# afd.sys CVE-2026-21236 KB5074109 vs KB5077181
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
* [AFDETW_TRACECLOSE](#afdetw_traceclose)
* [NTOSKRNL.EXE::RtlLogUnexpectedCodepath](#ntoskrnlexertllogunexpectedcodepath)
* [Modified](#modified)
* [AfdBReceive](#afdbreceive)
* [AfdNotifyPostEvents](#afdnotifypostevents)
* [AfdFastDatagramReceive](#afdfastdatagramreceive)
* [AfdTdiCreateAO](#afdtdicreateao)
* [AfdNotifyDestroyContext](#afdnotifydestroycontext)
* [AfdCleanupCore](#afdcleanupcore)
* [AfdTransmitPackets](#afdtransmitpackets)
* [AfdBCommonChainedReceiveEventHandler](#afdbcommonchainedreceiveeventhandler)
* [AfdSuperAccept](#afdsuperaccept)
* [AfdSanConnectHandler](#afdsanconnecthandler)
* [AfdRestartSuperAcceptGetAddress](#afdrestartsuperacceptgetaddress)
* [AfdCloseCore](#afdclosecore)
* [AfdReceiveDatagram](#afdreceivedatagram)
* [AfdSanAcceptCore](#afdsanacceptcore)
* [AfdNotifyProcessRegistration](#afdnotifyprocessregistration)
* [AfdExtractAfdSendMsgInfo](#afdextractafdsendmsginfo)
* [AfdCompleteBufferedSendsUnlock](#afdcompletebufferedsendsunlock)
* [AfdFastConnectionSend](#afdfastconnectionsend)
* [AfdFastConnectionReceive](#afdfastconnectionreceive)
* [AfdQueryHandles](#afdqueryhandles)
* [AfdBind](#afdbind)
* [AfdFastDatagramSend](#afdfastdatagramsend)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [NTOSKRNL.EXE::MmMapLockedPages](#ntoskrnlexemmmaplockedpages)
* [memcpy](#memcpy)
* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
* [__security_check_cookie](#__security_check_cookie)
* [__GSHandlerCheck_SEH](#__gshandlercheck_seh)
* [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag)
# Visual Chart Diff
```mermaid
flowchart LR
AfdBReceive-6-old<--Match 81%-->AfdBReceive-6-new
AfdNotifyPostEvents-3-old<--Match 89%-->AfdNotifyPostEvents-3-new
AfdFastDatagramReceive-4-old<--Match 77%-->AfdFastDatagramReceive-4-new
AfdTdiCreateAO-10-old<--Match 97%-->AfdTdiCreateAO-10-new
AfdNotifyDestroyContext-2-old<--Match 73%-->AfdNotifyDestroyContext-2-new
AfdCleanupCore-2-old<--Match 99%-->AfdCleanupCore-2-new
AfdTransmitPackets-2-old<--Match 79%-->AfdTransmitPackets-2-new
AfdBCommonChainedReceiveEventHandler-4-old<--Match 95%-->AfdBCommonChainedReceiveEventHandler-4-new
AfdSuperAccept-2-old<--Match 88%-->AfdSuperAccept-2-new
AfdSanConnectHandler-4-old<--Match 77%-->AfdSanConnectHandler-4-new
AfdRestartSuperAcceptGetAddress-3-old<--Match 98%-->AfdRestartSuperAcceptGetAddress-3-new
AfdCloseCore-1-old<--Match 46%-->AfdCloseCore-1-new
AfdReceiveDatagram-2-old<--Match 84%-->AfdReceiveDatagram-2-new
AfdSanAcceptCore-4-old<--Match 55%-->AfdSanAcceptCore-4-new
AfdNotifyProcessRegistration-4-old<--Match 23%-->AfdNotifyProcessRegistration-4-new
AfdExtractAfdSendMsgInfo-3-old<--Match 95%-->AfdExtractAfdSendMsgInfo-3-new
AfdCompleteBufferedSendsUnlock-2-old<--Match 75%-->AfdCompleteBufferedSendsUnlock-2-new
AfdFastConnectionSend-3-old<--Match 59%-->AfdFastConnectionSend-3-new
AfdFastConnectionReceive-4-old<--Match 82%-->AfdFastConnectionReceive-4-new
AfdQueryHandles-8-old<--Match 80%-->AfdQueryHandles-8-new
AfdBind-2-old<--Match 95%-->AfdBind-2-new
AfdFastDatagramSend-5-old<--Match 84%-->AfdFastDatagramSend-5-new
subgraph afd-10.0.26100.7824 (WinBuild.160101.0800).sys
AfdBReceive-6-new
AfdNotifyPostEvents-3-new
AfdFastDatagramReceive-4-new
AfdTdiCreateAO-10-new
AfdNotifyDestroyContext-2-new
AfdCleanupCore-2-new
AfdTransmitPackets-2-new
AfdBCommonChainedReceiveEventHandler-4-new
AfdSuperAccept-2-new
AfdSanConnectHandler-4-new
AfdRestartSuperAcceptGetAddress-3-new
AfdCloseCore-1-new
AfdReceiveDatagram-2-new
AfdSanAcceptCore-4-new
AfdNotifyProcessRegistration-4-new
AfdExtractAfdSendMsgInfo-3-new
AfdCompleteBufferedSendsUnlock-2-new
AfdFastConnectionSend-3-new
AfdFastConnectionReceive-4-new
AfdQueryHandles-8-new
AfdBind-2-new
AfdFastDatagramSend-5-new
subgraph Added
direction LR
AFDETW_TRACECLOSE
NTOSKRNLEXE-RtlLogUnexpectedCodepath
end
end
subgraph afd-10.0.26100.7623 (WinBuild.160101.0800).sys
AfdBReceive-6-old
AfdNotifyPostEvents-3-old
AfdFastDatagramReceive-4-old
AfdTdiCreateAO-10-old
AfdNotifyDestroyContext-2-old
AfdCleanupCore-2-old
AfdTransmitPackets-2-old
AfdBCommonChainedReceiveEventHandler-4-old
AfdSuperAccept-2-old
AfdSanConnectHandler-4-old
AfdRestartSuperAcceptGetAddress-3-old
AfdCloseCore-1-old
AfdReceiveDatagram-2-old
AfdSanAcceptCore-4-old
AfdNotifyProcessRegistration-4-old
AfdExtractAfdSendMsgInfo-3-old
AfdCompleteBufferedSendsUnlock-2-old
AfdFastConnectionSend-3-old
AfdFastConnectionReceive-4-old
AfdQueryHandles-8-old
AfdBind-2-old
AfdFastDatagramSend-5-old
end
```
```mermaid
pie showData
title Function Matches - 99.9372%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 3182
```
```mermaid
pie showData
title Matched Function Similarity - 98.7744%
"matched_funcs_with_code_changes_len" : 22
"matched_funcs_with_non_code_changes_len" : 17
"matched_funcs_no_changes_len" : 3143
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21236\ghidra_projects --project-name CVE-2026-21236 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21236\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title afd.sys CVE-2026-21236 KB5074109 vs KB5077181 afd-10.0.26100.7623 (WinBuild.160101.0800).sys afd-10.0.26100.7824 (WinBuild.160101.0800).sys
```
#### Verbose Args
```
--old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21236\\afd-10.0.26100.7623 (WinBuild.160101.0800).sys'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2026-21236\\afd-10.0.26100.7824 (WinBuild.160101.0800).sys']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21236\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21236\ghidra_projects --project-name CVE-2026-21236 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2026-21236\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title afd.sys CVE-2026-21236 KB5074109 vs KB5077181
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/afd.sys/5D088826B3000/afd.sys -O afd.sys.x64.10.0.26100.7623
wget https://msdl.microsoft.com/download/symbols/afd.sys/3FBD2AEEB4000/afd.sys -O afd.sys.x64.10.0.26100.7824
```
## Binary Metadata Diff
```diff
--- afd-10.0.26100.7623 (WinBuild.160101.0800).sys Meta
+++ afd-10.0.26100.7824 (WinBuild.160101.0800).sys Meta
@@ -1,44 +1,44 @@
-Program Name: afd-10.0.26100.7623 (WinBuild.160101.0800).sys
+Program Name: afd-10.0.26100.7824 (WinBuild.160101.0800).sys
Language ID: x86:LE:64:default (4.7)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 140000000
Maximum Address: ff0000184f
-# of Bytes: 735592
+# of Bytes: 739704
# of Memory Blocks: 15
-# of Instructions: 114593
-# of Defined Data: 11284
-# of Functions: 1590
-# of Symbols: 14161
+# of Instructions: 115115
+# of Defined Data: 11329
+# of Functions: 1594
+# of Symbols: 14199
# of Data Types: 398
# of Data Type Categories: 24
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.1.2
-Date Created: Fri Jul 24 14:07:40 SGT 2026
+Date Created: Fri Jul 24 14:07:46 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21236/afd-10.0.26100.7623 (WinBuild.160101.0800).sys
-Executable MD5: 1932f74bdbe80699ce0a9f56c8b70a01
-Executable SHA256: 8970f344bf8621f5a29db47a71fc3384a8f0124038807e77af680d59035f18b7
-FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21236/afd-10.0.26100.7623 (WinBuild.160101.0800).sys?MD5=1932f74bdbe80699ce0a9f56c8b70a01
+Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21236/afd-10.0.26100.7824 (WinBuild.160101.0800).sys
+Executable MD5: 80fb56d0890df92c800ace513f1f75b2
+Executable SHA256: 00793b62c568a3361366bdf34a1fb67bf186fe57c0d856e12033af87c3182944
+FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2026-21236/afd-10.0.26100.7824 (WinBuild.160101.0800).sys?MD5=80fb56d0890df92c800ace513f1f75b2
PDB Age: 1
PDB File: afd.pdb
-PDB GUID: 7bb240d0-60ab-fc99-e112-bf98429107bd
+PDB GUID: ba53c53c-26c6-1dd7-26eb-9bc9ff3ddbea
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Ancillary Function Driver for WinSock
-PE Property[FileVersion]: 10.0.26100.7623 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.7824 (WinBuild.160101.0800)
PE Property[InternalName]: afd.sys
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: afd.sys
PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.7623
+PE Property[ProductVersion]: 10.0.26100.7824
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra afd-10.0.26100.7623 (WinBuild.160101.0800).sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra afd-10.0.26100.7623 (WinBuild.160101.0800).sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra afd-10.0.26100.7623 (WinBuild.160101.0800).sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
interpretation: FUNCTION_IF_EXISTS,
applyCallingConvention: true,
applySignature: true,
demangleOnlyKnownPatterns: true,
doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra afd-10.0.26100.7824 (WinBuild.160101.0800).sys Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra afd-10.0.26100.7824 (WinBuild.160101.0800).sys Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra afd-10.0.26100.7824 (WinBuild.160101.0800).sys Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
interpretation: FUNCTION_IF_EXISTS,
applyCallingConvention: true,
applySignature: true,
demangleOnlyKnownPatterns: true,
doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|39|
|added_symbols_len|27|
|deleted_symbols_len|19|
|diff_time|21.359684467315674|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 1583, 'ExternalsName': 323, 'BulkBasicBlockMnemonicHash': 24})|
|items_to_process|87|
|diff_types|Counter({'address': 38, 'called': 32, 'code': 22, 'length': 22, 'refcount': 17, 'calling': 13, 'sig': 12, 'name': 10, 'fullname': 10})|
|unmatched_funcs_len|2|
|total_funcs_len|3184|
|matched_funcs_len|3182|
|matched_funcs_with_code_changes_len|22|
|matched_funcs_with_non_code_changes_len|17|
|matched_funcs_no_changes_len|3143|
|match_func_similarity_percent|98.7744%|
|func_match_overall_percent|99.9372%|
|first_matches|Counter({'SymbolsHash': 1583, 'BulkBasicBlockMnemonicHash': 24})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 1583
"ExternalsName" : 323
"BulkBasicBlockMnemonicHash" : 24
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 1583
"BulkBasicBlockMnemonicHash" : 24
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 39
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 27
"deleted_symbols_len" : 19
```
## Strings
*No string differences found*
# Deleted
# Added
## AFDETW_TRACECLOSE
### Function Meta
|Key|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|name|AFDETW_TRACECLOSE|
|fullname|AFDETW_TRACECLOSE|
|refcount|2|
|length|188|
|called|AFDETW_TRACESTATUS
EtwEx_tidActivityInfo
__security_check_cookie|
|calling|AfdCloseCore|
|paramcount|3|
|address|140012180|
|sig|undefined __fastcall AFDETW_TRACECLOSE(int param_1, undefined4 param_2, short * param_3)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|
```diff
--- AFDETW_TRACECLOSE
+++ AFDETW_TRACECLOSE
@@ -0,0 +1,36 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+void AFDETW_TRACECLOSE(int param_1,undefined4 param_2,short *param_3)
+
+{
+ undefined8 *puVar1;
+ undefined1 auStack_68 [32];
+ int local_48;
+ undefined8 local_38;
+ ulonglong uStack_30;
+ short *local_28;
+ undefined8 local_20;
+ ulonglong local_18;
+
+ local_18 = __security_cookie ^ (ulonglong)auStack_68;
+ if (g_AfdEtwTraceEnable != 0) {
+ local_20 = 0;
+ uStack_30 = 0;
+ if (param_3 != (short *)0x0) {
+ uStack_30 = (ulonglong)(*param_3 != -0x502f) + 1;
+ }
+ uStack_30 = uStack_30 | 0x8000000000000004;
+ puVar1 = &local_38;
+ local_38 = 0x3e90f04100003e9;
+ local_28 = param_3;
+ AFDETW_TRACESTATUS(puVar1,param_1,param_2,(longlong)param_3);
+ if (((param_3 != (short *)0x0) && (param_1 == 1)) &&
+ (Microsoft_Windows_Networking_CorrelationEnabled != 0)) {
+ local_48 = param_1;
+ EtwEx_tidActivityInfo(puVar1,&ActivityStop,&local_28);
+ }
+ }
+ return;
+}
+
```
## NTOSKRNL.EXE::RtlLogUnexpectedCodepath
### Function Meta
|Key|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|name|RtlLogUnexpectedCodepath|
|fullname|NTOSKRNL.EXE::RtlLogUnexpectedCodepath|
|refcount|2|
|length|0|
|called||
|calling|AfdBind|
|paramcount|0|
|address|EXTERNAL:00000004|
|sig|undefined RtlLogUnexpectedCodepath(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|
*No code available for NTOSKRNL.EXE::RtlLogUnexpectedCodepath*
# Modified
*Modified functions contain code changes*
## AfdBReceive
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.63|
|i_ratio|0.56|
|m_ratio|0.97|
|b_ratio|0.81|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdBReceive|AfdBReceive|
|fullname|AfdBReceive|AfdBReceive|
|refcount|2|2|
|`length`|6962|7280|
|`called`|Expand for full list:
AFDETW_TRACEABORT
AFDETW_TRACEBUFFER
AFDETW_TRACERECV
AfdBInitDrainBytesInTransport
AfdBPostDrainReceive
AfdBeginAbort
AfdGetReceiveBuffer
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdRemoveConnectionFromTimerWheel
AfdReturnBuffer
AfdTLPostUserReceive
NETIO.SYS::RtlCopyMdlToMdl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qL
_guard_dispatch_icallExpand for full list:
AFDETW_TRACEABORT
AFDETW_TRACEBUFFER
AFDETW_TRACERECV
AfdBInitDrainBytesInTransport
AfdBPostDrainReceive
AfdBeginAbort
AfdGetReceiveBuffer
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdRemoveConnectionFromTimerWheel
AfdReturnBuffer
AfdTLPostUserReceive
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NETIO.SYS::RtlCopyMdlToMdl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qL
_guard_dispatch_icall
AfdNotifyPollEventsToNotifyEvents
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLockFromDpcLevel
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject|Expand for full list:
AfdNotifyDestroyContext
AfdNotifyPollEventsToNotifyEvents
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLockAtDpcLevel
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLockFromDpcLevel
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
AfdNotifyProcessRegistration
AfdNotifySockIndicateEventsUnlock
AfdRestartFastDatagramSend
AfdTLFastDgramSend
AfdTLFastDgramSendComplete|AfdNotifyPacketCallback
AfdNotifyProcessRegistration
AfdNotifySockIndicateEventsUnlock
AfdRestartFastDatagramSend
AfdTLFastDgramSend
AfdTLFastDgramSendComplete|
|paramcount|3|3|
|`address`|14005364c|140053cac|
|sig|undefined __fastcall AfdNotifyPostEvents(longlong param_1, undefined8 param_2, char param_3)|undefined __fastcall AfdNotifyPostEvents(longlong param_1, undefined8 param_2, char param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdNotifyPostEvents Called Diff
```diff
--- AfdNotifyPostEvents called
+++ AfdNotifyPostEvents called
@@ -2,0 +3,2 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdNotifyPostEvents Diff
```diff
--- AfdNotifyPostEvents
+++ AfdNotifyPostEvents
@@ -1,111 +1,129 @@
void AfdNotifyPostEvents(longlong param_1,undefined8 param_2,char param_3)
{
longlong lVar1;
undefined8 uVar2;
char cVar3;
ushort uVar4;
- ushort uVar5;
- ushort uVar6;
+ uint uVar5;
+ ulonglong uVar6;
+ ushort uVar7;
+ ushort uVar8;
+ ushort uVar9;
lVar1 = *(longlong *)(param_1 + 0x178);
uVar2 = *(undefined8 *)(lVar1 + 0x40);
if ((*(ushort *)(lVar1 + 0x6a) & 2) == 0) {
- *(ushort *)(lVar1 + 0x6a) = *(ushort *)(lVar1 + 0x6a) | 2;
-LAB_0:
- do {
- uVar6 = *(ushort *)(lVar1 + 0x6a);
- if ((uVar6 & 1) != 0) {
- *(undefined8 *)(param_1 + 0x178) = 0;
- *(ushort *)(lVar1 + 0x6a) = *(ushort *)(lVar1 + 0x6a) & 0xfffd;
- if (param_3 == '\0') {
- KeReleaseInStackQueuedSpinLock(param_2);
+ uVar8 = *(ushort *)(lVar1 + 0x6a) | 2;
+ *(ushort *)(lVar1 + 0x6a) = uVar8;
+ while ((uVar8 & 1) == 0) {
+ uVar9 = *(ushort *)(lVar1 + 100);
+ if ((*(byte *)(lVar1 + 0x62) & 4) == 0) {
+ if ((*(byte *)(lVar1 + 0x62) & 2) == 0) {
+ uVar7 = AfdNotifyPollEventsToNotifyEvents(uVar9);
+ if ((*(byte *)(lVar1 + 99) & 8) != 0) {
+ uVar4 = AfdNotifyPollEventsToNotifyEvents(~*(ushort *)(lVar1 + 0x66) & uVar9);
+ uVar7 = uVar7 & *(ushort *)(lVar1 + 0x68) | uVar4;
+ }
+ uVar7 = uVar7 & *(ushort *)(lVar1 + 0x60);
}
else {
- KeReleaseInStackQueuedSpinLockFromDpcLevel();
- }
- AfdNotifyDestroyContext(uVar2,lVar1);
- if (param_3 != '\0') {
- KeAcquireInStackQueuedSpinLockAtDpcLevel();
- return;
- }
- KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
- return;
- }
- uVar4 = 0;
- if ((*(byte *)(lVar1 + 0x62) & 4) == 0) {
- if ((*(byte *)(lVar1 + 0x62) & 2) == 0) {
- uVar5 = *(ushort *)(lVar1 + 100);
- uVar4 = AfdNotifyPollEventsToNotifyEvents(uVar5);
- if ((*(byte *)(lVar1 + 99) & 8) != 0) {
- uVar5 = AfdNotifyPollEventsToNotifyEvents(~*(ushort *)(lVar1 + 0x66) & uVar5);
- uVar4 = uVar4 & *(ushort *)(lVar1 + 0x68) | uVar5;
- }
- uVar4 = uVar4 & *(ushort *)(lVar1 + 0x60);
+ uVar7 = 0;
}
}
else {
- uVar4 = 0x80;
+ uVar7 = 0x80;
}
- *(undefined2 *)(lVar1 + 0x66) = *(undefined2 *)(lVar1 + 100);
- uVar5 = *(ushort *)(lVar1 + 0x68);
- if (uVar4 == uVar5) {
+ uVar4 = *(ushort *)(lVar1 + 0x68);
+ *(ushort *)(lVar1 + 0x66) = uVar9;
+ if (uVar7 == uVar4) {
if ((*(byte *)(lVar1 + 99) & 1) != 0) {
- uVar6 = uVar6 | 4;
+ uVar8 = *(ushort *)(lVar1 + 0x6a) | 4;
}
-LAB_1:
- *(ushort *)(lVar1 + 0x6a) = uVar6 & 0xfffd;
+LAB_0:
+ *(ushort *)(lVar1 + 0x6a) = uVar8 & 0xfffd;
return;
}
- if ((uVar4 & uVar5) != 0) goto LAB_1;
- if (uVar5 == 0) {
- *(ushort *)(lVar1 + 0x68) = uVar4;
+ if ((uVar7 & uVar4) != 0) goto LAB_0;
+ if (uVar4 == 0) {
+ *(ushort *)(lVar1 + 0x68) = uVar7;
if (param_3 == '\0') {
KeReleaseInStackQueuedSpinLock(param_2);
}
else {
KeReleaseInStackQueuedSpinLockFromDpcLevel();
}
ObfReferenceObject(uVar2);
IoSetIoCompletionEx3
- (*(undefined8 *)(lVar1 + 0x50),*(undefined8 *)(lVar1 + 0x58),0,0,uVar4,0,lVar1,0,
+ (*(undefined8 *)(lVar1 + 0x50),*(undefined8 *)(lVar1 + 0x58),0,0,uVar7,0,lVar1,0,
AfdPriorityBoost);
if (param_3 == '\0') {
KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
}
else {
KeAcquireInStackQueuedSpinLockAtDpcLevel();
}
- goto LAB_0;
- }
- if (param_3 == '\0') {
- KeReleaseInStackQueuedSpinLock();
}
else {
- KeReleaseInStackQueuedSpinLockFromDpcLevel();
- }
- cVar3 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar1 + 0x50),lVar1);
- if (cVar3 != '\0') {
- ObfDereferenceObject(uVar2);
if (param_3 == '\0') {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
+ KeReleaseInStackQueuedSpinLock();
}
else {
- KeAcquireInStackQueuedSpinLockAtDpcLevel();
+ KeReleaseInStackQueuedSpinLockFromDpcLevel();
}
- *(undefined2 *)(lVar1 + 0x68) = 0;
- goto LAB_0;
+ cVar3 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar1 + 0x50),lVar1);
+ if (cVar3 == '\0') {
+ if (param_3 == '\0') {
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
+ }
+ else {
+ KeAcquireInStackQueuedSpinLockAtDpcLevel();
+ }
+ if (*(short *)(lVar1 + 0x68) != 0) {
+ *(ushort *)(lVar1 + 0x6a) = *(ushort *)(lVar1 + 0x6a) & 0xfffd;
+ return;
+ }
+ }
+ else {
+ ObfDereferenceObject(uVar2);
+ if (param_3 == '\0') {
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
+ }
+ else {
+ KeAcquireInStackQueuedSpinLockAtDpcLevel();
+ }
+ *(undefined2 *)(lVar1 + 0x68) = 0;
+ }
}
- if (param_3 == '\0') {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
- }
- else {
- KeAcquireInStackQueuedSpinLockAtDpcLevel();
- }
- } while (*(short *)(lVar1 + 0x68) == 0);
+ uVar8 = *(ushort *)(lVar1 + 0x6a);
+ }
+ *(undefined8 *)(param_1 + 0x178) = 0;
*(ushort *)(lVar1 + 0x6a) = *(ushort *)(lVar1 + 0x6a) & 0xfffd;
+ if (param_3 == '\0') {
+ KeReleaseInStackQueuedSpinLock(param_2);
+ }
+ else {
+ KeReleaseInStackQueuedSpinLockFromDpcLevel();
+ }
+ AfdNotifyDestroyContext(uVar2,lVar1);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar6 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar5 = (uint)uVar6;
+ }
+ else {
+ uVar5 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar5 != 0) {
+ ExFreePoolWithTag(lVar1,0x4e646641);
+ }
+ if (param_3 == '\0') {
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x38,param_2);
+ }
+ else {
+ KeAcquireInStackQueuedSpinLockAtDpcLevel();
+ }
}
return;
}
```
## AfdFastDatagramReceive
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.6|
|i_ratio|0.64|
|m_ratio|0.98|
|b_ratio|0.77|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdFastDatagramReceive|AfdFastDatagramReceive|
|fullname|AfdFastDatagramReceive|AfdFastDatagramReceive|
|refcount|4|4|
|`length`|2479|2571|
|`called`|Expand for full list:
AFDETW_START_ACTIVITY_FASTIO
AFDETW_TRACEBUFFER
AFDETW_TRACERECVDATAGRAM
AfdComputeCMSGLength32
AfdCopyMdlChainToBufferArray
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExGetPreviousMode
NTOSKRNL.EXE::ExRaiseAccessViolation
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::ProbeForWrite
WPP_SF_I
WPP_SF_qL
_guard_dispatch_icall
memcpyExpand for full list:
AFDETW_START_ACTIVITY_FASTIO
AFDETW_TRACEBUFFER
AFDETW_TRACERECVDATAGRAM
AfdComputeCMSGLength32
AfdCopyMdlChainToBufferArray
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExGetPreviousMode
NTOSKRNL.EXE::ExRaiseAccessViolation
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::ProbeForWrite
WPP_SF_I
WPP_SF_qL
_guard_dispatch_icall
memcpy
AfdFastIoRead|AfdFastIoDeviceControl
AfdFastIoRead|
|paramcount|4|4|
|`address`|140033850|140032940|
|sig|undefined8 __fastcall AfdFastDatagramReceive(short * param_1, longlong * param_2, uint param_3, undefined4 * param_4)|undefined8 __fastcall AfdFastDatagramReceive(short * param_1, longlong * param_2, uint param_3, undefined4 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdFastDatagramReceive Called Diff
```diff
--- AfdFastDatagramReceive called
+++ AfdFastDatagramReceive called
@@ -9,0 +10 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -10,0 +12 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdFastDatagramReceive Diff
```diff
--- AfdFastDatagramReceive
+++ AfdFastDatagramReceive
@@ -1,341 +1,362 @@
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
ulonglong AfdFastDatagramReceive(short *param_1,longlong *param_2,uint param_3,undefined4 *param_4)
{
ushort *puVar1;
longlong *plVar2;
ushort uVar3;
longlong *plVar4;
longlong lVar5;
bool bVar6;
- char cVar7;
- ushort uVar8;
- undefined8 uVar9;
- short *psVar10;
+ bool bVar7;
+ char cVar8;
+ ushort uVar9;
+ undefined8 uVar10;
+ short *psVar11;
void *_Src;
- ushort uVar11;
- longlong lVar12;
- code *pcVar13;
- ulonglong uVar14;
- uint uVar15;
+ ushort uVar12;
+ longlong lVar13;
+ code *pcVar14;
+ ulonglong uVar15;
+ uint uVar16;
undefined8 local_90;
undefined8 uStack_88;
undefined8 local_80;
uint local_78;
longlong local_70;
longlong *local_68;
undefined8 local_60;
undefined8 uStack_58;
undefined8 local_50;
longlong local_48;
local_90 = 0;
uStack_88 = 0;
local_80 = 0;
local_70 = 0;
if ((DAT_0 & 0x40) != 0) {
/* WARNING: Subroutine does not return */
WPP_SF_I(0x11,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1);
}
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
if ((*(byte *)((longlong)param_1 + 7) & 0x10) == 0) {
- lVar12 = 0;
+ lVar13 = 0;
if (g_AfdEtwTraceEnable != 0) {
local_70 = _DAT_1;
- lVar12 = _DAT_1;
+ lVar13 = _DAT_1;
}
if (*(int *)(param_1 + 0x4a) != 0) {
plVar2 = (longlong *)(param_1 + 0x40);
plVar4 = (longlong *)*plVar2;
lVar5 = *plVar4;
local_68 = plVar4;
if (((longlong *)plVar4[1] == plVar2) && (*(longlong **)(lVar5 + 8) == plVar4)) {
*plVar2 = lVar5;
*(longlong **)(lVar5 + 8) = plVar2;
if ((*(uint *)(plVar4 + 8) <= param_3) && (-1 < (int)plVar4[6])) {
*(int *)(param_1 + 0x4a) = *(int *)(param_1 + 0x4a) + -1;
*(int *)(param_1 + 0x48) = *(int *)(param_1 + 0x48) - (int)plVar4[8];
KeReleaseInStackQueuedSpinLock(&local_90);
- psVar10 = param_1;
- AFDETW_START_ACTIVITY_FASTIO(param_1,lVar12);
+ psVar11 = param_1;
+ AFDETW_START_ACTIVITY_FASTIO(param_1,lVar13);
if ((int)plVar4[8] != 0) {
- AFDETW_TRACEBUFFER(psVar10,lVar12,plVar4[7],0);
+ AFDETW_TRACEBUFFER(psVar11,lVar13,plVar4[7],0);
AfdCopyMdlChainToBufferArray
((uint *)*param_2,0,(int)param_2[1],(longlong *)plVar4[7],0,
*(uint *)(plVar4 + 8));
}
if (param_2[3] != 0) {
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
local_48 = plVar4[5];
- uVar15 = *(ushort *)(local_48 + 4) + 2;
+ uVar16 = *(ushort *)(local_48 + 4) + 2;
}
else {
- uVar15 = *(uint *)(plVar4 + 4);
+ uVar16 = *(uint *)(plVar4 + 4);
}
_Src = (void *)plVar4[5];
- if (*(uint *)param_2[4] < uVar15) {
+ if (*(uint *)param_2[4] < uVar16) {
/* WARNING: Subroutine does not return */
ExRaiseAccessViolation();
}
- cVar7 = ExGetPreviousMode();
- if (cVar7 != '\0') {
- ProbeForWrite(param_2[3],(ulonglong)uVar15,1);
+ cVar8 = ExGetPreviousMode();
+ if (cVar8 != '\0') {
+ ProbeForWrite(param_2[3],(ulonglong)uVar16,1);
}
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
_Src = (void *)((longlong)_Src + 6);
}
- memcpy((void *)param_2[3],_Src,(ulonglong)uVar15);
- *(uint *)param_2[4] = uVar15;
+ memcpy((void *)param_2[3],_Src,(ulonglong)uVar16);
+ *(uint *)param_2[4] = uVar16;
}
if (param_2[6] != 0) {
if (((*(uint *)(plVar4 + 3) & 0x1000) == 0) ||
- (uVar15 = *(uint *)(plVar4 + 2), uVar15 == 0)) {
- uVar15 = 0;
+ (uVar16 = *(uint *)(plVar4 + 2), uVar16 == 0)) {
+ uVar16 = 0;
}
else {
- pcVar13 = memcpy;
- cVar7 = IoIs32bitProcess(0);
- if (cVar7 != '\0') {
- uVar15 = AfdComputeCMSGLength32
+ pcVar14 = memcpy;
+ cVar8 = IoIs32bitProcess(0);
+ if (cVar8 != '\0') {
+ uVar16 = AfdComputeCMSGLength32
((longlong *)((ulonglong)*(uint *)(plVar4 + 8) + plVar4[0xb]),
- uVar15);
- pcVar13 = AfdCopyCMSGBuffer32;
- }
- if (*(uint *)param_2[6] < uVar15) {
+ uVar16);
+ pcVar14 = AfdCopyCMSGBuffer32;
+ }
+ if (*(uint *)param_2[6] < uVar16) {
/* WARNING: Subroutine does not return */
ExRaiseAccessViolation();
}
- cVar7 = ExGetPreviousMode();
- if (cVar7 != '\0') {
- ProbeForWrite(param_2[5],uVar15,1);
- }
- (*pcVar13)(param_2[5],(ulonglong)*(uint *)(plVar4 + 8) + plVar4[0xb],uVar15);
- }
- *(uint *)param_2[6] = uVar15;
+ cVar8 = ExGetPreviousMode();
+ if (cVar8 != '\0') {
+ ProbeForWrite(param_2[5],uVar16,1);
+ }
+ (*pcVar14)(param_2[5],(ulonglong)*(uint *)(plVar4 + 8) + plVar4[0xb],uVar16);
+ }
+ *(uint *)param_2[6] = uVar16;
}
if ((uint *)param_2[7] != (uint *)0x0) {
local_78 = 0;
if ((*(uint *)(plVar4 + 3) & 4) != 0) {
local_78 = 0x400;
}
if ((*(uint *)(plVar4 + 3) & 8) != 0) {
local_78 = local_78 | 0x800;
}
*(uint *)param_2[7] = local_78;
}
*(ulonglong *)(param_4 + 2) = (ulonglong)*(uint *)(plVar4 + 8);
*param_4 = 0;
AFDETW_TRACERECVDATAGRAM(0,0x1068,param_1,1);
- uVar15 = 0;
- uVar14 = *(ulonglong *)(*param_2 + 8);
+ uVar16 = 0;
+ uVar15 = *(ulonglong *)(*param_2 + 8);
AFDETW_TRACERECVDATAGRAM(1,0x1069,param_1,1);
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
*(uint *)(param_1 + 0x24) = *(uint *)(param_1 + 0x24) & 0xfffffffe;
if (*(int *)(param_1 + 0x4a) == 0) {
if (*(longlong *)(param_1 + 0xbc) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0xbc) + 100);
*puVar1 = *puVar1 & 0xfffe;
}
if ((*(uint *)(param_1 + 4) & 0x10) == 0) {
*(undefined1 *)((longlong)param_1 + 0x21) = 1;
}
}
else {
AfdIndicateEventSelectEvent(param_1,1,0);
}
bVar6 = false;
local_60 = 0;
uStack_58 = 0;
local_50 = 0;
if ((*(longlong *)(param_1 + 0xbc) != 0) &&
- (cVar7 = ExAcquireRundownProtection(param_1 + 0xc0), cVar7 != '\0')) {
+ (cVar8 = ExAcquireRundownProtection(param_1 + 0xc0), cVar8 != '\0')) {
bVar6 = true;
- lVar12 = *(longlong *)(param_1 + 0xbc);
- uVar9 = *(undefined8 *)(lVar12 + 0x40);
- uVar3 = *(ushort *)(lVar12 + 0x6a);
+ bVar7 = true;
+ lVar13 = *(longlong *)(param_1 + 0xbc);
+ uVar10 = *(undefined8 *)(lVar13 + 0x40);
+ uVar3 = *(ushort *)(lVar13 + 0x6a);
if ((uVar3 & 2) == 0) {
- uVar11 = uVar3 | 2;
- *(ushort *)(lVar12 + 0x6a) = uVar11;
+ uVar12 = uVar3 | 2;
+ *(ushort *)(lVar13 + 0x6a) = uVar12;
while ((uVar3 & 1) == 0) {
- uVar8 = AfdNotifyComputeEvents(lVar12);
- *(undefined2 *)(lVar12 + 0x66) = *(undefined2 *)(lVar12 + 100);
- uVar3 = *(ushort *)(lVar12 + 0x68);
- if (uVar8 == uVar3) {
- if ((*(byte *)(lVar12 + 99) & 1) != 0) {
- uVar11 = uVar11 | 4;
+ uVar9 = AfdNotifyComputeEvents(lVar13);
+ *(undefined2 *)(lVar13 + 0x66) = *(undefined2 *)(lVar13 + 100);
+ uVar3 = *(ushort *)(lVar13 + 0x68);
+ if (uVar9 == uVar3) {
+ if ((*(byte *)(lVar13 + 99) & 1) != 0) {
+ uVar12 = uVar12 | 4;
}
LAB_2:
- *(ushort *)(lVar12 + 0x6a) = uVar11 & 0xfffd;
- bVar6 = true;
+ *(ushort *)(lVar13 + 0x6a) = uVar12 & 0xfffd;
+ bVar7 = true;
goto LAB_3;
}
- if ((uVar3 & uVar8) != 0) goto LAB_2;
+ if ((uVar3 & uVar9) != 0) goto LAB_2;
if (uVar3 == 0) {
- *(ushort *)(lVar12 + 0x68) = uVar8;
+ *(ushort *)(lVar13 + 0x68) = uVar9;
KeReleaseInStackQueuedSpinLock(&local_90);
- ObfReferenceObject(uVar9);
- uVar15 = uVar15 & 0xffffff00;
- uVar14 = uVar14 & 0xffffffffffffff00;
+ ObfReferenceObject(uVar10);
+ uVar16 = uVar16 & 0xffffff00;
+ uVar15 = uVar15 & 0xffffffffffffff00;
IoSetIoCompletionEx3
- (*(undefined8 *)(lVar12 + 0x50),*(undefined8 *)(lVar12 + 0x58),0,0,uVar8
- ,uVar14,lVar12,uVar15,AfdPriorityBoost);
+ (*(undefined8 *)(lVar13 + 0x50),*(undefined8 *)(lVar13 + 0x58),0,0,uVar9
+ ,uVar15,lVar13,uVar16,AfdPriorityBoost);
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
}
else {
KeReleaseInStackQueuedSpinLock(&local_90);
- cVar7 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar12 + 0x50),lVar12);
- if (cVar7 == '\0') {
+ cVar8 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar13 + 0x50),lVar13);
+ if (cVar8 == '\0') {
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
- if (*(short *)(lVar12 + 0x68) != 0) {
- *(ushort *)(lVar12 + 0x6a) = *(ushort *)(lVar12 + 0x6a) & 0xfffd;
- bVar6 = true;
+ if (*(short *)(lVar13 + 0x68) != 0) {
+ *(ushort *)(lVar13 + 0x6a) = *(ushort *)(lVar13 + 0x6a) & 0xfffd;
+ bVar7 = true;
goto LAB_3;
}
}
else {
- ObfDereferenceObject(uVar9);
+ ObfDereferenceObject(uVar10);
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
- *(undefined2 *)(lVar12 + 0x68) = 0;
+ *(undefined2 *)(lVar13 + 0x68) = 0;
}
}
- uVar11 = *(ushort *)(lVar12 + 0x6a);
- uVar3 = uVar11;
+ uVar12 = *(ushort *)(lVar13 + 0x6a);
+ uVar3 = uVar12;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
- *(ushort *)(lVar12 + 0x6a) = *(ushort *)(lVar12 + 0x6a) & 0xfffd;
+ *(ushort *)(lVar13 + 0x6a) = *(ushort *)(lVar13 + 0x6a) & 0xfffd;
KeReleaseInStackQueuedSpinLock(&local_90);
- AfdNotifyDestroyContext(uVar9,lVar12);
- bVar6 = false;
+ AfdNotifyDestroyContext(uVar10,lVar13);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar15 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar16 = (uint)uVar15;
+ }
+ else {
+ uVar16 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar16 != 0) {
+ ExFreePoolWithTag(lVar13,0x4e646641);
+ }
+ bVar7 = false;
}
LAB_3:
- if (!bVar6) {
+ if (!bVar7) {
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
}
- bVar6 = true;
}
KeReleaseInStackQueuedSpinLock(&local_90);
if (bVar6) {
ExReleaseRundownProtection(param_1 + 0xc0);
}
- uVar9 = AfdReturnBuffer((longlong)plVar4,*(longlong *)(param_1 + 0x18));
- return CONCAT71((int7)((ulonglong)uVar9 >> 8),1);
+ uVar10 = AfdReturnBuffer((longlong)plVar4,*(longlong *)(param_1 + 0x18));
+ return CONCAT71((int7)((ulonglong)uVar10 >> 8),1);
}
- lVar12 = *plVar2;
- if (*(longlong **)(lVar12 + 8) == plVar2) {
- *plVar4 = lVar12;
+ lVar13 = *plVar2;
+ if (*(longlong **)(lVar13 + 8) == plVar2) {
+ *plVar4 = lVar13;
plVar4[1] = (longlong)plVar2;
- *(longlong **)(lVar12 + 8) = plVar4;
+ *(longlong **)(lVar13 + 8) = plVar4;
*plVar2 = (longlong)plVar4;
goto LAB_4;
}
}
- pcVar13 = (code *)swi(0x29);
- (*pcVar13)(3);
- pcVar13 = (code *)swi(3);
- uVar9 = (*pcVar13)();
- return uVar9;
+ pcVar14 = (code *)swi(0x29);
+ (*pcVar14)(3);
+ pcVar14 = (code *)swi(3);
+ uVar10 = (*pcVar14)();
+ return uVar10;
}
if (((*(uint *)(param_1 + 4) & 0x10) != 0) && ((*(uint *)((longlong)param_2 + 0xc) & 2) == 0)) {
*(uint *)(param_1 + 0x24) = *(uint *)(param_1 + 0x24) & 0xfffffffe;
if (*(longlong *)(param_1 + 0xbc) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0xbc) + 100);
*puVar1 = *puVar1 & 0xfffe;
}
