# cim_8737.sys-cim_8875.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_4078681401__private_IsEnabledDeviceUsageNoInline](#feature_4078681401__private_isenableddeviceusagenoinline)
	* [Feature_4078681401__private_IsEnabledFallback](#feature_4078681401__private_isenabledfallback)
* [Modified](#modified)
	* [CimFs::DispatchVolumeDirectoryControl](#cimfsdispatchvolumedirectorycontrol)
	* [CimFs::DriverUnload](#cimfsdriverunload)
	* [CimFs::NotifyChangeDirectory](#cimfsnotifychangedirectory)
	* [Cp_DriverEntry](#cp_driverentry)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
	* [wil_InitializeFeatureStaging](#wil_initializefeaturestaging)
	* [ProcessTraceStatusOrigin](#processtracestatusorigin)
	* [NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification](#ntoskrnlexertlunregisterfeatureconfigurationchangenotification)
	* [NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider](#ntoskrnlexertlunregisterfeatureusageprovider)
	* [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag)

# Visual Chart Diff



```mermaid

flowchart LR

CimFsDispatchVolumeDirectoryControl-2-old<--Match 72%-->CimFsDispatchVolumeDirectoryControl-2-new
CimFsDriverUnload-1-old<--Match 69%-->CimFsDriverUnload-1-new
CimFsNotifyChangeDirectory-2-old<--Match 75%-->CimFsNotifyChangeDirectory-2-new
Cp_DriverEntry-1-old<--Match 90%-->Cp_DriverEntry-1-new

subgraph cim_8875.sys
    CimFsDispatchVolumeDirectoryControl-2-new
CimFsDriverUnload-1-new
CimFsNotifyChangeDirectory-2-new
Cp_DriverEntry-1-new
    subgraph Added
direction LR
Feature_4078681401__private_IsEnabledDeviceUsageNoInline
    Feature_4078681401__private_IsEnabledFallback
end
end

subgraph cim_8737.sys
    CimFsDispatchVolumeDirectoryControl-2-old
CimFsDriverUnload-1-old
CimFsNotifyChangeDirectory-2-old
Cp_DriverEntry-1-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.8305%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 1178
```



```mermaid
pie showData
    title Matched Function Similarity - 99.1511%
"matched_funcs_with_code_changes_len" : 4
"matched_funcs_with_non_code_changes_len" : 6
"matched_funcs_no_changes_len" : 1168
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cim_8737.sys cim_8875.sys
```


#### Verbose Args


<details>

```
--old ['cim_8737.sys'] --new [['cim_8875.sys']] --engine VersionTrackingDiff --output-path cim_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/cimfs.sys/FB93563F43000/cimfs.sys -O cimfs.sys.x64.10.0.26100.8737
wget https://msdl.microsoft.com/download/symbols/cimfs.sys/70F5247143000/cimfs.sys -O cimfs.sys.x64.10.0.26100.8875
```


## Binary Metadata Diff


```diff
--- cim_8737.sys Meta
+++ cim_8875.sys Meta
@@ -1,44 +1,44 @@
-Program Name: cim_8737.sys
+Program Name: cim_8875.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
 # of Bytes: 280656
 # of Memory Blocks: 13
-# of Instructions: 43673
-# of Defined Data: 2067
-# of Functions: 589
-# of Symbols: 8141
-# of Data Types: 445
+# of Instructions: 43780
+# of Defined Data: 2077
+# of Functions: 591
+# of Symbols: 8148
+# of Data Types: 440
 # of Data Type Categories: 37
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Fri Aug 21 21:36:48 SGT 2026
+Date Created: Fri Aug 21 21:36:51 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /tmp/cim/cim_8737.sys
-Executable MD5: a15c282e86b5b2a9b6e3cc52e4a1b931
-Executable SHA256: 316bd8c4290bc933b597d63579ec03fbc835249ba2fd57aaec4e3bbf3187f400
-FSRL: file:///tmp/cim/cim_8737.sys?MD5=a15c282e86b5b2a9b6e3cc52e4a1b931
+Executable Location: /tmp/cim/cim_8875.sys
+Executable MD5: 5f22c479f87ded566d5016f27e52017f
+Executable SHA256: b2c0de4ced045cada8953b4524a198792c5f686f2f83cf295164171a3efd487e
+FSRL: file:///tmp/cim/cim_8875.sys?MD5=5f22c479f87ded566d5016f27e52017f
 PDB Age: 1
 PDB File: cimfs.pdb
-PDB GUID: 004d524c-679d-8786-456a-4467fda53b60
+PDB GUID: 633e09ab-80bc-f471-0e1d-d84483de97b4
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: CimFS driver
-PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800)
 PE Property[InternalName]: cimfs.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: cimfs.sys
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.8737
+PE Property[ProductVersion]: 10.0.26100.8875
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra cim_8737.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra cim_8737.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra cim_8737.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra cim_8875.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra cim_8875.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra cim_8875.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|10|
|added_symbols_len|4|
|deleted_symbols_len|3|
|diff_time|3.069775104522705|
|deleted_strings_len|1|
|added_strings_len|5|
|match_types|Counter({'SymbolsHash': 578, 'ExternalsName': 159, 'ExactInstructionsFunctionHasher': 7, 'ExactBytesFunctionHasher': 3})|
|items_to_process|19|
|diff_types|Counter({'address': 8, 'refcount': 6, 'calling': 6, 'code': 4, 'length': 4, 'called': 4, 'sig': 1})|
|unmatched_funcs_len|2|
|total_funcs_len|1180|
|matched_funcs_len|1178|
|matched_funcs_with_code_changes_len|4|
|matched_funcs_with_non_code_changes_len|6|
|matched_funcs_no_changes_len|1168|
|match_func_similarity_percent|99.1511%|
|func_match_overall_percent|99.8305%|
|first_matches|Counter({'SymbolsHash': 578, 'ExactInstructionsFunctionHasher': 7, 'ExactBytesFunctionHasher': 3})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 578
"ExternalsName" : 159
"ExactBytesFunctionHasher" : 3
"ExactInstructionsFunctionHasher" : 7
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 578
"ExactBytesFunctionHasher" : 3
"ExactInstructionsFunctionHasher" : 7
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 10
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 4
"deleted_symbols_len" : 3
```

## Strings



```mermaid
pie showData
    title Strings
"deleted_strings_len" : 1
"added_strings_len" : 5
```

### Strings Diff


```diff
--- deleted strings
+++ added strings
@@ -1 +1,5 @@
-s_blockcim
+s_ORIGIN:_FileObject_is_not_a_dir
+s_blockcim$
+u_DATA
+u_NDEX_ALLOCATION
+u_imfs

```


### String References

#### Old



|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|s_blockcim_1400317a8|5|Create,PerformBlockDeviceValidations|

#### New



|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|s_blockcim$_1400317e8|5|Create,PerformBlockDeviceValidations|
|s_ORIGIN:_FileObject_is_not_a_dir|3|NotifyChangeDirectory,DispatchVolumeDirectoryControl|
|u_NDEX_ALLOCATION_1400317f4|1|ParseName|
|u_DATA_14003199c|1|operator()|
|u_imfs_140031f9a|1|QueryVolume|

# Deleted

# Added

## Feature_4078681401__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|cim_8875.sys|
| :---: | :---: |
|name|Feature_4078681401__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_4078681401__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_4078681401__private_IsEnabledFallback|
|calling|CimFs::DispatchVolumeDirectoryControl<br>CimFs::NotifyChangeDirectory|
|paramcount|0|
|address|14000e854|
|sig|ulonglong __fastcall Feature_4078681401__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4078681401__private_IsEnabledDeviceUsageNoInline
+++ Feature_4078681401__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_4078681401__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+  ulonglong uVar1;
+  undefined8 local_res8;
+  
+  local_res8 = (ulonglong)Feature_4078681401__private_featureState;
+  if ((Feature_4078681401__private_featureState & 0x10) == 0) {
+    uVar1 = Feature_4078681401__private_IsEnabledFallback(local_res8,3);
+  }
+  else {
+    uVar1 = (ulonglong)(Feature_4078681401__private_featureState & 1);
+  }
+  return uVar1;
+}
+

```


## Feature_4078681401__private_IsEnabledFallback

### Function Meta



|Key|cim_8875.sys|
| :---: | :---: |
|name|Feature_4078681401__private_IsEnabledFallback|
|fullname|Feature_4078681401__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_4078681401__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|14000e88c|
|sig|undefined __fastcall Feature_4078681401__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4078681401__private_IsEnabledFallback
+++ Feature_4078681401__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_4078681401__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_4078681401__private_descriptor);
+  return;
+}
+

```


# Modified


*Modified functions contain code changes*
## CimFs::DispatchVolumeDirectoryControl

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.7|
|i_ratio|0.67|
|m_ratio|0.99|
|b_ratio|0.72|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|DispatchVolumeDirectoryControl|DispatchVolumeDirectoryControl|
|fullname|CimFs::DispatchVolumeDirectoryControl|CimFs::DispatchVolumeDirectoryControl|
|refcount|2|2|
|`length`|2046|2104|
|`called`|<details><summary>Expand for full list:<br>Cim::FileSystem::QueryDirectory<br>CimFs::DirectoryQueryCursor::~DirectoryQueryCursor<br>CimFs::NotifyChangeDirectory<br>CimFs::ProcessTraceStatusFromApi<br>CimFs::ProcessTraceStatusOrigin<br>CimFs::StackEventTracer::StackEventTracer<br>CimFs::StackEventTracer::~StackEventTracer<br>FsFltWil::AcquirePushLockExclusive<br>FsFltWil::Details::ReleasePushLockExclusive<br>FsFltWil::MakeUnique<struct_CimFs::DirectoryQueryCursor,0><br>FsFltWil::MakeUnique<wchar_t_[0],0></summary>NTOSKRNL.EXE::ExFreePoolWithTag<br>__security_check_cookie<br>gsl::copy<wchar_t,-1,wchar_t,-1><br>gsl::details::terminate</details>|<details><summary>Expand for full list:<br>Cim::FileSystem::QueryDirectory<br>CimFs::DirectoryQueryCursor::~DirectoryQueryCursor<br>CimFs::NotifyChangeDirectory<br>CimFs::ProcessTraceStatusFromApi<br>CimFs::ProcessTraceStatusOrigin<br>CimFs::StackEventTracer::StackEventTracer<br>CimFs::StackEventTracer::~StackEventTracer<br>Feature_4078681401__private_IsEnabledDeviceUsageNoInline<br>FsFltWil::AcquirePushLockExclusive<br>FsFltWil::Details::ReleasePushLockExclusive<br>FsFltWil::MakeUnique<struct_CimFs::DirectoryQueryCursor,0></summary>FsFltWil::MakeUnique<wchar_t_[0],0><br>NTOSKRNL.EXE::ExFreePoolWithTag<br>__security_check_cookie<br>gsl::copy<wchar_t_const_,-1,wchar_t,-1><br>gsl::details::terminate</details>|
|calling|CimFs::DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeDirectoryControl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>|CimFs::DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeDirectoryControl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>|
|paramcount|2|2|
|`address`|140008a8c|140008d40|
|sig|long __cdecl DispatchVolumeDirectoryControl(VolumeDevice * param_1, _IRP * param_2)|long __cdecl DispatchVolumeDirectoryControl(VolumeDevice * param_1, _IRP * param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### CimFs::DispatchVolumeDirectoryControl Called Diff


```diff
--- CimFs::DispatchVolumeDirectoryControl called
+++ CimFs::DispatchVolumeDirectoryControl called
@@ -7,0 +8 @@
+Feature_4078681401__private_IsEnabledDeviceUsageNoInline
@@ -14 +15 @@
-gsl::copy<wchar_t,-1,wchar_t,-1>
+gsl::copy<wchar_t_const_,-1,wchar_t,-1>
```


