windows\System32\smartscreenps.dll
    ==> `anonymous namespace'::device::cloud_sku+0x768 (RVA: 0xfa68)

 [[IN]] C:\Windows\System32\SmiEngine.dll
    ==> ??3@YAXPEAX@Z+0x0 (RVA: 0x2498)
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x93a46)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x93ad4)
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x9628a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x9871f)

 [[IN]] C:\Windows\System32\SpaceControl.dll
    ==> ?IsREFSFormatEnabled@@YAHXZ+0x673 (RVA: 0x14b5f)
    ==> ?IsREFSv1FormatEnabled@@YAHXZ+0x673 (RVA: 0x1e4ef)

 [[IN]] C:\Windows\System32\Speech_OneCore\common\sapi_onecore.dll
    ==> CSpRegistryIsolator::Initialize+0xca (RVA: 0x21de6)

 [[IN]] C:\Windows\System32\spool\drivers\x64\3\AdobePdf.dll
    ==> RVA: .text+0x131b2
    ==> RVA: .text+0x1655d
    ==> RVA: .text+0x165a4

 [[IN]] C:\Windows\System32\spool\drivers\x64\3\AdobePDFUI.dll
    ==> RVA: .text+0x65ba
    ==> RVA: .text+0x9980

 [[IN]] C:\Windows\System32\spool\drivers\x64\3\ADUIGP.DLL
    ==> RVA: .text+0x14c8e
    ==> RVA: .text+0x1c4f0

 [[IN]] C:\Windows\System32\sppcomapi.dll
    ==> ?get_LicensingInformation@CLicensingStateTools@@UEAAJPEAGPEAJ@Z+0x685 (RVA: 0x4035)
    ==> ?get_IsLocalGenuine@CLicensingStateTools@@UEAAJPEAF@Z+0x695 (RVA: 0xe485)
    ==> ?SPPGetWindowsLicenseStatus@@YAJPEAU_tagSL_LICENSING_STATUS@@PEAW4tagE_LICENSING_CHANNEL@@PEAU_SYSTEMTIME@@@Z+0x83a (RVA: 0x2151e)

 [[IN]] C:\Windows\System32\sppobjs.dll
    ==> RVA: .text+0xc4550
    ==> RVA: .text+0xd2cb6

 [[IN]] C:\Windows\System32\sppwinob.dll
    ==> RVA: .text+0x19882

 [[IN]] C:\Windows\System32\srpapi.dll
    ==> AiFree+0x0 (RVA: 0x8954)

 [[IN]] C:\Windows\System32\SshdBroker.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x1b5a2)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x214b8)

 [[IN]] C:\Windows\System32\SshdPinAuthLsa.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0x5602)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0x5ba8)

 [[IN]] C:\Windows\System32\sspicli.dll
    ==> LsaQueryContextAttributesExW+0x260 (RVA: 0x2060)
    ==> SecpQueryCredentialsAttributes+0x8b (RVA: 0x24cb)
    ==> SecpQueryCredentialsAttributes+0x126 (RVA: 0x2566)
    ==> LsaQueryContextAttributesExA+0x2f3 (RVA: 0x2dd3)
    ==> LsaCallAuthenticationPackage+0x9a (RVA: 0x2f1a)
    ==> LsaAcquireCredentialsHandleA+0x73 (RVA: 0x3803)
    ==> LsaAcquireCredentialsHandleA+0xfb (RVA: 0x388b)
    ==> SecpSetContextAttributes+0x47 (RVA: 0x3a53)
    ==> SecpQueryContextAttributes+0x83 (RVA: 0x49f3)
    ==> SecpQueryContextAttributes+0x13f (RVA: 0x4aaf)
    ==> LsaAcquireCredentialsHandleW+0xd9 (RVA: 0x51e9)
    ==> ProcAttach+0x111 (RVA: 0x8a41)
    ==> SecInitializePackageControl+0x20 (RVA: 0x8ab0)
    ==> LsaQueryCredentialsAttributesExW+0x66 (RVA: 0x9ef6)
    ==> NegQueryContextAttributes+0x84 (RVA: 0xcc24)
    ==> NegQueryContextAttributes+0x17a (RVA: 0xcd1a)
    ==> 0xf084 (no symbol)
    ==> 0xf8d8 (no symbol)
    ==> SecpSetCredentialsAttributes+0x5d (RVA: 0x16289)
    ==> ?LsaQueryCredentialsAttributesExA@@YAJPEAU_SecHandle@@KPEAXK@Z+0x6f (RVA: 0x1c25f)

 [[IN]] C:\Windows\System32\SSShim.dll
    ==> ?Internal_SssFindAndCopyImageBaseName@@YAXPEBXPEAU_LUNICODE_STRING@@PEA_K@Z+0x4a (RVA: 0x1052)
    ==> ?Internal_SssComputeRootDirectoryList@@YAJPEBU_SSS_BIND_SERVICING_STACK_INPUT_PARAMETERS@@PEAV?$Auto@U?$Vector@V?$Auto@U_LUNICODE_STRING@@@Windows@@@Windows@@@Windows@@@Z+0x305 (RVA: 0x1d31)
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x1147a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x1384f)

 [[IN]] C:\Windows\System32\StartTileData.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x76 (RVA: 0x31d26a)

 [[IN]] C:\Windows\System32\stobject.dll
    ==> ?s_PolicyAllowsSlideshow@CSlideshowSettings@@SAJXZ+0x649 (RVA: 0x2ada1)

 [[IN]] C:\Windows\System32\sxs.dll
    ==> ?FusionpGetProcessImageFileName@@YAXPEAU_UNICODE_STRING@@@Z+0x15 (RVA: 0x5f475)

 [[IN]] C:\Windows\System32\syncas.dll
    ==> RVA: .text+0xebf2
    ==> RVA: .text+0x148e4

 [[IN]] C:\Windows\System32\SystemResetPlatform\RjvClassicApp.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x72f16)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x72fa4)

 [[IN]] C:\Windows\System32\SystemSettings.DeviceEncryptionHandlers.dll
    ==> ?GetIsPremiumLicenseAvailable@DeviceEncryptionUIState@@SAJPEA_N@Z+0x661 (RVA: 0xdad5)

 [[IN]] C:\Windows\System32\Tabbtn.dll
    ==> ?GetBOOLPermission@CTabLicense@@SAHPEBGH@Z+0x6a5 (RVA: 0xe085)

 [[IN]] C:\Windows\System32\TabSvc.dll
    ==> ?LicenseCheck@@YAHXZ+0x63a (RVA: 0x21562)

 [[IN]] C:\Windows\System32\taskcomp.dll
    ==> ?SaveP@CJob@@QEAAJPEBGHK@Z+0x7c8 (RVA: 0x29748)

 [[IN]] C:\Windows\System32\TEEManagement64.dll
    ==> RVA: .text+0x19a2e
    ==> RVA: .text+0x241cc

 [[IN]] C:\Windows\System32\TempSignedLicenseExchangeTask.dll
    ==> ?StoreAppsAreDisabled@@YA_NXZ+0x66b (RVA: 0x1a7f)

 [[IN]] C:\Windows\System32\TetheringMgr.dll
    ==> ?IsTetheringPermittedOnSku@CDecisionEngineHandler@@UEAAJPEA_N@Z+0x6a5 (RVA: 0x11455)

 [[IN]] C:\Windows\System32\themecpl.dll
    ==> ?CheckIfPersonalizationFeatureIsEnabled@@YAHXZ+0x653 (RVA: 0xce1f)
    ==> ?IsPersonalizationFeatureAvailable@@YA_NXZ+0x66c (RVA: 0x1ba78)
    ==> ?s_PolicyAllowsSlideshow@CSlideshowSettings@@SAJXZ+0x672 (RVA: 0x3961a)

 [[IN]] C:\Windows\System32\themeservice.dll
    ==> ??0CThemeServer@@QEAA@PEAXKPEBXKK@Z+0x34 (RVA: 0x3c00)

 [[IN]] C:\Windows\System32\TimeBrokerServer.dll
    ==> ??1SystemTimer@Broker@@QEAA@XZ+0x17 (RVA: 0x1a117)
    ==> ??1WnfNotification@BILayer@Broker@@QEAA@XZ+0x12 (RVA: 0x1c46e)

 [[IN]] C:\Windows\System32\tscfgwmi.dll
    ==> ?LoadPropertyValues@CWin32_TerminalServiceSetting@@IEAAJPEAVCInstance@@_K@Z+0xdec (RVA: 0x7f38)
    ==> ?GetObject@CWin32_TerminalService@@MEAAJPEAVCInstance@@JAEAVCFrameworkQuery@@@Z+0x134 (RVA: 0x12254)
    ==> ?EnumerateInstances@CWin32_TerminalService@@MEAAJPEAVMethodContext@@J@Z+0x9e (RVA: 0x123de)
    ==> ?ExecQuery@CWin32_TerminalService@@MEAAJPEAVMethodContext@@AEAVCFrameworkQuery@@J@Z+0xc0 (RVA: 0x12670)

 [[IN]] C:\Windows\System32\tsmf.dll
    ==> ?GetTsAudioProtocol@@YAIK@Z+0x68 (RVA: 0x3258c)
    ==> ?EnableTSMFRemoting@@YAHXZ+0x6bd (RVA: 0x3b2f5)

 [[IN]] C:\Windows\System32\TSpkg.dll
    ==> _DeleteDebugTracing+0x14 (RVA: 0x1c1a0)
    ==> _InitDebugTracingEx+0x1d (RVA: 0x1c335)

