SxFillRectClr
_createVolumeMap
pA^_^[]
@.data
SelectObject
##((++
hA_A^A]A\_^[]
REH9)
GetStartupInfoW
k__\\RRPMM
l$<D9q
Msftedit.dll
CSharedWizData::CleanupSharedData
IsSREnabled
_SetSRRestoreBOOLs
CBlockingTaskExec::SetCurrentProgress
u*9Q<|%
InvalidVolumeName
LaunchWizardElevate
L$xE3
;/o7l/
p@'&$)
SpawnCOMRegisterThread
EndDialog
]%~!$2
)099(,5=<FJIKXPP1DD222DD
<autoElevate xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</autoElevate>
!]0!]@!]HH!]
6658D
zDZp|
</security>
CLSIDFromString
blbres.dll
HxVUW
SetEntriesInAclW
VWAVH
!|$XI
_TweakBiDiDateFlags
SxGet0XLogFileCount
Microsoft Corporation
+"=<FIGHH*n
v=TwwE
LoadLibraryExW
::StringCchCopy( pwszVolumeName, cchVolumeName, pwszShortest )
memcmp
:9:99:
%P1u]
type="win32"
wpww}||qlo
0ThPT
_XcptFilter
V8WSK
_lock
Log_SR_ERROR_SYSTEMRESTORE_UNSPECIFIED
K%ds9
USVWATAUAVAWH
A8H;E
_CheckNoOtherInstances
D9l$8v:H
AE0,14u
nxuuusi`
%s %s
_SetupFinalPageMessage
-,()(((11100"0///
_initterm
NLLLP
.idata$5
]Z)6lX
_FormatRestorePointFriendlyName
_SetWizStateError
h UAVAWH
%)))(((
Windows System Restore
SxStartTracing
tFDDDFLL
CBlockingTaskExec::OnTaskDlgCreate
.pdata
wcschr
_UpdateRestorePointVolumes
!t$hM
ubVyx
Microsoft
_acmdln
shVolume != INVALID_HANDLE_VALUE
e%s %s %s
NN>;9347""1P
"a`ABOTT
D$XfD
_IsRPBootVolume
CloseServiceHandle
@SUVWATAUAVH
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
_WasVolumeProtected
fD94Bu
&( 110"//""//+2,'-
SetEvent
CSharedWizData::_BuildFont
_exit
D$$D9
KKKXZZB
0A^_^
8\u*f
DPN{NNPN
MoveFileExW
_MsgSortRestorePointPicker
``YV~zzz
wp}}}}{{l
D$LA;
T*ajj
0A_A^A\_^
@8o8t
(((1+&
_MsgFinishPageConfirm
SxShowDirtyVolumeDialog
SxIsVolumeInteresting
F H9xPtc@8
p WAVAWH
_FindSppExternalGroup
VWWGWWW
_DetailsInsertListView
WinSqmAddToStreamEx
G8H;FHu
CoCreateInstance
GetCommandLineW
DestroyPropertySheetPage
%)((11000///7774446658
'7777
SrGuiStopTracing
SxCheckWBDiagSession
_MsgIntroErrorPageSetActive
_RealSystemRestoreOfflineThreadFunc
GetFileAttributesW
_RebootSystem
%systemroot%\system32\systempropertiesprotection.exe
CSxVolumeLocator::FindVolumeById
.CRT$XIA
RtlNtStatusToDosError
SrFreeRestoreStatus
CBlockingTaskExec::OnCancelNotification
_RealSystemRestoreThreadFunc
<=qqq
_ToggleVolumeState
S$<HmZv
CreateColorBitmap
SxPaintTopWhitePart
|$(E3
DispatchMessageW
ir=>K
0CZ+"
::DeleteFile( strTracingDirectory )
1[6oa
x UAVAWH
TeVCrL
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
U*"=<FJIGHLD
FileDescription
DvPPN{A
GetLocaleInfoEx
CSxApp::Init
[9:(6=<FIGHHW
#((1100///7774446558
GeDlD
UWATAVAWH
d6}{LC
BeginPaint
_LookForPriorInstallPointOrNothing
EHXL9JXL
ntdll.dll
Button
zzz:~
10.0.17763.1
DeviceIoControl
InitializeCriticalSection
8% kCL\
"$Zczj
SetWindowLongPtrW
fTKe0q
B8H+A8H
SetWindowLongW
AdjustTokenPrivileges
l$0E3
tlLFDD
lx6_`
version="6.0.0.0"
D$(E3
SxFindExistingWindow
SetSecurityDescriptorGroup
w%{A~
I+G@H
$iM[i+
IDATC
|annnrvv
L$(E3
UVWAVAWH
CBlockingTaskExec::OnCancelClicked
GetSysColor
tuxtheme.dll
owwWH.