### CimFs::DispatchVolumeDirectoryControl Diff


```diff
--- CimFs::DispatchVolumeDirectoryControl
+++ CimFs::DispatchVolumeDirectoryControl
@@ -1,345 +1,353 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* WARNING: Removing unreachable block (ram,0x000140008f92) */
+/* WARNING: Removing unreachable block (ram,0x000140009280) */
 /* long __cdecl CimFs::DispatchVolumeDirectoryControl(struct CimFs::VolumeDevice * __ptr64,struct
    _IRP * __ptr64) */
 
 long __cdecl CimFs::DispatchVolumeDirectoryControl(VolumeDevice *param_1,_IRP *param_2)
 
 {
   FileSystem *pFVar1;
   byte bVar2;
   longlong lVar3;
-  longlong lVar4;
-  undefined8 uVar5;
-  longlong lVar6;
+  short *psVar4;
+  longlong lVar5;
+  undefined8 uVar6;
   DirectoryQueryCursor DVar7;
   long lVar8;
   uint uVar9;
   char *pcVar10;
-  undefined8 *puVar11;
-  ulonglong *puVar12;
-  byte bVar13;
-  char cVar14;
-  DirectoryQueryCursor *pDVar15;
+  ulonglong uVar11;
+  undefined8 *puVar12;
+  ulonglong *puVar13;
+  byte bVar14;
+  longlong lVar15;
   DirectoryQueryCursor *pDVar16;
-  ulonglong uVar17;
+  char cVar17;
   DirectoryQueryCursor *pDVar18;
   char *pcVar19;
   __uint64 _Var20;
   byte bVar21;
   char *pcVar22;
   char *pcVar23;
   DirectoryQueryCursor *pDVar24;
   undefined1 auStackY_228 [32];
   char local_1d4 [4];
   byte local_1d0;
   uint local_1cc;
   char *local_1c8;
   uint local_1c0;
   DirectoryQueryCursor *local_1b8;
   undefined8 local_1b0;
   undefined8 uStack_1a8;
   undefined4 local_1a0;
   char *local_198;
   longlong lStack_190;
   char *local_188;
   char *pcStack_180;
   char *local_178;
   longlong lStack_170;
   undefined8 local_168;
   _IRP *local_160;
   char *local_158;
   DirectoryQueryCursor *local_150;
   DirectoryQueryCursor *local_148;
   char *local_138;
   char *pcStack_130;
   char *local_128;
   char *pcStack_120;
   VolumeDevice *local_118;
   char *pcStack_110;
   short *local_108;
   _IRP *local_100;
   char *local_f8;
   char *pcStack_f0;
   undefined8 local_e8;
   char *pcStack_e0;
   char *local_d8;
   longlong lStack_d0;
   StackEventTracer local_c8 [144];
   ulonglong local_38;
   
   local_38 = __security_cookie ^ (ulonglong)auStackY_228;
+  lVar15 = 0x1af000306b1;
   local_160 = param_2;
   local_118 = param_1;
   local_100 = param_2;
-  StackEventTracer::StackEventTracer(local_c8,0x1af000306a4);
+  StackEventTracer::StackEventTracer(local_c8,0x1af000306b1);
   lVar3 = *(longlong *)(param_2 + 0xb8);
   if (*(char *)(lVar3 + 1) == '\x02') {
     lVar8 = NotifyChangeDirectory(param_1,param_2);
     goto LAB_0;
   }
-  cVar14 = '\x01';
+  cVar17 = '\x01';
   if (*(char *)(lVar3 + 1) == '\x01') {
-    local_108 = *(short **)(*(longlong *)(lVar3 + 0x30) + 0x18);
-    lVar4 = *(longlong *)(*(longlong *)(lVar3 + 0x30) + 0x20);
-    pDVar15 = (DirectoryQueryCursor *)0x0;
-    if (local_108 != (short *)0x0) {
-      if (*local_108 == 0x5452) {
+    psVar4 = *(short **)(*(longlong *)(lVar3 + 0x30) + 0x18);
+    lVar5 = *(longlong *)(*(longlong *)(lVar3 + 0x30) + 0x20);
+    pDVar18 = (DirectoryQueryCursor *)0x0;
+    local_108 = psVar4;
+    if (psVar4 != (short *)0x0) {
+      if (*psVar4 == 0x5452) {
         pcVar10 = "ORIGIN: Invalid NodeTypeCode. FCB: %p";
-        _Var20 = 0x1b2000306c5;
+        _Var20 = 0x1b2000306d2;
         goto LAB_1;
       }
+      uVar11 = Feature_4078681401__private_IsEnabledDeviceUsageNoInline();
+      if (((int)uVar11 != 0) && ((*(uint *)(psVar4 + 0xe8) & 0x10) == 0)) {
+        pcVar10 = "ORIGIN: FileObject is not a directory. FCB: %p";
+        _Var20 = 0x1e4000306dd;
+        goto LAB_2;
+      }
       if ((*(short **)(lVar3 + 0x10) == (short *)0x0) || (**(short **)(lVar3 + 0x10) == 0)) {
-        cVar14 = '\0';
+        cVar17 = '\0';
       }
       bVar2 = *(byte *)(lVar3 + 2);
       bVar21 = bVar2 & 1;
       local_1d0 = bVar2 & 2;
-      bVar13 = bVar2 & 4;
+      bVar14 = bVar2 & 4;
       local_148 = (DirectoryQueryCursor *)0x0;
       local_150 = (DirectoryQueryCursor *)0x0;
-      local_1d4[0] = cVar14;
+      local_1d4[0] = cVar17;
       if ((bVar2 & 0x10) == 0) {
-        pDVar16 = (DirectoryQueryCursor *)(lVar4 + 0x28);
-        puVar11 = (undefined8 *)FsFltWil::AcquirePushLockExclusive((__uint64 *)&local_1b8);
-        pDVar18 = local_1b8;
-        pDVar24 = (DirectoryQueryCursor *)*puVar11;
-        *puVar11 = 0;
+        lVar15 = lVar5 + 0x28;
+        puVar12 = (undefined8 *)FsFltWil::AcquirePushLockExclusive((__uint64 *)&local_1b8);
+        pDVar16 = local_1b8;
+        pDVar24 = (DirectoryQueryCursor *)*puVar12;
+        *puVar12 = 0;
         local_1b8 = (DirectoryQueryCursor *)0x0;
         local_150 = pDVar24;
-        if (pDVar18 != (DirectoryQueryCursor *)0x0) {
-          FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar18);
-        }
-        pDVar18 = pDVar15;
-        pDVar15 = pDVar24;
-        pDVar24 = (DirectoryQueryCursor *)(lVar4 + 0x38);
-LAB_2:
+        if (pDVar16 != (DirectoryQueryCursor *)0x0) {
+          FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar16);
+        }
+        pDVar16 = pDVar18;
+        pDVar18 = pDVar24;
+        pDVar24 = (DirectoryQueryCursor *)(lVar5 + 0x38);
+LAB_3:
         pcVar10 = (char *)0x0;
-        uVar17 = CONCAT71((int7)((ulonglong)pDVar16 >> 8),bVar2) & 0xffffffffffffff04;
-        if (bVar13 == 0) {
+        uVar11 = CONCAT71((int7)((ulonglong)lVar15 >> 8),bVar2) & 0xffffffffffffff04;
+        if (bVar14 == 0) {
           if (bVar21 != 0) {
             local_1b0 = 0;
             uStack_1a8 = 0;
             local_1a0 = 1;
             *(undefined8 *)pDVar24 = 0;
             *(undefined8 *)(pDVar24 + 8) = 0;
             *(undefined4 *)(pDVar24 + 0x10) = 1;
           }
         }
         else if ((*(int *)(lVar3 + 0x20) != 0) || (bVar21 != 0)) {
           *(int *)(pDVar24 + 4) = *(int *)(lVar3 + 0x20);
         }
         DVar7 = pDVar24[0x10];
-        if ((bVar21 != 0) && (cVar14 != '\0')) {
+        if ((bVar21 != 0) && (cVar17 != '\0')) {
           DVar7 = (DirectoryQueryCursor)0x1;
         }
         pcVar19 = (char *)0x0;
         local_158 = (char *)0x0;
         local_138 = (char *)0x0;
         local_1c8 = (char *)0x0;
         pcStack_130 = (char *)0x0;
-        if ((bVar13 == 0) || (bVar21 != 0)) {
-LAB_3:
+        if ((bVar14 == 0) || (bVar21 != 0)) {
+LAB_4:
           pcVar22 = pcStack_130;
           local_138 = (char *)0x0;
           pcVar23 = (char *)0x0;
           pcStack_110 = pcStack_130;
           local_1c8 = pcStack_130;
-          if (DVar7 == (DirectoryQueryCursor)0x0) goto LAB_4;
+          if (DVar7 == (DirectoryQueryCursor)0x0) goto LAB_5;
           *(undefined8 *)(pDVar24 + 0x20) = 0;
           *(undefined8 *)(pDVar24 + 0x28) = 0;
           if (local_1d4[0] == '\0') {
-            lVar4 = *(longlong *)(pDVar24 + 0x18);
+            lVar15 = *(longlong *)(pDVar24 + 0x18);
             *(undefined8 *)(pDVar24 + 0x18) = 0;
-            if (lVar4 == 0) goto LAB_4;
-            ExFreePoolWithTag(lVar4,0);
+            if (lVar15 == 0) goto LAB_5;
+            ExFreePoolWithTag(lVar15,0);
           }
           else {
-            puVar11 = (undefined8 *)
+            puVar12 = (undefined8 *)
                       FsFltWil::MakeUnique<wchar_t_[0],0>
-                                ((_POOL_TYPE)&local_178,(ulong)uVar17,0x704d4943);
-            uVar5 = *puVar11;
-            *puVar11 = 0;
-            lVar4 = *(longlong *)(pDVar24 + 0x18);
-            *(undefined8 *)(pDVar24 + 0x18) = uVar5;
-            if (lVar4 != 0) {
-              ExFreePoolWithTag(lVar4,0);
+                                ((_POOL_TYPE)&local_178,(ulong)uVar11,0x704d4943);
+            uVar6 = *puVar12;
+            *puVar12 = 0;
+            lVar15 = *(longlong *)(pDVar24 + 0x18);
+            *(undefined8 *)(pDVar24 + 0x18) = uVar6;
+            if (lVar15 != 0) {
+              ExFreePoolWithTag(lVar15,0);
             }
             pcVar19 = local_178;
             local_178 = (char *)0x0;
             if (pcVar19 != (char *)0x0) {
               ExFreePoolWithTag(pcVar19,0);
             }
             pcStack_180 = *(char **)(pDVar24 + 0x18);
             local_128 = pcStack_180;
             if (pcStack_180 == (char *)0x0) {
               ProcessTraceStatusOrigin
-                        (-0x3fffff66,local_c8,0x1b50003074a,"CimFs::DispatchVolumeDirectoryControl",
+                        (-0x3fffff66,local_c8,0x1b500030763,"CimFs::DispatchVolumeDirectoryControl",
                          "ORIGIN: Failed to allocate buffer");
-              goto LAB_5;
