# atbroker-07.exe-atbroker-08.exe Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_2991529274getcachedfeatureenabledstate) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState](#wildetailsfeatureimpl__wilfeaturetraits_feature_575610170getcachedfeatureenabledstate) * [SettingsCopier::SetRegKeyValue](#settingscopiersetregkeyvalue) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_2991529274__private_isenabled) * [wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled](#wildetailsfeatureimpl__wilfeaturetraits_feature_575610170__private_isenabled) * [Added](#added) * [`SettingsCopier::CopyATSettings'::__l1::dtor$1](#settingscopiercopyatsettings__l1dtor1) * [Modified](#modified) * [SettingsCopier::CopyATSettings](#settingscopiercopyatsettings) * [Modified (No Code Changes)](#modified-no-code-changes) * [SubscribeFeatureStateCacheToConfigurationChanges](#subscribefeaturestatecachetoconfigurationchanges) * [MSVCRT.DLL::malloc](#msvcrtdllmalloc) * [~CRegKey](#cregkey) * [Return_Hr](#return_hr) * [KERNEL32.DLL::RegEnumValueW](#kernel32dllregenumvaluew) * [ADVAPI32.DLL::RegCloseKey](#advapi32dllregclosekey) * [EnsureSubscribedToFeatureConfigurationChangesImpl](#ensuresubscribedtofeatureconfigurationchangesimpl) * [KERNEL32.DLL::RegDeleteTreeW](#kernel32dllregdeletetreew) * [MSVCRT.DLL::free](#msvcrtdllfree) * [KERNEL32.DLL::RegSetValueExW](#kernel32dllregsetvalueexw) * [ADVAPI32.DLL::RegOpenKeyExW](#advapi32dllregopenkeyexw) * [Create](#create) * [ReportUsageToService](#reportusagetoservice) # Visual Chart Diff ```mermaid flowchart LR SettingsCopierCopyATSettings-3-old<--Match 19%-->SettingsCopierCopyATSettings-3-new subgraph atbroker-08.exe SettingsCopierCopyATSettings-3-new subgraph Added direction LR SettingsCopier-CopyATSettings-__l1-dtor1 end end subgraph atbroker-07.exe SettingsCopierCopyATSettings-3-old subgraph Deleted direction LR wil-details-FeatureImpl__WilFeatureTraits_Feature_2991529274-GetCachedFeatureEnabledState wil-details-FeatureImpl__WilFeatureTraits_Feature_575610170-GetCachedFeatureEnabledState SettingsCopier-SetRegKeyValue wil-details-FeatureImpl__WilFeatureTraits_Feature_2991529274-__private_IsEnabled wil-details-FeatureImpl__WilFeatureTraits_Feature_575610170-__private_IsEnabled end end ``` ```mermaid pie showData title Function Matches - 99.4958% "unmatched_funcs_len" : 6 "matched_funcs_len" : 1184 ``` ```mermaid pie showData title Matched Function Similarity - 98.7331% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 14 "matched_funcs_no_changes_len" : 1169 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 atbroker-07.exe atbroker-08.exe ``` #### Verbose Args
``` --old ['atbroker-07.exe'] --new [['atbroker-08.exe']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/ATBroker.exe/DFFF5F2C24000/ATBroker.exe -O atbroker.exe.x64.10.0.22621.7079 wget https://msdl.microsoft.com/download/symbols/ATBroker.exe/F7EFE79624000/ATBroker.exe -O atbroker.exe.x64.10.0.22621.1554 ``` ## Binary Metadata Diff ```diff --- atbroker-07.exe Meta +++ atbroker-08.exe Meta @@ -1,44 +1,44 @@ -Program Name: atbroker-07.exe +Program Name: atbroker-08.exe Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 151056 +# of Bytes: 151024 # of Memory Blocks: 9 -# of Instructions: 20908 -# of Defined Data: 1987 -# of Functions: 597 -# of Symbols: 4802 -# of Data Types: 563 +# of Instructions: 20431 +# of Defined Data: 1977 +# of Functions: 593 +# of Symbols: 4742 +# of Data Types: 559 # of Data Type Categories: 45 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Wed Aug 26 22:51:12 SGT 2026 +Date Created: Wed Aug 26 22:51:21 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/atbroker-07.exe -Executable MD5: 8762fd380eed3376f02f5e1b6aed9ff1 -Executable SHA256: 5050e3a1f612e30380b488c1796341e1a88bcd7d744256b688b6fef3ed1bff97 -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/atbroker-07.exe?MD5=8762fd380eed3376f02f5e1b6aed9ff1 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/atbroker-08.exe +Executable MD5: 5777ea81444ef2edcb29eada9dca2440 +Executable SHA256: ad099233d48f9fc6ae19dc10bb9458a7a2e184561f8206ccc06f964c096218a5 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/atbroker-08.exe?MD5=5777ea81444ef2edcb29eada9dca2440 PDB Age: 1 PDB File: ATBroker.pdb -PDB GUID: ecf5ce5a-b2b0-001c-3bb2-678d42dd721f +PDB GUID: 44bdfc1b-15e9-d045-8e33-ff7b62577121 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Assistive Technology Manager -PE Property[FileVersion]: 10.0.22621.7079 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.1554 (WinBuild.160101.0800) PE Property[InternalName]: ATBroker.exe PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: ATBroker.exe PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.7079 +PE Property[ProductVersion]: 10.0.22621.1554 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra atbroker-07.exe Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra atbroker-07.exe Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra atbroker-07.exe Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra atbroker-08.exe Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra atbroker-08.exe Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra atbroker-08.exe Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|1| |deleted_funcs_len|5| |modified_funcs_len|15| |added_symbols_len|3| |deleted_symbols_len|3| |diff_time|14.32227897644043| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 587, 'ExternalsName': 165, 'ExactBytesFunctionHasher': 2, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1})| |items_to_process|27| |diff_types|Counter({'refcount': 14, 'calling': 13, 'address': 1, 'code': 1, 'length': 1, 'called': 1})| |unmatched_funcs_len|6| |total_funcs_len|1190| |matched_funcs_len|1184| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|14| |matched_funcs_no_changes_len|1169| |match_func_similarity_percent|98.7331%| |func_match_overall_percent|99.4958%| |first_matches|Counter({'SymbolsHash': 587, 'ExactBytesFunctionHasher': 2, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 587 "ExternalsName" : 165 "ExactBytesFunctionHasher" : 2 "BulkInstructionHash" : 1 "SigCallingCalledHasher" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 587 "ExactBytesFunctionHasher" : 2 "BulkInstructionHash" : 1 "SigCallingCalledHasher" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 1 "deleted_funcs_len" : 5 "modified_funcs_len" : 15 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 3 "deleted_symbols_len" : 3 ``` ## Strings *No string differences found* # Deleted ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState ### Function Meta |Key|atbroker-07.exe| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState| |refcount|3| |length|371| |called|_guard_xfg_dispatch_icall_nop