if ((DAT_5 & 0x10) != 0) {
WPP_SF_qL(0x12,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,
*(undefined4 *)(param_1 + 0x24));
}
AFDETW_TRACERECVDATAGRAM(0,0x1015,param_1,1);
- uVar15 = 0xc00000a3;
- uVar14 = 0;
+ uVar16 = 0xc00000a3;
+ uVar15 = 0;
AFDETW_TRACERECVDATAGRAM(1,0x1016,param_1,1);
*param_4 = 0xc00000a3;
bVar6 = false;
local_60 = 0;
uStack_58 = 0;
local_50 = 0;
if ((*(longlong *)(param_1 + 0xbc) != 0) &&
- (cVar7 = ExAcquireRundownProtection(param_1 + 0xc0), cVar7 != '\0')) {
+ (cVar8 = ExAcquireRundownProtection(param_1 + 0xc0), cVar8 != '\0')) {
bVar6 = true;
- lVar12 = *(longlong *)(param_1 + 0xbc);
- uVar9 = *(undefined8 *)(lVar12 + 0x40);
- uVar3 = *(ushort *)(lVar12 + 0x6a);
+ lVar13 = *(longlong *)(param_1 + 0xbc);
+ uVar10 = *(undefined8 *)(lVar13 + 0x40);
+ uVar3 = *(ushort *)(lVar13 + 0x6a);
if ((uVar3 & 2) == 0) {
- uVar11 = uVar3 | 2;
- *(ushort *)(lVar12 + 0x6a) = uVar11;
+ uVar12 = uVar3 | 2;
+ *(ushort *)(lVar13 + 0x6a) = uVar12;
while ((uVar3 & 1) == 0) {
- uVar8 = AfdNotifyComputeEvents(lVar12);
- *(undefined2 *)(lVar12 + 0x66) = *(undefined2 *)(lVar12 + 100);
- uVar3 = *(ushort *)(lVar12 + 0x68);
- if (uVar8 == uVar3) {
- if ((*(byte *)(lVar12 + 99) & 1) != 0) {
- uVar11 = uVar11 | 4;
+ uVar9 = AfdNotifyComputeEvents(lVar13);
+ *(undefined2 *)(lVar13 + 0x66) = *(undefined2 *)(lVar13 + 100);
+ uVar3 = *(ushort *)(lVar13 + 0x68);
+ if (uVar9 == uVar3) {
+ if ((*(byte *)(lVar13 + 99) & 1) != 0) {
+ uVar12 = uVar12 | 4;
}
LAB_6:
- *(ushort *)(lVar12 + 0x6a) = uVar11 & 0xfffd;
+ *(ushort *)(lVar13 + 0x6a) = uVar12 & 0xfffd;
goto LAB_7;
}
- if ((uVar3 & uVar8) != 0) goto LAB_6;
+ if ((uVar3 & uVar9) != 0) goto LAB_6;
if (uVar3 == 0) {
- *(ushort *)(lVar12 + 0x68) = uVar8;
+ *(ushort *)(lVar13 + 0x68) = uVar9;
KeReleaseInStackQueuedSpinLock(&local_90);
- ObfReferenceObject(uVar9);
- uVar15 = uVar15 & 0xffffff00;
- uVar14 = uVar14 & 0xffffffffffffff00;
+ ObfReferenceObject(uVar10);
+ uVar16 = uVar16 & 0xffffff00;
+ uVar15 = uVar15 & 0xffffffffffffff00;
IoSetIoCompletionEx3
- (*(undefined8 *)(lVar12 + 0x50),*(undefined8 *)(lVar12 + 0x58),0,0,uVar8,
- uVar14,lVar12,uVar15,AfdPriorityBoost);
+ (*(undefined8 *)(lVar13 + 0x50),*(undefined8 *)(lVar13 + 0x58),0,0,uVar9,
+ uVar15,lVar13,uVar16,AfdPriorityBoost);
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
}
else {
KeReleaseInStackQueuedSpinLock(&local_90);
- cVar7 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar12 + 0x50),lVar12);
- if (cVar7 == '\0') {
+ cVar8 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar13 + 0x50),lVar13);
+ if (cVar8 == '\0') {
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
- if (*(short *)(lVar12 + 0x68) != 0) {
- *(ushort *)(lVar12 + 0x6a) = *(ushort *)(lVar12 + 0x6a) & 0xfffd;
+ if (*(short *)(lVar13 + 0x68) != 0) {
+ *(ushort *)(lVar13 + 0x6a) = *(ushort *)(lVar13 + 0x6a) & 0xfffd;
goto LAB_7;
}
}
else {
- ObfDereferenceObject(uVar9);
+ ObfDereferenceObject(uVar10);
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
- *(undefined2 *)(lVar12 + 0x68) = 0;
- }
- }
- uVar11 = *(ushort *)(lVar12 + 0x6a);
- uVar3 = uVar11;
+ *(undefined2 *)(lVar13 + 0x68) = 0;
+ }
+ }
+ uVar12 = *(ushort *)(lVar13 + 0x6a);
+ uVar3 = uVar12;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
- *(ushort *)(lVar12 + 0x6a) = *(ushort *)(lVar12 + 0x6a) & 0xfffd;
+ *(ushort *)(lVar13 + 0x6a) = *(ushort *)(lVar13 + 0x6a) & 0xfffd;
KeReleaseInStackQueuedSpinLock(&local_90);
bVar6 = false;
- AfdNotifyDestroyContext(uVar9,lVar12);
+ AfdNotifyDestroyContext(uVar10,lVar13);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar15 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar16 = (uint)uVar15;
+ }
+ else {
+ uVar16 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar16 != 0) {
+ ExFreePoolWithTag(lVar13,0x4e646641);
+ }
}
LAB_7:
if (!bVar6) {
KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_90);
}
bVar6 = true;
}
- uVar9 = KeReleaseInStackQueuedSpinLock(&local_90);
+ uVar10 = KeReleaseInStackQueuedSpinLock(&local_90);
if (bVar6) {
- uVar9 = ExReleaseRundownProtection(param_1 + 0xc0);
- }
- return CONCAT71((int7)((ulonglong)uVar9 >> 8),1);
+ uVar10 = ExReleaseRundownProtection(param_1 + 0xc0);
+ }
+ return CONCAT71((int7)((ulonglong)uVar10 >> 8),1);
}
}
LAB_4:
- uVar14 = KeReleaseInStackQueuedSpinLock(&local_90);
- return uVar14 & 0xffffffffffffff00;
+ uVar15 = KeReleaseInStackQueuedSpinLock(&local_90);
+ return uVar15 & 0xffffffffffffff00;
}
```
## AfdTdiCreateAO
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.92|
|i_ratio|0.68|
|m_ratio|0.98|
|b_ratio|0.97|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdTdiCreateAO|AfdTdiCreateAO|
|fullname|AfdTdiCreateAO|AfdTdiCreateAO|
|refcount|3|3|
|`length`|2774|2709|
|`called`|Expand for full list:
AfdFreeTransportInfo
AfdGetTransportInfo
AfdTdiSetDualInet
AfdTdiSetInet4Mapped
AfdTdiTlSyncIoControl
AfdTdxInitCallback
Feature_3261636923__private_IsEnabledDeviceUsageNoInline
IN6ADDR_ISUNSPECIFIED
IN6_IS_ADDR_V4MAPPED
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlAllocateExtraCreateParameter
NTOSKRNL.EXE::FsRtlAllocateExtraCreateParameterList
NTOSKRNL.EXE::FsRtlFreeExtraCreateParameterList
NTOSKRNL.EXE::FsRtlInsertExtraCreateParameter
NTOSKRNL.EXE::IoCreateFileEx
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::ZwClose
__security_check_cookie
memcpy
memsetExpand for full list:
AfdFreeTransportInfo
AfdGetTransportInfo
AfdTdiSetDualInet
AfdTdiSetInet4Mapped
AfdTdiTlSyncIoControl
AfdTdxInitCallback
IN6ADDR_ISUNSPECIFIED
IN6_IS_ADDR_V4MAPPED
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::FsRtlAllocateExtraCreateParameter
NTOSKRNL.EXE::FsRtlAllocateExtraCreateParameterList
NTOSKRNL.EXE::FsRtlFreeExtraCreateParameterList
NTOSKRNL.EXE::FsRtlInsertExtraCreateParameter
NTOSKRNL.EXE::IoCreateFileEx
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IoGetTopLevelIrp
NTOSKRNL.EXE::IoSetTopLevelIrp
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlAppendUnicodeToString
NTOSKRNL.EXE::RtlEqualUnicodeString
NTOSKRNL.EXE::RtlInitUnicodeString
NTOSKRNL.EXE::RtlPrefixUnicodeString
NTOSKRNL.EXE::ZwClose
__security_check_cookie
memcpy
memset
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::ObfDereferenceObject|Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::ObfDereferenceObject|
|calling|Expand for full list:
AfdBCommonChainedReceiveEventHandler
AfdBReceive
AfdCleanupCore
AfdCompleteBufferedSendsUnlock
AfdFastConnectionReceive
AfdFastConnectionSend
AfdFastDatagramReceive
AfdFastDatagramSend
AfdNotifyPostEvents
AfdNotifyProcessRegistration
AfdReceiveDatagram
Expand for full list:
AfdBCommonChainedReceiveEventHandler
AfdBReceive
AfdCleanupCore
AfdCompleteBufferedSendsUnlock
AfdFastConnectionReceive
AfdFastConnectionSend
AfdFastDatagramReceive
AfdFastDatagramSend
AfdNotifyPostEvents
AfdNotifyProcessRegistration
AfdReceiveDatagram
Expand for full list:
AFDETW_TRACEABORT
AFDETW_TRACESTATUS
AfdBeginAbort
AfdBeginDisconnect
AfdCleanupConnectionTimerWheelEntry
AfdCleanupReceiveDatagramIrp
AfdCleanupSuperAccept
AfdCloseConnection
AfdCloseTransportEndpoint
AfdDeleteConnectedReference
AfdDisconnectReceive
AfdFreeQueuedConnections
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdIssueDeviceControl
AfdNotifyDestroyContext
AfdRioFlushReceiveQueue
AfdRioFlushSendQueue
AfdSanHelperCleanup
AfdSanRestartRequestProcessing
AfdUnbind
NETIO.SYS::NsiDeregisterChangeNotification
NTOSKRNL.EXE::EtwWrite
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLockAtDpcLevel
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLockFromDpcLevel
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::PsGetProcessExitTime
WPP_SF_I
WPP_SF_lq
WPP_SF_lsq
WPP_SF_qiii
__security_check_cookie
_guard_dispatch_icallExpand for full list:
AFDETW_TRACEABORT
AFDETW_TRACESTATUS
AfdBeginAbort
AfdBeginDisconnect
AfdCleanupConnectionTimerWheelEntry
AfdCleanupReceiveDatagramIrp
AfdCleanupSuperAccept
AfdCloseConnection
AfdCloseTransportEndpoint
AfdDeleteConnectedReference
AfdDisconnectReceive
AfdFreeQueuedConnections
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdIssueDeviceControl
AfdNotifyDestroyContext
AfdRioFlushReceiveQueue
AfdRioFlushSendQueue
AfdSanHelperCleanup
AfdSanRestartRequestProcessing
AfdUnbind
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NETIO.SYS::NsiDeregisterChangeNotification
NTOSKRNL.EXE::EtwWrite
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLockAtDpcLevel
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLockFromDpcLevel
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::PsGetProcessExitTime
WPP_SF_I
WPP_SF_lq
WPP_SF_lsq
WPP_SF_qiii
__security_check_cookie
_guard_dispatch_icallExpand for full list:
AfdAbortTPackets
AfdCheckISBEvents
AfdCompleteTPackets
AfdEnqueueTPacketsIrp
AfdQueueTransmit
AfdReturnTpInfo
AfdTPacketsWorker
AfdTdiGetTpInfo
AfdTliGetTpInfo
AfdTransmitPackets32
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoQueryFileInformation
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfReferenceObject
RtlpCopyDeviceMemory
WPP_SF_qqL
__security_check_cookieExpand for full list:
AfdAbortTPackets
AfdCheckISBEvents
AfdCompleteTPackets
AfdEnqueueTPacketsIrp
AfdQueueTransmit
AfdReturnTpInfo
AfdTPacketsWorker
AfdTdiGetTpInfo
AfdTliGetTpInfo
AfdTransmitPackets32
Feature_TCPIP_2025_Wave4_AfdTransmit_MSRC__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoQueryFileInformation
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfReferenceObject
RtlpCopyDeviceMemory
WPP_SF_qqL
__security_check_cookieExpand for full list:
AFDETW_TRACEABORT
AFDETW_TRACEBUFFER
AFDETW_TRACEDATA_INDICATION
AFDETW_TRACERECV
AfdAddConnectionToTimerWheel
AfdBFillPendingIrps
AfdBeginAbort
AfdCloseConnection
AfdCommonRestartBufferReceive
AfdGetBuffer
AfdGetBufferTag
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdLRListAddItem
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
AfdReturnBuffer
NETIO.SYS::RtlCopyMdlToBuffer
NETIO.SYS::RtlCopyMdlToMdl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmAdvanceMdl
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_L
WPP_SF_lq
WPP_SF_qL
WPP_SF_qqL
WPP_SF_qqLPExpand for full list:
AFDETW_TRACEABORT
AFDETW_TRACEBUFFER
AFDETW_TRACEDATA_INDICATION
AFDETW_TRACERECV
AfdAddConnectionToTimerWheel
AfdBFillPendingIrps
AfdBeginAbort
AfdCloseConnection
AfdCommonRestartBufferReceive
AfdGetBuffer
AfdGetBufferTag
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdLRListAddItem
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
AfdReturnBuffer
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NETIO.SYS::RtlCopyMdlToBuffer
NETIO.SYS::RtlCopyMdlToMdl
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmAdvanceMdl
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_L
WPP_SF_lq
WPP_SF_qL
WPP_SF_qqL
WPP_SF_qqLP
AfdTLConnectedReceiveEventHandler|AfdBChainedReceiveEventHandler
AfdTLConnectedReceiveEventHandler|
|paramcount|4|4|
|`address`|14001a380|140019340|
|sig|ulonglong __fastcall AfdBCommonChainedReceiveEventHandler(undefined8 * * * * * param_1, uint param_2, undefined8 * * * * * * * param_3, undefined8 * * * param_4)|ulonglong __fastcall AfdBCommonChainedReceiveEventHandler(undefined8 * * * * * param_1, uint param_2, undefined8 * * * * * * * param_3, undefined8 * * * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdBCommonChainedReceiveEventHandler Called Diff
```diff
--- AfdBCommonChainedReceiveEventHandler called
+++ AfdBCommonChainedReceiveEventHandler called
@@ -18,0 +19 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -21,0 +23 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdBCommonChainedReceiveEventHandler Diff
```diff
--- AfdBCommonChainedReceiveEventHandler
+++ AfdBCommonChainedReceiveEventHandler
@@ -1,754 +1,764 @@
/* WARNING: Type propagation algorithm not settling */
ulonglong AfdBCommonChainedReceiveEventHandler
(undefined8 *****param_1,uint param_2,undefined8 *******param_3,
undefined8 ***param_4)
{
undefined8 *****pppppuVar1;
ushort *puVar2;
short sVar3;
int iVar4;
longlong lVar5;
longlong lVar6;
undefined8 **ppuVar7;
code *pcVar8;
bool bVar9;
char cVar10;
ushort uVar11;
undefined8 ****ppppuVar12;
ulonglong uVar13;
undefined8 *puVar14;
undefined8 uVar15;
undefined8 ***pppuVar16;
undefined8 ****ppppuVar17;
undefined8 *puVar18;
ushort uVar19;
uint uVar20;
undefined8 **ppuVar21;
undefined8 ************ppppppppppppuVar22;
undefined8 ***pppuVar23;
longlong *plVar24;
longlong *plVar25;
undefined1 *puVar26;
undefined1 *puVar27;
undefined1 *puVar28;
undefined1 *puVar29;
ushort uVar30;
undefined8 ***********pppppppppppuVar31;
undefined8 ***********pppppppppppuVar32;
undefined8 ***********pppppppppppuVar33;
undefined8 ***********pppppppppppuVar34;
int iVar35;
uint uVar36;
uint uVar37;
undefined4 uVar38;
ulonglong uVar39;
undefined8 ****ppppuVar40;
bool bVar41;
undefined8 *****local_res8;
undefined8 uStackY_130;
undefined1 auStackY_128 [8];
undefined1 auStackY_120 [24];
undefined8 in_stack_fffffffffffffef8;
char local_d8 [4];
uint local_d4;
undefined8 ***********local_d0;
undefined8 ************ppppppppppppuStack_c8;
uint local_c0;
undefined8 local_b8;
undefined8 uStack_b0;
undefined8 local_a8;
ushort local_a0;
int local_9c;
undefined8 ****local_98;
longlong local_90;
undefined8 local_88;
undefined8 local_80;
undefined8 ***local_78;
undefined8 local_70;
undefined8 local_68;
undefined8 uStack_60;
undefined8 local_58;
uVar38 = (undefined4)((ulonglong)in_stack_fffffffffffffef8 >> 0x20);
puVar26 = auStackY_128;
puVar29 = auStackY_128;
puVar28 = auStackY_128;
puVar27 = auStackY_128;
local_a8 = 0;
local_b8 = 0;
uStack_b0 = 0;
local_d0 = (undefined8 ***********)0x0;
ppppppppppppuStack_c8 = (undefined8 ************)0x0;
if ((AfdDoNotHoldNICBuffers == 0) || (bVar9 = true, (param_2 & 4) == 0)) {
bVar9 = false;
}
uVar37 = *(uint *)(*param_4 + 3);
ppppuVar40 = param_1[6];
do {
ppppuVar17 = (undefined8 ****)((longlong)ppppuVar40 + 1);
local_c0 = uVar37;
if (ppppuVar17 < (undefined8 ****)0x2) {
if (ppppuVar17 != (undefined8 ****)0x1) {
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
puVar26 = auStackY_120;
}
if ((DAT_0 & 8) != 0) {
uVar38 = *(undefined4 *)(param_1 + 6);
- *(undefined8 *)(puVar26 + -8) = 0x14001a462;
+ *(undefined8 *)(puVar26 + -8) = 0x140019422;
WPP_SF_qL(0x11,&WPP_1842c82698cc35643b675fc93d3b8d4e_Traceguids,param_1,uVar38);
}
goto LAB_1;
}
LOCK();
ppppuVar12 = param_1[6];
bVar41 = ppppuVar40 == ppppuVar12;
if (bVar41) {
param_1[6] = ppppuVar17;
ppppuVar12 = ppppuVar40;
}
UNLOCK();
ppppuVar40 = ppppuVar12;
} while (!bVar41);
ppppuVar40 = param_1[1];
if (ppppuVar40 == (undefined8 ****)0x0) {
LAB_2:
LOCK();
pppppuVar1 = param_1 + 6;
ppppuVar40 = *pppppuVar1;
*pppppuVar1 = (undefined8 ****)((longlong)*pppppuVar1 + -1);
UNLOCK();
if ((longlong)ppppuVar40 < 2) {
if (ppppuVar40 == (undefined8 ****)0x1) {
AfdCloseConnection((undefined2 *)param_1);
}
else {
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
}
}
LAB_1:
uVar13 = 0xc000021b;
}
else {
pppuVar23 = (undefined8 ***)*param_4;
uVar36 = 0;
pppuVar16 = pppuVar23;
do {
if (((undefined8 **)0xffffffff < pppuVar16[3]) ||
(uVar20 = (uint)pppuVar16[3], ~uVar20 < uVar36)) {
uVar38 = 0x1f4f;
goto LAB_3;
}
pppuVar16 = (undefined8 ***)*pppuVar16;
uVar36 = uVar36 + uVar20;
local_90 = CONCAT44(local_90._4_4_,uVar36);
} while (pppuVar16 != (undefined8 ***)0x0);
local_d4 = *(uint *)(pppuVar23 + 2);
if ((DAT_4 & 8) != 0) {
WPP_SF_qqL(0xb,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,param_1,pppuVar23[1]);
}
KeAcquireInStackQueuedSpinLock(ppppuVar40 + 7,&local_b8);
ppppuVar17 = (undefined8 ****)0xafd4;
if ((((ulonglong)*ppppuVar40 & 0xafd4) == 0xafd4) && (param_1[1] != ppppuVar40)) {
KeReleaseInStackQueuedSpinLock(&local_b8);
ppppuVar40 = param_1[1];
ppppuVar17 = ppppuVar40 + 7;
KeAcquireInStackQueuedSpinLock(ppppuVar17,&local_b8);
}
AFDETW_TRACEDATA_INDICATION
(ppppuVar17,9000,(short *)ppppuVar40,pppuVar23,CONCAT44(uVar38,uVar36),(short *)0x0);
if (((*(uint *)(ppppuVar40 + 1) >> 0x11 & 1) == 0) &&
((*(uint *)(ppppuVar40 + 1) >> 0xb & 1) == 0)) {
if ((param_2 & 1) == 0) {
if (((ulonglong)*param_1 & 0x4000000000000000) != 0) {
if ((DAT_5 & 8) != 0) {
WPP_SF_qL(0xd,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,param_1,uVar37);
}
*(uint *)((longlong)param_1 + 100) = uVar37;
LAB_6:
KeReleaseInStackQueuedSpinLock(&local_b8);
goto LAB_2;
}
if (0 < *(int *)(param_1 + 0x11)) {
if ((DAT_5 & 8) != 0) {
WPP_SF_qL(0xe,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,param_1,uVar36);
}
*(uint *)((longlong)param_1 + 100) = uVar36;
goto LAB_6;
}
if ((*(uint *)(param_1 + 0xb) != 0) && (~*(uint *)(param_1 + 0xb) < uVar36)) {
KeReleaseInStackQueuedSpinLock(&local_b8);
uVar38 = 0x1f52;
LAB_3:
uVar37 = 0xb;
goto LAB_7;
}
*(undefined4 *)((longlong)param_1 + 100) = 0;
ppppppppppppuStack_c8 = &local_d0;
local_98 = (undefined8 ****)0x0;
local_d0 = &local_d0;
local_78 = (undefined8 ***)0x0;
if ((*(uint *)(ppppuVar40 + 1) >> 8 & 1) != 0) {
while (pppuVar16 = pppuVar23,
uVar13 = AfdBFillPendingIrps((longlong)param_1,(longlong *)pppuVar16[1],
(longlong)param_3,local_d4,uVar37,
((byte)~*(byte *)((longlong)ppppuVar40 + 4) &
0xfffffffc | 0xc) << 0x1b | param_2 & 2,
(longlong *)&local_d0), pppuVar23 = pppuVar16,
local_c0 <= (int)uVar13 - local_d4) {
pppuVar23 = (undefined8 ***)*pppuVar16;
local_78 = pppuVar16;
if (pppuVar23 == (undefined8 ***)0x0) {
pppuVar23 = (undefined8 ***)0x0;
break;
}
uVar37 = *(uint *)(pppuVar23 + 3);
local_d4 = *(uint *)(pppuVar23 + 2);
local_c0 = uVar37;
}
LAB_8:
uVar39 = uVar13 & 0xffffffff;
uVar37 = (uint)uVar13;
if (uVar37 - local_d4 < local_c0) {
local_9c = 0;
if (((local_d4 < uVar37) || (pppuVar23 != (undefined8 ***)*param_4)) ||
((*(uint *)(param_1 + 0xb) <= *(uint *)(param_1 + 0x12) &&
(*(short *)(param_1 + 0xc) != -1)))) {
uVar36 = (local_d4 - uVar37) + local_c0;
if (bVar9) {
ppppuVar17 = AfdGetBuffer(uVar36,0,(longlong)param_1[4],0);
}
else {
ppppuVar17 = (undefined8 ****)AfdGetBufferTag(0,(longlong)param_1[4],0);
if (local_d4 < uVar37) {
local_98 = ppppuVar17;
}
}
if (ppppuVar17 == (undefined8 ****)0x0) {
LAB_9:
uVar36 = (uint)local_90;
goto LAB_10;
}
local_a0 = ~((short)param_2 * 2) & 4;
do {
if (bVar9) {
local_70 = 0;
RtlCopyMdlToBuffer(pppuVar23[1],uVar39,ppppuVar17[0xb],uVar36);
*(uint *)(ppppuVar17 + 8) = uVar36;
*(undefined4 *)(ppppuVar17 + 2) = 0;
pppuVar16 = (undefined8 ***)0x0;
}
else {
ppppuVar17[7] = (undefined8 ***)pppuVar23[1];
*(uint *)(ppppuVar17 + 8) = uVar36;
*(int *)(ppppuVar17 + 2) = (int)uVar39;
if ((*(uint *)(ppppuVar40 + 1) >> 8 & 1) == 0) {
pppuVar16 = (undefined8 ***)pppuVar23[-1];
*(ushort *)((longlong)ppppuVar17 + 0x4c) =
*(ushort *)((longlong)ppppuVar17 + 0x4c) | 8;
}
else {
*(ushort *)((longlong)ppppuVar17 + 0x4c) =
(ushort)(param_2 >> 1) & 2 |
*(ushort *)((longlong)ppppuVar17 + 0x4c) & 0xfffd | 0x10;
pppuVar16 = pppuVar23;
}
}
ppppuVar17[6] = pppuVar16;
ppppuVar17[3] = (undefined8 ***)((ulonglong)(local_98 == ppppuVar17) + 1);
pppppppppppuVar33 = (undefined8 ***********)param_3;
AFDETW_TRACEBUFFER(pppuVar16,0,(longlong)ppppuVar17[7],(longlong)param_3);
*(ushort *)((longlong)ppppuVar17 + 0x4c) =
*(ushort *)((longlong)ppppuVar17 + 0x4c) & 0xfffb | local_a0;
ppppuVar12 = param_1[10];
puVar29 = auStackY_128;
local_res8 = param_1;
if ((undefined8 *****)*ppppuVar12 != param_1 + 9) goto LAB_11;
ppppuVar17[1] = ppppuVar12;
iVar35 = local_9c + 1;
*ppppuVar17 = param_1 + 9;
*ppppuVar12 = ppppuVar17;
param_1[10] = ppppuVar17;
sVar3 = *(short *)(param_1 + 0xc);
*(uint *)(param_1 + 0xb) = *(int *)(param_1 + 0xb) + uVar36;
*(ushort *)(param_1 + 0xc) = sVar3 + 1U;
pppuVar23 = (undefined8 ***)*pppuVar23;
local_9c = iVar35;
pppuVar16 = (undefined8 ***)0x0;
if ((pppuVar23 == (undefined8 ***)0x0) ||
(pppuVar16 = pppuVar23, 0xfffe < (ushort)(sVar3 + 1U))) break;
uVar36 = *(uint *)(pppuVar23 + 3);
uVar39 = (ulonglong)*(uint *)(pppuVar23 + 2);
if (bVar9) {
pppppppppppuVar33 = (undefined8 ***********)0x0;
ppppuVar17 = AfdGetBuffer(uVar36,0,(longlong)param_1[4],0);
}
else {
ppppuVar17 = (undefined8 ****)AfdGetBufferTag(0,(longlong)param_1[4],0);
}
} while (ppppuVar17 != (undefined8 ****)0x0);
if (iVar35 == 0) goto LAB_9;
if (pppuVar16 != (undefined8 ***)0x0) {
do {
ppppuVar17 = param_1[10];
puVar29 = auStackY_128;
if (((undefined8 *****)*ppppuVar17 != param_1 + 9) ||
(ppppuVar12 = (undefined8 ****)ppppuVar17[1], puVar29 = auStackY_128,
(undefined8 ****)*ppppuVar12 != ppppuVar17)) goto LAB_11;
param_1[10] = ppppuVar12;
uVar19 = 0xffef;
*ppppuVar12 = param_1 + 9;
*(int *)(param_1 + 0xb) = *(int *)(param_1 + 0xb) - *(int *)(ppppuVar17 + 8);
*(short *)(param_1 + 0xc) = *(short *)(param_1 + 0xc) + -1;
if ((*(uint *)(ppppuVar40 + 1) >> 8 & 1) == 0) {
uVar19 = 0xfff7;
}
*(ushort *)((longlong)ppppuVar17 + 0x4c) =
*(ushort *)((longlong)ppppuVar17 + 0x4c) & uVar19;
AfdReturnBuffer((longlong)ppppuVar17,(longlong)param_1[4]);
iVar35 = iVar35 + -1;
} while (iVar35 != 0);
local_98 = (undefined8 ****)0x0;
uVar36 = (uint)local_90;
goto LAB_10;
}
*(undefined1 *)((longlong)ppppuVar40 + 0x21) = 0;
if (bVar9) {
local_res8 = (undefined8 *****)0x0;
}
else if ((*(uint *)(ppppuVar40 + 1) >> 8 & 1) == 0) {
local_res8 = (undefined8 *****)0x103;
}
else {
ppppuVar17 = param_1[10];
do {
ppppuVar12 = ppppuVar17 + 6;
ppppuVar17 = (undefined8 ****)ppppuVar17[1];
**ppppuVar12 = ppppuVar40[0x21] + 4;
iVar35 = iVar35 + -1;
} while (iVar35 != 0);
if ((param_2 & 4) != 0) {
AfdAddConnectionToTimerWheel((longlong)param_1,1000);
}
local_res8 = (undefined8 *****)0x0;
}
if (*(short *)((longlong)param_1 + 2) != 3) goto LAB_12;
AfdIndicateEventSelectEvent((short *)ppppuVar40,1,0);
if (ppppuVar40[0x2f] != (undefined8 ***)0x0) {
puVar2 = (ushort *)((longlong)ppppuVar40[0x2f] + 100);
*puVar2 = *puVar2 | 1;
}
uVar15 = AfdIndicatePollEvent((short *)ppppuVar40,1,0,&local_b8);
if ((char)uVar15 == '\0') {
bVar9 = false;
local_58 = 0;
local_68 = 0;
uStack_60 = 0;
if ((ppppuVar40[0x2f] == (undefined8 ***)0x0) ||
(cVar10 = ExAcquireRundownProtection(ppppuVar40 + 0x30), cVar10 == '\0')) {
LAB_13:
KeReleaseInStackQueuedSpinLock(&local_b8);
puVar27 = auStackY_128;
if (!bVar9) goto LAB_14;
}
else {
pppuVar16 = ppppuVar40[0x2f];
bVar9 = true;
uVar19 = *(ushort *)((longlong)pppuVar16 + 0x6a);
ppuVar21 = pppuVar16[8];
if ((uVar19 & 2) != 0) goto LAB_13;
uVar30 = uVar19 | 2;
*(ushort *)((longlong)pppuVar16 + 0x6a) = uVar30;
while ((uVar19 & 1) == 0) {
uVar11 = AfdNotifyComputeEvents((longlong)pppuVar16);
uVar19 = *(ushort *)(pppuVar16 + 0xd);
*(undefined2 *)((longlong)pppuVar16 + 0x66) =
*(undefined2 *)((longlong)pppuVar16 + 100);
if (uVar11 == uVar19) {
if ((*(byte *)((longlong)pppuVar16 + 99) & 1) != 0) {
uVar30 = uVar30 | 4;
}
LAB_15:
*(ushort *)((longlong)pppuVar16 + 0x6a) = uVar30 & 0xfffd;
goto LAB_16;
}
if ((uVar11 & uVar19) != 0) goto LAB_15;
if (uVar19 == 0) {
*(ushort *)(pppuVar16 + 0xd) = uVar11;
KeReleaseInStackQueuedSpinLock(&local_b8);
ObfReferenceObject(ppuVar21);
IoSetIoCompletionEx3(pppuVar16[10],pppuVar16[0xb],0);
KeAcquireInStackQueuedSpinLock(ppppuVar40 + 7,&local_b8);
}
else {
KeReleaseInStackQueuedSpinLock();
cVar10 = IoCancelMiniCompletionPacket(pppuVar16[10],pppuVar16);
if (cVar10 == '\0') {
KeAcquireInStackQueuedSpinLock(ppppuVar40 + 7,&local_b8);
if (*(short *)(pppuVar16 + 0xd) != 0) {
*(ushort *)((longlong)pppuVar16 + 0x6a) =
*(ushort *)((longlong)pppuVar16 + 0x6a) & 0xfffd;
goto LAB_16;
}
}
else {
ObfDereferenceObject(ppuVar21);
KeAcquireInStackQueuedSpinLock(ppppuVar40 + 7,&local_b8);
*(undefined2 *)(pppuVar16 + 0xd) = 0;
}
}
uVar30 = *(ushort *)((longlong)pppuVar16 + 0x6a);
uVar19 = uVar30;
}
ppppuVar40[0x2f] = (undefined8 ***)0x0;
*(ushort *)((longlong)pppuVar16 + 0x6a) =
*(ushort *)((longlong)pppuVar16 + 0x6a) & 0xfffd;
KeReleaseInStackQueuedSpinLock(&local_b8);
AfdNotifyDestroyContext(ppuVar21,(longlong)pppuVar16);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar13 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar37 = (uint)uVar13;
+ }
+ else {
+ uVar37 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar37 != 0) {
+ ExFreePoolWithTag(pppuVar16,0x4e646641);
+ }
KeAcquireInStackQueuedSpinLock(ppppuVar40 + 7,&local_b8);
LAB_16:
KeReleaseInStackQueuedSpinLock(&local_b8);
}
ExReleaseRundownProtection(ppppuVar40 + 0x30);
puVar27 = auStackY_128;
}
else {
AfdNotifySockIndicateEventsUnlock((longlong)ppppuVar40,(undefined8 *)0x0,'\0');
}
}
else {
LAB_10:
local_res8 = (undefined8 *****)0xc000021b;
if ((local_d0 != &local_d0) &&
(pppppppppppuVar34 = ppppppppppppuStack_c8, ppppppppppppuStack_c8 != &local_d0)) {
do {
ppppppppppppuVar22 = (undefined8 ************)(pppppppppppuVar34 + 1);
pppppppppppuVar33 = *ppppppppppppuVar22;
if (((ulonglong)pppppppppppuVar34[-0xf] & 0xc0000000) != 0xc0000000) {
LOCK();
pppppppppppuVar34[-8] = (undefined8 **********)AfdCancelReceive;
UNLOCK();
if (*(char *)((longlong)pppppppppppuVar34 + -100) == '\0') {
pppppppppppuVar32 = (undefined8 ***********)*pppppppppppuVar34;
puVar29 = auStackY_128;
if (((undefined8 ***********)pppppppppppuVar32[1] != pppppppppppuVar34) ||
(pppppppppppuVar31 = *ppppppppppppuVar22, puVar29 = auStackY_128,
(undefined8 ***********)*pppppppppppuVar31 != pppppppppppuVar34))
goto LAB_11;
*pppppppppppuVar31 = pppppppppppuVar32;
pppppppppppuVar32[1] = pppppppppppuVar31;
pppppppppppuVar32 = (undefined8 ***********)(param_1 + 7);
pppppppppppuVar31 = (undefined8 ***********)*pppppppppppuVar32;
puVar29 = auStackY_128;
if ((undefined8 ***********)pppppppppppuVar31[1] != pppppppppppuVar32)
goto LAB_11;
*pppppppppppuVar34 = pppppppppppuVar31;
*ppppppppppppuVar22 = pppppppppppuVar32;
pppppppppppuVar31[1] = pppppppppppuVar34;
*pppppppppppuVar32 = pppppppppppuVar34;
}
else {
LOCK();
pppppppppppuVar32 = (undefined8 ***********)pppppppppppuVar34[-8];
pppppppppppuVar34[-8] = (undefined8 ***********)0x0;
UNLOCK();
if (pppppppppppuVar32 == (undefined8 ***********)0x0) {
pppppppppppuVar32 = (undefined8 ***********)*pppppppppppuVar34;
puVar29 = auStackY_128;
if (((undefined8 ***********)pppppppppppuVar32[1] != pppppppppppuVar34) ||
(pppppppppppuVar31 = *ppppppppppppuVar22, puVar29 = auStackY_128,
(undefined8 ***********)*pppppppppppuVar31 != pppppppppppuVar34))
goto LAB_11;
*pppppppppppuVar31 = pppppppppppuVar32;
pppppppppppuVar32[1] = pppppppppppuVar31;
*pppppppppppuVar34 = (undefined8 ***********)0x0;
}
else if (*(int *)(pppppppppppuVar34[2] + 2) == 0) {
*(undefined4 *)(pppppppppppuVar34 + -0xf) = 0xc0000120;
}
else {
*(undefined4 *)(pppppppppppuVar34 + -0xf) = 0;
pppppppppppuVar34[-0xe] =
(undefined8 ***********)(ulonglong)*(uint *)(pppppppppppuVar34[2] + 2);
}
}
}
pppppppppppuVar34 = pppppppppppuVar33;
} while (pppppppppppuVar33 != &local_d0);
}
*(uint *)((longlong)param_1 + 100) = uVar36;
puVar28 = auStackY_128;
if ((*(int *)(param_1 + 0xb) == 0) &&
(puVar28 = auStackY_128, (*(uint *)((longlong)param_1 + 4) >> 0x1c & 1) == 0)) {
*(uint *)((longlong)param_1 + 4) = *(uint *)((longlong)param_1 + 4) | 0x10000000;
LOCK();
pppppuVar1 = param_1 + 6;
ppppuVar17 = *pppppuVar1;
*pppppuVar1 = (undefined8 ****)((longlong)*pppppuVar1 + 1);
UNLOCK();
puVar28 = auStackY_128;
if ((longlong)ppppuVar17 + 1 < 2) {
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
puVar28 = auStackY_120;
}
- *(undefined8 *)(puVar28 + -8) = 0x14001b0b6;
+ *(undefined8 *)(puVar28 + -8) = 0x14001a0a6;
AfdLRListAddItem((longlong)(param_1 + 0x18),AfdLRRepostReceive);
}
LAB_12:
- *(undefined8 *)(puVar28 + -8) = 0x14001b0c2;
+ *(undefined8 *)(puVar28 + -8) = 0x14001a0b2;
KeReleaseInStackQueuedSpinLock(puVar28 + 0x70);
puVar27 = puVar28;
}
LAB_14:
puVar29 = puVar27;
}
else {
KeReleaseInStackQueuedSpinLock(&local_b8);
local_res8._0_4_ = 0;
local_res8 = (undefined8 *****)0x0;
}
plVar24 = *(longlong **)(puVar29 + 0x58);
ppuVar21 = *param_4;
if (plVar24 == (longlong *)(puVar29 + 0x58)) {
uVar37 = *(uint *)(puVar29 + 0x68);
uVar38 = *(undefined4 *)(puVar29 + 0x54);
}
else {
uVar38 = *(undefined4 *)(ppuVar21 + 2);
uVar37 = *(uint *)(ppuVar21 + 3);
*(undefined4 *)(puVar29 + 0x54) = uVar38;
}
local_90 = (longlong)(int)local_res8;
while (pppppppppppuVar33 = (undefined8 ***********)0x0,
plVar24 != (longlong *)(puVar29 + 0x58)) {
if (((undefined1 *)plVar24[1] != puVar29 + 0x58) ||
(lVar5 = *plVar24, *(longlong **)(lVar5 + 8) != plVar24)) goto LAB_11;
plVar25 = plVar24 + -0x15;
*(longlong *)(puVar29 + 0x58) = lVar5;
*(undefined1 **)(lVar5 + 8) = puVar29 + 0x58;
lVar5 = plVar24[2];
if ((local_90 != -0x3ffffde5) &&
((*(uint *)(plVar24 + -0xf) & 0xc0000000) != 0xc0000000)) {
lVar6 = plVar24[-0x14];
if (lVar6 == 0) {
iVar35 = 0;
}
else {
puVar14 = ppuVar21[1];
local_80 = 0;
iVar35 = *(int *)(lVar5 + 0x10);
iVar4 = *(int *)(lVar5 + 0x20);
*(undefined8 **)(puVar29 + 0x28) = &local_80;
*(ulonglong *)(puVar29 + 0x20) = (ulonglong)uVar37;
- *(undefined8 *)(puVar29 + -8) = 0x14001b19a;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a18a;
RtlCopyMdlToMdl(puVar14,uVar38,lVar6,iVar35 - iVar4);
lVar6 = plVar24[-0x14];
iVar35 = (int)local_80;
- *(undefined8 *)(puVar29 + -8) = 0x14001b1b2;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a1a2;
AFDETW_TRACEBUFFER(puVar14,0,lVar6,(longlong)param_3);
lVar6 = plVar24[-0x14];
- *(undefined8 *)(puVar29 + -8) = 0x14001b1c1;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a1b1;
AFDETW_TRACEBUFFER(puVar14,(longlong)plVar25,lVar6,0);
plVar24[-0xe] = (ulonglong)(uint)(*(int *)(lVar5 + 0x10) + iVar35);
}
if (-1 < (char)*(undefined4 *)(lVar5 + 0x18)) {
*(int *)(puVar29 + 0x54) = *(int *)(puVar29 + 0x54) + iVar35;
uVar37 = uVar37 - iVar35;
if (((uVar37 == 0) &&
(ppuVar7 = (undefined8 **)*ppuVar21, ppuVar21 = (undefined8 **)0x0,
ppuVar7 != (undefined8 **)0x0)) &&
(ppuVar21 = ppuVar7, *(undefined1 **)(puVar29 + 0x58) != puVar29 + 0x58)) {
uVar38 = *(undefined4 *)(ppuVar7 + 2);
uVar37 = *(uint *)(ppuVar7 + 3);
*(undefined4 *)(puVar29 + 0x54) = uVar38;
goto LAB_17;
}
}
uVar38 = *(undefined4 *)(puVar29 + 0x54);
}
LAB_17:
if ((DAT_4 & 8) != 0) {
*(longlong *)(puVar29 + 0x28) = plVar24[-0xe];
*(int *)(puVar29 + 0x20) = (int)plVar24[-0xf];
- *(undefined8 *)(puVar29 + -8) = 0x14001b241;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a231;
WPP_SF_qqLP(0xf,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,ppppuVar40,plVar25);
}
lVar5 = plVar24[-0xf];
puVar29[0x48] = 1;
*(longlong **)(puVar29 + 0x40) = plVar25;
*(int *)(puVar29 + 0x38) = (int)lVar5;
*(int *)(puVar29 + 0x30) = (int)plVar24[-0xe];
*(longlong *)(puVar29 + 0x28) = plVar24[-0x14];
*(undefined4 *)(puVar29 + 0x20) = 1;
- *(undefined8 *)(puVar29 + -8) = 0x14001b27e;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a26e;
AFDETW_TRACERECV(1,0x1012,(short *)ppppuVar40,0,*(undefined4 *)(puVar29 + 0x20),
*(undefined8 *)(puVar29 + 0x28),*(undefined4 *)(puVar29 + 0x30),
*(undefined4 *)(puVar29 + 0x38),*(short **)(puVar29 + 0x40),
puVar29[0x48]);
- *(undefined8 *)(puVar29 + -8) = 0x14001b28f;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a27f;
IofCompleteRequest(plVar25,AfdPriorityBoost);
plVar24 = *(longlong **)(puVar29 + 0x58);
}
LAB_18:
if (((int)local_res8 == 0) && (puVar29[0x50] == '\0')) {
pppuVar16 = local_78;
if (local_78 == (undefined8 ***)0x0) {
pppuVar16 = param_4;
}
*pppuVar16 = pppppppppppuVar33;
}
if (local_98 != (undefined8 ****)0x0) {
LOCK();
ppppuVar40 = local_98 + 3;
pppuVar16 = *ppppuVar40;
*ppppuVar40 = (undefined8 ***)((longlong)*ppppuVar40 + -1);
UNLOCK();
if ((longlong)pppuVar16 < 2) {
if (pppuVar16 == (undefined8 ***)0x1) {
ppppuVar40 = param_1[4];
- *(undefined8 *)(puVar29 + -8) = 0x14001b2f7;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a2e7;
AfdReturnBuffer((longlong)local_98,(longlong)ppppuVar40);
}
else {
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
puVar29 = puVar29 + 8;
}
}
}
LOCK();
pppppuVar1 = param_1 + 6;
ppppuVar40 = *pppppuVar1;
*pppppuVar1 = (undefined8 ****)((longlong)*pppppuVar1 + -1);
UNLOCK();
if ((longlong)ppppuVar40 < 2) {