InflateRect
A_A^A\_]
InitiateShutdownW
O:BAG:BAD:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)
FrA2d
@*'*((11000///77
TerminateProcess
IsWinPE
A;E0r
fg=k{d
U/000/,6=?<FJKOXXXXXXXPXYi
V;Y^\
D$lD9}
##(++
%=R%:'
/////-,5=?<FINWWWWWWXXVYi
SxGetVolumeSize
GetDiffAreaInfo
HcF H
wDDDDD
CloseThemeData
.text$x
T$ E3
L!u8H
A^_^
GetModuleHandleW
MoveFile
GetTimeFormatW
L$ E3
SOFTWARE\Microsoft\RecoveryEnvironment
+66558v
_MsgFinishPageInitDlg
.giats
uLD9k(uFH
rstrui.exe
0A_A^_
nv}m|{ql]
OriginalFilename
GdiFlush
FileTimeToSystemTime
000///73-
uKD9k(uEH
AssertPrivilege
,['!<Z&
fD94Au
CheckGroupPolicy
RestoreUI
\$8E3
f9}gt
ImageList_Add
wwwwp
EnableWindow
X\\D.
mnpvzusif_
PropertySheetW
UVWATAUAVAWH
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
CreatePropertySheetPageW
D?PN{
DisableConfig
CloseHandle
_IsSystemVolumeRestorable
739;<<=
@.reloc
?{>MS
_IsBackupOnTarget
P)TJE
SxGetUserAccessLevelForHandle
"",5)
GetSystemTimeAsFileTime
SeShutdownPrivilege
ControlTraceW
H!|$
_MsgRestorePointItemChanged
EPNAydxVUUXWWXx
_SetRPListDefaultState
2K25777785X
|$HE3
[Uln^
y^mvvv
RegisterWindowMessageW
L9s(tLH
SetUnhandledExceptionFilter
ss4FF
D9.v*L
wcscmp
_MsgDetailsDlgInit
avyv`rxuyvvyq
wwxxx
NN{{{
D$ E3
.text
[6?>JI744`
SSS887
_GetGuidVolumeName
P((CM
SRCORE.dll
.rdata$brc
_MsgVolumePickerPageNext
SetWindowPos
Z7WVV
G0H;F@u
_DoRunOnceSpawn
_PopulateVolumePickerList
ControlService
xxxxxx
SetClassLongPtrW
L$`E3
.-,+0 )(
_RealMain
kJ(H!
<=c#.
T|7an
LocalAlloc
_GetSelectedRestorePoint
##$(+*
.idata$4
RegisterCOMObjectsInGIT
GetTokenInformation
xddHHVVU
__dllonexit
xl/wn
VUMcc
?dbbUUVV
SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations
DrawThemeBackgroundEx
InitializeSecurityDescriptor
I:]8G
D$4E3
COMCTL32.dll
((11000///774446656vPC
qksnc
_AddInterestingVolumes
SafeGetClassName
7[ }>
__C_specific_handler
RtlEnumerateGenericTableAvl
TraceMessage
D$4D9l$htwH
@fE98u
_PrepareForRestore
GetSystemId
GetSysColorBrush
_MsgRestorePointPageNext
%s.%d.%s
[C%n*
WinSqmAddToStream
S~[5O
[\vvvt&;)pxpS{{||G
RJ?=::
6Ifup<
CreateEventW
E9M0v+H
\\?\Volume{
DeleteObject
.text$mn$00
t$ WH
</windowsSettings>
_SetupDetailsLvColumns
SetLastError
_DoRestore
.rsrc$01
D$DE3
Xd-Y[n
n'.Et
A_A^A]A\_^[]
(is|
OMOcfz
OffsetRect
_SRConfirm
T$`9w
fE9<Pu
CoTaskMemRealloc
p.-98/0001*1**+*0++0p
_FindNewestAndSuggestedRestorePoints
GetWindowRect
GetTraceEnableLevel
111*3383
_ComputeAggregateState
SxIsElevatedWindow
EndPaint
IsWindow
E$PHX`0
t`D8t$ t
wp}}|zupqm
LeaveCriticalSection
FindFirstVolumeW
'D9.u%
pA^A]_^]
ILLL$&
Software\Microsoft\Windows NT\CurrentVersion\SystemRestore
"22/3355.