 [[IN]] C:\Windows\System32\tssrvlic.dll
    ==> ?SLGetWindowsInformationDWORDWrapper@@YAJPEBGPEAK@Z+0x671 (RVA: 0xa3f1)

 [[IN]] C:\Windows\System32\ttdrecord.dll
    ==> ?EMAbort@@YAXPEBDK0ZZ+0x78 (RVA: 0x3fd0c)

 [[IN]] C:\Windows\System32\ttdrecordcpu.dll
    ==> ?BaseGetStdHandle@@YAPEAXPEAXH@Z+0x3b (RVA: 0x3e217)
    ==> ?BaseGetStdHandle@@YAPEAXPEAXH@Z+0x4e (RVA: 0x3e22a)
    ==> ?BaseGetStdHandle@@YAPEAXPEAXH@Z+0x61 (RVA: 0x3e23d)
    ==> ?AcquireThreadStateFromPool@Nirvana@@YAPEAV?$VirtualCpu@VX64Traits@Nirvana@@@1@XZ+0x24b (RVA: 0x3fd6b)
    ==> ?DllNotificationCB@Nirvana@@YAXIPEBT_LDR_DLL_NOTIFICATION_DATA@@PEAX@Z+0xa3 (RVA: 0x41303)
    ==> RequestUnhookedFunctions+0xba (RVA: 0x4261a)
    ==> ?ThreadSyncPoint@VirtualCpuBase@Nirvana@@QEAA_NPEAUThreadInfo@2@@Z+0x5f (RVA: 0x431cb)
    ==> ?HandleBreakpoint@VirtualCpuBase@Nirvana@@QEAAPEAUSCODE@2@PEAU32@@Z+0xf (RVA: 0x43343)
    ==> ??$MakeScodeLoadRegisterFromOperand@$0A@@?$IntelDecoder@VX64Traits@Nirvana@@@Nirvana@@CAXPEAVScodeOutputStream@1@AEBU?$RegisterInfo@W4X64Registers@Nirvana@@@1@AEBUOPERAND@DIS@@W4MODS@DISX86@@@Z+0x21b (RVA: 0x7d267)
    ==> ??$MakeScodeLoadRegisterFromOperand@$0A@@?$IntelDecoder@VX64Traits@Nirvana@@@Nirvana@@CAXPEAVScodeOutputStream@1@AEBU?$RegisterInfo@W4X64Registers@Nirvana@@@1@AEBUOPERAND@DIS@@W4MODS@DISX86@@@Z+0x255 (RVA: 0x7d2a1)
    ==> ??$MakeScodeLoadRegisterFromOperand@$00@?$IntelDecoder@VX64Traits@Nirvana@@@Nirvana@@CAXPEAVScodeOutputStream@1@AEBU?$RegisterInfo@W4X64Registers@Nirvana@@@1@AEBUOPERAND@DIS@@W4MODS@DISX86@@@Z+0x13d (RVA: 0x7d44d)
    ==> ??$MakeScodeLoadRegisterFromOperand@$00@?$IntelDecoder@VX64Traits@Nirvana@@@Nirvana@@CAXPEAVScodeOutputStream@1@AEBU?$RegisterInfo@W4X64Registers@Nirvana@@@1@AEBUOPERAND@DIS@@W4MODS@DISX86@@@Z+0x175 (RVA: 0x7d485)

 [[IN]] C:\Windows\System32\twinapi.appcore.dll
    ==> ??0CoreApplication@Core@ApplicationModel@Windows@@QEAA@XZ+0x4b6 (RVA: 0x2087a)
    ==> CSessionQueryService::QueryServiceInSession+0x47 (RVA: 0x5c577)
    ==> MIDL_user_free+0x0 (RVA: 0x66b00)
    ==> MIDL_user_allocate+0x0 (RVA: 0x678c0)
    ==> 0xb33ee (no symbol)
    ==> <lambda_6fdbfedaecab72f8f8a293e9c12fc898>::<lambda_invoker_cdecl>+0x4 (RVA: 0xb9964)
    ==> ?CheckBackgroundCapabilityForPackage@CBackgroundTaskCapability@@UEAAJPEBG0W4_BACKGROUND_TASK_CAPABILITY@@PEAH@Z+0x38 (RVA: 0x11b858)

 [[IN]] C:\Windows\System32\twinapi.dll
    ==> ?Free@ARI@@YAXPEAX@Z+0x5 (RVA: 0x78c5)

 [[IN]] C:\Windows\System32\twinui.dll
    ==> PiiFilterCreate+0xf (RVA: 0x6f7ff)
    ==> PiiFilterCreate+0x74 (RVA: 0x6f864)
    ==> PiiFilterCreate+0xc4 (RVA: 0x6f8b4)
    ==> PiiFilterpAddProfiles+0x2a (RVA: 0x6f952)
    ==> PiiFilterpAddProfiles+0x56 (RVA: 0x6f97e)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x39 (RVA: 0x6fca1)
    ==> AslRegistryGetStringExpand+0x7d (RVA: 0x6ff7d)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x708bd)
    ==> AslEnvBuildBasic+0x313 (RVA: 0x70b9f)
    ==> AslEnvBuildBasic+0x58f (RVA: 0x70e1b)
    ==> AslRegistryGetString+0x81 (RVA: 0x711a1)
    ==> AslStringDuplicate+0x98 (RVA: 0x71304)
    ==> 0x119ab8 (no symbol)
    ==> 0x119bab (no symbol)

 [[IN]] C:\Windows\System32\twinui.pcshell.dll
    ==> ?IsFeedsAllowedOnSKU@ShellFeedsAvailabilityHelpers@@YAJPEAE@Z+0x63c (RVA: 0x10ab28)
    ==> ?IsCortanaAllowedOnSKU@CortanaAvailability@@YAJPEAE@Z+0x645 (RVA: 0x26861d)

 [[IN]] C:\Windows\System32\ubpm.dll
    ==> UBPM_MIDL_user_free+0x5 (RVA: 0x4475)
    ==> UbpmFree+0xf (RVA: 0x754f)
    ==> 0x1d6c7 (no symbol)
    ==> 0x1db6e (no symbol)

 [[IN]] C:\Windows\System32\ucrtbase.dll
    ==> exit_or_terminate_process+0xd (RVA: 0x20585)
    ==> thread_start<unsigned int (__cdecl*)(void *),1>+0x57 (RVA: 0x21bc7)
    ==> thread_start<void (__cdecl*)(void *),0>+0x34 (RVA: 0x25104)
    ==> 0x56d40 (no symbol)
    ==> __acrt_can_show_message_box+0x2a (RVA: 0x6e546)
    ==> common_show_message_box<char>+0x4b (RVA: 0x7090b)
    ==> common_show_message_box<char>+0xbc (RVA: 0x7097c)
    ==> common_show_message_box<wchar_t>+0x4c (RVA: 0x70a5c)
    ==> common_show_message_box<wchar_t>+0xbd (RVA: 0x70acd)

 [[IN]] C:\Windows\System32\ucrtbase_clr0400.dll
    ==> RVA: .text+0x80b6d
    ==> RVA: .text+0x80bc1
    ==> RVA: .text+0x80c08
    ==> RVA: .text+0x80c51

 [[IN]] C:\Windows\System32\UIAutomationCore.dll
    ==> ?GetUiaNode@ProviderEntryPoint@@QEAAJPEAVUiaClientState@@PEAUHWND__@@PEAPEAVIUiaNode@@PEAUElementExtraInfo@@W4UiaNodeType@@UInProcProxyRequest@@JJ_N@Z+0xafa (RVA: 0x503ba)

 [[IN]] C:\Windows\System32\uireng.dll
    ==> AslFileOpen+0x44 (RVA: 0x25778)
    ==> AslPathGetLongFileNameLongpath+0xa9 (RVA: 0x25ae9)
    ==> AslPathIsTemporaryInternetFile+0x44 (RVA: 0x25db4)
    ==> AslPathIsTemporaryInternetFile+0x194 (RVA: 0x25f04)
    ==> AslPathIsTemporaryInternetFile+0x22e (RVA: 0x25f9e)
    ==> AslPathIsTemporaryInternetFile+0x34c (RVA: 0x260bc)
    ==> AslPathBuildSignatureForDirectoryFileLongpath+0x1c0 (RVA: 0x2640c)
    ==> AslPathBuildSignatureForInternetFileLongpath+0x1ed (RVA: 0x26715)
    ==> AslStringDuplicate+0xb5 (RVA: 0x26c09)

 [[IN]] C:\Windows\System32\umpdc.dll
    ==> PdcFree+0x0 (RVA: 0x5880)

 [[IN]] C:\Windows\System32\umpnpmgr.dll
    ==> ProcessAttach+0xc6 (RVA: 0x10d6)
    ==> ProcessDetach+0xb4 (RVA: 0x2a8c)

 [[IN]] C:\Windows\System32\umpo.dll
    ==> UmpoMain+0xed (RVA: 0x1208d)
    ==> UmpoMainStop+0x173 (RVA: 0x12777)

 [[IN]] C:\Windows\System32\umrdp.dll
    ==> ?ALLOCMEM@@YAPEAX_K@Z+0x6 (RVA: 0x10dee)

 [[IN]] C:\Windows\System32\unattend.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x24e66)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x24eb4)

 [[IN]] C:\Windows\System32\UNP\UNPUX.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x71626)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x716b4)

 [[IN]] C:\Windows\System32\UNP\UpdateNotificationHelpers.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x47756)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x477e4)

 [[IN]] C:\Windows\System32\UpdateAgent.dll
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x6577a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x67a7f)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x738f4)