+              goto LAB_6;
             }
             pcVar19 = (char *)(ulonglong)(**(ushort **)(lVar3 + 0x10) >> 1);
             lStack_190 = *(longlong *)(*(ushort **)(lVar3 + 0x10) + 4);
             local_198 = pcVar19;
-            if ((lStack_190 == 0) && (lVar4 = 0, lVar6 = lStack_170, pcVar19 != (char *)0x0)) {
-LAB_6:
-              lStack_170 = lVar6;
-              lStack_190 = lVar4;
+            if ((lStack_190 == 0) && (lVar15 = 0, lVar5 = lStack_170, pcVar19 != (char *)0x0)) {
+LAB_7:
+              lStack_170 = lVar5;
+              lStack_190 = lVar15;
                     /* WARNING: Subroutine does not return */
               gsl::details::terminate();
             }
             local_188 = pcVar19;
             local_f8 = pcVar19;
             pcStack_f0 = (char *)lStack_190;
-            gsl::copy<wchar_t,_1,wchar_t,_1>(&local_f8,&local_188);
+            gsl::copy<wchar_t_const_,_1,wchar_t,_1>(&local_f8,&local_188);
             *(char **)(pDVar24 + 0x20) = pcVar19;
             *(char **)(pDVar24 + 0x28) = local_128;
             pcVar19 = pcVar10;
             pcVar22 = local_1c8;
           }
         }
         else {
           if ((*(int *)(lVar3 + 0x20) != 0) || (local_1d4[0] == '\0')) {
             local_e8 = 0;
             pcStack_130 = local_1d4;
             pcStack_e0 = pcStack_130;
-            goto LAB_3;
-          }
-          puVar12 = (ulonglong *)
+            goto LAB_4;
+          }
+          puVar13 = (ulonglong *)
                     FsFltWil::MakeUnique<wchar_t_[0],0>
-                              ((_POOL_TYPE)&local_1c8,(ulong)uVar17,0x704d4943);
+                              ((_POOL_TYPE)&local_1c8,(ulong)uVar11,0x704d4943);
           pcVar10 = local_1c8;
-          pcVar19 = (char *)*puVar12;
-          *puVar12 = 0;
+          pcVar19 = (char *)*puVar13;
+          *puVar13 = 0;
           local_1c8 = (char *)0x0;
           local_158 = pcVar19;
           if (pcVar10 != (char *)0x0) {
             ExFreePoolWithTag(pcVar10,0);
           }
           if (pcVar19 == (char *)0x0) {
             ProcessTraceStatusOrigin
-                      (-0x3fffff66,local_c8,0x1b400030727,"CimFs::DispatchVolumeDirectoryControl",
+                      (-0x3fffff66,local_c8,0x1b400030740,"CimFs::DispatchVolumeDirectoryControl",
                        "ORIGIN: Failed to allocate buffer");
-LAB_5:
-            if (pDVar15 != (DirectoryQueryCursor *)0x0) {
-              FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar15);
-            }
+LAB_6:
             if (pDVar18 != (DirectoryQueryCursor *)0x0) {
-              DirectoryQueryCursor::~DirectoryQueryCursor(pDVar18);
-              ExFreePoolWithTag(pDVar18,0);
-            }
-            goto LAB_7;
+              FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar18);
+            }
+            if (pDVar16 != (DirectoryQueryCursor *)0x0) {
+              DirectoryQueryCursor::~DirectoryQueryCursor(pDVar16);
+              ExFreePoolWithTag(pDVar16,0);
+            }
+            goto LAB_8;
           }
           local_188 = (char *)(ulonglong)(**(ushort **)(lVar3 + 0x10) >> 1);
           lStack_170 = *(longlong *)(*(ushort **)(lVar3 + 0x10) + 4);
           local_178 = local_188;
           local_138 = local_188;
           pcStack_130 = pcVar19;
           local_128 = local_188;
           pcStack_120 = pcVar19;
-          if ((lStack_170 == 0) && (lVar4 = lStack_190, lVar6 = 0, local_188 != (char *)0x0))
-          goto LAB_6;
+          if ((lStack_170 == 0) && (lVar15 = lStack_190, lVar5 = 0, local_188 != (char *)0x0))
+          goto LAB_7;
           local_198 = local_188;
           lStack_190 = lStack_170;
           pcStack_180 = pcVar19;
-          gsl::copy<wchar_t,_1,wchar_t,_1>(&local_198,&local_188);
+          gsl::copy<wchar_t_const_,_1,wchar_t,_1>(&local_198,&local_188);
           pcVar22 = pcStack_130;
           pcVar23 = local_138;
         }
-        uVar17 = (ulonglong)bVar13;
+        uVar11 = (ulonglong)bVar14;
         pcVar10 = pcVar19;
         pcStack_110 = pcVar22;
-LAB_4:
+LAB_5:
         local_168 = 0;
         local_1cc = 0;
         local_1c0 = (uint)(local_1d0 != 0);
-        if ((char)uVar17 != '\0') {
+        if ((char)uVar11 != '\0') {
           local_1c0 = local_1c0 | 2;
         }
         local_d8 = (char *)(ulonglong)*(uint *)(lVar3 + 8);
         lStack_d0 = *(longlong *)(local_160 + 0x70);
         if ((lStack_d0 == 0) && (local_d8 != (char *)0x0)) {
                     /* WARNING: Subroutine does not return */
           gsl::details::terminate();
         }
         if (pcVar23 == (char *)0xffffffffffffffff) {
                     /* WARNING: Subroutine does not return */
           gsl::details::terminate();
         }
         if ((pcStack_110 == (char *)0x0) && (pcVar23 != (char *)0x0)) {
           local_118 = (VolumeDevice *)pcVar23;
                     /* WARNING: Subroutine does not return */
           gsl::details::terminate();
         }
         local_188 = *(char **)(pDVar24 + 0x20);
         pcStack_180 = *(char **)(pDVar24 + 0x28);
         pFVar1 = (FileSystem *)(local_118 + 0x180);
         local_198 = local_d8;
         lStack_190 = lStack_d0;
         local_118 = (VolumeDevice *)pcVar23;
         local_f8 = pcVar23;
         pcStack_f0 = pcStack_110;
         uVar9 = Cim::FileSystem::QueryDirectory
                           (pFVar1,local_108 + 0x9c,*(undefined4 *)(lVar3 + 0x18),&local_198);
         local_1cc = uVar9;
         if ((uVar9 & 0xc0000000) == 0xc0000000) {
           ProcessTraceStatusFromApi
-                    (uVar9,local_c8,0x1b700030780,"CimFs::DispatchVolumeDirectoryControl",
+                    (uVar9,local_c8,0x1b700030799,"CimFs::DispatchVolumeDirectoryControl",
                      "API: QueryDirectory failed");
         }
         else {
           *(undefined8 *)(local_160 + 0x38) = local_168;
         }
         if (pcVar10 != (char *)0x0) {
           ExFreePoolWithTag(pcVar10,0);
         }
-        if (pDVar15 != (DirectoryQueryCursor *)0x0) {
-          FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar15);
-        }
         if (pDVar18 != (DirectoryQueryCursor *)0x0) {
-          DirectoryQueryCursor::~DirectoryQueryCursor(pDVar18);
-          ExFreePoolWithTag(pDVar18,0);
+          FsFltWil::Details::ReleasePushLockExclusive((__uint64 *)pDVar18);
+        }
+        if (pDVar16 != (DirectoryQueryCursor *)0x0) {
+          DirectoryQueryCursor::~DirectoryQueryCursor(pDVar16);
+          ExFreePoolWithTag(pDVar16,0);
         }
         StackEventTracer::~StackEventTracer(local_c8);
         return uVar9;
       }
-      pDVar16 = pDVar15;
-      puVar11 = (undefined8 *)
-                FsFltWil::MakeUnique<struct_CimFs::DirectoryQueryCursor,0>((_POOL_TYPE)&local_1b8,0)
-      ;
+      puVar12 = (undefined8 *)
+                FsFltWil::MakeUnique<struct_CimFs::DirectoryQueryCursor,0>
+                          ((_POOL_TYPE)&local_1b8,(ulong)lVar15);
       pDVar24 = local_1b8;
-      pDVar18 = (DirectoryQueryCursor *)*puVar11;
-      *puVar11 = 0;
+      pDVar16 = (DirectoryQueryCursor *)*puVar12;
+      *puVar12 = 0;
       local_1b8 = (DirectoryQueryCursor *)0x0;
-      local_148 = pDVar18;
+      local_148 = pDVar16;
       if (pDVar24 != (DirectoryQueryCursor *)0x0) {
         DirectoryQueryCursor::~DirectoryQueryCursor(pDVar24);
-        pDVar16 = (DirectoryQueryCursor *)0x0;
+        lVar15 = 0;
         ExFreePoolWithTag(pDVar24,0);
       }
-      pDVar24 = pDVar18;
-      if (pDVar18 != (DirectoryQueryCursor *)0x0) goto LAB_2;
+      pDVar24 = pDVar16;
+      if (pDVar16 != (DirectoryQueryCursor *)0x0) goto LAB_3;
       ProcessTraceStatusOrigin
-                (-0x3fffff66,local_c8,0x1b3000306ee,"CimFs::DispatchVolumeDirectoryControl",
+                (-0x3fffff66,local_c8,0x1b300030707,"CimFs::DispatchVolumeDirectoryControl",
                  "ORIGIN: Failed to allocate DirectoryQueryCursor");
-LAB_7:
+LAB_8:
       lVar8 = -0x3fffff66;
       goto LAB_0;
     }
     pcVar10 = "ORIGIN: Invalid FCB. FileObject: %p";
-    _Var20 = 0x1b1000306bc;
+    _Var20 = 0x1b1000306c9;
+LAB_2:
     lVar8 = -0x3ffffff3;
   }
   else {
     pcVar10 = "ORIGIN: Invalid MinorFunction. IRP: %p";
-    _Var20 = 0x1b0000306b2;
+    _Var20 = 0x1b0000306bf;
 LAB_1:
     lVar8 = -0x3ffffff0;
   }
   ProcessTraceStatusOrigin(lVar8,local_c8,_Var20,"CimFs::DispatchVolumeDirectoryControl",pcVar10);
 LAB_0:
   StackEventTracer::~StackEventTracer(local_c8);
   return lVar8;
 }
 