if (ppppuVar40 == (undefined8 ****)0x1) {
- *(undefined8 *)(puVar29 + -8) = 0x14001b319;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a309;
AfdCloseConnection((undefined2 *)param_1);
}
else {
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
puVar29 = puVar29 + 8;
}
}
if ((DAT_4 & 8) != 0) {
- *(undefined8 *)(puVar29 + -8) = 0x14001b33f;
+ *(undefined8 *)(puVar29 + -8) = 0x14001a32f;
WPP_SF_L(0x10,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,(int)local_res8);
}
return (ulonglong)local_res8 & 0xffffffff;
}
uVar13 = AfdBFillPendingIrps((longlong)param_1,(*param_4)[1],0,local_d4,uVar37,
((byte)~*(byte *)((longlong)ppppuVar40 + 4) & 0xfffffff8 | 8)
<< 0x1b | param_2 & 2,(longlong *)&local_d0);
pppppppppppuVar33 = local_d0;
if ((int)uVar13 != -1) goto LAB_8;
ppppppppppppuVar22 = (undefined8 ************)(local_d0 + -0x15);
pppppppppppuVar34 = (undefined8 ***********)local_d0[2];
*(int *)(param_1 + 0x11) = *(int *)(param_1 + 0x11) + -1;
KeReleaseInStackQueuedSpinLock(&local_b8);
if (*(int *)(pppppppppppuVar34 + 2) != 0) {
pppppppppppuVar32 = (undefined8 ***********)pppppppppppuVar33[-0x14];
uVar36 = *(int *)(pppppppppppuVar34 + 2) - *(int *)(pppppppppppuVar34 + 4);
uVar37 = *(uint *)(pppppppppppuVar32 + 5);
pppppppppppuVar31 = pppppppppppuVar32;
if (uVar37 < uVar36) {
do {
uVar36 = uVar36 - uVar37;
pppppppppppuVar32 = (undefined8 ***********)*pppppppppppuVar31;
*pppppppppppuVar31 = (undefined8 **********)0x0;
MmUnlockPages(pppppppppppuVar31);
IoFreeMdl(pppppppppppuVar31);
uVar37 = *(uint *)(pppppppppppuVar32 + 5);
pppppppppppuVar31 = pppppppppppuVar32;
} while (uVar37 < uVar36);
}
if (uVar36 != 0) {
MmAdvanceMdl(pppppppppppuVar32,uVar36);
}
pppppppppppuVar33[-0x14] = pppppppppppuVar32;
pppppppppppuVar34[4] = (undefined8 **********)(ulonglong)*(uint *)(pppppppppppuVar34 + 2);
}
pppppppppppuVar32 = (undefined8 ***********)pppppppppppuVar33[2];
pppppppppppuVar32[-2] = (undefined8 **********)AfdRestartBufferReceiveWithUserIrp;
pppppppppppuVar32[-1] = (undefined8 **********)param_1;
*(undefined1 *)((longlong)pppppppppppuVar32 + -0x45) = 0xe0;
pppppppppppuVar33 = (undefined8 ***********)pppppppppppuVar33[2];
*(undefined2 *)(pppppppppppuVar33 + -9) = 0x80f;
pppppppppppuVar33[-4] = (undefined8 **********)param_1[3];
pppppppppppuVar33[-3] = (undefined8 **********)param_1[2];
*(uint *)((longlong)pppppppppppuVar33 + -0x3c) = *(uint *)(pppppppppppuVar34 + 3) & 0x4060;
*(int *)(pppppppppppuVar33 + -8) =
*(int *)(pppppppppppuVar34 + 1) - *(int *)(pppppppppppuVar34 + 2);
LOCK();
*(int *)(ppppuVar40 + 0x1f) = *(int *)(ppppuVar40 + 0x1f) + 1;
UNLOCK();
IofCallDriver(param_1[3],ppppppppppppuVar22);
goto LAB_1;
}
uVar37 = 0;
if ((*(short *)((longlong)param_1 + 0x62) != 0x10) &&
(puVar14 = AfdGetBuffer(uVar36,0,(longlong)param_1[4],0), puVar14 != (undefined8 *)0x0)) {
puVar18 = &local_b8;
KeReleaseInStackQueuedSpinLock();
ppuVar21 = *param_4;
do {
local_88 = 0;
AFDETW_TRACEBUFFER(puVar18,0,puVar14[7],(longlong)param_3);
puVar18 = ppuVar21[1];
RtlCopyMdlToBuffer(puVar18,*(undefined4 *)(ppuVar21 + 2),(ulonglong)uVar37 + puVar14[0xb],
ppuVar21[3]);
uVar37 = uVar37 + (int)local_88;
ppuVar21 = (undefined8 **)*ppuVar21;
} while (ppuVar21 != (undefined8 **)0x0);
puVar14[6] = param_1;
*(ushort *)((longlong)puVar14 + 0x4c) =
~((short)param_2 * 2) & 4U | *(ushort *)((longlong)puVar14 + 0x4c) & 0xfffb | 1;
*(undefined4 *)(puVar14[10] + 0x30) = 0;
*(ulonglong *)(puVar14[10] + 0x38) = (ulonglong)uVar36;
AfdCommonRestartBufferReceive(puVar14,0,uVar36);
return 0;
}
KeReleaseInStackQueuedSpinLock(&local_b8);
uVar37 = 10;
uVar38 = 0x1f51;
}
else {
if ((DAT_4 & 8) != 0) {
WPP_SF_lq(0xc,&WPP_4baf20d1201f32f413bac65b914e826e_Traceguids,uVar37,ppppuVar40);
}
KeReleaseInStackQueuedSpinLock(&local_b8);
uVar38 = 0x1f50;
uVar37 = ~(*(uint *)(ppppuVar40 + 1) >> 0x11) & 1 | 0xc;
}
LAB_7:
AFDETW_TRACEABORT(2,uVar38,(short *)ppppuVar40,uVar37);
AfdBeginAbort((undefined2 *)param_1);
LOCK();
pppppuVar1 = param_1 + 6;
ppppuVar40 = *pppppuVar1;
*pppppuVar1 = (undefined8 ****)((longlong)*pppppuVar1 + -1);
UNLOCK();
if ((longlong)ppppuVar40 < 2) {
if (ppppuVar40 == (undefined8 ****)0x1) {
AfdCloseConnection((undefined2 *)param_1);
return 0;
}
pcVar8 = (code *)swi(0x29);
(*pcVar8)(0xe);
}
uVar13 = 0;
}
return uVar13;
LAB_11:
pcVar8 = (code *)swi(0x29);
(*pcVar8)(3);
puVar29 = puVar29 + 8;
goto LAB_18;
}
```
## AfdSuperAccept
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.26|
|i_ratio|0.6|
|m_ratio|0.99|
|b_ratio|0.88|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdSuperAccept|AfdSuperAccept|
|fullname|AfdSuperAccept|AfdSuperAccept|
|refcount|3|3|
|`length`|2256|2208|
|`called`|Expand for full list:
AFDETW_TRACEACCEPTEX
AFDETW_TRACEACCEPT_ERROR
AfdCleanupSuperAccept
AfdFreeQueuedConnections
AfdGetFreeConnection
AfdNotifySockIndicateEventsUnlock
AfdReplenishListenBacklog
AfdReportConnectionAllocationFailure
AfdServiceSuperAccept
AfdWaitForListen
Feature_682670395__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExQueryDepthSList
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
WPP_SF_IExpand for full list:
AFDETW_TRACEACCEPTEX
AFDETW_TRACEACCEPT_ERROR
AfdCleanupSuperAccept
AfdFreeQueuedConnections
AfdGetFreeConnection
AfdNotifySockIndicateEventsUnlock
AfdReplenishListenBacklog
AfdReportConnectionAllocationFailure
AfdServiceSuperAccept
AfdWaitForListen
NTOSKRNL.EXE::ExQueryDepthSList
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
NTOSKRNL.EXE::PsGetCurrentProcessId
WPP_SF_IExpand for full list:
AfdAllocateZeroedFromLookasideList
AfdCleanupSuperAccept
AfdCloseConnection
AfdCreateConnection
AfdGetFreeConnection
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdMapMdlChain
AfdNotifySockEventsChangedUnderLock
AfdNotifySockIndicateEventsUnlock
AfdSanInitEndpoint
AfdSanReleaseConnection
AfdServiceSuperAccept
AfdServiceWaitForListen
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IoThreadToProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
PplFreeToLookasideList
WPP_SF_
WPP_SF_I
WPP_SF_qq
memcpyExpand for full list:
AfdAllocateZeroedFromLookasideList
AfdCleanupSuperAccept
AfdCloseConnection
AfdCreateConnection
AfdGetFreeConnection
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdMapMdlChain
AfdNotifySockEventsChangedUnderLock
AfdNotifySockIndicateEventsUnlock
AfdSanInitEndpoint
AfdSanReleaseConnection
AfdServiceSuperAccept
AfdServiceWaitForListen
Feature_3923194169__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExpInterlockedPushEntrySList
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::IoGetRelatedDeviceObject
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IoThreadToProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
PplFreeToLookasideList
WPP_SF_
WPP_SF_I
WPP_SF_qq
memcpyExpand for full list:
AFDETW_TRACEACCEPTEX
AfdCloseConnection
AfdContinueSuperAccept
AfdTdi_TA4toTA6_InPlace
Feature_4190334265__private_IsEnabledDeviceUsageNoInline
Feature_682670395__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ObfDereferenceObject
memcpy
AfdCloseConnection
AfdContinueSuperAccept
AfdTdi_TA4toTA6_InPlace
Feature_4190334265__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::ObfDereferenceObject
memcpy|
|calling|||
|paramcount|3|3|
|`address`|14004a7e0|14004ae30|
|sig|undefined8 __fastcall AfdRestartSuperAcceptGetAddress(undefined8 param_1, longlong param_2, undefined2 * param_3)|undefined8 __fastcall AfdRestartSuperAcceptGetAddress(undefined8 param_1, longlong param_2, undefined2 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdRestartSuperAcceptGetAddress Called Diff
```diff
--- AfdRestartSuperAcceptGetAddress called
+++ AfdRestartSuperAcceptGetAddress called
@@ -6 +5,0 @@
-Feature_682670395__private_IsEnabledDeviceUsageNoInline
```
### AfdRestartSuperAcceptGetAddress Diff
```diff
--- AfdRestartSuperAcceptGetAddress
+++ AfdRestartSuperAcceptGetAddress
@@ -1,116 +1,113 @@
undefined8 AfdRestartSuperAcceptGetAddress(undefined8 param_1,longlong param_2,undefined2 *param_3)
{
byte *pbVar1;
longlong *plVar2;
uint uVar3;
longlong lVar4;
code *pcVar5;
char cVar6;
uint uVar7;
longlong lVar8;
longlong lVar9;
ulonglong uVar10;
undefined8 uVar11;
ushort uVar12;
+ ushort uVar13;
void *_Dst;
- ushort uVar13;
uint local_res10 [2];
lVar4 = *(longlong *)(param_2 + 0xb8);
lVar9 = *(longlong *)(*(longlong *)(lVar4 + 0x30) + 0x18);
- if ((Feature_682670395__private_featureState & 0x10) == 0) {
- Feature_682670395__private_IsEnabledDeviceUsageNoInline();
- }
if ((((*(uint *)(param_3 + 2) & 2) != 0) && (*(int *)(param_2 + 0x38) == 0x1a)) &&
(3 < *(uint *)(lVar4 + 0x18))) {
lVar8 = *(longlong *)(param_2 + 8);
local_res10[0] = *(uint *)(lVar4 + 0x18) - 4;
if ((*(byte *)(lVar8 + 10) & 5) == 0) {
lVar8 = MmMapLockedPagesSpecifyCache(lVar8,0,1,0,0,0x40000020);
}
else {
lVar8 = *(longlong *)(lVar8 + 0x18);
}
if (lVar8 != 0) {
cVar6 = AfdTdi_TA4toTA6_InPlace((int *)(lVar8 + 4),local_res10);
if (cVar6 != '\0') {
*(ulonglong *)(param_2 + 0x38) = (ulonglong)(local_res10[0] + 4);
}
}
}
LOCK();
*(int *)(lVar9 + 0xf8) = *(int *)(lVar9 + 0xf8) + -1;
UNLOCK();
if (*(char *)(param_2 + 0x41) != '\0') {
pbVar1 = (byte *)(*(longlong *)(param_2 + 0xb8) + 3);
*pbVar1 = *pbVar1 | 1;
}
IoFreeMdl(*(undefined8 *)(param_2 + 8));
lVar8 = *(longlong *)(lVar4 + 0x20);
*(longlong *)(param_2 + 8) = lVar8;
if (*(int *)(param_2 + 0x30) < 0) {
AFDETW_TRACEACCEPTEX
(1,0x17d6,*(short **)(lVar9 + 200),lVar8,*(undefined4 *)(param_2 + 0x38),
*(int *)(param_2 + 0x30),*(ushort **)(param_3 + 0x4c),lVar9);
ObfDereferenceObject(*(undefined8 *)(lVar4 + 0x30));
ObfDereferenceObject(*(undefined8 *)(param_2 + 0x98));
LOCK();
plVar2 = (longlong *)(param_3 + 0x18);
lVar4 = *plVar2;
*plVar2 = *plVar2 + -1;
UNLOCK();
if (lVar4 < 2) {
if (lVar4 == 1) {
AfdCloseConnection(param_3);
}
else {
pcVar5 = (code *)swi(0x29);
(*pcVar5)(0xe);
}
}
uVar11 = 0;
}
else {
if (*(char *)(lVar9 + 0xbc) != '\0') {
if ((*(byte *)(lVar8 + 10) & 5) == 0) {
lVar9 = MmMapLockedPages(lVar8,0);
}
else {
lVar9 = *(longlong *)(lVar8 + 0x18);
}
uVar3 = *(uint *)(lVar4 + 0x18);
_Dst = (void *)((ulonglong)*(uint *)(lVar4 + 8) + lVar9);
uVar13 = *(short *)((longlong)_Dst + 8) + 2;
if ((Feature_4190334265__private_featureState & 0x10) == 0) {
uVar10 = Feature_4190334265__private_IsEnabledDeviceUsageNoInline();
uVar7 = (uint)uVar10;
}
else {
uVar7 = Feature_4190334265__private_featureState & 1;
}
if (uVar7 == 0) {
if ((uint)(*(int *)(*(longlong *)(param_2 + 8) + 0x28) - *(int *)(lVar4 + 8)) < (uint)uVar13
) {
uVar13 = *(short *)(*(longlong *)(param_2 + 8) + 0x28) - *(short *)(lVar4 + 8);
}
}
else {
uVar12 = *(ushort *)(lVar4 + 0x18) - 10;
if (*(ushort *)(lVar4 + 0x18) < 10) {
uVar12 = 0;
}
if (uVar12 < uVar13) {
uVar13 = uVar12;
}
}
memcpy(_Dst,(void *)((longlong)_Dst + 10),(ulonglong)uVar13);
*(ushort *)(((ulonglong)uVar3 - 2) + (longlong)_Dst) = uVar13;
}
*(undefined4 *)(lVar4 + 0x18) = 0;
uVar11 = AfdContinueSuperAccept(param_2,param_3);
}
return uVar11;
}
```
## AfdCloseCore
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.17|
|i_ratio|0.3|
|m_ratio|0.91|
|b_ratio|0.46|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdCloseCore|AfdCloseCore|
|fullname|AfdCloseCore|AfdCloseCore|
|refcount|2|2|
|`length`|435|316|
|`called`|AFDETW_TRACESTATUS
AfdCloseConnection
AfdDereferenceEndpoint
AfdRioCloseRegistrationDomain
EtwEx_tidActivityInfo
NTOSKRNL.EXE::IoSetIoCompletion
WPP_SF_I
__security_check_cookie|AFDETW_TRACECLOSE
AfdCloseConnection
AfdDereferenceEndpoint
AfdRioCloseRegistrationDomain
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoSetIoCompletion
WPP_SF_I|
|calling|AfdDispatch|AfdDispatch|
|paramcount|1|1|
|`address`|140006ac8|1400150c0|
|sig|undefined8 __fastcall AfdCloseCore(ushort * param_1)|undefined8 __fastcall AfdCloseCore(ushort * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdCloseCore Called Diff
```diff
--- AfdCloseCore called
+++ AfdCloseCore called
@@ -1 +1 @@
-AFDETW_TRACESTATUS
+AFDETW_TRACECLOSE
@@ -5 +5,2 @@
-EtwEx_tidActivityInfo
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
+NTOSKRNL.EXE::ExFreePoolWithTag
@@ -8 +8,0 @@
-__security_check_cookie
```
### AfdCloseCore Diff
```diff
--- AfdCloseCore
+++ AfdCloseCore
@@ -1,97 +1,92 @@
-
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
undefined8 AfdCloseCore(ushort *param_1)
{
longlong *plVar1;
longlong lVar2;
ushort uVar3;
undefined2 *puVar4;
code *pcVar5;
- undefined1 *puVar6;
- undefined1 *puVar7;
- bool bVar8;
- undefined1 auStack_68 [8];
- undefined1 auStack_60 [24];
- undefined8 local_48;
- undefined1 local_40;
- ulonglong local_18;
+ uint uVar6;
+ ulonglong uVar7;
+ undefined1 *puVar8;
+ undefined1 auStack_38 [8];
+ undefined1 auStack_30 [24];
+ undefined8 local_18;
+ undefined1 local_10;
- local_18 = __security_cookie ^ (ulonglong)auStack_68;
- if ((DAT_0 & 4) == 0) {
- uVar3 = *param_1;
- if (((uVar3 & 0xafd2) == 0xafd2) &&
- (puVar4 = *(undefined2 **)(param_1 + 0x60), puVar4 != (undefined2 *)0x0)) {
- param_1[0x60] = 0;
- param_1[0x61] = 0;
- param_1[0x62] = 0;
- param_1[99] = 0;
- LOCK();
- plVar1 = (longlong *)(puVar4 + 0x18);
- lVar2 = *plVar1;
- *plVar1 = *plVar1 + -1;
- UNLOCK();
- puVar7 = auStack_68;
- if (lVar2 < 2) {
- if (lVar2 == 1) {
- AfdCloseConnection(puVar4);
- puVar7 = auStack_68;
- }
- else {
- pcVar5 = (code *)swi(0x29);
- (*pcVar5)(0xe);
- puVar7 = auStack_60;
- }
+ if ((DAT_0 & 4) != 0) {
+ /* WARNING: Subroutine does not return */
+ WPP_SF_I(0x13,&WPP_d2b38b0429f53b77cbd2e4881fa2ed61_Traceguids,param_1);
+ }
+ uVar3 = *param_1;
+ if (((uVar3 & 0xafd2) == 0xafd2) &&
+ (puVar4 = *(undefined2 **)(param_1 + 0x60), puVar4 != (undefined2 *)0x0)) {
+ param_1[0x60] = 0;
+ param_1[0x61] = 0;
+ param_1[0x62] = 0;
+ param_1[99] = 0;
+ LOCK();
+ plVar1 = (longlong *)(puVar4 + 0x18);
+ lVar2 = *plVar1;
+ *plVar1 = *plVar1 + -1;
+ UNLOCK();
+ puVar8 = auStack_38;
+ if (lVar2 < 2) {
+ if (lVar2 == 1) {
+ AfdCloseConnection(puVar4);
+ puVar8 = auStack_38;
}
- *(undefined2 **)(param_1 + 0xac) = puVar4;
- }
- else if (uVar3 == 0x1afd) {
- puVar7 = auStack_68;
- if (*(longlong *)(param_1 + 0x38) != 0) {
- param_1[0x34] = 0;
- param_1[0x35] = 0;
- param_1[0x36] = 0;
- param_1[0x37] = 0;
- local_40 = 0;
- local_48 = 0;
- IoSetIoCompletion(*(undefined8 *)(*(longlong *)(param_1 + 0x30) + 0x70),
- *(longlong *)(param_1 + 0x38),0xfffffff8,0);
- puVar7 = auStack_68;
+ else {
+ pcVar5 = (code *)swi(0x29);
+ (*pcVar5)(0xe);
+ puVar8 = auStack_30;
}
}
- else {
- puVar7 = auStack_68;
- if (uVar3 == 0xfa09) {
- AfdRioCloseRegistrationDomain((longlong)param_1);
- puVar7 = auStack_68;
- }
+ *(undefined2 **)(param_1 + 0xac) = puVar4;
+ }
+ else if (uVar3 == 0x1afd) {
+ puVar8 = auStack_38;
+ if (*(longlong *)(param_1 + 0x38) != 0) {
+ param_1[0x34] = 0;
+ param_1[0x35] = 0;
+ param_1[0x36] = 0;
+ param_1[0x37] = 0;
+ local_10 = 0;
+ local_18 = 0;
+ IoSetIoCompletion(*(undefined8 *)(*(longlong *)(param_1 + 0x30) + 0x70),
+ *(longlong *)(param_1 + 0x38),0xfffffff8,0);
+ puVar8 = auStack_38;
}
- bVar8 = g_AfdEtwTraceEnable != 0;
- *(undefined1 *)(param_1 + 1) = 6;
- if (bVar8) {
- *(undefined8 *)(puVar7 + 0x48) = 0;
- *(ushort **)(puVar7 + 0x40) = param_1;
- uVar3 = *param_1;
- *(undefined8 *)(puVar7 + 0x30) = 0x3e90f04100003e9;
- *(undefined8 *)(puVar7 + 0x38) = 0x8000000000000004;
- puVar7[0x34] = 4;
- puVar6 = puVar7 + 0x30;
- *(ulonglong *)(puVar7 + 0x38) = (ulonglong)(uVar3 != 0xafd1) + 1 | 0x8000000000000004;
- *(undefined8 *)(puVar7 + -8) = 0x140006be4;
- AFDETW_TRACESTATUS(puVar6,1,0x7d1,(longlong)param_1);
- if (Microsoft_Windows_Networking_CorrelationEnabled != 0) {
- *(undefined4 *)(puVar7 + 0x20) = 1;
- *(undefined8 *)(puVar7 + -8) = 0x140006c0b;
- EtwEx_tidActivityInfo(puVar6,&ActivityStop,puVar7 + 0x40);
- }
+ }
+ else {
+ puVar8 = auStack_38;
+ if (uVar3 == 0xfa09) {
+ AfdRioCloseRegistrationDomain((longlong)param_1);
+ puVar8 = auStack_38;
}
- *(undefined8 *)(puVar7 + -8) = 0x140006b41;
- AfdDereferenceEndpoint(param_1);
- *(undefined8 *)(puVar7 + -8) = 0x140006b50;
- return 0;
}
- /* WARNING: Subroutine does not return */
- WPP_SF_I(0x13,&WPP_b1761ff4e622369dcfb23f4b74cf4d6f_Traceguids,param_1);
+ *(undefined1 *)(param_1 + 1) = 6;
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar8 + -8) = 0x1400151ac;
+ uVar7 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar6 = (uint)uVar7;
+ }
+ else {
+ uVar6 = Feature_447951161__private_featureState & 1;
+ }
+ if ((uVar6 != 0) && (lVar2 = *(longlong *)(param_1 + 0xbc), lVar2 != 0)) {
+ param_1[0xbc] = 0;
+ param_1[0xbd] = 0;
+ param_1[0xbe] = 0;
+ param_1[0xbf] = 0;
+ *(undefined8 *)(puVar8 + -8) = 0x1400151d0;
+ ExFreePoolWithTag(lVar2,0x4e646641);
+ }
+ *(undefined8 *)(puVar8 + -8) = 0x1400151e7;
+ AFDETW_TRACECLOSE(1,0x7d1,(short *)param_1);
+ *(undefined8 *)(puVar8 + -8) = 0x1400151ef;
+ AfdDereferenceEndpoint(param_1);
+ return 0;
}
```
## AfdReceiveDatagram
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.67|
|i_ratio|0.67|
|m_ratio|0.98|
|b_ratio|0.84|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdReceiveDatagram|AfdReceiveDatagram|
|fullname|AfdReceiveDatagram|AfdReceiveDatagram|
|refcount|5|5|
|`length`|2506|2625|
|`called`|Expand for full list:
AFDETW_TRACEBUFFER
AFDETW_TRACERECVDATAGRAM
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReceiveDatagramProbeAndLockPages
AfdReceiveDatagramUnlockPages
AfdReturnBuffer
AfdSetupReceiveDatagramIrp
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qLExpand for full list:
AFDETW_TRACEBUFFER
AFDETW_TRACERECVDATAGRAM
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReceiveDatagramProbeAndLockPages
AfdReceiveDatagramUnlockPages
AfdReturnBuffer
AfdSetupReceiveDatagramIrp
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qLExpand for full list:
AfdDereferenceEndpoint
AfdIndicateEventSelectEvent
AfdNotifySockEventsChangedUnderLock
AfdNotifySockIndicateEventsUnlock
AfdSanInitEndpoint
AfdSanReleaseConnection
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IoThreadToProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAttachProcess
NTOSKRNL.EXE::KeDetachProcess
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
WPP_SF_qL
memcpyExpand for full list:
AfdDereferenceEndpoint
AfdIndicateEventSelectEvent
AfdNotifySockEventsChangedUnderLock
AfdNotifySockIndicateEventsUnlock
AfdSanInitEndpoint
AfdSanReleaseConnection
Feature_3923194169__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::IoAcquireCancelSpinLock
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::IoReleaseCancelSpinLock
NTOSKRNL.EXE::IoThreadToProcess
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeAttachProcess
NTOSKRNL.EXE::KeDetachProcess
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPages
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
WPP_SF_qL
memcpy
AfdServiceSuperAccept
AfdServiceWaitForListen|AfdAccept
AfdServiceSuperAccept
AfdServiceWaitForListen|
|paramcount|4|4|
|`address`|140044f40|1400453bc|
|sig|undefined8 __fastcall AfdSanAcceptCore(longlong param_1, longlong param_2, undefined2 * param_3, undefined8 * param_4)|undefined8 __fastcall AfdSanAcceptCore(longlong param_1, longlong param_2, undefined2 * param_3, undefined8 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdSanAcceptCore Called Diff
```diff
--- AfdSanAcceptCore called
+++ AfdSanAcceptCore called
@@ -6,0 +7 @@
+Feature_3923194169__private_IsEnabledDeviceUsageNoInline
```
### AfdSanAcceptCore Diff
```diff
--- AfdSanAcceptCore
+++ AfdSanAcceptCore
@@ -1,258 +1,353 @@
undefined8
AfdSanAcceptCore(longlong param_1,longlong param_2,undefined2 *param_3,undefined8 *param_4)
{
byte *pbVar1;
- short sVar2;
- ushort uVar3;
- uint uVar4;
- uint uVar5;
- ushort *puVar6;
- longlong lVar7;
- longlong lVar8;
- code *pcVar9;
- char cVar10;
- int iVar11;
- undefined8 uVar12;
+ uint uVar2;
+ longlong lVar3;
+ code *pcVar4;
+ undefined8 *puVar5;
+ char cVar6;
+ int iVar7;
+ uint uVar8;
+ uint uVar9;
+ undefined8 uVar10;
+ longlong lVar11;
+ longlong lVar12;
longlong lVar13;
- longlong lVar14;
- longlong lVar15;
- longlong lVar16;
- longlong *plVar17;
- undefined8 *puVar18;
- longlong *plVar19;
- undefined1 *puVar20;
- undefined4 *_Dst;
- uint local_res8 [2];
- longlong local_res10;
- undefined8 local_res18;
+ ulonglong uVar14;
+ longlong *plVar15;
+ ushort uVar16;
+ ushort uVar17;
+ longlong *plVar18;
+ undefined1 *puVar19;
+ ushort *puVar20;
+ undefined4 *puVar21;
+ longlong lVar22;
+ undefined1 local_res8 [8];
+ undefined4 local_res10;
+ longlong local_res18;
undefined8 *local_res20;
- undefined1 auStack_98 [8];
- undefined1 auStack_90 [24];
- undefined8 local_78;
- undefined1 local_70;
- undefined8 *local_68;
+ undefined1 auStack_a8 [8];
+ undefined1 auStack_a0 [24];
+ undefined8 local_88;
+ undefined1 local_80;
+ undefined8 *local_78;
+ undefined8 local_68;
+ longlong local_60;
longlong local_58;
longlong local_50;
- puVar20 = auStack_98;
- lVar15 = 0;
- local_res18 = 0;
- puVar6 = *(ushort **)(*(longlong *)(*(longlong *)(param_1 + 0xb8) + 0x30) + 0x18);
- lVar7 = *(longlong *)(param_2 + 0x18);
- lVar8 = *(longlong *)(param_3 + 0x14);
+ puVar19 = auStack_a8;
+ lVar13 = 0;
+ local_68 = 0;
+ puVar20 = *(ushort **)(*(longlong *)(*(longlong *)(param_1 + 0xb8) + 0x30) + 0x18);
+ local_res18 = *(longlong *)(param_2 + 0x18);
+ lVar3 = *(longlong *)(param_3 + 0x14);
*(undefined8 *)(param_3 + 0x14) = 0;
- *(uint *)(puVar6 + 0x24) = *(uint *)(puVar6 + 0x24) & 0xffffff7f;
- local_res10 = param_2;
+ *(uint *)(puVar20 + 0x24) = *(uint *)(puVar20 + 0x24) & 0xffffff7f;
local_res20 = param_4;
- local_58 = lVar8;
+ local_58 = lVar3;
if ((DAT_0 & 0x10) != 0) {
- WPP_SF_qL(0x33,&WPP_b1893ce3e4e03974ce237ee1d23f932c_Traceguids,puVar6,
- *(undefined4 *)(puVar6 + 0x24));
- }
- if (*(ushort **)(puVar6 + 0x30) == puVar6 + 0x30) {
- AfdNotifySockEventsChangedUnderLock((longlong)puVar6,0,0x80);
+ WPP_SF_qL(0x33,&WPP_d87f5cfd203e31ba1feb40bae02b1e31_Traceguids,puVar20,
+ *(undefined4 *)(puVar20 + 0x24));
+ }
+ if (*(ushort **)(puVar20 + 0x30) == puVar20 + 0x30) {
+ AfdNotifySockEventsChangedUnderLock((longlong)puVar20,0,0x80);
}
else {
- AfdIndicateEventSelectEvent((short *)puVar6,0x80,0);
+ AfdIndicateEventSelectEvent((short *)puVar20,0x80,0);
}
*(undefined8 *)(param_3 + 4) = 0;
*(uint *)(param_3 + 2) = *(uint *)(param_3 + 2) & 0xdfffffff;
LOCK();
- lVar13 = *(longlong *)(lVar8 + 0x68);
- *(longlong *)(lVar8 + 0x68) = 0;
+ lVar11 = *(longlong *)(lVar3 + 0x68);
+ *(longlong *)(lVar3 + 0x68) = 0;
UNLOCK();
- if (lVar13 == 0) {
- AfdNotifySockIndicateEventsUnlock((longlong)puVar6,param_4,'\0');
- AfdSanReleaseConnection((longlong)puVar6,param_3,'\0');
- AfdDereferenceEndpoint(puVar6);
- *(undefined4 *)(lVar8 + 0x30) = 0xc0000120;
+ if (lVar11 == 0) {
+ AfdNotifySockIndicateEventsUnlock((longlong)puVar20,param_4,'\0');
+ AfdSanReleaseConnection((longlong)puVar20,param_3,'\0');
+ AfdDereferenceEndpoint(puVar20);
+ *(undefined4 *)(lVar3 + 0x30) = 0xc0000120;
LAB_1:
- *(undefined8 *)(lVar8 + 0x38) = 0;
- IofCompleteRequest(lVar8,AfdPriorityBoost);
- uVar12 = 0xc000013c;
+ *(undefined8 *)(lVar3 + 0x38) = 0;
+ IofCompleteRequest(lVar3,AfdPriorityBoost);
+ uVar10 = 0xc000013c;
}
else {
- AfdNotifySockIndicateEventsUnlock((longlong)puVar6,param_4,'\0');
- AfdSanReleaseConnection((longlong)puVar6,param_3,'\0');
- AfdDereferenceEndpoint(puVar6);
- lVar13 = IoThreadToProcess(*(undefined8 *)(param_1 + 0x98));
- lVar14 = IoThreadToProcess(*(undefined8 *)(lVar8 + 0x98));
- if (lVar13 == lVar14) {
- local_res18 = *(undefined8 *)(param_1 + 0x90);
+ AfdNotifySockIndicateEventsUnlock((longlong)puVar20,param_4,'\0');
+ AfdSanReleaseConnection((longlong)puVar20,param_3,'\0');
+ AfdDereferenceEndpoint(puVar20);
+ lVar11 = IoThreadToProcess(*(undefined8 *)(param_1 + 0x98));
+ lVar12 = IoThreadToProcess(*(undefined8 *)(lVar3 + 0x98));
+ if (lVar11 == lVar12) {
+ local_68 = *(undefined8 *)(param_1 + 0x90);
local_50 = 0;
}
else {
- lVar15 = IoThreadToProcess(*(undefined8 *)(lVar8 + 0x98));
- local_50 = lVar15;
- KeAttachProcess(lVar15);
- local_68 = &local_res18;
- local_70 = 1;
- local_78 = *(undefined8 *)IoFileObjectType_exref;
- iVar11 = ObOpenObjectByPointer(local_res10,0x40,0,0x2000000);
+ lVar13 = IoThreadToProcess(*(undefined8 *)(lVar3 + 0x98));
+ local_50 = lVar13;
+ KeAttachProcess(lVar13);
+ local_78 = &local_68;
+ local_80 = 1;
+ local_88 = *(undefined8 *)IoFileObjectType_exref;
+ iVar7 = ObOpenObjectByPointer(param_2,0x40,0,0x2000000);
KeDetachProcess();
- if (iVar11 < 0) {
- *(undefined4 *)(lVar8 + 0x30) = 0xc0000008;
+ if (iVar7 < 0) {
+ *(undefined4 *)(lVar3 + 0x30) = 0xc0000008;
goto LAB_1;
}
}
- KeAcquireInStackQueuedSpinLock(lVar7 + 0x38,param_4);
+ puVar5 = local_res20;
+ KeAcquireInStackQueuedSpinLock(local_res18 + 0x38,local_res20);
LOCK();
*(code **)(param_1 + 0x68) = AfdSanCancelAccept;
UNLOCK();
- if (((*(uint *)(lVar7 + 8) & 0x800) == 0) && (*(char *)(param_1 + 0x44) == '\0')) {
+ if (((*(uint *)(local_res18 + 8) & 0x800) == 0) && (*(char *)(param_1 + 0x44) == '\0')) {
pbVar1 = (byte *)(*(longlong *)(param_1 + 0xb8) + 3);
*pbVar1 = *pbVar1 | 1;
- lVar13 = *(longlong *)(param_1 + 0xb8);
- local_res8[0] = *(uint *)(lVar13 + 8);
- lVar14 = *(longlong *)(lVar8 + 0x18);
- *(undefined8 *)(lVar7 + 0x160) = 0;
- AfdSanInitEndpoint(*(longlong *)(*(longlong *)(*(longlong *)(lVar8 + 0xb8) + 0x30) + 0x18),
- local_res10,*(undefined8 *)(lVar14 + 8));
- if (lVar15 != 0) {
- *(undefined1 *)(lVar7 + 0xa0) = 1;
- }
- plVar17 = (longlong *)(param_1 + 0xa8);
- lVar16 = lVar7 + 0x80;
- plVar19 = *(longlong **)(lVar7 + 0x88);
- if (*plVar19 != lVar16) {
- plVar17 = (longlong *)0x3;
- pcVar9 = (code *)swi(0x29);
- lVar16 = (*pcVar9)();
- puVar20 = auStack_90;
- }
- *plVar17 = lVar16;
- plVar17[1] = (longlong)plVar19;
- *plVar19 = (longlong)plVar17;
- *(longlong **)(lVar16 + 8) = plVar17;
- if (*(int *)(lVar13 + 0x10) != 0) {
- sVar2 = *(short *)(lVar14 + 0x14);
- *(short *)(puVar20 + 0xa8) = sVar2;
- lVar16 = *(longlong *)(param_1 + 8);
- if (*(char *)(lVar7 + 0xbc) == '\0') {
- if ((*(byte *)(lVar16 + 10) & 5) == 0) {
- *(undefined8 *)(puVar20 + -8) = 0x1400452bb;
- lVar16 = MmMapLockedPages(lVar16,0);
- }
- else {
- lVar16 = *(longlong *)(lVar16 + 0x18);
- }
- uVar4 = *(uint *)(lVar13 + 0x18);
- uVar5 = *(uint *)(lVar13 + 8);
- *(undefined8 *)(puVar20 + -8) = 0x1400452e6;
- memcpy((void *)((ulonglong)uVar5 + (ulonglong)uVar4 + lVar16),(void *)(lVar14 + 0x10),
- (ulonglong)*(ushort *)(puVar20 + 0xa8) + 8);
+ lVar11 = *(longlong *)(param_1 + 0xb8);
+ local_res10 = *(undefined4 *)(lVar11 + 8);
+ local_60 = *(longlong *)(lVar3 + 0x18);
+ *(undefined8 *)(local_res18 + 0x160) = 0;
+ AfdSanInitEndpoint(*(longlong *)(*(longlong *)(*(longlong *)(lVar3 + 0xb8) + 0x30) + 0x18),
+ param_2,*(undefined8 *)(local_60 + 8));
+ if (lVar13 != 0) {
+ *(undefined1 *)(local_res18 + 0xa0) = 1;
+ }
+ plVar15 = (longlong *)(param_1 + 0xa8);
+ lVar12 = local_res18 + 0x80;
+ plVar18 = *(longlong **)(local_res18 + 0x88);
+ lVar22 = local_res18;
+ if (*plVar18 != lVar12) {
+ plVar15 = (longlong *)0x3;
+ pcVar4 = (code *)swi(0x29);
+ lVar12 = (*pcVar4)();
+ puVar19 = auStack_a0;
+ }
+ *plVar15 = lVar12;
+ plVar15[1] = (longlong)plVar18;
+ *plVar18 = (longlong)plVar15;
+ *(longlong **)(lVar12 + 8) = plVar15;
+ if (*(int *)(lVar11 + 0x10) != 0) {
+ if ((Feature_3923194169__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x1400456a2;
+ uVar14 = Feature_3923194169__private_IsEnabledDeviceUsageNoInline();
+ uVar8 = (uint)uVar14;
+ lVar22 = *(longlong *)(puVar19 + 0xc0);
}
else {
- *(short *)(puVar20 + 0xa8) = sVar2 + 2;
- if ((*(byte *)(lVar16 + 10) & 5) == 0) {
- *(undefined8 *)(puVar20 + -8) = 0x14004522c;
- lVar16 = MmMapLockedPages(lVar16,0);
+ uVar8 = Feature_3923194169__private_featureState & 1;
+ }
+ if ((uVar8 == 0) || (0xb < *(uint *)(lVar11 + 0x10))) {
+ uVar8 = *(ushort *)(*(longlong *)(puVar19 + 0x48) + 0x14) + 8;
+ if (*(char *)(lVar22 + 0xbc) == '\0') {
+ if ((Feature_3923194169__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x1400457d3;
+ uVar14 = Feature_3923194169__private_IsEnabledDeviceUsageNoInline();
+ uVar9 = (uint)uVar14;
+ }
+ else {
+ uVar9 = Feature_3923194169__private_featureState & 1;
+ }
+ if ((uVar9 != 0) && (*(uint *)(lVar11 + 0x10) < uVar8)) {
+ uVar8 = *(uint *)(lVar11 + 0x10);
+ }
+ lVar12 = *(longlong *)(param_1 + 8);
+ if ((*(byte *)(lVar12 + 10) & 5) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x1400457fa;
+ lVar12 = MmMapLockedPages(lVar12,0);
+ }
+ else {
+ lVar12 = *(longlong *)(lVar12 + 0x18);
+ }
+ lVar22 = *(longlong *)(puVar19 + 0x48);
+ uVar9 = *(uint *)(lVar11 + 0x18);
+ uVar2 = *(uint *)(lVar11 + 8);
+ *(undefined8 *)(puVar19 + -8) = 0x140045820;
+ memcpy((void *)((ulonglong)uVar2 + (ulonglong)uVar9 + lVar12),(void *)(lVar22 + 0x10),
+ (ulonglong)uVar8);
}
else {
- lVar16 = *(longlong *)(lVar16 + 0x18);
- }
- uVar4 = *(uint *)(lVar13 + 0x18);
- uVar5 = *(uint *)(lVar13 + 0x10);
- *(ulonglong *)(puVar20 + 0x58) = (ulonglong)*(uint *)(lVar13 + 8);
- *(ulonglong *)(puVar20 + 0x50) = (ulonglong)uVar5 + lVar16 + (ulonglong)uVar4;
- lVar16 = *(longlong *)(param_1 + 8);
- if ((*(byte *)(lVar16 + 10) & 5) == 0) {
- *(undefined8 *)(puVar20 + -8) = 0x140045266;
- lVar16 = MmMapLockedPages(lVar16,0);
+ uVar16 = *(ushort *)(*(longlong *)(puVar19 + 0x48) + 0x14) + 2;
+ uVar8 = (uint)uVar16;
+ *(uint *)(puVar19 + 0xb0) = (uint)uVar16;
+ if ((Feature_3923194169__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x1400456f7;
+ uVar14 = Feature_3923194169__private_IsEnabledDeviceUsageNoInline();
+ uVar9 = (uint)uVar14;
+ uVar8 = *(uint *)(puVar19 + 0xb0);
+ }
+ else {
+ uVar9 = Feature_3923194169__private_featureState & 1;
+ }
+ if ((uVar9 == 0) ||
+ ((ulonglong)(uVar8 & 0xffff) <= (ulonglong)*(uint *)(lVar11 + 0x10) - 2)) {
+ uVar8 = *(uint *)(puVar19 + 0xb0);
+ }
+ else {
+ uVar8 = (uint)(ushort)(*(short *)(lVar11 + 0x10) - 2);
+ }
+ lVar12 = *(longlong *)(param_1 + 8);
+ if ((*(byte *)(lVar12 + 10) & 5) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x140045742;
+ lVar12 = MmMapLockedPages(lVar12,0);
+ }
+ else {
+ lVar12 = *(longlong *)(lVar12 + 0x18);
+ }
+ uVar9 = *(uint *)(lVar11 + 0x18);
+ uVar2 = *(uint *)(lVar11 + 8);
+ *(ulonglong *)(puVar19 + 0x60) = (ulonglong)*(uint *)(lVar11 + 0x10);
+ *(ulonglong *)(puVar19 + 0xb0) = (ulonglong)uVar2 + lVar12 + (ulonglong)uVar9;
+ lVar12 = *(longlong *)(param_1 + 8);
+ if ((*(byte *)(lVar12 + 10) & 5) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x14004577f;
+ lVar12 = MmMapLockedPages(lVar12,0);
+ }
+ else {
+ lVar12 = *(longlong *)(lVar12 + 0x18);
+ }
+ uVar9 = *(uint *)(lVar11 + 0x18);
+ uVar2 = *(uint *)(lVar11 + 8);
+ *(undefined8 *)(puVar19 + -8) = 0x1400457a5;
+ memcpy((void *)((ulonglong)uVar2 + (ulonglong)uVar9 + lVar12),
+ (void *)(*(longlong *)(puVar19 + 0x48) + 0x16),(ulonglong)(uVar8 & 0xffff));
+ *(short *)(*(longlong *)(puVar19 + 0x60) + -2 + *(longlong *)(puVar19 + 0xb0)) =
+ (short)uVar8;
+ lVar22 = *(longlong *)(puVar19 + 0x48);
+ }
+ if ((Feature_3923194169__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x140045834;
+ uVar14 = Feature_3923194169__private_IsEnabledDeviceUsageNoInline();
+ uVar8 = (uint)uVar14;
}
else {
- lVar16 = *(longlong *)(lVar16 + 0x18);
- }
- uVar4 = *(uint *)(lVar13 + 0x18);
- uVar5 = *(uint *)(lVar13 + 8);
- *(undefined8 *)(puVar20 + -8) = 0x14004528d;
- memcpy((void *)((ulonglong)uVar5 + (ulonglong)uVar4 + lVar16),(void *)(lVar14 + 0x16),
- (ulonglong)*(ushort *)(puVar20 + 0xa8));
- *(undefined2 *)(*(longlong *)(puVar20 + 0x58) + -2 + *(longlong *)(puVar20 + 0x50)) =
- *(undefined2 *)(puVar20 + 0xa8);
+ uVar8 = Feature_3923194169__private_featureState & 1;
+ }
+ uVar9 = *(uint *)(lVar11 + 0x18);
+ if (uVar8 == 0) {
+ if (uVar9 != 0) {
+ lVar22 = lVar22 + (ulonglong)*(ushort *)(lVar22 + 0x14);
+ lVar12 = *(longlong *)(param_1 + 8);