 [[IN]] C:\Windows\System32\uReFS.dll
    ==> ?IsRefsFormatEnabled@@YAHXZ+0x669 (RVA: 0x192d)

 [[IN]] C:\Windows\System32\uReFSv1.dll
    ==> ??2@YAPEAX_K@Z+0x0 (RVA: 0x1008)
    ==> ?IsRefsFormatEnabled@@YAHXZ+0x669 (RVA: 0x17f1)

 [[IN]] C:\Windows\System32\urlmon.dll
    ==> CRegZone::Init+0x71c (RVA: 0x5edac)
    ==> ?UpdateZoneMapFlags@CRegZone@@QEAAHXZ+0x50 (RVA: 0x123d84)
    ==> _CreateSharedHandleACL+0x1a (RVA: 0x1292b6)

 [[IN]] C:\Windows\System32\user32.dll
    ==> _UserClientDllInitialize+0x6a (RVA: 0x18572)
    ==> _UserClientDllInitialize+0x1c8 (RVA: 0x186d0)
    ==> _UserClientDllInitialize+0x26d (RVA: 0x18775)
    ==> _UserClientDllInitialize+0x34a (RVA: 0x18852)
    ==> _UserClientDllInitialize+0x365 (RVA: 0x1886d)
    ==> _UserClientDllInitialize+0x3b2 (RVA: 0x188ba)
    ==> _UserClientDllInitialize+0x83b (RVA: 0x18d43)
    ==> _UserClientDllInitialize+0x84a (RVA: 0x18d52)
    ==> _UserClientDllInitialize+0x869 (RVA: 0x18d71)
    ==> _UserClientDllInitialize+0x8f7 (RVA: 0x18dff)
    ==> _UserClientDllInitialize+0x920 (RVA: 0x18e28)
    ==> _UserClientDllInitialize+0x932 (RVA: 0x18e3a)
    ==> _UserClientDllInitialize+0x945 (RVA: 0x18e4d)
    ==> InitProcessGdiScaling+0x1e6 (RVA: 0x19272)
    ==> InitProcessGdiScaling+0x203 (RVA: 0x1928f)
    ==> ?TryGetDwordIFEO@@YAHPEBGPEAK@Z+0x6 (RVA: 0x1948a)
    ==> ?GetWindowStationName@@YAXPEAG_KPEAU_UNICODE_STRING@@@Z+0xf (RVA: 0x1b663)
    ==> CommonCreateWindowStation+0x72 (RVA: 0x1d6aa)
    ==> CommonCreateWindowStation+0x91 (RVA: 0x1d6c9)
    ==> CtxInitUser32+0xe (RVA: 0x1d8ce)
    ==> RecordShutdownReason+0x46 (RVA: 0x338d6)
    ==> 0x411de (no symbol)
    ==> 0x4140b (no symbol)
    ==> 0x41648 (no symbol)
    ==> 0x41658 (no symbol)
    ==> 0x4186e (no symbol)
    ==> 0x4187e (no symbol)
    ==> 0x41dba (no symbol)
    ==> 0x41dd9 (no symbol)
    ==> DisplayExitWindowsWarnings+0x4b (RVA: 0x56b4b)
    ==> DisplayExitWindowsWarnings+0x6c (RVA: 0x56b6c)
    ==> ?ServiceMessageBox@@YAHPEBG0IK@Z+0xcd (RVA: 0x7858d)

 [[IN]] C:\Windows\System32\usercpl.dll
    ==> ?s_DoesSKUSupportEFS@CUserCplCore@@CA_NXZ+0x66a (RVA: 0x1a63e)
    ==> ?_BitLockerEnabledOnSystemVolume@CBitLockerInfoPage@@AEAA_NXZ+0x670 (RVA: 0x43970)
    ==> ?_IsPremiumSKU@CBitLockerInfoPage@@AEAA_NXZ+0x669 (RVA: 0x4d3d5)

 [[IN]] C:\Windows\System32\userinitext.dll
    ==> CreateExplorerSessionKey+0x24 (RVA: 0x2b84)

 [[IN]] C:\Windows\System32\usermgr.dll
    ==> ?Initialize@UserMgrSvcTraceLog@@QEAAXXZ+0x32 (RVA: 0x2b33a)
    ==> ?CdplIsSupportedInl@@YAJPEAH@Z+0x6ba (RVA: 0x30c66)

 [[IN]] C:\Windows\System32\utcutil.dll
    ==> ?GetLocalUserIDAlloc@CommonAttributes@@UEAAJPEAPEA_W@Z+0x2e (RVA: 0x5c4e)

 [[IN]] C:\Windows\System32\uwfcsp.dll
    ==> `anonymous namespace'::isFeatureEnabled+0x663 (RVA: 0xe8bb)

 [[IN]] C:\Windows\System32\UXInit.dll
    ==> CThemeServerClient::WatchForStart+0x58 (RVA: 0x1c18)
    ==> ?SessionDestroy@CThemeServerClient@@SAJXZ+0xb1 (RVA: 0x2481)
    ==> ?CreateNamedSection@CThemeServerClient@@SAJXZ+0x1b (RVA: 0x2593)
    ==> CDataSection::Create+0x2e (RVA: 0x267e)
    ==> CThemeServicesInit::ReuseVisualStyle+0x9e (RVA: 0x404e)
    ==> CUxThemeFile::GetGlobalTheme+0x38 (RVA: 0x4d78)

 [[IN]] C:\Windows\System32\uxtheme.dll
    ==> ?GetGlobalTheme@CUxThemeFile@@SAJPEAPEAX0@Z+0x48 (RVA: 0xb560)
    ==> IsThemeActive+0x11a (RVA: 0x21f8a)
    ==> ?IsSystemThemeActive@CAppInfo@@QEAAHXZ+0x89 (RVA: 0x220ed)
    ==> CThemeServices::SetGlobalTheme+0x49 (RVA: 0x261e9)
    ==> 0x2e7f4 (no symbol)
    ==> ?Create@CDataSection@@QEAAJW4ThemeDataNamespace@@HK@Z+0x28 (RVA: 0x51460)

 [[IN]] C:\Windows\System32\VaultRoaming.dll
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x14920)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x14950)

 [[IN]] C:\Windows\System32\vaultsvc.dll
    ==> ?_Reallocate_exactly@?$vector@V?$_List_unchecked_const_iterator@V?$_List_val@U?$_List_simple_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@U_Iterator_base0@2@@std@@V?$allocator@V?$_List_unchecked_const_iterator@V?$_List_val@U?$_List_simple_types@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@U_Iterator_base0@2@@std@@@2@@std@@AEAAX_K@Z+0x77 (RVA: 0xe937)
    ==> ??$_Allocate_manually_vector_aligned@U_Default_allocate_traits@std@@@std@@YAPEAX_K@Z+0x1f (RVA: 0x2136b)

 [[IN]] C:\Windows\System32\vbsapi.dll
    ==> SdbpCreateSearchDBContext+0x5b (RVA: 0x545b)
    ==> SdbpCreateSearchDBContext+0x10f (RVA: 0x550f)
    ==> SdbpCreateSearchDBContext+0x208 (RVA: 0x5608)
    ==> SdbpCreateSearchDBContext+0x235 (RVA: 0x5635)
    ==> SdbpInitializeSearchDBContext+0x99 (RVA: 0x5755)
    ==> SdbpResolveMatchingFile+0x18b (RVA: 0x5ca7)
    ==> SdbpCheckMatchingRegistryValue+0xce (RVA: 0x6286)
    ==> SdbpCheckMatchingRegistryValue+0x1c8 (RVA: 0x6380)
    ==> SdbpCheckMatchingRegistryValue+0x29a (RVA: 0x6452)
    ==> SdbpCheckMatchingWildcardRegistryEntry+0x31 (RVA: 0x659d)
    ==> SdbpGetMatchingTextAttributes+0xeb (RVA: 0x6c27)
    ==> SdbpCheckMatchingTextEntry+0x233 (RVA: 0x6fc3)
    ==> SdbQueryDataExTagID+0x69 (RVA: 0x920d)
    ==> SdbInitDatabaseEx+0x79 (RVA: 0x9ca1)
    ==> SdbReleaseDatabase+0xde (RVA: 0xa2da)
    ==> SdbOpenDatabaseEx+0x4b (RVA: 0xa557)
    ==> SdbpOpenDatabaseInMemory+0x14 (RVA: 0xa758)
    ==> SdbpCreateSearchPathPartsFromPath+0x83 (RVA: 0xabe3)
    ==> SdbpGetProcessHistory+0x8b (RVA: 0xae8f)
    ==> SdbpCheckAllAttributes+0x61 (RVA: 0xc23d)
    ==> SdbResolveDatabaseEx+0x169 (RVA: 0xe0b5)
    ==> SdbpOpenCompressedDatabase+0xbe (RVA: 0xe3be)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0xe99e)
    ==> AslRegistryBuildUserPath+0x94 (RVA: 0xeae4)
    ==> AslFileMappingCreate+0x5e (RVA: 0xed1a)
    ==> AslPathWildcardFindFirst+0xed (RVA: 0x104cd)
    ==> AslPathWildcardFindFirst+0x1d8 (RVA: 0x105b8)
    ==> AslPathWildcardFindFirst+0x24e (RVA: 0x1062e)
    ==> AslPathWildcardFindNext+0x87 (RVA: 0x109db)
    ==> AslpPathWildcardAllocMatchNode+0x90 (RVA: 0x11460)
    ==> AslpAllocMatchNode+0xf (RVA: 0x1183f)
    ==> AslpProcessMatchRegNode+0xb4 (RVA: 0x11a34)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x12696)
    ==> AslGuidToString_UStr+0x29 (RVA: 0x12ea1)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x1314c)
    ==> AslStringDuplicate+0xb5 (RVA: 0x132e1)
    ==> AslStringUpcaseToMultiByteN+0x57 (RVA: 0x1348f)
    ==> AslpFileGetVersionBlock+0x464 (RVA: 0x14768)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x150ae)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x17b6c)

