# ai_8972.dll-ai_9168.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [LUATelemetry::LaunchAdminProcess](#luatelemetrylaunchadminprocesslongunsigned_long___ptr64unsigned_longunsigned_long___ptr64unsigned_short___ptr64unsigned_short___ptr64int___ptr64unsigned_long__int64___ptr64bool___ptr64char____ptr64129) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_1715195192getcachedfeatureenabledstate) * [wil::details::FeatureImpl::GetCurrentFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_1715195192getcurrentfeatureenabledstate) * [wil::details::FeatureImpl::ReportUsage](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_1715195192reportusage) * [Modified](#modified) * [RAiLaunchAdminProcess](#railaunchadminprocess) * [LUATelemetry::IsEnabled](#luatelemetryisenabled) * [Modified (No Code Changes)](#modified-no-code-changes) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_closeappexecutionaliasexvoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_) * [NTDLL.DLL::RtlNtStatusToDosErrorNoTeb](#ntdlldllrtlntstatustodoserrornoteb) * [push_back](#push_back) * [API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount](#api-ms-win-core-sysinfo-l1-1-0dllgettickcount) * [operator=](#operator) * [~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___ptr64___cdeclvoid___ptr64void___ptr64___cdecl_localfreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t_) * [WilApi_GetFeatureEnabledState](#wilapi_getfeatureenabledstate) * [ReportUsageToService](#reportusagetoservice) * [~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) * [AipJustFileName](#aipjustfilename) * [RPCRT4.DLL::RpcRevertToSelf](#rpcrt4dllrpcreverttoself) * [make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>](#make_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___ptr64___cdeclvoid___ptr64void___ptr64___cdecl_localfreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___) # Visual Chart Diff ```mermaid flowchart LR RAiLaunchAdminProcess-13-old<--Match 44%-->RAiLaunchAdminProcess-13-new LUATelemetryIsEnabled-2-old<--Match 32%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_1715195192__private_IsEnabled-2-new subgraph ai_9168.dll RAiLaunchAdminProcess-13-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_1715195192__private_IsEnabled-2-new subgraph Added direction LR LUATelemetry-LaunchAdminProcesslongunsigned_long___ptr64unsigned_longunsigned_long___ptr64unsigned_short___ptr64unsigned_short___ptr64int___ptr64unsigned_long__int64___ptr64bool___ptr64char____ptr64129 wil-details-FeatureImplstruct___WilFeatureTraits_Feature_1715195192-GetCachedFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_1715195192-GetCurrentFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_1715195192-ReportUsage end end subgraph ai_8972.dll RAiLaunchAdminProcess-13-old LUATelemetryIsEnabled-2-old end ``` ```mermaid pie showData title Function Matches - 99.8760% "unmatched_funcs_len" : 4 "matched_funcs_len" : 3223 ``` ```mermaid pie showData title Matched Function Similarity - 99.5036% "matched_funcs_with_code_changes_len" : 2 "matched_funcs_with_non_code_changes_len" : 14 "matched_funcs_no_changes_len" : 3207 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 ai_8972.dll ai_9168.dll ``` #### Verbose Args
``` --old ['ai_8972.dll'] --new [['ai_9168.dll']] --engine VersionTrackingDiff --output-path ai_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/appinfo.dll/4EECDCA96D000/appinfo.dll -O appinfo.dll.x64.10.0.26100.8972 wget https://msdl.microsoft.com/download/symbols/appinfo.dll/ACE53DCA6D000/appinfo.dll -O appinfo.dll.x64.10.0.26100.9168 ``` ## Binary Metadata Diff ```diff --- ai_8972.dll Meta +++ ai_9168.dll Meta @@ -1,44 +1,44 @@ -Program Name: ai_8972.dll +Program Name: ai_9168.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 449216 +# of Bytes: 449248 # of Memory Blocks: 10 -# of Instructions: 70859 -# of Defined Data: 6009 -# of Functions: 1611 -# of Symbols: 17612 -# of Data Types: 1067 +# of Instructions: 71208 +# of Defined Data: 6016 +# of Functions: 1616 +# of Symbols: 17678 +# of Data Types: 1068 # of Data Type Categories: 214 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Fri Aug 21 19:35:51 SGT 2026 +Date Created: Fri Aug 21 19:35:55 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/ai/ai_8972.dll -Executable MD5: c9597327e877ed05834d56dfb2c47d56 -Executable SHA256: ef6a0081feb04b1daa751907d085895c733a5a095fea8c593afbb6db6ba5065e -FSRL: file:///tmp/ai/ai_8972.dll?MD5=c9597327e877ed05834d56dfb2c47d56 +Executable Location: /tmp/ai/ai_9168.dll +Executable MD5: 00ab8f8f74c7097b858a4c413df72fc5 +Executable SHA256: 2f1a7547b89019bf9bbbf2685ee598945c1ed9e280106739545755efcd5b4d94 +FSRL: file:///tmp/ai/ai_9168.dll?MD5=00ab8f8f74c7097b858a4c413df72fc5 PDB Age: 1 PDB File: appinfo.pdb -PDB GUID: f5ea4db8-c1d2-81bf-ac88-1a8b22b166e8 +PDB GUID: 98d7dcfb-e9b5-bf96-ab9b-4b566388b5d5 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Application Information Service -PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800) PE Property[InternalName]: appinfo.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: appinfo.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8972 +PE Property[ProductVersion]: 10.0.26100.9168 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra ai_8972.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ai_8972.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ai_8972.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra ai_9168.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ai_9168.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ai_9168.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|16| |added_symbols_len|4| |deleted_symbols_len|1| |diff_time|7.109012126922607| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1589, 'ExternalsName': 346, 'StructuralGraphHash': 6, 'ExactBytesFunctionHasher': 5, 'ExactInstructionsFunctionHasher': 4, 'BulkInstructionHash': 4, 'BulkBasicBlockMnemonicHash': 4, 'Implied Match': 1})| |items_to_process|25| |diff_types|Counter({'refcount': 15, 'calling': 11, 'address': 4, 'code': 2, 'length': 2, 'sig': 2, 'called': 2, 'name': 1, 'fullname': 1, 'parent': 1})| |unmatched_funcs_len|4| |total_funcs_len|3227| |matched_funcs_len|3223| |matched_funcs_with_code_changes_len|2| |matched_funcs_with_non_code_changes_len|14| |matched_funcs_no_changes_len|3207| |match_func_similarity_percent|99.5036%| |func_match_overall_percent|99.8760%| |first_matches|Counter({'SymbolsHash': 1589, 'StructuralGraphHash': 6, 'ExactBytesFunctionHasher': 5, 'ExactInstructionsFunctionHasher': 4, 'BulkInstructionHash': 4, 'BulkBasicBlockMnemonicHash': 4, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1589 "ExternalsName" : 346 "ExactBytesFunctionHasher" : 5 "ExactInstructionsFunctionHasher" : 4 "BulkInstructionHash" : 4 "StructuralGraphHash" : 6 "BulkBasicBlockMnemonicHash" : 4 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1589 "ExactBytesFunctionHasher" : 5 "ExactInstructionsFunctionHasher" : 4 "BulkInstructionHash" : 4 "StructuralGraphHash" : 6 "BulkBasicBlockMnemonicHash" : 4 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 16 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 4 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## LUATelemetry::LaunchAdminProcess ### Function Meta |Key|ai_9168.dll| | :---: | :---: | |name|LaunchAdminProcess| |fullname|LUATelemetry::LaunchAdminProcess| |refcount|3| |length|199| |called|LUATelemetry::Instance
LUATelemetry::IsEnabled
LUATelemetry::LaunchAdminProcess_| |calling|RAiLaunchAdminProcess| |paramcount|11| |address|180026280| |sig|void __cdecl LaunchAdminProcess(long * param_1, ulong * param_2, ulong * param_3, ulong * param_4, ushort * * param_5, ushort * * param_6, int * param_7, ulong * param_8, __int64 * param_9, bool * param_10, char * param_11)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- LUATelemetry::LaunchAdminProcess +++ LUATelemetry::LaunchAdminProcess @@ -0,0 +1,27 @@ + +/* public: static void __cdecl LUATelemetry::LaunchAdminProcess(long + && __ptr64,unsigned long & __ptr64,unsigned long && __ptr64,unsigned long & __ptr64,unsigned + short * __ptr64 && __ptr64,unsigned short * __ptr64 && __ptr64,int & __ptr64,unsigned long && + __ptr64,__int64 & __ptr64,bool & __ptr64,char (& __ptr64)[129]) */ + +void __cdecl +LUATelemetry:: +LaunchAdminProcess + (long *param_1,ulong *param_2,ulong *param_3,ulong *param_4,ushort **param_5, + ushort **param_6,int *param_7,ulong *param_8,__int64 *param_9,bool *param_10, + char *param_11) + +{ + bool bVar1; + + bVar1 = IsEnabled((uchar)param_1,(__uint64)param_2); + if (bVar1) { + Instance(); + LaunchAdminProcess_((LUATelemetry *)*param_5,*param_1,*param_2,*param_3,*param_4,*param_5, + *param_6,*param_7,*param_8,*param_9,*param_10,param_11); + } + return; +} + ``` ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|ai_9168.