+ if ((*(byte *)(lVar12 + 10) & 5) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x14004595b;
+ lVar12 = MmMapLockedPages(lVar12,0);
+ }
+ else {
+ lVar12 = *(longlong *)(lVar12 + 0x18);
+ }
+ puVar21 = (undefined4 *)((ulonglong)*(uint *)(lVar11 + 8) + lVar12);
+ if (*(char *)(*(longlong *)(puVar19 + 0xc0) + 0xbc) == '\0') {
+ *puVar21 = 0;
+ puVar21[1] = 1;
+ uVar16 = *(ushort *)(lVar22 + 0x18);
+ *(undefined8 *)(puVar19 + -8) = 0x1400459c5;
+ memcpy(puVar21 + 2,(void *)(lVar22 + 0x18),(ulonglong)uVar16 + 4);
+ }
+ else {
+ uVar8 = *(uint *)(lVar11 + 0x18);
+ uVar16 = *(ushort *)(lVar22 + 0x18);
+ *(undefined8 *)(puVar19 + -8) = 0x140045996;
+ memcpy(puVar21,(void *)(lVar22 + 0x1a),(ulonglong)uVar16 + 2);
+ *(short *)(((ulonglong)uVar8 - 2) + (longlong)puVar21) =
+ *(short *)(lVar22 + 0x18) + 2;
+ }
+ }
+ }
+ else if (5 < uVar9) {
+ uVar14 = (ulonglong)(uVar9 & 0xffff);
+ *(short *)(puVar19 + 0xb0) = (short)uVar9;
+ puVar20 = (ushort *)((ulonglong)*(ushort *)(lVar22 + 0x14) + 0x18 + lVar22);
+ *(ushort **)(puVar19 + 0x60) = puVar20;
+ lVar12 = *(longlong *)(param_1 + 8);
+ if ((*(byte *)(lVar12 + 10) & 5) == 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x14004587f;
+ lVar12 = MmMapLockedPages(lVar12,0);
+ uVar14 = (ulonglong)*(ushort *)(puVar19 + 0xb0);
+ puVar20 = *(ushort **)(puVar19 + 0x60);
+ }
+ else {
+ lVar12 = *(longlong *)(lVar12 + 0x18);
+ }
+ puVar21 = (undefined4 *)((ulonglong)*(uint *)(lVar11 + 8) + lVar12);
+ uVar16 = *puVar20;
+ if (*(char *)(*(longlong *)(puVar19 + 0xc0) + 0xbc) == '\0') {
+ *puVar21 = 0;
+ puVar21[1] = 1;
+ uVar17 = uVar16 + 4;
+ if ((int)uVar14 + -8 <= (int)(uVar16 + 4)) {
+ uVar17 = (short)uVar14 - 8;
+ }
+ *(undefined8 *)(puVar19 + -8) = 0x14004592c;
+ memcpy(puVar21 + 2,puVar20,(ulonglong)uVar17);
+ }
+ else {
+ uVar17 = uVar16 + 2;
+ if (uVar14 - 2 <= (ulonglong)uVar16 + 2) {
+ uVar17 = (short)uVar14 - 2;
+ }
+ uVar8 = *(uint *)(lVar11 + 0x18);
+ *(undefined8 *)(puVar19 + -8) = 0x1400458e4;
+ memcpy(puVar21,puVar20 + 1,(ulonglong)uVar17);
+ *(ushort *)(((ulonglong)uVar8 - 2) + (longlong)puVar21) = uVar17;
+ }
+ }
}
- if (*(int *)(lVar13 + 0x18) != 0) {
- lVar14 = lVar14 + (ulonglong)*(ushort *)(lVar14 + 0x14);
- lVar16 = *(longlong *)(param_1 + 8);
- if ((*(byte *)(lVar16 + 10) & 5) == 0) {
- *(undefined8 *)(puVar20 + -8) = 0x140045311;
- lVar16 = MmMapLockedPages(lVar16,0);
- }
- else {
- lVar16 = *(longlong *)(lVar16 + 0x18);
- }
- _Dst = (undefined4 *)((ulonglong)*(uint *)(lVar13 + 8) + lVar16);
- if (*(char *)(lVar7 + 0xbc) == '\0') {
- *_Dst = 0;
- _Dst[1] = 1;
- uVar3 = *(ushort *)(lVar14 + 0x18);
- *(undefined8 *)(puVar20 + -8) = 0x14004537a;
- memcpy(_Dst + 2,(void *)(lVar14 + 0x18),(ulonglong)uVar3 + 4);
- }
- else {
- uVar4 = *(uint *)(lVar13 + 0x18);
- uVar3 = *(ushort *)(lVar14 + 0x18);
- *(undefined8 *)(puVar20 + -8) = 0x140045345;
- memcpy(_Dst,(void *)(lVar14 + 0x1a),(ulonglong)uVar3 + 2);
- *(short *)(((ulonglong)uVar4 - 2) + (longlong)_Dst) = *(short *)(lVar14 + 0x18) + 2;
- }
- }
- }
- *(undefined8 *)(puVar20 + -8) = 0x140045389;
- KeReleaseInStackQueuedSpinLock(*(undefined8 *)(puVar20 + 0xb8));
- if (lVar15 != 0) {
- *(undefined8 *)(puVar20 + -8) = 0x14004539d;
- KeAttachProcess(lVar15);
- }
- *(undefined8 *)(puVar20 + -8) = 0x1400453ad;
- cVar10 = IoIs32bitProcess(lVar8);
- puVar18 = (undefined8 *)
- ((ulonglong)*(uint *)(*(longlong *)(lVar8 + 8) + 0x2c) +
- *(longlong *)(*(longlong *)(lVar8 + 8) + 0x20));
- if (cVar10 == '\0') {
- *puVar18 = *(undefined8 *)(puVar20 + 0xb0);
- *(undefined4 *)(puVar18 + 1) = *(undefined4 *)(puVar20 + 0xa0);
- *(undefined8 *)(lVar8 + 0x38) = 0x10;
+ }
+ *(undefined8 *)(puVar19 + -8) = 0x1400459d9;
+ KeReleaseInStackQueuedSpinLock(*(undefined8 *)(puVar19 + 200));
+ if (lVar13 != 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x1400459ed;
+ KeAttachProcess(lVar13);
+ }
+ *(undefined8 *)(puVar19 + -8) = 0x1400459fd;
+ cVar6 = IoIs32bitProcess(lVar3);
+ uVar14 = (ulonglong)*(uint *)(*(longlong *)(lVar3 + 8) + 0x2c);
+ lVar11 = *(longlong *)(*(longlong *)(lVar3 + 8) + 0x20);
+ if (cVar6 == '\0') {
+ *(undefined8 *)(uVar14 + lVar11) = *(undefined8 *)(puVar19 + 0x40);
+ *(undefined4 *)(uVar14 + 8 + lVar11) = *(undefined4 *)(puVar19 + 0xb8);
+ *(undefined8 *)(lVar3 + 0x38) = 0x10;
}
else {
- *(int *)puVar18 = (int)*(undefined8 *)(puVar20 + 0xb0);
- *(undefined4 *)((longlong)puVar18 + 4) = *(undefined4 *)(puVar20 + 0xa0);
- *(undefined8 *)(lVar8 + 0x38) = 8;
- }
- *(uint *)(lVar8 + 0x30) = -(uint)(lVar15 != 0) & 0x105;
- if (lVar15 != 0) {
- *(undefined8 *)(puVar20 + -8) = 0x14004541d;
+ *(int *)(uVar14 + lVar11) = (int)*(undefined8 *)(puVar19 + 0x40);
+ *(undefined4 *)(uVar14 + 4 + lVar11) = *(undefined4 *)(puVar19 + 0xb8);
+ *(undefined8 *)(lVar3 + 0x38) = 8;
+ }
+ *(uint *)(lVar3 + 0x30) = -(uint)(lVar13 != 0) & 0x105;
+ if (lVar13 != 0) {
+ *(undefined8 *)(puVar19 + -8) = 0x140045a70;
KeDetachProcess();
}
- *(undefined8 *)(puVar20 + -8) = 0x140045432;
- IofCompleteRequest(lVar8,AfdPriorityBoost);
- uVar12 = 0x103;
+ *(undefined8 *)(puVar19 + -8) = 0x140045a85;
+ IofCompleteRequest(lVar3,AfdPriorityBoost);
+ uVar10 = 0x103;
}
else {
*(undefined8 *)(param_1 + 0xa8) = 0;
- KeReleaseInStackQueuedSpinLock(param_4);
- if (lVar15 != 0) {
- KeAttachProcess(lVar15);
- ObCloseHandle(local_res18,1);
+ KeReleaseInStackQueuedSpinLock(puVar5);
+ if (lVar13 != 0) {
+ KeAttachProcess(lVar13);
+ ObCloseHandle(local_68,1);
KeDetachProcess();
}
- *(undefined4 *)(lVar8 + 0x30) = 0xc0000120;
- *(undefined8 *)(lVar8 + 0x38) = 0;
- IofCompleteRequest(lVar8,AfdPriorityBoost);
+ *(undefined4 *)(lVar3 + 0x30) = 0xc0000120;
+ *(undefined8 *)(lVar3 + 0x38) = 0;
+ IofCompleteRequest(lVar3,AfdPriorityBoost);
LOCK();
- lVar7 = *(longlong *)(param_1 + 0x68);
+ lVar3 = *(longlong *)(param_1 + 0x68);
*(longlong *)(param_1 + 0x68) = 0;
UNLOCK();
- if (lVar7 == 0) {
- local_res8[0] = local_res8[0] & 0xffffff00;
+ if (lVar3 == 0) {
+ local_res8[0] = 0;
IoAcquireCancelSpinLock(local_res8);
- IoReleaseCancelSpinLock((undefined1)local_res8[0]);
- }
- uVar12 = 0xc0000120;
+ IoReleaseCancelSpinLock(local_res8[0]);
+ }
+ uVar10 = 0xc0000120;
}
}
- return uVar12;
+ return uVar10;
}
```
## AfdNotifyProcessRegistration
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.48|
|i_ratio|0.17|
|m_ratio|0.98|
|b_ratio|0.23|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdNotifyProcessRegistration|AfdNotifyProcessRegistration|
|fullname|AfdNotifyProcessRegistration|AfdNotifyProcessRegistration|
|refcount|2|2|
|`length`|776|814|
|`called`|Expand for full list:
AfdCheckPollEvents
AfdNotifyDestroyContext
AfdNotifyPostEvents
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoInitializeMiniCompletionPacket
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObjectExpand for full list:
AfdCheckPollEvents
AfdNotifyDestroyContext
AfdNotifyPostEvents
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoInitializeMiniCompletionPacket
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObReferenceObjectByHandle
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObjectExpand for full list:
AFDETW_TRACESENDMSG
AfdAllocateMdlChain
AfdAllocateMdlChain32
AfdBuildSendMsgTracker
AfdComputeCMSGLength
AfdCopyCMSGBuffer
Feature_Servicing_AudioVideoStutteringIssue__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
memcpyExpand for full list:
AFDETW_TRACESENDMSG
AfdAllocateMdlChain
AfdAllocateMdlChain32
AfdBuildSendMsgTracker
AfdComputeCMSGLength
AfdCopyCMSGBuffer
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
memcpyExpand for full list:
AFDETW_TRACEDATA_CORE
AfdDeleteConnectedReference
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
NTOSKRNL.EXE::EtwWrite
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
__security_check_cookieExpand for full list:
AFDETW_TRACEDATA_CORE
AfdDeleteConnectedReference
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::EtwWrite
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
__security_check_cookie
AfdTLBufferedSendCompleteBatch|AfdProcessBufferSend
AfdTLBufferedSendCompleteBatch|
|paramcount|2|2|
|address|140005230|140005230|
|sig|undefined __fastcall AfdCompleteBufferedSendsUnlock(undefined2 * param_1, undefined8 * param_2)|undefined __fastcall AfdCompleteBufferedSendsUnlock(undefined2 * param_1, undefined8 * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdCompleteBufferedSendsUnlock Called Diff
```diff
--- AfdCompleteBufferedSendsUnlock called
+++ AfdCompleteBufferedSendsUnlock called
@@ -7,0 +8 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -9,0 +11 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdCompleteBufferedSendsUnlock Diff
```diff
--- AfdCompleteBufferedSendsUnlock
+++ AfdCompleteBufferedSendsUnlock
@@ -1,459 +1,490 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* WARNING: Type propagation algorithm not settling */
void AfdCompleteBufferedSendsUnlock(undefined2 *param_1,undefined8 *param_2)
{
- longlong *******ppppppplVar1;
- ushort *puVar2;
- longlong *******ppppppplVar3;
- longlong *******ppppppplVar4;
- ushort uVar5;
- short *psVar6;
- longlong ******pppppplVar7;
- longlong *****ppppplVar8;
+ ushort *puVar1;
+ longlong *******ppppppplVar2;
+ longlong ******pppppplVar3;
+ ushort uVar4;
+ short *psVar5;
+ longlong ******pppppplVar6;
+ longlong *****ppppplVar7;
+ longlong *******ppppppplVar8;
longlong *******ppppppplVar9;
code *pcVar10;
bool bVar11;
char cVar12;
ushort uVar13;
- undefined8 uVar14;
- ushort uVar15;
+ uint uVar14;
+ undefined8 uVar15;
+ ulonglong uVar16;
+ ushort uVar17;
undefined1 auStack_128 [32];
undefined **local_108;
uint local_100;
- longlong ******local_f8;
+ longlong *****local_f8;
uint local_f0;
undefined4 local_e8;
- longlong *******local_e0;
+ longlong ******local_e0;
undefined8 local_d8;
undefined8 uStack_d0;
undefined8 local_c8;
- longlong *******local_c0;
- longlong *******local_b8;
- longlong *****local_b0;
+ longlong ******local_c0;
+ longlong ******local_b8;
+ longlong ****local_b0;
undefined8 local_a8;
undefined8 uStack_a0;
undefined8 local_98;
undefined8 local_90;
ulonglong uStack_88;
- longlong *******local_80;
+ longlong ******local_80;
undefined8 uStack_78;
short *local_70;
undefined8 local_68;
undefined *local_60;
undefined8 local_58;
- longlong *****local_50;
+ longlong ****local_50;
undefined8 local_48;
ulonglong local_40;
local_40 = __security_cookie ^ (ulonglong)auStack_128;
- psVar6 = *(short **)(param_1 + 4);
+ psVar5 = *(short **)(param_1 + 4);
if ((*(uint *)(param_1 + 0x3c) < *(uint *)(param_1 + 0x4a)) ||
- ((((*(uint *)(psVar6 + 4) & 0x10) != 0 && (*(uint *)(param_1 + 0x4a) != 0)) &&
+ ((((*(uint *)(psVar5 + 4) & 0x10) != 0 && (*(uint *)(param_1 + 0x4a) != 0)) &&
(*(uint *)(param_1 + 0x3e) < 2)))) {
bVar11 = true;
}
else {
bVar11 = false;
}
- ppppppplVar1 = (longlong *******)(param_1 + 0x34);
- if ((longlong *******)*ppppppplVar1 != ppppppplVar1) {
- local_c0 = (longlong *******)&local_c0;
- local_b8 = (longlong *******)&local_c0;
+ ppppppplVar9 = (longlong *******)(param_1 + 0x34);
+ if ((longlong *******)*ppppppplVar9 != ppppppplVar9) {
+ local_c0 = (longlong ******)&local_c0;
+ local_b8 = (longlong ******)&local_c0;
while( true ) {
if ((((*(uint *)(param_1 + 0x4a) < *(uint *)(param_1 + 0x3c)) &&
- (*ppppppplVar1 != *(longlong *******)(param_1 + 0x38))) &&
+ (*ppppppplVar9 != *(longlong *******)(param_1 + 0x38))) &&
(1 < *(uint *)(param_1 + 0x3e))) ||
- (ppppppplVar9 = (longlong *******)*ppppppplVar1, ppppppplVar9 == ppppppplVar1)) {
+ (ppppppplVar8 = (longlong *******)*ppppppplVar9, ppppppplVar8 == ppppppplVar9)) {
if (!bVar11) {
KeReleaseInStackQueuedSpinLock(param_2);
goto LAB_0;
}
- AfdIndicateEventSelectEvent(psVar6,4,0);
- if (*(longlong *)(psVar6 + 0xbc) != 0) {
- puVar2 = (ushort *)(*(longlong *)(psVar6 + 0xbc) + 100);
- *puVar2 = *puVar2 | 4;
- }
- uVar14 = AfdIndicatePollEvent(psVar6,4,0,param_2);
- if ((char)uVar14 == '\0') {
- AfdNotifySockIndicateEventsUnlock((longlong)psVar6,param_2,'\0');
+ AfdIndicateEventSelectEvent(psVar5,4,0);
+ if (*(longlong *)(psVar5 + 0xbc) != 0) {
+ puVar1 = (ushort *)(*(longlong *)(psVar5 + 0xbc) + 100);
+ *puVar1 = *puVar1 | 4;
+ }
+ uVar15 = AfdIndicatePollEvent(psVar5,4,0,param_2);
+ if ((char)uVar15 == '\0') {
+ AfdNotifySockIndicateEventsUnlock((longlong)psVar5,param_2,'\0');
goto LAB_0;
}
local_a8 = 0;
uStack_a0 = 0;
local_98 = 0;
bVar11 = false;
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_a8);
- if ((*(longlong *)(psVar6 + 0xbc) != 0) &&
- (cVar12 = ExAcquireRundownProtection(psVar6 + 0xc0), cVar12 != '\0')) {
- pppppplVar7 = *(longlong *******)(psVar6 + 0xbc);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_a8);
+ if ((*(longlong *)(psVar5 + 0xbc) != 0) &&
+ (cVar12 = ExAcquireRundownProtection(psVar5 + 0xc0), cVar12 != '\0')) {
+ pppppplVar6 = *(longlong *******)(psVar5 + 0xbc);
bVar11 = true;
- uVar5 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- ppppplVar8 = pppppplVar7[8];
- if ((uVar5 & 2) == 0) {
- uVar15 = uVar5 | 2;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15;
- goto joined_r0x000140005a1f;
+ uVar4 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ ppppplVar7 = pppppplVar6[8];
+ if ((uVar4 & 2) == 0) {
+ uVar17 = uVar4 | 2;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17;
+ goto joined_r0x000140005a6f;
}
}
KeReleaseInStackQueuedSpinLock(&local_a8);
- if (!bVar11) goto LAB_0;
- goto LAB_1;
- }
- if (((longlong *******)ppppppplVar9[1] != ppppppplVar1) ||
- (pppppplVar7 = *ppppppplVar9, (longlong *******)pppppplVar7[1] != ppppppplVar9)) break;
- *ppppppplVar1 = pppppplVar7;
- pppppplVar7[1] = (longlong *****)ppppppplVar1;
+ if (bVar11) goto LAB_1;
+ goto LAB_0;
+ }
+ if (((longlong *******)ppppppplVar8[1] != ppppppplVar9) ||
+ (pppppplVar6 = *ppppppplVar8, (longlong *******)pppppplVar6[1] != ppppppplVar8)) break;
+ *ppppppplVar9 = pppppplVar6;
+ pppppplVar6[1] = (longlong *****)ppppppplVar9;
LOCK();
- pppppplVar7 = ppppppplVar9[-8];
- ppppppplVar9[-8] = (longlong ******)0x0;
+ pppppplVar6 = ppppppplVar8[-8];
+ ppppppplVar8[-8] = (longlong ******)0x0;
UNLOCK();
- if (pppppplVar7 == (longlong ******)0x0) {
- *ppppppplVar9 = (longlong ******)0x0;
+ if (pppppplVar6 == (longlong ******)0x0) {
+ *ppppppplVar8 = (longlong ******)0x0;
}
else {
- if ((longlong ********)*local_b8 != &local_c0) break;
- ppppppplVar9[1] = (longlong ******)local_b8;
- *ppppppplVar9 = (longlong ******)&local_c0;
- *local_b8 = (longlong ******)ppppppplVar9;
- local_b8 = ppppppplVar9;
+ if ((longlong *******)*local_b8 != &local_c0) break;
+ ppppppplVar8[1] = local_b8;
+ *ppppppplVar8 = (longlong ******)&local_c0;
+ *local_b8 = (longlong *****)ppppppplVar8;
+ local_b8 = (longlong ******)ppppppplVar8;
}
}
LAB_2:
pcVar10 = (code *)swi(0x29);
(*pcVar10)(3);
pcVar10 = (code *)swi(3);
(*pcVar10)();
return;
}
if ((*(uint *)(param_1 + 2) & 0x10000) != 0) {
if ((*(longlong *)(param_1 + 0x40) != 0) && (*(int *)(param_1 + 0x3e) == 0)) {
*(undefined8 *)(param_1 + 0x40) = 0;
KeReleaseInStackQueuedSpinLock(param_2);
IofCallDriver(*(undefined8 *)(param_1 + 0xc));
AfdDeleteConnectedReference(param_1,'\0');
return;
}
if (bVar11) {
- AfdIndicateEventSelectEvent(psVar6,4,0);
- if (*(longlong *)(psVar6 + 0xbc) != 0) {
- puVar2 = (ushort *)(*(longlong *)(psVar6 + 0xbc) + 100);
- *puVar2 = *puVar2 | 4;
- }
- uVar14 = AfdIndicatePollEvent(psVar6,4,0,param_2);
- if ((char)uVar14 == '\0') {
- AfdNotifySockIndicateEventsUnlock((longlong)psVar6,param_2,'\0');
+ AfdIndicateEventSelectEvent(psVar5,4,0);
+ if (*(longlong *)(psVar5 + 0xbc) != 0) {
+ puVar1 = (ushort *)(*(longlong *)(psVar5 + 0xbc) + 100);
+ *puVar1 = *puVar1 | 4;
+ }
+ uVar15 = AfdIndicatePollEvent(psVar5,4,0,param_2);
+ if ((char)uVar15 == '\0') {
+ AfdNotifySockIndicateEventsUnlock((longlong)psVar5,param_2,'\0');
AfdDeleteConnectedReference(param_1,'\0');
return;
}
local_d8 = 0;
uStack_d0 = 0;
local_c8 = 0;
bVar11 = false;
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c);
- if ((*(longlong *)(psVar6 + 0xbc) != 0) &&
- (cVar12 = ExAcquireRundownProtection(psVar6 + 0xc0), cVar12 != '\0')) {
- pppppplVar7 = *(longlong *******)(psVar6 + 0xbc);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c);
+ if ((*(longlong *)(psVar5 + 0xbc) != 0) &&
+ (cVar12 = ExAcquireRundownProtection(psVar5 + 0xc0), cVar12 != '\0')) {
+ pppppplVar6 = *(longlong *******)(psVar5 + 0xbc);
bVar11 = true;
- uVar5 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- local_b0 = pppppplVar7[8];
- if ((uVar5 & 2) == 0) {
- uVar15 = uVar5 | 2;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15;
- while ((uVar5 & 1) == 0) {
- uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar7);
- *(undefined2 *)((longlong)pppppplVar7 + 0x66) =
- *(undefined2 *)((longlong)pppppplVar7 + 100);
- uVar5 = *(ushort *)(pppppplVar7 + 0xd);
- if (uVar13 == uVar5) {
- if ((*(byte *)((longlong)pppppplVar7 + 99) & 1) != 0) {
- uVar15 = uVar15 | 4;
+ uVar4 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ local_b0 = (longlong ****)pppppplVar6[8];
+ if ((uVar4 & 2) == 0) {
+ uVar17 = uVar4 | 2;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17;
+ while ((uVar4 & 1) == 0) {
+ uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar6);
+ *(undefined2 *)((longlong)pppppplVar6 + 0x66) =
+ *(undefined2 *)((longlong)pppppplVar6 + 100);
+ uVar4 = *(ushort *)(pppppplVar6 + 0xd);
+ if (uVar13 == uVar4) {
+ if ((*(byte *)((longlong)pppppplVar6 + 99) & 1) != 0) {
+ uVar17 = uVar17 | 4;
}
LAB_3:
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15 & 0xfffd;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17 & 0xfffd;
goto LAB_4;
}
- if ((uVar5 & uVar13) != 0) goto LAB_3;
- if (uVar5 == 0) {
- *(ushort *)(pppppplVar7 + 0xd) = uVar13;
+ if ((uVar13 & uVar4) != 0) goto LAB_3;
+ if (uVar4 == 0) {
+ *(ushort *)(pppppplVar6 + 0xd) = uVar13;
KeReleaseInStackQueuedSpinLock(&local_d8);
ObfReferenceObject(local_b0);
local_e8 = CONCAT31(local_e8._1_3_,AfdPriorityBoost);
local_f0 = local_f0 & 0xffffff00;
local_100 = local_100 & 0xffffff00;
local_108 = (undefined **)(ulonglong)uVar13;
- local_f8 = pppppplVar7;
- IoSetIoCompletionEx3(pppppplVar7[10],pppppplVar7[0xb],0,0);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c);
+ local_f8 = (longlong *****)pppppplVar6;
+ IoSetIoCompletionEx3(pppppplVar6[10],pppppplVar6[0xb],0,0);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c);
}
else {
KeReleaseInStackQueuedSpinLock();
- cVar12 = IoCancelMiniCompletionPacket(pppppplVar7[10],pppppplVar7);
+ cVar12 = IoCancelMiniCompletionPacket(pppppplVar6[10],pppppplVar6);
if (cVar12 == '\0') {
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c);
- if (*(short *)(pppppplVar7 + 0xd) != 0) {
- *(ushort *)((longlong)pppppplVar7 + 0x6a) =
- *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd;
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c);
+ if (*(short *)(pppppplVar6 + 0xd) != 0) {
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) =
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd;
goto LAB_4;
}
}
else {
ObfDereferenceObject(local_b0);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c);
- *(undefined2 *)(pppppplVar7 + 0xd) = 0;
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c);
+ *(undefined2 *)(pppppplVar6 + 0xd) = 0;
}
}
- uVar15 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- uVar5 = uVar15;
- }
- psVar6[0xbc] = 0;
- psVar6[0xbd] = 0;
- psVar6[0xbe] = 0;
- psVar6[0xbf] = 0;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) =
- *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd;
+ uVar17 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ uVar4 = uVar17;
+ }
+ psVar5[0xbc] = 0;
+ psVar5[0xbd] = 0;
+ psVar5[0xbe] = 0;
+ psVar5[0xbf] = 0;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) =
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd;
KeReleaseInStackQueuedSpinLock(&local_d8);
- AfdNotifyDestroyContext(local_b0,(longlong)pppppplVar7);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c);
+ AfdNotifyDestroyContext(local_b0,(longlong)pppppplVar6);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar16 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar14 = (uint)uVar16;
+ }
+ else {
+ uVar14 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar14 != 0) {
+ ExFreePoolWithTag(pppppplVar6,0x4e646641);
+ }
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c);
LAB_4:
KeReleaseInStackQueuedSpinLock(&local_d8);
goto LAB_5;
}
}
KeReleaseInStackQueuedSpinLock(&local_d8);
if (bVar11) {
LAB_5:
- ExReleaseRundownProtection(psVar6 + 0xc0);
+ ExReleaseRundownProtection(psVar5 + 0xc0);
AfdDeleteConnectedReference(param_1,'\0');
return;
}
}
else {
KeReleaseInStackQueuedSpinLock(param_2);
}
AfdDeleteConnectedReference(param_1,'\0');
return;
}
if (!bVar11) {
KeReleaseInStackQueuedSpinLock(param_2);
return;
}
- AfdIndicateEventSelectEvent(psVar6,4,0);
- if (*(longlong *)(psVar6 + 0xbc) != 0) {
- puVar2 = (ushort *)(*(longlong *)(psVar6 + 0xbc) + 100);
- *puVar2 = *puVar2 | 4;
- }
- uVar14 = AfdIndicatePollEvent(psVar6,4,0,param_2);
- if ((char)uVar14 == '\0') {
- AfdNotifySockIndicateEventsUnlock((longlong)psVar6,param_2,'\0');
+ AfdIndicateEventSelectEvent(psVar5,4,0);
+ if (*(longlong *)(psVar5 + 0xbc) != 0) {
+ puVar1 = (ushort *)(*(longlong *)(psVar5 + 0xbc) + 100);
+ *puVar1 = *puVar1 | 4;
+ }
+ uVar15 = AfdIndicatePollEvent(psVar5,4,0,param_2);
+ if ((char)uVar15 == '\0') {
+ AfdNotifySockIndicateEventsUnlock((longlong)psVar5,param_2,'\0');
return;
}
local_d8 = 0;
uStack_d0 = 0;
local_c8 = 0;
bVar11 = false;
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_d8);
- if ((*(longlong *)(psVar6 + 0xbc) != 0) &&
- (cVar12 = ExAcquireRundownProtection(psVar6 + 0xc0), cVar12 != '\0')) {
- pppppplVar7 = *(longlong *******)(psVar6 + 0xbc);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_d8);
+ if ((*(longlong *)(psVar5 + 0xbc) != 0) &&
+ (cVar12 = ExAcquireRundownProtection(psVar5 + 0xc0), cVar12 != '\0')) {
+ pppppplVar6 = *(longlong *******)(psVar5 + 0xbc);
bVar11 = true;
- uVar5 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- ppppplVar8 = pppppplVar7[8];
- if ((uVar5 & 2) == 0) {
- uVar15 = uVar5 | 2;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15;
- while ((uVar5 & 1) == 0) {
- uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar7);
- *(undefined2 *)((longlong)pppppplVar7 + 0x66) = *(undefined2 *)((longlong)pppppplVar7 + 100)
+ uVar4 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ ppppplVar7 = pppppplVar6[8];
+ if ((uVar4 & 2) == 0) {
+ uVar17 = uVar4 | 2;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17;
+ while ((uVar4 & 1) == 0) {
+ uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar6);
+ *(undefined2 *)((longlong)pppppplVar6 + 0x66) = *(undefined2 *)((longlong)pppppplVar6 + 100)
;
- uVar5 = *(ushort *)(pppppplVar7 + 0xd);
- if (uVar13 == uVar5) {
- if ((*(byte *)((longlong)pppppplVar7 + 99) & 1) != 0) {
- uVar15 = uVar15 | 4;
+ uVar4 = *(ushort *)(pppppplVar6 + 0xd);
+ if (uVar13 == uVar4) {
+ if ((*(byte *)((longlong)pppppplVar6 + 99) & 1) != 0) {
+ uVar17 = uVar17 | 4;
}
LAB_6:
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15 & 0xfffd;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17 & 0xfffd;
goto LAB_7;
}
- if ((uVar13 & uVar5) != 0) goto LAB_6;
- if (uVar5 == 0) {
- *(ushort *)(pppppplVar7 + 0xd) = uVar13;
+ if ((uVar13 & uVar4) != 0) goto LAB_6;
+ if (uVar4 == 0) {
+ *(ushort *)(pppppplVar6 + 0xd) = uVar13;
KeReleaseInStackQueuedSpinLock(&local_d8);
- ObfReferenceObject(ppppplVar8);
+ ObfReferenceObject(ppppplVar7);
local_e8 = CONCAT31(local_e8._1_3_,AfdPriorityBoost);
local_f0 = local_f0 & 0xffffff00;
local_100 = local_100 & 0xffffff00;
local_108 = (undefined **)(ulonglong)uVar13;
- local_f8 = pppppplVar7;
- IoSetIoCompletionEx3(pppppplVar7[10],pppppplVar7[0xb],0,0);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_d8);
+ local_f8 = (longlong *****)pppppplVar6;
+ IoSetIoCompletionEx3(pppppplVar6[10],pppppplVar6[0xb],0,0);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_d8);
}
else {
KeReleaseInStackQueuedSpinLock();
- cVar12 = IoCancelMiniCompletionPacket(pppppplVar7[10],pppppplVar7);
+ cVar12 = IoCancelMiniCompletionPacket(pppppplVar6[10],pppppplVar6);
if (cVar12 == '\0') {
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_d8);
- if (*(short *)(pppppplVar7 + 0xd) != 0) {
- *(ushort *)((longlong)pppppplVar7 + 0x6a) =
- *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd;
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_d8);
+ if (*(short *)(pppppplVar6 + 0xd) != 0) {
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) =
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd;
goto LAB_7;
}
}
else {
- ObfDereferenceObject(ppppplVar8);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_d8);
- *(undefined2 *)(pppppplVar7 + 0xd) = 0;
- }
- }
- uVar15 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- uVar5 = uVar15;
- }
- psVar6[0xbc] = 0;
- psVar6[0xbd] = 0;
- psVar6[0xbe] = 0;
- psVar6[0xbf] = 0;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd
+ ObfDereferenceObject(ppppplVar7);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_d8);
+ *(undefined2 *)(pppppplVar6 + 0xd) = 0;
+ }
+ }
+ uVar17 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ uVar4 = uVar17;
+ }
+ psVar5[0xbc] = 0;
+ psVar5[0xbd] = 0;
+ psVar5[0xbe] = 0;
+ psVar5[0xbf] = 0;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd
;
KeReleaseInStackQueuedSpinLock(&local_d8);
- AfdNotifyDestroyContext(ppppplVar8,(longlong)pppppplVar7);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_d8);
+ AfdNotifyDestroyContext(ppppplVar7,(longlong)pppppplVar6);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar16 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar14 = (uint)uVar16;
+ }
+ else {
+ uVar14 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar14 != 0) {
+ ExFreePoolWithTag(pppppplVar6,0x4e646641);
+ }
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_d8);
LAB_7:
KeReleaseInStackQueuedSpinLock(&local_d8);
goto LAB_8;
}
}
KeReleaseInStackQueuedSpinLock(&local_d8);
if (!bVar11) {
return;
}
LAB_8:
- ExReleaseRundownProtection(psVar6 + 0xc0);
+ ExReleaseRundownProtection(psVar5 + 0xc0);
return;
-joined_r0x000140005a1f:
- if ((uVar5 & 1) != 0) goto LAB_9;
- uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar7);
- *(undefined2 *)((longlong)pppppplVar7 + 0x66) = *(undefined2 *)((longlong)pppppplVar7 + 100);
- uVar5 = *(ushort *)(pppppplVar7 + 0xd);
- if (uVar13 == uVar5) {
- if ((*(byte *)((longlong)pppppplVar7 + 99) & 1) != 0) {
- uVar15 = uVar15 | 4;
+joined_r0x000140005a6f:
+ if ((uVar4 & 1) != 0) goto LAB_9;
+ uVar13 = AfdNotifyComputeEvents((longlong)pppppplVar6);
+ *(undefined2 *)((longlong)pppppplVar6 + 0x66) = *(undefined2 *)((longlong)pppppplVar6 + 100);
+ uVar4 = *(ushort *)(pppppplVar6 + 0xd);
+ if (uVar13 == uVar4) {
+ if ((*(byte *)((longlong)pppppplVar6 + 99) & 1) != 0) {
+ uVar17 = uVar17 | 4;
}
LAB_10:
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = uVar15 & 0xfffd;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = uVar17 & 0xfffd;
goto LAB_11;
}
- if ((uVar13 & uVar5) != 0) goto LAB_10;
- if (uVar5 == 0) {
- *(ushort *)(pppppplVar7 + 0xd) = uVar13;
+ if ((uVar13 & uVar4) != 0) goto LAB_10;
+ if (uVar4 == 0) {
+ *(ushort *)(pppppplVar6 + 0xd) = uVar13;
KeReleaseInStackQueuedSpinLock(&local_a8);
- ObfReferenceObject(ppppplVar8);
+ ObfReferenceObject(ppppplVar7);
local_e8 = CONCAT31(local_e8._1_3_,AfdPriorityBoost);
local_f0 = local_f0 & 0xffffff00;
local_100 = local_100 & 0xffffff00;
local_108 = (undefined **)(ulonglong)uVar13;
- local_f8 = pppppplVar7;
- IoSetIoCompletionEx3(pppppplVar7[10],pppppplVar7[0xb],0,0);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_a8);
+ local_f8 = (longlong *****)pppppplVar6;
+ IoSetIoCompletionEx3(pppppplVar6[10],pppppplVar6[0xb],0,0);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_a8);
}
else {
KeReleaseInStackQueuedSpinLock();
- cVar12 = IoCancelMiniCompletionPacket(pppppplVar7[10],pppppplVar7);
+ cVar12 = IoCancelMiniCompletionPacket(pppppplVar6[10],pppppplVar6);
if (cVar12 == '\0') {
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_a8);
- if (*(short *)(pppppplVar7 + 0xd) != 0) {
- *(ushort *)((longlong)pppppplVar7 + 0x6a) =
- *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd;
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_a8);
+ if (*(short *)(pppppplVar6 + 0xd) != 0) {
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) =
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd;
goto LAB_11;
}
}
else {
- ObfDereferenceObject(ppppplVar8);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_a8);
- *(undefined2 *)(pppppplVar7 + 0xd) = 0;
- }
- }
- uVar15 = *(ushort *)((longlong)pppppplVar7 + 0x6a);
- uVar5 = uVar15;
- goto joined_r0x000140005a1f;
+ ObfDereferenceObject(ppppplVar7);
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_a8);
+ *(undefined2 *)(pppppplVar6 + 0xd) = 0;
+ }
+ }
+ uVar17 = *(ushort *)((longlong)pppppplVar6 + 0x6a);
+ uVar4 = uVar17;
+ goto joined_r0x000140005a6f;
LAB_9:
- psVar6[0xbc] = 0;
- psVar6[0xbd] = 0;
- psVar6[0xbe] = 0;
- psVar6[0xbf] = 0;
- *(ushort *)((longlong)pppppplVar7 + 0x6a) = *(ushort *)((longlong)pppppplVar7 + 0x6a) & 0xfffd;
+ psVar5[0xbc] = 0;
+ psVar5[0xbd] = 0;
+ psVar5[0xbe] = 0;
+ psVar5[0xbf] = 0;
+ *(ushort *)((longlong)pppppplVar6 + 0x6a) = *(ushort *)((longlong)pppppplVar6 + 0x6a) & 0xfffd;
KeReleaseInStackQueuedSpinLock(&local_a8);
- AfdNotifyDestroyContext(ppppplVar8,(longlong)pppppplVar7);
- KeAcquireInStackQueuedSpinLock(psVar6 + 0x1c,&local_a8);
+ AfdNotifyDestroyContext(ppppplVar7,(longlong)pppppplVar6);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar16 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar14 = (uint)uVar16;
+ }
+ else {
+ uVar14 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar14 != 0) {
+ ExFreePoolWithTag(pppppplVar6,0x4e646641);
+ }
+ KeAcquireInStackQueuedSpinLock(psVar5 + 0x1c,&local_a8);
LAB_11:
KeReleaseInStackQueuedSpinLock(&local_a8);
LAB_1:
- ExReleaseRundownProtection(psVar6 + 0xc0);
+ ExReleaseRundownProtection(psVar5 + 0xc0);
LAB_0:
do {
- ppppppplVar1 = local_c0;
- if ((longlong ********)local_c0 == &local_c0) {
+ pppppplVar6 = local_c0;
+ if ((longlong *******)local_c0 == &local_c0) {
return;
}
- if (((longlong ********)local_c0[1] != &local_c0) ||
- (ppppppplVar9 = (longlong *******)*local_c0, (longlong *******)ppppppplVar9[1] != local_c0))
+ if (((longlong *******)local_c0[1] != &local_c0) ||
+ (ppppppplVar9 = (longlong *******)*local_c0, ppppppplVar9[1] != local_c0))
goto LAB_2;
- ppppppplVar4 = local_c0 + -0x15;
+ ppppppplVar2 = (longlong *******)(local_c0 + -0x15);
ppppppplVar9[1] = (longlong ******)&local_c0;
LOCK();
- ppppppplVar3 = local_c0 + -6;
- pppppplVar7 = *ppppppplVar3;
- local_c0 = ppppppplVar9;
- *ppppppplVar3 = (longlong ******)0xffffffffffffffff;
+ ppppppplVar8 = (longlong *******)(local_c0 + -6);
+ pppppplVar3 = *ppppppplVar8;
+ local_c0 = (longlong ******)ppppppplVar9;
+ *ppppppplVar8 = (longlong ******)0xffffffffffffffff;
UNLOCK();
- if (pppppplVar7 != (longlong ******)0x0) {
- local_80 = (longlong *******)0x0;
+ if (pppppplVar3 != (longlong ******)0x0) {
+ local_80 = (longlong ******)0x0;
if ((g_AfdEtwTraceEnable != 0) || (Microsoft_Windows_Networking_CorrelationEnabled != 0)) {
local_68 = 0;
- local_80 = ppppppplVar4;
- local_70 = psVar6;
+ local_80 = (longlong ******)ppppppplVar2;
+ local_70 = psVar5;
}
uStack_78 = 0;
if (g_AfdEtwTraceEnable == 0) {
LAB_12:
if (Microsoft_Windows_Networking_CorrelationEnabled != 0) goto LAB_13;
}
else {
uStack_88 = 0;
- if (psVar6 != (short *)0x0) {
- uStack_88 = (ulonglong)(*psVar6 != -0x502f) + 1;
+ if (psVar5 != (short *)0x0) {
+ uStack_88 = (ulonglong)(*psVar5 != -0x502f) + 1;
}
uStack_88 = uStack_88 | 0x8000000000000004;
local_100 = 1;