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled| |paramcount|1| |address|140012fcc| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_2991529274> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState @@ -1,92 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ - -void __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState - (FeatureImpl<__WilFeatureTraits_Feature_2991529274> *this) - -{ - uint uVar1; - code *pcVar2; - uint uVar3; - uint uVar4; - uint uVar5; - uint *in_RDX; - uint uVar6; - bool bVar7; - int local_res8 [2]; - - uVar1 = *(uint *)this; - *in_RDX = uVar1; - if (((byte)uVar1 & 6) == 6) { - return; - } - uVar1 = DAT_14001ec34; - if (DAT_14001ec34 == 0) { - uVar1 = EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl - ((EnabledStateManager *)&g_enabledStateManager); - } - pcVar2 = (code *)g_wil_details_internalGetFeatureEnabledState; - if ((g_wil_details_internalGetFeatureEnabledState == 0) && - (pcVar2 = (code *)g_wil_details_apiGetFeatureEnabledState, - g_wil_details_apiGetFeatureEnabledState == 0)) { - uVar6 = 0; - } - else { - uVar6 = (*pcVar2)(0x39bcdf2,3,local_res8); - } - uVar3 = (((uVar6 & 3) << 2 | uVar6 & 0x40) << 2 | uVar6 & 0x80) << 3; - if ((uVar6 & 0xffffff3f) == 0) { - uVar3 = uVar3 | 0x40; - } - else { - uVar4 = 0; - if ((uVar6 & 0xffffff3f) == 2) { - uVar4 = 0x40; - } - uVar3 = uVar3 | uVar4; - } - bVar7 = false; - uVar6 = 1; - if ((uVar3 & 0xc00) == 0xc00) { - bVar7 = true; - } - else if ((uVar3 & 0x40) != 0) goto LAB_1400130bc; - if (((uVar3 & 0x40) == 0) || (!bVar7)) { - uVar6 = 0; - } -LAB_1400130bc: - uVar6 = uVar6 | uVar3; - uVar3 = *in_RDX; - do { - uVar5 = uVar3; - *in_RDX = uVar5; - uVar4 = uVar5; - if ((local_res8[0] != 0) && ((uVar5 & 2) == 0)) { - uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar5 | 2; - *in_RDX = uVar4; - } - if ((uVar5 & 4) == 0) { - uVar4 = uVar4 ^ (uVar6 ^ uVar4) & 0x400 | 4; - *in_RDX = uVar4; - } - LOCK(); - uVar3 = *(uint *)this; - bVar7 = uVar5 == uVar3; - if (bVar7) { - *(uint *)this = uVar4; - uVar3 = uVar5; - } - UNLOCK(); - } while (!bVar7); - if ((uVar5 & 4) == 0) { - SubscribeFeatureStateCacheToConfigurationChanges((wil_details_FeatureStateCache *)this,3,uVar1); - } - if ((*in_RDX & 2) == 0) { - *in_RDX = *in_RDX ^ (*in_RDX ^ uVar6) & 0x9c1; - } - return; -} - ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState ### Function Meta |Key|atbroker-07.exe| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState| |refcount|3| |length|371| |called|_guard_xfg_dispatch_icall_nop
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |calling|wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled| |paramcount|1| |address|140013148| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl<__WilFeatureTraits_Feature_575610170> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState @@ -1,92 +0,0 @@ - -/* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ - -void __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState - (FeatureImpl<__WilFeatureTraits_Feature_575610170> *this) - -{ - uint uVar1; - code *pcVar2; - uint uVar3; - uint uVar4; - uint uVar5; - uint *in_RDX; - uint uVar6; - bool bVar7; - int local_res8 [2]; - - uVar1 = *(uint *)this; - *in_RDX = uVar1; - if (((byte)uVar1 & 6) == 6) { - return; - } - uVar1 = DAT_14001ec34; - if (DAT_14001ec34 == 0) { - uVar1 = EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl - ((EnabledStateManager *)&g_enabledStateManager); - } - pcVar2 = (code *)g_wil_details_internalGetFeatureEnabledState; - if ((g_wil_details_internalGetFeatureEnabledState == 0) && - (pcVar2 = (code *)g_wil_details_apiGetFeatureEnabledState, - g_wil_details_apiGetFeatureEnabledState == 0)) { - uVar6 = 0; - } - else { - uVar6 = (*pcVar2)(0x39bcdd6,3,local_res8); - } - uVar3 = (((uVar6 & 3) << 2 | uVar6 & 0x40) << 2 | uVar6 & 0x80) << 3; - if ((uVar6 & 0xffffff3f) == 0) { - uVar3 = uVar3 | 0x40; - } - else { - uVar4 = 0; - if ((uVar6 & 0xffffff3f) == 2) { - uVar4 = 0x40; - } - uVar3 = uVar3 | uVar4; - } - bVar7 = false; - uVar6 = 1; - if ((uVar3 & 0xc00) == 0xc00) { - bVar7 = true; - } - else if ((uVar3 & 0x40) != 0) goto LAB_140013238; - if (((uVar3 & 0x40) == 0) || (!bVar7)) { - uVar6 = 0; - } -LAB_140013238: - uVar6 = uVar6 | uVar3; - uVar3 = *in_RDX; - do { - uVar5 = uVar3; - *in_RDX = uVar5; - uVar4 = uVar5; - if ((local_res8[0] != 0) && ((uVar5 & 2) == 0)) { - uVar4 = (uVar5 ^ uVar6) & 0x9c1 ^ uVar5 | 2; - *in_RDX = uVar4; - } - if ((uVar5 & 4) == 0) { - uVar4 = uVar4 ^ (uVar6 ^ uVar4) & 0x400 | 4; - *in_RDX = uVar4; - } - LOCK(); - uVar3 = *(uint *)this; - bVar7 = uVar5 == uVar3; - if (bVar7) { - *(uint *)this = uVar4; - uVar3 = uVar5; - } - UNLOCK(); - } while (!bVar7); - if ((uVar5 & 4) == 0) { - SubscribeFeatureStateCacheToConfigurationChanges((wil_details_FeatureStateCache *)this,3,uVar1); - } - if ((*in_RDX & 2) == 0) { - *in_RDX = *in_RDX ^ (*in_RDX ^ uVar6) & 0x9c1; - } - return; -} - ``` ## SettingsCopier::SetRegKeyValue ### Function Meta |Key|atbroker-07.exe| | :---: | :---: | |name|SetRegKeyValue| |fullname|SettingsCopier::SetRegKeyValue| |refcount|2| |length|407| |called|ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegQueryValueExW
KERNEL32.DLL::RegCreateKeyExW
