Why are some methods inside the session file referred to like this $E18 or $E20?
The $E??? sign is automatically generated name for an exported function, which is being exported by ordinal number. And these numbers are inserted by the compiler. The advantage to do that is to create a smaller image or to hide the function name. But the consequence is the exported API's name is not stored in the exporting dll. Our symbol engine reads what the image has, so if the creator compiled with ordinal numbers, then there are no function names for TrueTime to read in.