- local_90 = CONCAT35(0x3eb0c,CONCAT14(((byte)((int)*(undefined4 *)(ppppppplVar1 + -0xf) >>
+ local_90 = CONCAT35(0x3eb0c,CONCAT14(((byte)((int)*(undefined4 *)(pppppplVar6 + -0xf) >>
0x1f) & 0xfe) + 4,0x100003eb));
- local_f8 = ppppppplVar1[-0x14];
- local_f0 = *(uint *)(ppppppplVar1 + -0xe);
- local_e8 = *(undefined4 *)(ppppppplVar1 + -0xf);
- local_e0 = ppppppplVar4;
- AFDETW_TRACEDATA_CORE(&local_90,1,0xbd1,(longlong)psVar6);
+ local_f8 = pppppplVar6[-0x14];
+ local_f0 = *(uint *)(pppppplVar6 + -0xe);
+ local_e8 = *(undefined4 *)(pppppplVar6 + -0xf);
+ local_e0 = (longlong ******)ppppppplVar2;
+ AFDETW_TRACEDATA_CORE(&local_90,1,0xbd1,(longlong)psVar5);
if (g_AfdEtwTraceEnable == 0) goto LAB_12;
LAB_13:
if (Microsoft_Windows_Networking_CorrelationEnabled != 0) {
- local_b0 = (longlong *****)CONCAT44(local_b0._4_4_,2);
+ local_b0 = (longlong ****)CONCAT44(local_b0._4_4_,2);
if (Microsoft_Windows_Networking_CorrelationTraceActivityPayload == 0) {
local_108 = (undefined **)0x0;
- uVar14 = 0;
+ uVar15 = 0;
}
else {
- local_50 = (longlong *****)&local_b0;
+ local_50 = (longlong ****)&local_b0;
local_60 = &Microsoft_Windows_Networking_ProviderId;
- uVar14 = 2;
+ uVar15 = 2;
local_108 = &local_60;
local_58 = 0x10;
local_48 = 4;
}
- EtwWrite(Microsoft_Windows_Networking_CorrelationHandle,&ActivityStop,&local_80,uVar14);
- }
- }
- IofCompleteRequest(ppppppplVar4,AfdPriorityBoost);
+ EtwWrite(Microsoft_Windows_Networking_CorrelationHandle,&ActivityStop,&local_80,uVar15);
+ }
+ }
+ IofCompleteRequest(ppppppplVar2,AfdPriorityBoost);
}
} while( true );
}
```
## AfdFastConnectionSend
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.7|
|i_ratio|0.58|
|m_ratio|0.98|
|b_ratio|0.59|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdFastConnectionSend|AfdFastConnectionSend|
|fullname|AfdFastConnectionSend|AfdFastConnectionSend|
|refcount|3|3|
|`length`|2387|2477|
|`called`|Expand for full list:
AFDETW_TRACESEND
AfdCheckISBEvents
AfdCloseConnection
AfdCopyBufferArrayToBuffer
AfdEnqueueTpSendIrp
AfdGetBuffer
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
AfdShouldSendBlock
AfdTLStartBufferedVcSend
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_DDq
WPP_SF_qqExpand for full list:
AFDETW_TRACESEND
AfdCheckISBEvents
AfdCloseConnection
AfdCopyBufferArrayToBuffer
AfdEnqueueTpSendIrp
AfdGetBuffer
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
AfdShouldSendBlock
AfdTLStartBufferedVcSend
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_DDq
WPP_SF_qq
AfdFastIoWrite|AfdFastIoDeviceControl
AfdFastIoWrite|
|paramcount|3|3|
|`address`|140032e60|140031ef0|
|sig|undefined8 __fastcall AfdFastConnectionSend(ushort * param_1, longlong param_2, uint param_3)|undefined8 __fastcall AfdFastConnectionSend(ushort * param_1, longlong param_2, uint param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdFastConnectionSend Called Diff
```diff
--- AfdFastConnectionSend called
+++ AfdFastConnectionSend called
@@ -11,0 +12 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -12,0 +14 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdFastConnectionSend Diff
```diff
--- AfdFastConnectionSend
+++ AfdFastConnectionSend
@@ -1,453 +1,479 @@
ulonglong AfdFastConnectionSend(ushort *param_1,longlong param_2,uint param_3)
{
longlong *plVar1;
longlong lVar2;
ushort uVar3;
undefined2 *puVar4;
undefined8 uVar5;
uint *puVar6;
void *pvVar7;
short *psVar8;
undefined4 *puVar9;
code *pcVar10;
bool bVar11;
char cVar12;
char cVar13;
ushort uVar14;
uint uVar15;
int iVar16;
undefined8 uVar17;
- void *pvVar18;
- ulonglong uVar19;
+ ulonglong uVar18;
+ void *pvVar19;
undefined1 *puVar20;
undefined1 *puVar21;
undefined1 *puVar22;
ushort uVar23;
undefined8 local_res20;
undefined1 auStack_f8 [8];
undefined1 auStack_f0 [24];
ulonglong local_d8;
undefined1 local_d0;
longlong local_c8;
undefined1 local_c0;
undefined1 local_b8;
- undefined8 local_a8;
- undefined8 uStack_a0;
- undefined8 local_98;
+ char local_a8;
+ undefined8 local_a0;
+ undefined8 uStack_98;
+ undefined8 local_90;
undefined2 *local_78;
undefined8 local_50;
undefined8 uStack_48;
undefined8 local_40;
puVar20 = auStack_f8;
puVar22 = auStack_f8;
- local_a8 = 0;
- uStack_a0 = 0;
- local_98 = 0;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a8);
+ local_a0 = 0;
+ uStack_98 = 0;
+ local_90 = 0;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a0);
if (((((*(byte *)((longlong)param_1 + 7) & 0x10) != 0) || ((*param_1 & 0xafd2) != 0xafd2)) ||
(puVar4 = *(undefined2 **)(param_1 + 0x60), local_78 = puVar4, puVar4 == (undefined2 *)0x0))
|| ((*(uint *)(puVar4 + 2) & 0x100010) != 0)) {
- uVar19 = KeReleaseInStackQueuedSpinLock(&local_a8);
+ uVar18 = KeReleaseInStackQueuedSpinLock(&local_a0);
goto LAB_0;
}
uVar17 = AfdShouldSendBlock((longlong)param_1,(longlong)puVar4,param_3);
if ((char)uVar17 != '\0') {
if ((((*(uint *)(puVar4 + 2) >> 0x15 & 1) == 0) && (AfdDynamicSendBufferDisabled == 0)) &&
((*(uint *)(puVar4 + 2) >> 0x13 & 1) == 0)) {
LOCK();
plVar1 = (longlong *)(puVar4 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + 1;
UNLOCK();
if (lVar2 + 1 < 2) {
pcVar10 = (code *)swi(0x29);
(*pcVar10)(0xe);
puVar20 = auStack_f0;
}
cVar13 = '\0';
*(undefined8 *)(puVar20 + 0x90) = 0;
*(undefined8 *)(puVar20 + 0x98) = 0;
*(undefined8 *)(puVar20 + 0xa0) = 0;
if (*(longlong *)(param_1 + 0xbc) != 0) {
- *(undefined8 *)(puVar20 + -8) = 0x140032f80;
+ *(undefined8 *)(puVar20 + -8) = 0x140032010;
cVar12 = ExAcquireRundownProtection(param_1 + 0xc0);
if (cVar12 != '\0') {
- puVar20[0x100] = 1;
- bVar11 = true;
+ puVar20[0x50] = 1;
+ cVar13 = '\x01';
lVar2 = *(longlong *)(param_1 + 0xbc);
*(undefined8 *)(puVar20 + 0x70) = *(undefined8 *)(lVar2 + 0x40);
uVar3 = *(ushort *)(lVar2 + 0x6a);
if ((uVar3 & 2) == 0) {
uVar23 = uVar3 | 2;
*(ushort *)(lVar2 + 0x6a) = uVar23;
while ((uVar3 & 1) == 0) {
- *(undefined8 *)(puVar20 + -8) = 0x140032fd8;
+ *(undefined8 *)(puVar20 + -8) = 0x14003205e;
uVar14 = AfdNotifyComputeEvents(lVar2);
*(undefined2 *)(lVar2 + 0x66) = *(undefined2 *)(lVar2 + 100);
uVar3 = *(ushort *)(lVar2 + 0x68);
if (uVar14 == uVar3) {
if ((*(byte *)(lVar2 + 99) & 1) != 0) {
uVar23 = uVar23 | 4;
}
LAB_1:
*(ushort *)(lVar2 + 0x6a) = uVar23 & 0xfffd;
- bVar11 = true;
+ cVar13 = '\x01';
goto LAB_2;
}
if ((uVar14 & uVar3) != 0) goto LAB_1;
if (uVar3 == 0) {
*(ushort *)(lVar2 + 0x68) = uVar14;
- *(undefined8 *)(puVar20 + -8) = 0x140033096;
- KeReleaseInStackQueuedSpinLock(puVar20 + 0x50);
- *(undefined8 *)(puVar20 + -8) = 0x1400330a7;
+ *(undefined8 *)(puVar20 + -8) = 0x14003211c;
+ KeReleaseInStackQueuedSpinLock(puVar20 + 0x58);
+ *(undefined8 *)(puVar20 + -8) = 0x14003212d;
ObfReferenceObject(*(undefined8 *)(puVar20 + 0x70));
puVar20[0x40] = AfdPriorityBoost;
puVar20[0x38] = 0;
*(longlong *)(puVar20 + 0x30) = lVar2;
puVar20[0x28] = 0;
*(ulonglong *)(puVar20 + 0x20) = (ulonglong)uVar14;
uVar17 = *(undefined8 *)(lVar2 + 0x58);
uVar5 = *(undefined8 *)(lVar2 + 0x50);
- *(undefined8 *)(puVar20 + -8) = 0x1400330e0;
+ *(undefined8 *)(puVar20 + -8) = 0x140032166;
IoSetIoCompletionEx3(uVar5,uVar17,0,0);
- *(undefined8 *)(puVar20 + -8) = 0x1400330f5;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x50);
+ *(undefined8 *)(puVar20 + -8) = 0x14003217b;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x58);
}
else {
- *(undefined8 *)(puVar20 + -8) = 0x140033011;
+ *(undefined8 *)(puVar20 + -8) = 0x140032097;
KeReleaseInStackQueuedSpinLock();
uVar17 = *(undefined8 *)(lVar2 + 0x50);
- *(undefined8 *)(puVar20 + -8) = 0x140033024;
+ *(undefined8 *)(puVar20 + -8) = 0x1400320aa;
cVar13 = IoCancelMiniCompletionPacket(uVar17,lVar2);
if (cVar13 == '\0') {
- *(undefined8 *)(puVar20 + -8) = 0x14003303d;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x50);
+ *(undefined8 *)(puVar20 + -8) = 0x1400320c3;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x58);
if (*(short *)(lVar2 + 0x68) != 0) {
*(ushort *)(lVar2 + 0x6a) = *(ushort *)(lVar2 + 0x6a) & 0xfffd;
- bVar11 = true;
+ cVar13 = '\x01';
goto LAB_2;
}
}
else {
- *(undefined8 *)(puVar20 + -8) = 0x140033069;
+ *(undefined8 *)(puVar20 + -8) = 0x1400320ef;
ObfDereferenceObject(*(undefined8 *)(puVar20 + 0x70));
- *(undefined8 *)(puVar20 + -8) = 0x14003307e;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x50);
+ *(undefined8 *)(puVar20 + -8) = 0x140032104;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x58);
*(undefined2 *)(lVar2 + 0x68) = 0;
}
}
uVar23 = *(ushort *)(lVar2 + 0x6a);
uVar3 = uVar23;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
*(ushort *)(lVar2 + 0x6a) = *(ushort *)(lVar2 + 0x6a) & 0xfffd;
- *(undefined8 *)(puVar20 + -8) = 0x140033124;
- KeReleaseInStackQueuedSpinLock(puVar20 + 0x50);
- *(undefined8 *)(puVar20 + -8) = 0x140033136;
+ *(undefined8 *)(puVar20 + -8) = 0x1400321aa;
+ KeReleaseInStackQueuedSpinLock(puVar20 + 0x58);
+ puVar20[0x100] = 0;
+ *(undefined8 *)(puVar20 + -8) = 0x1400321c4;
AfdNotifyDestroyContext(*(undefined8 *)(puVar20 + 0x70),lVar2);
- bVar11 = false;
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar20 + -8) = 0x1400321f2;
+ uVar18 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar15 = (uint)uVar18;
+ }
+ else {
+ uVar15 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar15 != 0) {
+ *(undefined8 *)(puVar20 + -8) = 0x140032205;
+ ExFreePoolWithTag(lVar2,0x4e646641);
+ }
+ cVar13 = puVar20[0x100];
LAB_2:
param_2 = *(longlong *)(puVar20 + 0x108);
}
- if (!bVar11) {
- *(undefined8 *)(puVar20 + -8) = 0x140033154;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x50);
- }
- cVar13 = puVar20[0x100];
- }
- }
- *(undefined8 *)(puVar20 + -8) = 0x14003316d;
- KeReleaseInStackQueuedSpinLock(puVar20 + 0x50);
+ if (cVar13 == '\0') {
+ *(undefined8 *)(puVar20 + -8) = 0x14003222e;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar20 + 0x58);
+ }
+ cVar13 = puVar20[0x50];
+ }
+ }
+ *(undefined8 *)(puVar20 + -8) = 0x140032244;
+ KeReleaseInStackQueuedSpinLock(puVar20 + 0x58);
if (cVar13 != '\0') {
- *(undefined8 *)(puVar20 + -8) = 0x140033184;
+ *(undefined8 *)(puVar20 + -8) = 0x14003225b;
ExReleaseRundownProtection(param_1 + 0xc0);
}
- *(undefined8 *)(puVar20 + -8) = 0x140033197;
+ *(undefined8 *)(puVar20 + -8) = 0x14003226e;
AfdCheckISBEvents((longlong)puVar4,AfdTLSockOptEnable);
LOCK();
plVar1 = (longlong *)(puVar4 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + -1;
UNLOCK();
puVar21 = puVar20;
if (lVar2 < 2) {
if (lVar2 == 1) {
- *(undefined8 *)(puVar20 + -8) = 0x1400331bb;
+ *(undefined8 *)(puVar20 + -8) = 0x140032292;
AfdCloseConnection(puVar4);
}
else {
pcVar10 = (code *)swi(0x29);
(*pcVar10)(0xe);
puVar21 = puVar20 + 8;
}
}
}
else {
- bVar11 = false;
local_50 = 0;
uStack_48 = 0;
local_40 = 0;
+ cVar13 = '\0';
if ((*(longlong *)(param_1 + 0xbc) != 0) &&
- (cVar13 = ExAcquireRundownProtection(param_1 + 0xc0), cVar13 != '\0')) {
+ (cVar12 = ExAcquireRundownProtection(param_1 + 0xc0), cVar12 != '\0')) {
+ local_a8 = '\x01';
bVar11 = true;
lVar2 = *(longlong *)(param_1 + 0xbc);
uVar17 = *(undefined8 *)(lVar2 + 0x40);
uVar3 = *(ushort *)(lVar2 + 0x6a);
if ((uVar3 & 2) == 0) {
uVar23 = uVar3 | 2;
*(ushort *)(lVar2 + 0x6a) = uVar23;
while ((uVar3 & 1) == 0) {
uVar14 = AfdNotifyComputeEvents(lVar2);
*(undefined2 *)(lVar2 + 0x66) = *(undefined2 *)(lVar2 + 100);
uVar3 = *(ushort *)(lVar2 + 0x68);
if (uVar14 == uVar3) {
if ((*(byte *)(lVar2 + 99) & 1) != 0) {
uVar23 = uVar23 | 4;
}
LAB_3:
*(ushort *)(lVar2 + 0x6a) = uVar23 & 0xfffd;
bVar11 = true;
goto LAB_4;
}
if ((uVar3 & uVar14) != 0) goto LAB_3;
if (uVar3 == 0) {
*(ushort *)(lVar2 + 0x68) = uVar14;
- KeReleaseInStackQueuedSpinLock(&local_a8);
+ KeReleaseInStackQueuedSpinLock(&local_a0);
ObfReferenceObject(uVar17);
local_b8 = AfdPriorityBoost;
local_c0 = 0;
local_d0 = 0;
local_d8 = (ulonglong)uVar14;
local_c8 = lVar2;
IoSetIoCompletionEx3(*(undefined8 *)(lVar2 + 0x50),*(undefined8 *)(lVar2 + 0x58),0,0);
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a8);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a0);
}
else {
KeReleaseInStackQueuedSpinLock();
cVar13 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar2 + 0x50),lVar2);
if (cVar13 == '\0') {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a8);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a0);
if (*(short *)(lVar2 + 0x68) != 0) {
*(ushort *)(lVar2 + 0x6a) = *(ushort *)(lVar2 + 0x6a) & 0xfffd;
bVar11 = true;
goto LAB_4;
}
}
else {
ObfDereferenceObject(uVar17);
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a8);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a0);
*(undefined2 *)(lVar2 + 0x68) = 0;
}
}
uVar23 = *(ushort *)(lVar2 + 0x6a);
uVar3 = uVar23;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
*(ushort *)(lVar2 + 0x6a) = *(ushort *)(lVar2 + 0x6a) & 0xfffd;
- KeReleaseInStackQueuedSpinLock(&local_a8);
+ KeReleaseInStackQueuedSpinLock(&local_a0);
AfdNotifyDestroyContext(uVar17,lVar2);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar18 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar15 = (uint)uVar18;
+ }
+ else {
+ uVar15 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar15 != 0) {
+ ExFreePoolWithTag(lVar2,0x4e646641);
+ }
bVar11 = false;
}
LAB_4:
+ cVar13 = local_a8;
if (!bVar11) {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a8);
- }
- bVar11 = true;
- }
- KeReleaseInStackQueuedSpinLock(&local_a8);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_a0);
+ cVar13 = local_a8;
+ }
+ }
+ KeReleaseInStackQueuedSpinLock(&local_a0);
puVar21 = auStack_f8;
- if (bVar11) {
+ if (cVar13 != '\0') {
ExReleaseRundownProtection(param_1 + 0xc0);
puVar21 = auStack_f8;
}
}
- uVar19 = (ulonglong)*(uint *)(param_1 + 4);
+ uVar18 = (ulonglong)*(uint *)(param_1 + 4);
if ((*(uint *)(param_1 + 4) & 0x10) != 0) {
uVar15 = *(uint *)(param_2 + 0xc);
- uVar19 = (ulonglong)uVar15;
+ uVar18 = (ulonglong)uVar15;
if ((uVar15 & 2) == 0) {
**(undefined4 **)(puVar21 + 0x118) = 0xc00000a3;
return CONCAT71((uint7)(uint3)(uVar15 >> 8),1);
}
}
goto LAB_0;
}
LOCK();
plVar1 = (longlong *)(puVar4 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + 1;
UNLOCK();
if (lVar2 + 1 < 2) {
pcVar10 = (code *)swi(0x29);
(*pcVar10)(0xe);
puVar22 = auStack_f0;
}
- *(undefined8 *)(puVar22 + -8) = 0x14003347f;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x140032569;
+ KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
if ((DAT_5 & 0x40) != 0) {
- *(undefined8 *)(puVar22 + -8) = 0x1400334a4;
+ *(undefined8 *)(puVar22 + -8) = 0x14003258e;
WPP_SF_qq(10,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,puVar4);
}
lVar2 = *(longlong *)(puVar4 + 0x10);
- *(undefined8 *)(puVar22 + -8) = 0x1400334b4;
- pvVar18 = AfdGetBuffer(param_3,0,lVar2,0);
- *(void **)(puVar22 + 0x70) = pvVar18;
- if (pvVar18 == (void *)0x0) {
- *(undefined8 *)(puVar22 + -8) = 0x1400334d1;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x14003259e;
+ pvVar19 = AfdGetBuffer(param_3,0,lVar2,0);
+ *(void **)(puVar22 + 0x70) = pvVar19;
+ if (pvVar19 == (void *)0x0) {
+ *(undefined8 *)(puVar22 + -8) = 0x1400325bb;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x58);
*(uint *)(puVar4 + 0x3c) = *(int *)(puVar4 + 0x3c) - param_3;
*(int *)(puVar4 + 0x3e) = *(int *)(puVar4 + 0x3e) + -1;
- *(undefined8 *)(puVar22 + -8) = 0x1400334e8;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x1400325d2;
+ KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
LOCK();
plVar1 = (longlong *)(puVar4 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + -1;
UNLOCK();
- uVar19 = lVar2 - 1;
- if (uVar19 == 0 || lVar2 < 1) {
- if (uVar19 == 0) {
- *(undefined8 *)(puVar22 + -8) = 0x140033510;
- uVar19 = AfdCloseConnection(puVar4);
+ uVar18 = lVar2 - 1;
+ if (uVar18 == 0 || lVar2 < 1) {
+ if (uVar18 == 0) {
+ *(undefined8 *)(puVar22 + -8) = 0x1400325fa;
+ uVar18 = AfdCloseConnection(puVar4);
}
else {
pcVar10 = (code *)swi(0x29);
- uVar19 = (*pcVar10)(0xe);
+ uVar18 = (*pcVar10)(0xe);
}
}
goto LAB_0;
}
- *(uint *)(*(longlong *)((longlong)pvVar18 + 0x38) + 0x28) = param_3;
- *(undefined2 **)((longlong)pvVar18 + 0x30) = puVar4;
+ *(uint *)(*(longlong *)((longlong)pvVar19 + 0x38) + 0x28) = param_3;
+ *(undefined2 **)((longlong)pvVar19 + 0x30) = puVar4;
if (param_3 != 0) {
iVar16 = *(int *)(param_2 + 8);
puVar6 = (uint *)**(undefined8 **)(puVar22 + 0x108);
- uVar19 = (ulonglong)param_3;
- pvVar7 = *(void **)((longlong)pvVar18 + 0x58);
- *(undefined8 *)(puVar22 + -8) = 0x140033552;
+ uVar18 = (ulonglong)param_3;
+ pvVar7 = *(void **)((longlong)pvVar19 + 0x58);
+ *(undefined8 *)(puVar22 + -8) = 0x14003263c;
uVar15 = AfdCopyBufferArrayToBuffer(pvVar7,param_3,puVar6,iVar16);
if (uVar15 != param_3) {
if ((DAT_5 & 0x40) != 0) {
*(ushort **)(puVar22 + 0x20) = param_1;
- *(undefined8 *)(puVar22 + -8) = 0x140033578;
- WPP_SF_DDq(0xb,uVar19,param_3,uVar15);
- }
- *(undefined4 *)(*(longlong *)((longlong)pvVar18 + 0x38) + 0x28) =
- *(undefined4 *)((longlong)pvVar18 + 0x44);
+ *(undefined8 *)(puVar22 + -8) = 0x140032662;
+ WPP_SF_DDq(0xb,uVar18,param_3,uVar15);
+ }
+ *(undefined4 *)(*(longlong *)((longlong)pvVar19 + 0x38) + 0x28) =
+ *(undefined4 *)((longlong)pvVar19 + 0x44);
lVar2 = *(longlong *)(puVar4 + 0x10);
- *(undefined8 *)(puVar22 + -8) = 0x14003358e;
- AfdReturnBuffer((longlong)pvVar18,lVar2);
- *(undefined8 *)(puVar22 + -8) = 0x14003359e;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x140032678;
+ AfdReturnBuffer((longlong)pvVar19,lVar2);
+ *(undefined8 *)(puVar22 + -8) = 0x140032688;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x58);
*(uint *)(puVar4 + 0x3c) = *(int *)(puVar4 + 0x3c) - param_3;
*(int *)(puVar4 + 0x3e) = *(int *)(puVar4 + 0x3e) + -1;
- *(undefined8 *)(puVar22 + -8) = 0x1400335bf;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x1400326a9;
+ KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
LOCK();
plVar1 = (longlong *)(puVar4 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + -1;
UNLOCK();
- uVar19 = lVar2 - 1;
- if (uVar19 == 0 || lVar2 < 1) {
- if (uVar19 == 0) {
- *(undefined8 *)(puVar22 + -8) = 0x1400335e4;
- uVar19 = AfdCloseConnection(puVar4);
+ uVar18 = lVar2 - 1;
+ if (uVar18 == 0 || lVar2 < 1) {
+ if (uVar18 == 0) {
+ *(undefined8 *)(puVar22 + -8) = 0x1400326ce;
+ uVar18 = AfdCloseConnection(puVar4);
}
else {
pcVar10 = (code *)swi(0x29);
- uVar19 = (*pcVar10)(0xe);
- }
- }
- return uVar19 & 0xffffffffffffff00;
+ uVar18 = (*pcVar10)(0xe);
+ }
+ }
+ return uVar18 & 0xffffffffffffff00;
}
}
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
- lVar2 = *(longlong *)(*(longlong *)((longlong)pvVar18 + 0x50) + 0xb8);
+ lVar2 = *(longlong *)(*(longlong *)((longlong)pvVar19 + 0x50) + 0xb8);
*(code **)(lVar2 + -0x10) = AfdRestartBufferSend;
- *(void **)(lVar2 + -8) = pvVar18;
+ *(void **)(lVar2 + -8) = pvVar19;
*(undefined1 *)(lVar2 + -0x45) = 0xe0;
- lVar2 = *(longlong *)(*(longlong *)((longlong)pvVar18 + 0x50) + 0xb8);
+ lVar2 = *(longlong *)(*(longlong *)((longlong)pvVar19 + 0x50) + 0xb8);
*(undefined2 *)(lVar2 + -0x48) = 0x70f;
*(undefined8 *)(lVar2 + -0x20) = *(undefined8 *)(puVar4 + 0xc);
*(undefined8 *)(lVar2 + -0x18) = *(undefined8 *)(puVar4 + 8);
*(undefined4 *)(lVar2 + -0x3c) = 0;
*(uint *)(lVar2 + -0x40) = param_3;
- *(undefined8 *)(*(longlong *)((longlong)pvVar18 + 0x50) + 8) =
- *(undefined8 *)((longlong)pvVar18 + 0x38);
+ *(undefined8 *)(*(longlong *)((longlong)pvVar19 + 0x50) + 8) =
+ *(undefined8 *)((longlong)pvVar19 + 0x38);
*(longlong *)(puVar22 + 0x100) = *(longlong *)(puVar22 + 0x108) + 8;
}
else {
*(longlong *)(puVar22 + 0x100) = param_2 + 8;
}
- lVar2 = *(longlong *)((longlong)pvVar18 + 0x38);
- *(void **)(puVar22 + 0x40) = pvVar18;
+ lVar2 = *(longlong *)((longlong)pvVar19 + 0x38);
+ *(void **)(puVar22 + 0x40) = pvVar19;
*(undefined4 *)(puVar22 + 0x38) = 0;
*(undefined4 *)(puVar22 + 0x30) = *(undefined4 *)(lVar2 + 0x28);
*(longlong *)(puVar22 + 0x28) = lVar2;
*(undefined4 *)(puVar22 + 0x20) = *(undefined4 *)(*(longlong *)(puVar22 + 0x108) + 8);
- *(undefined8 *)(puVar22 + -8) = 0x140033748;
+ *(undefined8 *)(puVar22 + -8) = 0x140032832;
AFDETW_TRACESEND(0,0xbe7,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
*(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
*(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40));
if (*(longlong *)(param_1 + 0xb0) == 0) {
LAB_6:
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
- uVar17 = *(undefined8 *)((longlong)pvVar18 + 0x50);
+ uVar17 = *(undefined8 *)((longlong)pvVar19 + 0x50);
uVar5 = *(undefined8 *)(puVar4 + 0xc);
- *(undefined8 *)(puVar22 + -8) = 0x1400337a1;
+ *(undefined8 *)(puVar22 + -8) = 0x14003288b;
iVar16 = IofCallDriver(uVar5,uVar17);
}
else {
- *(void **)(puVar22 + 0x20) = pvVar18;
- uVar17 = *(undefined8 *)((longlong)pvVar18 + 0x38);
- *(undefined8 *)(puVar22 + -8) = 0x140033790;
- uVar19 = AfdTLStartBufferedVcSend
+ *(void **)(puVar22 + 0x20) = pvVar19;
+ uVar17 = *(undefined8 *)((longlong)pvVar19 + 0x38);
+ *(undefined8 *)(puVar22 + -8) = 0x14003287a;
+ uVar18 = AfdTLStartBufferedVcSend
((longlong)puVar4,uVar17,param_3,(short **)0x0,*(short **)(puVar22 + 0x20))
;
- iVar16 = (int)uVar19;
+ iVar16 = (int)uVar18;
}
}
else {
- psVar8 = *(short **)((longlong)pvVar18 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140033764;
- cVar13 = AfdEnqueueTpSendIrp(param_1,psVar8,0,(longlong)pvVar18);
+ psVar8 = *(short **)((longlong)pvVar19 + 0x50);
+ *(undefined8 *)(puVar22 + -8) = 0x14003284e;
+ cVar13 = AfdEnqueueTpSendIrp((short *)param_1,psVar8,0,(longlong)pvVar19);
if (cVar13 == '\0') goto LAB_6;
iVar16 = 0x103;
}
- *(void **)(puVar22 + 0x40) = pvVar18;
+ *(void **)(puVar22 + 0x40) = pvVar19;
if (-1 < iVar16) {
puVar9 = *(undefined4 **)(puVar22 + 0x118);
*(ulonglong *)(puVar9 + 2) = (ulonglong)param_3;
*puVar9 = 0;
*(undefined4 *)(puVar22 + 0x38) = 0;
*(uint *)(puVar22 + 0x30) = param_3;
*(longlong *)(puVar22 + 0x28) = lVar2;
*(undefined4 *)(puVar22 + 0x20) = **(undefined4 **)(puVar22 + 0x100);
- *(undefined8 *)(puVar22 + -8) = 0x1400337ed;
+ *(undefined8 *)(puVar22 + -8) = 0x1400328d7;
uVar17 = AFDETW_TRACESEND(1,0xbeb,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
*(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
*(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40));
return CONCAT71((int7)((ulonglong)uVar17 >> 8),1);
}
*(int *)(puVar22 + 0x38) = iVar16;
*(uint *)(puVar22 + 0x30) = param_3;
*(longlong *)(puVar22 + 0x28) = lVar2;
*(undefined4 *)(puVar22 + 0x20) = **(undefined4 **)(puVar22 + 0x100);
- *(undefined8 *)(puVar22 + -8) = 0x140033819;
- uVar19 = AFDETW_TRACESEND(1,0xbed,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
+ *(undefined8 *)(puVar22 + -8) = 0x140032903;
+ uVar18 = AFDETW_TRACESEND(1,0xbed,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
*(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
*(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40));
LAB_0:
- return uVar19 & 0xffffffffffffff00;
+ return uVar18 & 0xffffffffffffff00;
}
```
## AfdFastConnectionReceive
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.5|
|i_ratio|0.66|
|m_ratio|0.98|
|b_ratio|0.82|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdFastConnectionReceive|AfdFastConnectionReceive|
|fullname|AfdFastConnectionReceive|AfdFastConnectionReceive|
|refcount|3|3|
|`length`|3504|3631|
|`called`|Expand for full list:
AFDETW_START_ACTIVITY_FASTIO
AFDETW_TRACEBUFFER
AFDETW_TRACERECV
AfdBInitDrainBytesInTransport
AfdBPostDrainReceive
AfdCloseConnection
AfdCopyMdlChainToBufferArray
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qL
WPP_SF_qqExpand for full list:
AFDETW_START_ACTIVITY_FASTIO
AFDETW_TRACEBUFFER
AFDETW_TRACERECV
AfdBInitDrainBytesInTransport
AfdBPostDrainReceive
AfdCloseConnection
AfdCopyMdlChainToBufferArray
AfdIndicateEventSelectEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdReturnBuffer
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
WPP_SF_qL
WPP_SF_qq
AfdFastIoRead|AfdFastIoDeviceControl
AfdFastIoRead|
|paramcount|4|4|
|`address`|140031ef0|140030f00|
|sig|char __fastcall AfdFastConnectionReceive(uint * param_1, longlong param_2, undefined8 param_3, undefined4 * param_4)|char __fastcall AfdFastConnectionReceive(uint * param_1, longlong param_2, undefined8 param_3, undefined4 * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdFastConnectionReceive Called Diff
```diff
--- AfdFastConnectionReceive called
+++ AfdFastConnectionReceive called
@@ -11,0 +12 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -12,0 +14 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdFastConnectionReceive Diff
```diff
--- AfdFastConnectionReceive
+++ AfdFastConnectionReceive
@@ -1,661 +1,698 @@
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
char AfdFastConnectionReceive(uint *param_1,longlong param_2,undefined8 param_3,undefined4 *param_4)
{
ushort *puVar1;
uint *puVar2;
uint uVar3;
undefined2 *puVar4;
longlong lVar5;
undefined8 uVar6;
undefined8 uVar7;
undefined8 uVar8;
longlong lVar9;
longlong *plVar10;
longlong lVar11;
code *pcVar12;
bool bVar13;
char cVar14;
char cVar15;
ushort uVar16;
- undefined8 *puVar17;
+ uint uVar17;
ulonglong uVar18;
- uint *puVar19;
+ undefined8 *puVar19;
uint *puVar20;
- longlong *plVar21;
- undefined1 *puVar22;
+ uint *puVar21;
+ longlong *plVar22;
undefined1 *puVar23;
- ushort uVar24;
+ undefined1 *puVar24;
ushort uVar25;
- uint uVar26;
+ ushort uVar26;
int iVar27;
- longlong *plVar28;
- ulonglong uVar29;
+ ulonglong uVar28;
+ longlong *plVar29;
uint uVar30;
undefined1 auStack_158 [72];
char local_110 [16];
undefined8 local_100;
undefined8 uStack_f8;
undefined8 local_f0;
undefined8 local_e0;
undefined8 uStack_d8;
undefined8 local_c0;
undefined8 local_a8;
undefined8 local_a0;
local_a8 = 0;
local_100 = 0;
uStack_f8 = 0;
local_f0 = 0;
local_e0 = 0;
uStack_d8 = 0;
cVar15 = '\0';
local_a0 = 0;
local_c0 = 0;
*param_4 = 0;
*(undefined8 *)(param_4 + 2) = 0;
- puVar23 = auStack_158;
+ puVar24 = auStack_158;
while( true ) {
- *(undefined8 *)(puVar23 + -8) = 0x140031f76;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x140030f86;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar24 + 0x58);
if ((*(byte *)((longlong)param_1 + 7) & 0x10) != 0) break;
if ((*param_1 & 0xafd2) != 0xafd2) {
LAB_0:
- *(undefined8 *)(puVar23 + -8) = 0x1400322ba;
- KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x1400312f6;
+ KeReleaseInStackQueuedSpinLock(puVar24 + 0x58);
return cVar15;
}
puVar4 = *(undefined2 **)(param_1 + 0x30);
- *(undefined2 **)(puVar23 + 0x88) = puVar4;
+ *(undefined2 **)(puVar24 + 0x88) = puVar4;
if (puVar4 == (undefined2 *)0x0) goto LAB_0;
if ((DAT_1 & 0x40) != 0) {
- *(undefined8 *)(puVar23 + -8) = 0x140031fce;
+ *(undefined8 *)(puVar24 + -8) = 0x140030fde;
WPP_SF_qq(0xc,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,puVar4);
}
if (((*(undefined2 **)(puVar4 + 0x1c) != puVar4 + 0x1c) || (puVar4[0x31] != 0)) ||
((*(uint *)(puVar4 + 2) & 0x110) != 0)) goto LAB_0;
if (puVar4[0x30] == 0) {
if (((cVar15 != '\0') || ((param_1[2] & 0x10) == 0)) || ((*(uint *)(param_2 + 0xc) & 2) != 0))
{
if ((param_1[2] & 0x10) == 0) {
*(undefined1 *)((longlong)param_1 + 0x21) = 1;
}
goto LAB_0;
}
param_1[0x12] = param_1[0x12] & 0xfffffffe;
if (*(longlong *)(param_1 + 0x5e) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0x5e) + 100);
*puVar1 = *puVar1 & 0xfffe;
}
if ((DAT_2 & 0x10) != 0) {
- uVar26 = param_1[0x12];
- *(undefined8 *)(puVar23 + -8) = 0x14003205b;
- WPP_SF_qL(0xd,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,uVar26);
+ uVar17 = param_1[0x12];
+ *(undefined8 *)(puVar24 + -8) = 0x14003106b;
+ WPP_SF_qL(0xd,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,uVar17);
}
cVar15 = '\0';
- *(undefined8 *)(puVar23 + 0xd0) = 0;
- *(undefined8 *)(puVar23 + 0xd8) = 0;
- *(undefined8 *)(puVar23 + 0xe0) = 0;
+ *(undefined8 *)(puVar24 + 0xd0) = 0;
+ *(undefined8 *)(puVar24 + 0xd8) = 0;
+ *(undefined8 *)(puVar24 + 0xe0) = 0;
if (*(longlong *)(param_1 + 0x5e) == 0) goto LAB_3;
- *(undefined8 *)(puVar23 + -8) = 0x14003208d;
+ *(undefined8 *)(puVar24 + -8) = 0x14003109d;
cVar14 = ExAcquireRundownProtection(param_1 + 0x60);
if (cVar14 == '\0') goto LAB_3;
- puVar23[0x170] = 1;
+ puVar24[0x170] = 1;
bVar13 = true;
lVar5 = *(longlong *)(param_1 + 0x5e);
uVar6 = *(undefined8 *)(lVar5 + 0x40);
- uVar25 = *(ushort *)(lVar5 + 0x6a);
- if ((uVar25 & 2) != 0) goto LAB_4;
- uVar24 = uVar25 | 2;
- *(ushort *)(lVar5 + 0x6a) = uVar24;
- goto joined_r0x0001400320c9;
- }
- plVar28 = (longlong *)(puVar4 + 0x24);
- plVar21 = (longlong *)*plVar28;
+ uVar26 = *(ushort *)(lVar5 + 0x6a);
+ if ((uVar26 & 2) != 0) goto LAB_4;
+ uVar25 = uVar26 | 2;
+ *(ushort *)(lVar5 + 0x6a) = uVar25;
+ goto joined_r0x0001400310d9;
+ }
+ plVar29 = (longlong *)(puVar4 + 0x24);
+ plVar22 = (longlong *)*plVar29;
if ((param_1[1] & 0x10) == 0) {
- uVar26 = *(uint *)(puVar23 + 0x170);
- }
- else if (((*(byte *)((longlong)plVar21 + 0x4c) & 4) != 0) ||
- (uVar26 = *(uint *)(puVar23 + 0x170), uVar26 < *(uint *)(plVar21 + 8))) break;
- lVar9 = *(longlong *)(puVar23 + 0x178);
+ uVar17 = *(uint *)(puVar24 + 0x170);
+ }
+ else if (((*(byte *)((longlong)plVar22 + 0x4c) & 4) != 0) ||
+ (uVar17 = *(uint *)(puVar24 + 0x170), uVar17 < *(uint *)(plVar22 + 8))) break;
+ lVar9 = *(longlong *)(puVar24 + 0x178);
uVar30 = *(uint *)(lVar9 + 8);
- *(uint *)(puVar23 + 0x70) = uVar30;
- *(undefined1 **)(puVar23 + 0x80) = puVar23 + 0x78;
- *(undefined1 **)(puVar23 + 0x78) = puVar23 + 0x78;
+ *(uint *)(puVar24 + 0x70) = uVar30;
+ *(undefined1 **)(puVar24 + 0x80) = puVar24 + 0x78;
+ *(undefined1 **)(puVar24 + 0x78) = puVar24 + 0x78;
LOCK();
plVar10 = (longlong *)(puVar4 + 0x18);
lVar5 = *plVar10;
*plVar10 = *plVar10 + 1;
UNLOCK();
- puVar22 = puVar23;
+ puVar23 = puVar24;
if (lVar5 + 1 < 2) {
pcVar12 = (code *)swi(0x29);
(*pcVar12)(0xe);
- puVar22 = puVar23 + 8;
+ puVar23 = puVar24 + 8;
}
if (g_AfdEtwTraceEnable != 0) {
- *(undefined8 *)(puVar22 + 0x98) = _DAT_5;
- }
- *(undefined4 *)(puVar22 + 0x90) = 0;
- uVar29 = (ulonglong)uVar26;
+ *(undefined8 *)(puVar23 + 0x98) = _DAT_5;
+ }
+ *(undefined4 *)(puVar23 + 0x90) = 0;
+ uVar28 = (ulonglong)uVar17;
uVar18 = *(ulonglong *)(lVar9 + 8);
- if (uVar18 < uVar29) {
- while (uVar3 = *(uint *)(plVar21 + 8), (ulonglong)uVar3 <= uVar29 - uVar18) {
- lVar5 = *plVar21;
- plVar10 = (longlong *)plVar21[1];
- if ((*(longlong **)(lVar5 + 8) != plVar21) || ((longlong *)*plVar10 != plVar21))
+ if (uVar18 < uVar28) {
+ while (uVar3 = *(uint *)(plVar22 + 8), (ulonglong)uVar3 <= uVar28 - uVar18) {
+ lVar5 = *plVar22;
+ plVar10 = (longlong *)plVar22[1];
+ if ((*(longlong **)(lVar5 + 8) != plVar22) || ((longlong *)*plVar10 != plVar22))
goto LAB_6;
*plVar10 = lVar5;
*(longlong **)(lVar5 + 8) = plVar10;
- plVar10 = *(longlong **)(puVar22 + 0x80);
- if ((undefined1 *)*plVar10 != puVar22 + 0x78) goto LAB_6;
- *plVar21 = (longlong)(puVar22 + 0x78);
- plVar21[1] = (longlong)plVar10;
- *plVar10 = (longlong)plVar21;
- *(longlong **)(puVar22 + 0x80) = plVar21;
- *(int *)(puVar4 + 0x2c) = *(int *)(puVar4 + 0x2c) - (int)plVar21[8];
+ plVar10 = *(longlong **)(puVar23 + 0x80);
+ if ((undefined1 *)*plVar10 != puVar23 + 0x78) goto LAB_6;
+ *plVar22 = (longlong)(puVar23 + 0x78);
+ plVar22[1] = (longlong)plVar10;
+ *plVar10 = (longlong)plVar22;
+ *(longlong **)(puVar23 + 0x80) = plVar22;
+ *(int *)(puVar4 + 0x2c) = *(int *)(puVar4 + 0x2c) - (int)plVar22[8];
puVar4[0x30] = puVar4[0x30] + -1;
- uVar18 = (ulonglong)*(uint *)(plVar21 + 8) + *(longlong *)(lVar9 + 8);
+ uVar18 = (ulonglong)*(uint *)(plVar22 + 8) + *(longlong *)(lVar9 + 8);
*(ulonglong *)(lVar9 + 8) = uVar18;
- if ((((param_1[1] & 0x10) != 0) || (plVar21 = (longlong *)*plVar28, plVar21 == plVar28)) ||
- (uVar29 <= uVar18)) goto LAB_7;
- }
- iVar27 = uVar26 - (int)uVar18;
- *(int *)(puVar22 + 0x90) = iVar27;
- *(longlong **)(puVar22 + 0xb0) = plVar21;
- *(uint *)(plVar21 + 8) = uVar3 - iVar27;
- *(int *)(plVar21 + 2) = (int)plVar21[2] + iVar27;