KERNEL32.DLL::RegSetValueExW| |calling|SettingsCopier::CopyATSettings| |paramcount|6| |address|140013b68| |sig|long __cdecl SetRegKeyValue(HKEY__ * param_1, ushort * param_2, ushort * param_3, ulong param_4, uchar * param_5, ulong param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- SettingsCopier::SetRegKeyValue +++ SettingsCopier::SetRegKeyValue @@ -1,60 +0,0 @@ - -/* private: static long __cdecl SettingsCopier::SetRegKeyValue(struct HKEY__ * __ptr64,unsigned - short const * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned char const * - __ptr64,unsigned long) */ - -long __cdecl -SettingsCopier::SetRegKeyValue - (HKEY__ *param_1,ushort *param_2,ushort *param_3,ulong param_4,uchar *param_5, - ulong param_6) - -{ - uint uVar1; - bool bVar2; - DWORD local_28 [4]; - HKEY local_18; - HKEY local_10; - - local_10 = (HKEY)0x0; - local_18 = (HKEY)0x0; - local_28[1] = 0; - local_28[0] = 0; - local_28[2] = 0; - uVar1 = RegCreateKeyExW(param_1,(LPCWSTR)param_2,0,(LPWSTR)0x0,1,0x2001f, - (LPSECURITY_ATTRIBUTES)0x0,&local_10,local_28 + 1); - if (uVar1 != 0) { -LAB_140013be0: - if (-1 < (int)uVar1) { - uVar1 = uVar1 & 0xffff | 0x80070000; - } - return uVar1; - } - RegCloseKey(local_10); - uVar1 = RegOpenKeyExW(param_1,(LPCWSTR)param_2,8,0x2001f,&local_18); - if (uVar1 != 0) goto LAB_140013be0; - uVar1 = RegQueryValueExW(local_18,L"SymbolicLinkValue",(LPDWORD)0x0,local_28,(LPBYTE)0x0, - local_28 + 2); - if (uVar1 == 0) { - if (local_28[0] == 6) { - RegCloseKey(local_18); - return -0x7ff8fa48; - } - } - else if (uVar1 != 2) { - RegCloseKey(local_18); - bVar2 = uVar1 == 0; - goto LAB_140013c78; - } - uVar1 = RegSetValueExW(local_18,(LPCWSTR)param_3,0,param_4,param_5,param_6); - RegCloseKey(local_18); - bVar2 = false; - if (uVar1 == 0) { - return 0; - } -LAB_140013c78: - if (bVar2 || (int)uVar1 < 0) { - return uVar1; - } - return uVar1 & 0xffff | 0x80070000; -} - ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled ### Function Meta |Key|atbroker-07.exe| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled| |refcount|2| |length|141| |called|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|SettingsCopier::CopyATSettings| |paramcount|1| |address|140013d08| |sig|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_2991529274> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled @@ -1,35 +0,0 @@ - -/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ - -bool __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled - (FeatureImpl<__WilFeatureTraits_Feature_2991529274> *this) - -{ - undefined8 *puVar1; - uint uVar2; - bool bVar3; - undefined4 local_res8; - undefined1 local_resc; - undefined8 local_res10; - wil_ReportingKind in_stack_ffffffffffffffe8; - __uint64 in_stack_fffffffffffffff0; - - GetCachedFeatureEnabledState(this); - uVar2 = *(uint *)this; - bVar3 = (bool)((byte)local_res10 & 1); - if ((uVar2 & 4) == 0) { - puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); - local_res10 = *puVar1; - uVar2 = (uint)local_res10; - } - local_res8 = 0; - local_resc = 2; - ReportUsageToService - ((wil_details_FeatureReportingCache *)(this + 8),0x39bcdf2,uVar2 >> 10 & 1, - uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3, - in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0); - return bVar3; -} - ``` ## wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled ### Function Meta |Key|atbroker-07.exe| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled| |refcount|3| |length|141| |called|wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|SettingsCopier::CopyATSettings| |paramcount|1| |address|140013d9c| |sig|bool __thiscall __private_IsEnabled(FeatureImpl<__WilFeatureTraits_Feature_575610170> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled +++ wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled @@ -1,35 +0,0 @@ - -/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ - -bool __thiscall -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled - (FeatureImpl<__WilFeatureTraits_Feature_575610170> *this) - -{ - undefined8 *puVar1; - uint uVar2; - bool bVar3; - undefined4 local_res8; - undefined1 local_resc; - undefined8 local_res10; - wil_ReportingKind in_stack_ffffffffffffffe8; - __uint64 in_stack_fffffffffffffff0; - - GetCachedFeatureEnabledState(this); - uVar2 = *(uint *)this; - bVar3 = (bool)((byte)local_res10 & 1); - if ((uVar2 & 4) == 0) { - puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); - local_res10 = *puVar1; - uVar2 = (uint)local_res10; - } - local_res8 = 0; - local_resc = 2; - ReportUsageToService - ((wil_details_FeatureReportingCache *)(this + 8),0x39bcdd6,uVar2 >> 10 & 1, - uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3, - in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0); - return bVar3; -} - ``` # Added ## `SettingsCopier::CopyATSettings'::__l1::dtor$1 ### Function Meta |Key|atbroker-08.exe| | :---: | :---: | |name|dtor$1| |fullname|`SettingsCopier::CopyATSettings'::__l1::dtor$1| |refcount|0| |length|12| |called|ATL::CRegKey::~CRegKey| |calling|| |paramcount|2| |address|140016120| |sig|undefined __fastcall dtor$1(undefined8 param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- `SettingsCopier::CopyATSettings'::__l1::dtor$1 +++ `SettingsCopier::CopyATSettings'::__l1::dtor$1 @@ -0,0 +1,8 @@ + +void `SettingsCopier::CopyATSettings'::__l1::dtor_1(undefined8 param_1,longlong param_2) + +{ + ATL::CRegKey::~CRegKey((CRegKey *)(param_2 + 0xa8)); + return; +} + ``` # Modified *Modified functions contain code changes* ## SettingsCopier::CopyATSettings ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|code,length,called| |ratio|0.11| |i_ratio|0.2| |m_ratio|0.87| |b_ratio|0.19| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|CopyATSettings|CopyATSettings| |fullname|SettingsCopier::CopyATSettings|SettingsCopier::CopyATSettings| |refcount|3|3| |`length`|1333|1043| |`called`|
Expand for full list:
ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ATL::CRegKey::Create
ATManager::GetAccommodations
CATUtils::IsInteractiveUser
KERNEL32.DLL::RegDeleteTreeW
KERNEL32.DLL::RegEnumValueW
KERNEL32.DLL::RegSetValueExW
MSVCRT.DLL::_wcsnicmp
MSVCRT.DLL::free
MSVCRT.DLL::mallocSettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::SetRegKeyValue
WPP_SF_D