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|302| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|18002ff80| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,81 @@ + +/* WARNING: Removing unreachable block (ram,0x00018002ffdb) */ +/* WARNING: Removing unreachable block (ram,0x00018002ffe0) */ +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint *in_RDX; + bool bVar5; + uint local_res18 [2]; + undefined *local_res20; + undefined4 local_38; + undefined4 local_34; + undefined4 *local_30; + + in_RDX[0] = 0; + uVar3 = Feature_1715195192__private_cppFeatureState; + in_RDX[1] = 0; + *in_RDX = Feature_1715195192__private_cppFeatureState; + if (((byte)uVar3 & 6) == 6) { + return; + } + uVar2 = EnsureSubscribedToFeatureConfigurationChanges(); + GetCurrentFeatureEnabledState(this,(int *)local_res18); + uVar3 = *in_RDX; + do { + uVar1 = uVar3; + uVar4 = uVar1 | 0x40000; + *in_RDX = uVar4; + if ((uVar1 & 4) == 0) { + uVar4 = uVar1 & 0xfffffbff | 0x40000 | local_res18[0] & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + bVar5 = uVar1 != Feature_1715195192__private_cppFeatureState; + uVar3 = uVar1; + if (bVar5) { + uVar3 = Feature_1715195192__private_cppFeatureState; + uVar4 = Feature_1715195192__private_cppFeatureState; + } + Feature_1715195192__private_cppFeatureState = uVar4; + UNLOCK(); + } while (bVar5); + if (((uVar1 & 4) != 0) || (_g_enabledStateManager == 0)) goto LAB_180030087; + AcquireSRWLockExclusive((PSRWLOCK)&DAT_180062380); + local_res20 = &DAT_180062380; + if ((uVar2 == 0) || (uVar2 != DAT_180062394)) { +LAB_18003007a: + LOCK(); + Feature_1715195192__private_cppFeatureState = + Feature_1715195192__private_cppFeatureState & 0xfffffffb; + UNLOCK(); + } + else { + local_34 = 0; + local_38 = 3; + local_30 = &Feature_1715195192__private_cppFeatureState; + bVar5 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_1800623b8,&local_38,0x10); + if (!bVar5) goto LAB_18003007a; + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res20); +LAB_180030087: + if ((*in_RDX & 2) == 0) { + *in_RDX = *in_RDX & 0xfffff63e | local_res18[0] & 0x9c1; + } + return; +} + ``` ## wil::details::FeatureImpl::GetCurrentFeatureEnabledState ### Function Meta |Key|ai_9168.dll| | :---: | :---: | |name|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |refcount|2| |length|179| |called|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |paramcount|2| |address|180033014| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState @@ -0,0 +1,45 @@ + +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ + +int * __thiscall +wil::details::FeatureImpl:: +GetCurrentFeatureEnabledState + (FeatureImpl *this,int *param_1) + +{ + bool bVar1; + FEATURE_ENABLED_STATE FVar2; + uint uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + int *in_R8; + + FVar2 = WilApi_GetFeatureEnabledState(0x3afd047,3,in_R8); + param_1[0] = 0; + param_1[1] = 0; + uVar5 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400; + uVar6 = uVar5 | (FVar2 & 3) << 7; + *param_1 = uVar6; + if ((FVar2 & 0xffffff3f) == 0) { + uVar3 = 0x40; + } + else { + uVar3 = 0; + if ((FVar2 & 0xffffff3f) == 2) { + uVar3 = 0x40; + } + } + bVar1 = false; + uVar4 = 1; + if ((uVar5 == 0xc00) || (uVar3 != 0)) { + bVar1 = true; + } + if ((uVar3 == 0) || (!bVar1)) { + uVar4 = 0; + } + *param_1 = uVar6 | uVar3 | uVar4; + return param_1; +} + ``` ## wil::details::FeatureImpl::ReportUsage ### Function Meta |Key|ai_9168.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl::ReportUsage| |refcount|2| |length|134| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|4| |address|180038f34| |sig|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::ReportUsage +++ wil::details::FeatureImpl::ReportUsage @@ -0,0 +1,31 @@ + +/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned + __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl::ReportUsage + (FeatureImpl *this,bool param_1, + ReportingKind param_2,__uint64 param_3) + +{ + ulonglong *puVar1; + ulonglong uVar2; + undefined4 local_res8; + undefined2 local_resc; + __uint64 in_stack_ffffffffffffffe0; + + uVar2 = (ulonglong)Feature_1715195192__private_cppFeatureState; + if ((Feature_1715195192__private_cppFeatureState & 4) == 0) { + puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); + uVar2 = *puVar1; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x3afd047,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1,3, + in_stack_ffffffffffffffe0); + return; +} + ``` # Modified *Modified functions contain code changes* ## RAiLaunchAdminProcess ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.12| |i_ratio|0.33| |m_ratio|0.96| |b_ratio|0.44| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|RAiLaunchAdminProcess|RAiLaunchAdminProcess| |fullname|RAiLaunchAdminProcess|RAiLaunchAdminProcess| |refcount|3|3| |`length`|4514|4999| |`called`|
Expand for full list:
API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL::PackageFamilyNameFromFullName
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::GetApplicationUserModelIdFromToken
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::GetPackageFullNameFromToken
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::ParseApplicationUserModelId
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::CreateFileW
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0.DLL::CheckElevation
API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0.DLL::CheckElevationEnabled
API-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceCounterAPI-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceFrequency
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::ImpersonateLoggedOnUser
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::RevertToSelf
AiBuildEXEParams
AiBuildPackagedAppParams
AiCheckForAdminUser
AiCheckForElevatedUser
AiCheckLUA
AiCheckSecureApplicationDirectory
AiCheckSecureApplicationDirectoryEx
AiConvertWow64Paths
AiGetClientInformation
AiIsEXESafeToAutoApprove
AiIsElevationAllowedForSession
AiLaunchProcess
AiLogPerfTrackEventEx
AipApplyAdminProcessPackageClaimsPolicy
AipCheckAssistiveTechnologyList
AipJustFileName
AipLaunchProcessWithIdentityHelper
AipLoadUserProfile
EXT-MS-WIN-APPMODEL-ACTIVATION-L1-1-1.DLL::RegisterAppXPackageIfNecessary2
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::FreeAppExecutionAliasInfoEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::GetAppExecutionAliasApplicationUserModelIdEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::LoadAppExecutionAliasInfoEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::OpenAppExecutionAliasForUserEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-2.DLL::GetAppExecutionAliasPath
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-5.DLL::LoadAppExecutionAliasInfoEx2
EXT-MS-WIN-DESKTOPAPPX-L1-1-6.DLL::VerifyFileIsTrustedAndInPackage
IsLoadAppExecutionAliasInfoEx2Present
IsLoadAppExecutionAliasInfoExPresent
LUAGetUACPromptPolicy
LUAIsShadowAdminEnabled
LUATelemetry::Instance
LUATelemetry::IsEnabled
LUATelemetry::LaunchAdminProcess_
LUATelemetry::WatchCurrentThread
NTDLL.DLL::NtClose
NTDLL.DLL::RtlNtStatusToDosErrorNoTeb
RPCRT4.DLL::RpcAsyncCompleteCall
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
RateLimiter::RequestPermission
StringCbCatW
StringCbCopyW
TraceLoggingCorrelationVector::ToStringImpl
TraceLoggingCorrelationVector::TraceLoggingCorrelationVector
USERENV.DLL::UnloadUserProfile
WIN32_FROM_HRESULT
WPP_SF_D
WPP_SF_DDDDSSSSs
__security_check_cookie
memset
operator_delete
operator_new
wil::ActivityThreadWatcher::~ActivityThreadWatcher
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_>::~out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=
|
Expand for full list:
API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL::PackageFamilyNameFromFullName
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::GetApplicationUserModelIdFromToken
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::GetPackageFullNameFromToken
API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL::ParseApplicationUserModelId
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::CreateFileW
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0.DLL::CheckElevation
API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0.DLL::CheckElevationEnabled
API-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceCounterAPI-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceFrequency
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::ImpersonateLoggedOnUser
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::RevertToSelf
AiBuildEXEParams
AiBuildPackagedAppParams
AiCheckForAdminUser
AiCheckForElevatedUser
AiCheckLUA
AiCheckSecureApplicationDirectory
AiCheckSecureApplicationDirectoryEx
AiConvertWow64Paths
AiGetClientInformation
AiIsEXESafeToAutoApprove
AiIsElevationAllowedForSession
AiLaunchProcess
AiLogPerfTrackEventEx
AipApplyAdminProcessPackageClaimsPolicy
AipCheckAssistiveTechnologyList
AipJustFileName
AipLaunchProcessWithIdentityHelper
AipLoadUserProfile
EXT-MS-WIN-APPMODEL-ACTIVATION-L1-1-1.DLL::RegisterAppXPackageIfNecessary2
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::FreeAppExecutionAliasInfoEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::GetAppExecutionAliasApplicationUserModelIdEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::LoadAppExecutionAliasInfoEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::OpenAppExecutionAliasForUserEx
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-2.DLL::GetAppExecutionAliasPath
EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-5.DLL::LoadAppExecutionAliasInfoEx2
EXT-MS-WIN-DESKTOPAPPX-L1-1-6.DLL::VerifyFileIsTrustedAndInPackage
IsLoadAppExecutionAliasInfoEx2Present
IsLoadAppExecutionAliasInfoExPresent
LUAGetUACPromptPolicy
LUAIsShadowAdminEnabled
LUATelemetry::LaunchAdminProcess
LUATelemetry::WatchCurrentThread
NTDLL.DLL::NtClose
NTDLL.DLL::RtlNtStatusToDosErrorNoTeb
RPCRT4.DLL::RpcAsyncCompleteCall
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
RateLimiter::RequestPermission
StringCbCatW
StringCbCopyW
TraceLoggingCorrelationVector::ToStringImpl
TraceLoggingCorrelationVector::TraceLoggingCorrelationVector
USERENV.DLL::UnloadUserProfile
WIN32_FROM_HRESULT
WPP_SF_D
WPP_SF_DDDDSSSSs
__security_check_cookie
memset
operator_delete
operator_new
wil::ActivityThreadWatcher::~ActivityThreadWatcher
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_>::~out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=