 [[IN]] C:\Windows\System32\verifier.dll
    ==> VerifierSetFaultInjectionProbability+0xa (RVA: 0x1aea)
    ==> VerifierEnableFaultInjectionTargetRange+0xf (RVA: 0x1b7f)
    ==> VerifierDisableFaultInjectionTargetRange+0x14 (RVA: 0x1c74)
    ==> VerifierEnableFaultInjectionExclusionRange+0xf (RVA: 0x1d4f)
    ==> VerifierDisableFaultInjectionExclusionRange+0x14 (RVA: 0x1e14)
    ==> AVrfDebugPageHeapDestroy+0x18 (RVA: 0x3e58)
    ==> VerifierGetProviderImageName+0x37 (RVA: 0x5fdf)
    ==> VerifierCaptureContextAndReportStop+0xd5 (RVA: 0x66e9)
    ==> VerifierStopMessageEx+0x611 (RVA: 0x7121)
    ==> VerifierEnumerateResource+0xa3 (RVA: 0xa293)
    ==> VerifierEnumerateResource+0xbb (RVA: 0xa2ab)
    ==> VerifierSetRuntimeFlags+0x0 (RVA: 0xa320)
    ==> VerifierQueryRuntimeFlags+0x0 (RVA: 0xa360)
    ==> VerifierCreateRpcPageHeap+0x0 (RVA: 0xa3c0)
    ==> VerifierDestroyRpcPageHeap+0x0 (RVA: 0xa400)
    ==> VerifierIsDllEntryActive+0x4 (RVA: 0xa444)
    ==> VerifierIsCurrentThreadHoldingLocks+0x4 (RVA: 0xa484)
    ==> VerifierAddFreeMemoryCallback+0x4 (RVA: 0xa4c4)
    ==> VerifierDeleteFreeMemoryCallback+0x0 (RVA: 0xa540)
    ==> ?AVrfpSuspendEnumerateAllocations@@YAJPEAXKP6AKPEAU_AVRF_HEAP_ALLOCATION@@0PEAK@Z0@Z+0x24b (RVA: 0xf24f)
    ==> ?AVrfpSuspendEnumerateAllocations@@YAJPEAXKP6AKPEAU_AVRF_HEAP_ALLOCATION@@0PEAK@Z0@Z+0x271 (RVA: 0xf275)
    ==> AVrfpVectoredExceptionHandler+0x28f (RVA: 0xfcff)
    ==> AVrfInitializeHeapWalk+0xe0 (RVA: 0x10ee4)
    ==> AVrfInitializeHeapWalk+0x104 (RVA: 0x10f08)
    ==> AVrfpVerifyInitializedCriticalSection+0x48 (RVA: 0x11f04)
    ==> AVrfpRtlTryEnterCriticalSection1+0x7f (RVA: 0x122af)
    ==> AVrfpRtlTryEnterCriticalSection1+0xc7 (RVA: 0x122f7)
    ==> AVrfpRtlEnterCriticalSection1+0x101 (RVA: 0x124e5)
    ==> AVrfpRtlEnterCriticalSection1+0x14d (RVA: 0x12531)
    ==> AVrfCheckForOrphanedCriticalSections+0x2f (RVA: 0x133b7)
    ==> AVrfpCheckDllLeaks+0xce (RVA: 0x153d2)
    ==> AVrfpCheckDllLeaks+0x259 (RVA: 0x1555d)
    ==> AVrfpInitializeThreadPoolCheck+0x6 (RVA: 0x18cbe)
    ==> AVrfpCallbackPrologCheck+0x214 (RVA: 0x194d8)
    ==> AVrfpCallbackEpilogCheck+0x375 (RVA: 0x198e1)
    ==> AVrfpHandleSelfhostSupport+0x16 (RVA: 0x1bcba)
    ==> AVrfpSetHeapPathStackTrace+0x4 (RVA: 0x1eed4)

 [[IN]] C:\Windows\System32\vertdll.dll
    ==> GetProcessHeap+0x0 (RVA: 0x1800)
    ==> GetModuleHandleExW+0x4a (RVA: 0x1e0a)
    ==> GetProcAddress+0x5d (RVA: 0x1edd)
    ==> GetProcAddress+0x79 (RVA: 0x1ef9)
    ==> GetProcAddress+0xa2 (RVA: 0x1f22)
    ==> VertResolveDelayLoadedAPI+0x1c (RVA: 0x3dac)
    ==> VertInitializeLdr+0xbc (RVA: 0x502c)
    ==> VertInitializeLdr+0xd0 (RVA: 0x5040)
    ==> LdrDisableThreadCalloutsForDll+0x0 (RVA: 0x5730)
    ==> VertpInitializeHeapSupport+0x6 (RVA: 0x57b2)
    ==> VertpInitializeHeapSupport+0xb1 (RVA: 0x585d)
    ==> RtlpEnterCriticalSectionContended+0x55 (RVA: 0x7a25)
    ==> RtlpEnterCriticalSectionContended+0x2b6 (RVA: 0x7c86)
    ==> RtlLeaveCriticalSection+0x14a (RVA: 0x7e3a)
    ==> RtlInitializeCriticalSection+0x1b (RVA: 0x7eab)
    ==> RtlInitializeCriticalSectionEx+0x44 (RVA: 0x7f24)
    ==> RtlRaiseException+0x30 (RVA: 0x8f40)
    ==> RtlRaiseException+0x15d (RVA: 0x906d)
    ==> RtlpTimeFieldsToTime+0x19 (RVA: 0x9175)
    ==> RtlpTimeFieldsToTime+0x46 (RVA: 0x91a2)
    ==> RtlUnhandledExceptionFilter2+0x17 (RVA: 0x9553)
    ==> RtlUnhandledExceptionFilter2+0x40 (RVA: 0x957c)
    ==> RtlCreateHeap+0x3c (RVA: 0xb00c)
    ==> RtlCreateHeap+0x15b (RVA: 0xb12b)
    ==> RtlDestroyHeap+0x5e (RVA: 0xb93a)
    ==> RtlpInitializeHeapSegment+0x1c (RVA: 0xce30)
    ==> vDbgPrintExWithPrefixInternal+0x15e (RVA: 0x13182)
    ==> vDbgPrintExWithPrefixInternal+0x16d (RVA: 0x13191)
    ==> RtlReportCriticalFailure+0x19 (RVA: 0x13f59)
    ==> RtlRaiseNoncontinuableException+0x41 (RVA: 0x1b501)

 [[IN]] C:\Windows\System32\vfbasics.dll
    ==> VerifierAddFreeMemoryCallback+0x0 (RVA: 0x2600)
    ==> VerifierCreateRpcPageHeap+0x0 (RVA: 0x2630)
    ==> VerifierDeleteFreeMemoryCallback+0x0 (RVA: 0x2670)
    ==> VerifierDestroyRpcPageHeap+0x0 (RVA: 0x26a0)
    ==> VerifierIsCurrentThreadHoldingLocks+0x4 (RVA: 0x26e4)
    ==> VerifierIsDllEntryActive+0x4 (RVA: 0x2724)
    ==> VerifierQueryRuntimeFlags+0x0 (RVA: 0x2760)
    ==> VerifierSetRuntimeFlags+0x0 (RVA: 0x27c0)
    ==> VfEnableStackVerifier+0xd (RVA: 0x2ab9)
    ==> VfEnableStackVerifier+0x1c (RVA: 0x2ac8)
    ==> AVrfCheckForOrphanedCriticalSections+0x3d (RVA: 0x5399)
    ==> AVrfpRtlEnterCriticalSection1+0xfb (RVA: 0x679b)
    ==> AVrfpRtlEnterCriticalSection1+0x14e (RVA: 0x67ee)
    ==> AVrfpRtlTryEnterCriticalSection1+0x7f (RVA: 0x6dbf)
    ==> AVrfpRtlTryEnterCriticalSection1+0xce (RVA: 0x6e0e)
    ==> AVrfpVerifyInitializedCriticalSection+0x48 (RVA: 0x718c)
    ==> AVrfpGetDllImageName+0x37 (RVA: 0x8313)
    ==> AVrfpCheckDllLeaks+0xd1 (RVA: 0x94ad)
    ==> AVrfpLeakIsDllAnApplication+0x28 (RVA: 0x9948)
    ==> AVrfpLeakIsDllAnApplication+0x81 (RVA: 0x99a1)
    ==> AVrfpCallbackEpilogCheck+0x386 (RVA: 0xd8c6)
    ==> AVrfpCallbackPrologCheck+0x1ac (RVA: 0xdb4c)
    ==> AVrfpInitializeThreadPoolCheck+0xe (RVA: 0xe3fe)
    ==> AVrfpTpCheckLdrLockHeld+0x0 (RVA: 0xffb4)
    ==> AVrfpSetHeapPathStackTrace+0x6 (RVA: 0x15142)

 [[IN]] C:\Windows\System32\vfcompat.dll
    ==> DllMain+0x23 (RVA: 0x65df)