```


## CimFs::DriverUnload

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.74|
|i_ratio|0.57|
|m_ratio|0.73|
|b_ratio|0.69|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|DriverUnload|DriverUnload|
|fullname|CimFs::DriverUnload|CimFs::DriverUnload|
|refcount|4|4|
|`length`|97|168|
|`called`|NTOSKRNL.EXE::ExDeleteLookasideListEx<br>NTOSKRNL.EXE::NtClose<br>TlgUnregisterAggregateProvider|NTOSKRNL.EXE::ExDeleteLookasideListEx<br>NTOSKRNL.EXE::NtClose<br>NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification<br>NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider<br>TlgUnregisterAggregateProvider|
|calling|||
|paramcount|1|1|
|address|140002bd0|140002bd0|
|sig|void __cdecl DriverUnload(_DRIVER_OBJECT * param_1)|void __cdecl DriverUnload(_DRIVER_OBJECT * param_1)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### CimFs::DriverUnload Called Diff


```diff
--- CimFs::DriverUnload called
+++ CimFs::DriverUnload called
@@ -2,0 +3,2 @@
+NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
+NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
```


### CimFs::DriverUnload Diff


```diff
--- CimFs::DriverUnload
+++ CimFs::DriverUnload
@@ -1,18 +1,27 @@
 
 /* void __cdecl CimFs::DriverUnload(struct _DRIVER_OBJECT * __ptr64) */
 
 void __cdecl CimFs::DriverUnload(_DRIVER_OBJECT *param_1)
 
 {
   if (DAT_0 != '\0') {
     ExDeleteLookasideListEx(&DAT_1);
   }
   if (DAT_2 != '\0') {
     ExDeleteLookasideListEx(&DAT_3);
   }
   NtClose(DAT_4);
   DAT_4 = 0;
   TlgUnregisterAggregateProvider();
+  if (g_wil_details_featureChangeNotification != 0) {
+    RtlUnregisterFeatureConfigurationChangeNotification();
+    g_wil_details_featureChangeNotification = 0;
+  }
+  if (g_wil_details_featureUsageProvider != 0) {
+    RtlUnregisterFeatureUsageProvider();
+    g_wil_details_featureUsageProvider = 0;
+  }
+  g_wil_details_isFeatureStagingInitialized = 0;
   return;
 }
 

```


## CimFs::NotifyChangeDirectory

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.23|
|i_ratio|0.25|
|m_ratio|0.83|
|b_ratio|0.75|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|NotifyChangeDirectory|NotifyChangeDirectory|
|fullname|CimFs::NotifyChangeDirectory|CimFs::NotifyChangeDirectory|
|refcount|2|2|
|`length`|383|526|
|`called`|CimFs::ProcessTraceStatusOrigin<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::FsRtlNotifyFullChangeDirectory<br>__security_check_cookie|CimFs::ProcessTraceStatusOrigin<br>Feature_4078681401__private_IsEnabledDeviceUsageNoInline<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::FsRtlNotifyFullChangeDirectory<br>__security_check_cookie|
|calling|CimFs::DispatchVolumeDirectoryControl|CimFs::DispatchVolumeDirectoryControl|
|paramcount|2|2|
|`address`|14000c33c|14000c62c|
|sig|long __cdecl NotifyChangeDirectory(VolumeDevice * param_1, _IRP * param_2)|long __cdecl NotifyChangeDirectory(VolumeDevice * param_1, _IRP * param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### CimFs::NotifyChangeDirectory Called Diff


```diff
--- CimFs::NotifyChangeDirectory called
+++ CimFs::NotifyChangeDirectory called
@@ -1,0 +2 @@
+Feature_4078681401__private_IsEnabledDeviceUsageNoInline
```


### CimFs::NotifyChangeDirectory Diff


```diff
--- CimFs::NotifyChangeDirectory
+++ CimFs::NotifyChangeDirectory
@@ -1,78 +1,94 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* long __cdecl CimFs::NotifyChangeDirectory(struct CimFs::VolumeDevice * __ptr64,struct _IRP *
    __ptr64) */
 
 long __cdecl CimFs::NotifyChangeDirectory(VolumeDevice *param_1,_IRP *param_2)
 
 {
   longlong lVar1;
   longlong lVar2;
-  char *pcVar3;
-  long lVar4;
-  __uint64 _Var5;
-  undefined1 auStackY_f8 [32];
-  undefined4 local_a8 [2];
-  undefined8 local_a0;
-  undefined8 local_98;
-  undefined1 local_90;
-  undefined8 local_8c;
-  undefined8 uStack_84;
-  undefined8 local_7c;
-  undefined8 uStack_74;
-  undefined2 local_6c;
-  undefined1 local_58;
-  undefined8 local_50;
-  undefined8 uStack_48;
-  longlong local_40;
-  undefined8 local_38;
-  undefined8 uStack_30;
-  longlong local_28;
-  ulonglong local_18;
+  short *psVar3;
+  char *pcVar4;
+  ulonglong uVar5;
+  __uint64 _Var6;
+  undefined1 auStackY_118 [32];
+  undefined4 local_c8 [2];
+  undefined8 local_c0;
+  undefined8 local_b8;
+  undefined1 local_b0;
+  undefined8 local_ac;
+  undefined8 uStack_a4;
+  undefined8 local_9c;
+  undefined8 uStack_94;
+  undefined2 local_8c;
+  undefined1 local_78;
+  undefined8 local_70;
+  undefined8 uStack_68;
+  longlong local_60;
+  undefined8 local_58;
+  undefined8 uStack_50;
+  longlong local_48;
+  ulonglong local_38;
   
-  local_18 = __security_cookie ^ (ulonglong)auStackY_f8;
-  local_a8[0] = 0;
-  local_a0 = 0x1ac0003067c;
-  local_98 = 0;
-  local_90 = 0;
+  local_38 = __security_cookie ^ (ulonglong)auStackY_118;
+  lVar1 = *(longlong *)(param_2 + 0xb8);
+  local_c8[0] = 0;
+  local_b8 = 0;
+  local_c0 = 0x1ac0003067d;
+  lVar2 = *(longlong *)(lVar1 + 0x30);
+  local_b0 = 0;
+  local_ac = 0;
+  uStack_a4 = 0;
   local_8c = 0;
-  uStack_84 = 0;
-  lVar1 = *(longlong *)(*(longlong *)(param_2 + 0xb8) + 0x30);
-  local_7c = 0;
-  uStack_74 = 0;
-  local_6c = 0;
+  psVar3 = *(short **)(lVar2 + 0x18);
+  lVar2 = *(longlong *)(lVar2 + 0x20);
+  local_78 = 0;
+  local_60 = 0;
+  local_48 = 0;
+  local_9c = 0;
+  uStack_94 = 0;
+  local_70 = 0;
+  uStack_68 = 0;
   local_58 = 0;
-  lVar2 = *(longlong *)(lVar1 + 0x20);
-  local_40 = 0;
-  local_28 = 0;
-  local_50 = 0;
-  uStack_48 = 0;
-  local_38 = 0;
-  uStack_30 = 0;
-  if (*(short **)(lVar1 + 0x18) == (short *)0x0) {
-    pcVar3 = "ORIGIN: Invalid FCB. FileObject: %p";
-    _Var5 = 0x1ad00030685;
-    lVar4 = -0x3ffffff3;
+  uStack_50 = 0;
+  if (psVar3 == (short *)0x0) {
+    _Var6 = 0x1ad00030686;
+    pcVar4 = "ORIGIN: Invalid FCB. FileObject: %p";
   }
   else {
-    if (**(short **)(lVar1 + 0x18) != 0x5452) {
+    if (*psVar3 == 0x5452) {
+      ProcessTraceStatusOrigin
+                (-0x3ffffff0,(StackEventTracer *)local_c8,0x1ae0003068f,
+                 "CimFs::NotifyChangeDirectory","ORIGIN: Invalid NodeTypeCode. FCB: %p");
+      if (local_48 != 0) {
+        ExFreePoolWithTag(local_48,0);
+      }
+      if (local_60 == 0) {
+        return -0x3ffffff0;
+      }
+      ExFreePoolWithTag(local_60,0);
+      return -0x3ffffff0;
+    }
+    uVar5 = Feature_4078681401__private_IsEnabledDeviceUsageNoInline();
+    if (((int)uVar5 == 0) || ((*(uint *)(psVar3 + 0xe8) & 0x10) != 0)) {
       FsRtlNotifyFullChangeDirectory
-                (*(undefined8 *)(param_1 + 0x4c0),param_1 + 0x4c8,lVar2,lVar1 + 0x58);
+                (*(undefined8 *)(param_1 + 0x4c0),param_1 + 0x4c8,lVar2,
+                 *(longlong *)(lVar1 + 0x30) + 0x58);
       *(undefined1 *)(lVar2 + 0x68) = 1;
       return 0x103;
     }
-    _Var5 = 0x1ae0003068e;
-    pcVar3 = "ORIGIN: Invalid NodeTypeCode. FCB: %p";
-    lVar4 = -0x3ffffff0;
+    pcVar4 = "ORIGIN: FileObject is not a directory. FCB: %p";
+    _Var6 = 0x3ed0003069a;
   }
   ProcessTraceStatusOrigin
-            (lVar4,(StackEventTracer *)local_a8,_Var5,"CimFs::NotifyChangeDirectory",pcVar3);
-  if (local_28 != 0) {
-    ExFreePoolWithTag(local_28,0);
+            (-0x3ffffff3,(StackEventTracer *)local_c8,_Var6,"CimFs::NotifyChangeDirectory",pcVar4);
+  if (local_48 != 0) {
+    ExFreePoolWithTag(local_48,0);
   }
-  if (local_40 != 0) {
-    ExFreePoolWithTag(local_40,0);
+  if (local_60 != 0) {
+    ExFreePoolWithTag(local_60,0);
   }
-  return lVar4;
+  return -0x3ffffff3;
 }
 

```


## Cp_DriverEntry

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|code,length,sig,address,called|
|ratio|0.92|
|i_ratio|0.68|
|m_ratio|0.95|
|b_ratio|0.9|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|Cp_DriverEntry|Cp_DriverEntry|
|fullname|Cp_DriverEntry|Cp_DriverEntry|
|refcount|2|2|
|`length`|1335|1488|
|`called`|<details><summary>Expand for full list:<br>CimFs::ProcessTraceStatusFromApi<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::ExInitializeLookasideListEx<br>NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks<br>NTOSKRNL.EXE::IoCreateSymbolicLink<br>NTOSKRNL.EXE::IoDeleteDevice<br>NTOSKRNL.EXE::IoRegisterFileSystem<br>NTOSKRNL.EXE::ZwClose<br>NTOSKRNL.EXE::ZwCreateDirectoryObject<br>TlgRegisterAggregateProvider<br>TlgUnregisterAggregateProvider</summary>WdmlibIoCreateDeviceSecure<br>__security_check_cookie<br>memset</details>|<details><summary>Expand for full list:<br>CimFs::ProcessTraceStatusFromApi<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::ExInitializeLookasideListEx<br>NTOSKRNL.EXE::FsRtlRegisterFileSystemFilterCallbacks<br>NTOSKRNL.EXE::IoCreateSymbolicLink<br>NTOSKRNL.EXE::IoDeleteDevice<br>NTOSKRNL.EXE::IoRegisterFileSystem<br>NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification<br>NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider<br>NTOSKRNL.EXE::ZwClose<br>NTOSKRNL.EXE::ZwCreateDirectoryObject</summary>TlgRegisterAggregateProvider<br>TlgUnregisterAggregateProvider<br>WdmlibIoCreateDeviceSecure<br>__security_check_cookie<br>memset<br>wil_InitializeFeatureStaging</details>|
|calling|DriverEntry|DriverEntry|
|paramcount|1|1|
|`address`|140002d40|140002d88|
|`sig`|ulonglong __fastcall Cp_DriverEntry(longlong param_1)|int __fastcall Cp_DriverEntry(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### Cp_DriverEntry Called Diff


```diff
--- Cp_DriverEntry called
+++ Cp_DriverEntry called
@@ -7,0 +8,2 @@
+NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification
+NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider
@@ -14,0 +17 @@
+wil_InitializeFeatureStaging
```