GetTraceLoggerHandle
D9l$8v
Microsoft Corporation. All rights reserved.
%SystemDrive%\
SxRegReadString
GetDateFormatW
.text$yd
;bOHS
l?9eU
@..820001(
GetWindowLongPtrW
CreateDirectoryW
nyvvxr`v|||b~~c
LcA<E3
SxGetVolumeIdentifier
@USVWAUAVAWH
D9gDtSI
L9egt
#$(+T
@.rsrc
blblog
_MsgVolumePickerKeyDown
?\UNC\
)jnooqql
`A_A^A]A\_^]
l$ E3
fD9$qu
LegalCopyright
CallWindowProcW
SendMessageTimeoutW
_MsgSuccessDialogInit
&)))(((111
version="1.0.0.0"
<dependentAssembly>
tFas+
eT9lD
xr.!<
;L$8r
T*amm
48:>>>pN
t:K[;
KY8g3(
.rdata$zzzdbg
IsSystemVolumeInClient
_GetDisplayNameOfVolume
LoadStringW
RtlInsertElementGenericTableAvl
WAVAWH
1)/('%%8@@@AAA>:
GetDriveTypeW
.rdata
|$XE3
#((&Bhsi]
hmr0|
CleanupParameters
RegisterEventSourceW
_AddSqmDatapointsAtWizardCompletion
OpenSCManagerW
wwwp}wrq|q]
%)((11000///774446655-
A;v r
::GetVolumeNameForVolumeMountPoint( wszVolume, pwszUnique, cchUnique )
wcsstr
_FindSrVolumeInBackup
D$$I;
h_^[]
<assemblyIdentity
ImageList_Create
SetLayout
WaitForSingleObject
netmsg.dll
QG8~<s
_AppendStatus
[Ufe-
OpenProcessToken
97vwH
;`aC0
Nuz{{
::StringCchCopy( STRING_CCH_PARAM( wszVolume ), pwszVolume )
SystemParametersInfoW
StartTraceW
MessageBoxW
g2jwz
hFHnbb"
Clll`eE$
memcpy
SetForegroundWindow
.idata$3
_GetPresentableVolumeName
8Pq\w:
SxShellExecuteWithElevate
5RRRRTTTUUTY
SetErrorMode
D$DD9w
SxGetWindowsDirectory
n++>I]
vsstrace.dll
SxRotateLogs
E\Q:CB
ExpandEnvironmentStringsW
DeleteFile
]Ubyi
__setusermatherr
D;uPs
UATAUAVAWH
UWATAUAVH
~"|]o
GetTickCount
u\L;@
txqNC%
]X/9q
SxShowIcon
_MsgRestorePointPageInitDlg
.CRT$XIY
s?6==}h
GetVolumeInformationW
PostMessageW
_InitWbengine
#$(+4
&GBs=;
/>
_FindBackup
pL=wH
mmmmAX
"2I't
zsWWW[
f&:=A
UWAVH
z\cg84
A_A^A\
Dv?PNN{A
-X `V
iswspace
UWAUAVAWH
>6^6Q
SetFileShortName
UnregisterTraceGuids
Pgdeefe
%s.0.%s
WaitForCOMRegisterThread
9LKMOId
SHELL32.dll
@#'-..'()((1000//777444666559=?
:\ubf
jhse|
|$hE3
)30^wtsi]
_MsgIntroErrorPageInitDlg
_ismbblead
_HighlightSelectedRestorePoint
Hc@ D
p;gI'
%465;>>?