+ if ((((param_1[1] & 0x10) != 0) || (plVar22 = (longlong *)*plVar29, plVar22 == plVar29)) ||
+ (uVar28 <= uVar18)) goto LAB_7;
+ }
+ iVar27 = uVar17 - (int)uVar18;
+ *(int *)(puVar23 + 0x90) = iVar27;
+ *(longlong **)(puVar23 + 0xb0) = plVar22;
+ *(uint *)(plVar22 + 8) = uVar3 - iVar27;
+ *(int *)(plVar22 + 2) = (int)plVar22[2] + iVar27;
LOCK();
- plVar21 = plVar21 + 3;
- lVar5 = *plVar21;
- *plVar21 = *plVar21 + 1;
+ plVar22 = plVar22 + 3;
+ lVar5 = *plVar22;
+ *plVar22 = *plVar22 + 1;
UNLOCK();
if (lVar5 + 1 < 2) {
pcVar12 = (code *)swi(0x29);
(*pcVar12)(0xe);
- puVar22 = puVar22 + 8;
+ puVar23 = puVar23 + 8;
}
*(int *)(puVar4 + 0x2c) = *(int *)(puVar4 + 0x2c) - iVar27;
- *(ulonglong *)(lVar9 + 8) = uVar29;
- uVar26 = *(uint *)(puVar22 + 0x170);
+ *(ulonglong *)(lVar9 + 8) = uVar28;
+ uVar17 = *(uint *)(puVar23 + 0x170);
}
LAB_7:
param_1[0x12] = param_1[0x12] & 0xfffffffe;
- if ((longlong *)*plVar28 == plVar28) {
+ if ((longlong *)*plVar29 == plVar29) {
if (*(longlong *)(param_1 + 0x5e) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0x5e) + 100);
*puVar1 = *puVar1 & 0xfffe;
}
- if ((((ulonglong)uVar26 <= *(ulonglong *)(lVar9 + 8)) || ((param_1[1] & 0x10) != 0)) ||
- (uVar26 = param_1[0x62], puVar22[0x51] = 1, (uVar26 & 1) != 0)) {
- puVar22[0x51] = 0;
+ if ((((ulonglong)uVar17 <= *(ulonglong *)(lVar9 + 8)) || ((param_1[1] & 0x10) != 0)) ||
+ (uVar17 = param_1[0x62], puVar23[0x52] = 1, (uVar17 & 1) != 0)) {
+ puVar23[0x52] = 0;
}
if ((param_1[2] & 0x10) == 0) {
*(undefined1 *)((longlong)param_1 + 0x21) = 1;
}
if (((param_1[2] >> 8 & 1) != 0) && (AfdDoNotHoldNICBuffers == 0)) {
if (*(int *)(puVar4 + 0x7e) != 0) {
LOCK();
_AfdTimerWheelCurrentConnectionCount = _AfdTimerWheelCurrentConnectionCount + -1;
UNLOCK();
}
*(undefined4 *)(puVar4 + 0x7e) = 0;
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140032513;
+ *(undefined8 *)(puVar23 + -8) = 0x140031543;
AfdIndicateEventSelectEvent((short *)param_1,1,0);
- puVar22[0x51] = 0;
+ puVar23[0x52] = 0;
}
if (((*(int *)(puVar4 + 0x32) == 0) || (*(uint *)(puVar4 + 0x48) <= *(uint *)(puVar4 + 0x2c)))
|| (*(int *)(puVar4 + 0x44) != 0)) {
cVar15 = '\0';
- *(undefined8 *)(puVar22 + 0x100) = 0;
- *(undefined8 *)(puVar22 + 0x108) = 0;
- *(undefined8 *)(puVar22 + 0x110) = 0;
+ *(undefined8 *)(puVar23 + 0x100) = 0;
+ *(undefined8 *)(puVar23 + 0x108) = 0;
+ *(undefined8 *)(puVar23 + 0x110) = 0;
if (*(longlong *)(param_1 + 0x5e) != 0) {
- *(undefined8 *)(puVar22 + -8) = 0x1400327f5;
+ *(undefined8 *)(puVar23 + -8) = 0x14003184d;
cVar14 = ExAcquireRundownProtection(param_1 + 0x60);
if (cVar14 != '\0') {
- puVar22[0x50] = 1;
+ puVar23[0x50] = 1;
bVar13 = true;
lVar5 = *(longlong *)(param_1 + 0x5e);
uVar6 = *(undefined8 *)(lVar5 + 0x40);
if ((*(ushort *)(lVar5 + 0x6a) & 2) == 0) {
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) | 2;
LAB_8:
do {
- uVar25 = *(ushort *)(lVar5 + 0x6a);
- if ((uVar25 & 1) != 0) {
+ uVar26 = *(ushort *)(lVar5 + 0x6a);
+ if ((uVar26 & 1) != 0) {
param_1[0x5e] = 0;
param_1[0x5f] = 0;
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
- *(undefined8 *)(puVar22 + -8) = 0x1400329ae;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x140031a0e;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
bVar13 = false;
- *(undefined8 *)(puVar22 + -8) = 0x1400329c1;
+ *(undefined8 *)(puVar23 + -8) = 0x140031a21;
AfdNotifyDestroyContext(uVar6,lVar5);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar23 + -8) = 0x140031a35;
+ uVar18 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar17 = (uint)uVar18;
+ }
+ else {
+ uVar17 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar17 != 0) {
+ *(undefined8 *)(puVar23 + -8) = 0x140031a48;
+ ExFreePoolWithTag(lVar5,0x4e646641);
+ }
goto LAB_9;
}
- *(undefined8 *)(puVar22 + -8) = 0x140032846;
+ *(undefined8 *)(puVar23 + -8) = 0x1400318a6;
uVar16 = AfdNotifyComputeEvents(lVar5);
*(undefined2 *)(lVar5 + 0x66) = *(undefined2 *)(lVar5 + 100);
- uVar24 = *(ushort *)(lVar5 + 0x68);
- if (uVar16 == uVar24) {
+ uVar25 = *(ushort *)(lVar5 + 0x68);
+ if (uVar16 == uVar25) {
if ((*(byte *)(lVar5 + 99) & 1) != 0) {
- uVar25 = uVar25 | 4;
+ uVar26 = uVar26 | 4;
}
LAB_10:
- *(ushort *)(lVar5 + 0x6a) = uVar25 & 0xfffd;
+ *(ushort *)(lVar5 + 0x6a) = uVar26 & 0xfffd;
bVar13 = true;
goto LAB_9;
}
- if ((uVar16 & uVar24) != 0) goto LAB_10;
- if (uVar24 == 0) {
+ if ((uVar16 & uVar25) != 0) goto LAB_10;
+ if (uVar25 == 0) {
*(ushort *)(lVar5 + 0x68) = uVar16;
- *(undefined8 *)(puVar22 + -8) = 0x14003290d;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
- *(undefined8 *)(puVar22 + -8) = 0x14003291c;
+ *(undefined8 *)(puVar23 + -8) = 0x14003196d;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x14003197c;
ObfReferenceObject(uVar6);
- puVar22[0x40] = AfdPriorityBoost;
- puVar22[0x38] = 0;
- *(longlong *)(puVar22 + 0x30) = lVar5;
- puVar22[0x28] = 0;
- *(ulonglong *)(puVar22 + 0x20) = (ulonglong)uVar16;
+ puVar23[0x40] = AfdPriorityBoost;
+ puVar23[0x38] = 0;
+ *(longlong *)(puVar23 + 0x30) = lVar5;
+ puVar23[0x28] = 0;
+ *(ulonglong *)(puVar23 + 0x20) = (ulonglong)uVar16;
uVar7 = *(undefined8 *)(lVar5 + 0x58);
uVar8 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140032955;
+ *(undefined8 *)(puVar23 + -8) = 0x1400319b5;
IoSetIoCompletionEx3(uVar8,uVar7);
- *(undefined8 *)(puVar22 + -8) = 0x14003296d;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x1400319cd;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
goto LAB_8;
}
- *(undefined8 *)(puVar22 + -8) = 0x140032882;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x1400318e2;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
uVar7 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140032895;
+ *(undefined8 *)(puVar23 + -8) = 0x1400318f5;
cVar15 = IoCancelMiniCompletionPacket(uVar7,lVar5);
if (cVar15 != '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x1400328d9;
+ *(undefined8 *)(puVar23 + -8) = 0x140031939;
ObfDereferenceObject(uVar6);
- *(undefined8 *)(puVar22 + -8) = 0x1400328ec;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x14003194c;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
*(undefined2 *)(lVar5 + 0x68) = 0;
goto LAB_8;
}
bVar13 = true;
- *(undefined8 *)(puVar22 + -8) = 0x1400328b1;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x140031911;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
} while (*(short *)(lVar5 + 0x68) == 0);
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
}
LAB_9:
if (!bVar13) {
- *(undefined8 *)(puVar22 + -8) = 0x1400329d9;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x140031a65;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
}
- uVar30 = *(uint *)(puVar22 + 0x70);
- cVar15 = puVar22[0x50];
- }
- }
- *(undefined8 *)(puVar22 + -8) = 0x1400329f2;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
+ uVar30 = *(uint *)(puVar23 + 0x70);
+ cVar15 = puVar23[0x50];
+ }
+ }
+ *(undefined8 *)(puVar23 + -8) = 0x140031a7e;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
if (cVar15 != '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x140032a09;
+ *(undefined8 *)(puVar23 + -8) = 0x140031a95;
ExReleaseRundownProtection(param_1 + 0x60);
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x14003254d;
- puVar17 = AfdBInitDrainBytesInTransport((longlong)puVar4,(longlong)param_1);
- *(undefined8 **)(puVar22 + 0xa0) = puVar17;
+ *(undefined8 *)(puVar23 + -8) = 0x14003157d;
+ puVar19 = AfdBInitDrainBytesInTransport((longlong)puVar4,(longlong)param_1);
+ *(undefined8 **)(puVar23 + 0xa0) = puVar19;
cVar15 = '\0';
- *(undefined8 *)(puVar22 + 0xe8) = 0;
- *(undefined8 *)(puVar22 + 0xf0) = 0;
- *(undefined8 *)(puVar22 + 0xf8) = 0;
+ *(undefined8 *)(puVar23 + 0xe8) = 0;
+ *(undefined8 *)(puVar23 + 0xf0) = 0;
+ *(undefined8 *)(puVar23 + 0xf8) = 0;
if (*(longlong *)(param_1 + 0x5e) != 0) {
- *(undefined8 *)(puVar22 + -8) = 0x14003258a;
+ *(undefined8 *)(puVar23 + -8) = 0x1400315ba;
cVar14 = ExAcquireRundownProtection(param_1 + 0x60);
if (cVar14 != '\0') {
- puVar22[0x50] = 1;
+ puVar23[0x50] = 1;
cVar15 = '\x01';
lVar5 = *(longlong *)(param_1 + 0x5e);
uVar6 = *(undefined8 *)(lVar5 + 0x40);
- uVar25 = *(ushort *)(lVar5 + 0x6a);
- if ((uVar25 & 2) == 0) {
- uVar24 = uVar25 | 2;
- *(ushort *)(lVar5 + 0x6a) = uVar24;
- if ((uVar25 & 1) == 0) {
- puVar22[0x52] = 1;
+ uVar26 = *(ushort *)(lVar5 + 0x6a);
+ if ((uVar26 & 2) == 0) {
+ uVar25 = uVar26 | 2;
+ *(ushort *)(lVar5 + 0x6a) = uVar25;
+ if ((uVar26 & 1) == 0) {
+ puVar23[0x51] = 1;
do {
- *(undefined8 *)(puVar22 + -8) = 0x1400325d8;
+ *(undefined8 *)(puVar23 + -8) = 0x140031608;
uVar16 = AfdNotifyComputeEvents(lVar5);
*(undefined2 *)(lVar5 + 0x66) = *(undefined2 *)(lVar5 + 100);
- uVar25 = *(ushort *)(lVar5 + 0x68);
- if (uVar16 == uVar25) {
+ uVar26 = *(ushort *)(lVar5 + 0x68);
+ if (uVar16 == uVar26) {
if ((*(byte *)(lVar5 + 99) & 1) != 0) {
- uVar24 = uVar24 | 4;
+ uVar25 = uVar25 | 4;
}
LAB_11:
- *(ushort *)(lVar5 + 0x6a) = uVar24 & 0xfffd;
+ *(ushort *)(lVar5 + 0x6a) = uVar25 & 0xfffd;
cVar15 = '\x01';
goto LAB_12;
}
- if ((uVar16 & uVar25) != 0) goto LAB_11;
- if (uVar25 == 0) {
+ if ((uVar16 & uVar26) != 0) goto LAB_11;
+ if (uVar26 == 0) {
*(ushort *)(lVar5 + 0x68) = uVar16;
- *(undefined8 *)(puVar22 + -8) = 0x140032698;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
- *(undefined8 *)(puVar22 + -8) = 0x1400326a7;
+ *(undefined8 *)(puVar23 + -8) = 0x1400316bf;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x1400316ce;
ObfReferenceObject(uVar6);
- puVar22[0x40] = AfdPriorityBoost;
- puVar22[0x38] = 0;
- *(longlong *)(puVar22 + 0x30) = lVar5;
- puVar22[0x28] = 0;
- *(ulonglong *)(puVar22 + 0x20) = (ulonglong)uVar16;
+ puVar23[0x40] = AfdPriorityBoost;
+ puVar23[0x38] = 0;
+ *(longlong *)(puVar23 + 0x30) = lVar5;
+ puVar23[0x28] = 0;
+ *(ulonglong *)(puVar23 + 0x20) = (ulonglong)uVar16;
uVar7 = *(undefined8 *)(lVar5 + 0x58);
uVar8 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x1400326e0;
+ *(undefined8 *)(puVar23 + -8) = 0x140031707;
IoSetIoCompletionEx3(uVar8,uVar7);
- *(undefined8 *)(puVar22 + -8) = 0x1400326f5;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x14003171c;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140032611;
+ *(undefined8 *)(puVar23 + -8) = 0x14003163d;
KeReleaseInStackQueuedSpinLock();
uVar7 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140032624;
+ *(undefined8 *)(puVar23 + -8) = 0x140031650;
cVar15 = IoCancelMiniCompletionPacket(uVar7,lVar5);
if (cVar15 == '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x14003263d;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x140031669;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
if (*(short *)(lVar5 + 0x68) != 0) {
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
- cVar15 = puVar22[0x52];
- goto LAB_12;
+ goto LAB_13;
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x14003266a;
+ *(undefined8 *)(puVar23 + -8) = 0x140031691;
ObfDereferenceObject(uVar6);
- *(undefined8 *)(puVar22 + -8) = 0x14003267f;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x1400316a6;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
*(undefined2 *)(lVar5 + 0x68) = 0;
}
}
- uVar24 = *(ushort *)(lVar5 + 0x6a);
- } while ((uVar24 & 1) == 0);
+ uVar25 = *(ushort *)(lVar5 + 0x6a);
+ } while ((uVar25 & 1) == 0);
}
param_1[0x5e] = 0;
param_1[0x5f] = 0;
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
- *(undefined8 *)(puVar22 + -8) = 0x140032726;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
- *(undefined8 *)(puVar22 + -8) = 0x140032736;
+ *(undefined8 *)(puVar23 + -8) = 0x14003174d;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ puVar23[0x51] = 0;
+ *(undefined8 *)(puVar23 + -8) = 0x140031762;
AfdNotifyDestroyContext(uVar6,lVar5);
- cVar15 = '\0';
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar23 + -8) = 0x140031790;
+ uVar18 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar17 = (uint)uVar18;
+ }
+ else {
+ uVar17 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar17 != 0) {
+ *(undefined8 *)(puVar23 + -8) = 0x1400317a3;
+ ExFreePoolWithTag(lVar5,0x4e646641);
+ }
+LAB_13:
+ cVar15 = puVar23[0x51];
}
LAB_12:
if (cVar15 == '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x14003274c;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar22 + 0x58);
+ *(undefined8 *)(puVar23 + -8) = 0x1400317c1;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
}
- uVar30 = *(uint *)(puVar22 + 0x70);
- puVar17 = *(undefined8 **)(puVar22 + 0xa0);
- cVar15 = puVar22[0x50];
- }
- }
- *(undefined8 *)(puVar22 + -8) = 0x14003276f;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x58);
+ uVar30 = *(uint *)(puVar23 + 0x70);
+ puVar19 = *(undefined8 **)(puVar23 + 0xa0);
+ cVar15 = puVar23[0x50];
+ }
+ }
+ *(undefined8 *)(puVar23 + -8) = 0x1400317e4;
+ KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
if (cVar15 != '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x140032786;
+ *(undefined8 *)(puVar23 + -8) = 0x1400317fb;
ExReleaseRundownProtection(param_1 + 0x60);
}
- if (puVar17 != (undefined8 *)0x0) {
- *(undefined8 *)(puVar22 + -8) = 0x14003279c;
- AfdBPostDrainReceive(puVar17);
- }
- }
- lVar5 = *(longlong *)(puVar22 + 0x98);
- *(undefined8 *)(puVar22 + -8) = 0x140032a21;
- puVar20 = param_1;
+ if (puVar19 != (undefined8 *)0x0) {
+ *(undefined8 *)(puVar23 + -8) = 0x140031811;
+ AfdBPostDrainReceive(puVar19);
+ }
+ }
+ lVar5 = *(longlong *)(puVar23 + 0x98);
+ *(undefined8 *)(puVar23 + -8) = 0x140031aad;
+ puVar21 = param_1;
AFDETW_START_ACTIVITY_FASTIO(param_1,lVar5);
- while (puVar19 = *(uint **)(puVar22 + 0x78), puVar19 != (uint *)(puVar22 + 0x78)) {
- *(uint **)(puVar22 + 0xa0) = puVar19;
- lVar9 = *(longlong *)puVar19;
- if ((*(undefined1 **)(puVar19 + 2) != puVar22 + 0x78) || (*(uint **)(lVar9 + 8) != puVar19)) {
+ while (puVar20 = *(uint **)(puVar23 + 0x78), puVar20 != (uint *)(puVar23 + 0x78)) {
+ *(uint **)(puVar23 + 0xa0) = puVar20;
+ lVar9 = *(longlong *)puVar20;
+ if ((*(undefined1 **)(puVar20 + 2) != puVar23 + 0x78) || (*(uint **)(lVar9 + 8) != puVar20)) {
LAB_6:
pcVar12 = (code *)swi(0x29);
(*pcVar12)(3);
pcVar12 = (code *)swi(3);
cVar15 = (*pcVar12)();
return cVar15;
}
- *(longlong *)(puVar22 + 0x78) = lVar9;
- puVar20 = (uint *)(puVar22 + 0x78);
- *(uint **)(lVar9 + 8) = puVar20;
- if (puVar19[0x10] != 0) {
- plVar28 = *(longlong **)(puVar22 + 0x168);
- uVar6 = *(undefined8 *)(*plVar28 + 8);
- *(undefined8 *)(puVar22 + 0xb8) = uVar6;
- lVar9 = *(longlong *)(puVar19 + 0xe);
- *(undefined8 *)(puVar22 + -8) = 0x140032cdc;
+ *(longlong *)(puVar23 + 0x78) = lVar9;
+ puVar21 = (uint *)(puVar23 + 0x78);
+ *(uint **)(lVar9 + 8) = puVar21;
+ if (puVar20[0x10] != 0) {
+ plVar29 = *(longlong **)(puVar23 + 0x168);
+ uVar6 = *(undefined8 *)(*plVar29 + 8);
+ *(undefined8 *)(puVar23 + 0xb8) = uVar6;
+ lVar9 = *(longlong *)(puVar20 + 0xe);
+ *(undefined8 *)(puVar23 + -8) = 0x140031d6b;
AFDETW_TRACEBUFFER(uVar6,lVar5,lVar9,0);
- *(uint *)(puVar22 + 0x28) = puVar19[0x10];
- *(uint *)(puVar22 + 0x20) = puVar19[4];
- plVar21 = *(longlong **)(puVar19 + 0xe);
- lVar9 = plVar28[1];
- puVar20 = (uint *)*plVar28;
- *(undefined8 *)(puVar22 + -8) = 0x140032cfd;
+ *(uint *)(puVar23 + 0x28) = puVar20[0x10];
+ *(uint *)(puVar23 + 0x20) = puVar20[4];
+ plVar22 = *(longlong **)(puVar20 + 0xe);
+ lVar9 = plVar29[1];
+ puVar21 = (uint *)*plVar29;
+ *(undefined8 *)(puVar23 + -8) = 0x140031d8c;
AfdCopyMdlChainToBufferArray
- (puVar20,uVar30,(int)lVar9,plVar21,*(uint *)(puVar22 + 0x20),
- *(uint *)(puVar22 + 0x28));
- uVar30 = uVar30 + puVar19[0x10];
+ (puVar21,uVar30,(int)lVar9,plVar22,*(uint *)(puVar23 + 0x20),
+ *(uint *)(puVar23 + 0x28));
+ uVar30 = uVar30 + puVar20[0x10];
}
LOCK();
- puVar2 = puVar19 + 6;
+ puVar2 = puVar20 + 6;
lVar9 = *(longlong *)puVar2;
*(longlong *)puVar2 = *(longlong *)puVar2 + -1;
UNLOCK();
if (lVar9 < 2) {
if (lVar9 == 1) {
lVar9 = *(longlong *)(puVar4 + 0x10);
- *(undefined8 *)(puVar22 + -8) = 0x140032e39;
- AfdReturnBuffer((longlong)puVar19,lVar9);
- puVar20 = puVar19;
+ *(undefined8 *)(puVar23 + -8) = 0x140031ec9;
+ AfdReturnBuffer((longlong)puVar20,lVar9);
+ puVar21 = puVar20;
}
else {
- puVar20 = (uint *)0xe;
+ puVar21 = (uint *)0xe;
pcVar12 = (code *)swi(0x29);
(*pcVar12)();
- puVar22 = puVar22 + 8;
- }
- }
- }
- lVar9 = *(longlong *)(puVar22 + 0xb0);
+ puVar23 = puVar23 + 8;
+ }
+ }
+ }
+ lVar9 = *(longlong *)(puVar23 + 0xb0);
if (lVar9 == 0) {
- puVar17 = *(undefined8 **)(puVar22 + 0x168);
+ puVar19 = *(undefined8 **)(puVar23 + 0x168);
}
else {
lVar11 = *(longlong *)(lVar9 + 0x38);
- *(undefined8 *)(puVar22 + -8) = 0x140032a54;
- AFDETW_TRACEBUFFER(puVar20,lVar5,lVar11,0);
+ *(undefined8 *)(puVar23 + -8) = 0x140031ae3;
+ AFDETW_TRACEBUFFER(puVar21,lVar5,lVar11,0);
iVar27 = *(int *)(lVar9 + 0x10);
- *(int *)(puVar22 + 0x28) = *(int *)(puVar22 + 0x90);
- *(int *)(puVar22 + 0x20) = iVar27 - *(int *)(puVar22 + 0x90);
- plVar28 = *(longlong **)(lVar9 + 0x38);
- puVar17 = *(undefined8 **)(puVar22 + 0x168);
- iVar27 = *(int *)(puVar17 + 1);
- puVar20 = (uint *)*puVar17;
- *(undefined8 *)(puVar22 + -8) = 0x140032a85;
+ *(int *)(puVar23 + 0x28) = *(int *)(puVar23 + 0x90);
+ *(int *)(puVar23 + 0x20) = iVar27 - *(int *)(puVar23 + 0x90);
+ plVar29 = *(longlong **)(lVar9 + 0x38);
+ puVar19 = *(undefined8 **)(puVar23 + 0x168);
+ iVar27 = *(int *)(puVar19 + 1);
+ puVar21 = (uint *)*puVar19;
+ *(undefined8 *)(puVar23 + -8) = 0x140031b14;
AfdCopyMdlChainToBufferArray
- (puVar20,uVar30,iVar27,plVar28,*(uint *)(puVar22 + 0x20),*(uint *)(puVar22 + 0x28));
+ (puVar21,uVar30,iVar27,plVar29,*(uint *)(puVar23 + 0x20),*(uint *)(puVar23 + 0x28));
LOCK();
- plVar28 = (longlong *)(lVar9 + 0x18);
- lVar5 = *plVar28;
- *plVar28 = *plVar28 + -1;
+ plVar29 = (longlong *)(lVar9 + 0x18);
+ lVar5 = *plVar29;
+ *plVar29 = *plVar29 + -1;
UNLOCK();
if (lVar5 < 2) {
if (lVar5 == 1) {
lVar5 = *(longlong *)(puVar4 + 0x10);
- *(undefined8 *)(puVar22 + -8) = 0x140032aaa;
+ *(undefined8 *)(puVar23 + -8) = 0x140031b39;
AfdReturnBuffer(lVar9,lVar5);
}
else {
pcVar12 = (code *)swi(0x29);
(*pcVar12)();
- puVar22 = puVar22 + 8;
- }
- }
- }
- cVar15 = puVar22[0x51];
+ puVar23 = puVar23 + 8;
+ }
+ }
+ }
+ cVar15 = puVar23[0x52];
if ((cVar15 == '\0') || ((param_1[0x12] & 1) == 0)) {
LOCK();
- plVar28 = (longlong *)(puVar4 + 0x18);
- lVar5 = *plVar28;
- *plVar28 = *plVar28 + -1;
+ plVar29 = (longlong *)(puVar4 + 0x18);
+ lVar5 = *plVar29;
+ *plVar29 = *plVar29 + -1;
UNLOCK();
if (lVar5 < 2) {
if (lVar5 == 1) {
- *(undefined8 *)(puVar22 + -8) = 0x140032bd7;
+ *(undefined8 *)(puVar23 + -8) = 0x140031c66;
AfdCloseConnection(puVar4);
}
else {
pcVar12 = (code *)swi(0x29);
(*pcVar12)();
- puVar22 = puVar22 + 8;
- }
- }
- puVar22[0x48] = 0;
- uVar6 = *(undefined8 *)(puVar22 + 0x98);
- *(undefined8 *)(puVar22 + 0x40) = uVar6;
- *(undefined4 *)(puVar22 + 0x38) = 0;
- *(undefined4 *)(puVar22 + 0x30) = *(undefined4 *)(puVar22 + 0x170);
- uVar7 = *(undefined8 *)(puVar22 + 0xb8);
- *(undefined8 *)(puVar22 + 0x28) = uVar7;
- *(undefined4 *)(puVar22 + 0x20) = *(undefined4 *)(puVar17 + 1);
- *(undefined8 *)(puVar22 + -8) = 0x140032c30;
- AFDETW_TRACERECV(0,0x1013,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
- *(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
- *(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40),puVar22[0x48]);
- puVar22[0x48] = 1;
- *(undefined8 *)(puVar22 + 0x40) = uVar6;
- *(undefined4 *)(puVar22 + 0x38) = **(undefined4 **)(puVar22 + 0x178);
- *(undefined4 *)(puVar22 + 0x30) = (*(undefined4 **)(puVar22 + 0x178))[2];
- *(undefined8 *)(puVar22 + 0x28) = uVar7;
- *(undefined4 *)(puVar22 + 0x20) = *(undefined4 *)(puVar17 + 1);
- *(undefined8 *)(puVar22 + -8) = 0x140032c73;
- AFDETW_TRACERECV(1,0x1014,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
- *(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
- *(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40),puVar22[0x48]);
+ puVar23 = puVar23 + 8;
+ }
+ }
+ puVar23[0x48] = 0;
+ uVar6 = *(undefined8 *)(puVar23 + 0x98);
+ *(undefined8 *)(puVar23 + 0x40) = uVar6;
+ *(undefined4 *)(puVar23 + 0x38) = 0;
+ *(undefined4 *)(puVar23 + 0x30) = *(undefined4 *)(puVar23 + 0x170);
+ uVar7 = *(undefined8 *)(puVar23 + 0xb8);
+ *(undefined8 *)(puVar23 + 0x28) = uVar7;
+ *(undefined4 *)(puVar23 + 0x20) = *(undefined4 *)(puVar19 + 1);
+ *(undefined8 *)(puVar23 + -8) = 0x140031cbf;
+ AFDETW_TRACERECV(0,0x1013,(short *)param_1,1,*(undefined4 *)(puVar23 + 0x20),
+ *(undefined8 *)(puVar23 + 0x28),*(undefined4 *)(puVar23 + 0x30),
+ *(undefined4 *)(puVar23 + 0x38),*(short **)(puVar23 + 0x40),puVar23[0x48]);
+ puVar23[0x48] = 1;
+ *(undefined8 *)(puVar23 + 0x40) = uVar6;
+ *(undefined4 *)(puVar23 + 0x38) = **(undefined4 **)(puVar23 + 0x178);
+ *(undefined4 *)(puVar23 + 0x30) = (*(undefined4 **)(puVar23 + 0x178))[2];
+ *(undefined8 *)(puVar23 + 0x28) = uVar7;
+ *(undefined4 *)(puVar23 + 0x20) = *(undefined4 *)(puVar19 + 1);
+ *(undefined8 *)(puVar23 + -8) = 0x140031d02;
+ AFDETW_TRACERECV(1,0x1014,(short *)param_1,1,*(undefined4 *)(puVar23 + 0x20),
+ *(undefined8 *)(puVar23 + 0x28),*(undefined4 *)(puVar23 + 0x30),
+ *(undefined4 *)(puVar23 + 0x38),*(short **)(puVar23 + 0x40),puVar23[0x48]);
return '\x01';
}
LOCK();
- plVar28 = (longlong *)(puVar4 + 0x18);
- lVar5 = *plVar28;
- *plVar28 = *plVar28 + -1;
+ plVar29 = (longlong *)(puVar4 + 0x18);
+ lVar5 = *plVar29;
+ *plVar29 = *plVar29 + -1;
UNLOCK();
- param_2 = *(longlong *)(puVar22 + 0x168);
- puVar23 = puVar22;
+ param_2 = *(longlong *)(puVar23 + 0x168);
+ puVar24 = puVar23;
if (lVar5 < 2) {
if (lVar5 == 1) {
- *(undefined8 *)(puVar22 + -8) = 0x140032ba5;
+ *(undefined8 *)(puVar23 + -8) = 0x140031c34;
AfdCloseConnection(puVar4);
}
else {
pcVar12 = (code *)swi(0x29);
(*pcVar12)(0xe);
- puVar23 = puVar22 + 8;
- param_2 = *(longlong *)(puVar22 + 0x170);
+ puVar24 = puVar23 + 8;
+ param_2 = *(longlong *)(puVar23 + 0x170);
}
}
}
- *(undefined8 *)(puVar23 + -8) = 0x1400322f0;
- KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x14003132c;
+ KeReleaseInStackQueuedSpinLock(puVar24 + 0x58);
return '\0';
-joined_r0x0001400320c9:
- if ((uVar25 & 1) != 0) {
+joined_r0x0001400310d9:
+ if ((uVar26 & 1) != 0) {
param_1[0x5e] = 0;
param_1[0x5f] = 0;
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
- *(undefined8 *)(puVar23 + -8) = 0x14003221c;
- KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x14003122c;
+ KeReleaseInStackQueuedSpinLock(puVar24 + 0x58);
bVar13 = false;
- *(undefined8 *)(puVar23 + -8) = 0x14003222f;
+ *(undefined8 *)(puVar24 + -8) = 0x14003123f;
AfdNotifyDestroyContext(uVar6,lVar5);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar24 + -8) = 0x14003126b;
+ uVar18 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar17 = (uint)uVar18;
+ }
+ else {
+ uVar17 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar17 != 0) {
+ *(undefined8 *)(puVar24 + -8) = 0x14003127e;
+ ExFreePoolWithTag(lVar5,0x4e646641);
+ }
LAB_4:
if (!bVar13) {
- *(undefined8 *)(puVar23 + -8) = 0x140032244;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
- }
- cVar15 = puVar23[0x170];
+ *(undefined8 *)(puVar24 + -8) = 0x140031298;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar24 + 0x58);
+ }
+ cVar15 = puVar24[0x170];
LAB_3:
- *(undefined8 *)(puVar23 + -8) = 0x14003225d;
- KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x1400312b1;
+ KeReleaseInStackQueuedSpinLock(puVar24 + 0x58);
if (cVar15 != '\0') {
- *(undefined8 *)(puVar23 + -8) = 0x140032274;
+ *(undefined8 *)(puVar24 + -8) = 0x1400312c8;
ExReleaseRundownProtection(param_1 + 0x60);
}
- **(undefined4 **)(puVar23 + 0x178) = 0xc00000a3;
+ **(undefined4 **)(puVar24 + 0x178) = 0xc00000a3;
return '\x01';
}
- *(undefined8 *)(puVar23 + -8) = 0x1400320d8;
+ *(undefined8 *)(puVar24 + -8) = 0x1400310e8;
uVar16 = AfdNotifyComputeEvents(lVar5);
*(undefined2 *)(lVar5 + 0x66) = *(undefined2 *)(lVar5 + 100);
- uVar25 = *(ushort *)(lVar5 + 0x68);
- if (uVar16 == uVar25) {
+ uVar26 = *(ushort *)(lVar5 + 0x68);
+ if (uVar16 == uVar26) {
if ((*(byte *)(lVar5 + 99) & 1) != 0) {
- uVar24 = uVar24 | 4;
- }
-LAB_13:
- *(ushort *)(lVar5 + 0x6a) = uVar24 & 0xfffd;
+ uVar25 = uVar25 | 4;
+ }
+LAB_14:
+ *(ushort *)(lVar5 + 0x6a) = uVar25 & 0xfffd;
goto LAB_4;
}
- if ((uVar16 & uVar25) != 0) goto LAB_13;
- if (uVar25 == 0) {
+ if ((uVar16 & uVar26) != 0) goto LAB_14;
+ if (uVar26 == 0) {
*(ushort *)(lVar5 + 0x68) = uVar16;
- *(undefined8 *)(puVar23 + -8) = 0x14003218f;
- KeReleaseInStackQueuedSpinLock(puVar23 + 0x58);
- *(undefined8 *)(puVar23 + -8) = 0x14003219e;
+ *(undefined8 *)(puVar24 + -8) = 0x14003119f;
+ KeReleaseInStackQueuedSpinLock(puVar24 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x1400311ae;
ObfReferenceObject(uVar6);
- puVar23[0x40] = AfdPriorityBoost;
- puVar23[0x38] = 0;
- *(longlong *)(puVar23 + 0x30) = lVar5;
- puVar23[0x28] = 0;
- *(ulonglong *)(puVar23 + 0x20) = (ulonglong)uVar16;
+ puVar24[0x40] = AfdPriorityBoost;
+ puVar24[0x38] = 0;
+ *(longlong *)(puVar24 + 0x30) = lVar5;
+ puVar24[0x28] = 0;
+ *(ulonglong *)(puVar24 + 0x20) = (ulonglong)uVar16;
uVar7 = *(undefined8 *)(lVar5 + 0x58);
uVar8 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar23 + -8) = 0x1400321d7;
+ *(undefined8 *)(puVar24 + -8) = 0x1400311e7;
IoSetIoCompletionEx3(uVar8,uVar7,0,0);
- *(undefined8 *)(puVar23 + -8) = 0x1400321ec;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x1400311fc;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar24 + 0x58);
}
else {
- *(undefined8 *)(puVar23 + -8) = 0x14003210d;
+ *(undefined8 *)(puVar24 + -8) = 0x14003111d;
KeReleaseInStackQueuedSpinLock();
uVar7 = *(undefined8 *)(lVar5 + 0x50);
- *(undefined8 *)(puVar23 + -8) = 0x140032120;
+ *(undefined8 *)(puVar24 + -8) = 0x140031130;
cVar15 = IoCancelMiniCompletionPacket(uVar7,lVar5);
if (cVar15 == '\0') {
- *(undefined8 *)(puVar23 + -8) = 0x140032139;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x140031149;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar24 + 0x58);
if (*(short *)(lVar5 + 0x68) != 0) {
*(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
goto LAB_4;
}
}
else {
- *(undefined8 *)(puVar23 + -8) = 0x140032161;
+ *(undefined8 *)(puVar24 + -8) = 0x140031171;
ObfDereferenceObject(uVar6);
- *(undefined8 *)(puVar23 + -8) = 0x140032176;
- KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar23 + 0x58);
+ *(undefined8 *)(puVar24 + -8) = 0x140031186;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0xe,puVar24 + 0x58);
*(undefined2 *)(lVar5 + 0x68) = 0;
}
}
- uVar24 = *(ushort *)(lVar5 + 0x6a);
- uVar25 = uVar24;
- goto joined_r0x0001400320c9;
+ uVar25 = *(ushort *)(lVar5 + 0x6a);
+ uVar26 = uVar25;
+ goto joined_r0x0001400310d9;
}
```
## AfdQueryHandles
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.63|
|i_ratio|0.56|
|m_ratio|0.93|
|b_ratio|0.8|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdQueryHandles|AfdQueryHandles|
|fullname|AfdQueryHandles|AfdQueryHandles|
|refcount|3|3|
|`length`|952|834|
|`called`|AfdCloseConnection
AfdGetConnectionReferenceFromEndpoint
AfdPreventUnbind
AfdReallowUnbind
Feature_3261636923__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
RtlpCopyDeviceMemory|AfdCloseConnection
AfdGetConnectionReferenceFromEndpoint
AfdPreventUnbind
AfdReallowUnbind
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::IoIs32bitProcess
NTOSKRNL.EXE::ObCloseHandle
NTOSKRNL.EXE::ObOpenObjectByPointer
RtlpCopyDeviceMemory|
|calling|||
|paramcount|8|8|
|`address`|14003a350|140039510|
|`sig`|int __fastcall AfdQueryHandles(longlong param_1, undefined8 param_2, byte param_3, uint * param_4, uint param_5, undefined8 param_6, uint param_7, undefined8 * param_8)|int __fastcall AfdQueryHandles(longlong param_1, undefined8 param_2, char param_3, uint * param_4, uint param_5, undefined8 param_6, uint param_7, undefined8 * param_8)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdQueryHandles Called Diff
```diff
--- AfdQueryHandles called
+++ AfdQueryHandles called
@@ -5 +4,0 @@
-Feature_3261636923__private_IsEnabledDeviceUsageNoInline
```
### AfdQueryHandles Diff
```diff
--- AfdQueryHandles
+++ AfdQueryHandles
@@ -1,182 +1,160 @@
-int AfdQueryHandles(longlong param_1,undefined8 param_2,byte param_3,uint *param_4,uint param_5,
+int AfdQueryHandles(longlong param_1,undefined8 param_2,char param_3,uint *param_4,uint param_5,
undefined8 param_6,uint param_7,undefined8 *param_8)
{
longlong *plVar1;
longlong lVar2;
ushort *puVar3;
undefined4 *puVar4;
undefined8 *puVar5;
code *pcVar6;
undefined8 uVar7;
char cVar8;
bool bVar9;
- uint uVar10;
- int iVar11;
- undefined2 *puVar12;
- ulonglong uVar13;
+ int iVar10;
+ undefined2 *puVar11;
void *_Dst;
- undefined1 *puVar14;
- undefined1 *puVar15;
- bool bVar16;
+ undefined1 *puVar12;
+ undefined1 *puVar13;
+ bool bVar14;
undefined1 auStack_78 [8];
undefined1 auStack_70 [24];
undefined8 local_58;
- byte local_50;
+ char local_50;
undefined8 *local_48;
int local_38;
uint local_34;
undefined8 local_30;
undefined8 auStack_28 [2];
- puVar15 = auStack_78;
+ puVar13 = auStack_78;
bVar9 = false;
*param_8 = 0;
puVar3 = *(ushort **)(param_1 + 0x18);
cVar8 = IoIs32bitProcess(0);
if (3 < param_5) {
if (cVar8 == '\0') {
- bVar16 = param_7 < 0x10;
+ bVar14 = param_7 < 0x10;
}
else {
- bVar16 = param_7 < 8;
+ bVar14 = param_7 < 8;
}
- if (!bVar16) {
+ if (!bVar14) {
local_38 = 0;
- if ((param_3 != 0) && (((ulonglong)param_4 & 3) != 0)) {
+ if ((param_3 != '\0') && (((ulonglong)param_4 & 3) != 0)) {
/* WARNING: Subroutine does not return */
ExRaiseDatatypeMisalignment();
}
local_34 = *param_4;
if (((local_34 & 0xfffffffc) == 0) && (local_34 != 0)) {
if (((*(uint *)(puVar3 + 4) >> 8 & 1) == 0) && ((*(uint *)(puVar3 + 4) >> 9 & 1) == 0)) {
local_30 = 0;
auStack_28[0] = 0;
if ((((*puVar3 != 0xafd1) && (*puVar3 != 0x1afd)) &&
(((*(byte *)((longlong)puVar3 + 5) & 0x10) == 0 || ((puVar3[3] & 1) == 0)))) &&
(((*(uint *)(puVar3 + 4) & 1) == 0 && ((char)puVar3[1] != '\x04')))) {
bVar9 = AfdPreventUnbind((longlong)puVar3);
if (!bVar9) {
return -0x3ffffe7c;
}
bVar9 = true;
}
if ((((local_34 & 1) != 0) && ((byte)((char)puVar3[1] - 3U) < 2)) &&
(*(longlong *)(puVar3 + 0xc) != 0)) {
- if ((Feature_3261636923__private_featureState & 0x10) == 0) {
- uVar13 = Feature_3261636923__private_IsEnabledDeviceUsageNoInline();
- uVar10 = (uint)uVar13;
- }
- else {
- uVar10 = Feature_3261636923__private_featureState & 1;
- }
- local_50 = param_3;
- if (uVar10 == 0) {
- local_50 = -((*(uint *)(puVar3 + 8) & 0x10000) != 0) & param_3;
- }
local_48 = &local_30;
local_58 = *(undefined8 *)IoFileObjectType_exref;
- local_38 = ObOpenObjectByPointer(*(undefined8 *)(puVar3 + 0xc),0x40,0,0x2000000);
+ local_50 = param_3;
+ local_38 = ObOpenObjectByPointer(*(longlong *)(puVar3 + 0xc),0x40,0,0x2000000);
}
if (bVar9) {
AfdReallowUnbind((longlong)puVar3);
}
if (local_38 < 0) {
return local_38;
}
- puVar15 = auStack_78;
- if ((((local_34 & 2) != 0) && (puVar15 = auStack_78, (*puVar3 & 0xafd2) == 0xafd2)) &&
- ((puVar15 = auStack_78, (char)puVar3[1] == '\x04' &&
- (puVar12 = (undefined2 *)AfdGetConnectionReferenceFromEndpoint(puVar3),
- puVar15 = auStack_78, puVar12 != (undefined2 *)0x0)))) {
- if ((Feature_3261636923__private_featureState & 0x10) == 0) {
- uVar13 = Feature_3261636923__private_IsEnabledDeviceUsageNoInline();
- uVar10 = (uint)uVar13;
- }
- else {
- uVar10 = Feature_3261636923__private_featureState & 1;
- }
- local_50 = param_3;
- if (uVar10 == 0) {
- local_50 = -((*(uint *)(puVar3 + 8) & 0x10000) != 0) & param_3;
- }
+ puVar13 = auStack_78;
+ if ((((local_34 & 2) != 0) && (puVar13 = auStack_78, (*puVar3 & 0xafd2) == 0xafd2)) &&
+ ((puVar13 = auStack_78, (char)puVar3[1] == '\x04' &&
+ (puVar11 = (undefined2 *)AfdGetConnectionReferenceFromEndpoint(puVar3),
+ puVar13 = auStack_78, puVar11 != (undefined2 *)0x0)))) {
local_48 = auStack_28;
local_58 = *(undefined8 *)IoFileObjectType_exref;
- iVar11 = ObOpenObjectByPointer(*(undefined8 *)(puVar12 + 8),0x40,0,0x2000000);
