# cldflt-2024-05.sys-cldflt-2024-06.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [FUN_1c006963c](#fun_1c006963c) * [FUN_1c00671a0](#fun_1c00671a0) * [FUN_1c0069dfc](#fun_1c0069dfc) * [Modified (No Code Changes)](#modified-no-code-changes) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [NTOSKRNL.EXE::FsRtlUninitializeBaseMcb](#ntoskrnlexefsrtluninitializebasemcb) # Visual Chart Diff ```mermaid flowchart LR FUN_1c006963c-7-old<--Match 68%-->FUN_1c0077140-7-new FUN_1c00671a0-6-old<--Match 9%-->FUN_1c007a7c0-6-new FUN_1c0069dfc-8-old<--Match 23%-->FUN_1c00102e4-8-new subgraph cldflt-2024-06.sys FUN_1c0077140-7-new FUN_1c007a7c0-6-new FUN_1c00102e4-8-new end subgraph cldflt-2024-05.sys FUN_1c006963c-7-old FUN_1c00671a0-6-old FUN_1c0069dfc-8-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 2721 ``` ```mermaid pie showData title Matched Function Similarity - 99.4855% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 11 "matched_funcs_no_changes_len" : 2707 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --no-symbols --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cldflt-2024-05.sys cldflt-2024-06.sys ``` #### Verbose Args

``` --old ['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-05.sys'] --new [['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-06.sys']] --engine VersionTrackingDiff --output-path /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2024-30085 --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols True --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cldflt.sys/39CA8EB98C000/cldflt.sys -O cldflt.sys.x64.10.0.22621.3672 wget https://msdl.microsoft.com/download/symbols/cldflt.sys/5B556DF88C000/cldflt.sys -O cldflt.sys.x64.10.0.22621.3733 ``` ## Binary Metadata Diff ```diff --- cldflt-2024-05.sys Meta +++ cldflt-2024-06.sys Meta @@ -1,43 +1,43 @@ -Program Name: cldflt-2024-05.sys +Program Name: cldflt-2024-06.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f -# of Bytes: 577688 +# of Bytes: 577696 # of Memory Blocks: 14 -# of Instructions: 106880 -# of Defined Data: 2947 -# of Functions: 1360 -# of Symbols: 14436 +# of Instructions: 106972 +# of Defined Data: 2960 +# of Functions: 1361 +# of Symbols: 14435 # of Data Types: 161 # of Data Type Categories: 13 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Jul 26 18:39:53 SGT 2026 +Date Created: Sun Jul 26 18:39:56 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-05.sys -Executable MD5: 9bd45c253a2e8e77d0da0c1249ac6322 -Executable SHA256: fff42100bfe8870c3988f572d35c1f4d3f194a35e2e6673bdd26cbc5da78e828 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-05.sys?MD5=9bd45c253a2e8e77d0da0c1249ac6322 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-06.sys +Executable MD5: 6ecd764bb754b1e5d251ffa71b80c9dd +Executable SHA256: 0b495138e1ce25decdd3a940fd584288bd219131a35b57a977aefb214503ca88 +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/cldflt-2024-06.sys?MD5=6ecd764bb754b1e5d251ffa71b80c9dd PDB Age: 1 PDB File: cldflt.pdb -PDB GUID: 185e1766-3d3d-f525-6782-3fb6bfd3fbd2 +PDB GUID: 0ea33523-cc15-3df3-011d-e646dd4ed539 PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Cloud Files Mini Filter Driver -PE Property[FileVersion]: 10.0.22621.3672 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.3733 (WinBuild.160101.0800) PE Property[InternalName]: cldflt.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cldflt.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.3672 +PE Property[ProductVersion]: 10.0.22621.3733 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra cldflt-2024-05.sys Decompiler Options

Ghidra cldflt-2024-05.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cldflt-2024-05.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|false| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra cldflt-2024-06.sys Decompiler Options

Ghidra cldflt-2024-06.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cldflt-2024-06.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|14| |added_symbols_len|0| |deleted_symbols_len|0| |diff_time|8.566090106964111| |deleted_strings_len|1| |added_strings_len|0| |match_types|Counter({'ExactInstructionsFunctionHasher': 525, 'StructuralGraphHash': 467, 'ExactBytesFunctionHasher': 382, 'SymbolsHash': 342, 'ExternalsName': 328, 'BulkInstructionHash': 36, 'BSIM': 10, 'StructuralGraphExactHash': 1})| |items_to_process|14| |diff_types|Counter({'refcount': 13, 'calling': 13, 'name': 6, 'fullname': 6, 'sig': 6, 'address': 6, 'called': 5, 'code': 3, 'length': 3})| |unmatched_funcs_len|0| |total_funcs_len|2721| |matched_funcs_len|2721| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|11| |matched_funcs_no_changes_len|2707| |match_func_similarity_percent|99.4855%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'ExactInstructionsFunctionHasher': 525, 'StructuralGraphHash': 467, 'ExactBytesFunctionHasher': 382, 'SymbolsHash': 342, 'BulkInstructionHash': 36, 'BSIM': 10, 'StructuralGraphExactHash': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 342 "ExternalsName" : 328 "ExactBytesFunctionHasher" : 382 "ExactInstructionsFunctionHasher" : 525 "StructuralGraphExactHash" : 1 "BSIM" : 10 "BulkInstructionHash" : 36 "StructuralGraphHash" : 467 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 342 "ExactBytesFunctionHasher" : 382 "ExactInstructionsFunctionHasher" : 525 "StructuralGraphExactHash" : 1 "BSIM" : 10 "BulkInstructionHash" : 36 "StructuralGraphHash" : 467 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 14 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 0 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 0 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1 +0,0 @@ -s_create ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_create_1c001f5e8|1|FUN_1c007158c| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | # Deleted # Added # Modified *Modified functions contain code changes* ## FUN_1c006963c ### Match Info |Key|cldflt-2024-05.sys - cldflt-2024-06.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.28| |i_ratio|0.55| |m_ratio|0.98| |b_ratio|0.68| |match_types|BSIM| ### Function Meta Diff |Key|cldflt-2024-05.sys|cldflt-2024-06.sys| | :---: | :---: | :---: | |`name`|FUN_1c006963c|FUN_1c0077140| |`fullname`|FUN_1c006963c|FUN_1c0077140| |`refcount`|3|4| |`length`|1975|2075| |`called`|