//39:.:;:
g|DFL
'Z]&7n$I
9E@u0H
CreateProcessW
y!dHxU
dl&fu
WATAUAVAWH
##$(%V
DisableSR
RFHJQ@
qsuU,ba[x
NN{NNN{AA
D$4D9g
hnl`l|
A_A^A]A\_
|$ E3
.CRT$XCAA
\$@E3
_BackupRestorePointPageNext
L!t$ H
\$ UH
ADVAPI32.dll
#$$+%Q
CreateThread
SetBkMode
.00cfg
_wcsicmp
SPP.dll
DialogBoxParamW
FreeLibrary
@SUVWH
UAVAWI
_FillDetailsPage
GetWindowTextW
_MsgIntroPageInitDlg
T$0E3
DuplicateToken
V2%3,
K(D9y
UVWATAVH
ydHVUU
GetKeyState
CompanyName
N3c'H
cI $F
GetCurrentThreadId
{=:8377" 111*1(p
7773:<<
__getmainargs
dkgJV
u3c[6
DnG`L
fSxGetTimeZoneString
u HcA<H
_MsgRestorePointPageSetActive
SetThreadPreferredUILanguages
OpenThemeData
_MsgVolumePickerClickItem
Sleep
ydHxVU
dl0Dh4
q=ft}
1L G!)
v7%oL9
GlobalFree
t$ UWATAVAWH
RtlInitializeGenericTableAvl
ShellExecuteExW
+7774446665.
GetVolumePathNamesForVolumeNameW
RegOpenKeyExW
~gtX;
SetBkColor
CopyRect
_wcsnicmp
FindFirstFileW
_ShowNoOSSelectedMessage
CSxVolumeLocator::FinalConstruct
@8~pt~
|zpAo
SetSecurityDescriptorDacl
(1Xn'
SxInitializeUiLib
`A_A^A\_^[]
"1|5=
L9E8v
SxGetInterestingVolumes
p@2!H
SetSecurityDescriptorOwner
'*)(((111
n/RUNONCELAUNCH
SxSetupWinREUILang
r$+LHy
A`#60
_RegisterCOMInterfaceInGIT
I@2 p
UnregisterCOMObjectsInGIT
CheckTokenMembership
_ValidateVolumeStates
ShH92t
n/~A+
vvv?PNN{{A
~?FX{
!\$XI
!!$I7J
UILanguage
##$(%N
T$hE3
S@f!C8H
ImageList_AddMasked
memmove
SHGetStockIconInfo
uiAccess="false"
#sGqp
strchr
@8y(t
_callnewh
OpenProcess
i*PYJ
InitRPFromSnapshot
__set_app_type
\ynqq
R.B_w
CSxVolumeLocator::_AddVolumes
LoadIconW
D$LE3
C0C0k!
GetVolumeNameForVolumeMountPointW
IDATx
GetUserDefaultLCID
SrGuiStartTracing
XP9'*
_MsgSuggestPageSetActive
040904B0
@.',%#)))##
W))*hVVW
M8D8ITt
023'898
@USVWAVH
a1`/(&&#,,,68ABBBBBKIL
F|t{m
-\NY;>
ReleaseDC
HcA<H
#yUDm
A_A^A]A\_^]
,&.-((11100///77744466658v
SxIsDirtyVolume
c6 -p
PeekMessageW
A_A^]
rstrui.pdb
fE9,Xu
SxWaitForSingleObjectWithMsgLoop
f\j\[e
'Zpop
_FilterRestorePointsBySystemId
ryjnn
fuxrjkfjjjjmrl
D$4D9mh
9%=?FJIGHK`]spmsuxv||bh~~oe]
GetClientRect
%s (0x%x)
txD8e@t
SxStopTracing
_MsgFinishPageSetActive
c267y<CE
sDa${+
F>>>t~~~
fyyttutm{|b~~h~o
SxCheckDiskViaShell
RegQueryValueExW
lOHH%
_MsgRestorePointCheckboxClicked
t$(E3
NgOh6
VarFileInfo
LLNNNNPPPOS
_fmode
{VxVUT
ImageList_Destroy
::GetVolumePathName( strPath, STRING_CCH_PARAM( wszRootPath ) )
C$&((11100///7774446655.
>{nx7
5EjAa
,,,0}
SxEnableTraceDefault
qLOO#
SxLocalSystemTimeToString
v?PN{A
s(D9n
DoCrashCleanup
_vsnwprintf
?`0=3===
CreateDIBSection
Software\Policies\Microsoft\Windows NT\SystemRestore
CreateFileW
>RhIuJ
000+8-9-:-
!N=;:9
<&'+x
CSxApp::GetResourceString
/OFFLINE:
FormatMessageW
GetTimeZoneInformation
processorArchitecture="amd64"
_IsTargetPresent
'_pSN
InitializeCriticalSectionAndSpinCount
`.&######,,655@BCCCCCCKCc
<security>
IcGPH
GetInterfaceFromGIT
CoUninitialize
<!-- Copyright (c) Microsoft Corporation -->
<requestedExecutionLevel
fA94@A
A_A^A]A\_
10.0.17763.1 (WinBuild.160101.0800)
SxIsBootVolume
DeleteCriticalSection
%s%s(0x%08X)
GetWindowLongW
$V77>y
C.,&+1
FillRectClr
t$HL9m
RtlCaptureContext
3232337-
_DoRestoreWizard
d$8E3
x ATAVAWH
Pu8D9
l$ VWAWH
9kXvLH
u5D9g
_MsgVolumePickerPageSetActive
%s (%s)
~eEz!