### Cp_DriverEntry Diff


```diff
--- Cp_DriverEntry
+++ Cp_DriverEntry
@@ -1,264 +1,283 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
 
-ulonglong Cp_DriverEntry(longlong param_1)
+int Cp_DriverEntry(longlong param_1)
 
 {
   int iVar1;
   long lVar2;
   longlong lVar3;
   char *pcVar4;
   undefined8 *puVar5;
   undefined8 uVar6;
-  ulonglong unaff_RSI;
+  int unaff_ESI;
   __uint64 _Var7;
   bool bVar8;
   undefined1 auStackY_208 [32];
   longlong local_1b8;
   longlong local_1b0;
   longlong *local_1a8;
   longlong local_1a0;
   char local_198;
   undefined8 local_190;
   wchar_t *pwStack_188;
   undefined8 local_180;
   undefined8 local_178;
   undefined8 *local_170;
   undefined8 local_168;
   undefined8 local_160;
   undefined8 uStack_158;
   undefined8 local_150;
   wchar_t *pwStack_148;
   undefined4 local_140;
   undefined4 uStack_13c;
   undefined4 uStack_138;
   undefined4 uStack_134;
   undefined4 local_128 [2];
   code *local_120;
   code *local_110;
   code *local_c0;
   undefined4 local_a8 [2];
   undefined8 local_a0;
   undefined8 local_98;
   undefined1 local_90;
   undefined8 local_8c;
   undefined8 uStack_84;
   undefined8 local_7c;
   undefined8 uStack_74;
   undefined2 local_6c;
   undefined1 local_58;
   undefined8 local_50;
   undefined8 uStack_48;
   longlong local_40;
   undefined8 local_38;
   undefined8 uStack_30;
   longlong local_28;
   ulonglong local_18;
   
   local_18 = __security_cookie ^ (ulonglong)auStackY_208;
   lVar3 = 0;
   local_a8[0] = 0;
-  local_a0 = 0x1000100bb;
+  local_a0 = 0x1000100bc;
   local_98 = 0;
   local_90 = 0;
   local_8c = 0;
   uStack_84 = 0;
   local_6c = 0;
   local_7c = 0;
   uStack_74 = 0;
   local_58 = 0;
   local_50 = 0;
   uStack_48 = 0;
   local_40 = 0;
   local_38 = 0;
   uStack_30 = 0;
   local_28 = 0;
+  wil_InitializeFeatureStaging();
   iVar1 = TlgRegisterAggregateProvider();
   if (iVar1 < 0) {
-    return unaff_RSI;
+    if (g_wil_details_featureChangeNotification != 0) {
+      RtlUnregisterFeatureConfigurationChangeNotification();
+      g_wil_details_featureChangeNotification = 0;
+    }
+    if (g_wil_details_featureUsageProvider != 0) {
+      RtlUnregisterFeatureUsageProvider();
+      g_wil_details_featureUsageProvider = 0;
+    }
+    g_wil_details_isFeatureStagingInitialized = 0;
+    return unaff_ESI;
   }
   *(code **)(param_1 + 0x68) = CimFs::DriverUnload;
   puVar5 = (undefined8 *)(param_1 + 0x70);
   *(_FAST_IO_DISPATCH **)(param_1 + 0x50) = &CimFs::FastIoDispatch;
   bVar8 = false;
   do {
     if (!bVar8) {
       *puVar5 = CimFs::DispatchWrapper<0,0,0>;
     }
     lVar3 = lVar3 + 1;
     puVar5 = puVar5 + 1;
     bVar8 = lVar3 == 0x1b;
   } while (lVar3 < 0x1c);
   *(code **)(param_1 + 0x70) =
        CimFs::
        DispatchWrapper<&long___cdecl_CimFs::DispatchControlCreate(struct_CimFs::Device*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchDiskCreate(struct_CimFs::DiskDevice*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchVolumeCreate(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xd8) =
        CimFs::
        DispatchWrapper<&long___cdecl_CimFs::DispatchControlFsctl(struct_CimFs::Device*___ptr64,struct__IRP*___ptr64),0,&long___cdecl_CimFs::DispatchVolumeFsctl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xe0) =
        CimFs::
        DispatchWrapper<&long___cdecl_CimFs::DispatchControlIoctl(struct_CimFs::Device*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchDiskIoctl(struct_CimFs::DiskDevice*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchVolumeIoctl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xd0) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeDirectoryControl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x98) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeQueryInformation(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xa8) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeQueryEa(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x110) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeQuerySecurity(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xc0) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeQueryVolume(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x100) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeCleanup(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x80) =
        CimFs::
        DispatchWrapper<0,&long___cdecl_CimFs::DispatchDiskClose(struct_CimFs::DiskDevice*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchVolumeClose(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x88) =
        CimFs::
        DispatchWrapper<0,&long___cdecl_CimFs::DispatchDiskRead(struct_CimFs::DiskDevice*___ptr64,struct__IRP*___ptr64),&long___cdecl_CimFs::DispatchVolumeRead(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xf8) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchVolumeLockControl(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x90) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchConstant<struct_CimFs::VolumeDevice*___ptr64,_1073741662>(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xa0) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchConstant<struct_CimFs::VolumeDevice*___ptr64,_1073741662>(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0x118) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchConstant<struct_CimFs::VolumeDevice*___ptr64,_1073741662>(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xb0) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchConstant<struct_CimFs::VolumeDevice*___ptr64,_1073741662>(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   *(code **)(param_1 + 0xb8) =
        CimFs::
        DispatchWrapper<0,0,&long___cdecl_CimFs::DispatchConstant<struct_CimFs::VolumeDevice*___ptr64,0>(struct_CimFs::VolumeDevice*___ptr64,struct__IRP*___ptr64)>
   ;
   memset(local_128,0,0x78);
   local_128[0] = 0x78;
   local_c0 = CimFs::DispatchPreFsFilterOperation;
   local_120 = CimFs::DispatchPreFsFilterOperation;
   local_110 = CimFs::DispatchPreFsFilterOperation;
   iVar1 = FsRtlRegisterFileSystemFilterCallbacks(param_1,local_128);
   if (iVar1 < 0) {
     pcVar4 = "API: FsRtlRegisterFileSystemFilterCallbacks failed";
-    _Var7 = 0x2000100f1;
+    _Var7 = 0x2000100f9;
   }
   else {
     iVar1 = ExInitializeLookasideListEx(&DAT_0,0,0,0x200);
     if (iVar1 < 0) {
       pcVar4 = "API: FcbLookaside failed initialization";
-      _Var7 = 0x3000100fc;
+      _Var7 = 0x300010104;
     }
     else {
       DAT_1 = 1;
       iVar1 = ExInitializeLookasideListEx(&DAT_2,0,0,0x200);
       if (-1 < iVar1) {
         DAT_3 = 1;
         _DAT_4 = CimFs::CimAcquireForLazyWrite;
         local_180 = 0x30;
         _DAT_5 = CimFs::CimReleaseFromLazyWrite;
         local_168 = 0x200;
         _DAT_6 = CimFs::CimAcquireForLazyWrite;
         uVar6 = 0xf000f;
         local_178 = 0;
         _DAT_7 = CimFs::CimReleaseFromLazyWrite;
         local_170 = &local_150;
         local_150 = 0x1c001a;
         pwStack_148 = L"\\Device\\cimfs";
         local_1b0 = 0;
         local_160 = 0;
         uStack_158 = 0;
         iVar1 = ZwCreateDirectoryObject(&local_1b0,0xf000f,&local_180);
         if (iVar1 < 0) {
           CimFs::ProcessTraceStatusFromApi
-                    (iVar1,(StackEventTracer *)local_a8,0x50001011c,"CimFs::Cp_DriverEntry",
+                    (iVar1,(StackEventTracer *)local_a8,0x500010124,"CimFs::Cp_DriverEntry",
                      "API: Create device directory failed");
         }
         else {
           local_1a8 = &local_1b8;
           local_1b8 = 0;
           local_1a0 = 0;
           local_190 = 0x2c002a;
           pwStack_188 = L"\\Device\\cimfs\\control";
           local_198 = '\x01';
           lVar2 = WdmlibIoCreateDeviceSecure(param_1,uVar6,&local_190);
           if ((local_198 != '\0') && (lVar3 = *local_1a8, *local_1a8 = local_1a0, lVar3 != 0)) {
             IoDeleteDevice();
           }
           if (lVar2 < 0) {
             pcVar4 = "API: Create control device failed";
-            _Var7 = 0x60001012b;
+            _Var7 = 0x600010133;
           }
           else {
             *(undefined4 *)(local_1b8 + 0x150) = 0;
             *(undefined4 *)(local_1b8 + 0x150) = 0;
             local_140 = 0x320030;
             uStack_13c = 0;
             uStack_138 = 0x4002d300;
             uStack_134 = 1;
             lVar2 = IoCreateSymbolicLink(&local_140,&local_190);
             if (-1 < lVar2) {
               *(uint *)(local_1b8 + 0x30) = *(uint *)(local_1b8 + 0x30) & 0xffffff7f;
               IoRegisterFileSystem(local_1b8);
               _CimFsData = param_1;
               DAT_8 = local_1b0;
-              return unaff_RSI;
+              return unaff_ESI;
             }
             pcVar4 = "API: Create symbolic link to control device failed";
-            _Var7 = 0x700010139;
+            _Var7 = 0x700010141;
           }
           CimFs::ProcessTraceStatusFromApi
                     (lVar2,(StackEventTracer *)local_a8,_Var7,"CimFs::Cp_DriverEntry",pcVar4);
           lVar3 = local_1b8;
           local_1b8 = 0;
           if (lVar3 != 0) {
             IoDeleteDevice();
           }
         }
         if (local_1b0 != 0) {
           ZwClose();
         }
         goto LAB_9;
       }
       pcVar4 = "API: CcbLookaside failed initialization";
-      _Var7 = 0x400010109;
+      _Var7 = 0x400010111;
     }
   }
   CimFs::ProcessTraceStatusFromApi
             (iVar1,(StackEventTracer *)local_a8,_Var7,"CimFs::Cp_DriverEntry",pcVar4);
 LAB_9:
   TlgUnregisterAggregateProvider();
+  if (g_wil_details_featureChangeNotification != 0) {
+    RtlUnregisterFeatureConfigurationChangeNotification();
+    g_wil_details_featureChangeNotification = 0;
+  }
+  if (g_wil_details_featureUsageProvider != 0) {
+    RtlUnregisterFeatureUsageProvider();
+    g_wil_details_featureUsageProvider = 0;
+  }
+  g_wil_details_isFeatureStagingInitialized = 0;
   if (local_28 != 0) {
     ExFreePoolWithTag(local_28,0);
   }
   if (local_40 != 0) {
     ExFreePoolWithTag(local_40,0);
   }
-  return unaff_RSI;
+  return unaff_ESI;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## wil_details_IsEnabledFallback

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.83|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|3|4|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Feature_CimFS_Fuzzing_Km_Check__private_IsEnabledFallback<br>Feature_CimfsV1CompatGetFileFix__private_IsEnabledFallback|Feature_4078681401__private_IsEnabledFallback<br>Feature_CimFS_Fuzzing_Km_Check__private_IsEnabledFallback<br>Feature_CimfsV1CompatGetFileFix__private_IsEnabledFallback|
|paramcount|3|3|
|`address`|14000ed40|14000f114|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -0,0 +1 @@
+Feature_4078681401__private_IsEnabledFallback
```