 [[IN]] C:\Windows\System32\vfcuzz.dll
    ==> NativeIsThreadHoldingLoaderLock+0x87 (RVA: 0x3897)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x4c (RVA: 0x3b58)

 [[IN]] C:\Windows\System32\vfluapriv.dll
    ==> DllMain+0x27 (RVA: 0x24013)

 [[IN]] C:\Windows\System32\vfnet.dll
    ==> ??1?$CResourceUsageMgr@_KUNoExemptionPolicy@ResourceSDK@@UNetAllocatorViaPrivateHeap@@UFreeThreadedResourceUsagePolicy@2@V?$ResourceMisusageReportPolicy_VerifierStop_t@UTDumpKeyForVerifierStopAsULONGPTR@ResourceSDK@@@2@VResource@?$NetResourceMgr@_K$0OBAB@$0OBAC@$0A@$0OBAD@$0A@@@VDictionary@7@@ResourceSDK@@UEAA@XZ+0x34 (RVA: 0x14ac)
    ==> ??1?$CResourceUsageMgr@_KUNoExemptionPolicy@ResourceSDK@@UNetAllocatorViaPrivateHeap@@UFreeThreadedResourceUsagePolicy@2@V?$ResourceMisusageReportPolicy_VerifierStop_t@UTDumpKeyForVerifierStopAsULONGPTR@ResourceSDK@@@2@VResource@?$NetResourceMgr@_K$0OBAB@$0OBAC@$0A@$0OBAD@$0A@@@VDictionary@7@@ResourceSDK@@UEAA@XZ+0x74 (RVA: 0x14ec)
    ==> ??_E?$CResourceUsageMgr@_KUNoExemptionPolicy@ResourceSDK@@UNetAllocatorViaPrivateHeap@@UFreeThreadedResourceUsagePolicy@2@V?$ResourceMisusageReportPolicy_VerifierStop_t@UTDumpKeyForVerifierStopAsULONGPTR@ResourceSDK@@@2@VResource@?$NetResourceMgr@_K$0OBAE@$0OBAF@$0A@$0OBAG@$0A@@@VDictionary@7@@ResourceSDK@@UEAAPEAXI@Z+0x25 (RVA: 0x1565)
    ==> ??_E?$CItemBase@_KUNetAllocatorViaPrivateHeap@@@ResourceSDK@@MEAAPEAXI@Z+0x24 (RVA: 0x15c4)
    ==> ??_GNetTrackStartup@@UEAAPEAXI@Z+0x3a (RVA: 0x163a)
    ==> ?Initialize@?$NetResourceMgr@_K$0OBAB@$0OBAC@$0A@$0OBAD@$0A@@@QEAAHXZ+0x3f (RVA: 0x1b2f)
    ==> ?Initialize@?$NetResourceMgr@_K$0OBAB@$0OBAC@$0A@$0OBAD@$0A@@@QEAAHXZ+0x89 (RVA: 0x1b79)
    ==> ?Initialize@?$NetResourceMgr@_K$0OBAE@$0OBAF@$0A@$0OBAG@$0A@@@QEAAHXZ+0x3f (RVA: 0x1c67)
    ==> ?Initialize@?$NetResourceMgr@_K$0OBAE@$0OBAF@$0A@$0OBAG@$0A@@@QEAAHXZ+0x89 (RVA: 0x1cb1)
    ==> ?InitializeNetVerifier@@YAHXZ+0x172 (RVA: 0x1ed2)
    ==> ?InitializeNetVerifier@@YAHXZ+0x211 (RVA: 0x1f71)
    ==> ?InitializeNetVerifier@@YAHXZ+0x2a0 (RVA: 0x2000)
    ==> ?InitializeNetVerifier@@YAHXZ+0x2fc (RVA: 0x205c)
    ==> ?InitializeNetVerifier@@YAHXZ+0x363 (RVA: 0x20c3)
    ==> ?InitializeNetVerifier@@YAHXZ+0x3b9 (RVA: 0x2119)
    ==> ?InitializeNetVerifier@@YAHXZ+0x465 (RVA: 0x21c5)
    ==> ?InitializeNetVerifier@@YAHXZ+0x50c (RVA: 0x226c)
    ==> ?InitializeNetVerifier@@YAHXZ+0x601 (RVA: 0x2361)
    ==> ?InitializeNetVerifier@@YAHXZ+0x647 (RVA: 0x23a7)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x4a (RVA: 0x2c26)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0xfd (RVA: 0x2cd9)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x11f (RVA: 0x2cfb)
    ==> ?addNewListEntry@?$NetStackTraceList@$0GE@@@AEAAHPEAPEAUStackTraceEntry@1@0@Z+0x76 (RVA: 0x706e)
    ==> ?addNewListEntry@?$NetStackTraceList@$0GE@@@AEAAHPEAPEAUStackTraceEntry@1@0@Z+0x107 (RVA: 0x70ff)
    ==> ??_G?$CItemTracker@_KUNoExemptionPolicy@ResourceSDK@@UNetAllocatorViaPrivateHeap@@UFreeThreadedResourceUsagePolicy@2@V?$CListItemBase@_KUNetAllocatorViaPrivateHeap@@@2@@ResourceSDK@@MEAAPEAXI@Z+0x25 (RVA: 0xd2c5)
    ==> ?NetAddWSASocket@@YA_K_K@Z+0x23 (RVA: 0xd3af)
    ==> ?NetAddWSPSocket@@YA_K_KPEAH@Z+0x2b (RVA: 0xd4fb)

 [[IN]] C:\Windows\System32\vfntlmless.dll
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x34 (RVA: 0x12e0)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x5c (RVA: 0x1308)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x6e (RVA: 0x131a)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x80 (RVA: 0x132c)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleA@@YAJPEAD0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0xf5 (RVA: 0x1685)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleA@@YAJPEAD0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0x107 (RVA: 0x1697)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleA@@YAJPEAD0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0x11d (RVA: 0x16ad)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleW@@YAJPEAG0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0xf2 (RVA: 0x1952)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleW@@YAJPEAG0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0x104 (RVA: 0x1964)
    ==> ?VfHook_SECUR32_AcquireCredentialsHandleW@@YAJPEAG0KPEAX1P6AX11KPEAPEAXPEAJ@Z1PEAU_SecHandle@@PEAT_LARGE_INTEGER@@@Z+0x11a (RVA: 0x197a)

 [[IN]] C:\Windows\System32\vfnws.dll
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x2a (RVA: 0x12e6)

 [[IN]] C:\Windows\System32\vfprint.dll
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x24 (RVA: 0x2ac0)

 [[IN]] C:\Windows\System32\vfrdvcompat.dll
    ==> ??3@YAXPEAX@Z+0x0 (RVA: 0xc8a8)
    ==> DllMain+0x23 (RVA: 0xfeef)

 [[IN]] C:\Windows\System32\vmiccore.dll
    ==> ?GetSystemTimePreciseAsFileTimeUTC@@YAXPEAU_FILETIME@@0@Z+0x1f (RVA: 0x1e5c3)

 [[IN]] C:\Windows\System32\vrfcore.dll
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0xc2 (RVA: 0x1bf6)
    ==> ?_DllMain@@YAHPEAUHINSTANCE__@@KPEAX@Z+0x222 (RVA: 0x1d56)
    ==> VerifierIsDllEntryActive+0x4 (RVA: 0x30d4)
    ==> ?VfCoreAlloc@@YAPEAX_K@Z+0x0 (RVA: 0x43c4)
    ==> ?VfCoreFree@@YAXPEAX@Z+0x0 (RVA: 0x47b0)
    ==> ?VfCoreGetImageName@@YAPEAGXZ+0x2f (RVA: 0x4803)
    ==> ?VfCoreGetProviderImageName@@YAJPEAUHINSTANCE__@@PEAPEAG@Z+0x37 (RVA: 0x4877)
    ==> ?VfCoreModuleInfo@@YAJPEAPEAXPEAKPEAG@Z+0x24 (RVA: 0x54ac)
    ==> ?ViCoreCreateLoggingFile@@YAJPEAG0_KPEAU_UNICODE_STRING@@@Z+0x36 (RVA: 0x684e)
    ==> ?ViCoreGetProcessImageName@@YAPEAGXZ+0x0 (RVA: 0x69c8)
    ==> ??1?$OnDelete@PEAXP6AXPEAX@Z$1?VfCoreFree@@YAX0@Z@@QEAA@XZ+0x0 (RVA: 0x6a54)
    ==> ?VfCoreRedirectOldStopFunctions@@YAXXZ+0xff (RVA: 0x976f)
    ==> ?VfCoreRedirectOldStopFunctions@@YAXXZ+0x116 (RVA: 0x9786)
    ==> ?VfCoreRedirectedStopMessage@@YAX_KPEAD01010101@Z+0xb6 (RVA: 0x9a06)
    ==> ?VfCoreDllLoadCallback@@YAXPEAGPEAX_K1@Z+0x3f (RVA: 0xb14f)
    ==> VerifierDisableFaultInjectionExclusionRange+0x14 (RVA: 0xca94)
    ==> VerifierDisableFaultInjectionTargetRange+0x14 (RVA: 0xcb94)
    ==> VerifierEnableFaultInjectionExclusionRange+0x19 (RVA: 0xcc99)
    ==> VerifierEnableFaultInjectionTargetRange+0x19 (RVA: 0xcdc9)
    ==> VerifierResetFaultInjectionAddressRanges+0x6 (RVA: 0xcf86)
    ==> VerifierSetAPIClassName+0xa (RVA: 0xd09a)
    ==> VerifierSetFaultInjectionProbability+0xa (RVA: 0xd13a)