GetDeviceCaps
GetWindowThreadProcessId
A9GTu
` UAVAWH
CVUHHd
EnumWindows
/+U^[
publicKeyToken="6595b64144ccf1df"
WinSqmIncrementDWORD
\$XE3
A_A^_
BVc2c
SxGetUniqueVolumeForPath
SxShowLuaMessage
_PopulateRestorePointList
l@b>A
/6656?
A_A^A\
9}wt*
DestroyWindow
=>DZ{u
/RUNONCELAUNCH
SxLoadSystem32LibraryEx
H9t$@t
SystemRestoreTracingFlags
@USVWATAVAWH
"ACEis
ExtTextOutW
c)*IM
SetWindowTextW
DeleteDC
CBlockingTaskExec::EnableCancel
@h!&`
ReportEventW
ozzZN
m"6vgbc#
8388838A
777469
fD94{u
ht]i-
=7XZZ
tk]RMk
RtlLookupFunctionEntry
MsgWaitForMultipleObjectsEx
OMNabz
GetTraceEnableFlags
_MsgSortVolumePicker
CSrGuiCallback::_Init
m#W(`
QueryPerformanceCounter
L$0H+
t$0E3
CreateCheckBoxImagelist
pqqp,
%ic`\&
fA90u
msvcrt.dll
\$ UVWATAUAVAWH
RtlDeleteElementGenericTableAvl
D9o(tbL
StringFileInfo
ole32.dll
u]LLL`||\!
DDvPPPDC
tDDDD
EQ"K%
SxMergeExtraLogs
Z3bc8
SxCheckRebootRequired
.text$mn
\$(fD
D$XE3
e2++E\
EnableTraceEx2
,(((1100///7774446665=
/3:z/
, ((*&&,'
11+233,
H!M8H
/RECOMMEND:
000/3
B@I9@@s
&&'71>1jr
m%:E;
delh`c}
,',,))(((
DecodePointer
LaunchControlPanel
InitCommonControlsEx
_GetSrDelayedErrorString
F.[TAh
?$)((11100///7774446656p
SxFindTopLevelWindow
bd`~tkw#B
dHxVUXWV
CSxApp::InitAccessLevel
UpdateWindow
L$ SWH
SxGetBootVolume
eqspy{^h~oocE
HB*A*
_DisplayStatus
BackgroundFetchDriverWU
]wD;`
fNBW%
A^A\_^]
HB!91u
&&&P,
RtlVirtualUnwind
%s.0.?.%s
|$ UH
pA_A^_^]
qE@.=<<;d
!Q7pI;
D9@Dt
uOD9k(uIH
Iv%*w1h
_Mount
9?=K?