## wil_InitializeFeatureStaging

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.9|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging|
|fullname|wil_InitializeFeatureStaging|wil_InitializeFeatureStaging|
|`refcount`|2|3|
|length|341|341|
|called|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp<br>NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification<br>NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider<br>wil_details_EvaluateFeatureDependencies<br>wil_details_PopulateInitialConfiguredFeatureStates|NTOSKRNL.EXE::RtlQueryFeatureConfigurationChangeStamp<br>NTOSKRNL.EXE::RtlRegisterFeatureConfigurationChangeNotification<br>NTOSKRNL.EXE::RtlRegisterFeatureUsageProvider<br>wil_details_EvaluateFeatureDependencies<br>wil_details_PopulateInitialConfiguredFeatureStates|
|`calling`|DriverEntry|Cp_DriverEntry<br>DriverEntry|
|paramcount|0|0|
|address|14003e078|14003e078|
|sig|int __fastcall wil_InitializeFeatureStaging(void)|int __fastcall wil_InitializeFeatureStaging(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_InitializeFeatureStaging Calling Diff


```diff
--- wil_InitializeFeatureStaging calling
+++ wil_InitializeFeatureStaging calling
@@ -0,0 +1 @@
+Cp_DriverEntry
```


## ProcessTraceStatusOrigin

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.84|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|ProcessTraceStatusOrigin|ProcessTraceStatusOrigin|
|fullname|CimFs::ProcessTraceStatusOrigin|CimFs::ProcessTraceStatusOrigin|
|`refcount`|192|193|
|length|425|425|
|called|CimFs::SafeFormatMessage<br>__security_check_cookie<br>_tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*___ptr64>::Write<struct__tlgWrapSz<char>,struct__tlgWrapSz<char>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<2>,struct__tlgWrapperByVal<4>_>|CimFs::SafeFormatMessage<br>__security_check_cookie<br>_tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*___ptr64>::Write<struct__tlgWrapSz<char>,struct__tlgWrapSz<char>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<2>,struct__tlgWrapperByVal<4>_>|
|`calling`|<details><summary>Expand for full list:<br><lambda_c3c156badebf65fb4aa63199b7e46cca>::operator()<br>Cim::AddDirectoryEntry<br>Cim::CopySecurityDescriptor<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::Fsctl<br>Cim::FileSystem::GetFullPath<br>Cim::FileSystem::GetImageMappings<br>Cim::FileSystem::GetMappingSegment<br>Cim::FileSystem::GetNameInformation<br>Cim::FileSystem::GetReparseData</summary>Cim::FileSystem::GetStreamSegment<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::QueryDirectory<br>Cim::FileSystem::QueryEa<br>Cim::FileSystem::QueryEffectiveAccess<br>Cim::FileSystem::QueryInformation<br>Cim::FileSystem::QueryStatInfo<br>Cim::FileSystem::QueryVirtualSizeOffset<br>Cim::FileSystem::QueryVolume<br>Cim::GetNextEa<br>Cim::GetNextRequestedEa<br>Cim::ImageReader::GetArray<enum_gsl::byte><br>Cim::ImageReader::GetArray<struct_Cim::Format::FileTableDirectoryEntry><br>Cim::ImageReader::GetArray<struct_Cim::Format::PeImageMapping><br>Cim::ImageReader::GetArray<struct_Cim::Format::PeImageMappingV1><br>Cim::ImageReader::GetArray<wchar_t><br>Cim::ImageReader::GetData<br>Cim::ImageReader::GetDataTruncate<br>Cim::ImageReader::GetFile<br>Cim::ImageReader::GetOffsetTruncate<br>Cim::ImageReader::GetStruct<struct_Cim::Format::Filesystem><br>Cim::ImageReader::GetStruct<struct_Cim::Format::PeImage><br>Cim::ImageReader::GetStruct<unsigned_int><br>Cim::ImageReader::GetStruct<unsigned_short><br>Cim::ImageReader::ParseName<br>Cim::InMemoryImage::CreateMergedFileTableDirectory<br>Cim::InMemoryImage::CreateMergedLinkTables<br>Cim::InMemoryImage::CreateMergedRegion<br>Cim::InMemoryImage::UpdateMergedFileList<br>Cim::InMemoryParser::GetCimIndex<br>Cim::InMemoryParser::GetFileName<br>Cim::InMemoryParser::GetNextFileOffset<br>Cim::InMemoryParser::InMemoryParser<br>Cim::LinkTable<enum_Cim::Format::FileId>::Parse<br>Cim::LinkTable<struct_Cim::Format::Stream>::Parse<br>Cim::TryConvertSubspan<int_const_,enum_gsl::byte_const_><br>Cim::TryConvertSubspan<struct_Cim::Format::RegionSet,enum_gsl::byte><br>Cim::TryConvertSubspan<wchar_t_const_,enum_gsl::byte_const_><br>CimFs::AcquireForSectionSyncCallback<br>CimFs::AsyncCachedRead<br>CimFs::BuildAlignedMdl<br>CimFs::ClearCachedFcb<br>CimFs::ClearCachedFcbTree<br>CimFs::ClearFcbTree<br>CimFs::CommonCreate<br>CimFs::CommonFsctl<br>CimFs::DispatchControlCreate<br>CimFs::DispatchControlFsctl<br>CimFs::DispatchControlIoctl<br>CimFs::DispatchDiskCreate<br>CimFs::DispatchDiskIoctl<br>CimFs::DispatchDiskRead<br>CimFs::DispatchPreFsFilterOperationPriv<br>CimFs::DispatchVolumeDirectoryControl<br>CimFs::DispatchVolumeFsctl<br>CimFs::DispatchVolumeIoctl<br>CimFs::DispatchVolumeLockControl<br>CimFs::DispatchVolumeQueryEa<br>CimFs::DispatchVolumeQueryInformation<br>CimFs::DispatchVolumeQuerySecurity<br>CimFs::DispatchVolumeRead<br>CimFs::EnableDirectAccessForDataRegion<br>CimFs::ExceptionFilter<br>CimFs::FastIoDecode<br>CimFs::GetBlockLocationMappersForRegionSets<br>CimFs::GetFcb<br>CimFs::GetIoctlBuffers<br>CimFs::IsMergeMountKmHandleValid<br>CimFs::IssueSynchronousDeviceIoctl<br>CimFs::LockUserBuffer<br>CimFs::MergeMountVolumeInMemory<br>CimFs::MountVolume<br>CimFs::MountVolumeFromFileSystem<br>CimFs::MountVolumeInternal<br>CimFs::MountVolumeInternalInmemory<br>CimFs::NonCachedRead<br>CimFs::NotifyChangeDirectory<br>CimFs::OpenFileSystemKernel<br>CimFs::OpenRegionSetsKernel<br>CimFs::PrepareFileForDirectAccess<br>CimFs::PrepareRegion<br>CimFs::PrepareRegions<br>CimFs::ProcessAlignedMdlContextOnIrpCompletion<br>CimFs::QueryDirectAccessExtents<br>CimFs::QueryOpenFsFilterCallback<br>CimFs::ReleaseFcb<br>CimFs::SetCachedFileObject</details>|<details><summary>Expand for full list:<br><lambda_c3c156badebf65fb4aa63199b7e46cca>::operator()<br>Cim::AddDirectoryEntry<br>Cim::CopySecurityDescriptor<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::Fsctl<br>Cim::FileSystem::GetFullPath<br>Cim::FileSystem::GetImageMappings<br>Cim::FileSystem::GetMappingSegment<br>Cim::FileSystem::GetNameInformation<br>Cim::FileSystem::GetReparseData</summary>Cim::FileSystem::GetStreamSegment<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::QueryDirectory<br>Cim::FileSystem::QueryEa<br>Cim::FileSystem::QueryEffectiveAccess<br>Cim::FileSystem::QueryInformation<br>Cim::FileSystem::QueryStatInfo<br>Cim::FileSystem::QueryVirtualSizeOffset<br>Cim::FileSystem::QueryVolume<br>Cim::GetNextEa<br>Cim::GetNextRequestedEa<br>Cim::ImageReader::GetArray<enum_gsl::byte><br>Cim::ImageReader::GetArray<struct_Cim::Format::FileTableDirectoryEntry><br>Cim::ImageReader::GetArray<struct_Cim::Format::PeImageMapping><br>Cim::ImageReader::GetArray<struct_Cim::Format::PeImageMappingV1><br>Cim::ImageReader::GetArray<wchar_t><br>Cim::ImageReader::GetData<br>Cim::ImageReader::GetDataTruncate<br>Cim::ImageReader::GetFile<br>Cim::ImageReader::GetOffsetTruncate<br>Cim::ImageReader::GetStruct<struct_Cim::Format::Filesystem><br>Cim::ImageReader::GetStruct<struct_Cim::Format::PeImage><br>Cim::ImageReader::GetStruct<unsigned_int><br>Cim::ImageReader::GetStruct<unsigned_short><br>Cim::ImageReader::ParseName<br>Cim::InMemoryImage::CreateMergedFileTableDirectory<br>Cim::InMemoryImage::CreateMergedLinkTables<br>Cim::InMemoryImage::CreateMergedRegion<br>Cim::InMemoryImage::UpdateMergedFileList<br>Cim::InMemoryParser::GetCimIndex<br>Cim::InMemoryParser::GetFileName<br>Cim::InMemoryParser::GetNextFileOffset<br>Cim::InMemoryParser::InMemoryParser<br>Cim::LinkTable<enum_Cim::Format::FileId>::Parse<br>Cim::LinkTable<struct_Cim::Format::Stream>::Parse<br>Cim::TryConvertSubspan<int_const_,enum_gsl::byte_const_><br>Cim::TryConvertSubspan<struct_Cim::Format::RegionSet,enum_gsl::byte><br>Cim::TryConvertSubspan<wchar_t_const_,enum_gsl::byte_const_><br>CimFs::AcquireForSectionSyncCallback<br>CimFs::AsyncCachedRead<br>CimFs::BuildAlignedMdl<br>CimFs::ClearCachedFcb<br>CimFs::ClearCachedFcbTree<br>CimFs::ClearFcbTree<br>CimFs::CommonCreate<br>CimFs::CommonFsctl<br>CimFs::DispatchControlCreate<br>CimFs::DispatchControlFsctl<br>CimFs::DispatchControlIoctl<br>CimFs::DispatchDiskCreate<br>CimFs::DispatchDiskIoctl<br>CimFs::DispatchDiskRead<br>CimFs::DispatchPreFsFilterOperationPriv<br>CimFs::DispatchVolumeDirectoryControl<br>CimFs::DispatchVolumeFsctl<br>CimFs::DispatchVolumeIoctl<br>CimFs::DispatchVolumeLockControl<br>CimFs::DispatchVolumeQueryEa<br>CimFs::DispatchVolumeQueryInformation<br>CimFs::DispatchVolumeQuerySecurity<br>CimFs::DispatchVolumeRead<br>CimFs::EnableDirectAccessForDataRegion<br>CimFs::ExceptionFilter<br>CimFs::FastIoDecode<br>CimFs::GetBlockLocationMappersForRegionSets<br>CimFs::GetFcb<br>CimFs::GetIoctlBuffers<br>CimFs::IsMergeMountKmHandleValid<br>CimFs::IssueSynchronousDeviceIoctl<br>CimFs::LockUserBuffer<br>CimFs::MergeMountVolumeInMemory<br>CimFs::MountVolume<br>CimFs::MountVolumeFromFileSystem<br>CimFs::MountVolumeInternal<br>CimFs::MountVolumeInternalInmemory<br>CimFs::NonCachedRead<br>CimFs::NotifyChangeDirectory<br>CimFs::OpenFileSystemKernel<br>CimFs::OpenRegionSetsKernel<br>CimFs::PrepareFileForDirectAccess<br>CimFs::PrepareRegion<br>CimFs::PrepareRegions<br>CimFs::ProcessAlignedMdlContextOnIrpCompletion<br>CimFs::QueryDirectAccessExtents<br>CimFs::QueryOpenFsFilterCallback<br>CimFs::ReleaseFcb<br>CimFs::SetCachedFileObject</details>|
|paramcount|5|5|
|`address`|140015d68|140016148|
|sig|void __cdecl ProcessTraceStatusOrigin(long param_1, StackEventTracer * param_2, __uint64 param_3, char * param_4, char * param_5, ...)|void __cdecl ProcessTraceStatusOrigin(long param_1, StackEventTracer * param_2, __uint64 param_3, char * param_4, char * param_5, ...)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### ProcessTraceStatusOrigin Calling Diff


```diff