Expand for full list:
FLTMGR.SYS::FltInitializePushLock
FUN_1c0004140
FUN_1c0008324
FUN_1c00096dc
FUN_1c00170b8
FUN_1c001721c
FUN_1c0017f9c
FUN_1c001ca80
FUN_1c00313b0
FUN_1c00359a4
NTOSKRNL.EXE::ExAllocatePool2

NTOSKRNL.EXE::RtlComputeCrc32

Expand for full list:
FLTMGR.SYS::FltInitializePushLock
FUN_1c0004140
FUN_1c0008324
FUN_1c00096dc
FUN_1c00102e4
FUN_1c00170ac
FUN_1c0017108
FUN_1c001726c
FUN_1c0017fec
FUN_1c001cac0
FUN_1c00313b0

FUN_1c00359a4
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::RtlComputeCrc32

| |`calling`|FUN_1c00671a0
FUN_1c0069dfc|FUN_1c007a7c0| |paramcount|7|7| |`address`|1c006963c|1c0077140| |`sig`|int __fastcall FUN_1c006963c(ulonglong param_1, undefined8 param_2, longlong param_3, undefined4 param_4, longlong param_5, uint param_6, undefined8 * param_7)|ulonglong __fastcall FUN_1c0077140(ulonglong param_1, undefined8 param_2, longlong param_3, undefined4 param_4, longlong param_5, uint param_6, undefined8 * param_7)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_1c006963c Called Diff ```diff --- FUN_1c006963c called +++ FUN_1c0077140 called @@ -5,4 +5,6 @@ -FUN_1c00170b8 -FUN_1c001721c -FUN_1c0017f9c -FUN_1c001ca80 +FUN_1c00102e4 +FUN_1c00170ac +FUN_1c0017108 +FUN_1c001726c +FUN_1c0017fec +FUN_1c001cac0 ``` ### FUN_1c006963c Calling Diff ```diff --- FUN_1c006963c calling +++ FUN_1c0077140 calling @@ -1,2 +1 @@ -FUN_1c00671a0 -FUN_1c0069dfc +FUN_1c007a7c0 ``` ### FUN_1c006963c Diff ```diff --- FUN_1c006963c +++ FUN_1c0077140 @@ -1,334 +1,305 @@ -int FUN_1c006963c(ulonglong param_1,undefined8 param_2,longlong param_3,undefined4 param_4, - longlong param_5,uint param_6,undefined8 *param_7) +ulonglong FUN_1c0077140(ulonglong param_1,undefined8 param_2,longlong param_3,undefined4 param_4, + longlong param_5,uint param_6,undefined8 *param_7) { - uint uVar1; - uint uVar2; - undefined8 uVar3; - code *pcVar4; + longlong *plVar1; + undefined8 *puVar2; + uint uVar3; + int iVar4; uint uVar5; undefined4 uVar6; - longlong lVar7; - undefined8 *puVar8; - longlong *plVar9; + ulonglong uVar7; + longlong lVar8; + undefined8 *puVar9; undefined8 *puVar10; - ulonglong uVar11; - undefined2 uVar12; - longlong *plVar13; - int iVar14; - undefined1 *puVar15; - int iVar16; - ulonglong uVar17; - undefined8 uVar18; - uint uVar19; + undefined2 uVar11; + ulonglong uVar12; + ulonglong uVar13; + ulonglong uVar14; + undefined8 uVar15; + uint uVar16; undefined4 local_res20 [2]; - undefined1 auStackY_c8 [8]; - undefined1 auStackY_c0 [24]; byte local_78; byte local_77; undefined8 *local_70; undefined8 local_68; int local_40 [2]; - puVar15 = auStackY_c8; - uVar19 = 0; + uVar13 = 0; local_77 = 0; local_68 = 0; local_78 = 0; local_70 = (undefined8 *)0x0; - uVar17 = param_1; + uVar7 = param_1; local_res20[0] = param_4; if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (3 < (byte)PTR_LOOP_1c0026170[0x29])) { - FUN_1c001721c(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x5d,param_1,param_1,param_2, + FUN_1c001726c(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x5d,param_1,param_1,param_2, (undefined *)local_res20); } - iVar14 = 0; + uVar12 = 0; if ((param_6 < 0x18) || (*(ushort *)(param_5 + 0xe) < 3)) { LAB_0: - iVar14 = -0x3ffffddb; - } - else { - uVar1 = *(uint *)(param_5 + 8); - uVar17 = (ulonglong)uVar1; - if ((((uVar1 < 0x28) || (0x11 < *(ushort *)(param_5 + 0x20))) || - ((uVar2 = *(uint *)(param_5 + 0x24), uVar2 != 0 && - ((uVar2 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar1 < uVar2)))))) || - (((uVar1 < *(ushort *)(param_5 + 0x22) || - (((uVar5 = *(ushort *)(param_5 + 0x22) + uVar2, uVar5 < uVar2 || (uVar1 < uVar5)) || + uVar12 = 0xc0000225; + } + else { + uVar16 = *(uint *)(param_5 + 8); + uVar7 = (ulonglong)uVar16; + if ((((uVar16 < 0x28) || (0x11 < *(ushort *)(param_5 + 0x20))) || + ((uVar3 = *(uint *)(param_5 + 0x24), uVar3 != 0 && + ((uVar3 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar16 < uVar3)))))) || + (((uVar16 < *(ushort *)(param_5 + 0x22) || + (((uVar5 = *(ushort *)(param_5 + 0x22) + uVar3, uVar5 < uVar3 || (uVar16 < uVar5)) || (*(ushort *)(param_5 + 0x20) != 7)))) || (*(short *)(param_5 + 0x22) != 1)))) goto LAB_0; local_77 = *(byte *)((ulonglong)*(uint *)(param_5 + 0x24) + param_5); } - FUN_1c0004140(iVar14); - if (iVar14 < 0) { - if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { - return iVar14; - } - if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { - return iVar14; - } - if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { - return iVar14; - } - uVar12 = 0x5e; + FUN_1c0004140((int)uVar12); + if ((int)uVar12 < 0) { + if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { + return uVar12; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return uVar12; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return uVar12; + } + uVar11 = 0x5e; goto LAB_1; } if ((param_6 < 0x18) || (*(ushort *)(param_5 + 0xe) < 2)) { LAB_2: - iVar14 = -0x3ffffddb; - } - else { - uVar1 = *(uint *)(param_5 + 8); - uVar17 = (ulonglong)uVar1; - if (((uVar1 < 0x20) || (0x11 < *(ushort *)(param_5 + 0x18))) || - (((uVar2 = *(uint *)(param_5 + 0x1c), uVar2 != 0 && - ((uVar2 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar1 < uVar2)))) || - ((uVar1 < *(ushort *)(param_5 + 0x1a) || - ((((uVar5 = *(ushort *)(param_5 + 0x1a) + uVar2, uVar5 < uVar2 || (uVar1 < uVar5)) || + uVar12 = 0xc0000225; + } + else { + uVar16 = *(uint *)(param_5 + 8); + uVar7 = (ulonglong)uVar16; + if (((uVar16 < 0x20) || (0x11 < *(ushort *)(param_5 + 0x18))) || + (((uVar3 = *(uint *)(param_5 + 0x1c), uVar3 != 0 && + ((uVar3 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar16 < uVar3)))) || + ((uVar16 < *(ushort *)(param_5 + 0x1a) || + ((((uVar5 = *(ushort *)(param_5 + 0x1a) + uVar3, uVar5 < uVar3 || (uVar16 < uVar5)) || (*(ushort *)(param_5 + 0x18) != 7)) || (*(short *)(param_5 + 0x1a) != 1)))))))) goto LAB_2; - iVar14 = 0; + uVar12 = 0; local_78 = *(byte *)((ulonglong)*(uint *)(param_5 + 0x1c) + param_5); } - FUN_1c0004140(iVar14); - if (iVar14 < 0) { - if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { - return iVar14; - } - if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { - return iVar14; - } - if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { - return iVar14; - } - uVar12 = 0x5f; + FUN_1c0004140((int)uVar12); + if ((int)uVar12 < 0) { + if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { + return uVar12; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return uVar12; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return uVar12; + } + uVar11 = 0x5f; goto LAB_1; } if ((param_6 < 0x18) || (*(ushort *)(param_5 + 0xe) < 4)) { LAB_3: - iVar14 = -0x3ffffddb; - } - else { - uVar1 = *(uint *)(param_5 + 8); - uVar17 = (ulonglong)uVar1; - if ((((uVar1 < 0x30) || (0x11 < *(ushort *)(param_5 + 0x28))) || - ((uVar2 = *(uint *)(param_5 + 0x2c), uVar2 != 0 && - ((uVar2 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar1 < uVar2)))))) || - (((uVar1 < *(ushort *)(param_5 + 0x2a) || - (((uVar5 = *(ushort *)(param_5 + 0x2a) + uVar2, uVar5 < uVar2 || (uVar1 < uVar5)) || + uVar12 = 0xc0000225; + } + else { + uVar16 = *(uint *)(param_5 + 8); + uVar7 = (ulonglong)uVar16; + if ((((uVar16 < 0x30) || (0x11 < *(ushort *)(param_5 + 0x28))) || + ((uVar3 = *(uint *)(param_5 + 0x2c), uVar3 != 0 && + ((uVar3 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar16 < uVar3)))))) || + (((uVar16 < *(ushort *)(param_5 + 0x2a) || + (((uVar5 = *(ushort *)(param_5 + 0x2a) + uVar3, uVar5 < uVar3 || (uVar16 < uVar5)) || (*(ushort *)(param_5 + 0x28) != 6)))) || (*(short *)(param_5 + 0x2a) != 8)))) goto LAB_3; - iVar14 = 0; + uVar12 = 0; local_68 = *(undefined8 *)((ulonglong)*(uint *)(param_5 + 0x2c) + param_5); } - FUN_1c0004140(iVar14); - iVar16 = 0; - if (iVar14 < 0) { - if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { - return iVar14; - } - if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { - return iVar14; - } - if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { - return iVar14; - } - uVar12 = 0x60; + FUN_1c0004140((int)uVar12); + if ((int)uVar12 < 0) { + if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { + return uVar12; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return uVar12; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return uVar12; + } + uVar11 = 0x60; goto LAB_1; } if (param_6 < 0x18) { - iVar16 = -0x3ffffddb; - uVar19 = 0; + uVar14 = 0xc0000225; } else { if (*(ushort *)(param_5 + 0xe) < 5) { LAB_4: - iVar16 = -0x3ffffddb; + uVar14 = 0xc0000225; } else { - uVar1 = *(uint *)(param_5 + 8); - uVar17 = (ulonglong)uVar1; - if ((((uVar1 < 0x38) || (0x11 < *(ushort *)(param_5 + 0x30))) || - ((uVar2 = *(uint *)(param_5 + 0x34), uVar2 != 0 && - ((uVar2 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar1 < uVar2)))))) || - ((uVar1 < *(ushort *)(param_5 + 0x32) || - (((uVar5 = *(ushort *)(param_5 + 0x32) + uVar2, uVar5 < uVar2 || (uVar1 < uVar5)) || + uVar16 = *(uint *)(param_5 + 8); + uVar7 = (ulonglong)uVar16; + if ((((uVar16 < 0x38) || (0x11 < *(ushort *)(param_5 + 0x30))) || + ((uVar3 = *(uint *)(param_5 + 0x34), uVar3 != 0 && + ((uVar3 < (uint)*(ushort *)(param_5 + 0xe) * 8 + 0x10 || (uVar16 < uVar3)))))) || + ((uVar16 < *(ushort *)(param_5 + 0x32) || + (((uVar5 = *(ushort *)(param_5 + 0x32) + uVar3, uVar5 < uVar3 || (uVar16 < uVar5)) || (*(ushort *)(param_5 + 0x30) != 0x11)))))) goto LAB_4; if ((*(uint *)(param_5 + 0x34) == 0) || (*(short *)(param_5 + 0x32) == 0)) { local_70 = (undefined8 *)0x0; } else { - local_70 = (undefined8 *)(param_5 + (ulonglong)*(uint *)(param_5 + 0x34)); + local_70 = (undefined8 *)((ulonglong)*(uint *)(param_5 + 0x34) + param_5); } - uVar19 = (uint)*(ushort *)(param_5 + 0x32); - } - if (iVar16 < 0) { - uVar19 = 0; - } - } - FUN_1c0004140(iVar16); - iVar14 = 0; - if (iVar16 != -0x3ffffddb) { - iVar14 = iVar16; - } - if (iVar14 < 0) { - if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { - return iVar14; - } - if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { - return iVar14; - } - if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { - return iVar14; - } - uVar12 = 0x61; + uVar13 = (ulonglong)*(ushort *)(param_5 + 0x32); + uVar14 = 0; + } + if ((int)uVar14 < 0) { + uVar13 = 0; + } + } + FUN_1c0004140((int)uVar14); + uVar12 = 0; + if ((int)uVar14 != -0x3ffffddb) { + uVar12 = uVar14; + } + if ((int)uVar12 < 0) { + if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { + return uVar12; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return uVar12; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return uVar12; + } + uVar11 = 0x61; LAB_1: - FUN_1c00170b8(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar12,uVar17,param_2,param_3, + FUN_1c0017108(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar11,uVar7,param_2,param_3, (undefined *)local_res20); - return iVar14; + return uVar12; + } + uVar7 = FUN_1c00102e4(); + uVar16 = (uint)uVar13; + if (((int)uVar7 != 0) && (0x1000 < uVar16)) { + FUN_1c0004140(-0x3fff30fe); + if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { + return 0xc000cf02; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return 0xc000cf02; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return 0xc000cf02; + } + FUN_1c00170ac(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x62,&DAT_5,uVar16); + return 0xc000cf02; } if ((local_78 != 0) && - (lVar7 = FUN_1c00359a4(1,(ulonglong)(uint)(1 << (local_78 & 0x1f))), lVar7 < param_3)) { + (lVar8 = FUN_1c00359a4(1,(ulonglong)(uint)(1 << (local_78 & 0x1f))), lVar8 < param_3)) { FUN_1c0004140(-0x3fffff1b); - return -0x3fffff1b; - } - uVar17 = 0x6d427348; - puVar8 = (undefined8 *)ExAllocatePool2(0x40); - if (puVar8 == (undefined8 *)0x0) { - iVar14 = -0x3fffff66; + return 0xc00000e5; + } + uVar7 = 0x6d427348; + puVar9 = (undefined8 *)ExAllocatePool2(0x40); + if (puVar9 == (undefined8 *)0x0) { + uVar12 = 0xc000009a; FUN_1c0004140(-0x3fffff66); if ((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) { - return -0x3fffff66; - } - if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { - return -0x3fffff66; - } - if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { - return -0x3fffff66; - } - uVar12 = 0x62; + return 0xc000009a; + } + if ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0) { + return 0xc000009a; + } + if ((byte)PTR_LOOP_1c0026170[0x29] < 2) { + return 0xc000009a; + } + uVar11 = 99; goto LAB_1; } - uVar1 = *(uint *)(puVar8 + 2); - plVar13 = puVar8 + 0xe; - puVar8[1] = param_3; - *puVar8 = param_2; + *puVar9 = param_2; + puVar9[1] = param_3; *param_7 = 0; - *(uint *)(puVar8 + 2) = (local_78 & 0x3f) << 6 | uVar1 & 0xfffff038; - *(undefined4 *)((longlong)puVar8 + 0x14) = 1; - puVar8[5] = param_1; - *(uint *)(puVar8 + 2) = - *(uint *)(puVar8 + 2) ^ ((uint)local_77 << 0xc ^ *(uint *)(puVar8 + 2)) & 0x7000; - *(undefined4 *)(puVar8 + 4) = local_res20[0]; - puVar8[0x12] = local_68; - puVar10 = puVar8 + 0x10; - puVar8[0xf] = plVar13; - *plVar13 = (longlong)plVar13; - puVar8[0x11] = puVar10; - *puVar10 = puVar10; - plVar9 = puVar8 + 9; - lVar7 = *plVar13; - if (*(longlong **)(lVar7 + 8) != plVar13) { - pcVar4 = (code *)swi(0x29); - plVar9 = (longlong *)(*pcVar4)(3); - puVar15 = auStackY_c0; - } - *plVar9 = lVar7; - plVar9[1] = (longlong)plVar13; - *(longlong **)(lVar7 + 8) = plVar9; - *plVar13 = (longlong)plVar9; - *(undefined8 *)(puVar15 + -8) = 0x1c0069b6e; - FltInitializePushLock(puVar8 + 6); - *(undefined8 *)(puVar15 + -8) = 0x1c0069b7e; - FltInitializePushLock(puVar8 + 8); - if ((local_70 == (undefined8 *)0x0) || (0xffe < uVar19 - 1)) { - uVar18 = 0x6d427348; - *(undefined8 *)(puVar15 + -8) = 0x1c0069cb3; + *(uint *)(puVar9 + 2) = (local_78 & 0x3f) << 6 | *(uint *)(puVar9 + 2) & 0xfffff038; + puVar10 = puVar9 + 0xe; + *(undefined4 *)((longlong)puVar9 + 0x14) = 1; + puVar9[5] = param_1; + *(uint *)(puVar9 + 2) = + *(uint *)(puVar9 + 2) ^ ((uint)local_77 << 0xc ^ *(uint *)(puVar9 + 2)) & 0x7000; + *(undefined4 *)(puVar9 + 4) = local_res20[0]; + puVar9[0x12] = local_68; + puVar2 = puVar9 + 0x10; + puVar9[0x11] = puVar2; + *puVar2 = puVar2; + plVar1 = puVar9 + 9; + *plVar1 = (longlong)puVar10; + puVar9[10] = puVar10; + puVar9[0xf] = plVar1; + *puVar10 = plVar1; + FltInitializePushLock(puVar9 + 6); + FltInitializePushLock(puVar9 + 8); + if ((local_70 == (undefined8 *)0x0) || (0xffe < uVar16 - 1)) { + uVar15 = 0x6d427348; puVar10 = (undefined8 *)ExAllocatePool2(0x100,0x1000); - puVar8[7] = puVar10; + puVar9[7] = puVar10; if (puVar10 != (undefined8 *)0x0) { - *(undefined8 *)(puVar15 + -8) = 0x1c0069d33; - FUN_1c001ca80(puVar10,local_70,(ulonglong)uVar19); - goto LAB_5; - } - *(undefined8 *)(puVar15 + -8) = 0x1c0069ccf; + FUN_1c001cac0(puVar10,local_70,uVar13); + goto LAB_6; + } FUN_1c0004140(-0x3fffff66); if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0026170[0x29] < 2)) - goto LAB_6; - uVar12 = 100; - } - else { - uVar17 = (ulonglong)uVar19; - iVar16 = *(int *)((uVar17 - 4) + (longlong)local_70); - if ((iVar16 == -1) && (uVar19 == 4)) { - *(uint *)(puVar8 + 2) = *(uint *)(puVar8 + 2) | 0x10; -LAB_5: + goto LAB_7; + uVar11 = 0x65; + } + else { + iVar4 = *(int *)((uVar13 - 4) + (longlong)local_70); + if ((iVar4 == -1) && (uVar16 == 4)) { + *(uint *)(puVar9 + 2) = *(uint *)(puVar9 + 2) | 0x10; +LAB_6: local_40[0] = 0; local_40[1] = 0; - *(undefined8 *)(puVar15 + -8) = 0x1c0069d56; - FUN_1c00096dc((longlong)puVar8); - *(undefined8 *)(puVar15 + -8) = 0x1c0069d6d; + FUN_1c00096dc((longlong)puVar9); FUN_1c0008324(FUN_1c00092c0,local_40); if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (3 < (byte)PTR_LOOP_1c0026170[0x29]) ) { - uVar19 = *(uint *)(puVar8 + 2); - uVar18 = puVar8[0x12]; - uVar3 = *(undefined8 *)(PTR_LOOP_1c0026170 + 0x18); - *(undefined4 *)(puVar15 + 0x40) = *(undefined4 *)(puVar8 + 3); - *(undefined8 *)(puVar15 + 0x38) = uVar18; - uVar18 = *puVar8; - *(uint *)(puVar15 + 0x30) = uVar19 >> 0xc & 7; - *(undefined8 **)(puVar15 + 0x28) = puVar8 + 4; - *(undefined8 *)(puVar15 + 0x20) = uVar18; - *(undefined8 *)(puVar15 + -8) = 0x1c0069dd3; - FUN_1c0017f9c(uVar3,0x65,uVar18,puVar8,*(undefined8 *)(puVar15 + 0x20), - *(undefined **)(puVar15 + 0x28)); + FUN_1c0017fec(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x66,*puVar9,puVar9,*puVar9, + (undefined *)(puVar9 + 4)); } - *param_7 = puVar8; - return iVar14; - } - uVar18 = 0x6d427348; - *(undefined8 *)(puVar15 + -8) = 0x1c0069bd7; + *param_7 = puVar9; + return uVar12; + } + uVar15 = 0x6d427348; puVar10 = (undefined8 *)ExAllocatePool2(0x100,0x1000); - puVar8[7] = puVar10; + puVar9[7] = puVar10; if (puVar10 != (undefined8 *)0x0) { - *(undefined8 *)(puVar15 + -8) = 0x1c0069c3d; - FUN_1c001ca80(puVar10,local_70,uVar17); - if (uVar19 < 0xffc) { - uVar11 = (ulonglong)((0xffb - uVar19 >> 2) + 1); + FUN_1c001cac0(puVar10,local_70,uVar13); + if (uVar16 < 0xffc) { + uVar7 = (ulonglong)((0xffb - uVar16 >> 2) + 1); do { - *(int *)(uVar17 + puVar8[7]) = iVar16; - uVar17 = uVar17 + 4; - uVar11 = uVar11 - 1; - } while (uVar11 != 0); + *(int *)(uVar13 + puVar9[7]) = iVar4; + uVar13 = uVar13 + 4; + uVar7 = uVar7 - 1; + } while (uVar7 != 0); } - uVar18 = puVar8[7]; - *(undefined8 *)(puVar15 + -8) = 0x1c0069c80; - uVar6 = RtlComputeCrc32(0,uVar18,0xffc); - *(undefined4 *)(puVar8[7] + 0xffc) = uVar6; - goto LAB_5; - } - *(undefined8 *)(puVar15 + -8) = 0x1c0069bf3; + uVar6 = RtlComputeCrc32(0,puVar9[7],0xffc); + *(undefined4 *)(puVar9[7] + 0xffc) = uVar6; + goto LAB_6; + } FUN_1c0004140(-0x3fffff66); if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0026170[0x29] < 2)) - goto LAB_6; - uVar12 = 99; - } - uVar3 = *(undefined8 *)(PTR_LOOP_1c0026170 + 0x18); - *(undefined4 *)(puVar15 + 0x30) = 0xc000009a; - *(undefined4 **)(puVar15 + 0x28) = local_res20; - *(longlong *)(puVar15 + 0x20) = param_3; - *(undefined8 *)(puVar15 + -8) = 0x1c0069d17; - FUN_1c00170b8(uVar3,uVar12,uVar18,param_2,*(undefined8 *)(puVar15 + 0x20), - *(undefined **)(puVar15 + 0x28)); -LAB_6: - *(undefined8 *)(puVar15 + -8) = 0x1c0069d1f; - FUN_1c00313b0((longlong)puVar8); - return -0x3fffff66; + goto LAB_7; + uVar11 = 100; + } + FUN_1c0017108(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar11,uVar15,param_2,param_3, + (undefined *)local_res20); +LAB_7: + FUN_1c00313b0((longlong)puVar9); + return 0xc000009a; } ``` ## FUN_1c00671a0 ### Match Info |Key|cldflt-2024-05.sys - cldflt-2024-06.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,called| |ratio|0.12| |i_ratio|0.14| |m_ratio|0.97| |b_ratio|0.09| |match_types|BSIM| ### Function Meta Diff |Key|cldflt-2024-05.sys|cldflt-2024-06.sys| | :---: | :---: | :---: | |`name`|FUN_1c00671a0|FUN_1c007a7c0| |`fullname`|FUN_1c00671a0|FUN_1c007a7c0| |`refcount`|2|4| |`length`|4338|4287| |`called`|