| |calling||| |paramcount|13|13| |`address`|18003e980|18003ed40| |`sig`|undefined __fastcall RAiLaunchAdminProcess(_RPC_ASYNC_STATE * param_1, void * param_2, _STARTUPINFO_STDHANDLES * param_3, _STARTUPINFO_STDHANDLES * param_4, uint param_5, uint param_6, wchar_t * param_7, ushort * param_8, _APPINFO_STARTUPINFO * param_9, HWND__ * param_10, ulong param_11, _PROCESS_INFORMATION * param_12, ELEVATION_REASON * param_13)|undefined __fastcall RAiLaunchAdminProcess(PRPC_ASYNC_STATE param_1, void * param_2, _STARTUPINFO_STDHANDLES * param_3, _STARTUPINFO_STDHANDLES * param_4, uint param_5, uint param_6, wchar_t * param_7, ushort * param_8, _APPINFO_STARTUPINFO * param_9, HWND__ * param_10, ulong param_11, _PROCESS_INFORMATION * param_12, ELEVATION_REASON * param_13)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RAiLaunchAdminProcess Called Diff ```diff --- RAiLaunchAdminProcess called +++ RAiLaunchAdminProcess called @@ -45,3 +45 @@ -LUATelemetry::Instance -LUATelemetry::IsEnabled -LUATelemetry::LaunchAdminProcess_ +LUATelemetry::LaunchAdminProcess @@ -67,0 +66 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### RAiLaunchAdminProcess Diff ```diff --- RAiLaunchAdminProcess +++ RAiLaunchAdminProcess @@ -1,787 +1,951 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void RAiLaunchAdminProcess - (_RPC_ASYNC_STATE *param_1,void *param_2,_STARTUPINFO_STDHANDLES *param_3, + (PRPC_ASYNC_STATE param_1,void *param_2,_STARTUPINFO_STDHANDLES *param_3, _STARTUPINFO_STDHANDLES *param_4,uint param_5,uint param_6,wchar_t *param_7, ushort *param_8,_APPINFO_STARTUPINFO *param_9,HWND__ *param_10,ulong param_11, _PROCESS_INFORMATION *param_12,ELEVATION_REASON *param_13) { ulong uVar1; - ELEVATION_REASON EVar2; + uint uVar2; ulong uVar3; - UACPROMPT_POLICY UVar4; - bool bVar5; - wchar_t wVar6; - int iVar7; + bool bVar4; + wchar_t wVar5; + int iVar6; + DWORD DVar7; ulong uVar8; - DWORD DVar9; + long lVar9; undefined4 uVar10; - long lVar11; + ulong uVar11; TraceLoggingCorrelationVector *pTVar12; - TraceLoggingCorrelationVector *pTVar13; - longlong lVar14; + TraceLoggingCorrelationVector *this; + HANDLE hObject; + longlong lVar13; + _STARTUPINFO_STDHANDLES *p_Var14; longlong lVar15; _STARTUPINFO_STDHANDLES *p_Var16; - _STARTUPINFO_STDHANDLES *p_Var17; - LARGE_INTEGER *lpPerformanceCount; - wchar_t *pwVar18; - void *pvVar19; - uint uVar20; - ulonglong uVar21; - _STARTUPINFO_STDHANDLES *p_Var22; - HANDLE pvVar23; - ushort *puVar24; - uint uVar25; - TraceLoggingCorrelationVector *pTVar26; - __uint64 _Var27; - undefined1 auStackY_728 [32]; - AicAgenticFlags in_stack_fffffffffffff950; - ushort *puVar28; - ulong local_658; - bool local_654; - ulong local_650 [2]; - longlong local_648; - ELEVATION_REASON local_640; - uint local_63c; - uint local_638; - uint local_634; - ulong local_630 [2]; - ulong local_628; - SETTINGFLAG local_624; - void *local_620; - _STARTUPINFO_STDHANDLES *local_618; - ulong local_610 [2]; - HWND__ *local_608; - HANDLE local_600; - undefined8 *local_5f8; - uint local_5f0; - ulong local_5ec; - UACPROMPT_POLICY local_5e8; - int local_5e4; - wchar_t *local_5e0; - ushort *local_5d8; - undefined4 local_5d0; - undefined4 uStack_5cc; - int local_5c8; - int local_5c4; + wchar_t *pwVar17; + void *pvVar18; + wchar_t *pwVar19; + ulonglong uVar20; + _STARTUPINFO_STDHANDLES *p_Var21; + ushort *puVar22; + void *pvVar23; + PRPC_ASYNC_STATE pAsync; + __uint64 _Var24; + undefined1 auStackY_748 [32]; + AicAgenticFlags in_stack_fffffffffffff930; + ushort *puVar25; + ulong local_678; + ulong local_674; + bool local_670 [8]; + wchar_t *local_668; + HANDLE local_660; + PRPC_ASYNC_STATE local_658; + _STARTUPINFO_STDHANDLES *local_650; + ulong local_648; + ELEVATION_REASON local_644; + uint local_640 [2]; + longlong local_638; + uint local_630; + uint local_62c; + ELEVATION_REASON local_628 [2]; + ulong local_620 [2]; + ulong local_618; + void *local_610; + _STARTUPINFO_STDHANDLES *local_608; + UACPROMPT_POLICY local_600 [2]; + SETTINGFLAG local_5f8; + ulong local_5f4; + ushort *local_5f0; + wchar_t *local_5e8; + undefined8 *local_5e0; + uint local_5d8 [2]; + void *local_5d0; + wchar_t *local_5c8; + int local_5c0 [2]; unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - local_5c0 [8]; - _STARTUPINFO_STDHANDLES *local_5b8; - ulonglong local_5b0; - void *local_5a8; - ushort *local_5a0; - _PROCESS_INFORMATION *local_598; - _APPINFO_STARTUPINFO *local_590; - _CONSENTUI_PARAM_HEADER *local_588; - ushort *local_580; - undefined4 local_578 [2]; + local_5b8 [8]; + int local_5b0 [2]; + _STARTUPINFO_STDHANDLES *local_5a8; + ulonglong local_5a0; + void *local_598; + void *local_590; + _PROCESS_INFORMATION *local_588; + _APPINFO_STARTUPINFO *local_580; + _CONSENTUI_PARAM_HEADER *local_578; wchar_t *local_570; - _STARTUPINFO_STDHANDLES *local_568; - _STARTUPINFO_STDHANDLES *local_560; + ushort *local_568; + ushort *local_560; wchar_t *local_558; - ushort *local_550; - void *local_548; - undefined4 local_540 [2]; - void *local_538; - LARGE_INTEGER local_530; - LARGE_INTEGER local_528; + wchar_t *local_550; + ushort *local_548; + undefined4 local_540; + undefined4 local_53c; + HWND__ *local_538; + _STARTUPINFO_STDHANDLES *local_530; + unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + local_528 [8]; LARGE_INTEGER local_520; - ELEVATION_REASON *local_518; - _RPC_ASYNC_STATE *local_510; - _STARTUPINFO_STDHANDLES **local_508; - undefined8 local_500; - undefined1 local_4f8; + LARGE_INTEGER local_518; + LARGE_INTEGER local_510; + ELEVATION_REASON *local_508; + _STARTUPINFO_STDHANDLES **local_500; + undefined8 local_4f8; + undefined1 local_4f0; ActivityThreadWatcher local_4e8 [80]; char local_498 [144]; ushort local_408 [72]; ushort local_378 [136]; ushort local_268 [136]; undefined1 local_158 [256]; ulonglong local_58; - local_58 = __security_cookie ^ (ulonglong)auStackY_728; - local_600 = (HANDLE)0xffffffffffffffff; - local_63c = param_5; - local_634 = param_6; - local_590 = param_9; - local_608 = param_10; - local_628 = param_11; - pTVar26 = (TraceLoggingCorrelationVector *)0x0; - local_598 = param_12; - local_638 = 0; - local_610[0] = 0; - local_650[0] = 0; - local_5f0 = 0; + local_58 = __security_cookie ^ (ulonglong)auStackY_748; + local_660 = (HANDLE)0xffffffffffffffff; + local_640[0] = param_5; + local_62c = param_6; + local_580 = param_9; + local_538 = param_10; + local_618 = param_11; + this = (TraceLoggingCorrelationVector *)0x0; + local_588 = param_12; + local_630 = 0; + local_5f4 = 0; + local_674 = 0; + local_5d8[0] = 0; + local_558 = (wchar_t *)0x0; + local_548 = (ushort *)0x0; + local_610 = (void *)0x0; + local_598 = (void *)0x0; + local_5d0 = (void *)0x0; + local_5e8 = (wchar_t *)0x0; + local_5a0 = 0; + local_578 = (_CONSENTUI_PARAM_HEADER *)0x0; + local_648 = 0; + local_620[0] = 0; + local_670[0] = false; + local_5e0 = (undefined8 *)0x0; + local_600[1] = 0; + local_600[0] = 0; + local_5f8 = 0; + local_510.QuadPart = 0; + local_518.QuadPart = 0; + local_520.QuadPart = 0; + local_5c8 = (wchar_t *)0x0; + local_568 = (ushort *)0x0; local_570 = (wchar_t *)0x0; - local_550 = (ushort *)0x0; - local_620 = (void *)0x0; - local_5a8 = (void *)0x0; - local_548 = (void *)0x0; - local_5b0 = 0; - local_588 = (_CONSENTUI_PARAM_HEADER *)0x0; - local_5ec = 0; - local_630[0] = 0; - local_654 = false; - local_5f8 = (undefined8 *)0x0; - local_5e4 = 0; - local_5e8 = 0; - local_624 = 0; - local_520.QuadPart = 0; - local_528.QuadPart = 0; - local_530.QuadPart = 0; - local_5d8 = (ushort *)0x0; - local_580 = (ushort *)0x0; - local_518 = param_13; - local_5a0 = param_8; - local_558 = param_7; - local_5e0 = param_7; - local_5c8 = 1; - local_640 = 6; - local_618 = param_4; - local_5b8 = param_3; - local_568 = param_3; - local_560 = param_4; - local_538 = param_2; - local_510 = param_1; - QueryPerformanceCounter(&local_528); - QueryPerformanceFrequency(&local_520); + local_508 = param_13; + local_560 = param_8; + local_550 = param_7; + local_668 = param_7; + local_5b0[0] = 1; + local_644 = 6; + local_658 = param_1; + local_650 = param_4; + local_608 = param_4; + local_5a8 = param_3; + local_590 = param_2; + local_530 = param_3; + QueryPerformanceCounter(&local_518); + QueryPerformanceFrequency(&local_510); memset(local_498,0,0x81); - p_Var17 = param_4; + pwVar19 = L"NULL"; + p_Var16 = param_4; if (param_4 == (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = (_STARTUPINFO_STDHANDLES *)L"NULL"; + p_Var16 = (_STARTUPINFO_STDHANDLES *)L"NULL"; } if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { AipJustFileName((ushort *)param_3); } + uVar10 = SUB84(local_538,0); LUATelemetry::WatchCurrentThread ((char *)local_4e8,"RAiLaunchAdminProcess", "++. hwnd = %x dwClientFlags = %x dwCreationFlags = %x dwTimeout = %x\n\tlpDesktop = %ws\n\tlpApplicationName = %ws\n\tlpCommandLine = %ws\n\tlpCurrentDirectory = %ws\n\tlpCvStr = %s\n" - ,(ulonglong)local_608 & 0xffffffff); - pTVar13 = pTVar26; + ,(ulonglong)local_538 & 0xffffffff); + pTVar12 = this; if ((_g_pLaunchAdminProcessActivityTelemetryRateLimiter != (RateLimiter *)0x0) && - (iVar7 = RateLimiter::RequestPermission(_g_pLaunchAdminProcessActivityTelemetryRateLimiter), - pTVar13 = (TraceLoggingCorrelationVector *)0x0, iVar7 != 0)) { + (iVar6 = RateLimiter::RequestPermission(_g_pLaunchAdminProcessActivityTelemetryRateLimiter), + pTVar12 = (TraceLoggingCorrelationVector *)0x0, iVar6 != 0)) { pTVar12 = operator_new(0x90); - pTVar13 = pTVar26; if (pTVar12 != (TraceLoggingCorrelationVector *)0x0) { - pTVar13 = (TraceLoggingCorrelationVector *) - TraceLoggingCorrelationVector::TraceLoggingCorrelationVector(pTVar12); + this = (TraceLoggingCorrelationVector *) + TraceLoggingCorrelationVector::TraceLoggingCorrelationVector(pTVar12); } LOCK(); - pTVar12 = pTVar13 + 0x88; - _Var27 = *(__uint64 *)pTVar12; + pTVar12 = this + 0x88; + _Var24 = *(__uint64 *)pTVar12; *(__uint64 *)pTVar12 = *(__uint64 *)pTVar12; UNLOCK(); - TraceLoggingCorrelationVector::ToStringImpl(pTVar13,_Var27,local_498); - if (pTVar13 != (TraceLoggingCorrelationVector *)0x0) { - operator_delete(pTVar13); - } - pTVar13 = (TraceLoggingCorrelationVector *)(ulonglong)local_650[0]; - param_4 = local_618; - param_3 = local_5b8; - } - uVar25 = (uint)pTVar13; + TraceLoggingCorrelationVector::ToStringImpl(this,_Var24,local_498); + if (this != (TraceLoggingCorrelationVector *)0x0) { + operator_delete(this); + } + pTVar12 = (TraceLoggingCorrelationVector *)(ulonglong)local_674; + param_3 = local_5a8; + param_4 = local_608; + } + uVar2 = local_640[0]; + uVar11 = (ulong)pTVar12; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pwVar18 = L"NULL"; - if (local_5e0 != (wchar_t *)0x0) { - pwVar18 = local_5e0; - } - p_Var17 = (_STARTUPINFO_STDHANDLES *)L"NULL"; + pwVar17 = L"NULL"; + if (local_668 != (wchar_t *)0x0) { + pwVar17 = local_668; + } + p_Var16 = (_STARTUPINFO_STDHANDLES *)L"NULL"; if (param_4 