 [[IN]] C:\Windows\System32\vscover170.dll
    ==> RVA: .text+0xe832
    ==> RVA: .text+0x13510

 [[IN]] C:\Windows\System32\VsGraphicsHelper.dll
    ==> RVA: .text+0xdf8e6
    ==> RVA: .text+0xe3fd0

 [[IN]] C:\Windows\System32\VSPerf170.dll
    ==> RVA: .text+0x19f8e
    ==> RVA: .text+0x1dfc0

 [[IN]] C:\Windows\System32\w32time.dll
    ==> ?GetLSStatusFromKernel@@YAJPEAHPEAPEAU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@PEAK@Z+0x2c (RVA: 0x45840)
    ==> ?GetLeapSecondCompiledStatusFromKernel@@YAJPEAUKernelLSCompiledInfo@@PEAUKernelLSSnapshot@@@Z+0x45 (RVA: 0x4598d)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0x47f10)
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0x47f40)

 [[IN]] C:\Windows\System32\WaaSMedicSvc.dll
    ==> ?LaunchRemediation@WaaSRemediationAgent@@UEAAJPEBDPEBG@Z+0x683 (RVA: 0x26e13)

 [[IN]] C:\Windows\System32\wbem\appbackgroundtask.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x436c)

 [[IN]] C:\Windows\System32\wbem\Microsoft.Uev.AgentWmi.dll
    ==> ?ReadLicenseValue@productionSlapiProxy@SlapiWrapper@Shared@AppMan@@UEAAJPEB_WPEAK@Z+0x671 (RVA: 0x638c1)

 [[IN]] C:\Windows\System32\wbem\NetPeerDistCim.dll
    ==> ?IsLicenseEnabled@@YA_NPEBG@Z+0x6ad (RVA: 0x19329)

 [[IN]] C:\Windows\System32\wbem\wfascim.dll
    ==> FwmiValidateDospOperation+0x9a3 (RVA: 0x3d403)

 [[IN]] C:\Windows\System32\wbem\Win32_EncryptableVolume.dll
    ==> 0x131d6 (no symbol)

 [[IN]] C:\Windows\System32\wbiosrvc.dll
    ==> ?Start@BioTrustlet@@QEAAJ_N@Z+0x28d (RVA: 0x8d985)

 [[IN]] C:\Windows\System32\wdigest.dll
    ==> _InitDebugTracingEx+0xf (RVA: 0x51bf)
    ==> ?TelemetryAllocate@SspTelemetry@@YAPEAX_K@Z+0x0 (RVA: 0x1096c)
    ==> ?TelemetryFree@SspTelemetry@@YAXPEAX@Z+0x0 (RVA: 0x10994)
    ==> _DeleteDebugTracing+0x14 (RVA: 0x38c04)

 [[IN]] C:\Windows\System32\webservices.dll
    ==> ServiceProxy::Close+0x91 (RVA: 0x39f1)
    ==> ServiceProxy::Close+0xf5 (RVA: 0x3a55)
    ==> Heap::Create+0xf2 (RVA: 0x31862)
    ==> 0x4f99a (no symbol)
    ==> 0x4fa7a (no symbol)
    ==> ?ReportFatalException@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@@K@Z+0x5d (RVA: 0x523f9)
    ==> ?VerifyListenerApiAvailability@AppContainer@@SAJPEAVError@@@Z+0x667 (RVA: 0x8016b)

 [[IN]] C:\Windows\System32\Websocket.dll
    ==> ?ReportFatalException@@YAX_KKW4FATAL_FAILURE_REASON_TYPE@@K@Z+0x4b (RVA: 0x28f3)

 [[IN]] C:\Windows\System32\wimgapi.dll
    ==> ?XmlAlloc@CXmlCursor@@KAJ_KPEAPEAXPEAX@Z+0x6 (RVA: 0x8bf06)
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x8bf94)

 [[IN]] C:\Windows\System32\win32appinventorycsp.dll
    ==> ??0AslLogGlobalLogger@@QEAA@PEBDI@Z+0x6e (RVA: 0x117fa)
    ==> AslRegistryGetString+0xb4 (RVA: 0x12858)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x12a36)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x12af2)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x12c62)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x13fcf)
    ==> AslTelemetryFlush+0x40 (RVA: 0x147dc)
    ==> AslTelemetryFlush+0x6d (RVA: 0x14809)
    ==> AslTelemetryFlush+0x9a (RVA: 0x14836)
    ==> AslTelemetryFlush+0xbd (RVA: 0x14859)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x1487c)
    ==> AslTelemetryFlush+0x103 (RVA: 0x1489f)
    ==> AslTelemetryFlush+0x123 (RVA: 0x148bf)
    ==> AslTelemetryFlush+0x142 (RVA: 0x148de)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x14943)
    ==> AslpTelemetryProcessError+0xbe (RVA: 0x15502)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x15610)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x15661)
    ==> AslLogCreate+0x3b (RVA: 0x15b8f)
    ==> AslLogCreate+0x7c (RVA: 0x15bd0)
    ==> AslLogCreate+0xa6 (RVA: 0x15bfa)
    ==> AslStringDuplicateA+0x91 (RVA: 0x16871)
    ==> AslStringDuplicate+0xb5 (RVA: 0x16a79)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x16bd0)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x17226)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x176ad)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x18259)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x18767)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x18dd5)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x18e09)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x190d6)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x192f9)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x1933a)

 [[IN]] C:\Windows\System32\Win32CompatibilityAppraiserCSP.dll
    ==> ??0AslLogGlobalLogger@@QEAA@PEBDI@Z+0x55 (RVA: 0x96e1)
    ==> ?Initialize@PiiFilter@@QEAAJXZ+0xf (RVA: 0x173e3)
    ==> AslTelemetryFlush+0x40 (RVA: 0x17b14)
    ==> AslTelemetryFlush+0x6d (RVA: 0x17b41)
    ==> AslTelemetryFlush+0x9a (RVA: 0x17b6e)
    ==> AslTelemetryFlush+0xbd (RVA: 0x17b91)
    ==> AslTelemetryFlush+0xe0 (RVA: 0x17bb4)
    ==> AslTelemetryFlush+0x103 (RVA: 0x17bd7)
    ==> AslTelemetryFlush+0x123 (RVA: 0x17bf7)
    ==> AslTelemetryFlush+0x142 (RVA: 0x17c16)
    ==> AslTelemetryFlush+0x1a7 (RVA: 0x17c7b)
    ==> AslpTelemetryProcessError+0xca (RVA: 0x1888a)
    ==> AslTelemetryTrackError+0x48 (RVA: 0x1899c)
    ==> AslTelemetryTrackError+0x99 (RVA: 0x189ed)
    ==> AslRegistryGetString+0xb4 (RVA: 0x19188)
    ==> AslRegistryGetStringExpand+0xa6 (RVA: 0x19366)
    ==> AslRegistryGetStringExpand+0x162 (RVA: 0x19422)
    ==> AslRegistryBuildMachinePath+0x66 (RVA: 0x19592)
    ==> AslLogCreate+0x36 (RVA: 0x1a60a)
    ==> AslLogCreate+0x77 (RVA: 0x1a64b)
    ==> AslLogCreate+0xa1 (RVA: 0x1a675)
    ==> AslStringAnsiToUnicode+0x80 (RVA: 0x1b120)
    ==> AslStringDuplicateA+0x91 (RVA: 0x1b291)
    ==> AslStringDuplicate+0xb5 (RVA: 0x1b499)
    ==> AslAnsiStringDuplicate+0x58 (RVA: 0x1b5f0)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x29 (RVA: 0x1bbc9)
    ==> ?PiiFilterpAddProfiles@@YAJPEAU_PII_FILTER@@@Z+0x5d (RVA: 0x1bbfd)
    ==> ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z+0x3e (RVA: 0x1beca)
    ==> PiiFilterEmbeddedPathsExecute+0x69 (RVA: 0x1c195)
    ==> PiiFilterEmbeddedPathsExecute+0xaa (RVA: 0x1c1d6)
    ==> AslEnvExpandStrings2+0xce (RVA: 0x1cda6)
    ==> AslEnvBuildBasic+0x31 (RVA: 0x1d22d)
    ==> AslEnvBuildBasic+0xbdd (RVA: 0x1ddd9)
    ==> AslEnvBuildBasic+0x10eb (RVA: 0x1e2e7)
    ==> AslFileMappingCreate+0x55 (RVA: 0x1e651)
    ==> AslpFileGetVersionBlock+0x46b (RVA: 0x1fe87)
    ==> AslpFileGetVersionBlockImageOnly+0x1e6 (RVA: 0x207ce)
    ==> AslpFileLargeMapCreate+0x28 (RVA: 0x23294)
    ==> ?WriteLogV@Appraiser@Compat@Windows@@YAX_NKPEBD1J1PEAD@Z+0x27d (RVA: 0x264ad)
    ==> ?ReadJsonNumber@JsonReader@@QEAAJPEAN@Z+0x1b (RVA: 0x2c9af)

 [[IN]] C:\Windows\System32\win32spl.dll
    ==> ALLOCMEM+0x6 (RVA: 0xccfde)

 [[IN]] C:\Windows\System32\WinBioPlugIns\FaceDriver\amd64\FaceRecognitionEngineAdapter.dll
    ==> RVA: .text+0x66cff
    ==> RVA: .text+0x7302a
    ==> RVA: .text+0x73080
    ==> RVA: .text+0x83e20
    ==> RVA: .text+0xa5457
    ==> RVA: .text+0xa5514
    ==> RVA: .text+0xa561a
    ==> RVA: .text+0xaee6c
    ==> RVA: .text+0xd9cef
    ==> RVA: .text+0xdf2ad
    ==> RVA: .text+0xf6baf
    ==> RVA: .text+0xf6c95
    ==> RVA: .text+0x101bab