Expand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltInitializePushLock
FLTMGR.SYS::FltReleaseContext
FUN_1c0004140
FUN_1c00092fc
FUN_1c000a234
FUN_1c001ca80
FUN_1c001cd80
FUN_1c00313b0
FUN_1c00670c8
FUN_1c00682a0

FUN_1c00684f0
FUN_1c006963c
FUN_1c0069dfc
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::KeInitializeEvent
_guard_dispatch_icall

Expand for full list:
FLTMGR.SYS::FltAllocateContext
FLTMGR.SYS::FltInitializePushLock
FLTMGR.SYS::FltReleaseContext
FUN_1c0004140
FUN_1c00092fc
FUN_1c000a234
FUN_1c000be38
FUN_1c000bf88
FUN_1c00102e4
FUN_1c001cac0
FUN_1c001cdc0

FUN_1c0067330
FUN_1c0069190
FUN_1c0075048
FUN_1c0077140
FUN_1c0079998
NTOSKRNL.EXE::ExAllocateFromPagedLookasideList
NTOSKRNL.EXE::ExAllocatePool2
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::ExInitializeRundownProtection
NTOSKRNL.EXE::FsRtlUninitializeBaseMcb
NTOSKRNL.EXE::KeInitializeEvent
_guard_dispatch_icall

| |calling|FUN_1c004e650|FUN_1c004e650| |paramcount|6|6| |`address`|1c00671a0|1c007a7c0| |`sig`|int __fastcall FUN_1c00671a0(ulonglong param_1, longlong * * param_2, undefined8 param_3, uint * param_4, uint param_5, undefined8 * param_6)|int __fastcall FUN_1c007a7c0(ulonglong param_1, longlong * * param_2, undefined8 param_3, uint * param_4, uint param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_1c00671a0 Called Diff ```diff --- FUN_1c00671a0 called +++ FUN_1c007a7c0 called @@ -7,8 +7,10 @@ -FUN_1c001ca80 -FUN_1c001cd80 -FUN_1c00313b0 -FUN_1c00670c8 -FUN_1c00682a0 -FUN_1c00684f0 -FUN_1c006963c -FUN_1c0069dfc +FUN_1c000be38 +FUN_1c000bf88 +FUN_1c00102e4 +FUN_1c001cac0 +FUN_1c001cdc0 +FUN_1c0067330 +FUN_1c0069190 +FUN_1c0075048 +FUN_1c0077140 +FUN_1c0079998 @@ -16,0 +19 @@ +NTOSKRNL.EXE::ExFreePoolWithTag @@ -17,0 +21 @@ +NTOSKRNL.EXE::FsRtlUninitializeBaseMcb ``` ### FUN_1c00671a0 Diff ```diff --- FUN_1c00671a0 +++ FUN_1c007a7c0 @@ -1,524 +1,616 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -int FUN_1c00671a0(ulonglong param_1,longlong **param_2,undefined8 param_3,uint *param_4,uint param_5 +int FUN_1c007a7c0(ulonglong param_1,longlong **param_2,undefined8 param_3,uint *param_4,uint param_5 ,undefined8 *param_6) { ushort *puVar1; uint *puVar2; - ushort uVar3; - int iVar4; - uint uVar5; + int iVar3; + ushort uVar4; + int iVar5; uint uVar6; uint uVar7; - uint *puVar8; - longlong *plVar9; - int *piVar10; - longlong lVar11; + uint uVar8; + uint uVar9; + longlong *plVar10; + int *piVar11; ulonglong uVar12; - ulonglong uVar13; - undefined2 uVar14; - uint uVar15; + uint *puVar13; + longlong lVar14; + undefined2 uVar15; undefined4 *puVar16; undefined8 uVar17; - undefined8 *puVar18; - ulonglong uVar19; - longlong **pplVar20; + undefined8 uVar18; + uint uVar19; + uint uVar20; uint uVar21; - uint uVar22; + undefined8 *puVar22; longlong **pplVar23; - longlong *local_98; - int local_90 [2]; + longlong *local_a8; + int local_a0; + uint local_9c; + uint local_98; + undefined8 local_90; undefined8 local_88; - uint local_80; + longlong local_80; longlong local_78; longlong local_70; longlong local_68; - longlong local_60 [2]; - longlong local_50; - ulonglong local_48; - undefined8 local_40; + longlong **local_60; + longlong **local_58; + longlong **local_50; + undefined8 local_48; - puVar8 = (uint *)0x0; - local_98 = (longlong *)0x0; - local_60[0] = 0; - local_40 = 0; + puVar13 = (uint *)0x0; + local_a8 = (longlong *)0x0; + local_68 = 0; + uVar9 = 0; + local_48 = 0; *param_6 = 0; + local_9c = 0; + local_60 = (longlong **)0x0; + local_58 = (longlong **)0x0; + local_50 = (longlong **)0x0; local_80 = 0; - local_50 = 0; - uVar21 = 0; - local_48 = 0; local_78 = 0; local_70 = 0; - local_68 = 0; - local_90[0] = 0; - iVar4 = FUN_1c00682a0(param_1,(longlong)param_2,param_3,local_60); - FUN_1c0004140(iVar4); - lVar11 = local_60[0]; - if (iVar4 < 0) { + local_a0 = 0; + iVar5 = FUN_1c0069190(param_1,(longlong)param_2,param_3,&local_68); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) { FUN_1c00092fc(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x43,&DAT_0,param_1); } goto LAB_1; } - local_88 = *(undefined8 *)(local_60[0] + 0x20); - pplVar23 = &local_98; - iVar4 = FltAllocateContext(DAT_2,8,0xa8,0x200,pplVar23); - FUN_1c0004140(iVar4); - if (iVar4 < 0) { + pplVar23 = &local_a8; + local_88 = *(undefined8 *)(local_68 + 0x20); + iVar5 = FltAllocateContext(DAT_2,8,0xa8,0x200,pplVar23); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0026170[0x29] < 2)) goto LAB_1; - uVar14 = 0x44; -LAB_3: - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar14,&DAT_0,param_1); - goto LAB_1; - } - FUN_1c001cd80(local_98,0,(undefined1 *)0xa8); - *(undefined4 *)local_98 = 0x63537348; - ExInitializeRundownProtection(local_98 + 0xf); - KeInitializeEvent(local_98 + 0x10,0,1); - local_60[0] = 0; - local_98[2] = lVar11; - LOCK(); - UNLOCK(); - lVar11 = DAT_4 + 1; - DAT_4 = DAT_4 + 1; - local_98[5] = lVar11; - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 1; - FltInitializePushLock(local_98 + 8); - plVar9 = local_98 + 0xb; - local_98[0xc] = (longlong)plVar9; - *plVar9 = (longlong)plVar9; - piVar10 = FUN_1c00684f0(param_4,param_5); - iVar4 = (int)piVar10; - FUN_1c0004140(iVar4); - if (iVar4 < 0) { - if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) - { - pplVar23 = (longlong **)local_98[2]; - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x45,&DAT_0,param_1); - } - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 4; - if (iVar4 == -0x3fffffa8) { - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 8; - } - else if (iVar4 == -0x3fffffa7) { - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x10; - } - } - if ((*(uint *)((longlong)local_98 + 0x1c) & 4) == 0) { - uVar21 = param_5 - 4; - puVar8 = param_4 + 1; - if (param_5 < 5) { - uVar21 = 0; - } - puVar1 = (ushort *)((longlong)param_4 + 0x12); - puVar2 = param_4 + 3; - uVar15 = local_80; - if (0x17 < uVar21) { - if (((((((3 < *puVar1) && (uVar15 = *puVar2, 0x2f < uVar15)) && ((ushort)param_4[0xb] < 0x12)) - && ((uVar22 = param_4[0xc], uVar22 == 0 || - (((uint)*puVar1 * 8 + 0x10 <= uVar22 && (uVar22 <= uVar15)))))) && - (*(ushort *)((longlong)param_4 + 