__security_check_cookie
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled
wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled
wil::details::in1diag3::Return_Hr
|
Expand for full list:
ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegQueryValueExW
ATManager::GetAccommodations
CATUtils::IsInteractiveUser
KERNEL32.DLL::RegCreateKeyExW
KERNEL32.DLL::RegSetValueExW
MSVCRT.DLL::_wcsnicmp
MSVCRT.DLL::free
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValueWPP_SF_D
__security_check_cookie
| |calling|SettingsCopier::InteractiveDesktopCopy
SettingsCopier::LockedDesktopCopy|SettingsCopier::InteractiveDesktopCopy
SettingsCopier::LockedDesktopCopy| |paramcount|3|3| |address|1400124f0|1400124f0| |sig|long __thiscall CopyATSettings(SettingsCopier * this, CRegKey * param_1, CRegKey * param_2)|long __thiscall CopyATSettings(SettingsCopier * this, CRegKey * param_1, CRegKey * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SettingsCopier::CopyATSettings Called Diff ```diff --- SettingsCopier::CopyATSettings called +++ SettingsCopier::CopyATSettings called @@ -3 +3 @@ -ATL::CRegKey::Create +ADVAPI32.DLL::RegQueryValueExW @@ -6,2 +6 @@ -KERNEL32.DLL::RegDeleteTreeW -KERNEL32.DLL::RegEnumValueW +KERNEL32.DLL::RegCreateKeyExW @@ -11 +9,0 @@ -MSVCRT.DLL::malloc @@ -14 +11,0 @@ -SettingsCopier::SetRegKeyValue @@ -17,3 +13,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled -wil::details::in1diag3::Return_Hr ``` ### SettingsCopier::CopyATSettings Diff ```diff --- SettingsCopier::CopyATSettings +++ SettingsCopier::CopyATSettings @@ -1,248 +1,202 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Type propagation algorithm not settling */ /* private: long __cdecl SettingsCopier::CopyATSettings(class ATL::CRegKey & __ptr64,class ATL::CRegKey & __ptr64) __ptr64 */ long __thiscall SettingsCopier::CopyATSettings(SettingsCopier *this,CRegKey *param_1,CRegKey *param_2) { undefined8 *puVar1; undefined8 *puVar2; - undefined1 auVar3 [16]; - CRegKey *pCVar4; - undefined8 hKey; - bool bVar5; - long lVar6; - int iVar7; - LSTATUS LVar8; - CAtlList_> *pCVar9; - _SECURITY_ATTRIBUTES *p_Var10; - HKEY pHVar11; - _SECURITY_ATTRIBUTES *p_Var12; - undefined2 uVar13; - undefined **ppuVar14; - HKEY pHVar15; - uint uVar16; - longlong lVar18; - ushort *puVar20; - HKEY pHVar21; - void *unaff_retaddr; - undefined1 auStackY_2f8 [32]; - HKEY in_stack_fffffffffffffd28; - _SECURITY_ATTRIBUTES *in_stack_fffffffffffffd38; - ulong local_2b8; - ulong local_2b4; - undefined1 local_2b0 [24]; + LPCWSTR lpSubKey; + HKEY hKey; + PHKEY lpData; + long lVar3; + int iVar4; + uint uVar5; + CAtlList_> *pCVar6; + undefined2 uVar7; + undefined **ppuVar8; + longlong lVar9; + ulong uVar11; + CRegKey *pCVar12; + bool bVar13; + bool bVar14; + undefined1 auStackY_318 [32]; + PHKEY in_stack_fffffffffffffd08; + HKEY local_2c8; + DWORD local_2c0; + ulong local_2bc; + ulong local_2b8 [2]; + PHKEY local_2b0; + DWORD local_2a8; + DWORD local_2a4; + HKEY local_2a0; CRegKey *local_298; - HKEY local_290; + CRegKey *local_290; undefined8 local_288; undefined8 local_280; - HKEY local_278; + undefined8 local_278; undefined8 local_270; undefined8 local_268; + undefined8 local_260; wchar_t local_258 [264]; ulonglong local_48; - HKEY pHVar17; - longlong lVar19; + longlong lVar10; - local_48 = __security_cookie ^ (ulonglong)auStackY_2f8; - local_2b0._16_8_ = param_1; + local_48 = __security_cookie ^ (ulonglong)auStackY_318; local_298 = param_2; - bVar5 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_575610170> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_575610170>::GetImpl(void)' - ::__l2::impl); - if (bVar5) { - lVar6 = DeleteATSettings(param_2); - param_2 = local_298; - if (lVar6 < 0) { - wil::details::in1diag3::Return_Hr - (unaff_retaddr,0x1fd,"enduser\\ezap\\easeofaccess\\atmanager\\settingscopier.cpp", - lVar6); - return lVar6; - } + local_290 = param_1; + lVar3 = DeleteATSettings(param_2); + if (lVar3 < 0) { + lVar3 = -0x7fffbffb; } else { - LVar8 = RegDeleteTreeW(*(HKEY *)param_2,(LPCWSTR)0x0); - if (LVar8 != 0) { - return -0x7fffbffb; - } - } - pCVar9 = ATManager::GetAccommodations(*(ATManager **)this); - puVar1 = *(undefined8 **)pCVar9; -joined_r0x0001400125a7: - do { - pCVar4 = param_2; - if (puVar1 == (undefined8 *)0x0) { - return 0; - } - pHVar17 = (HKEY)0x0; - puVar2 = (undefined8 *)puVar1[2]; - puVar1 = (undefined8 *)*puVar1; - param_2 = local_298; - } while (*(int *)((longlong)puVar2 + 0x44) == 0); - local_278 = (HKEY)0x0; - local_270 = 0; - local_268 = 0; - local_290 = (HKEY)0x0; - local_288 = 0; - local_280 = 0; - bVar5 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_575610170> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_575610170>::GetImpl(void)' - ::__l2::impl); - pHVar15 = pHVar17; - pHVar21 = pHVar17; - if (bVar5) { - do { - local_2b8 = 0; - local_2b4 = 0; - local_2b0._0_8_ = (HKEY)0x0; - in_stack_fffffffffffffd38 = (_SECURITY_ATTRIBUTES *)local_2b0; - lVar6 = GetRegKeyValue(*(HKEY__ **)param_1,(ushort *)*puVar2,(ulong)pHVar17, - (ushort *)local_258,(ulong)in_stack_fffffffffffffd28,&local_2b8, - (CHeapPtr *)in_stack_fffffffffffffd38 - ,&local_2b4); - pHVar11 = (HKEY)local_2b0._0_8_; - if (lVar6 == 1) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - uVar13 = 10; - lVar6 = 1; -LAB_0: - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar13, - &WPP_5da04c73fa1631631bfb3049d88d5700_Traceguids,lVar6); - pHVar11 = (HKEY)local_2b0._0_8_; - } -LAB_1: - free(pHVar11); - param_1 = (CRegKey *)local_2b0._16_8_; - break; - } - if (lVar6 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar13 = 0xb; - goto LAB_0; - } - goto LAB_1; - } - bVar5 = wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled - ((FeatureImpl<__WilFeatureTraits_Feature_2991529274> *) - &`private:_static_class_wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>&___ptr64___cdecl_wil::Feature<__WilFeatureTraits_Feature_2991529274>::GetImpl(void)' - ::__l2::impl); - if ((bVar5) && (iVar7 = CATUtils::IsInteractiveUser(), iVar7 == 0)) { - ppuVar14 = &PTR_u_StartExe_1400170e0; + pCVar6 = ATManager::GetAccommodations(*(ATManager **)this); + puVar1 = *(undefined8 **)pCVar6; +joined_r0x000140012557: + pCVar12 = param_2; + if (puVar1 != (undefined8 *)0x0) { + uVar11 = 0; + puVar2 = (undefined8 *)puVar1[2]; + puVar1 = (undefined8 *)*puVar1; + param_2 = pCVar12; + if (*(int *)((longlong)puVar2 + 0x44) != 0) { + local_288 = 0; + local_280 = 0; + local_278 = 0; + local_270 = 0; + local_268 = 0; + local_260 = 0; do { - lVar18 = -1; - do { - lVar19 = lVar18; - lVar18 = lVar19 + 1; - } while (*(wchar_t *)((longlong)*ppuVar14 + lVar18 * 2) != L'\0'); - iVar7 = _wcsnicmp(local_258,(wchar_t *)*ppuVar14,lVar19 + 2); - if (iVar7 == 0) { - pHVar11 = (HKEY)local_2b0._0_8_; + local_2b8[0] = 0; + local_2bc = 0; + local_2b0 = (PHKEY)0x0; + lVar3 = GetRegKeyValue(*(HKEY__ **)param_1,(ushort *)*puVar2,uVar11,(ushort *)local_258, + (ulong)in_stack_fffffffffffffd08,local_2b8, + (CHeapPtr *)&local_2b0,&local_2bc + ); + if (lVar3 == 1) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, - &WPP_5da04c73fa1631631bfb3049d88d5700_Traceguids,lVar6); - pHVar11 = (HKEY)local_2b0._0_8_; - } - goto LAB_2; - } - ppuVar14 = ppuVar14 + 1; - } while ((IMAGE_LOAD_CONFIG_DIRECTORY64 *)ppuVar14 != &_load_config_used); + uVar7 = 10; + lVar3 = 1; +LAB_0: + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_52f2c25973ba3ab773056b23ddbc5b5b_Traceguids,lVar3); + } +LAB_1: + free(local_2b0); + param_1 = local_290; + param_2 = local_298; + break; + } + if (lVar3 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + uVar7 = 0xb; + goto LAB_0; + } + goto LAB_1; + } + iVar4 = CATUtils::IsInteractiveUser(); + if (iVar4 == 0) { + ppuVar8 = &PTR_u_StartExe_1400170e0; + do { + lVar9 = -1; + do { + lVar10 = lVar9; + lVar9 = lVar10 + 1; + } while (*(wchar_t *)((longlong)*ppuVar8 + lVar9 * 2) != L'\0'); + iVar4 = _wcsnicmp(local_258,(wchar_t *)*ppuVar8,lVar10 + 2); + if (iVar4 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, + &WPP_52f2c25973ba3ab773056b23ddbc5b5b_Traceguids,lVar3); + } + free(local_2b0); + goto LAB_2; + } + ppuVar8 = ppuVar8 + 1; + } while ((IMAGE_LOAD_CONFIG_DIRECTORY64 *)ppuVar8 != &_load_config_used); + } + lpSubKey = (LPCWSTR)*puVar2; + hKey = *(HKEY *)pCVar12; + local_2a0 = (HKEY)0x0; + local_2c8 = (HKEY)0x0; + local_2a8 = 0; + local_2c0 = 0; + local_2a4 = 0; + in_stack_fffffffffffffd08 = (PHKEY)0x1; + uVar5 = RegCreateKeyExW(hKey,lpSubKey,0,(LPWSTR)0x0,1,0x2001f,(LPSECURITY_ATTRIBUTES)0x0, + &local_2a0,&local_2a8); + lpData = local_2b0; + bVar13 = false; + if (uVar5 == 0) { + RegCloseKey(local_2a0); + in_stack_fffffffffffffd08 = &local_2c8; + uVar5 = RegOpenKeyExW(hKey,lpSubKey,8,0x2001f,in_stack_fffffffffffffd08); + bVar13 = uVar5 == 0; + if (!bVar13) goto LAB_3; + in_stack_fffffffffffffd08 = (PHKEY)0x0; + uVar5 = RegQueryValueExW(local_2c8,L"SymbolicLinkValue",(LPDWORD)0x0,&local_2c0, + (LPBYTE)0x0,&local_2a4); + if (uVar5 == 0) { + if (local_2c0 != 6) goto LAB_4; + RegCloseKey(local_2c8); + uVar5 = 0x800705b8; + goto LAB_5; + } + if (uVar5 != 2) { + RegCloseKey(local_2c8); + bVar13 = uVar5 == 0; +LAB_6: + bVar14 = (int)uVar5 < 0; + if (!bVar13 && !bVar14) goto LAB_7; + goto LAB_8; + } +LAB_4: + in_stack_fffffffffffffd08 = lpData; + uVar5 = RegSetValueExW(local_2c8,local_258,0,local_2b8[0],(BYTE *)lpData,local_2bc); + RegCloseKey(local_2c8); + bVar13 = uVar5 == 0; + if (!bVar13) goto LAB_6; + } + else { +LAB_3: + if (!bVar13 && -1 < (int)uVar5) { +LAB_7: + uVar5 = uVar5 & 0xffff | 0x80070000; + } + bVar14 = (int)uVar5 < 0; +LAB_8: + if (bVar14) { +LAB_5: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd, + &WPP_52f2c25973ba3ab773056b23ddbc5b5b_Traceguids,uVar5); + } + free(lpData); + param_1 = local_290; + param_2 = local_298; + break; + } + } + free(lpData); + pCVar12 = local_298; +LAB_2: + uVar11 = uVar11 + 1; + param_1 = local_290; + param_2 = local_298; + } while (uVar11 < 0x65); } - pHVar11 = (HKEY)local_2b0._0_8_; - in_stack_fffffffffffffd28 = (HKEY)local_2b0._0_8_; - lVar6 = SetRegKeyValue(*(HKEY__ **)local_298,(ushort *)*puVar2,(ushort *)local_258,local_2b8, - (uchar *)local_2b0._0_8_,local_2b4); - if (lVar6 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd, - &WPP_5da04c73fa1631631bfb3049d88d5700_Traceguids,lVar6); - } - goto LAB_1; - } -LAB_2: - free(pHVar11); - uVar16 = (ulong)pHVar17 + 1; - pHVar17 = (HKEY)(ulonglong)uVar16; - param_1 = (CRegKey *)local_2b0._16_8_; - } while (uVar16 < 0x65); + goto joined_r0x000140012557; + } + lVar3 = 0; } - else { - local_2b0._0_8_ = (HKEY)0x0; - in_stack_fffffffffffffd28 = (HKEY)local_2b0; - puVar20 = (ushort *)0x20019; - LVar8 = RegOpenKeyExW(*(HKEY *)param_1,(LPCWSTR)*puVar2,0,0x20019, - (PHKEY)in_stack_fffffffffffffd28); - hKey = local_2b0._0_8_; - if (LVar8 == 0) { - local_278 = (HKEY)local_2b0._0_8_; - in_stack_fffffffffffffd28 = (HKEY)0x1; - lVar6 = ATL::CRegKey::Create - ((CRegKey *)&local_290,*(HKEY__ **)pCVar4,(ushort *)*puVar2,puVar20,1, - 0x2001f,in_stack_fffffffffffffd38,&local_2b4); - pHVar15 = local_290; - pHVar21 = (HKEY)hKey; - if (lVar6 == 0) { - do { - local_2b4 = 0x104; - local_2b8 = 0; - local_2b0._0_8_ = (HKEY)0x0; - in_stack_fffffffffffffd38 = (_SECURITY_ATTRIBUTES *)0x0; - in_stack_fffffffffffffd28 = (HKEY)0x0; - uVar16 = (uint)pHVar17; - iVar7 = RegEnumValueW((HKEY)hKey,uVar16,local_258,&local_2b4,(LPDWORD)0x0, - (LPDWORD)(local_2b0 + 8),(LPBYTE)0x0,&local_2b8); - if ((iVar7 == 0) || (p_Var10 = (_SECURITY_ATTRIBUTES *)0x0, iVar7 == 0xea)) { - p_Var12 = (_SECURITY_ATTRIBUTES *)CONCAT44(0,local_2b8); - p_Var10 = (_SECURITY_ATTRIBUTES *)0x0; - if (((p_Var12 != (_SECURITY_ATTRIBUTES *)0x0) && - (auVar3._8_8_ = 0, auVar3._0_8_ = p_Var12, p_Var10 = p_Var12, - SUB168((ZEXT816(0) << 0x40 | ZEXT816(0xffffffffffffffff)) / auVar3,0) == 0)) || - (p_Var10 = malloc((size_t)p_Var10), p_Var10 == (_SECURITY_ATTRIBUTES *)0x0)) { - free((void *)0x0); - if (pHVar15 != (HKEY)0x0) { - RegCloseKey(pHVar15); - } - if ((HKEY)hKey != (HKEY)0x0) { - RegCloseKey((HKEY)hKey); - } - return -0x7ff8fff2; - } - local_2b4 = 0x104; - in_stack_fffffffffffffd28 = (HKEY)0x0; - in_stack_fffffffffffffd38 = p_Var10; - iVar7 = RegEnumValueW((HKEY)hKey,uVar16,local_258,&local_2b4,(LPDWORD)0x0, - (LPDWORD)(local_2b0 + 8),(LPBYTE)p_Var10,&local_2b8); - } - if (iVar7 == 0) { - RegSetValueExW(pHVar15,local_258,0,local_2b0._8_4_,(BYTE *)p_Var10,local_2b8); - } - else if ((iVar7 == 0x103) || (100 < uVar16)) goto LAB_3; - pHVar17 = (HKEY)(ulonglong)(uVar16 + 1); - free(p_Var10); - } while( true ); - } - } - } - goto LAB_4; -LAB_3: - free(p_Var10); -LAB_4: - if (pHVar15 != (HKEY)0x0) { - RegCloseKey(pHVar15); - } - param_2 = local_298; - if (pHVar21 != (HKEY)0x0) { - RegCloseKey(pHVar21); - param_2 = local_298; - } - goto joined_r0x0001400125a7; + return lVar3; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## SubscribeFeatureStateCacheToConfigurationChanges ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::SubscribeFeatureStateCacheToConfigurationChanges|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |`refcount`|6|4| |length|154|154| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_LCTest>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_VoiceAccess>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl<__WilFeatureTraits_Feature_LCTest>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_VoiceAccess>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|3|3| |address|14000b434|14000b434| |sig|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SubscribeFeatureStateCacheToConfigurationChanges Calling Diff ```diff --- wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling +++ wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling @@ -1,2 +0,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState ``` ## MSVCRT.DLL::malloc ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|malloc|malloc| |fullname|MSVCRT.DLL::malloc|MSVCRT.DLL::malloc| |`refcount`|13|12| |length|0|0| |called||| |`calling`|ATL::CAtlList_>_>,ATL::CElementTraits_>_>_>_>::AddTail
ATManager::GetAccommodations
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::OpenSessionKey
StartList::CreateATProcess
StartList::CreateBreakawayATProcess
StartSoundAgent|ATL::CAtlList_>_>,ATL::CElementTraits_>_>_>_>::AddTail
ATManager::GetAccommodations
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::OpenSessionKey
StartList::CreateATProcess
StartList::CreateBreakawayATProcess
StartSoundAgent| |paramcount|1|1| |address|EXTERNAL:00000091|EXTERNAL:00000091| |sig|void * __cdecl malloc(size_t _Size)|void * __cdecl malloc(size_t _Size)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSVCRT.DLL::malloc Calling Diff ```diff --- MSVCRT.DLL::malloc calling +++ MSVCRT.DLL::malloc calling @@ -3 +2,0 @@ -SettingsCopier::CopyATSettings ``` ## ~CRegKey ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|~CRegKey|~CRegKey| |fullname|ATL::CRegKey::~CRegKey|ATL::CRegKey::~CRegKey| |`refcount`|15|16| |length|39|39| |called|ADVAPI32.DLL::RegCloseKey|ADVAPI32.DLL::RegCloseKey| |`calling`|
Expand for full list:
`ATManager::GetAccommodations'::__l1::dtor$0
`Accommodation::Open'::__l1::dtor$1
`SettingsCopier::CopyATSettings'::__l1::dtor$0
`SettingsCopier::InteractiveDesktopCopy'::__l1::dtor$0
`StartList::BuildConfigList'::__l1::dtor$2
`StartList::GetSessionTransitValue'::__l1::dtor$0
`StartList::HandleFirstTime'::__l1::dtor$2
`StartList::IsDesktopSwitch'::__l1::dtor$1
`StartList::LoadSettings'::__l1::dtor$0
`StartList::LoadSettings'::__l1::dtor$2
`StartList::LoadSettings'::__l1::dtor$5`StartList::LoadSettings'::__l1::dtor$8
`StartList::LoadSettings'::__l1::dtor$9
`StartList::SaveSessionKey'::__l1::dtor$1
|
Expand for full list:
`ATManager::GetAccommodations'::__l1::dtor$0
`Accommodation::Open'::__l1::dtor$1
`SettingsCopier::CopyATSettings'::__l1::dtor$0
`SettingsCopier::CopyATSettings'::__l1::dtor$1
`SettingsCopier::InteractiveDesktopCopy'::__l1::dtor$0
`StartList::BuildConfigList'::__l1::dtor$2
`StartList::GetSessionTransitValue'::__l1::dtor$0
`StartList::HandleFirstTime'::__l1::dtor$2
`StartList::IsDesktopSwitch'::__l1::dtor$1
`StartList::LoadSettings'::__l1::dtor$0
`StartList::LoadSettings'::__l1::dtor$2`StartList::LoadSettings'::__l1::dtor$5
`StartList::LoadSettings'::__l1::dtor$8
`StartList::LoadSettings'::__l1::dtor$9
`StartList::SaveSessionKey'::__l1::dtor$1
| |paramcount|1|1| |address|140002694|140002694| |sig|void __thiscall ~CRegKey(CRegKey * this)|void __thiscall ~CRegKey(CRegKey * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~CRegKey Calling Diff ```diff --- ATL::CRegKey::~CRegKey calling +++ ATL::CRegKey::~CRegKey calling @@ -3,0 +4 @@ +`SettingsCopier::CopyATSettings'::__l1::dtor$1 ``` ## Return_Hr ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|Return_Hr|Return_Hr| |fullname|wil::details::in1diag3::Return_Hr|wil::details::in1diag3::Return_Hr| |`refcount`|20|19| |length|30|30| |called|wil::details::ReportFailure_Hr<1>|wil::details::ReportFailure_Hr<1>| |`calling`|SetInboxATAutoStart
SettingsCopier::CopyATSettings
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal|SetInboxATAutoStart
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|4|4| |address|14000a8a4|14000a8a4| |sig|void __cdecl Return_Hr(void * param_1, uint param_2, char * param_3, long param_4)|void __cdecl Return_Hr(void * param_1, uint param_2, char * param_3, long param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Return_Hr Calling Diff ```diff --- wil::details::in1diag3::Return_Hr calling +++ wil::details::in1diag3::Return_Hr calling @@ -2 +1,0 @@ -SettingsCopier::CopyATSettings ``` ## KERNEL32.DLL::RegEnumValueW ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|RegEnumValueW|RegEnumValueW| |fullname|KERNEL32.DLL::RegEnumValueW|KERNEL32.DLL::RegEnumValueW| |`refcount`|5|3| |length|0|0| |called||| |`calling`|SettingsCopier::CopyATSettings