 [[IN]] C:\Windows\System32\Windows.Devices.Background.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0xec30)

 [[IN]] C:\Windows\System32\Windows.Devices.Custom.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0xc558)

 [[IN]] C:\Windows\System32\Windows.Devices.Lights.dll
    ==> ?WorkerThreadProc@LampArrayDeviceManager@@AEAAJXZ+0x41 (RVA: 0x2c235)
    ==> ??0AlpcPortString@@QEAA@AEBU_GUID@@W4SIPC_SERVICE_BOUNDARY@@@Z+0x5e (RVA: 0x345ba)

 [[IN]] C:\Windows\System32\Windows.FileExplorer.Common.dll
    ==> _CreateSharedHandleACL+0x15 (RVA: 0x37d2d)

 [[IN]] C:\Windows\System32\Windows.Globalization.dll
    ==> Windows::Data::Text::GetDgmlRootName+0x672 (RVA: 0xa3d72)
    ==> Windows::Data::Text::IsLangResourcesInstalled+0x640 (RVA: 0xba7cc)
    ==> Windows::Data::Text::ResolveLanguageForTextSuggestionApi+0x69d (RVA: 0xc622d)

 [[IN]] C:\Windows\System32\windows.immersiveshell.serviceprovider.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6e (RVA: 0x523b2)
    ==> ?GetStorePolicy@Policy@CreativeFramework@@YA?AW4StorePolicy@12@XZ+0x667 (RVA: 0x72aaf)
    ==> ?IsContentDeliveryPolicyEnforced@Policy@CreativeFramework@@YA_NXZ+0x633 (RVA: 0x7dd43)

 [[IN]] C:\Windows\System32\Windows.Internal.Management.dll
    ==> ?EnrollAsync@ReflectedEnroller@Enrollment@EnterpriseDeviceManagement@@UEAAJPEAUHSTRING__@@00W4ReflectedMDMAuthPolicy@23@0000K0PEAPEAU?$IAsyncOperation@PEAVReflectedEnrollmentResult@Enrollment@EnterpriseDeviceManagement@@@Foundation@Windows@@@Z+0xa33 (RVA: 0x42d63)
    ==> ?EnrollmentLicenseCheck@@YAJW4EnrollmentEnrollType@@@Z+0x6a2 (RVA: 0x7583a)

 [[IN]] C:\Windows\System32\Windows.Internal.Shell.Broker.dll
    ==> ?IsSLSAllowMultipleSessionsSet@@YAHXZ+0x61f (RVA: 0x581eb)

 [[IN]] C:\Windows\System32\Windows.Internal.ShellCommon.Broker.dll
    ==> ?GetContentDeliverySkuPolicy@Policy@CreativeFramework@@YA?AW4ContentDeliverySkuPolicy@?A0x3f5dd371@@XZ+0x66d (RVA: 0x8ba5)

 [[IN]] C:\Windows\System32\Windows.Management.InprocObjects.dll
    ==> ?IsAadjSupported@Autopilot@Windows@Microsoft@@YA_NXZ+0x653 (RVA: 0x26e0f)

 [[IN]] C:\Windows\System32\Windows.Media.dll
    ==> Windows::Media::Capture::MediaCaptureServer::MediaCaptureServer+0xbe2 (RVA: 0x3088c6)
    ==> Windows::Media::Protection::GetPMPCreationOptions+0x77c (RVA: 0x4d278c)
    ==> Windows::Media::Protection::UseUnprotectedProcess+0x654 (RVA: 0x4de354)

 [[IN]] C:\Windows\System32\Windows.Mirage.dll
    ==> ??_EClientComponentManagerHolder@Spectrum@@UEAAPEAXI@Z+0x8c (RVA: 0x2d56c)
    ==> ?InitializeDwmSecurityDescriptor@HolographicPresentationProducer@@AEAAJXZ+0xca (RVA: 0x1b024e)

 [[IN]] C:\Windows\System32\Windows.Mirage.Internal.dll
    ==> RVA: .text+0x549cc

 [[IN]] C:\Windows\System32\Windows.Networking.Connectivity.dll
    ==> Windows::Networking::Connectivity::CEventDispatcher::_CheckListenerCount+0x8a (RVA: 0xd6a2)
    ==> 0x1796a (no symbol)

 [[IN]] C:\Windows\System32\Windows.Networking.Proximity.dll
    ==> PolicyCheck::SupportApp2Device+0x684 (RVA: 0x3360)
    ==> PolicyCheck::SupportReconnect+0x685 (RVA: 0xcd1d)
    ==> PolicyCheck::SupportSubscriptionTracking+0x685 (RVA: 0x166d5)

 [[IN]] C:\Windows\System32\Windows.Networking.Sockets.PushEnabledApplication.dll
    ==> ControlChannelTriggerServer::InitializeParameters+0x706 (RVA: 0x6386)

 [[IN]] C:\Windows\System32\Windows.Security.Credentials.UI.CredentialPicker.dll
    ==> SafeAllocaFreeToHeap+0x0 (RVA: 0xa870)
    ==> SafeAllocaAllocateFromHeap+0x0 (RVA: 0xa8a0)

 [[IN]] C:\Windows\System32\Windows.Services.TargetedContent.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x6f (RVA: 0x8cb13)
    ==> ?GetStorePolicy@Policy@CreativeFramework@@YA?AW4StorePolicy@12@XZ+0x67e (RVA: 0xa2b32)
    ==> ?IsContentDeliveryPolicyEnforced@Policy@CreativeFramework@@YA_NXZ+0x638 (RVA: 0xadd68)

 [[IN]] C:\Windows\System32\windows.storage.dll
    ==> _CreateSharedHandleACL+0x15 (RVA: 0x25515)
    ==> CPrivateProfile::DoPostWrite+0x2d (RVA: 0x85439)
    ==> _SHCoCreateInstance+0xb7 (RVA: 0xabeb7)
    ==> _SHCoCreateInstance+0x742 (RVA: 0xac542)
    ==> ?_InitSource@CAssocProgidElement@@MEAAJXZ+0x3f (RVA: 0xd907f)
    ==> ?ShouldShowUserDefaultsForCaller@@YA_NXZ+0x1b (RVA: 0x12fddf)
    ==> ?Validate@AppDataPathsImpl@Storage@Windows@@EEAAJXZ+0x0 (RVA: 0x33b730)
    ==> ?ApphelpHookCOM@@YAXAEBU_GUID@@0PEAPEAX@Z+0x24 (RVA: 0x4e3644)
    ==> AuxUlibIsDLLSynchronizationHeld+0x67 (RVA: 0x565eff)

 [[IN]] C:\Windows\System32\Windows.System.Diagnostics.dll
    ==> MIDL_user_allocate+0x0 (RVA: 0x38090)
    ==> MIDL_user_free+0x0 (RVA: 0x380c0)

 [[IN]] C:\Windows\System32\Windows.System.Profile.SystemManufacturers.dll
    ==> ?Alloc@GlobalHeap@Common@@SAJ_KPEAPEAX@Z+0x18 (RVA: 0x36f8)

 [[IN]] C:\Windows\System32\Windows.UI.CredDialogController.dll
    ==> ?GetSessionLangID@@YAGXZ+0x16 (RVA: 0xc8ea)
    ==> ?LoadAccessibilitySettingsForCurrentUser@CredUXInstance@@AEAAJPEAUIUIThreadDispatcher@XAMLHost@UI@Internal@Windows@@@Z+0x62 (RVA: 0xe57e)
    ==> ?v_GetTheme@CredUXViewDefinition@@MEAAJPEAW4ApplicationTheme@Xaml@UI@Windows@@@Z+0x3f (RVA: 0x23e3f)
    ==> WlSecureDesktopPromptingRequest+0x30 (RVA: 0x2e2e4)

 [[IN]] C:\Windows\System32\Windows.UI.dll
    ==> Windows::UI::Core::WindowServer::Activate+0x170 (RVA: 0xa100)
    ==> Windows::UI::Core::WindowServer::OnVisibilityChangedEvent+0xea (RVA: 0x10a0a)

 [[IN]] C:\Windows\System32\Windows.UI.Immersive.dll
    ==> ?GetCurrentUserSidString@LockScreenCreativeConfigHelpers@CreativeFramework@@YAJPEAPEAG@Z+0x76 (RVA: 0x95972)
    ==> ?s_SendChangeNotification@CSetLockScreenImageTask@@SAXXZ+0x81 (RVA: 0xadb79)

 [[IN]] C:\Windows\System32\Windows.UI.Logon.dll
    ==> ??0SlowConnectionCheckboxField@LogonUX@@QE$AAA@IPE$AAVString@Platform@@@Z+0xa9 (RVA: 0x1bdb09)
    ==> ?set@?QICheckBoxField@CredProvData@Logon@UI@Internal@Windows@@Checked@SlowConnectionCheckboxField@LogonUX@@UE$AAAX_N@Z+0x30 (RVA: 0x1c623c)

 [[IN]] C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Provisioning\provpackageapi.dll
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x7f57c)