yyydHxVUTcc!b
f*90BBA@?=
M4;-4
.CRT$XCA
%s.0.%d.%s
cA@pe
fD9;t/H
KERNEL32.dll
E9}ou
A^A]A\_]
M9fPt
U((09:;1
<windowsSettings>
*)(((
c||<1
^/#I}
UnhandledExceptionFilter
GetWindowsDirectoryW
CSrGuiCallback::UpdateProgress
,))((111
%s.0.1.%s
SxTracerDebuggerBreak
}MCkK
ZZZ:{
SxQueryTraceSession
GetSystemDirectoryW
ydHxU
udD9ot
VS_VERSION_INFO
CreateWellKnownSid
n/cq1A
&))(((111
_MsgErrorDialogInit
x UATAUAVAWH
</dependency>
A_A^_^]
_MsgProgressDialogUpdate
u8D9g
.CRT$XCZ
AF m&
_MsgRestorePointPageOnCommand
zqkk34L
1Q<Nkt=
\$ UVWATAVH
/RUNONCE
SendMessageW
778;;;<;<;
Pu;D9
;|$8r
L$pE3
.data
$aX_T
\9:065=?FIIGMZ2elszylg
_LogStatus
L$ UVWH
yddxU
GetVolumePathNameW
9|$0t
wbengine
xwwww
B$'..-*(11100///777
<application xmlns="urn:schemas-microsoft-com:asm.v3">
memset
_DoSystemRestore
ydHxVUXc b
GetThemePartSize
SetFocus
9A98u6A9x
level="requireAdministrator"
aT )I
GetProcAddress
H!D$tE3
</trustInfo>
ProductName
_FakeupSnapshotName
GetClassNameW
!M9HXI
DuplicateTokenEx
t^D9e
CreateCompatibleDC
L9}wu
.idata$6
fA9<Qu
SxTracerGetThreadContextRetail
e00nv
SxSetRichEditUnicodeText
$,:=3.*
S[Mwy
D$$9{
9s(tGH
a|<F
GetParent
TWVV6
InitRPfromBackup
D$HE3
spp.dll
E)(11100///77
type="win32"
SxCompressLogFile
D$ 9D$xt
t$ UWAVH
#>;7&|J
FileVersion
fD9$Au
D9k(t
A0H;E
J}kJ|
t$ E3
CreateDialogParamW
::DeviceIoControl( shVolume, FSCTL_IS_VOLUME_DIRTY, NULL, 0, &dwResult, sizeof(dwResult), &cbReturned, NULL)
UAVAWH
J cGP
wwwwxp
1860yJyTH
</dependentAssembly>
USVWATAVAWH
<requestedPrivileges>
DeregisterEventSource
K_dbl
FileTimeToLocalFileTime
&o`dt3
idCreate
Zmlvff
CoInitializeSecurity
@2d89^
2+20=
RtlLookupElementGenericTableAvl
SppFreeExternalGroupPropArray
+SxIsLocaleBiDi
/>
_SetWizStateSuggest
e;5/|
@`D9n(t?H
CoTaskMemAlloc
SxInitializeCOMSecurityForSPP
bSxGetPresentableVolumeName
%,..'((11000///77744466555q
SxTracerShouldTrackFailure
'@e$I
fA90t
H9L$@u
?R#H}(
A_A^_^]
DeleteFileW
CoInitializeEx
*9:9-6=?>JJICPYDS[eepce[
GDI32.dll
SYSTEM\CurrentControlSet\Control\MiniNT
FindNextVolumeW
B0H+A0u
D$TD9y
BackgroundInitRP
]S56+
*))(((
.$'.---&)(((111000/7774466558<=v
A_A^A\_^
G|H9]
7p&"g@
@USVH
omma}}}
$'R;R
i*#&&&###,,65=?ACLLLLLLLL3
?.HC|
5SS[[[[[[
K_z/-DC
.data$brc
yydHV
H@!1#
mJy}_'
[wmAe
H3E H3E
InternalName
GetAncestor
g2Y0&
](((((.,65=?<JCOOOOOVVVMZi
yHxVW{
?vvvPPN{
malloc
E@9]0
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
D$lE3
f94HA
Dv?PNPv
srcore.dll
</application>
.rsrc$02
L!u7H
_unlock
xxxxw
wDLDld
GetDC
SetTextColor
%(11000//777446
`hsgc
kilh`bb
HxVUX
AssertPrivilegeOnToken
RegisterApplicationRestart
runas
en-US
FindNextFileW
LogSrCommon
:9%=<JIGHHKD_ssqtx{|~hU
E`I;G@
.text$di
hVolume != INVALID_HANDLE_VALUE
FindClose
$GD9g0
CBlockingTaskExec::SetMarqueeProgress
VWATAVAWH
_SetupVolumePickerColumns
</requestedPrivileges>
_DoRunOnce
RtlGetLastNtStatus
(((*+2&
_GetBootVolumeProp
\$0E3
GetCurrentProcessId
L$XH3
+.,((1110
_PopulateDetailsList
_SetupRestorePointPickerColumns
<assemblyIdentity
aeiouyAEIOUY
GetAndEnsureTracingDirectory
name="Microsoft.Windows.Rstrui"
.)((opoo
DD.@}UR
language="*"
+0MMLH
MapWindowPoints
d$(E3
#GM}`
GetSystemMetrics
!]HH!]