SettingsCopier::GetRegKeyValue|SettingsCopier::GetRegKeyValue| |paramcount|8|8| |address|EXTERNAL:0000002f|EXTERNAL:0000002f| |sig|LSTATUS __stdcall RegEnumValueW(HKEY hKey, DWORD dwIndex, LPWSTR lpValueName, LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|LSTATUS __stdcall RegEnumValueW(HKEY hKey, DWORD dwIndex, LPWSTR lpValueName, LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::RegEnumValueW Calling Diff ```diff --- KERNEL32.DLL::RegEnumValueW calling +++ KERNEL32.DLL::RegEnumValueW calling @@ -1 +0,0 @@ -SettingsCopier::CopyATSettings ``` ## ADVAPI32.DLL::RegCloseKey ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|RegCloseKey|RegCloseKey| |fullname|ADVAPI32.DLL::RegCloseKey|ADVAPI32.DLL::RegCloseKey| |`refcount`|67|63| |length|0|0| |called||| |`calling`|
Expand for full list:
ATL::CRegKey::Create
ATL::CRegKey::~CRegKey
ATManager::GetAccommodations
Accommodation::Open
ColorFiltering::ColorFilterHelper::IsActive
ColorFiltering::ColorFilterHelper::UpdateActiveFilter
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
GetHardwareLaunchATApp
IsWizardOnlyAccount
SettingsCopier::CopyATSettingsSettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::InteractiveDesktopCopy
SettingsCopier::LockedDesktopCopy
SettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
SettingsCopier::SetRegKeyValue
StartList::BuildConfigList
StartList::GetNarratorAfterSigninResetCompleted
StartList::GetSessionTransitValue
StartList::GetSessionValue
StartList::GetSettingConfigurationValue
StartList::GetTempValue
StartList::GetUserValue
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::SetTempValueToStart
StartList::StartSessionTransit
`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
wil::unique_any_t,HKEY__*___ptr64,HKEY__*___ptr64,0,std::nullptr_t>_>_>::~unique_any_t,HKEY__*___ptr64,HKEY__*___ptr64,0,std::nullptr_t>_>_>
|
Expand for full list:
ATL::CRegKey::Create
ATL::CRegKey::~CRegKey
ATManager::GetAccommodations
Accommodation::Open
ColorFiltering::ColorFilterHelper::IsActive
ColorFiltering::ColorFilterHelper::UpdateActiveFilter
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
GetHardwareLaunchATApp
IsWizardOnlyAccount
SettingsCopier::CopyATSettingsSettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::InteractiveDesktopCopy
SettingsCopier::LockedDesktopCopy
SettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
StartList::BuildConfigList
StartList::GetNarratorAfterSigninResetCompleted
StartList::GetSessionTransitValue
StartList::GetSessionValue
StartList::GetSettingConfigurationValue
StartList::GetTempValue
StartList::GetUserValue
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::SetTempValueToStart
StartList::StartSessionTransit
`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
wil::unique_any_t,HKEY__*___ptr64,HKEY__*___ptr64,0,std::nullptr_t>_>_>::~unique_any_t,HKEY__*___ptr64,HKEY__*___ptr64,0,std::nullptr_t>_>_>
| |paramcount|1|1| |address|EXTERNAL:00000014|EXTERNAL:00000014| |sig|LSTATUS __stdcall RegCloseKey(HKEY hKey)|LSTATUS __stdcall RegCloseKey(HKEY hKey)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegCloseKey Calling Diff ```diff --- ADVAPI32.DLL::RegCloseKey calling +++ ADVAPI32.DLL::RegCloseKey calling @@ -18 +17,0 @@ -SettingsCopier::SetRegKeyValue ``` ## EnsureSubscribedToFeatureConfigurationChangesImpl ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChangesImpl|EnsureSubscribedToFeatureConfigurationChangesImpl| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |`refcount`|6|4| |length|230|230| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::ReleaseSRWLockExclusive
_guard_xfg_dispatch_icall_nop
wil::unique_any_t,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>_>::operator&|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::ReleaseSRWLockExclusive
_guard_xfg_dispatch_icall_nop
wil::unique_any_t,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>_>::operator&| |`calling`|wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_LCTest>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_VoiceAccess>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl<__WilFeatureTraits_Feature_LCTest>::GetCachedFeatureEnabledState
wil::details::FeatureImpl<__WilFeatureTraits_Feature_VoiceAccess>::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|1|1| |address|140006e64|140006e64| |sig|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChangesImpl Calling Diff ```diff --- wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl calling +++ wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl calling @@ -1,2 +0,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::GetCachedFeatureEnabledState -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::GetCachedFeatureEnabledState ``` ## KERNEL32.DLL::RegDeleteTreeW ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|RegDeleteTreeW|RegDeleteTreeW| |fullname|KERNEL32.DLL::RegDeleteTreeW|KERNEL32.DLL::RegDeleteTreeW| |`refcount`|5|4| |length|0|0| |called||| |`calling`|ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings|ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
SettingsCopier::DeleteATSettings| |paramcount|2|2| |address|EXTERNAL:00000030|EXTERNAL:00000030| |sig|LSTATUS __stdcall RegDeleteTreeW(HKEY hKey, LPCWSTR lpSubKey)|LSTATUS __stdcall RegDeleteTreeW(HKEY hKey, LPCWSTR lpSubKey)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::RegDeleteTreeW Calling Diff ```diff --- KERNEL32.DLL::RegDeleteTreeW calling +++ KERNEL32.DLL::RegDeleteTreeW calling @@ -3 +2,0 @@ -SettingsCopier::CopyATSettings ``` ## MSVCRT.DLL::free ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|free|free| |fullname|MSVCRT.DLL::free|MSVCRT.DLL::free| |`refcount`|42|41| |length|0|0| |called||| |calling|
Expand for full list:
ATL::CAtlBaseModule::~CAtlBaseModule
ATL::CAtlList_>_>,ATL::CElementTraits_>_>_>_>::RemoveAll
ATL::CAtlList_>::RemoveAll
ATL::CAtlWinModule::~CAtlWinModule
ATL::CHeapPtr::~CHeapPtr
ATL::CHeapPtr::~CHeapPtr
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::OpenSessionKey
StartList::CreateATProcessStartList::CreateBreakawayATProcess
StartSoundAgent
|
Expand for full list:
ATL::CAtlBaseModule::~CAtlBaseModule
ATL::CAtlList_>_>,ATL::CElementTraits_>_>_>_>::RemoveAll
ATL::CAtlList_>::RemoveAll
ATL::CAtlWinModule::~CAtlWinModule
ATL::CHeapPtr::~CHeapPtr
ATL::CHeapPtr::~CHeapPtr
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValue
SettingsCopier::OpenSessionKey
StartList::CreateATProcessStartList::CreateBreakawayATProcess