 [[IN]] C:\Windows\System32\windowsudk.shellcommon.dll
    ==> ??0XamlExtensions@implementation@AppExtensions@ApplicationModel@WindowsUdk@winrt@@QEAA@AEBUhstring@5@@Z+0x137 (RVA: 0x3d70b)
    ==> ?IsCurrentProcessInSessionZeroForDesktop@CloudStore@implementation@Storage@WindowsUdk@winrt@@CA_NXZ+0x29 (RVA: 0xac859)

 [[IN]] C:\Windows\System32\wininitext.dll
    ==> SetDefaultWinstaSecurity+0x216 (RVA: 0x1e56)
    ==> SetUserDesktopSecurity+0xd6 (RVA: 0x2386)
    ==> MapUmfdVirtualAccount+0x44 (RVA: 0x2dc4)
    ==> MapUmfdVirtualAccount+0xe2 (RVA: 0x2e62)

 [[IN]] C:\Windows\System32\winmm.dll
    ==> DllProcessAttach+0x1b (RVA: 0x2307)

 [[IN]] C:\Windows\System32\winmmbase.dll
    ==> ?DllProcessAttach@@YAHPEAUHINSTANCE__@@@Z+0x1b (RVA: 0xc04b)
    ==> ?waveOutSetCurrentConsoleVoiceComId@@YAIIK@Z+0xa6 (RVA: 0x12aa6)
    ==> ?waveInSetCurrentConsoleVoiceComId@@YAIIK@Z+0xa2 (RVA: 0x12ea6)

 [[IN]] C:\Windows\System32\WinSCard.dll
    ==> ?IsSafeToUnregisterForSessionChangeNotifications@@YAHXZ+0x0 (RVA: 0x4d9c)

 [[IN]] C:\Windows\System32\winsku.dll
    ==> ?XmlFree@CXmlCursor@@KAJPEAX0@Z+0x4 (RVA: 0x31b64)
    ==> ?WriteLiteralString@CBaseTracingStream@Rtl@Implementation@WCP@Windows@@UEAAX_KQEBE@Z+0x3a (RVA: 0x38a6a)
    ==> `anonymous namespace'::CTracingSink::WriteUtf8NullTerminated+0x1bf (RVA: 0x3ae7f)

 [[IN]] C:\Windows\System32\winsrvext.dll
    ==> WinStationAPIInit+0x6 (RVA: 0xb7a6)
    ==> CreateTermSrvReadyEvent+0xbe (RVA: 0xe3e2)

 [[IN]] C:\Windows\System32\winsta.dll
    ==> CWaitItem::StopWait+0x2a (RVA: 0x1b4a)
    ==> CWaitItem::StopWait+0x48 (RVA: 0x1b68)
    ==> _tsrpcRegisterForSessionNotifications+0x16 (RVA: 0x22ca)
    ==> InternalGetConnectionProperty+0x80 (RVA: 0x3770)
    ==> WinStationQueryInformationW+0x60d (RVA: 0x839d)
    ==> ?Open@CSmartSession@@QEAAJKPEAX@Z+0x70 (RVA: 0x89c0)
    ==> WinStationDisconnect+0x3e (RVA: 0xa90e)
    ==> ?CreateVirtualChannel@@YAPEAXPEAXPEBDKHPEADGK@Z+0xa9 (RVA: 0xafd5)
    ==> 0xec23 (no symbol)
    ==> 0x10397 (no symbol)
    ==> 0x12002 (no symbol)
    ==> 0x12b94 (no symbol)
    ==> 0x13230 (no symbol)
    ==> WinStationGetInitialApplication+0x5d (RVA: 0x1525d)
    ==> WinStationGetParentSessionId+0x43 (RVA: 0x154f3)
    ==> WinStationGetUserCertificates+0x72 (RVA: 0x15a42)
    ==> WinStationReset+0x62 (RVA: 0x15f42)
    ==> WinStationSendMessageW+0xf8 (RVA: 0x16368)
    ==> WinStationShadow+0x9d (RVA: 0x167ad)
    ==> WinStationShadowStop+0x8c (RVA: 0x16a9c)
    ==> WinStationShadowStop2+0x3f (RVA: 0x16bcf)
    ==> WinStationVerify+0x67 (RVA: 0x16fc7)
    ==> WinStationVirtualOpen+0x7d (RVA: 0x1714d)
    ==> _WinStationShadowTarget2+0xf4 (RVA: 0x17334)
    ==> WinStationBroadcastSystemMessage+0x1a8 (RVA: 0x185b8)
    ==> ?QueryMaxSessions@@YAJPEAU_GUID@@PEAK@Z+0x80f (RVA: 0x1c03f)
    ==> ?Legacy_WinStationConnectW@@YAEPEAXKKPEAGE@Z+0x96 (RVA: 0x28b5a)
    ==> ?Legacy_WinStationConnectW@@YAEPEAXKKPEAGE@Z+0xaa (RVA: 0x28b6e)
    ==> ?Legacy_WinStationConnectW@@YAEPEAXKKPEAGE@Z+0x137 (RVA: 0x28bfb)
    ==> ?Legacy_WinStationDisconnect@@YAEPEAXKE@Z+0x79 (RVA: 0x28da9)
    ==> ?Legacy_WinStationNameFromLogonIdW@@YAEPEAXKPEAG@Z+0x7e (RVA: 0x298c6)
    ==> ?Legacy_WinStationQueryInformationW@@YAEPEAXKW4_WINSTATIONINFOCLASS@@0KPEAK@Z+0x12d (RVA: 0x29ddd)
    ==> ?Legacy_WinStationReset@@YAEPEAXKE@Z+0x79 (RVA: 0x29fb5)
    ==> ?Legacy_WinStationSendMessageW@@YAEPEAXKPEBGK1KKKPEAKE@Z+0x77 (RVA: 0x2a113)
    ==> ?Legacy_WinStationShadowTarget@@YAJPEAXKPEAU_WINSTATIONCONFIG2W@@PEAU_ICA_STACK_ADDRESS@@0K0K0K@Z+0x9b (RVA: 0x2a3b3)
    ==> ?Legacy_WinStationShutdownSystem@@YAEPEAXK@Z+0x84 (RVA: 0x2a58c)
    ==> WinStationQuerySessionVirtualIP+0x81 (RVA: 0x2ac11)

 [[IN]] C:\Windows\System32\wkssvc.dll
    ==> WJInitializeWorkplaceJoin+0x686 (RVA: 0x11dee)

 [[IN]] C:\Windows\System32\wlanpref.dll
    ==> ?IsAdhocNetworkAllowed@@YA_NXZ+0x656 (RVA: 0x15d86)

 [[IN]] C:\Windows\System32\wlansvc.dll
    ==> QueryWindowsInformation+0x67f (RVA: 0xa8bb)

 [[IN]] C:\Windows\System32\wmp.dll
    ==> RVA: .text+0x21fa2b

 [[IN]] C:\Windows\System32\WmpDui.dll
    ==> ?IsInsideLoaderLock@WinNT@@UEAAHXZ+0x6 (RVA: 0x3b406)

 [[IN]] C:\Windows\System32\wow64.dll
    ==> Wow64pNotifyDebugger+0x13 (RVA: 0x1ceb)
    ==> Run64IfContextIs64+0x36 (RVA: 0x3daa)
    ==> whNtWow64CsrClientConnectToServer+0x4e (RVA: 0x1567e)
    ==> whNtWow64CsrClientConnectToServer+0x66 (RVA: 0x15696)
    ==> whNtWow64CsrClientConnectToServer+0x7e (RVA: 0x156ae)
    ==> Wow64AllocateHeap+0x0 (RVA: 0x221a0)
    ==> Wow64FreeHeap+0x0 (RVA: 0x221d0)
    ==> ConsoleLaunchServerProcess+0xf (RVA: 0x39a23)

 [[IN]] C:\Windows\System32\wow64win.dll
    ==> whUserConnectToServer+0x22 (RVA: 0x5da2)
    ==> whUserConnectToServer+0x149 (RVA: 0x5ec9)
    ==> whUserConnectToServer+0x215 (RVA: 0x5f95)
    ==> whUserConnectToServer+0x22e (RVA: 0x5fae)
    ==> whUserConnectToServer+0x2c8 (RVA: 0x6048)
    ==> whUserConnectToServer+0x2ea (RVA: 0x606a)
    ==> Wow64CopyOverSharedMemory+0x33 (RVA: 0x61b3)
    ==> Wow64CopyOverSharedMemory+0x48 (RVA: 0x61c8)
    ==> Wow64CopyOverSharedMemory+0x5a (RVA: 0x61da)

 [[IN]] C:\Windows\System32\wscapi.dll
    ==> ?IsDefenderDisabledByGSKU@@YA_NXZ+0x634 (RVA: 0x19b00)

 [[IN]] C:\Windows\System32\wscinterop.dll
    ==> 0xaefd (no symbol)

 [[IN]] C:\Windows\System32\wscsvc.dll
    ==> 0x1c9f9 (no symbol)

 [[IN]] C:\Windows\System32\wsp_fs.dll
    ==> exit_or_terminate_process+0x12 (RVA: 0xc805a)
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xc8618)

 [[IN]] C:\Windows\System32\wsp_health.dll
    ==> __acrt_get_process_end_policy+0xc (RVA: 0xa9a08)
    ==> exit_or_terminate_process+0x12 (RVA: 0xa9c32)

 [[IN]] C:\Windows\System32\wtsapi32.dll
    ==> 0x3b4c (no symbol)

 [[IN]] C:\Windows\System32\WUDFPlatform.dll
    ==> CPlatform::InitializeClass+0x97 (RVA: 0x2517)

 [[IN]] C:\Windows\System32\xgameruntime.dll
    ==> RVA: .text+0x13706e
No results found