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_4; - } - WPP_SF_DDDDSSSSs(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pwVar18,WPP_GLOBAL_Control, - local_608._0_4_); - } - uVar21 = 0xffffffffffffffff; - p_Var22 = param_3; + p_Var16 = param_4; + } + WPP_SF_DDDDSSSSs(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pwVar17,WPP_GLOBAL_Control,uVar10); + } + p_Var21 = param_3; if (param_3 == (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var22 = param_4; + p_Var21 = param_4; } wil:: make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> - ((ushort *)&local_648,(__uint64)p_Var22); + ((ushort *)local_628,(__uint64)p_Var21); wil:: unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)&local_5d8, + *)&local_5c8, (unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)&local_648); + *)local_628); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_648); - if (param_3 == (_STARTUPINFO_STDHANDLES *)0x0) { + *)local_628); + if ((param_3 != (_STARTUPINFO_STDHANDLES *)0x0) || (param_4 != (_STARTUPINFO_STDHANDLES *)0x0)) { + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar4) { + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + pwVar19 = (wchar_t *)AipJustFileName((ushort *)param_3); + } + wil:: + make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> + ((ushort *)local_528,(__uint64)pwVar19); + wil:: + unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + *)&local_570,local_528); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)local_528); + pwVar19 = local_570; + pwVar17 = local_558; + } + else { + pwVar17 = pwVar19; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + pwVar19 = (wchar_t *)AipJustFileName((ushort *)param_3); + pwVar17 = pwVar19; + } + } + local_558 = pwVar17; + local_628[0] = AiLogPerfTrackEventEx + ((_EVENT_DESCRIPTOR *)&AppInfo_PerfTrack_Elevation_EXE_Start, + (ushort *)pwVar19); + pwVar19 = local_5e8; + pwVar17 = (wchar_t *)0xffffffffffffffff; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + do { + pwVar19 = (wchar_t *)((longlong)pwVar17 + 1); + pwVar17 = pwVar19; + } while (*(short *)(param_3 + (longlong)pwVar19 * 2) != 0); + } if (param_4 != (_STARTUPINFO_STDHANDLES *)0x0) { - local_570 = L"NULL"; - goto LAB_0; - } - } - else { - local_570 = (wchar_t *)AipJustFileName((ushort *)param_3); -LAB_0: - uVar8 = AiLogPerfTrackEventEx - ((_EVENT_DESCRIPTOR *)&AppInfo_PerfTrack_Elevation_EXE_Start, - (ushort *)local_570); - local_648 = CONCAT44(local_648._4_4_,uVar8); - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - pTVar26 = (TraceLoggingCorrelationVector *)0xffffffffffffffff; + local_5a0 = 0xffffffffffffffff; do { - pTVar26 = pTVar26 + 1; - } while (*(short *)(param_3 + (longlong)pTVar26 * 2) != 0); - } - if (param_4 != (_STARTUPINFO_STDHANDLES *)0x0) { - do { - uVar21 = uVar21 + 1; - local_5b0 = uVar21; - } while (*(short *)(param_4 + uVar21 * 2) != 0); - } - uVar21 = local_5b0; - if ((pTVar26 < (TraceLoggingCorrelationVector *)0x8000) && (local_5b0 < 0x8000)) { - local_658 = CheckElevationEnabled(&local_5c8); - uVar8 = local_658; - if ((local_658 != 0) || - (local_658 = AiGetClientInformation(local_538,&local_5a8,&local_548,local_610,&local_5ec), - uVar8 = local_658, local_658 != 0)) goto LAB_1; - DVar9 = LUAGetUACPromptPolicy(&local_624,&local_5e8); - pvVar19 = local_548; - if (-1 < (int)DVar9) { - local_624 = 0; - DVar9 = AiCheckForElevatedUser(local_548,(int *)&local_624); - if ((-1 < (int)DVar9) && - (DVar9 = AiCheckForAdminUser(pvVar19,local_624,&local_5e4), -1 < (int)DVar9)) { - if ((local_63c & 8) != 0) { - local_658 = AiConvertWow64Paths((ushort *)local_568,(ushort **)&local_5b8, - (ushort *)local_560,(ushort **)&local_618, - (ushort *)local_558,(ushort **)&local_5e0); - param_3 = local_5b8; - param_4 = local_618; - uVar8 = local_658; - if (local_658 != 0) goto LAB_1; - if (local_5b8 != (_STARTUPINFO_STDHANDLES *)0x0) { - pTVar26 = (TraceLoggingCorrelationVector *)0xffffffffffffffff; - do { - pTVar26 = pTVar26 + 1; - } while (*(short *)(local_5b8 + (longlong)pTVar26 * 2) != 0); - } - if (local_618 != (_STARTUPINFO_STDHANDLES *)0x0) { - uVar21 = 0xffffffffffffffff; - do { - uVar21 = uVar21 + 1; - local_5b0 = uVar21; - } while (*(short *)(local_618 + uVar21 * 2) != 0); - } - if (((TraceLoggingCorrelationVector *)0x7fff < pTVar26) || (0x7fff < uVar21)) - goto LAB_2; - p_Var22 = local_618; - if (local_5b8 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var22 = local_5b8; + local_5a0 = local_5a0 + 1; + } while (*(short *)(param_4 + local_5a0 * 2) != 0); + } + uVar20 = local_5a0; + if ((pwVar19 < (wchar_t *)0x8000) && (local_5a0 < 0x8000)) { + local_678 = CheckElevationEnabled(local_5b0); + hObject = local_660; + pwVar17 = local_668; + pvVar23 = local_5d0; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if ((local_678 != 0) || + (local_678 = AiGetClientInformation(local_590,&local_598,&local_5d0,&local_5f4,&local_648), + hObject = local_660, pwVar17 = local_668, pvVar23 = local_5d0, pAsync = local_658, + p_Var21 = local_650, uVar8 = local_678, local_678 != 0)) goto LAB_0; + DVar7 = LUAGetUACPromptPolicy(&local_5f8,local_600); + pvVar23 = local_5d0; + if ((int)DVar7 < 0) { + uVar8 = RtlNtStatusToDosErrorNoTeb(DVar7); + hObject = local_660; + pwVar17 = local_668; + pvVar23 = local_5d0; + pAsync = local_658; + p_Var21 = local_650; + goto LAB_0; + } + local_5f8 = 0; + lVar9 = AiCheckForElevatedUser(local_5d0,(int *)&local_5f8); + if ((lVar9 < 0) || + (lVar9 = AiCheckForAdminUser(pvVar23,local_5f8,(int *)(local_600 + 1)), p_Var21 = local_650 + , lVar9 < 0)) { + uVar8 = RtlNtStatusToDosErrorNoTeb(lVar9); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + goto LAB_0; + } + if ((uVar2 & 8) != 0) { + local_678 = AiConvertWow64Paths((ushort *)local_530,(ushort **)&local_5a8, + (ushort *)local_650,(ushort **)&local_608, + (ushort *)local_550,(ushort **)&local_668); + param_3 = local_5a8; + param_4 = local_608; + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + uVar8 = local_678; + if (local_678 != 0) goto LAB_0; + if (local_5a8 != (_STARTUPINFO_STDHANDLES *)0x0) { + pwVar19 = (wchar_t *)0xffffffffffffffff; + do { + pwVar19 = (wchar_t *)((longlong)pwVar19 + 1); + } while (*(short *)(local_5a8 + (longlong)pwVar19 * 2) != 0); + } + if (local_608 != (_STARTUPINFO_STDHANDLES *)0x0) { + uVar20 = 0xffffffffffffffff; + do { + uVar20 = uVar20 + 1; + local_5a0 = uVar20; + } while (*(short *)(local_608 + uVar20 * 2) != 0); + } + if (((wchar_t *)0x7fff < pwVar19) || (0x7fff < uVar20)) { + local_678 = 0x57; + uVar8 = local_678; + goto LAB_0; + } + p_Var21 = local_608; + if (local_5a8 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var21 = local_5a8; + } + wil:: + make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> + ((ushort *)local_5b8,(__uint64)p_Var21); + wil:: + unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + *)&local_5c8,local_5b8); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)local_5b8); + } + uVar3 = local_5f4; + puVar22 = local_560; + uVar8 = local_678; + if (local_5b0[0] == 0) { +LAB_1: + local_678 = uVar8; + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + pvVar18 = pvVar23; + if ((bVar4) && (iVar6 = LUAIsShadowAdminEnabled(), iVar6 != 0)) { + puVar25 = local_568; + if (local_610 != (void *)0x0) { + pvVar18 = local_610; + } + } + else { + puVar25 = (ushort *)0x0; + if (local_610 != (void *)0x0) { + pvVar18 = local_610; + } + } + hObject = local_660; + pwVar17 = local_668; + uVar8 = AiLaunchProcess(local_598,pvVar18,local_660,uVar11,(ushort *)param_3, + (ushort *)param_4,local_62c,(ushort *)local_668,puVar22,local_580, + (_STARTUPINFO_STDHANDLES *)0x0,(_SECURITY_CAPABILITIES *)0x0,uVar3, + (ushort *)0x0,local_620[0],0,(void *)0x0,0,(ushort *)0x0,local_588, + puVar25,(ulong *)0x0,(void *)0x0,0); + pAsync = local_658; + p_Var21 = local_650; + goto LAB_0; + } + uVar8 = RpcImpersonateClient((RPC_BINDING_HANDLE)0x0); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + if (uVar8 != 0) goto LAB_0; + p_Var21 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var21 = param_3; + } + hObject = CreateFileW((LPCWSTR)p_Var21,0xa0000000,5,(LPSECURITY_ATTRIBUTES)0x0,3,0x80, + (HANDLE)0x0); + local_660 = hObject; + if (hObject != (HANDLE)0xffffffffffffffff) { + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + local_678 = CheckElevation(p_Var16,local_5d8,0,&local_630); + if (local_678 == 0) { + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((bVar4) && (iVar6 = LUAIsShadowAdminEnabled(), iVar6 != 0)) { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_568,(ushort *)0x0); + local_678 = AiCheckSecureApplicationDirectoryEx(hObject,&local_674,&local_568); + } + else { + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + local_678 = AiCheckSecureApplicationDirectory((ushort *)p_Var16,&local_674); + } + if (local_678 == 0) { + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar4) && (local_630 - 0x10 < 3)) && + (iVar6 = LUAIsShadowAdminEnabled(), iVar6 != 0)) { + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + AipCheckAssistiveTechnologyList((ushort *)p_Var16,&local_674); + } + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + AiIsEXESafeToAutoApprove + ((ushort *)p_Var16,hObject,(ushort *)param_4,&local_674,&local_548); + uVar8 = RpcRevertToSelf(); + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + if (uVar8 != 0) goto LAB_0; + if ((local_5d8[0] & 8) != 0) { + local_674 = local_674 | 0x1000; + } + if ((local_5d8[0] & 4) != 0) { + local_674 = local_674 | 2; + } + if (local_630 - 0x10 < 3) { + if (2 < local_630) { + local_630 = local_630 - 0x10; + } + local_674 = local_674 | 0x8000c; + } + uVar11 = local_674; + if (((local_630 != 0) || ((local_674 & 4) == 0)) && + (iVar6 = AiIsElevationAllowedForSession(uVar3), iVar6 == 0)) { + local_678 = 0x32; + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; + } + if ((local_640[0] & 1) != 0) { + if (local_630 < 2) { + uVar11 = uVar11 | 0x200; + local_674 = uVar11; + } + local_630 = 2; + local_644 = 6; + } + if ((local_640[0] & 0x10) != 0) { + uVar11 = uVar11 | 0x800; + local_674 = uVar11; + } + if ((char)local_640[0] < '\0') { + local_674 = uVar11 | 0x100000; + } + if ((local_640[0] >> 8 & 1) == 0) { + local_620[0] = 0; + if ((local_640[0] & 0x800) != 0) { + local_620[0] = 0x400; + } + } + else { + local_620[0] = 8; + } + local_5c0[0] = 0; + local_53c = 0x80; + iVar6 = GetPackageFullNameFromToken(pvVar23,&local_53c,local_158); + if (iVar6 == 0) { + VerifyFileIsTrustedAndInPackage(param_3,local_158,local_5c0); + } + memset(local_378,0,0x106); + local_540 = 0x83; + if (local_5c0[0] == 0) { + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + local_678 = AiBuildEXEParams((ushort *)p_Var16,local_660,(ushort *)param_3, + (ulong)pwVar19,(ushort *)param_4,(ulong)local_5a0, + local_548,local_648,&local_578); + } + else { + iVar6 = GetApplicationUserModelIdFromToken(pvVar23,&local_540,local_378); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if (iVar6 != 0) goto LAB_0; + local_638 = CONCAT44(local_638._4_4_,0x41); + local_640[0] = 0x41; + iVar6 = ParseApplicationUserModelId(local_378,&local_638,local_408,local_640); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if (iVar6 < 0) goto LAB_0; + local_644 = 8; + p_Var16 = param_4; + if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { + p_Var16 = param_3; + } + local_678 = AiBuildPackagedAppParams + ((ushort *)p_Var16,(ulong)pwVar19,(ushort *)param_4, + (ulong)local_5a0,local_648,local_408,local_378,&local_578); + } + puVar22 = local_560; + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if (local_678 != 0) goto LAB_0; + *(ELEVATION_REASON *)(local_578 + 0x34) = local_628[0]; + local_678 = AiCheckLUA(local_630,&local_674,local_644,pvVar23,local_578,local_560, + local_538,uVar3,local_618,local_498,&local_610); + uVar1 = local_674; + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if (local_678 != 0) goto LAB_0; + uVar11 = local_674; + uVar8 = 0; + if (local_610 == (void *)0x0) goto LAB_1; + uVar11 = local_674 | 1; + local_674 = uVar11; + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar4) && (local_62c = local_62c & 0xfffffffc, local_644 == 8)) && + (((uVar1 & 0x20) == 0 || + (((uVar1 & 0x8000000) != 0 && (iVar6 = LUAIsShadowAdminEnabled(), iVar6 != 0)))))) { + local_5f0 = (ushort *)0x0; + local_678 = AipLoadUserProfile(local_610,&local_5f0); + if (local_678 == 0) { + ImpersonateLoggedOnUser(local_610); + local_618 = 0; + iVar6 = RegisterAppXPackageIfNecessary2(0,local_378,0,0); + if (-1 < iVar6) { + RevertToSelf(); + if (local_5f0 != (ushort *)0x0) { + UnloadUserProfile(local_610); + } + goto LAB_2; + } + local_678 = 0x3d35; + RevertToSelf(); + } + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + if (local_5f0 != (ushort *)0x0) { + UnloadUserProfile(local_610); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + } + goto LAB_0; + } +LAB_2: + uVar8 = AipApplyAdminProcessPackageClaimsPolicy(&local_610,pvVar23,uVar11); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + if (uVar8 != 0) goto LAB_0; + uVar8 = 0; + goto LAB_1; + } + } + RpcRevertToSelf(); + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; + } + local_678 = GetLastError(); + if ((local_678 == 0x780) || (local_678 == 5)) { + uVar10 = IsLoadAppExecutionAliasInfoExPresent(); + lVar15 = 0; + if ((char)uVar10 != '\0') { + local_638 = 0; + uVar10 = IsLoadAppExecutionAliasInfoEx2Present(); + if (((char)uVar10 == '\0') || + (iVar6 = LoadAppExecutionAliasInfoEx2(p_Var21,pvVar23,0,&local_5e0), iVar6 < 0)) { + local_620[0] = 0; + lVar9 = GetAppExecutionAliasPath(p_Var21,pvVar23,0,local_620); + uVar11 = WIN32_FROM_HRESULT(lVar9); + if (uVar11 != 0x7a) { + RpcRevertToSelf(); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_638); + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; } wil:: make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> - ((ushort *)local_5c0,(__uint64)p_Var22); + ((ushort *)&local_5e8,0); wil:: unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)&local_5d8,local_5c0); + *)&local_638, + (unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + *)&local_5e8); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)local_5c0); - } - uVar3 = local_610[0]; - puVar24 = local_5a0; - uVar8 = local_658; - if (local_5c8 == 0) { -LAB_3: - local_658 = uVar8; - bVar5 = wil::details::FeatureImpl:: - __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' - ::__l2::impl); - if ((bVar5) && (iVar7 = LUAIsShadowAdminEnabled(), iVar7 != 0)) { - puVar28 = local_580; - if (local_620 != (void *)0x0) { - pvVar19 = local_620; - } - } - else { - puVar28 = (ushort *)0x0; - if (local_620 != (void *)0x0) { - pvVar19 = local_620; - } - } - uVar8 = AiLaunchProcess(local_5a8,pvVar19,local_600,uVar25,(ushort *)param_3, - (ushort *)param_4,local_634,(ushort *)local_5e0,puVar24, - local_590,(_STARTUPINFO_STDHANDLES *)0x0, - (_SECURITY_CAPABILITIES *)0x0,uVar3,(ushort *)0x0,local_630[0],0 - ,(void *)0x0,0,(ushort *)0x0,local_598,puVar28,(ulong *)0x0, - (void *)0x0,0); - goto LAB_1; - } - uVar8 = RpcImpersonateClient((RPC_BINDING_HANDLE)0x0); - if (uVar8 != 0) goto LAB_1; - p_Var22 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var22 = param_3; - } - local_600 = CreateFileW((LPCWSTR)p_Var22,0xa0000000,5,(LPSECURITY_ATTRIBUTES)0x0,3,0x80, - (HANDLE)0x0); - if (local_600 == (HANDLE)0xffffffffffffffff) { - local_658 = GetLastError(); - if ((local_658 == 0x780) || (local_658 == 5)) { - uVar10 = IsLoadAppExecutionAliasInfoExPresent(); - lVar14 = 0; - if ((char)uVar10 != '\0') { - local_648 = 0; - uVar10 = IsLoadAppExecutionAliasInfoEx2Present(); - if (((char)uVar10 == '\0') || - (iVar7 = LoadAppExecutionAliasInfoEx2(p_Var22,pvVar19,0,&local_5f8), iVar7 < 0)) - { - local_630[0] = 0; - lVar11 = GetAppExecutionAliasPath(p_Var22,pvVar19,0,local_630); - uVar8 = WIN32_FROM_HRESULT(lVar11); - if (uVar8 == 0x7a) { - wil:: - make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> - ((ushort *)local_650,0); - wil:: - unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)&local_648, - (unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)local_650); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)local_650); - lVar15 = local_648; - iVar7 = GetAppExecutionAliasPath(p_Var22,pvVar19,local_648,local_630); - if (-1 < iVar7) { - iVar7 = LoadAppExecutionAliasInfoEx(lVar15,pvVar19,&local_5f8); - if (-1 < iVar7) goto LAB_4; - goto LAB_5; - } - } -LAB_6: - RpcRevertToSelf(); - } - else { - wil:: - make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> - ((ushort *)local_630,(__uint64)p_Var22); - wil:: - unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)&local_648, - (unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> - *)local_630); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)local_630); - lVar15 = local_648; - if (local_648 == 0) goto LAB_6; -LAB_4: - if (*(int *)(local_5f8 + 4) != 0) { + *)&local_5e8); + lVar13 = local_638; + iVar6 = GetAppExecutionAliasPath(p_Var21,pvVar23,local_638,local_620); + if (-1 < iVar6) { + iVar6 = LoadAppExecutionAliasInfoEx(lVar13,pvVar23,&local_5e0); + if (-1 < iVar6) goto LAB_3; + goto LAB_4; + } LAB_5: - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_648); - goto LAB_7; - } - local_610[0] = 0x41; - iVar7 = PackageFamilyNameFromFullName(*local_5f8,local_610,local_408); - if (iVar7 != 0) goto LAB_5; - memset(local_268,0,0x106); - local_508 = &local_618; - local_624 = 0x83; - local_618 = (_STARTUPINFO_STDHANDLES *)0x0; - local_500 = 0; - local_4f8 = 1; - iVar7 = OpenAppExecutionAliasForUserEx(lVar15,pvVar19,&local_500); - wil::details:: - out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> - :: - ~out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> - ((out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> - *)&local_508); - if ((iVar7 < 0) || - (iVar7 = GetAppExecutionAliasApplicationUserModelIdEx - (local_618,local_268,&local_624), iVar7 < 0)) { -LAB_8: - wil::details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_618); - goto LAB_5; - } - p_Var22 = param_4; - if (param_4 != (_STARTUPINFO_STDHANDLES *)0x0) { - wVar6 = *(wchar_t *)param_4; - if (wVar6 == L'\"') { - p_Var16 = param_4 + 2; - wVar6 = *(wchar_t *)p_Var16; - while ((wVar6 != L'\"' && (bVar5 = wVar6 != L'\0', wVar6 = L'\0', bVar5))) { - p_Var16 = p_Var16 + 2; - wVar6 = *(wchar_t *)p_Var16; - } - p_Var22 = p_Var16 + 2; - if (wVar6 != L'\"') { - p_Var22 = p_Var16; - } - } - else { - while ((wVar6 != L' ' && (wVar6 != L'\0'))) { - p_Var22 = p_Var22 + 2; - wVar6 = *(wchar_t *)p_Var22; - } - } - lVar14 = -1; - do { - lVar14 = lVar14 + 1; - } while (*(short *)(p_Var22 + lVar14 * 2) != 0); - } - lVar15 = -1; - do { - lVar15 = lVar15 + 1; - } while (*(short *)(local_5f8[1] + lVar15 * 2) != 0); - _Var27 = (__uint64)(((int)lVar15 + (int)lVar14) * 2 + 6); - wil:: - make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> - ((ushort *)&local_5d0,0); - puVar24 = (ushort *)CONCAT44(uStack_5cc,local_5d0); - if ((((puVar24 == (ushort *)0x0) || - (lVar11 = StringCbCopyW(puVar24,_Var27,(ushort *)L"\""), lVar11 < 0)) || - (lVar11 = StringCbCatW(puVar24,_Var27,(ushort *)local_5f8[1]), lVar11 < 0)) || - (lVar11 = StringCbCatW(puVar24,_Var27,(ushort *)L"\""), lVar11 < 0)) { - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_5d0); - goto LAB_8; - } - if ((p_Var22 == (_STARTUPINFO_STDHANDLES *)0x0) || - (lVar11 = StringCbCatW(puVar24,_Var27,(ushort *)p_Var22), -1 < lVar11)) { - *local_518 = local_640; - AipLaunchProcessWithIdentityHelper - (local_510,local_538,(ushort *)local_5f8[1],puVar24,local_63c | 0x200, - local_634,(ushort *)local_5e0,local_5a0,local_590,p_Var17,local_408, - local_268,(__uint64)local_608,local_628,0x11, - in_stack_fffffffffffff950,(void *)0x0,0,(__uint64 *)0x0,(_GUID *)0x0, - 0,local_498,&local_5e4,&local_5e8, - (_APPINFO_PROCESS_INFORMATION *)local_598); - local_654 = true; - } - RpcRevertToSelf(); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_5d0); - wil::details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_618); - } - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_648); - uVar8 = local_658; - goto LAB_1; - } - } + RpcRevertToSelf(); } else { - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; - } - local_658 = CheckElevation(p_Var17,&local_5f0,0,&local_638); - if (local_658 == 0) { - bVar5 = wil::details::FeatureImpl:: - __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' - ::__l2::impl); - if ((bVar5) && (iVar7 = LUAIsShadowAdminEnabled(), iVar7 != 0)) { - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_580,(ushort *)0x0); - local_658 = AiCheckSecureApplicationDirectoryEx(local_600,local_650,&local_580); - } - else { - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; + wil:: + make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> + ((ushort *)local_620,(__uint64)p_Var21); + wil:: + unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + ::operator=((unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + *)&local_638, + (unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> + *)local_620); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)local_620); + lVar13 = local_638; + if (local_638 == 0) goto LAB_5; +LAB_3: + if (*(int *)(local_5e0 + 4) != 0) { +LAB_4: + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_638); + goto LAB_6; + } + local_628[0] = 0x41; + iVar6 = PackageFamilyNameFromFullName(*local_5e0,local_628,local_408); + if (iVar6 != 0) goto LAB_4; + memset(local_268,0,0x106); + local_500 = &local_608; + local_5f4 = 0x83; + local_608 = (_STARTUPINFO_STDHANDLES *)0x0; + local_4f8 = 0; + local_4f0 = 1; + iVar6 = OpenAppExecutionAliasForUserEx(lVar13,pvVar23,&local_4f8); + wil::details:: + out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> + :: + ~out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> + ((out_param_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_>_> + *)&local_500); + if ((iVar6 < 0) || + (iVar6 = GetAppExecutionAliasApplicationUserModelIdEx(local_608,local_268,&local_5f4) + , iVar6 < 0)) { +LAB_7: + wil::details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)&local_608); + goto LAB_4; + } + p_Var21 = param_4; + if (param_4 != (_STARTUPINFO_STDHANDLES *)0x0) { + wVar5 = *(wchar_t *)param_4; + if (wVar5 == L'\"') { + p_Var14 = param_4 + 2; + wVar5 = *(wchar_t *)p_Var14; + while ((wVar5 != L'\"' && (bVar4 = wVar5 != L'\0', wVar5 = L'\0', bVar4))) { + p_Var14 = p_Var14 + 2; + wVar5 = *(wchar_t *)p_Var14; } - local_658 = AiCheckSecureApplicationDirectory((ushort *)p_Var17,local_650); - } - if (local_658 != 0) { - RpcRevertToSelf(); - uVar25 = local_650[0]; - uVar8 = local_658; - goto LAB_1; - } - bVar5 = wil::details::FeatureImpl:: - __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' - ::__l2::impl); - if (((bVar5) && (local_638 - 0x10 < 3)) && - (iVar7 = LUAIsShadowAdminEnabled(), iVar7 != 0)) { - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; - } - AipCheckAssistiveTechnologyList((ushort *)p_Var17,local_650); - } - pvVar23 = local_600; - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; - } - AiIsEXESafeToAutoApprove - ((ushort *)p_Var17,local_600,(ushort *)param_4,local_650,&local_550); - uVar8 = RpcRevertToSelf(); - uVar25 = local_650[0]; - if (uVar8 != 0) goto LAB_1; - if ((local_5f0 & 8) != 0) { - local_650[0] = local_650[0] | 0x1000; - } - if ((local_5f0 & 4) != 0) { - local_650[0] = local_650[0] | 2; - } - if (local_638 - 0x10 < 3) { - if (2 < local_638) { - local_638 = local_638 - 0x10; - } - local_650[0] = local_650[0] | 0x8000c; - } - uVar25 = local_650[0]; - if (((local_638 != 0) || ((local_650[0] & 4) == 0)) && - (iVar7 = AiIsElevationAllowedForSession(uVar3), iVar7 == 0)) { - local_658 = 0x32; - uVar8 = local_658; - goto LAB_1; - } - if ((local_63c & 1) != 0) { - if (local_638 < 2) { - uVar25 = uVar25 | 0x200; - local_650[0] = uVar25; - } - local_638 = 2; - local_640 = 6; - } - if ((local_63c & 0x10) != 0) { - uVar25 = uVar25 | 0x800; - local_650[0] = uVar25; - } - if ((char)local_63c < '\0') { - uVar25 = uVar25 | 0x100000; - local_650[0] = uVar25; - } - if ((local_63c >> 8 & 1) == 0) { - pvVar23 = local_600; - if ((local_63c & 0x800) != 0) { - local_630[0] = 0x400; + p_Var21 = p_Var14 + 2; + if (wVar5 != L'\"') { + p_Var21 = p_Var14; } } else { - local_630[0] = 8; + while ((wVar5 != L' ' && (wVar5 != L'\0'))) { + p_Var21 = p_Var21 + 2; + wVar5 = *(wchar_t *)p_Var21; + } } - local_5c4 = 0; - local_578[0] = 0x80; - iVar7 = GetPackageFullNameFromToken(pvVar19,local_578,local_158); - if (iVar7 == 0) { - VerifyFileIsTrustedAndInPackage(param_3,local_158,&local_5c4); - } - memset(local_378,0,0x106); - local_540[0] = 0x83; - if (local_5c4 == 0) { - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; - } - local_658 = AiBuildEXEParams((ushort *)p_Var17,pvVar23,(ushort *)param_3, - (ulong)pTVar26,(ushort *)param_4,(ulong)local_5b0, - local_550,local_5ec,&local_588); - } - else { - iVar7 = GetApplicationUserModelIdFromToken(pvVar19,local_540,local_378); - uVar8 = local_658; - if (iVar7 != 0) goto LAB_1; - local_5d0 = 0x41; - local_63c = 0x41; - iVar7 = ParseApplicationUserModelId(local_378,&local_5d0,local_408,&local_63c); - uVar8 = local_658; - if (iVar7 < 0) goto LAB_1; - local_640 = 8; - p_Var17 = param_4; - if (param_3 != (_STARTUPINFO_STDHANDLES *)0x0) { - p_Var17 = param_3; - } - local_658 = AiBuildPackagedAppParams - ((ushort *)p_Var17,(ulong)pTVar26,(ushort *)param_4, - (ulong)local_5b0,local_5ec,local_408,local_378,&local_588); - } - puVar24 = local_5a0; - uVar8 = local_658; - if (local_658 != 0) goto LAB_1; - *(undefined4 *)(local_588 + 0x34) = (undefined4)local_648; - local_658 = AiCheckLUA(local_638,local_650,local_640,pvVar19,local_588,local_5a0, - local_608,uVar3,local_628,local_498,&local_620); - uVar1 = local_650[0]; - uVar25 = local_650[0]; - uVar8 = local_658; - if (local_658 != 0) goto LAB_1; - uVar8 = 0; - if (local_620 == (void *)0x0) goto LAB_3; - uVar25 = local_650[0] | 1; - bVar5 = wil::details::FeatureImpl:: - __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' - ::__l2::impl); - if (((bVar5) && (local_634 = local_634 & 0xfffffffc, local_640 == 8)) && - (((uVar1 & 0x20) == 0 || - (((uVar1 & 0x8000000) != 0 && (iVar7 = LUAIsShadowAdminEnabled(), iVar7 != 0)))))) - { - local_608 = (HWND__ *)0x0; - local_658 = AipLoadUserProfile(local_620,&local_608); - if (local_658 == 0) { - ImpersonateLoggedOnUser(local_620); - local_628 = 0; - iVar7 = RegisterAppXPackageIfNecessary2(0,local_378,0,0); - if (-1 < iVar7) { - RevertToSelf(); - if (local_608 != (HWND__ *)0x0) { - UnloadUserProfile(local_620); - } - goto LAB_9; - } - local_658 = 0x3d35; - RevertToSelf(); - } - uVar8 = local_658; - if (local_608 != (HWND__ *)0x0) { - UnloadUserProfile(local_620); - uVar8 = local_658; - } - goto LAB_1; - } -LAB_9: - uVar8 = AipApplyAdminProcessPackageClaimsPolicy(&local_620,pvVar19,uVar25); - if (uVar8 != 0) goto LAB_1; - goto LAB_3; - } + lVar15 = -1; + do { + lVar15 = lVar15 + 1; + } while (*(short *)(p_Var21 + lVar15 * 2) != 0); + } + lVar13 = -1; + do { + lVar13 = lVar13 + 1; + } while (*(short *)(local_5e0[1] + lVar13 * 2) != 0); + _Var24 = (__uint64)(((int)lVar13 + (int)lVar15) * 2 + 6); + wil:: + make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> + ((ushort *)&local_5f0,0); + puVar22 = local_5f0; + if ((((local_5f0 == (ushort *)0x0) || + (lVar9 = StringCbCopyW(local_5f0,_Var24,(ushort *)L"\""), lVar9 < 0)) || + (lVar9 = StringCbCatW(puVar22,_Var24,(ushort *)local_5e0[1]), lVar9 < 0)) || + (lVar9 = StringCbCatW(puVar22,_Var24,(ushort *)L"\""), lVar9 < 0)) { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_5f0); + goto LAB_7; + } + if ((p_Var21 == (_STARTUPINFO_STDHANDLES *)0x0) || + (lVar9 = StringCbCatW(puVar22,_Var24,(ushort *)p_Var21), -1 < lVar9)) { + pAsync = local_658; + pwVar17 = local_668; + *local_508 = local_644; + AipLaunchProcessWithIdentityHelper + (local_658,local_590,(ushort *)local_5e0[1],puVar22,local_640[0] | 0x200, + local_62c,(ushort *)local_668,local_560,local_580,p_Var16,local_408, + local_268,(__uint64)local_538,local_618,0x11,in_stack_fffffffffffff930, + (void *)0x0,0,(__uint64 *)0x0,(_GUID *)0x0,0,local_498, + (int *)(local_600 + 1),local_600,(_APPINFO_PROCESS_INFORMATION *)local_588) + ; + local_670[0] = true; + RpcRevertToSelf(); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_5f0); + wil::details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)&local_608); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_638); + hObject = local_660; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; + } + RpcRevertToSelf(); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_5f0); + wil::details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)&local_608); } -LAB_7: - RpcRevertToSelf(); - uVar8 = local_658; - goto LAB_1; + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_638); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; } } - uVar8 = RtlNtStatusToDosErrorNoTeb(DVar9); - goto LAB_1; - } - } -LAB_2: - local_658 = 0x57; - uVar8 = local_658; -LAB_1: - local_658 = uVar8; - lpPerformanceCount = &local_530; - QueryPerformanceCounter(lpPerformanceCount); - UVar4 = local_5e8; - EVar2 = local_640; - lVar14 = (local_530.QuadPart - (longlong)local_528) * 1000; - lVar15 = lVar14 / local_520.QuadPart; - if (local_658 == 0x4c7) { - uVar20 = 0; +LAB_6: + RpcRevertToSelf(); + hObject = local_660; + pwVar17 = local_668; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; + goto LAB_0; + } + } + local_678 = 0x57; + hObject = local_660; + pwVar17 = local_668; + pvVar23 = local_5d0; + pAsync = local_658; + p_Var21 = local_650; + uVar8 = local_678; +LAB_0: + local_678 = uVar8; + QueryPerformanceCounter(&local_520); + local_590 = (void *)(((local_520.QuadPart - (longlong)local_518) * 1000) / local_510.QuadPart); + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + local_638 = CONCAT44(local_638._4_4_,local_600[0]); + local_648 = local_678; + if (bVar4) { + local_558 = local_5c8; + local_5e8 = local_570; + local_628[0] = local_644; + if (local_678 == 0x4c7) { + local_648 = 0; + } + else if (0 < (int)local_678) { + local_648 = local_678 & 0xffff | 0x80070000; + } + LUATelemetry:: + LaunchAdminProcess + ((long *)&local_648,&local_674,local_628,&local_678,(ushort **)&local_5e8, + (ushort **)&local_558,(int *)(local_600 + 1),(ulong *)&local_638, + (__int64 *)&local_590,local_670,local_498); } else { - uVar20 = local_658; - if (0 < (int)local_658) { - uVar20 = local_658 & 0xffff | 0x80070000; - } - } - bVar5 = LUATelemetry::IsEnabled((uchar)lpPerformanceCount,lVar14 % local_520.QuadPart); - if (bVar5) { - LUATelemetry::Instance(); - LUATelemetry::LaunchAdminProcess_ - ((LUATelemetry *)&lpPerformanceCount->s,uVar20,uVar25,EVar2,local_658, - (ushort *)local_570,local_5d8,local_5e4,UVar4,lVar15,local_654,local_498); - } - if (local_600 != (HANDLE)0xffffffffffffffff) { - CloseHandle(local_600); - } - if (param_3 != local_568) { + local_5e8 = local_5c8; + local_628[0] = local_644; + if (local_678 == 0x4c7) { + local_648 = 0; + } + else if (0 < (int)local_678) { + local_648 = local_678 & 0xffff | 0x80070000; + } + LUATelemetry:: + LaunchAdminProcess + ((long *)&local_648,&local_674,local_628,&local_678,(ushort **)&local_558, + (ushort **)&local_5e8,(int *)(local_600 + 1),(ulong *)&local_638, + (__int64 *)&local_590,local_670,local_498); + } + if (hObject != (HANDLE)0xffffffffffffffff) { + CloseHandle(hObject); + } + if (param_3 != local_530) { LocalFree(param_3); } - if (param_4 != local_560) { + if (param_4 != p_Var21) { LocalFree(param_4); } - if (local_5e0 != local_558) { - LocalFree(local_5e0); - } - LocalFree(local_588); - LocalFree(local_550); - if (local_620 != (void *)0x0) { + if (pwVar17 != local_550) { + LocalFree(pwVar17); + } + LocalFree(local_578); + LocalFree(local_548); + if (local_610 != (void *)0x0) { NtClose(); - local_620 = (void *)0x0; - } - if (local_548 != (void *)0x0) { + local_610 = (void *)0x0; + } + if (pvVar23 != (void *)0x0) { + NtClose(pvVar23); + } + if (local_598 != (void *)0x0) { NtClose(); } - if (local_5a8 != (void *)0x0) { - NtClose(); - } - if (local_5f8 != (undefined8 *)0x0) { + if (local_5e0 != (undefined8 *)0x0) { FreeAppExecutionAliasInfoEx(); - local_5f8 = (undefined8 *)0x0; - } - if (local_654 == false) { - *local_518 = local_640; - RpcAsyncCompleteCall(local_510,&local_658); + local_5e0 = (undefined8 *)0x0; + } + if (local_670[0] == false) { + *local_508 = local_644; + RpcAsyncCompleteCall(pAsync,&local_678); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, - &WPP_0ce7c76f698f39e4e4b30c7837b6f8d8_Traceguids,local_658); + &WPP_b0ad0aeaf2dd389428535dff1a3bbbae_Traceguids,local_678); } wil::ActivityThreadWatcher::~ActivityThreadWatcher(local_4e8); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_580); + *)&local_570); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_5d8); + *)&local_568); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_5c8); return; } ``` ## LUATelemetry::IsEnabled ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.35| |i_ratio|0.0| |m_ratio|0.4| |b_ratio|0.32| |match_types|Implied Match| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |`name`|IsEnabled|__private_IsEnabled| |`fullname`|LUATelemetry::IsEnabled|wil::details::FeatureImpl::__private_IsEnabled| |`refcount`|9|3| |`length`|21|78| |`called`|LUATelemetry::Instance
wil::TraceLoggingProvider::IsEnabled_|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |`calling`|AiRegistrySync
LUATelemetry::COMElevation
LUATelemetry::CentennialElevation
LUATelemetry::CentennialElevation
LUATelemetry::LongPathApplicationElevation
LUATelemetry::MSIElevation
LUATelemetry::SettingsSyncErrorContext
RAiLaunchAdminProcess|RAiLaunchAdminProcess| |paramcount|2|1| |`address`|180036fe0|18003d13c| |`sig`|bool __cdecl IsEnabled(uchar param_1, __uint64 param_2)|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### LUATelemetry::IsEnabled Called Diff ```diff --- LUATelemetry::IsEnabled called +++ wil::details::FeatureImpl::__private_IsEnabled called @@ -1,2 +1,3 @@ -LUATelemetry::Instance -wil::TraceLoggingProvider::IsEnabled_ +API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureImpl::ReportUsage ``` ### LUATelemetry::IsEnabled Calling Diff ```diff --- LUATelemetry::IsEnabled calling +++ wil::details::FeatureImpl::__private_IsEnabled calling @@ -1,7 +0,0 @@ -AiRegistrySync -LUATelemetry::COMElevation -LUATelemetry::CentennialElevation -LUATelemetry::CentennialElevation -LUATelemetry::LongPathApplicationElevation -LUATelemetry::MSIElevation -LUATelemetry::SettingsSyncErrorContext ``` ### LUATelemetry::IsEnabled Diff ```diff --- LUATelemetry::IsEnabled +++ wil::details::FeatureImpl::__private_IsEnabled @@ -1,17 +1,19 @@ -/* public: static bool __cdecl LUATelemetry::IsEnabled(unsigned char,unsigned __int64) */ +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ -bool __cdecl LUATelemetry::IsEnabled(uchar param_1,__uint64 param_2) +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) { - bool bVar1; - LUATelemetry *this; - uchar uVar2; - __uint64 in_R8; + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; - uVar2 = (uchar)param_2; - this = Instance(); - bVar1 = wil::TraceLoggingProvider::IsEnabled_((TraceLoggingProvider *)this,uVar2,in_R8); - return bVar1; + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_1715195192__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|71|72| |length|0|0| |called||| |`calling`|
Expand for full list:
::
FlushLookUpTableBucket
TlgRegisterAggregateProviderEx
TlgUnregisterAggregateProvider
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::OnUsageFlushed
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_RecordFeatureUsage
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
FlushLookUpTableBucket
TlgRegisterAggregateProviderEx
TlgUnregisterAggregateProvider
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::OnUsageFlushed
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_RecordFeatureUsage
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|EXTERNAL:00000057|EXTERNAL:00000057| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -15,0 +16 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |`refcount`|6|7| |length|29|29| |called|EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::CloseAppExecutionAliasEx|EXT-MS-WIN-APPMODEL-APPEXECUTIONALIAS-L1-1-0.DLL::CloseAppExecutionAliasEx| |`calling`|::operator()
RAiLaunchAdminProcess|::operator()
RAiLaunchAdminProcess| |paramcount|1|1| |address|180011a64|180011a64| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling @@ -1 +1 @@ -::operator() +::operator() ``` ## NTDLL.DLL::RtlNtStatusToDosErrorNoTeb ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|RtlNtStatusToDosErrorNoTeb|RtlNtStatusToDosErrorNoTeb| |fullname|NTDLL.DLL::RtlNtStatusToDosErrorNoTeb|NTDLL.DLL::RtlNtStatusToDosErrorNoTeb| |`refcount`|40|41| |length|0|0| |called||| |calling|
Expand for full list:
AccessCheckIncomingToken
AiCheckLUA
AiCheckSecureApplicationDirectory
AiGetClientInformation
AiGetElevationToken
AiLaunchConsentUI
AiLaunchProcess
AipAddPolicyClient
AipAddProfileReference
AipAddTokenUserInTokenSD
AipAdjustTokenSDAipCheckForAppPathsKey
AipExpandEnvironment
AipGetTokenForService
AipHardenEnvironment
AipLaunchProcessWithIdentityImplementation
AipNormalizePath
AipNormalizePathEx
AipValidateClientService
AipValidateLaunchedProcess
AipVerifyConsent
RAiDisableElevationForSession
RAiEnableElevationForSession
RAiGetElevatedToken
RAiGetProcessesFromJitvSilos
RAiLaunchAdminProcess
RAiOverrideDesktopPromptPolicy
RAiProcessRunOnce
ServiceMain
|
Expand for full list:
AccessCheckIncomingToken
AiCheckLUA
AiCheckSecureApplicationDirectory
AiGetClientInformation
AiGetElevationToken
AiLaunchConsentUI
AiLaunchProcess
AipAddPolicyClient
AipAddProfileReference
AipAddTokenUserInTokenSD
AipAdjustTokenSDAipCheckForAppPathsKey
AipExpandEnvironment
AipGetTokenForService
AipHardenEnvironment
AipLaunchProcessWithIdentityImplementation
AipNormalizePath
AipNormalizePathEx
AipValidateClientService
AipValidateLaunchedProcess
AipVerifyConsent
RAiDisableElevationForSession
RAiEnableElevationForSession
RAiGetElevatedToken
RAiGetProcessesFromJitvSilos
RAiLaunchAdminProcess
RAiOverrideDesktopPromptPolicy
RAiProcessRunOnce
ServiceMain
| |paramcount|0|0| |address|EXTERNAL:00000103|EXTERNAL:00000103| |sig|undefined RtlNtStatusToDosErrorNoTeb(void)|undefined RtlNtStatusToDosErrorNoTeb(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## push_back ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|push_back|push_back| |fullname|wil::details_abi::heap_buffer::push_back|wil::details_abi::heap_buffer::push_back| |`refcount`|49|50| |length|158|158| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::reserve|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::reserve| |`calling`|
Expand for full list:
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledStatewil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::WilApiImpl_RecordFeatureUsage
wil::details_abi::SubscriptionList::SubscribeUnderLock
|
Expand for full list:
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledStatewil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::WilApiImpl_RecordFeatureUsage
wil::details_abi::SubscriptionList::SubscribeUnderLock
| |paramcount|3|3| |address|180010480|180010480| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### push_back Calling Diff ```diff --- wil::details_abi::heap_buffer::push_back calling +++ wil::details_abi::heap_buffer::push_back calling @@ -3,0 +4 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|GetTickCount|GetTickCount| |fullname|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount| |`refcount`|45|46| |length|0|0| |called||| |`calling`|
Expand for full list:
ServiceMain
__security_init_cookie
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabledwil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
|
Expand for full list:
ServiceMain
__security_init_cookie
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabledwil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
