There is a public symbol file for winlogon.exe that gives names for most
non-WPA stuff (excluding some static functions). However, most names
from WPA stuff are stripped from public symbols.
Some names are still present, like CIniSection::Attach
and AutoHeapPtr<SECURITY_DESCRIPTOR>. I have named some of the rest;
to distinguish between and original names, I always use a substring "WPA"
in made-up names. Also, there still are a lot of autogenerated names
like sub_10456789, they obviously are not original.
If you see a name that is not auto-generated and does not have a "WPA"
substring, it is original. CreateAndHoldWPAGlobalMutex, szRRWPA, szRWPA,
szWPAOldBaseKeyName_ENC, g_hAbortWPA also are original names,
everything else with "WPA" substring is made up.

Also, winlogon.pdb has original names of all *.obj and boundaries
of individual *.obj-s. I have put all code and data from "something.obj"
to "something.c" or "something.cxx", and code/data referenced by other units
to "something.h". Occasionally I have created other h-files; autoptr.h
comes from another subtree of the leak (with some additions),
trivialencrypt.h is named from an assert in debug build, other names are made-up.