```


## NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|RtlUnregisterFeatureConfigurationChangeNotification|RtlUnregisterFeatureConfigurationChangeNotification|
|fullname|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification|NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification|
|`refcount`|3|6|
|length|0|0|
|called|||
|`calling`|DriverEntry<br>_CppDriverUnload|CimFs::DriverUnload<br>Cp_DriverEntry<br>DriverEntry<br>_CppDriverUnload|
|paramcount|0|0|
|`address`|EXTERNAL:000000a5|EXTERNAL:0000000c|
|sig|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)|undefined RtlUnregisterFeatureConfigurationChangeNotification(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification Calling Diff


```diff
--- NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification calling
+++ NTOSKRNL.EXE::RtlUnregisterFeatureConfigurationChangeNotification calling
@@ -0,0 +1,2 @@
+CimFs::DriverUnload
+Cp_DriverEntry
```


## NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|RtlUnregisterFeatureUsageProvider|RtlUnregisterFeatureUsageProvider|
|fullname|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider|NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider|
|`refcount`|3|6|
|length|0|0|
|called|||
|`calling`|DriverEntry<br>_CppDriverUnload|CimFs::DriverUnload<br>Cp_DriverEntry<br>DriverEntry<br>_CppDriverUnload|
|paramcount|0|0|
|`address`|EXTERNAL:000000a4|EXTERNAL:0000000b|
|sig|undefined RtlUnregisterFeatureUsageProvider(void)|undefined RtlUnregisterFeatureUsageProvider(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider Calling Diff


```diff
--- NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider calling
+++ NTOSKRNL.EXE::RtlUnregisterFeatureUsageProvider calling
@@ -0,0 +1,2 @@
+CimFs::DriverUnload
+Cp_DriverEntry
```