| |paramcount|0|0| |address|EXTERNAL:0000007d|EXTERNAL:0000007d| |sig|DWORD __stdcall GetTickCount(void)|DWORD __stdcall GetTickCount(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount Calling Diff ```diff --- API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling +++ API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling @@ -3,0 +4 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ## operator= ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|operator=|operator=| |fullname|wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=|wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=| |`refcount`|11|12| |length|47|47| |called|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset| |calling|AipCompareSingleAssistiveTechnology
GetEAAumidIfPresent
RAiLaunchAdminProcess
wil::AdaptFixedSizeToAllocatedResult,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>,256>
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::swap|AipCompareSingleAssistiveTechnology
GetEAAumidIfPresent
RAiLaunchAdminProcess
wil::AdaptFixedSizeToAllocatedResult,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>,256>
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::swap| |paramcount|2|2| |`address`|180027524|1800275f4| |sig|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * __thiscall operator=(unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * this, unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * param_1)|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * __thiscall operator=(unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * this, unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>|~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>| |`refcount`|59|64| |length|29|29| |called|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree| |`calling`|
Expand for full list:
::operator()
AiCopyRegistry
AiDoesExecutableExistInPackage
AiRegistrySync
AipCompareSingleAssistiveTechnology
AipLaunchProcessWithIdentityImplementation
CheckPackageFamilyNameACEFromPath
CreateBnoIsolationPrefix
CreateBnoIsolationPrefixForRpc
GetEAAumidIfPresent
GetFullPathToAUMIDExecutableGetPackageActivationTokenForSxS
GetPackageFamilyNameFromConditionalAce
RAiLaunchAdminProcess
StateRepository::Cache::Entity::PackageFamily_NoThrow::ContextToObject
VerifyExecutableHasProperConditionalACE
wil::AdaptFixedSizeToAllocatedResult,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>,256>
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::swap
|
Expand for full list:
::operator()
AiCopyRegistry
AiDoesExecutableExistInPackage
AiRegistrySync
AipCompareSingleAssistiveTechnology
AipLaunchProcessWithIdentityImplementation
CheckPackageFamilyNameACEFromPath
CreateBnoIsolationPrefix
CreateBnoIsolationPrefixForRpc
GetEAAumidIfPresent
GetFullPathToAUMIDExecutableGetPackageActivationTokenForSxS
GetPackageFamilyNameFromConditionalAce
RAiLaunchAdminProcess
StateRepository::Cache::Entity::PackageFamily_NoThrow::ContextToObject
VerifyExecutableHasProperConditionalACE
wil::AdaptFixedSizeToAllocatedResult,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>,256>
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::swap
| |paramcount|1|1| |address|18001311c|18001311c| |sig|void __thiscall ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>(unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>(unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> calling @@ -1 +1 @@ -::operator() +::operator() ``` ## WilApi_GetFeatureEnabledState ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|WilApi_GetFeatureEnabledState|WilApi_GetFeatureEnabledState| |fullname|wil::details::WilApi_GetFeatureEnabledState|wil::details::WilApi_GetFeatureEnabledState| |`refcount`|47|48| |length|30|30| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|
Expand for full list:
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledStatewil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
|
Expand for full list:
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledStatewil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
| |paramcount|3|3| |address|1800222c8|1800222c8| |sig|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### WilApi_GetFeatureEnabledState Calling Diff ```diff --- wil::details::WilApi_GetFeatureEnabledState calling +++ wil::details::WilApi_GetFeatureEnabledState calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCurrentFeatureEnabledState ``` ## ReportUsageToService ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|48|49| |length|154|154| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |`calling`|
Expand for full list:
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsagewil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
|
Expand for full list:
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsagewil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
| |paramcount|8|8| |address|18001a194|18001a194| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::ReportUsage ``` ## ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|78|79| |length|31|31| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
Windows::Internal::PlatformExtensions::Details::PlatformExtensionsTelemetry::TryActivateContractExtension::StartActivity
Windows::Internal::PlatformExtensions::Details::PlatformExtensionsTelemetry::TryLookupExtensionPointImplementationAcid::StartActivity
Windows::Internal::PlatformExtensions::Details::TryLookupExtensionPointImplementationAcid
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::zInternalStart
wil::ActivityBase::zInternalStop
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::zInternalStartwil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_RecordFeatureUsage
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
Windows::Internal::PlatformExtensions::Details::PlatformExtensionsTelemetry::TryActivateContractExtension::StartActivity
Windows::Internal::PlatformExtensions::Details::PlatformExtensionsTelemetry::TryLookupExtensionPointImplementationAcid::StartActivity
Windows::Internal::PlatformExtensions::Details::TryLookupExtensionPointImplementationAcid
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::zInternalStart
wil::ActivityBase::zInternalStop
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::zInternalStartwil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::OnTimer
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::WilApiImpl_RecordFeatureUsage
wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|1800113e0|1800113e0| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -24,0 +25 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|51|52| |length|32|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |`calling`|
Expand for full list:
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledStatewil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured
|
Expand for full list:
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledStatewil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured
| |paramcount|0|0| |address|18001dff0|18001dff0| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## AipJustFileName ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|AipJustFileName|AipJustFileName| |fullname|AipJustFileName|AipJustFileName| |`refcount`|16|17| |length|50|50| |called|MSVCRT.DLL::wcsrchr|MSVCRT.DLL::wcsrchr| |`calling`|::operator()
::operator()
::operator()
AiDoesExecutableExistInPackage
AipLaunchProcessWithIdentityImplementation
GetPackageActivationTokenForFilePath
RAiFinishPackageActivation
RAiGetPackageActivationTokenForAlias
RAiGetPackageActivationTokenForFilePath
RAiLaunchAdminProcess|::operator()
::operator()
::operator()
AiDoesExecutableExistInPackage
AipLaunchProcessWithIdentityImplementation
GetPackageActivationTokenForFilePath
RAiFinishPackageActivation
RAiGetPackageActivationTokenForAlias
RAiGetPackageActivationTokenForFilePath
RAiLaunchAdminProcess| |paramcount|1|1| |address|18000aba0|18000aba0| |sig|ushort * __cdecl AipJustFileName(ushort * param_1)|ushort * __cdecl AipJustFileName(ushort * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### AipJustFileName Calling Diff ```diff --- AipJustFileName calling +++ AipJustFileName calling @@ -1,3 +1,3 @@ -::operator() -::operator() -::operator() +::operator() +::operator() +::operator() ``` ## RPCRT4.DLL::RpcRevertToSelf ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|RpcRevertToSelf|RpcRevertToSelf| |fullname|RPCRT4.DLL::RpcRevertToSelf|RPCRT4.DLL::RpcRevertToSelf| |`refcount`|13|15| |length|0|0| |called||| |calling|AiGetClientInformation
AipApplyAdminProcessPackageClaimsPolicy
AipCompareSingleAssistiveTechnology
AipLaunchProcessWithIdentityImplementation
RAiGetProcessesFromJitvSilos
RAiLaunchAdminProcess|AiGetClientInformation
AipApplyAdminProcessPackageClaimsPolicy
AipCompareSingleAssistiveTechnology
AipLaunchProcessWithIdentityImplementation
RAiGetProcessesFromJitvSilos
RAiLaunchAdminProcess| |paramcount|0|0| |address|EXTERNAL:00000031|EXTERNAL:00000031| |sig|RPC_STATUS __stdcall RpcRevertToSelf(void)|RPC_STATUS __stdcall RpcRevertToSelf(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> ### Match Info |Key|ai_8972.dll - ai_9168.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ai_8972.dll|ai_9168.dll| | :---: | :---: | :---: | |name|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |fullname|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |`refcount`|14|15| |length|253|253| |called|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
MSVCRT.DLL::memcpy_s
wil::details::in1diag3::_FailFast_Unexpected|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
MSVCRT.DLL::memcpy_s
wil::details::in1diag3::_FailFast_Unexpected| |calling|AiDoesExecutableExistInPackage
AipCompareSingleAssistiveTechnology
GetEAAumidIfPresent
GetFullPathToAUMIDExecutable
GetPackageFamilyNameFromConditionalAce
RAiLaunchAdminProcess
VerifyExecutableHasProperConditionalACE
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make|AiDoesExecutableExistInPackage
AipCompareSingleAssistiveTechnology
GetEAAumidIfPresent
GetFullPathToAUMIDExecutable
GetPackageFamilyNameFromConditionalAce
RAiLaunchAdminProcess
VerifyExecutableHasProperConditionalACE
wil::details::string_maker,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::make| |paramcount|2|2| |`address`|180026958|180026a28| |sig|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| Generated with `ghidriff` version: 1.0.0 on 2026-08-21T19:36:43