+ local_50 = param_3;
+ iVar10 = ObOpenObjectByPointer(*(undefined8 *)(puVar11 + 8),0x40,0,0x2000000);
LOCK();
- plVar1 = (longlong *)(puVar12 + 0x18);
+ plVar1 = (longlong *)(puVar11 + 0x18);
lVar2 = *plVar1;
*plVar1 = *plVar1 + -1;
UNLOCK();
- puVar15 = auStack_78;
- local_38 = iVar11;
+ puVar13 = auStack_78;
+ local_38 = iVar10;
if (lVar2 < 2) {
if (lVar2 == 1) {
- AfdCloseConnection(puVar12);
- puVar15 = auStack_78;
+ AfdCloseConnection(puVar11);
+ puVar13 = auStack_78;
}
else {
pcVar6 = (code *)swi(0x29);
(*pcVar6)(0xe);
- puVar15 = auStack_70;
+ puVar13 = auStack_70;
}
}
- if (iVar11 < 0) {
- if (*(longlong *)(puVar15 + 0x48) == 0) {
- return iVar11;
+ if (iVar10 < 0) {
+ if (*(longlong *)(puVar13 + 0x48) == 0) {
+ return iVar10;
}
- *(undefined8 *)(puVar15 + -8) = 0x14003a618;
- ObCloseHandle(*(longlong *)(puVar15 + 0x48),param_3);
- return iVar11;
+ *(undefined8 *)(puVar13 + -8) = 0x140039762;
+ ObCloseHandle(*(longlong *)(puVar13 + 0x48),param_3);
+ return iVar10;
}
}
}
else {
local_30 = 0xffffffffffffffff;
auStack_28[0] = 0xffffffffffffffff;
}
if (cVar8 == '\0') {
- if (param_3 == 0) {
- uVar7 = *(undefined8 *)(puVar15 + 0x50);
- puVar5 = *(undefined8 **)(puVar15 + 0xa8);
- *puVar5 = *(undefined8 *)(puVar15 + 0x48);
+ if (param_3 == '\0') {
+ uVar7 = *(undefined8 *)(puVar13 + 0x50);
+ puVar5 = *(undefined8 **)(puVar13 + 0xa8);
+ *puVar5 = *(undefined8 *)(puVar13 + 0x48);
puVar5[1] = uVar7;
}
else {
- _Dst = *(void **)(puVar15 + 0xa8);
- if (*(void **)MmUserProbeAddress_exref <= *(void **)(puVar15 + 0xa8)) {
+ _Dst = *(void **)(puVar13 + 0xa8);
+ if (*(void **)MmUserProbeAddress_exref <= *(void **)(puVar13 + 0xa8)) {
_Dst = *(void **)MmUserProbeAddress_exref;
}
- *(undefined8 *)(puVar15 + -8) = 0x14003a6c3;
- RtlpCopyDeviceMemory(_Dst,puVar15 + 0x48,0x10);
+ *(undefined8 *)(puVar13 + -8) = 0x14003980d;
+ RtlpCopyDeviceMemory(_Dst,puVar13 + 0x48,0x10);
}
*param_8 = 0x10;
}
else {
- if (param_3 != 0) {
- if (((ulonglong)*(undefined1 **)(puVar15 + 0xa8) & 3) != 0) {
+ if (param_3 != '\0') {
+ if (((ulonglong)*(undefined1 **)(puVar13 + 0xa8) & 3) != 0) {
/* WARNING: Subroutine does not return */
- *(undefined8 *)(puVar15 + -8) = 0x14003a650;
+ *(undefined8 *)(puVar13 + -8) = 0x14003979a;
ExRaiseDatatypeMisalignment();
}
- puVar14 = *(undefined1 **)(puVar15 + 0xa8);
- if (*(undefined1 **)MmUserProbeAddress_exref <= *(undefined1 **)(puVar15 + 0xa8)) {
- puVar14 = *(undefined1 **)MmUserProbeAddress_exref;
+ puVar12 = *(undefined1 **)(puVar13 + 0xa8);
+ if (*(undefined1 **)MmUserProbeAddress_exref <= *(undefined1 **)(puVar13 + 0xa8)) {
+ puVar12 = *(undefined1 **)MmUserProbeAddress_exref;
}
- *puVar14 = *puVar14;
- puVar14[7] = puVar14[7];
+ *puVar12 = *puVar12;
+ puVar12[7] = puVar12[7];
}
- puVar4 = *(undefined4 **)(puVar15 + 0xa8);
- *puVar4 = (int)*(undefined8 *)(puVar15 + 0x48);
- puVar4[1] = (int)*(undefined8 *)(puVar15 + 0x50);
+ puVar4 = *(undefined4 **)(puVar13 + 0xa8);
+ *puVar4 = (int)*(undefined8 *)(puVar13 + 0x48);
+ puVar4[1] = (int)*(undefined8 *)(puVar13 + 0x50);
*param_8 = 8;
}
return 0;
}
return -0x3ffffff3;
}
}
return -0x3fffffdd;
}
```
## AfdBind
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.1|
|i_ratio|0.61|
|m_ratio|0.98|
|b_ratio|0.95|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|AfdBind|AfdBind|
|fullname|AfdBind|AfdBind|
|refcount|3|3|
|`length`|2587|2730|
|`called`|Expand for full list:
AFDETW_TRACEBIND
AfdAddConnectedReference
AfdCreateConnection
AfdGetTransportInfo
AfdIsAddressInUse
AfdNotifySockEventsChangedUnderLock
AfdPreventUnbind
AfdReallowUnbind
AfdTLBindSecurity
AfdTdiCreateAO
AfdTdiSetEventHandlers
Feature_1384345915__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExEnterCriticalRegionAndAcquireResourceExclusive
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExReleaseResourceAndLeaveCriticalRegion
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObDereferenceSecurityDescriptor
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ZwClose
SOCKADDR_SIZE
WPP_SF_qL
WPP_SF_qqq
memcpyExpand for full list:
AFDETW_TRACEBIND
AfdAddConnectedReference
AfdCreateConnection
AfdGetTransportInfo
AfdIsAddressInUse
AfdNotifySockEventsChangedUnderLock
AfdPreventUnbind
AfdReallowUnbind
AfdTLBindSecurity
AfdTdiCreateAO
AfdTdiSetEventHandlers
Feature_1384345915__private_IsEnabledDeviceUsageNoInline
Feature_2829529401__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExEnterCriticalRegionAndAcquireResourceExclusive
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseDatatypeMisalignment
NTOSKRNL.EXE::ExReleaseResourceAndLeaveCriticalRegion
NTOSKRNL.EXE::IoAllocateMdl
NTOSKRNL.EXE::IoFreeMdl
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::IofCompleteRequest
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::MmMapLockedPagesSpecifyCache
NTOSKRNL.EXE::MmProbeAndLockPages
NTOSKRNL.EXE::MmUnlockPages
NTOSKRNL.EXE::ObDereferenceSecurityDescriptor
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::RtlLogUnexpectedCodepath
NTOSKRNL.EXE::ZwClose
SOCKADDR_SIZE
WPP_SF_qL
WPP_SF_qqq
__security_check_cookie
memcpyExpand for full list:
AFDETW_TRACESEND
AFDETW_TRACESENDDATAGRAM
AFDETW_TRACESENDMSG
AFDETW_TRACESENDTO
AfdCopyBufferArrayToBuffer
AfdDereferenceEndpoint
AfdEnqueueTpSendIrp
AfdGetBuffer
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
AfdReturnBuffer
AfdTLFastDgramSend
AfdTdi_TA6toTA4_InPlace
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
SOCKADDR_SIZE
WPP_SF_DDq
WPP_SF_I
WPP_SF_qL
memcpyExpand for full list:
AFDETW_TRACESEND
AFDETW_TRACESENDDATAGRAM
AFDETW_TRACESENDMSG
AFDETW_TRACESENDTO
AfdCopyBufferArrayToBuffer
AfdDereferenceEndpoint
AfdEnqueueTpSendIrp
AfdGetBuffer
AfdIndicateEventSelectEvent
AfdIndicatePollEvent
AfdNotifyComputeEvents
AfdNotifyDestroyContext
AfdNotifySockIndicateEventsUnlock
AfdReturnBuffer
AfdTLFastDgramSend
AfdTdi_TA6toTA4_InPlace
Feature_447951161__private_IsEnabledDeviceUsageNoInline
NTOSKRNL.EXE::ExAcquireRundownProtection
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExRaiseStatus
NTOSKRNL.EXE::ExReleaseRundownProtection
NTOSKRNL.EXE::IoCancelMiniCompletionPacket
NTOSKRNL.EXE::IoSetIoCompletionEx3
NTOSKRNL.EXE::IofCallDriver
NTOSKRNL.EXE::KeAcquireInStackQueuedSpinLock
NTOSKRNL.EXE::KeReleaseInStackQueuedSpinLock
NTOSKRNL.EXE::ObfDereferenceObject
NTOSKRNL.EXE::ObfReferenceObject
SOCKADDR_SIZE
WPP_SF_DDq
WPP_SF_I
WPP_SF_qL
memcpy
AfdFastIoWrite|AfdFastIoDeviceControl
AfdFastIoWrite|
|paramcount|5|5|
|`address`|140034280|1400333d0|
|sig|ulonglong __fastcall AfdFastDatagramSend(ushort * param_1, undefined8 * param_2, uint param_3, void * param_4, uint param_5)|ulonglong __fastcall AfdFastDatagramSend(ushort * param_1, undefined8 * param_2, uint param_3, void * param_4, uint param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
### AfdFastDatagramSend Called Diff
```diff
--- AfdFastDatagramSend called
+++ AfdFastDatagramSend called
@@ -16,0 +17 @@
+Feature_447951161__private_IsEnabledDeviceUsageNoInline
@@ -17,0 +19 @@
+NTOSKRNL.EXE::ExFreePoolWithTag
```
### AfdFastDatagramSend Diff
```diff
--- AfdFastDatagramSend
+++ AfdFastDatagramSend
@@ -1,614 +1,638 @@
ulonglong AfdFastDatagramSend(ushort *param_1,undefined8 *param_2,uint param_3,void *param_4,
uint param_5)
{
ushort *puVar1;
ushort uVar2;
uint uVar3;
undefined4 uVar4;
- longlong lVar5;
- short *psVar6;
- longlong lVar7;
- code *pcVar8;
- bool bVar9;
- undefined4 *puVar10;
- char cVar11;
- byte bVar12;
- char cVar13;
- ushort uVar14;
- uint uVar15;
- int iVar16;
- ulonglong uVar17;
- undefined4 *puVar18;
+ short *psVar5;
+ longlong lVar6;
+ code *pcVar7;
+ bool bVar8;
+ undefined4 *puVar9;
+ char cVar10;
+ byte bVar11;
+ char cVar12;
+ ushort uVar13;
+ uint uVar14;
+ int iVar15;
+ ulonglong uVar16;
+ undefined4 *puVar17;
+ undefined8 uVar18;
undefined8 uVar19;
- undefined8 uVar20;
- uint *puVar21;
- undefined1 *puVar22;
- ushort uVar23;
+ uint *puVar20;
+ undefined1 *puVar21;
+ ushort uVar22;
+ longlong lVar23;
bool bVar24;
undefined1 auStack_108 [8];
undefined1 auStack_100 [24];
ushort *local_e8;
undefined1 local_e0;
longlong local_d8;
undefined1 local_d0;
undefined1 local_c8;
undefined4 local_a8;
undefined4 *local_98;
uint local_88;
uint local_84;
- uint local_80;
+ undefined8 local_80;
undefined8 local_78;
- undefined8 local_70;
- undefined8 uStack_68;
- undefined8 local_60;
+ undefined8 uStack_70;
+ undefined8 local_68;
+ uint local_60;
undefined8 local_58;
undefined8 local_50;
undefined8 uStack_48;
undefined8 local_40;
- puVar22 = auStack_108;
- local_70 = 0;
- uStack_68 = 0;
- local_60 = 0;
+ puVar21 = auStack_108;
+ local_78 = 0;
+ uStack_70 = 0;
+ local_68 = 0;
local_98 = (undefined4 *)0x0;
local_84 = 0;
- uVar17 = (ulonglong)*(uint *)(param_1 + 4);
+ uVar16 = (ulonglong)*(uint *)(param_1 + 4);
if (((*(uint *)(param_1 + 4) & 0x10) == 0) && (AfdFastSendDatagramThreshold < param_3))
goto LAB_0;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
if ((*(byte *)((longlong)param_1 + 7) & 0x10) != 0) {
- uVar17 = KeReleaseInStackQueuedSpinLock(&local_70);
+ uVar16 = KeReleaseInStackQueuedSpinLock(&local_78);
goto LAB_0;
}
- uVar15 = *(uint *)(param_1 + 0x4e);
- if ((uVar15 < *(uint *)(param_1 + 0x50)) || (uVar15 == 0)) {
- *(uint *)(param_1 + 0x4e) = uVar15 + param_3;
- KeReleaseInStackQueuedSpinLock(&local_70);
+ uVar14 = *(uint *)(param_1 + 0x4e);
+ if ((uVar14 < *(uint *)(param_1 + 0x50)) || (uVar14 == 0)) {
+ *(uint *)(param_1 + 0x4e) = uVar14 + param_3;
+ KeReleaseInStackQueuedSpinLock(&local_78);
if ((DAT_1 & 0x40) != 0) {
/* WARNING: Subroutine does not return */
WPP_SF_I(0xf,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1);
}
local_58 = *(undefined8 *)(param_1 + 0xc);
- local_78 = *(undefined8 *)(param_1 + 0x14);
+ local_80 = *(undefined8 *)(param_1 + 0x14);
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
while( true ) {
local_a8 = 0;
local_88 = param_3;
- uVar15 = param_3;
+ uVar14 = param_3;
if ((param_5 != 0) &&
- ((uVar15 = param_3 + 7 & 0xfffffff8, uVar15 < param_3 ||
- (local_88 = uVar15 + param_5, uVar15 + param_5 < uVar15)))) goto LAB_2;
- local_84 = uVar15;
- uVar15 = *(uint *)(param_2 + 0xb);
+ ((uVar14 = param_3 + 7 & 0xfffffff8, uVar14 < param_3 ||
+ (local_88 = uVar14 + param_5, uVar14 + param_5 < uVar14)))) goto LAB_2;
+ local_84 = uVar14;
+ uVar14 = *(uint *)(param_2 + 0xb);
if ((*(uint *)(param_2 + 0xb) == 0) &&
((param_4 != (void *)0x0 ||
- ((uVar15 = 0, (*(uint *)(param_1 + 4) >> 8 & 1) == 0 &&
+ ((uVar14 = 0, (*(uint *)(param_1 + 4) >> 8 & 1) == 0 &&
((*(uint *)(param_1 + 8) & 0x8000) == 0)))))) {
- uVar15 = *(uint *)(param_1 + 0x52);
+ uVar14 = *(uint *)(param_1 + 0x52);
}
puVar1 = param_1 + 0x18;
- local_80 = uVar15;
- puVar18 = AfdGetBuffer(local_88,uVar15,*(longlong *)puVar1,1);
- local_98 = puVar18;
+ local_60 = uVar14;
+ puVar17 = AfdGetBuffer(local_88,uVar14,*(longlong *)puVar1,1);
+ local_98 = puVar17;
if (param_4 == (void *)0x0) {
- *(undefined8 *)(puVar18 + 6) = 0;
- puVar18[4] = 0;
+ *(undefined8 *)(puVar17 + 6) = 0;
+ puVar17[4] = 0;
}
else {
- *(void **)(puVar18 + 6) = (void *)((ulonglong)local_84 + *(longlong *)(puVar18 + 0x16));
- memcpy((void *)((ulonglong)local_84 + *(longlong *)(puVar18 + 0x16)),param_4,
+ *(void **)(puVar17 + 6) = (void *)((ulonglong)local_84 + *(longlong *)(puVar17 + 0x16));
+ memcpy((void *)((ulonglong)local_84 + *(longlong *)(puVar17 + 0x16)),param_4,
(ulonglong)param_5);
- puVar18[4] = param_5;
- }
- puVar18[8] = uVar15;
- iVar16 = 0;
+ puVar17[4] = param_5;
+ }
+ puVar17[8] = uVar14;
+ iVar15 = 0;
if (*(int *)(param_2 + 0xb) != 0) {
- memcpy(*(void **)(puVar18 + 10),(void *)param_2[0xc],(longlong)*(int *)(param_2 + 0xb));
- if ((**(int **)(puVar18 + 10) != 1) ||
- (iVar16 = *(int *)(param_2 + 0xb),
- iVar16 < (int)(*(ushort *)(*(int **)(puVar18 + 10) + 1) + 8))) {
+ memcpy(*(void **)(puVar17 + 10),(void *)param_2[0xc],(longlong)*(int *)(param_2 + 0xb));
+ if ((**(int **)(puVar17 + 10) != 1) ||
+ (iVar15 = *(int *)(param_2 + 0xb),
+ iVar15 < (int)(*(ushort *)(*(int **)(puVar17 + 10) + 1) + 8))) {
/* WARNING: Subroutine does not return */
ExRaiseStatus(0xc000000d);
}
}
- if (iVar16 != 0) goto LAB_3;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
+ if (iVar15 != 0) goto LAB_3;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
if ((char)param_1[1] != '\x04') break;
if ((param_4 == (void *)0x0) &&
- ((puVar18 = local_98, (*(uint *)(param_1 + 4) >> 8 & 1) != 0 ||
+ ((puVar17 = local_98, (*(uint *)(param_1 + 4) >> 8 & 1) != 0 ||
((*(uint *)(param_1 + 8) & 0x8000) != 0)))) goto LAB_4;
- if (*(uint *)(param_1 + 0x52) <= (uint)*(ushort *)((longlong)puVar18 + 0x4e))
+ if (*(uint *)(param_1 + 0x52) <= (uint)*(ushort *)((longlong)puVar17 + 0x4e))
goto LAB_5;
- KeReleaseInStackQueuedSpinLock(&local_70);
- AfdReturnBuffer((longlong)puVar18,*(longlong *)puVar1);
- }
- KeReleaseInStackQueuedSpinLock(&local_70);
- AfdReturnBuffer((longlong)puVar18,*(longlong *)puVar1);
+ KeReleaseInStackQueuedSpinLock(&local_78);
+ AfdReturnBuffer((longlong)puVar17,*(longlong *)puVar1);
+ }
+ KeReleaseInStackQueuedSpinLock(&local_78);
+ AfdReturnBuffer((longlong)puVar17,*(longlong *)puVar1);
local_a8 = 0xc0000140;
}
else {
local_a8 = 0;
local_88 = param_3;
- uVar15 = param_3;
+ uVar14 = param_3;
if ((param_5 == 0) ||
- ((uVar15 = param_3 + 7 & 0xfffffff8, param_3 <= uVar15 &&
- (local_88 = uVar15 + param_5, uVar15 <= local_88)))) {
- local_84 = uVar15;
- puVar18 = AfdGetBuffer(local_88,*(uint *)(param_2 + 0xb),*(longlong *)(param_1 + 0x18),1);
- local_98 = puVar18;
+ ((uVar14 = param_3 + 7 & 0xfffffff8, param_3 <= uVar14 &&
+ (local_88 = uVar14 + param_5, uVar14 <= local_88)))) {
+ local_84 = uVar14;
+ puVar17 = AfdGetBuffer(local_88,*(uint *)(param_2 + 0xb),*(longlong *)(param_1 + 0x18),1);
+ local_98 = puVar17;
if (*(int *)(param_2 + 0xb) == 0) {
- iVar16 = 0;
+ iVar15 = 0;
if ((char)param_1[1] != '\x04') {
/* WARNING: Subroutine does not return */
ExRaiseStatus(0xc0000140);
}
}
else {
- memcpy(*(void **)(puVar18 + 10),(void *)param_2[0xc],(longlong)*(int *)(param_2 + 0xb));
- iVar16 = *(int *)(param_2 + 0xb);
- if (iVar16 < 2) {
+ memcpy(*(void **)(puVar17 + 10),(void *)param_2[0xc],(longlong)*(int *)(param_2 + 0xb));
+ iVar15 = *(int *)(param_2 + 0xb);
+ if (iVar15 < 2) {
/* WARNING: Subroutine does not return */
ExRaiseStatus(0xc000000d);
}
- if (0x22 < **(ushort **)(puVar18 + 10)) {
+ if (0x22 < **(ushort **)(puVar17 + 10)) {
/* WARNING: Subroutine does not return */
ExRaiseStatus(0xc0000141);
}
- bVar12 = SOCKADDR_SIZE(**(ushort **)(puVar18 + 10));
- if (iVar16 < (int)(uint)bVar12) {
+ bVar11 = SOCKADDR_SIZE(**(ushort **)(puVar17 + 10));
+ if (iVar15 < (int)(uint)bVar11) {
/* WARNING: Subroutine does not return */
ExRaiseStatus(0xc0000141);
}
}
- puVar18[8] = iVar16;
+ puVar17[8] = iVar15;
if (param_4 == (void *)0x0) {
- *(undefined8 *)(puVar18 + 6) = 0;
- puVar18[4] = 0;
+ *(undefined8 *)(puVar17 + 6) = 0;
+ puVar17[4] = 0;
}
else {
- *(void **)(puVar18 + 6) = (void *)((ulonglong)uVar15 + *(longlong *)(puVar18 + 0x16));
- memcpy((void *)((ulonglong)uVar15 + *(longlong *)(puVar18 + 0x16)),param_4,
+ *(void **)(puVar17 + 6) = (void *)((ulonglong)uVar14 + *(longlong *)(puVar17 + 0x16));
+ memcpy((void *)((ulonglong)uVar14 + *(longlong *)(puVar17 + 0x16)),param_4,
(ulonglong)param_5);
- puVar18[4] = param_5;
+ puVar17[4] = param_5;
}
goto LAB_3;
}
LAB_2:
local_a8 = 0xc000000d;
local_88 = param_3;
}
goto LAB_6;
}
if (((*(uint *)(param_1 + 4) & 0x10) != 0) && ((*(uint *)((longlong)param_2 + 0xc) & 2) == 0)) {
*(uint *)(param_1 + 0x24) = *(uint *)(param_1 + 0x24) & 0xfffffffb;
if (*(longlong *)(param_1 + 0xbc) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0xbc) + 100);
*puVar1 = *puVar1 & 0xfffb;
}
*(uint *)(param_1 + 4) = *(uint *)(param_1 + 4) | 0x2000000;
if ((DAT_7 & 0x10) != 0) {
WPP_SF_qL(0xe,&WPP_5d10adf6cd9b3dca63b04d5d43604693_Traceguids,param_1,
*(undefined4 *)(param_1 + 0x24));
}
}
bVar24 = false;
local_50 = 0;
uStack_48 = 0;
local_40 = 0;
if ((*(longlong *)(param_1 + 0xbc) != 0) &&
- (cVar11 = ExAcquireRundownProtection(param_1 + 0xc0), cVar11 != '\0')) {
+ (cVar10 = ExAcquireRundownProtection(param_1 + 0xc0), cVar10 != '\0')) {
bVar24 = true;
- lVar5 = *(longlong *)(param_1 + 0xbc);
- uVar20 = *(undefined8 *)(lVar5 + 0x40);
- uVar2 = *(ushort *)(lVar5 + 0x6a);
- bVar9 = true;
+ lVar23 = *(longlong *)(param_1 + 0xbc);
+ uVar19 = *(undefined8 *)(lVar23 + 0x40);
+ uVar2 = *(ushort *)(lVar23 + 0x6a);
+ bVar8 = true;
if ((uVar2 & 2) == 0) {
- uVar23 = uVar2 | 2;
- *(ushort *)(lVar5 + 0x6a) = uVar23;
+ uVar22 = uVar2 | 2;
+ *(ushort *)(lVar23 + 0x6a) = uVar22;
while ((uVar2 & 1) == 0) {
- uVar14 = AfdNotifyComputeEvents(lVar5);
- *(undefined2 *)(lVar5 + 0x66) = *(undefined2 *)(lVar5 + 100);
- uVar2 = *(ushort *)(lVar5 + 0x68);
- if (uVar14 == uVar2) {
- if ((*(byte *)(lVar5 + 99) & 1) != 0) {
- uVar23 = uVar23 | 4;
+ uVar13 = AfdNotifyComputeEvents(lVar23);
+ *(undefined2 *)(lVar23 + 0x66) = *(undefined2 *)(lVar23 + 100);
+ uVar2 = *(ushort *)(lVar23 + 0x68);
+ if (uVar13 == uVar2) {
+ if ((*(byte *)(lVar23 + 99) & 1) != 0) {
+ uVar22 = uVar22 | 4;
}
LAB_8:
- *(ushort *)(lVar5 + 0x6a) = uVar23 & 0xfffd;
- bVar9 = true;
+ *(ushort *)(lVar23 + 0x6a) = uVar22 & 0xfffd;
+ bVar8 = true;
goto LAB_9;
}
- if ((uVar14 & uVar2) != 0) goto LAB_8;
+ if ((uVar13 & uVar2) != 0) goto LAB_8;
if (uVar2 == 0) {
- *(ushort *)(lVar5 + 0x68) = uVar14;
- KeReleaseInStackQueuedSpinLock(&local_70);
- ObfReferenceObject(uVar20);
+ *(ushort *)(lVar23 + 0x68) = uVar13;
+ KeReleaseInStackQueuedSpinLock(&local_78);
+ ObfReferenceObject(uVar19);
local_c8 = AfdPriorityBoost;
local_d0 = 0;
local_e0 = 0;
- local_e8 = (ushort *)(ulonglong)uVar14;
- local_d8 = lVar5;
- IoSetIoCompletionEx3(*(undefined8 *)(lVar5 + 0x50),*(undefined8 *)(lVar5 + 0x58),0,0);
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
+ local_e8 = (ushort *)(ulonglong)uVar13;
+ local_d8 = lVar23;
+ IoSetIoCompletionEx3(*(undefined8 *)(lVar23 + 0x50),*(undefined8 *)(lVar23 + 0x58),0,0);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
}
else {
- KeReleaseInStackQueuedSpinLock(&local_70);
- cVar11 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar5 + 0x50),lVar5);
- if (cVar11 == '\0') {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
- if (*(short *)(lVar5 + 0x68) != 0) {
- *(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
+ KeReleaseInStackQueuedSpinLock(&local_78);
+ cVar10 = IoCancelMiniCompletionPacket(*(undefined8 *)(lVar23 + 0x50),lVar23);
+ if (cVar10 == '\0') {
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
+ if (*(short *)(lVar23 + 0x68) != 0) {
+ *(ushort *)(lVar23 + 0x6a) = *(ushort *)(lVar23 + 0x6a) & 0xfffd;
goto LAB_9;
}
}
else {
- ObfDereferenceObject(uVar20);
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
- *(undefined2 *)(lVar5 + 0x68) = 0;
- }
- }
- uVar23 = *(ushort *)(lVar5 + 0x6a);
- uVar2 = uVar23;
+ ObfDereferenceObject(uVar19);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
+ *(undefined2 *)(lVar23 + 0x68) = 0;
+ }
+ }
+ uVar22 = *(ushort *)(lVar23 + 0x6a);
+ uVar2 = uVar22;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
- *(ushort *)(lVar5 + 0x6a) = *(ushort *)(lVar5 + 0x6a) & 0xfffd;
- KeReleaseInStackQueuedSpinLock(&local_70);
- AfdNotifyDestroyContext(uVar20,lVar5);
- bVar9 = false;
+ *(ushort *)(lVar23 + 0x6a) = *(ushort *)(lVar23 + 0x6a) & 0xfffd;
+ KeReleaseInStackQueuedSpinLock(&local_78);
+ AfdNotifyDestroyContext(uVar19,lVar23);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ uVar16 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar14 = (uint)uVar16;
+ }
+ else {
+ uVar14 = Feature_447951161__private_featureState & 1;
+ }
+ bVar8 = false;
+ if (uVar14 != 0) {
+ ExFreePoolWithTag(lVar23,0x4e646641);
+ }
}
LAB_9:
- if (!bVar9) {
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
- }
- }
- KeReleaseInStackQueuedSpinLock(&local_70);
+ if (!bVar8) {
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
+ }
+ }
+ KeReleaseInStackQueuedSpinLock(&local_78);
if (bVar24) {
ExReleaseRundownProtection(param_1 + 0xc0);
}
local_a8 = 0xc00000a3;
- puVar22 = auStack_108;
+ puVar21 = auStack_108;
goto LAB_10;
LAB_5:
- memcpy(*(void **)(puVar18 + 10),*(void **)(param_1 + 0x54),(ulonglong)*(uint *)(param_1 + 0x52));
+ memcpy(*(void **)(puVar17 + 10),*(void **)(param_1 + 0x54),(ulonglong)*(uint *)(param_1 + 0x52));
LAB_4:
- KeReleaseInStackQueuedSpinLock(&local_70);
+ KeReleaseInStackQueuedSpinLock(&local_78);
LAB_3:
- uVar17 = (ulonglong)param_3;
- uVar15 = AfdCopyBufferArrayToBuffer
- (*(void **)(puVar18 + 0x16),param_3,(uint *)*param_2,*(int *)(param_2 + 1));
- puVar10 = local_98;
- if (uVar15 == param_3) {
- puVar18[0x10] = param_3;
- uVar20 = local_78;
+ uVar16 = (ulonglong)param_3;
+ uVar14 = AfdCopyBufferArrayToBuffer
+ (*(void **)(puVar17 + 0x16),param_3,(uint *)*param_2,*(int *)(param_2 + 1));
+ puVar9 = local_98;
+ if (uVar14 == param_3) {
+ puVar17[0x10] = param_3;
+ uVar19 = local_80;
if ((*(uint *)(param_1 + 4) >> 8 & 1) == 0) {
if (((*(uint *)(param_1 + 4) >> 8 & 1) == 0) && ((*(uint *)(param_1 + 8) & 0x8000) == 0)) {
- puVar21 = puVar18 + 8;
+ puVar20 = puVar17 + 8;
}
else {
- puVar21 = local_98 + 8;
- if ((*puVar21 == 0) && (*(longlong *)(local_98 + 6) == 0)) {
+ puVar20 = local_98 + 8;
+ if ((*puVar20 == 0) && (*(longlong *)(local_98 + 6) == 0)) {
if (((*(uint *)(param_1 + 4) >> 0x16 & 1) != 0) &&
((*(uint *)(param_1 + 0x58) & 0x20) != 0)) {
local_58 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 8);
- uVar20 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 0x10);
- }
- lVar5 = *(longlong *)(*(longlong *)(puVar18 + 0x14) + 0xb8);
- *(code **)(lVar5 + -0x10) = AfdRestartFastDatagramSend;
- *(undefined4 **)(lVar5 + -8) = local_98;
- *(undefined1 *)(lVar5 + -0x45) = 0xe0;
- lVar5 = *(longlong *)(*(longlong *)(local_98 + 0x14) + 0xb8);
- *(undefined2 *)(lVar5 + -0x48) = 0x70f;
- *(undefined8 *)(lVar5 + -0x20) = uVar20;
- *(undefined8 *)(lVar5 + -0x18) = local_58;
- *(undefined4 *)(lVar5 + -0x3c) = 0;
- *(uint *)(lVar5 + -0x40) = param_3;
+ uVar19 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 0x10);
+ }
+ lVar23 = *(longlong *)(*(longlong *)(puVar17 + 0x14) + 0xb8);
+ *(code **)(lVar23 + -0x10) = AfdRestartFastDatagramSend;
+ *(undefined4 **)(lVar23 + -8) = local_98;
+ *(undefined1 *)(lVar23 + -0x45) = 0xe0;
+ lVar23 = *(longlong *)(*(longlong *)(local_98 + 0x14) + 0xb8);
+ *(undefined2 *)(lVar23 + -0x48) = 0x70f;
+ *(undefined8 *)(lVar23 + -0x20) = uVar19;
+ *(undefined8 *)(lVar23 + -0x18) = local_58;
+ *(undefined4 *)(lVar23 + -0x3c) = 0;
+ *(uint *)(lVar23 + -0x40) = param_3;
goto LAB_11;
}
}
*(undefined8 *)(local_98 + 2) = 0;
if (param_4 == (void *)0x0) {
*local_98 = 0;
}
else {
*(undefined8 *)(local_98 + 2) = 0x886103;
}
if ((*(uint *)(param_1 + 4) >> 0x16 & 1) == 0) {
- uVar20 = local_58;
+ uVar19 = local_58;
if ((*(uint *)(param_1 + 4) >> 0x15 & 1) != 0) {
- AfdTdi_TA6toTA4_InPlace(*(int **)(local_98 + 10),puVar21);
- uVar20 = local_58;
+ AfdTdi_TA6toTA4_InPlace(*(int **)(local_98 + 10),puVar20);
+ uVar19 = local_58;
}
}
else {
- uVar19 = AfdTdi_TA6toTA4_InPlace(*(int **)(local_98 + 10),puVar21);
- uVar20 = local_58;
- if ((char)uVar19 != '\0') {
- local_78 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 0x10);
- uVar20 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 8);
- }
- }
- lVar5 = *(longlong *)(*(longlong *)(puVar18 + 0x14) + 0xb8);
- *(code **)(lVar5 + -0x10) = AfdRestartFastDatagramSend;
- *(undefined4 **)(lVar5 + -8) = puVar10;
- *(undefined1 *)(lVar5 + -0x45) = 0xe0;
- lVar5 = *(longlong *)(*(longlong *)(puVar10 + 0x14) + 0xb8);
- *(undefined2 *)(lVar5 + -0x48) = 0x90f;
- *(undefined8 *)(lVar5 + -0x20) = local_78;
- *(undefined8 *)(lVar5 + -0x18) = uVar20;
- *(uint *)(lVar5 + -0x40) = param_3;
- *(undefined4 **)(lVar5 + -0x38) = puVar10;
- uVar20 = local_78;
+ uVar18 = AfdTdi_TA6toTA4_InPlace(*(int **)(local_98 + 10),puVar20);
+ uVar19 = local_58;
+ if ((char)uVar18 != '\0') {
+ local_80 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 0x10);
+ uVar19 = *(undefined8 *)(*(longlong *)(param_1 + 0x88) + 8);
+ }
+ }
+ lVar23 = *(longlong *)(*(longlong *)(puVar17 + 0x14) + 0xb8);
+ *(code **)(lVar23 + -0x10) = AfdRestartFastDatagramSend;
+ *(undefined4 **)(lVar23 + -8) = puVar9;
+ *(undefined1 *)(lVar23 + -0x45) = 0xe0;
+ lVar23 = *(longlong *)(*(longlong *)(puVar9 + 0x14) + 0xb8);
+ *(undefined2 *)(lVar23 + -0x48) = 0x90f;
+ *(undefined8 *)(lVar23 + -0x20) = local_80;
+ *(undefined8 *)(lVar23 + -0x18) = uVar19;
+ *(uint *)(lVar23 + -0x40) = param_3;
+ *(undefined4 **)(lVar23 + -0x38) = puVar9;
+ uVar19 = local_80;
}
LAB_11:
- uVar19 = 0;
- uVar15 = param_3;
+ uVar18 = 0;
+ uVar14 = param_3;
if ((*(uint *)(param_1 + 4) >> 8 & 1) != 0) {
- uVar15 = local_84;
- }
- *(uint *)(*(longlong *)(puVar18 + 0xe) + 0x28) = uVar15;
+ uVar14 = local_84;
+ }
+ *(uint *)(*(longlong *)(puVar17 + 0xe) + 0x28) = uVar14;
LOCK();
puVar1 = param_1 + 0x20;
- lVar5 = *(longlong *)puVar1;
+ lVar23 = *(longlong *)puVar1;
*(longlong *)puVar1 = *(longlong *)puVar1 + 1;
UNLOCK();
- puVar22 = auStack_108;
- if (lVar5 + 1 < 2) {
- pcVar8 = (code *)swi(0x29);
- (*pcVar8)(0xe);
- puVar22 = auStack_100;
- }
- lVar5 = *(longlong *)(puVar22 + 0x70);
- *(undefined8 *)(lVar5 + 0x30) = uVar19;
+ puVar21 = auStack_108;
+ if (lVar23 + 1 < 2) {
+ pcVar7 = (code *)swi(0x29);
+ (*pcVar7)(0xe);
+ puVar21 = auStack_100;
+ }
+ lVar23 = *(longlong *)(puVar21 + 0x70);
+ *(undefined8 *)(lVar23 + 0x30) = uVar18;
if (*(longlong *)(param_1 + 0xb0) == 0) {
LAB_12:
- uVar15 = *(uint *)(param_1 + 4);
+ uVar14 = *(uint *)(param_1 + 4);
uVar3 = *(uint *)((longlong)param_2 + 0xc);
- *(uint *)(puVar22 + 0x50) = uVar3;
- lVar7 = *(longlong *)(puVar22 + 0x70);
- if ((uVar15 >> 8 & 1) == 0) {
- *(undefined8 *)(puVar22 + 0x48) = *(undefined8 *)(lVar7 + 0x50);
- *(undefined8 *)(puVar22 + 0x40) = *(undefined8 *)(puVar18 + 10);
- *(uint *)(puVar22 + 0x30) = param_3;
- *(undefined8 *)(puVar22 + 0x28) = *(undefined8 *)(puVar18 + 0xe);
- *(undefined4 *)(puVar22 + 0x20) = *(undefined4 *)(*(longlong *)(puVar22 + 0x118) + 8);
- *(undefined8 *)(puVar22 + -8) = 0x140034cae;
+ *(uint *)(puVar21 + 0x50) = uVar3;
+ lVar6 = *(longlong *)(puVar21 + 0x70);
+ if ((uVar14 >> 8 & 1) == 0) {
+ *(undefined8 *)(puVar21 + 0x48) = *(undefined8 *)(lVar6 + 0x50);
+ *(undefined8 *)(puVar21 + 0x40) = *(undefined8 *)(puVar17 + 10);
+ *(uint *)(puVar21 + 0x30) = param_3;
+ *(undefined8 *)(puVar21 + 0x28) = *(undefined8 *)(puVar17 + 0xe);
+ *(undefined4 *)(puVar21 + 0x20) = *(undefined4 *)(*(longlong *)(puVar21 + 0x118) + 8);
+ *(undefined8 *)(puVar21 + -8) = 0x140033e31;
AFDETW_TRACESENDDATAGRAM((ulonglong)uVar3,0xc1d,(short *)param_1);
- uVar19 = *(undefined8 *)(lVar7 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140034cbc;
- iVar16 = IofCallDriver(uVar20,uVar19);
+ uVar18 = *(undefined8 *)(lVar6 + 0x50);
+ *(undefined8 *)(puVar21 + -8) = 0x140033e3f;
+ iVar15 = IofCallDriver(uVar19,uVar18);
}
else {
- *(longlong *)(puVar22 + 0x48) = lVar7;
- *(undefined8 *)(puVar22 + 0x40) = *(undefined8 *)(puVar18 + 10);
- *(uint *)(puVar22 + 0x30) = param_3;
- *(undefined8 *)(puVar22 + 0x28) = *(undefined8 *)(puVar18 + 0xe);
- *(undefined4 *)(puVar22 + 0x20) = *(undefined4 *)(*(longlong *)(puVar22 + 0x118) + 8);
- *(undefined8 *)(puVar22 + -8) = 0x140034c68;
+ *(longlong *)(puVar21 + 0x48) = lVar6;
+ *(undefined8 *)(puVar21 + 0x40) = *(undefined8 *)(puVar17 + 10);
+ *(uint *)(puVar21 + 0x30) = param_3;
+ *(undefined8 *)(puVar21 + 0x28) = *(undefined8 *)(puVar17 + 0xe);
+ *(undefined4 *)(puVar21 + 0x20) = *(undefined4 *)(*(longlong *)(puVar21 + 0x118) + 8);
+ *(undefined8 *)(puVar21 + -8) = 0x140033deb;
AFDETW_TRACESENDDATAGRAM((ulonglong)uVar3,0xc1c,(short *)param_1);
- *(undefined8 *)(puVar22 + -8) = 0x140034c73;
- iVar16 = AfdTLFastDgramSend(param_1,lVar7);
+ *(undefined8 *)(puVar21 + -8) = 0x140033df6;
+ iVar15 = AfdTLFastDgramSend((longlong)param_1,lVar6);
}
}
else {
- psVar6 = *(short **)(lVar5 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140034c0d;
- cVar11 = AfdEnqueueTpSendIrp(param_1,psVar6,0,lVar5);
- if (cVar11 == '\0') goto LAB_12;
- iVar16 = 0x103;
- }
- *(int *)(puVar22 + 0x60) = iVar16;
+ psVar5 = *(short **)(lVar23 + 0x50);
+ *(undefined8 *)(puVar21 + -8) = 0x140033d90;
+ cVar10 = AfdEnqueueTpSendIrp((short *)param_1,psVar5,0,lVar23);
+ if (cVar10 == '\0') goto LAB_12;
+ iVar15 = 0x103;
+ }
+ *(int *)(puVar21 + 0x60) = iVar15;
LOCK();
- bVar24 = *(longlong *)(lVar5 + 0x30) == 0;
+ bVar24 = *(longlong *)(lVar23 + 0x30) == 0;
if (bVar24) {
- *(longlong *)(lVar5 + 0x30) = (longlong)param_1;
+ *(longlong *)(lVar23 + 0x30) = (longlong)param_1;
}
UNLOCK();
if (bVar24) {
- iVar16 = *(int *)(puVar22 + 0x60);
+ iVar15 = *(int *)(puVar21 + 0x60);
}
else {
- lVar5 = *(longlong *)(puVar22 + 0x70);
- iVar16 = *(int *)(*(longlong *)(lVar5 + 0x50) + 0x30);
- *(int *)(puVar22 + 0x88) = iVar16;
- *(int *)(puVar22 + 0x60) = iVar16;
- *(undefined8 *)(puVar22 + -8) = 0x140034cfd;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x98);
- uVar15 = *(int *)(param_1 + 0x4e) - param_3;
- *(uint *)(param_1 + 0x4e) = uVar15;
- if ((uVar15 < *(uint *)(param_1 + 0x50)) || (uVar15 == 0)) {
- *(undefined8 *)(puVar22 + -8) = 0x140034d45;
+ lVar23 = *(longlong *)(puVar21 + 0x70);
+ iVar15 = *(int *)(*(longlong *)(lVar23 + 0x50) + 0x30);
+ *(int *)(puVar21 + 0x60) = iVar15;
+ *(undefined8 *)(puVar21 + -8) = 0x140033e7b;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar21 + 0x90);
+ uVar14 = *(int *)(param_1 + 0x4e) - param_3;
+ *(uint *)(param_1 + 0x4e) = uVar14;
+ if ((uVar14 < *(uint *)(param_1 + 0x50)) || (uVar14 == 0)) {
+ *(undefined8 *)(puVar21 + -8) = 0x140033ec3;
AfdIndicateEventSelectEvent((short *)param_1,4,0);
if (*(longlong *)(param_1 + 0xbc) != 0) {
puVar1 = (ushort *)(*(longlong *)(param_1 + 0xbc) + 100);
*puVar1 = *puVar1 | 4;
}
- *(undefined8 *)(puVar22 + -8) = 0x140034d6d;
- uVar20 = AfdIndicatePollEvent((short *)param_1,4,0,puVar22 + 0x98);
- if ((char)uVar20 == '\0') {
- cVar11 = '\0';
- *(undefined8 *)(puVar22 + 0xb8) = 0;
- *(undefined8 *)(puVar22 + 0xc0) = 0;
- *(undefined8 *)(puVar22 + 200) = 0;
+ *(undefined8 *)(puVar21 + -8) = 0x140033eeb;
+ uVar19 = AfdIndicatePollEvent((short *)param_1,4,0,puVar21 + 0x90);
+ if ((char)uVar19 == '\0') {
+ cVar10 = '\0';
+ *(undefined8 *)(puVar21 + 0xb8) = 0;
+ *(undefined8 *)(puVar21 + 0xc0) = 0;
+ *(undefined8 *)(puVar21 + 200) = 0;
if (*(longlong *)(param_1 + 0xbc) != 0) {
- *(undefined8 *)(puVar22 + -8) = 0x140034da8;
- cVar13 = ExAcquireRundownProtection(param_1 + 0xc0);
- if (cVar13 != '\0') {
- puVar22[0x110] = 1;
- bVar24 = true;
- lVar7 = *(longlong *)(param_1 + 0xbc);
- *(undefined8 *)(puVar22 + 0x90) = *(undefined8 *)(lVar7 + 0x40);
- uVar2 = *(ushort *)(lVar7 + 0x6a);
+ *(undefined8 *)(puVar21 + -8) = 0x140033f25;
+ cVar12 = ExAcquireRundownProtection(param_1 + 0xc0);
+ if (cVar12 != '\0') {
+ puVar21[100] = 1;
+ cVar10 = '\x01';
+ lVar6 = *(longlong *)(param_1 + 0xbc);
+ *(undefined8 *)(puVar21 + 0x88) = *(undefined8 *)(lVar6 + 0x40);
+ uVar2 = *(ushort *)(lVar6 + 0x6a);
if ((uVar2 & 2) == 0) {
- uVar23 = uVar2 | 2;
- *(ushort *)(lVar7 + 0x6a) = uVar23;
+ uVar22 = uVar2 | 2;
+ *(ushort *)(lVar6 + 0x6a) = uVar22;
while ((uVar2 & 1) == 0) {
- *(undefined8 *)(puVar22 + -8) = 0x140034dfc;
- uVar14 = AfdNotifyComputeEvents(lVar7);
- *(undefined2 *)(lVar7 + 0x66) = *(undefined2 *)(lVar7 + 100);
- uVar2 = *(ushort *)(lVar7 + 0x68);
- if (uVar14 == uVar2) {
- if ((*(byte *)(lVar7 + 99) & 1) != 0) {
- uVar23 = uVar23 | 4;
+ *(undefined8 *)(puVar21 + -8) = 0x140033f78;
+ uVar13 = AfdNotifyComputeEvents(lVar6);
+ *(undefined2 *)(lVar6 + 0x66) = *(undefined2 *)(lVar6 + 100);
+ uVar2 = *(ushort *)(lVar6 + 0x68);
+ if (uVar13 == uVar2) {