## NTOSKRNL.EXE::ExFreePoolWithTag

### Match Info



|Key|cim_8737.sys - cim_8875.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|cim_8737.sys|cim_8875.sys|
| :---: | :---: | :---: |
|name|ExFreePoolWithTag|ExFreePoolWithTag|
|fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag|
|`refcount`|468|470|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>Cim::BlockIOHandler::Create<br>Cim::BlockIOHandler::GetImageBuffer<br>Cim::BlockIOHandler::InsertRegionOrObjecIdInfoForAGuid<br>Cim::BlockIOHandler::PerformBlockDeviceValidations<br>Cim::BlockIOHandler::ReadBlockIntoMemory<br>Cim::BlockIOHandler::ReadFsHeaderBlockAndPopulateRegAndObjIdInfo<br>Cim::BlockIOHandler::ValidatePBTAndMapCimBlocks<br>Cim::BlockIOHandler::~BlockIOHandler<br>Cim::BlockLocationMapper::CacheRegionInMemory<br>Cim::BlockLocationMapper::GetImageMapperInstance<br>Cim::BlockLocationMapper::GetRegionMapperInstance</summary>Cim::BlockLocationMapper::~BlockLocationMapper<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::Fsctl<br>Cim::FileSystem::GetDataSegment<br>Cim::FileSystem::GetImageMappings<br>Cim::FileSystem::GetMappingSegment<br>Cim::FileSystem::GetNameInformation<br>Cim::FileSystem::GetReparseData<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::QueryDirectory<br>Cim::FileSystem::QueryEa<br>Cim::FileSystem::QueryEffectiveAccess<br>Cim::FileSystem::QueryInformation<br>Cim::FileSystem::QuerySecurity<br>Cim::FileSystem::QueryStatInfo<br>Cim::FileSystem::QueryVirtualSizeOffset<br>Cim::FileSystem::QueryVolume<br>Cim::FileSystemHeaderBlockInformation::FileSystemHeaderBlockInformation<br>Cim::FileSystemHeaderBlockInformation::~FileSystemHeaderBlockInformation<br>Cim::InMemoryImage::CreateMergedLinkTables<br>Cim::InMemoryImage::CreateMergedRegion<br>Cim::InMemoryImage::UpdateMergedFileList<br>Cim::InMemoryImage::operator=<br>Cim::InMemoryImage::~InMemoryImage<br>Cim::InMemoryParser::GetCimIndex<br>Cim::InMemoryParser::GetFileName<br>Cim::InMemoryParser::GetNextFileOffset<br>Cim::InMemoryParser::InMemoryParser<br>CimFs::AcquireForSectionSyncCallback<br>CimFs::AsyncCachedRead<br>CimFs::AsyncCachedReadCompletion<br>CimFs::AsyncCachedReadCompletionContext::~AsyncCachedReadCompletionContext<br>CimFs::BuildAlignedMdl<br>CimFs::CommonCreate<br>CimFs::DirectoryQueryCursor::~DirectoryQueryCursor<br>CimFs::DismountVolume<br>CimFs::DispatchControlCreate<br>CimFs::DispatchControlFsctl<br>CimFs::DispatchControlIoctl<br>CimFs::DispatchDiskClose<br>CimFs::DispatchDiskCreate<br>CimFs::DispatchDiskIoctl<br>CimFs::DispatchPreFsFilterOperationPriv<br>CimFs::DispatchPreFsFilterOperationPrivOnNewStack<br>CimFs::DispatchVolumeCleanup<br>CimFs::DispatchVolumeClose<br>CimFs::DispatchVolumeCreatePrivOnNewStack<br>CimFs::DispatchVolumeDirectoryControl<br>CimFs::DispatchVolumeFsctl<br>CimFs::DispatchVolumeIoctl<br>CimFs::DispatchVolumeLockControl<br>CimFs::EnableDirectAccessForDataRegion<br>CimFs::EventCompletionRoutine<br>CimFs::FCB::~FCB<br>CimFs::GetBlockLocationMappersForRegionSets<br>CimFs::IRPContext::`scalar_deleting_destructor'<br>CimFs::MappedRegion::~MappedRegion<br>CimFs::MergeMountVolumeInMemory<br>CimFs::MountVolume<br>CimFs::MountVolumeFromFileSystem<br>CimFs::MountVolumeHandles<br>CimFs::MountVolumeInternal<br>CimFs::MountVolumeInternalInmemory<br>CimFs::MultiSegmentAssociatedIrpCompletionRoutine<br>CimFs::NotifyChangeDirectory<br>CimFs::OpenFileSystemKernel<br>CimFs::OpenRegionSetsKernel<br>CimFs::PrepareFileForDirectAccess<br>CimFs::PrepareRegion<br>CimFs::PrepareRegions<br>CimFs::ProcessAlignedMdlContextOnIrpCompletion<br>CimFs::ReleaseForSectionSyncCallback<br>CimFs::SetCachedFileObject<br>CimFs::SingleSegmentAssociatedIrpCompletionRoutine<br>CimFs::StackEventTracer::~StackEventTracer<br>CmRegUtilUcValueGetFullBuffer<br>Cp_DriverEntry<br>DestroyAggregateSession<br>DestroyEventEntry<br>IoDevObjCreateDeviceSecure<br>PiRegStateReadStackCreationSettingsFromKey<br>PpRegStateUpdateStackCreationSettings<br>SeSddlSecurityDescriptorFromSDDL<br>SepSddlAddAceToAcl<br>SepSddlDaclFromSDDLString<br>SepSddlGetAclForString<br>SepSddlSecurityDescriptorFromSDDLString<br>doexit<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::_Rehash<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::emplace<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const&___ptr64,class_utl::shared_ptr<class_Cim::BlockIOHandler>&___ptr64,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0>::_Rehash<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0><br>utl::_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0>::clear<br>utl::_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0>::~_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0><br>utl::_RangeDestroyApc<class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_><br>utl::_RangeDestroyApc<class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_><br>utl::_RangeDestroyApc<class_utl::allocator<struct_CimFs::MappedRegionKernel>_><br>utl::_RefCountVtable<class_utl::_RefCountNormal<class_Cim::BlockIOHandler*___ptr64,struct_utl::default_delete<class_Cim::BlockIOHandler>,class_utl::allocator<int>_>,0>::_CallDeleter<br>utl::_RefCountVtable<class_utl::_RefCountNormal<wchar_t*___ptr64,struct_utl::default_delete<wchar_t>,class_utl::allocator<int>_>,0>::_CallDeleter<br>utl::_RefCountVtable<class_utl::_RefCountNormal<wchar_t*___ptr64,struct_utl::default_delete<wchar_t>,class_utl::allocator<int>_>,0>::_FreeRefCount<br>utl::_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::emplace<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId>,0><br>utl::_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::~_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0><br>utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::map<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>_>_>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::map<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>_>_>_>,0>::clear<br>utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::vector<unsigned_int,class_utl::allocator<unsigned_int>_>_>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::vector<unsigned_int,class_utl::allocator<unsigned_int>_>_>_>,0>::clear<br>utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,struct_Cim::Format::LinkTable>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,struct_Cim::Format::LinkTable>_>,0>::clear<br>utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>::assign<br>utl::vector<class_Cim::FileSystem,class_utl::allocator<class_Cim::FileSystem>_>::_Uninit<br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::_PushBackOne2<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const&___ptr64><br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::_SetCapacity<br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::~vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_><br>utl::vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_>::~vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_><br>utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::_SetCapacity<br>utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::emplace_back<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>&___ptr64,0><br>utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::operator=<br>utl::vector<enum_gsl::byte,class_utl::allocator<enum_gsl::byte>_>::resize<br>utl::vector<int,class_utl::allocator<int>_>::_Grow<br>utl::vector<struct_Cim::Format::File,class_utl::allocator<struct_Cim::Format::File>_>::_Grow<br>utl::vector<struct_Cim::Format::FileTableDirectoryEntry,class_utl::allocator<struct_Cim::Format::FileTableDirectoryEntry>_>::_Grow<br>utl::vector<struct_Cim::Format::RegionOffset,class_utl::allocator<struct_Cim::Format::RegionOffset>_>::_Grow<br>utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>::_Grow<br>utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>::_SetCapacity<br>utl::vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_>::_SetCapacity<br>utl::vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_>::~vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_><br>wil::details::out_param_ptr_t<struct__DEVICE_OBJECT*___ptr64*___ptr64,class_wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>_>::~out_param_ptr_t<struct__DEVICE_OBJECT*___ptr64*___ptr64,class_wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>_><br>wistd::unique_ptr<struct_CimFs::MappedRegion_[0],struct_wistd::default_delete<struct_CimFs::MappedRegion_[0]>_>::~unique_ptr<struct_CimFs::MappedRegion_[0],struct_wistd::default_delete<struct_CimFs::MappedRegion_[0]>_><br>wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>::~unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter></details>|<details><summary>Expand for full list:<br>Cim::BlockIOHandler::Create<br>Cim::BlockIOHandler::GetImageBuffer<br>Cim::BlockIOHandler::InsertRegionOrObjecIdInfoForAGuid<br>Cim::BlockIOHandler::PerformBlockDeviceValidations<br>Cim::BlockIOHandler::ReadBlockIntoMemory<br>Cim::BlockIOHandler::ReadFsHeaderBlockAndPopulateRegAndObjIdInfo<br>Cim::BlockIOHandler::ValidatePBTAndMapCimBlocks<br>Cim::BlockIOHandler::~BlockIOHandler<br>Cim::BlockLocationMapper::CacheRegionInMemory<br>Cim::BlockLocationMapper::GetImageMapperInstance<br>Cim::BlockLocationMapper::GetRegionMapperInstance</summary>Cim::BlockLocationMapper::~BlockLocationMapper<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::FileSystem<br>Cim::FileSystem::Fsctl<br>Cim::FileSystem::GetDataSegment<br>Cim::FileSystem::GetImageMappings<br>Cim::FileSystem::GetMappingSegment<br>Cim::FileSystem::GetNameInformation<br>Cim::FileSystem::GetReparseData<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::Open<br>Cim::FileSystem::QueryDirectory<br>Cim::FileSystem::QueryEa<br>Cim::FileSystem::QueryEffectiveAccess<br>Cim::FileSystem::QueryInformation<br>Cim::FileSystem::QuerySecurity<br>Cim::FileSystem::QueryStatInfo<br>Cim::FileSystem::QueryVirtualSizeOffset<br>Cim::FileSystem::QueryVolume<br>Cim::FileSystemHeaderBlockInformation::FileSystemHeaderBlockInformation<br>Cim::FileSystemHeaderBlockInformation::~FileSystemHeaderBlockInformation<br>Cim::InMemoryImage::CreateMergedLinkTables<br>Cim::InMemoryImage::CreateMergedRegion<br>Cim::InMemoryImage::UpdateMergedFileList<br>Cim::InMemoryImage::operator=<br>Cim::InMemoryImage::~InMemoryImage<br>Cim::InMemoryParser::GetCimIndex<br>Cim::InMemoryParser::GetFileName<br>Cim::InMemoryParser::GetNextFileOffset<br>Cim::InMemoryParser::InMemoryParser<br>CimFs::AcquireForSectionSyncCallback<br>CimFs::AsyncCachedRead<br>CimFs::AsyncCachedReadCompletion<br>CimFs::AsyncCachedReadCompletionContext::~AsyncCachedReadCompletionContext<br>CimFs::BuildAlignedMdl<br>CimFs::CommonCreate<br>CimFs::DirectoryQueryCursor::~DirectoryQueryCursor<br>CimFs::DismountVolume<br>CimFs::DispatchControlCreate<br>CimFs::DispatchControlFsctl<br>CimFs::DispatchControlIoctl<br>CimFs::DispatchDiskClose<br>CimFs::DispatchDiskCreate<br>CimFs::DispatchDiskIoctl<br>CimFs::DispatchPreFsFilterOperationPriv<br>CimFs::DispatchPreFsFilterOperationPrivOnNewStack<br>CimFs::DispatchVolumeCleanup<br>CimFs::DispatchVolumeClose<br>CimFs::DispatchVolumeCreatePrivOnNewStack<br>CimFs::DispatchVolumeDirectoryControl<br>CimFs::DispatchVolumeFsctl<br>CimFs::DispatchVolumeIoctl<br>CimFs::DispatchVolumeLockControl<br>CimFs::EnableDirectAccessForDataRegion<br>CimFs::EventCompletionRoutine<br>CimFs::FCB::~FCB<br>CimFs::GetBlockLocationMappersForRegionSets<br>CimFs::IRPContext::`scalar_deleting_destructor'<br>CimFs::MappedRegion::~MappedRegion<br>CimFs::MergeMountVolumeInMemory<br>CimFs::MountVolume<br>CimFs::MountVolumeFromFileSystem<br>CimFs::MountVolumeHandles<br>CimFs::MountVolumeInternal<br>CimFs::MountVolumeInternalInmemory<br>CimFs::MultiSegmentAssociatedIrpCompletionRoutine<br>CimFs::NotifyChangeDirectory<br>CimFs::OpenFileSystemKernel<br>CimFs::OpenRegionSetsKernel<br>CimFs::PrepareFileForDirectAccess<br>CimFs::PrepareRegion<br>CimFs::PrepareRegions<br>CimFs::ProcessAlignedMdlContextOnIrpCompletion<br>CimFs::ReleaseForSectionSyncCallback<br>CimFs::SetCachedFileObject<br>CimFs::SingleSegmentAssociatedIrpCompletionRoutine<br>CimFs::StackEventTracer::~StackEventTracer<br>CmRegUtilUcValueGetFullBuffer<br>Cp_DriverEntry<br>DestroyAggregateSession<br>DestroyEventEntry<br>IoDevObjCreateDeviceSecure<br>PiRegStateReadStackCreationSettingsFromKey<br>PpRegStateUpdateStackCreationSettings<br>SeSddlSecurityDescriptorFromSDDL<br>SepSddlAddAceToAcl<br>SepSddlDaclFromSDDLString<br>SepSddlGetAclForString<br>SepSddlSecurityDescriptorFromSDDLString<br>doexit<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::_Rehash<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::emplace<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const&___ptr64,class_utl::shared_ptr<class_Cim::BlockIOHandler>&___ptr64,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,class_utl::weak_ptr<class_Cim::BlockIOHandler>_>_>,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::_Rehash<br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0><br>utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0>::~_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0><br>utl::_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0>::clear<br>utl::_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0>::~_HashTable<struct__GUID,struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>,struct_Cim::GUIDHash,struct_Cim::GUIDKeyEqual,class_utl::allocator<struct_utl::pair<struct__GUID_const_,class_utl::unique_ptr<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,struct_utl::default_delete<class_utl::set<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>_>_>,0><br>utl::_RangeDestroyApc<class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_><br>utl::_RangeDestroyApc<class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_><br>utl::_RangeDestroyApc<class_utl::allocator<struct_CimFs::MappedRegionKernel>_><br>utl::_RefCountVtable<class_utl::_RefCountNormal<class_Cim::BlockIOHandler*___ptr64,struct_utl::default_delete<class_Cim::BlockIOHandler>,class_utl::allocator<int>_>,0>::_CallDeleter<br>utl::_RefCountVtable<class_utl::_RefCountNormal<wchar_t*___ptr64,struct_utl::default_delete<wchar_t>,class_utl::allocator<int>_>,0>::_CallDeleter<br>utl::_RefCountVtable<class_utl::_RefCountNormal<wchar_t*___ptr64,struct_utl::default_delete<wchar_t>,class_utl::allocator<int>_>,0>::_FreeRefCount<br>utl::_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::emplace<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId>,0><br>utl::_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::~_Tree<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0><br>utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::map<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>_>_>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::map<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,enum_Cim::Format::FileId,class_Cim::UpcaseTableLess,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>_>_>_>,0>::clear<br>utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::vector<unsigned_int,class_utl::allocator<unsigned_int>_>_>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,class_utl::vector<unsigned_int,class_utl::allocator<unsigned_int>_>_>_>,0>::clear<br>utl::_Tree<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>,0>::~_Tree<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>,0><br>utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>::assign<br>utl::vector<class_Cim::FileSystem,class_utl::allocator<class_Cim::FileSystem>_>::_Uninit<br>utl::vector<class_gsl::span<wchar_t_const_,-1>,class_utl::allocator<class_gsl::span<wchar_t_const_,-1>_>_>::_Grow<br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::_PushBackOne2<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const&___ptr64><br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::_SetCapacity<br>utl::vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_>::~vector<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,class_utl::allocator<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>_><br>utl::vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_>::_SetCapacity<br>utl::vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_>::~vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_><br>utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::emplace_back<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>&___ptr64,0><br>utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::operator=<br>utl::vector<enum_Cim::Format::FileId,class_utl::allocator<enum_Cim::Format::FileId>_>::_Grow<br>utl::vector<enum_gsl::byte,class_utl::allocator<enum_gsl::byte>_>::resize<br>utl::vector<struct_Cim::Format::File,class_utl::allocator<struct_Cim::Format::File>_>::_Grow<br>utl::vector<struct_Cim::Format::RegionOffset,class_utl::allocator<struct_Cim::Format::RegionOffset>_>::_Grow<br>utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>::_Grow<br>utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>::_SetCapacity<br>utl::vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_>::_SetCapacity<br>utl::vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_>::~vector<struct_CimFs::MappedRegionKernel,class_utl::allocator<struct_CimFs::MappedRegionKernel>_><br>wil::details::out_param_ptr_t<struct__DEVICE_OBJECT*___ptr64*___ptr64,class_wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>_>::~out_param_ptr_t<struct__DEVICE_OBJECT*___ptr64*___ptr64,class_wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>_><br>wistd::unique_ptr<struct_CimFs::MappedRegion_[0],struct_wistd::default_delete<struct_CimFs::MappedRegion_[0]>_>::~unique_ptr<struct_CimFs::MappedRegion_[0],struct_wistd::default_delete<struct_CimFs::MappedRegion_[0]>_><br>wistd::unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter>::~unique_ptr<struct_CimFs::VolumeDevice,struct_CimFs::DeviceDeleter></details>|
|paramcount|0|0|
|`address`|EXTERNAL:0000006f|EXTERNAL:00000075|
|sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff


```diff
--- NTOSKRNL.EXE::ExFreePoolWithTag calling
+++ NTOSKRNL.EXE::ExFreePoolWithTag calling
@@ -105,0 +106 @@
+utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,enum_Cim::Format::FileId>_>,0>::_Rehash
@@ -107 +107,0 @@
-utl::_HashTable<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>,struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>,struct_utl::hash<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,struct_utl::equal_to<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_>,class_utl::allocator<struct_utl::pair<class_utl::basic_string<wchar_t,struct_utl::char_traits<wchar_t>,class_utl::allocator<wchar_t>_>_const_,struct_Cim::FileSystemHeaderBlockInformation>_>,0>::_Rehash
@@ -121 +121 @@
-utl::_Tree<enum_Cim::Format::FileId,struct_utl::pair<enum_Cim::Format::FileId_const_,struct_Cim::Format::LinkTable>,struct_utl::less<enum_Cim::Format::FileId>,class_utl::allocator<struct_utl::pair<enum_Cim::Format::FileId_const_,struct_Cim::Format::LinkTable>_>,0>::clear
+utl::_Tree<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>,0>::~_Tree<struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfo,struct_Cim::RegionOrObjectIdInfoLess,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>,0>
@@ -123,0 +124 @@
+utl::vector<class_gsl::span<wchar_t_const_,-1>,class_utl::allocator<class_gsl::span<wchar_t_const_,-1>_>_>::_Grow
@@ -126,0 +128 @@
+utl::vector<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>,class_utl::allocator<class_utl::vector<struct_Cim::Format::RegionSet,class_utl::allocator<struct_Cim::Format::RegionSet>_>_>_>::_SetCapacity
@@ -128 +129,0 @@
-utl::vector<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>,class_utl::allocator<class_utl::vector<struct_Cim::RegionOrObjectIdInfo,class_utl::allocator<struct_Cim::RegionOrObjectIdInfo>_>_>_>::_SetCapacity
@@ -130,0 +132 @@
+utl::vector<enum_Cim::Format::FileId,class_utl::allocator<enum_Cim::Format::FileId>_>::_Grow
@@ -132 +133,0 @@
-utl::vector<int,class_utl::allocator<int>_>::_Grow
@@ -134 +134,0 @@
-utl::vector<struct_Cim::Format::FileTableDirectoryEntry,class_utl::allocator<struct_Cim::Format::FileTableDirectoryEntry>_>::_Grow
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-21T21:37:23</sub>