StartSoundAgent
| |paramcount|1|1| |address|EXTERNAL:00000092|EXTERNAL:00000092| |sig|void __cdecl free(void * _Memory)|void __cdecl free(void * _Memory)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## KERNEL32.DLL::RegSetValueExW ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|RegSetValueExW|RegSetValueExW| |fullname|KERNEL32.DLL::RegSetValueExW|KERNEL32.DLL::RegSetValueExW| |`refcount`|14|13| |length|0|0| |called||| |`calling`|
Expand for full list:
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
SettingsCopier::CopyATSettings
SettingsCopier::SetRegKeyValue
StartList::GetTempValue
StartList::HandleFirstTime
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::SetTempValueToStart
StartList::StartSessionTransit`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
|
Expand for full list:
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
SettingsCopier::CopyATSettings
StartList::GetTempValue
StartList::HandleFirstTime
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::SetTempValueToStart
StartList::StartSessionTransit
`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
| |paramcount|6|6| |address|EXTERNAL:0000005a|EXTERNAL:0000005a| |sig|LSTATUS __stdcall RegSetValueExW(HKEY hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, BYTE * lpData, DWORD cbData)|LSTATUS __stdcall RegSetValueExW(HKEY hKey, LPCWSTR lpValueName, DWORD Reserved, DWORD dwType, BYTE * lpData, DWORD cbData)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::RegSetValueExW Calling Diff ```diff --- KERNEL32.DLL::RegSetValueExW calling +++ KERNEL32.DLL::RegSetValueExW calling @@ -4 +3,0 @@ -SettingsCopier::SetRegKeyValue ``` ## ADVAPI32.DLL::RegOpenKeyExW ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|RegOpenKeyExW|RegOpenKeyExW| |fullname|ADVAPI32.DLL::RegOpenKeyExW|ADVAPI32.DLL::RegOpenKeyExW| |`refcount`|32|31| |length|0|0| |called||| |`calling`|
Expand for full list:
ATManager::GetAccommodations
Accommodation::Open
ColorFiltering::ColorFilterHelper::IsActive
ColorFiltering::ColorFilterHelper::UpdateActiveFilter
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
GetHardwareLaunchATApp
IsWizardOnlyAccount
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValueSettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
SettingsCopier::SetRegKeyValue
StartList::BuildConfigList
StartList::GetNarratorAfterSigninResetCompleted
StartList::GetSessionTransitValue
StartList::GetSessionValue
StartList::GetSettingConfigurationValue
StartList::GetTempValue
StartList::GetUserValue
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::StartSessionTransit
`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
|
Expand for full list:
ATManager::GetAccommodations
Accommodation::Open
ColorFiltering::ColorFilterHelper::IsActive
ColorFiltering::ColorFilterHelper::UpdateActiveFilter
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsActive
ColorFiltering::ColorFilterHelper::UpdateTransferSettingsFilterType
GetHardwareLaunchATApp
IsWizardOnlyAccount
SettingsCopier::CopyATSettings
SettingsCopier::DeleteATSettings
SettingsCopier::GetRegKeyValueSettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
StartList::BuildConfigList
StartList::GetNarratorAfterSigninResetCompleted
StartList::GetSessionTransitValue
StartList::GetSessionValue
StartList::GetSettingConfigurationValue
StartList::GetTempValue
StartList::GetUserValue
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::LoadSettings
StartList::SaveSessionKey
StartList::SetNarratorAfterSigninResetCompleted
StartList::StartSessionTransit
`anonymous_namespace'::WriteAccessibilityConfigStringListToRegistry
| |paramcount|5|5| |address|EXTERNAL:00000005|EXTERNAL:00000005| |sig|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegOpenKeyExW Calling Diff ```diff --- ADVAPI32.DLL::RegOpenKeyExW calling +++ ADVAPI32.DLL::RegOpenKeyExW calling @@ -14 +13,0 @@ -SettingsCopier::SetRegKeyValue ``` ## Create ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|Create|Create| |fullname|ATL::CRegKey::Create|ATL::CRegKey::Create| |`refcount`|8|7| |length|166|166| |called|ADVAPI32.DLL::RegCloseKey
KERNEL32.DLL::RegCreateKeyExW|ADVAPI32.DLL::RegCloseKey
KERNEL32.DLL::RegCreateKeyExW| |`calling`|SettingsCopier::CopyATSettings
SettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::SaveSessionKey
StartList::SetTempValueToStart|SettingsCopier::OpenSessionKey
SettingsCopier::OpenUserConfigKey
StartList::HandleFirstTime
StartList::IsDesktopSwitch
StartList::SaveSessionKey
StartList::SetTempValueToStart| |paramcount|8|8| |address|14000464c|14000464c| |sig|long __thiscall Create(CRegKey * this, HKEY__ * param_1, ushort * param_2, ushort * param_3, ulong param_4, ulong param_5, _SECURITY_ATTRIBUTES * param_6, ulong * param_7)|long __thiscall Create(CRegKey * this, HKEY__ * param_1, ushort * param_2, ushort * param_3, ulong param_4, ulong param_5, _SECURITY_ATTRIBUTES * param_6, ulong * param_7)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Create Calling Diff ```diff --- ATL::CRegKey::Create calling +++ ATL::CRegKey::Create calling @@ -1 +0,0 @@ -SettingsCopier::CopyATSettings ``` ## ReportUsageToService ### Match Info |Key|atbroker-07.exe - atbroker-08.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|atbroker-07.exe|atbroker-08.exe| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|5|3| |length|158|158| |called|_guard_xfg_dispatch_icall_nop
wil::details::ReportUsageToServiceDirect|_guard_xfg_dispatch_icall_nop
wil::details::ReportUsageToServiceDirect| |`calling`|`anonymous_namespace'::GetNameOfInboxAT
wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled
wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled|`anonymous_namespace'::GetNameOfInboxAT| |paramcount|8|8| |address|14000a494|14000a494| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -2,2 +1,0 @@ -wil::details::FeatureImpl<__WilFeatureTraits_Feature_2991529274>::__private_IsEnabled -wil::details::FeatureImpl<__WilFeatureTraits_Feature_575610170>::__private_IsEnabled ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-26T22:52:09