+ if ((*(byte *)(lVar6 + 99) & 1) != 0) {
+ uVar22 = uVar22 | 4;
}
LAB_13:
- *(ushort *)(lVar7 + 0x6a) = uVar23 & 0xfffd;
- bVar24 = true;
+ *(ushort *)(lVar6 + 0x6a) = uVar22 & 0xfffd;
+ cVar10 = '\x01';
goto LAB_14;
}
- if ((uVar2 & uVar14) != 0) goto LAB_13;
+ if ((uVar2 & uVar13) != 0) goto LAB_13;
if (uVar2 == 0) {
- *(ushort *)(lVar7 + 0x68) = uVar14;
- *(undefined8 *)(puVar22 + -8) = 0x140034ec7;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x98);
- *(undefined8 *)(puVar22 + -8) = 0x140034edb;
- ObfReferenceObject(*(undefined8 *)(puVar22 + 0x90));
- puVar22[0x40] = AfdPriorityBoost;
- puVar22[0x38] = 0;
- *(longlong *)(puVar22 + 0x30) = lVar7;
- puVar22[0x28] = 0;
- *(ulonglong *)(puVar22 + 0x20) = (ulonglong)uVar14;
- uVar20 = *(undefined8 *)(lVar7 + 0x58);
- uVar19 = *(undefined8 *)(lVar7 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140034f14;
- IoSetIoCompletionEx3(uVar19,uVar20,0,0);
- *(undefined8 *)(puVar22 + -8) = 0x140034f2c;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x98);
+ *(ushort *)(lVar6 + 0x68) = uVar13;
+ *(undefined8 *)(puVar21 + -8) = 0x140034043;
+ KeReleaseInStackQueuedSpinLock(puVar21 + 0x90);
+ *(undefined8 *)(puVar21 + -8) = 0x140034057;
+ ObfReferenceObject(*(undefined8 *)(puVar21 + 0x88));
+ puVar21[0x40] = AfdPriorityBoost;
+ puVar21[0x38] = 0;
+ *(longlong *)(puVar21 + 0x30) = lVar6;
+ puVar21[0x28] = 0;
+ *(ulonglong *)(puVar21 + 0x20) = (ulonglong)uVar13;
+ uVar19 = *(undefined8 *)(lVar6 + 0x58);
+ uVar18 = *(undefined8 *)(lVar6 + 0x50);
+ *(undefined8 *)(puVar21 + -8) = 0x140034090;
+ IoSetIoCompletionEx3(uVar18,uVar19,0,0);
+ *(undefined8 *)(puVar21 + -8) = 0x1400340a8;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar21 + 0x90);
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140034e38;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x98);
- uVar20 = *(undefined8 *)(lVar7 + 0x50);
- *(undefined8 *)(puVar22 + -8) = 0x140034e4b;
- cVar11 = IoCancelMiniCompletionPacket(uVar20,lVar7);
- if (cVar11 == '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x140034e67;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x98);
- if (*(short *)(lVar7 + 0x68) != 0) {
- *(ushort *)(lVar7 + 0x6a) = *(ushort *)(lVar7 + 0x6a) & 0xfffd;
- bVar24 = true;
+ *(undefined8 *)(puVar21 + -8) = 0x140033fb4;
+ KeReleaseInStackQueuedSpinLock(puVar21 + 0x90);
+ uVar19 = *(undefined8 *)(lVar6 + 0x50);
+ *(undefined8 *)(puVar21 + -8) = 0x140033fc7;
+ cVar10 = IoCancelMiniCompletionPacket(uVar19,lVar6);
+ if (cVar10 == '\0') {
+ *(undefined8 *)(puVar21 + -8) = 0x140033fe3;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar21 + 0x90);
+ if (*(short *)(lVar6 + 0x68) != 0) {
+ *(ushort *)(lVar6 + 0x6a) = *(ushort *)(lVar6 + 0x6a) & 0xfffd;
+ cVar10 = '\x01';
goto LAB_14;
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140034e96;
- ObfDereferenceObject(*(undefined8 *)(puVar22 + 0x90));
- *(undefined8 *)(puVar22 + -8) = 0x140034eae;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x98);
- *(undefined2 *)(lVar7 + 0x68) = 0;
+ *(undefined8 *)(puVar21 + -8) = 0x140034012;
+ ObfDereferenceObject(*(undefined8 *)(puVar21 + 0x88));
+ *(undefined8 *)(puVar21 + -8) = 0x14003402a;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar21 + 0x90);
+ *(undefined2 *)(lVar6 + 0x68) = 0;
}
}
- uVar23 = *(ushort *)(lVar7 + 0x6a);
- uVar2 = uVar23;
+ uVar22 = *(ushort *)(lVar6 + 0x6a);
+ uVar2 = uVar22;
}
param_1[0xbc] = 0;
param_1[0xbd] = 0;
param_1[0xbe] = 0;
param_1[0xbf] = 0;
- *(ushort *)(lVar7 + 0x6a) = *(ushort *)(lVar7 + 0x6a) & 0xfffd;
- *(undefined8 *)(puVar22 + -8) = 0x140034f61;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x98);
- *(undefined8 *)(puVar22 + -8) = 0x140034f76;
- AfdNotifyDestroyContext(*(undefined8 *)(puVar22 + 0x90),lVar7);
- bVar24 = false;
+ *(ushort *)(lVar6 + 0x6a) = *(ushort *)(lVar6 + 0x6a) & 0xfffd;
+ *(undefined8 *)(puVar21 + -8) = 0x1400340dd;
+ KeReleaseInStackQueuedSpinLock(puVar21 + 0x90);
+ puVar21[0x110] = 0;
+ *(undefined8 *)(puVar21 + -8) = 0x1400340fa;
+ AfdNotifyDestroyContext(*(undefined8 *)(puVar21 + 0x88),lVar6);
+ if ((Feature_447951161__private_featureState & 0x10) == 0) {
+ *(undefined8 *)(puVar21 + -8) = 0x14003412b;
+ uVar16 = Feature_447951161__private_IsEnabledDeviceUsageNoInline();
+ uVar14 = (uint)uVar16;
+ }
+ else {
+ uVar14 = Feature_447951161__private_featureState & 1;
+ }
+ if (uVar14 != 0) {
+ *(undefined8 *)(puVar21 + -8) = 0x14003413e;
+ ExFreePoolWithTag(lVar6,0x4e646641);
+ }
+ cVar10 = puVar21[0x110];
+ iVar15 = *(int *)(puVar21 + 0x60);
+ lVar23 = *(longlong *)(puVar21 + 0x70);
}
LAB_14:
- if (!bVar24) {
- *(undefined8 *)(puVar22 + -8) = 0x140034f8f;
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar22 + 0x98);
+ if (cVar10 == '\0') {
+ *(undefined8 *)(puVar21 + -8) = 0x14003416c;
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,puVar21 + 0x90);
}
- cVar11 = puVar22[0x110];
- iVar16 = *(int *)(puVar22 + 0x88);
+ cVar10 = puVar21[100];
+ param_3 = *(uint *)(puVar21 + 0x120);
}
}
- *(undefined8 *)(puVar22 + -8) = 0x140034fb3;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x98);
- if (cVar11 != '\0') {
- *(undefined8 *)(puVar22 + -8) = 0x140034fcb;
+ *(undefined8 *)(puVar21 + -8) = 0x14003418d;
+ KeReleaseInStackQueuedSpinLock(puVar21 + 0x90);
+ if (cVar10 != '\0') {
+ *(undefined8 *)(puVar21 + -8) = 0x1400341a4;
ExReleaseRundownProtection(param_1 + 0xc0);
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140034ffc;
+ *(undefined8 *)(puVar21 + -8) = 0x1400341b8;
AfdNotifySockIndicateEventsUnlock((longlong)param_1,(undefined8 *)0x0,'\0');
}
}
else {
- *(undefined8 *)(puVar22 + -8) = 0x140034d2c;
- KeReleaseInStackQueuedSpinLock(puVar22 + 0x98);
- }
- if (*(longlong *)(lVar5 + 0x18) == 0) {
- if (*(int *)(lVar5 + 0x20) == 0) {
- *(longlong *)(puVar22 + 0x40) = lVar5;
- *(int *)(puVar22 + 0x38) = iVar16;
- *(uint *)(puVar22 + 0x30) = param_3;
- *(undefined8 *)(puVar22 + 0x28) = *(undefined8 *)(puVar18 + 0xe);
- *(undefined4 *)(puVar22 + 0x20) = 1;
- *(undefined8 *)(puVar22 + -8) = 0x140035070;
- AFDETW_TRACESEND(1,0xc81,(short *)param_1,1,*(undefined4 *)(puVar22 + 0x20),
- *(undefined8 *)(puVar22 + 0x28),*(undefined4 *)(puVar22 + 0x30),
- *(undefined4 *)(puVar22 + 0x38),*(short **)(puVar22 + 0x40));
+ *(undefined8 *)(puVar21 + -8) = 0x140033eaa;
+ KeReleaseInStackQueuedSpinLock(puVar21 + 0x90);
+ }
+ if (*(longlong *)(lVar23 + 0x18) == 0) {
+ if (*(int *)(lVar23 + 0x20) == 0) {
+ *(longlong *)(puVar21 + 0x40) = lVar23;
+ *(int *)(puVar21 + 0x38) = iVar15;
+ *(uint *)(puVar21 + 0x30) = param_3;
+ *(undefined8 *)(puVar21 + 0x28) = *(undefined8 *)(puVar17 + 0xe);
+ *(undefined4 *)(puVar21 + 0x20) = 1;
+ *(undefined8 *)(puVar21 + -8) = 0x14003422e;
+ AFDETW_TRACESEND(1,0xc81,(short *)param_1,1,*(undefined4 *)(puVar21 + 0x20),
+ *(undefined8 *)(puVar21 + 0x28),*(undefined4 *)(puVar21 + 0x30),
+ *(undefined4 *)(puVar21 + 0x38),*(short **)(puVar21 + 0x40));
}
else {
- *(longlong *)(puVar22 + 0x48) = lVar5;
- *(undefined8 *)(puVar22 + 0x40) = *(undefined8 *)(lVar5 + 0x28);
- *(int *)(puVar22 + 0x38) = iVar16;
- *(uint *)(puVar22 + 0x30) = param_3;
- *(undefined8 *)(puVar22 + 0x28) = *(undefined8 *)(puVar18 + 0xe);
- *(undefined4 *)(puVar22 + 0x20) = 1;
- *(undefined8 *)(puVar22 + -8) = 0x1400350a4;
+ *(longlong *)(puVar21 + 0x48) = lVar23;
+ *(undefined8 *)(puVar21 + 0x40) = *(undefined8 *)(lVar23 + 0x28);
+ *(int *)(puVar21 + 0x38) = iVar15;
+ *(uint *)(puVar21 + 0x30) = param_3;
+ *(undefined8 *)(puVar21 + 0x28) = *(undefined8 *)(puVar17 + 0xe);
+ *(undefined4 *)(puVar21 + 0x20) = 1;
+ *(undefined8 *)(puVar21 + -8) = 0x140034263;
AFDETW_TRACESENDTO(1,0xc82,(short *)param_1,1);
}
}
else {
- *(longlong *)(puVar22 + 0x48) = lVar5;
- *(undefined8 *)(puVar22 + 0x40) = *(undefined8 *)(lVar5 + 0x28);
- *(int *)(puVar22 + 0x38) = iVar16;
- *(uint *)(puVar22 + 0x30) = param_3;
- *(undefined8 *)(puVar22 + 0x28) = *(undefined8 *)(puVar18 + 0xe);
- *(undefined4 *)(puVar22 + 0x20) = 1;
- *(undefined8 *)(puVar22 + -8) = 0x14003503e;
+ *(longlong *)(puVar21 + 0x48) = lVar23;
+ *(undefined8 *)(puVar21 + 0x40) = *(undefined8 *)(lVar23 + 0x28);
+ *(int *)(puVar21 + 0x38) = iVar15;
+ *(uint *)(puVar21 + 0x30) = param_3;
+ *(undefined8 *)(puVar21 + 0x28) = *(undefined8 *)(puVar17 + 0xe);
+ *(undefined4 *)(puVar21 + 0x20) = 1;
+ *(undefined8 *)(puVar21 + -8) = 0x1400341fb;
AFDETW_TRACESENDMSG((undefined4 *)0x1,0xc80,(short *)param_1,1);
}
- lVar7 = *(longlong *)(param_1 + 0x18);
- *(undefined8 *)(puVar22 + -8) = 0x1400350b0;
- AfdReturnBuffer(lVar5,lVar7);
- *(undefined8 *)(puVar22 + -8) = 0x1400350b8;
+ lVar6 = *(longlong *)(param_1 + 0x18);
+ *(undefined8 *)(puVar21 + -8) = 0x14003426f;
+ AfdReturnBuffer(lVar23,lVar6);
+ *(undefined8 *)(puVar21 + -8) = 0x140034277;
AfdDereferenceEndpoint(param_1);
}
- if (-1 < iVar16) {
- puVar18 = *(undefined4 **)(puVar22 + 0x138);
- *(ulonglong *)(puVar18 + 2) = (ulonglong)param_3;
- *puVar18 = 0;
+ if (-1 < iVar15) {
+ puVar17 = *(undefined4 **)(puVar21 + 0x138);
+ *(ulonglong *)(puVar17 + 2) = (ulonglong)param_3;
+ *puVar17 = 0;
return 1;
}
}
else {
if ((DAT_1 & 0x40) != 0) {
local_e8 = param_1;
- WPP_SF_DDq(0x10,uVar17,param_3,uVar15);
+ WPP_SF_DDq(0x10,uVar16,param_3,uVar14);
}
local_a8 = 0xc000000d;
- AfdReturnBuffer((longlong)puVar18,*(longlong *)(param_1 + 0x18));
+ AfdReturnBuffer((longlong)puVar17,*(longlong *)(param_1 + 0x18));
LAB_6:
- KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_70);
+ KeAcquireInStackQueuedSpinLock(param_1 + 0x1c,&local_78);
*(uint *)(param_1 + 0x4e) = *(int *)(param_1 + 0x4e) - param_3;
- KeReleaseInStackQueuedSpinLock(&local_70);
+ KeReleaseInStackQueuedSpinLock(&local_78);
}
LAB_10:
- uVar17 = (ulonglong)*(uint *)(param_1 + 4);
+ uVar16 = (ulonglong)*(uint *)(param_1 + 4);
if (((*(uint *)(param_1 + 4) & 0x10) != 0) &&
- (uVar17 = (ulonglong)*(uint *)(*(longlong *)(puVar22 + 0x118) + 0xc),
- (*(uint *)(*(longlong *)(puVar22 + 0x118) + 0xc) & 2) == 0)) {
- uVar4 = *(undefined4 *)(puVar22 + 0x60);
- **(undefined4 **)(puVar22 + 0x138) = uVar4;
+ (uVar16 = (ulonglong)*(uint *)(*(longlong *)(puVar21 + 0x118) + 0xc),
+ (*(uint *)(*(longlong *)(puVar21 + 0x118) + 0xc) & 2) == 0)) {
+ uVar4 = *(undefined4 *)(puVar21 + 0x60);
+ **(undefined4 **)(puVar21 + 0x138) = uVar4;
return CONCAT71((uint7)(uint3)((uint)uVar4 >> 8),1);
}
LAB_0:
- return uVar17 & 0xffffffffffffff00;
+ return uVar16 & 0xffffffffffffff00;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## NTOSKRNL.EXE::MmMapLockedPages
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|MmMapLockedPages|MmMapLockedPages|
|fullname|NTOSKRNL.EXE::MmMapLockedPages|NTOSKRNL.EXE::MmMapLockedPages|
|`refcount`|30|32|
|length|0|0|
|called|||
|calling|AfdConnectEventHandler
AfdGetAddress
AfdRestartSuperAcceptGetAddress
AfdSanAcceptCore
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdServiceSuperAccept
AfdServiceWaitForListen
AfdTLCopyRemoteAndLocalAddresses|AfdConnectEventHandler
AfdGetAddress
AfdRestartSuperAcceptGetAddress
AfdSanAcceptCore
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdServiceSuperAccept
AfdServiceWaitForListen
AfdTLCopyRemoteAndLocalAddresses|
|paramcount|0|0|
|`address`|EXTERNAL:000000d5|EXTERNAL:000000d6|
|sig|undefined MmMapLockedPages(void)|undefined MmMapLockedPages(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
## memcpy
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.82|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|memcpy|memcpy|
|fullname|memcpy|memcpy|
|`refcount`|179|182|
|length|537|537|
|called|||
|calling|Expand for full list:
AfdAddressListQuery
AfdAllocateEndpoint
AfdBReceiveEventHandler
AfdBind
AfdBufferReceiveDatagram
AfdBuildPacketChain
AfdCommonAddAddressHandler
AfdConnect
AfdConnectEventHandler
AfdCopyBufferArrayToBuffer
AfdCopyCMSGBuffer
AfdCopyCMSGBuffer32
AfdCopyMdlChainToBufferAvoidMapping
AfdCreateSecurityDescriptor
AfdDoDatagramConnect
AfdExtractAfdSendMsgInfo
AfdFastDatagramReceive
AfdFastDatagramSend
AfdFastTransmitFile
AfdFinishSuperAccept
AfdGetConnectData
AfdGetContext
AfdGetRemoteAddress
AfdGetUnacceptedConnectData
AfdHandleIcmpError
AfdIssueDeviceControl
AfdNsiAddressChangeEvent
AfdRestartDelayedAcceptListen
AfdRestartSuperAcceptGetAddress
AfdRioFlushDgramSend
AfdRioGrowTable
AfdRioHandleDgramReceiveRequest
AfdRioResizeCq
AfdRioResizeRqPair
AfdRoutingInterfaceQuery
AfdSanAcceptCore
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdSaveReceivedConnectData
AfdSend
AfdSendDatagram
AfdServiceSuperAccept
AfdServiceWaitForListen
AfdSetConnectData
AfdSetContext
AfdSetupReceiveDatagramIrp
AfdSuperConnect
AfdTLConnectEventHandler
AfdTLCopyRemoteAndLocalAddresses
AfdTLGetAddressComplete
AfdTLInspectEventHandler
AfdTdiCreateAO
AfdTliIoControl
AfdTliIoControlHandleSetQoS
AfdTraceLogTdiFilter
Atma_RecordRead_New
CopySingleConnectDataBuffer
Dhcid_RecordRead_New
Dns_ReadPacketNameImpl_New
Ds_RecordRead_New
Key_RecordRead_New
MarshalRpcRecordToDnsRecord
Minfo_RecordRead_New
Mx_RecordRead_New
Naptr_RecordRead_New
Nsec3Param_RecordRead_New
Nsec3_RecordRead_New
Nsec_RecordRead_New
Opt_RecordRead_New
Ptr_RecordRead_New
Sig_RecordRead_New
Soa_RecordRead_New
Srv_RecordRead_New
TLSA_RecordRead_New
Tsig_RecordRead_New
Txt_RecordRead_New
Wins_RecordRead_New
Winsr_RecordRead_New
WppTraceCallback
WskProAddressListQuery
WskProCompleteReceiveFromIrp
WskProIRPGetNameInfo
WskProTLEVENTConnect
WskTdiCOMPAcceptAddressQuery
WskTdiCOMPAddressQuery
WskTdiCOMPCOAListen
WskTdiConnectCore
WskTdiCreateAO
WskTdiEHConnect
WskTdiEHReceiveDatagram
WskTdiTLRequestConnect
WskTdiTLRequestIoControlEndpoint
WskTdiTLRequestSendMessages
rio_rq_dequeExpand for full list:
AfdAddressListQuery
AfdAllocateEndpoint
AfdBReceiveEventHandler
AfdBind
AfdBufferReceiveDatagram
AfdBuildPacketChain
AfdCommonAddAddressHandler
AfdConnect
AfdConnectEventHandler
AfdCopyBufferArrayToBuffer
AfdCopyCMSGBuffer
AfdCopyCMSGBuffer32
AfdCopyMdlChainToBufferAvoidMapping
AfdCreateSecurityDescriptor
AfdDoDatagramConnect
AfdExtractAfdSendMsgInfo
AfdFastDatagramReceive
AfdFastDatagramSend
AfdFastTransmitFile
AfdFinishSuperAccept
AfdGetConnectData
AfdGetContext
AfdGetRemoteAddress
AfdGetUnacceptedConnectData
AfdHandleIcmpError
AfdIssueDeviceControl
AfdNsiAddressChangeEvent
AfdRestartDelayedAcceptListen
AfdRestartSuperAcceptGetAddress
AfdRioFlushDgramSend
AfdRioGrowTable
AfdRioHandleDgramReceiveRequest
AfdRioResizeCq
AfdRioResizeRqPair
AfdRoutingInterfaceQuery
AfdSanAcceptCore
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdSaveReceivedConnectData
AfdSend
AfdSendDatagram
AfdServiceSuperAccept
AfdServiceWaitForListen
AfdSetConnectData
AfdSetContext
AfdSetupReceiveDatagramIrp
AfdSuperConnect
AfdTLConnectEventHandler
AfdTLCopyRemoteAndLocalAddresses
AfdTLGetAddressComplete
AfdTLInspectEventHandler
AfdTdiCreateAO
AfdTliIoControl
AfdTliIoControlHandleSetQoS
AfdTraceLogTdiFilter
Atma_RecordRead_New
CopySingleConnectDataBuffer
Dhcid_RecordRead_New
Dns_ReadPacketNameImpl_New
Ds_RecordRead_New
Key_RecordRead_New
MarshalRpcRecordToDnsRecord
Minfo_RecordRead_New
Mx_RecordRead_New
Naptr_RecordRead_New
Nsec3Param_RecordRead_New
Nsec3_RecordRead_New
Nsec_RecordRead_New
Opt_RecordRead_New
Ptr_RecordRead_New
Sig_RecordRead_New
Soa_RecordRead_New
Srv_RecordRead_New
TLSA_RecordRead_New
Tsig_RecordRead_New
Txt_RecordRead_New
Wins_RecordRead_New
Winsr_RecordRead_New
WppTraceCallback
WskProAddressListQuery
WskProCompleteReceiveFromIrp
WskProIRPGetNameInfo
WskProTLEVENTConnect
WskTdiCOMPAcceptAddressQuery
WskTdiCOMPAddressQuery
WskTdiCOMPCOAListen
WskTdiConnectCore
WskTdiCreateAO
WskTdiEHConnect
WskTdiEHReceiveDatagram
WskTdiTLRequestConnect
WskTdiTLRequestIoControlEndpoint
WskTdiTLRequestSendMessages
rio_rq_deque
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Expand for full list:
Feature_1149455673__private_IsEnabledFallback
Feature_1384345915__private_IsEnabledFallback
Feature_3261636923__private_IsEnabledFallback
Feature_3944182073__private_IsEnabledFallback
Feature_4190334265__private_IsEnabledFallback
Feature_428571963__private_IsEnabledFallback
Feature_4431_4260__private_IsEnabledFallback
Feature_57479439__private_IsEnabledFallback
Feature_682670395__private_IsEnabledFallback
Feature_Servicing_AudioVideoStutteringIssue__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_AfdRwLock__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_AfdSd__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_LimitTcpRxBatchNonTdi__private_IsEnabledFallback
Feature_TCPIP_AfdFuzzing_58104732_Fix__private_IsEnabledFallbackExpand for full list:
Feature_1149455673__private_IsEnabledFallback
Feature_1384345915__private_IsEnabledFallback
Feature_2829529401__private_IsEnabledFallback
Feature_3923194169__private_IsEnabledFallback
Feature_3944182073__private_IsEnabledFallback
Feature_4190334265__private_IsEnabledFallback
Feature_428571963__private_IsEnabledFallback
Feature_4431_4260__private_IsEnabledFallback
Feature_447951161__private_IsEnabledFallback
Feature_57479439__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_AfdRwLock__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_AfdSd__private_IsEnabledFallback
Feature_TCPIP_2025_Wave2_LimitTcpRxBatchNonTdi__private_IsEnabledFallback
Feature_TCPIP_2025_Wave4_AfdTransmit_MSRC__private_IsEnabledFallback
Feature_TCPIP_AfdFuzzing_58104732_Fix__private_IsEnabledFallbackExpand for full list:
AFDETW_NRT_TRACE
AFDETW_RIO_TRACE_BUFFER_CLEANUP
AFDETW_RIO_TRACE_BUFFER_DEREGISTER
AFDETW_RIO_TRACE_BUFFER_REGISTER
AFDETW_RIO_TRACE_CQ_CLEANUP
AFDETW_RIO_TRACE_CQ_CLOSE
AFDETW_RIO_TRACE_CQ_CREATE
AFDETW_RIO_TRACE_CQ_NOTIFY
AFDETW_RIO_TRACE_CQ_RESIZE
AFDETW_RIO_TRACE_INVALID_BUFFERID
AFDETW_RIO_TRACE_INVALID_BUFFER_RANGE
AFDETW_RIO_TRACE_INVALID_BUFFER_SHARING
AFDETW_RIO_TRACE_INVALID_BUFFER_SIZE
AFDETW_RIO_TRACE_REGDOMAIN_CREATE
AFDETW_RIO_TRACE_RQ_CLEANUP
AFDETW_RIO_TRACE_RQ_CREATE
AFDETW_RIO_TRACE_RQ_RESIZE
AFDETW_STARTACTIVITY
AFDETW_START_ACTIVITY_FASTIO
AFDETW_STOPACTIVITY
AFDETW_STOP_ACTIVITY_FASTIO
AFDETW_TRACEABORT
AFDETW_TRACEACCEPT
AFDETW_TRACEACCEPTEX
AFDETW_TRACEACCEPTPAUSE
AFDETW_TRACEACCEPT_CORE
AFDETW_TRACEACCEPT_ERROR
AFDETW_TRACEBIND
AFDETW_TRACEBSEND
AFDETW_TRACEBUFFER
AFDETW_TRACEBUFFERTOBUFFER
AFDETW_TRACECONNECT
AFDETW_TRACECONNECTEX
AFDETW_TRACECONNECT_CORE
AFDETW_TRACECONNECT_INDICATION
AFDETW_TRACECREATE
AFDETW_TRACEDATAADDR_CORE
AFDETW_TRACEDATAGRAM_DROP
AFDETW_TRACEDATA_CORE
AFDETW_TRACEDATA_INDICATION
AFDETW_TRACEDISCONNECT
AFDETW_TRACELISTEN
AFDETW_TRACEOPTION
AFDETW_TRACERECV
AFDETW_TRACERECVDATAGRAM
AFDETW_TRACESEND
AFDETW_TRACESENDBACKLOG
AFDETW_TRACESENDDATAGRAM
AFDETW_TRACESENDMSG
AFDETW_TRACESENDTO
AFDETW_TRACESTATUS
AFDETW_TRACETRANSFER
AFDETW_TRACEWAITLISTEN
AfdAddressListQuery
AfdCleanupCore
AfdCloseCore
AfdCloseTransportEndpoint
AfdCompleteBufferedSendsUnlock
AfdConnectEventHandler
AfdCreateConnection
AfdCreateSecurityDescriptor
AfdDispatch
AfdEnumerateProcessDiagnostics
AfdEtwTraceEvent
AfdFastIoDeviceControl
AfdFreeEndpointResources
AfdGetAddress
AfdGetConnectData
AfdGetInformation
AfdGetSecurity
AfdGetTransportInfo
AfdGetUnacceptedConnectData
AfdHandleIcmpError
AfdInitializeData
AfdLRStartTimer
AfdNotifyIPAvailabilityConsumers
AfdNotifyRemoveIoCompletion
AfdNsiAddressChangeEventAtPassive
AfdNsiGetAddressProperties
AfdNsiGetBestIPv4RouteHelper
AfdNsiGetBestIPv6Route
AfdNsiRouteChangeCallback
AfdPartialDisconnect
AfdPcwProviderCallback
AfdPodInit
AfdQueryProviderInfo
AfdReadRegistry
AfdReadSingleParameter
AfdReceiveDatagramEventHandler
AfdRioFlushDgramSend
AfdRioFlushReceiveQueue
AfdRioHandleIcmpError
AfdRioValidateRequestBuffer
AfdRioValidateRequestBuffer_Old
AfdRoutingInterfaceQuery
AfdSanFastCementEndpoint
AfdSanFastCompleteAccept
AfdSanFastTransferCtx
AfdSetConnectData
AfdSetInLineMode
AfdSetInformation
AfdSetSecurity
AfdTLBufferedSendCompleteBatch
AfdTLFastDgramSend
AfdTLFastDgramSendComplete
AfdTLResumeConnectionSetup
AfdTLRioDgramReceiveEventHandler
AfdTLStartBufferedVcSend
AfdTLVcSendDgramComplete
AfdTdiCreateAO
AfdTdxCallbackRoutine
AfdTliIoControl
AfdTraceLogTdiFilter
AfdTransmitFile
AfdTransmitPackets
AfdTransmitPackets32
AfdUnbind
EtwEx_tidActivityInfo
EtwEx_tidActivityInfoTransfer
Ipv6UnicastAddressScope
KnrNrpCreateBinding
KnrNrpDnskQuery
KnrNrpGetAddressInfoW
KnrNrpGetNameInfoW
KnrNrpImpersonate
MicrosoftTelemetryAssertTriggeredWorker
Minfo_RecordRead_New
Mx_RecordRead_New
Naptr_RecordRead_New
Nsec_RecordRead_New
Ptr_RecordRead_New
Sig_RecordRead_New
Soa_RecordRead_New
Srv_RecordRead_New
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
Winsr_RecordRead_New
WskKnrCreateNameResNamedEvent
WskKnrDemandStartDns
WskProIRPResume
WskProTLEVENTConnect
WskProTLEVENTReceive
WskProTLReceiveComplete
WskProTLSendOrDisconnectComplete
WskTdiCOMPAcceptAddressQuery
WskTdiCOMPCOAListen
WskTdiCreateAO
WskTdiCreateCO
WskTdiResolveFamilyAndCreateAO
WskTdiWQRoutineEndpointCreate
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStatesExpand for full list:
AFDETW_NRT_TRACE
AFDETW_RIO_TRACE_BUFFER_CLEANUP
AFDETW_RIO_TRACE_BUFFER_DEREGISTER
AFDETW_RIO_TRACE_BUFFER_REGISTER
AFDETW_RIO_TRACE_CQ_CLEANUP
AFDETW_RIO_TRACE_CQ_CLOSE
AFDETW_RIO_TRACE_CQ_CREATE
AFDETW_RIO_TRACE_CQ_NOTIFY
AFDETW_RIO_TRACE_CQ_RESIZE
AFDETW_RIO_TRACE_INVALID_BUFFERID
AFDETW_RIO_TRACE_INVALID_BUFFER_RANGE
AFDETW_RIO_TRACE_INVALID_BUFFER_SHARING
AFDETW_RIO_TRACE_INVALID_BUFFER_SIZE
AFDETW_RIO_TRACE_REGDOMAIN_CREATE
AFDETW_RIO_TRACE_RQ_CLEANUP
AFDETW_RIO_TRACE_RQ_CREATE
AFDETW_RIO_TRACE_RQ_RESIZE
AFDETW_STARTACTIVITY
AFDETW_START_ACTIVITY_FASTIO
AFDETW_STOPACTIVITY
AFDETW_STOP_ACTIVITY_FASTIO
AFDETW_TRACEABORT
AFDETW_TRACEACCEPT
AFDETW_TRACEACCEPTEX
AFDETW_TRACEACCEPTPAUSE
AFDETW_TRACEACCEPT_CORE
AFDETW_TRACEACCEPT_ERROR
AFDETW_TRACEBIND
AFDETW_TRACEBSEND
AFDETW_TRACEBUFFER
AFDETW_TRACEBUFFERTOBUFFER
AFDETW_TRACECLOSE
AFDETW_TRACECONNECT
AFDETW_TRACECONNECTEX
AFDETW_TRACECONNECT_CORE
AFDETW_TRACECONNECT_INDICATION
AFDETW_TRACECREATE
AFDETW_TRACEDATAADDR_CORE
AFDETW_TRACEDATAGRAM_DROP
AFDETW_TRACEDATA_CORE
AFDETW_TRACEDATA_INDICATION
AFDETW_TRACEDISCONNECT
AFDETW_TRACELISTEN
AFDETW_TRACEOPTION
AFDETW_TRACERECV
AFDETW_TRACERECVDATAGRAM
AFDETW_TRACESEND
AFDETW_TRACESENDBACKLOG
AFDETW_TRACESENDDATAGRAM
AFDETW_TRACESENDMSG
AFDETW_TRACESENDTO
AFDETW_TRACESTATUS
AFDETW_TRACETRANSFER
AFDETW_TRACEWAITLISTEN
AfdAddressListQuery
AfdBind
AfdCleanupCore
AfdCloseTransportEndpoint
AfdCompleteBufferedSendsUnlock
AfdConnectEventHandler
AfdCreateConnection
AfdCreateSecurityDescriptor
AfdDispatch
AfdEnumerateProcessDiagnostics
AfdEtwTraceEvent
AfdFastIoDeviceControl
AfdFreeEndpointResources
AfdGetAddress
AfdGetConnectData
AfdGetInformation
AfdGetSecurity
AfdGetTransportInfo
AfdGetUnacceptedConnectData
AfdHandleIcmpError
AfdInitializeData
AfdLRStartTimer
AfdNotifyIPAvailabilityConsumers
AfdNotifyRemoveIoCompletion
AfdNsiAddressChangeEventAtPassive
AfdNsiGetAddressProperties
AfdNsiGetBestIPv4RouteHelper
AfdNsiGetBestIPv6Route
AfdNsiRouteChangeCallback
AfdPartialDisconnect
AfdPcwProviderCallback
AfdPodInit
AfdQueryProviderInfo
AfdReadRegistry
AfdReadSingleParameter
AfdReceiveDatagramEventHandler
AfdRioFlushDgramSend
AfdRioFlushReceiveQueue
AfdRioHandleIcmpError
AfdRioValidateRequestBuffer
AfdRioValidateRequestBuffer_Old
AfdRoutingInterfaceQuery
AfdSanFastCementEndpoint
AfdSanFastCompleteAccept
AfdSanFastTransferCtx
AfdSetConnectData
AfdSetInLineMode
AfdSetInformation
AfdSetSecurity
AfdTLBufferedSendCompleteBatch
AfdTLFastDgramSend
AfdTLFastDgramSendComplete
AfdTLResumeConnectionSetup
AfdTLRioDgramReceiveEventHandler
AfdTLStartBufferedVcSend
AfdTLVcSendDgramComplete
AfdTdiCreateAO
AfdTdxCallbackRoutine
AfdTliIoControl
AfdTraceLogTdiFilter
AfdTransmitFile
AfdTransmitPackets
AfdTransmitPackets32
AfdUnbind
EtwEx_tidActivityInfo
EtwEx_tidActivityInfoTransfer
Ipv6UnicastAddressScope
KnrNrpCreateBinding
KnrNrpDnskQuery
KnrNrpGetAddressInfoW
KnrNrpGetNameInfoW
KnrNrpImpersonate
MicrosoftTelemetryAssertTriggeredWorker
Minfo_RecordRead_New
Mx_RecordRead_New
Naptr_RecordRead_New
Nsec_RecordRead_New
Ptr_RecordRead_New
Sig_RecordRead_New
Soa_RecordRead_New
Srv_RecordRead_New
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
Winsr_RecordRead_New
WskKnrCreateNameResNamedEvent
WskKnrDemandStartDns
WskProIRPResume
WskProTLEVENTConnect
WskProTLEVENTReceive
WskProTLReceiveComplete
WskProTLSendOrDisconnectComplete
WskTdiCOMPAcceptAddressQuery
WskTdiCOMPCOAListen
WskTdiCreateAO
WskTdiCreateCO
WskTdiResolveFamilyAndCreateAO
WskTdiWQRoutineEndpointCreate
__GSHandlerCheckCommon
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_PopulateInitialConfiguredFeatureStates
wil_details_RecordCachedUsage
wil_details_UpdateFeatureConfiguredStates
__GSHandlerCheckCommon|__C_specific_handler
__GSHandlerCheckCommon|
|calling|||
|paramcount|4|4|
|`address`|1400747b4|140075024|
|sig|undefined __fastcall __GSHandlerCheck_SEH(_EXCEPTION_RECORD * param_1, void * param_2, _CONTEXT * param_3, _DISPATCHER_CONTEXT * param_4)|undefined __fastcall __GSHandlerCheck_SEH(_EXCEPTION_RECORD * param_1, void * param_2, _CONTEXT * param_3, _DISPATCHER_CONTEXT * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|
## NTOSKRNL.EXE::ExFreePoolWithTag
### Match Info
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys - afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|afd-10.0.26100.7623 (WinBuild.160101.0800).sys|afd-10.0.26100.7824 (WinBuild.160101.0800).sys|
| :---: | :---: | :---: |
|name|ExFreePoolWithTag|ExFreePoolWithTag|
|fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag|
|`refcount`|231|256|
|length|0|0|
|called|||
|`calling`|Expand for full list:
AfdAccept
AfdAddressListChange
AfdAllocateBuffer
AfdAllocateEndpoint
AfdBind
AfdBuildDeviceAcl
AfdCancelAddressListChange
AfdCancelRouteChange
AfdCaptureCreatorSD
AfdCleanupAddressListChange
AfdCleanupCompartment
AfdCleanupCore
AfdCleanupRouteChange
AfdCommonDelAddressHandler
AfdCompleteTliIoControlCore
AfdConnect
AfdConnectEventHandler
AfdCreateSecurityDescriptor
AfdDeregisterPnPHandlers
AfdDnskNotifyAttachClient
AfdDnskNotifyCleanupClientContext
AfdDoDatagramConnect
AfdEnumerateProcessDiagnostics
AfdExtractAfdSendMsgInfo
AfdFastIoDeviceControl
AfdFinishSuperAccept
AfdFreeBuffer
AfdFreeBufferTag
AfdFreeConnectDataBuffers
AfdFreeConnectionResources
AfdFreeEndpointResources
AfdFreePollInfo
AfdFreeRemoteAddress
AfdFreeTpInfo
AfdFreeTransportInfo
AfdGetBufferSlow
AfdGetBufferTag
AfdGetSecurity
AfdGetTransportInfo
AfdInitTimerWheel
AfdNotifyDestroyContext
AfdNotifyRemoveIoCompletion
AfdNsiAddressChangeEvent
AfdNsiAddressChangeEventWorker
AfdPartialDisconnect
AfdPcwCleanup
AfdPcwInit
AfdPoll32
AfdProcessAddressChangeList
AfdReceive
AfdRestartConnect
AfdRestartDelayedAcceptListen
AfdRestartDgConnect
AfdRestartReceive
AfdRestartSendConnDatagram
AfdReturnBuffer
AfdReturnTpInfo
AfdRioCleanupBuffer
AfdRioCleanupBufferCache
AfdRioCleanupCq
AfdRioCleanupRioState
AfdRioCreateCompletionQueue
AfdRioCreateRegistrationDomain
AfdRioFlushDgramSend
AfdRioGrowTable
AfdRioInvalidateBuffer
AfdRioResizeCq
AfdRioResizeRqPair
AfdRouteChangeCallback
AfdRoutingInterfaceChange
AfdRoutingInterfaceQuery
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdSanProcessAddrListForProviderChange
AfdSanRestartRequestProcessing
AfdSaveReceivedConnectData
AfdSend
AfdSetConnectData
AfdSetContext
AfdSetSecurity
AfdSetupAcceptEndpoint
AfdStopTimerWheel
AfdTDISendMessage
AfdTDISendMsgComplete
AfdTLBindComplete2
AfdTLBufferedSendCompleteBatch
AfdTLConnectEventHandler
AfdTLFastDgramSend
AfdTLFastDgramSendComplete
AfdTLInspectEventHandler
AfdTLSendMsgComplete
AfdTdiCreateAO
AfdTerminateGroup
AfdTlNotifyAttachProvider
AfdTlNotifyCleanupProviderContext
AfdTlStartClientModule
AfdTlStopClientModule
AfdTliIoControl
AfdTliIoControlHandleAssociateQoS
AfdTliIoControlHandleSetQoS
AfdTransmitPackets
AfdTransmitPackets32
AfdUnBindSocket
AfdUnload
AfdWskNotifyAttachClient
AfdWskNotifyCleanupClientContext
Dns_RecordFree_New
Dns_RecordListRpcSafeFree
DriverEntry
KnrNrpFreeAddressInfoW
MIDL_user_free
MarshalRpcRecordListToDnsRecordList_New
PplDestroyLookasideList
PplpCreateLookasideListEx
Rpc_Free
Tkey_RecordRead_New
Tsig_RecordRead_New
WskKnrFreeRequest
WskKnrRpcCloseBinding
WskKnrRpcOpenBinding
WskProAPIDnskFreeQueryResults
WskProAllocateConnectExContext
WskProCleanupConnectExContext
WskTdiCloseEndpoint
WskTdiConnectFinish
WskTdiCreateAO
WskTdiEHReceive
WskTdiEHReceiveDatagram
WskTdiFreeDatagramIndicationResources
WskTdiFreeEndpoint
WskTdiPopulateReadyEndpoints
WskTdiTLRequestConnect
WskTdiTLRequestReleaseIndicationList
WskTdiWQRoutineEndpointBind
WskTdiWQRoutineEndpointCreateExpand for full list:
AfdAccept
AfdAddressListChange
AfdAllocateBuffer
AfdAllocateEndpoint
AfdBCommonChainedReceiveEventHandler
AfdBReceive
AfdBind
AfdBuildDeviceAcl
AfdCancelAddressListChange
AfdCancelRouteChange
AfdCaptureCreatorSD
AfdCleanupAddressListChange
AfdCleanupCompartment
AfdCleanupCore
AfdCleanupRouteChange
AfdCloseCore
AfdCommonDelAddressHandler
AfdCompleteBufferedSendsUnlock
AfdCompleteTliIoControlCore
AfdConnect
AfdConnectEventHandler
AfdCreateSecurityDescriptor
AfdDeregisterPnPHandlers
AfdDnskNotifyAttachClient
AfdDnskNotifyCleanupClientContext
AfdDoDatagramConnect
AfdEnumerateProcessDiagnostics
AfdExtractAfdSendMsgInfo
AfdFastConnectionReceive
AfdFastConnectionSend
AfdFastDatagramReceive
AfdFastDatagramSend
AfdFastIoDeviceControl
AfdFinishSuperAccept
AfdFreeBuffer
AfdFreeBufferTag
AfdFreeConnectDataBuffers
AfdFreeConnectionResources
AfdFreeEndpointResources
AfdFreePollInfo
AfdFreeRemoteAddress
AfdFreeTpInfo
AfdFreeTransportInfo
AfdGetBufferSlow
AfdGetBufferTag
AfdGetSecurity
AfdGetTransportInfo
AfdInitTimerWheel
AfdNotifyDestroyContext
AfdNotifyPostEvents
AfdNotifyProcessRegistration
AfdNotifyRemoveIoCompletion
AfdNsiAddressChangeEvent
AfdNsiAddressChangeEventWorker
AfdPartialDisconnect
AfdPcwCleanup
AfdPcwInit
AfdPoll32
AfdProcessAddressChangeList
AfdReceive
AfdReceiveDatagram
AfdRestartConnect
AfdRestartDelayedAcceptListen
AfdRestartDgConnect
AfdRestartReceive
AfdRestartSendConnDatagram
AfdReturnBuffer
AfdReturnTpInfo
AfdRioCleanupBuffer
AfdRioCleanupBufferCache
AfdRioCleanupCq
AfdRioCleanupRioState
AfdRioCreateCompletionQueue
AfdRioCreateRegistrationDomain
AfdRioFlushDgramSend
AfdRioGrowTable
AfdRioInvalidateBuffer
AfdRioResizeCq
AfdRioResizeRqPair
AfdRouteChangeCallback
AfdRoutingInterfaceChange
AfdRoutingInterfaceQuery
AfdSanAcquireContext
AfdSanConnectHandler
AfdSanFastTransferCtx
AfdSanProcessAddrListForProviderChange
AfdSanRestartRequestProcessing
AfdSaveReceivedConnectData
AfdSend
AfdSetConnectData
AfdSetContext
AfdSetSecurity
AfdSetupAcceptEndpoint
AfdStopTimerWheel
AfdTDISendMessage
AfdTDISendMsgComplete
AfdTLBindComplete2
AfdTLBufferedSendCompleteBatch
AfdTLConnectEventHandler
AfdTLFastDgramSend
AfdTLFastDgramSendComplete
AfdTLInspectEventHandler
AfdTLSendMsgComplete
AfdTdiCreateAO
AfdTerminateGroup
AfdTlNotifyAttachProvider
AfdTlNotifyCleanupProviderContext
AfdTlStartClientModule
AfdTlStopClientModule
AfdTliIoControl
AfdTliIoControlHandleAssociateQoS
AfdTliIoControlHandleSetQoS
AfdTransmitPackets
AfdTransmitPackets32
AfdUnBindSocket
AfdUnload
AfdWskNotifyAttachClient
AfdWskNotifyCleanupClientContext
Dns_RecordFree_New
Dns_RecordListRpcSafeFree
DriverEntry
KnrNrpFreeAddressInfoW
MIDL_user_free
MarshalRpcRecordListToDnsRecordList_New
PplDestroyLookasideList
PplpCreateLookasideListEx
Rpc_Free
Tkey_RecordRead_New
Tsig_RecordRead_New
WskKnrFreeRequest
WskKnrRpcCloseBinding
WskKnrRpcOpenBinding
WskProAPIDnskFreeQueryResults
WskProAllocateConnectExContext
WskProCleanupConnectExContext
WskTdiCloseEndpoint
WskTdiConnectFinish
WskTdiCreateAO
WskTdiEHReceive
WskTdiEHReceiveDatagram
WskTdiFreeDatagramIndicationResources
WskTdiFreeEndpoint
WskTdiPopulateReadyEndpoints
WskTdiTLRequestConnect
WskTdiTLRequestReleaseIndicationList
WskTdiWQRoutineEndpointBind
WskTdiWQRoutineEndpointCreate