@)(11100///7774446656P
EtwTraceMessage
<.AH
}hk#k
dHHxVU
_SetFinalPageHeaderFont
SxIsUserDefaultLocaleBiDi
@USWH
ShutdownSystem
@USVWH
CoTaskMemFree
GetDlgItem
processorArchitecture="amd64"
GetDesktopWindow
DvvDD
"ABEJ
_SetIntroPageHeaderFont
.CRT$XIZ
FAILED[TRACK]
CBlockingTaskExec::SetTitle
xS9\$XuM
EncodePointer
!This program cannot be run in DOS mode.
n&''Y
A_A^A]_^[]
f96`.|
SxEnableTraceCustom
-%u9QX
GetLocaleInfoW
t$@E3
L$0uDH
$,--1>>
JJJ|hhh
D$xE3
USER32.dll
SxAllocateEventTraceProp
_MsgVolumePickerPageInitDlg
OpenServiceW
::GetVolumeNameForVolumeMountPoint( wszRootPath, STRING_CCH_PARAM( wszVolume ) )
_GetFocusedVolume
#ACEG
OF8:o
Pv?PPNN{{AA
%SystemRoot%\Logs\SystemRestore
ry\OZ
CreateFontIndirectW
HeapSetInformation
KPL+@@I
f9H\u
EnterCriticalSection
.CRT$XCU
CSharedWizData::Initialize
\$ E3
ConvertStringSecurityDescriptorToSecurityDescriptorW
%%-'-'-'&)(((111
system32\rstrui.exe /RUNONCE
_MsgSuggestPageInitDlg
%s%s(0x%08X[0x%08X])
`A_A^_^]
GetCurrentProcess
,[uXB
System Restore
d&PIa[o
_vscwprintf
9A5?>JIGHH:ajpssuxz|bhh~gcl
dwErr
Cgald
K L9s
CSrGuiCallback::CreateInstance
SysLink
LocalFree
7769=
%systemroot%\system32\rstrui.exe
</assembly>
TargetOS
<description>manifest file for rstrui</description>
Translation
^wjzvuuruyo
{LAL$
Software\Microsoft\RecoveryEnvironment
RegisterTraceGuidsW
idSysRestoreOnOff
IsTokenMember
\.((..&,,65=?<KNNNNMMMMMR
ProductVersion
238'8'
D9ott]D9n
xxxxxxwttDDDL|V
ju&^39n
gePP"
_ParseCommandLine
y;w&:
ShowWindow
_onexit
^J,--bvn
.CRT$XIAA
Wu00 b
7W4xDWL
CHnb"HW
SafeSetWindowLongPtr
A_A^A\_^[]
_ShowDetails
dHHxU
$qb;I
Windows
CBlockingTaskExec::Execute
D$0E3
fff0??
{SxRegReadDWORD
_GetSPPExternalGroups
.idata$2
fA94Cu
x AVH
lzG3
lQ?wEk
|$PE3
5H@JM
D;mgs
l$<fD
R=v|{N
ls_0;;k
Bjq@?
LookupPrivilegeValueW
SxIsCalendarRtl
53gN_
.xdata
E#'..-&((11000///77744466655:
.gfids
K+]llq
$1K"BA
$$&,,,
>3ZiT
FindVolumeClose
Operating System
0A^A]A\_^][
FAILED
L$49}`v;
IDAT^
_cexit
SystemRestore{B03D8975-C55C-411d-A198-BA9DD6342261}
RB[;'
#n]$;2
SetInitialFocus
<xtlll<
xVUUX
UVWAUAVH
CenterDialog
[5@Z9
D$$E3
p]7AT
GetLastError
@USVWATAUAVAWH
UWAWH
_commode
SxUTCFileTimeToStringFormatted
_amsg_exit
fD9$Gu
p WATAUAVAWH
?terminate@@YAXXZ
<dependency>
#oX}+CP
HandleHelpSysLink
CommandLineToArgvW
V@"6l
_UpdateCurrentlyProtectedVolumes
BuiltInRestoreUITracing
TaskDialogDirtyVolumeCallbackProc
_FillWinDir
pA_A^A]A\_^]
wwttD
SrFreeRpPropArray
EwA96
name="Microsoft.Windows.Common-Controls"
DrawFrameControl
P:UEm
)5RV%o
A_A^A]A\]
A_A^A]_]
#VJA)
`.rdata
t$4;}`r
f9<Bu
CBlockingTaskExec::SetDetails
mnldsop
RegQueryInfoKeyW
RegCloseKey
&,.-&(111000///7774446655-
NtShutdownSystem
&*)))((
SxUTCFileTimeToString
0'T E