0x2e) <= uVar15)) && - ((uVar6 = *(ushort *)((longlong)param_4 + 0x2e) + uVar22, (ushort)param_4[0xb] == 0x11 && - (uVar22 <= uVar6)))) && (uVar6 <= uVar15)) { - if ((param_4[0xc] == 0) || (*(short *)((longlong)param_4 + 0x2e) == 0)) { - puVar18 = (undefined8 *)0x0; + uVar15 = 0x44; + } + else { + FUN_1c001cdc0(local_a8,0,(undefined1 *)0xa8); + *(undefined4 *)local_a8 = 0x63537348; + ExInitializeRundownProtection(local_a8 + 0xf); + KeInitializeEvent(local_a8 + 0x10,0,1); + lVar14 = local_68; + local_68 = 0; + local_a8[2] = lVar14; + LOCK(); + UNLOCK(); + lVar14 = DAT_3 + 1; + DAT_3 = DAT_3 + 1; + local_a8[5] = lVar14; + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 1; + FltInitializePushLock(local_a8 + 8); + plVar10 = local_a8 + 0xb; + local_a8[0xc] = (longlong)plVar10; + *plVar10 = (longlong)plVar10; + piVar11 = FUN_1c0067330(param_4,param_5); + iVar5 = (int)piVar11; + FUN_1c0004140(iVar5); + if (iVar5 < 0) { + if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29]) + ) { + pplVar23 = (longlong **)local_a8[2]; + FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x45,&DAT_0,param_1); + } + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 4; + if (iVar5 == -0x3fffffa8) { + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 8; + } + else if (iVar5 == -0x3fffffa7) { + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x10; + } + } + local_90 = local_a8; + if ((*(uint *)((longlong)local_a8 + 0x1c) & 4) == 0) { + uVar9 = param_5 - 4; + puVar13 = param_4 + 1; + if (param_5 < 5) { + uVar9 = 0; + } + puVar1 = (ushort *)((longlong)param_4 + 0x12); + puVar2 = param_4 + 3; + if (0x17 < uVar9) { + if ((((3 < *puVar1) && (uVar20 = *puVar2, 0x2f < uVar20)) && + (((ushort)param_4[0xb] < 0x12 && + (((uVar21 = param_4[0xc], uVar21 == 0 || + (((uint)*puVar1 * 8 + 0x10 <= uVar21 && (uVar21 <= uVar20)))) && + (*(ushort *)((longlong)param_4 + 0x2e) <= uVar20)))))) && + (((uVar6 = *(ushort *)((longlong)param_4 + 0x2e) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)) && ((ushort)param_4[0xb] == 0x11)))) { + if ((param_4[0xc] == 0) || + (puVar22 = (undefined8 *)((longlong)puVar13 + (ulonglong)param_4[0xc]), + *(short *)((longlong)param_4 + 0x2e) == 0)) { + puVar22 = (undefined8 *)0x0; + } + uVar4 = *(ushort *)((longlong)param_4 + 0x2e); + local_98 = (uint)uVar4; + if ((puVar22 != (undefined8 *)0x0) && (local_98 != 0)) { + local_90 = (longlong *)(ulonglong)uVar4; + lVar14 = ExAllocatePool2(0x102,(longlong *)(ulonglong)uVar4,0x69467348,0x11,pplVar23); + local_a8[6] = lVar14; + if ((undefined8 *)local_a8[6] == (undefined8 *)0x0) { + iVar5 = -0x3fffff66; + FUN_1c0004140(-0x3fffff66); + goto LAB_1; + } + FUN_1c001cac0((undefined8 *)local_a8[6],puVar22,(ulonglong)local_90); + *(uint *)(local_a8 + 7) = local_98; + local_90 = local_a8; + } + } + if ((((((1 < *puVar1) && (uVar20 = *puVar2, 0x1f < uVar20)) && ((ushort)param_4[7] < 0x12)) + && ((uVar21 = param_4[8], uVar21 == 0 || + (((uint)*puVar1 * 8 + 0x10 <= uVar21 && (uVar21 <= uVar20)))))) && + (*(ushort *)((longlong)param_4 + 0x1e) <= uVar20)) && + (((uVar6 = *(ushort *)((longlong)param_4 + 0x1e) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)) && + (((ushort)param_4[7] == 10 && (*(short *)((longlong)param_4 + 0x1e) == 4)))))) { + local_9c = *(uint *)((ulonglong)param_4[8] + (longlong)puVar13); + } + } + local_a8 = local_90; + uVar20 = local_9c; + *(uint *)((longlong)local_90 + 0x1c) = + *(uint *)((longlong)local_90 + 0x1c) ^ + (local_9c << 5 ^ *(uint *)((longlong)local_90 + 0x1c)) & 0x20; + *(uint *)((longlong)local_90 + 0x1c) = + *(uint *)((longlong)local_90 + 0x1c) ^ + (local_9c << 5 ^ *(uint *)((longlong)local_90 + 0x1c)) & 0x40; + *(uint *)((longlong)local_90 + 0x1c) = + *(uint *)((longlong)local_90 + 0x1c) ^ + (local_9c << 6 ^ *(uint *)((longlong)local_90 + 0x1c)) & 0x100; + *(uint *)((longlong)local_90 + 0x1c) = + *(uint *)((longlong)local_90 + 0x1c) ^ + (local_9c << 7 ^ *(uint *)((longlong)local_90 + 0x1c)) & 0x400; + local_90 = (longlong *)(CONCAT44(local_90._4_4_,local_9c) & 0xffffffff00000020); + *(uint *)((longlong)local_a8 + 0x1c) = + -(uint)((local_9c & 0x20) != 0) & 0x1000 | + *(uint *)((longlong)local_a8 + 0x1c) & 0xffffefff; + *(uint *)((longlong)local_a8 + 0x1c) = + *(uint *)((longlong)local_a8 + 0x1c) ^ + (local_9c << 7 ^ *(uint *)((longlong)local_a8 + 0x1c)) & 0x2000; + local_98 = local_9c & 0x10; + *(uint *)((longlong)local_a8 + 0x1c) = + -(uint)(local_98 != 0) & 2 | *(uint *)((longlong)local_a8 + 0x1c) & 0xfffffffd; + *(uint *)((longlong)local_a8 + 0x1c) = + *(uint *)((longlong)local_a8 + 0x1c) ^ + (local_9c << 7 ^ *(uint *)((longlong)local_a8 + 0x1c)) & 0x4000; + *(uint *)((longlong)local_a8 + 0x1c) = + *(uint *)((longlong)local_a8 + 0x1c) ^ + (local_9c << 7 ^ *(uint *)((longlong)local_a8 + 0x1c)) & 0x8000; + *(uint *)((longlong)local_a8 + 0x1c) = + *(uint *)((longlong)local_a8 + 0x1c) ^ + (local_9c << 7 ^ *(uint *)((longlong)local_a8 + 0x1c)) & 0x10000; + uVar12 = FUN_1c00102e4(); + if ((((int)uVar12 != 0) && ((param_4[-2] & 0x1000) != 0)) && + ((local_98 == 0 || ((int)local_90 == 0)))) { + FUN_1c000bf88(); + iVar5 = -0x3fff30fe; + FUN_1c0004140(-0x3fff30fe); + if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && + (1 < (byte)PTR_LOOP_1c0026170[0x29])) { + FUN_1c000be38(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x46,&DAT_0,uVar20); + } + goto LAB_1; + } + if ((*(uint *)((longlong)local_a8 + 0x1c) & 2) == 0) { + if (((((0x17 < uVar9) && (2 < *puVar1)) && + ((uVar20 = *puVar2, 0x27 < uVar20 && ((ushort)param_4[9] < 0x12)))) && + ((uVar21 = param_4[10], uVar21 == 0 || + (((uint)*puVar1 * 8 + 0x10 <= uVar21 && (uVar21 <= uVar20)))))) && + ((*(ushort *)((longlong)param_4 + 0x26) <= uVar20 && + ((((uVar6 = *(ushort *)((longlong)param_4 + 0x26) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)) && ((ushort)param_4[9] == 6)) && + (*(short *)((longlong)param_4 + 0x26) == 8)))))) { + local_48 = *(undefined8 *)((ulonglong)param_4[10] + (longlong)puVar13); + } + goto LAB_4; + } + } + else { +LAB_4: + lVar14 = ExAllocateFromPagedLookasideList(&DAT_5); + local_a8[0x14] = lVar14; + puVar22 = (undefined8 *)local_a8[0x14]; + if (puVar22 == (undefined8 *)0x0) { + iVar5 = -0x3fffff66; + FUN_1c0004140(-0x3fffff66); + if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || + ((byte)PTR_LOOP_1c0026170[0x29] < 2)) goto LAB_1; + uVar15 = 0x47; + goto LAB_6; + } + *puVar22 = 0; + puVar22[1] = 0; + puVar22[2] = 0; + puVar22[3] = 0; + puVar22[4] = 0; + puVar22[5] = 0; + puVar22[6] = 0; + puVar22[7] = 0; + puVar22[8] = 0; + puVar22[9] = 0; + puVar22[10] = 0; + puVar22[0xb] = 0; + FltInitializePushLock(local_a8[0x14] + 0x28); + lVar14 = local_a8[0x14] + 0x50; + *(longlong *)(local_a8[0x14] + 0x58) = lVar14; + *(longlong *)lVar14 = lVar14; + lVar14 = local_a8[0x14]; + if (((uVar9 < 0x18) || (*(ushort *)((longlong)puVar13 + 0xe) < 8)) || + (uVar20 = puVar13[2], uVar20 < 0x50)) { +LAB_7: + puVar22 = (undefined8 *)(lVar14 + 8); + if (0x17 < uVar9) goto LAB_8; +LAB_9: + *(undefined4 *)(local_a8[0x14] + 0x18) = 1; + puVar16 = (undefined4 *)(local_a8[0x14] + 0x18); + if (0x17 < uVar9) goto LAB_10; + } + else { + if (((ushort)puVar13[0x12] < 0x12) && + ((((uVar21 = puVar13[0x13], uVar21 == 0 || + (((uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 <= uVar21 && + (uVar21 <= uVar20)))) && (*(ushort *)((longlong)puVar13 + 0x4a) <= uVar20)) && + ((uVar6 = *(ushort *)((longlong)puVar13 + 0x4a) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)))))) { + if (((ushort)puVar13[0x12] != 6) || (*(short *)((longlong)puVar13 + 0x4a) != 8)) + goto LAB_7; + *(undefined8 *)(lVar14 + 0x10) = + *(undefined8 *)((ulonglong)puVar13[0x13] + (longlong)puVar13); + puVar22 = (undefined8 *)(local_a8[0x14] + 8); } else { - puVar18 = (undefined8 *)((longlong)puVar8 + (ulonglong)param_4[0xc]); - } - uVar3 = *(ushort *)((longlong)param_4 + 0x2e); - if ((puVar18 != (undefined8 *)0x0) && (uVar3 != 0)) { - lVar11 = ExAllocatePool2(0x102,uVar3,0x69467348,uVar22,pplVar23); - local_98[6] = lVar11; - if ((undefined8 *)local_98[6] == (undefined8 *)0x0) { - iVar4 = -0x3fffff66; - FUN_1c0004140(-0x3fffff66); - goto LAB_1; - } - FUN_1c001ca80((undefined8 *)local_98[6],puVar18,(ulonglong)(uint)uVar3); - *(uint *)(local_98 + 7) = (uint)uVar3; - } - } - uVar15 = local_80; - if ((((1 < *puVar1) && (uVar22 = *puVar2, 0x1f < uVar22)) && ((ushort)param_4[7] < 0x12)) && - (((uVar6 = param_4[8], uVar6 == 0 || - (((uint)*puVar1 * 8 + 0x10 <= uVar6 && (uVar6 <= uVar22)))) && - ((*(ushort *)((longlong)param_4 + 0x1e) <= uVar22 && - (((uVar5 = *(ushort *)((longlong)param_4 + 0x1e) + uVar6, (ushort)param_4[7] == 10 && - (uVar6 <= uVar5)) && ((uVar5 <= uVar22 && (*(short *)((longlong)param_4 + 0x1e) == 4))) - ))))))) { - uVar15 = *(uint *)((ulonglong)param_4[8] + (longlong)puVar8); - } - } - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 5 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x20; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 5 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x40; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 6 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x100; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x400; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x1000; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x2000; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 >> 3 ^ *(uint *)((longlong)local_98 + 0x1c)) & 2; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x4000; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x8000; - *(uint *)((longlong)local_98 + 0x1c) = - *(uint *)((longlong)local_98 + 0x1c) ^ - (uVar15 << 7 ^ *(uint *)((longlong)local_98 + 0x1c)) & 0x10000; - if ((*(uint *)((longlong)local_98 + 0x1c) & 2) == 0) { - if (((((((0x17 < uVar21) && (2 < *puVar1)) && (uVar15 = *puVar2, 0x27 < uVar15)) && - ((ushort)param_4[9] < 0x12)) && - ((uVar22 = param_4[10], uVar22 == 0 || - (((uint)*puVar1 * 8 + 0x10 <= uVar22 && (uVar22 <= uVar15)))))) && - ((*(ushort *)((longlong)param_4 + 0x26) <= uVar15 && - ((uVar6 = *(ushort *)((longlong)param_4 + 0x26) + uVar22, (ushort)param_4[9] == 6 && - (uVar22 <= uVar6)))))) && - ((uVar6 <= uVar15 && (*(short *)((longlong)param_4 + 0x26) == 8)))) { - local_40 = *(undefined8 *)((ulonglong)param_4[10] + (longlong)puVar8); - } - goto LAB_5; - } - } - else { -LAB_5: - lVar11 = ExAllocateFromPagedLookasideList(&DAT_6); - local_98[0x14] = lVar11; - if ((longlong *)local_98[0x14] == (longlong *)0x0) { - iVar4 = -0x3fffff66; - FUN_1c0004140(-0x3fffff66); - if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0026170[0x29] < 2) - ) goto LAB_1; - uVar14 = 0x46; - goto LAB_3; - } - FUN_1c001cd80((longlong *)local_98[0x14],0,(undefined1 *)0x60); - FltInitializePushLock(local_98[0x14] + 0x28); - lVar11 = local_98[0x14] + 0x50; - *(longlong *)(local_98[0x14] + 0x58) = lVar11; - *(longlong *)lVar11 = lVar11; - lVar11 = local_98[0x14]; - if (((uVar21 < 0x18) || (*(ushort *)((longlong)puVar8 + 0xe) < 8)) || - (uVar15 = puVar8[2], uVar15 < 0x50)) { -LAB_7: - puVar18 = (undefined8 *)(lVar11 + 8); - if (0x17 < uVar21) goto LAB_8; -LAB_9: - *(undefined4 *)(local_98[0x14] + 0x18) = 1; - puVar16 = (undefined4 *)(local_98[0x14] + 0x18); - if (0x17 < uVar21) goto LAB_10; - } - else { - if (((ushort)puVar8[0x12] < 0x12) && - ((((uVar22 = puVar8[0x13], uVar22 == 0 || - (((uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 <= uVar22 && (uVar22 <= uVar15))) - ) && (*(ushort *)((longlong)puVar8 + 0x4a) <= uVar15)) && - ((uVar6 = *(ushort *)((longlong)puVar8 + 0x4a) + uVar22, uVar22 <= uVar6 && - (uVar6 <= uVar15)))))) { - if (((ushort)puVar8[0x12] != 6) || (*(short *)((longlong)puVar8 + 0x4a) != 8)) - goto LAB_7; - *(undefined8 *)(lVar11 + 0x10) = *(undefined8 *)((ulonglong)puVar8[0x13] + (longlong)puVar8) - ; - puVar18 = (undefined8 *)(local_98[0x14] + 8); - } - else { - puVar18 = (undefined8 *)(lVar11 + 8); - } + puVar22 = (undefined8 *)(lVar14 + 8); + } LAB_8: - if ((*(ushort *)((longlong)puVar8 + 0xe) < 9) || (uVar15 = puVar8[2], uVar15 < 0x58)) - goto LAB_9; - if (((((ushort)puVar8[0x14] < 0x12) && - ((uVar22 = puVar8[0x15], uVar22 == 0 || - (((uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 <= uVar22 && (uVar22 <= uVar15))) - ))) && (*(ushort *)((longlong)puVar8 + 0x52) <= uVar15)) && - ((uVar6 = *(ushort *)((longlong)puVar8 + 0x52) + uVar22, uVar22 <= uVar6 && - (uVar6 <= uVar15)))) { - if (((ushort)puVar8[0x14] != 6) || (*(short *)((longlong)puVar8 + 0x52) != 8)) + if ((*(ushort *)((longlong)puVar13 + 0xe) < 9) || (uVar20 = puVar13[2], uVar20 < 0x58)) goto LAB_9; - *puVar18 = *(undefined8 *)((ulonglong)puVar8[0x15] + (longlong)puVar8); - *(undefined4 *)(local_98[0x14] + 0x18) = 1; - puVar16 = (undefined4 *)(local_98[0x14] + 0x18); - } - else { - *(undefined4 *)(local_98[0x14] + 0x18) = 1; - puVar16 = (undefined4 *)(local_98[0x14] + 0x18); - } + if (((((ushort)puVar13[0x14] < 0x12) && + ((uVar21 = puVar13[0x15], uVar21 == 0 || + (((uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 <= uVar21 && + (uVar21 <= uVar20)))))) && (*(ushort *)((longlong)puVar13 + 0x52) <= uVar20)) && + ((uVar6 = *(ushort *)((longlong)puVar13 + 0x52) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)))) { + if (((ushort)puVar13[0x14] != 6) || (*(short *)((longlong)puVar13 + 0x52) != 8)) + goto LAB_9; + *puVar22 = *(undefined8 *)((ulonglong)puVar13[0x15] + (longlong)puVar13); + *(undefined4 *)(local_a8[0x14] + 0x18) = 1; + puVar16 = (undefined4 *)(local_a8[0x14] + 0x18); + } + else { + *(undefined4 *)(local_a8[0x14] + 0x18) = 1; + puVar16 = (undefined4 *)(local_a8[0x14] + 0x18); + } LAB_10: - if (((((9 < *(ushort *)((longlong)puVar8 + 0xe)) && (uVar15 = puVar8[2], 0x5f < uVar15)) && - ((ushort)puVar8[0x16] < 0x12)) && - ((uVar22 = puVar8[0x17], uVar22 == 0 || - (((uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 <= uVar22 && (uVar22 <= uVar15)))) - )) && ((*(ushort *)((longlong)puVar8 + 0x5a) <= uVar15 && - (((uVar6 = *(ushort *)((longlong)puVar8 + 0x5a) + uVar22, - (ushort)puVar8[0x16] == 10 && (uVar22 <= uVar6)) && - ((uVar6 <= uVar15 && (*(short *)((longlong)puVar8 + 0x5a) == 4)))))))) { - *puVar16 = *(undefined4 *)((ulonglong)puVar8[0x17] + (longlong)puVar8); - } - } - uVar15 = 0xc0000225; - *(undefined8 *)local_98[0x14] = local_40; - if ((*(uint *)((longlong)local_98 + 0x1c) & 0x40) == 0) { - if (uVar21 < 0x18) { - FUN_1c0004140(-0x3ffffddb); - } - else { - pplVar20 = (longlong **)0x0; - uVar22 = 0; - if (((((*(ushort *)((longlong)puVar8 + 0xe) < 5) || (uVar6 = puVar8[2], uVar6 < 0x38)) || - (0x11 < (ushort)puVar8[0xc])) || - (((uVar5 = puVar8[0xd], uVar5 != 0 && - ((uVar5 < (uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 || (uVar6 < uVar5)))) - || (uVar6 < *(ushort *)((longlong)puVar8 + 0x32))))) || - (((uVar7 = *(ushort *)((longlong)puVar8 + 0x32) + uVar5, (ushort)puVar8[0xc] != 0x11 || - (uVar7 < uVar5)) || (uVar6 < uVar7)))) { - uVar6 = 0xc0000225; + if (((((9 < *(ushort *)((longlong)puVar13 + 0xe)) && (uVar20 = puVar13[2], 0x5f < uVar20)) + && ((ushort)puVar13[0x16] < 0x12)) && + ((uVar21 = puVar13[0x17], uVar21 == 0 || + (((uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 <= uVar21 && (uVar21 <= uVar20) + ))))) && + ((*(ushort *)((longlong)puVar13 + 0x5a) <= uVar20 && + (((uVar6 = *(ushort *)((longlong)puVar13 + 0x5a) + uVar21, uVar21 <= uVar6 && + (uVar6 <= uVar20)) && + (((ushort)puVar13[0x16] == 10 && (*(short *)((longlong)puVar13 + 0x5a) == 4)))))))) { + *puVar16 = *(undefined4 *)((ulonglong)puVar13[0x17] + (longlong)puVar13); + } + } + *(undefined8 *)local_a8[0x14] = local_48; + uVar20 = 0xc0000225; + if ((*(uint *)((longlong)local_a8 + 0x1c) & 0x40) == 0) { + if (uVar9 < 0x18) { + FUN_1c0004140(-0x3ffffddb); } else { - if ((puVar8[0xd] != 0) && (*(short *)((longlong)puVar8 + 0x32) != 0)) { - pplVar20 = (longlong **)((longlong)puVar8 + (ulonglong)puVar8[0xd]); - } - uVar22 = (uint)*(ushort *)((longlong)puVar8 + 0x32); + uVar21 = 0; uVar6 = 0; - } - if ((int)uVar6 < 0) { - uVar22 = 0; - } - FUN_1c0004140(uVar6); - if (-1 < (int)uVar6) { - uVar17 = local_88; - iVar4 = FUN_1c006963c(param_1,local_88,*(longlong *)local_98[0x14],0x4244, - (longlong)pplVar20,uVar22,&local_78); - FUN_1c0004140(iVar4); - FUN_1c0004140(iVar4); - if (iVar4 < 0) { - pplVar23 = pplVar20; - if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && - (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x47; -LAB_11: - pplVar23 = param_2; - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar14,&DAT_0,param_1 - ); - } + if (((((*(ushort *)((longlong)puVar13 + 0xe) < 5) || (uVar19 = puVar13[2], uVar19 < 0x38)) + || (0x11 < (ushort)puVar13[0xc])) || + (((uVar8 = puVar13[0xd], uVar8 != 0 && + ((uVar8 < (uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 || (uVar19 < uVar8)) + )) || (uVar19 < *(ushort *)((longlong)puVar13 + 0x32))))) || + (((uVar7 = *(ushort *)((longlong)puVar13 + 0x32) + uVar8, uVar7 < uVar8 || + (uVar19 < uVar7)) || ((ushort)puVar13[0xc] != 0x11)))) { + uVar19 = 0xc0000225; } else { - iVar4 = FUN_1c00670c8(local_78,uVar17,(longlong *)local_98[0x14],local_90); - FUN_1c0004140(iVar4); - pplVar23 = pplVar20; - if (iVar4 < 0) { + uVar19 = uVar6; + if ((puVar13[0xd] == 0) || (*(short *)((longlong)puVar13 + 0x32) == 0)) { + uVar21 = (uint)*(ushort *)((longlong)puVar13 + 0x32); + local_60 = (longlong **)0x0; + } + else { + uVar21 = (uint)*(ushort *)((longlong)puVar13 + 0x32); + local_60 = (longlong **)((ulonglong)puVar13[0xd] + (longlong)puVar13); + } + } + if ((int)uVar19 < 0) { + uVar21 = uVar6; + } + FUN_1c0004140(uVar19); + if (-1 < (int)uVar19) { + uVar17 = local_88; + pplVar23 = local_60; + uVar12 = FUN_1c0077140(param_1,local_88,*(longlong *)local_a8[0x14],0x4244, + (longlong)local_60,uVar21,&local_80); + iVar5 = (int)uVar12; + FUN_1c0004140(iVar5); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x48; - goto LAB_11; - } - } - else if (local_90[0] == 1) { - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x40; - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x80; + uVar15 = 0x48; +LAB_11: + pplVar23 = param_2; + FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar15,&DAT_0, + param_1); + } } else { - *(longlong *)(local_98[0x14] + 0x38) = local_78; - local_78 = 0; - } - } - } - } - } - if ((*(uint *)((longlong)local_98 + 0x1c) & 0x100) == 0) { - if (uVar21 < 0x18) { - FUN_1c0004140(-0x3ffffddb); - } - else { - uVar22 = 0; - if ((((*(ushort *)((longlong)puVar8 + 0xe) < 6) || (uVar6 = puVar8[2], uVar6 < 0x40)) || - ((0x11 < (ushort)puVar8[0xe] || - ((uVar5 = puVar8[0xf], uVar5 != 0 && - ((uVar5 < (uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 || (uVar6 < uVar5)))))) - )) || ((uVar6 < *(ushort *)((longlong)puVar8 + 0x3a) || - (((uVar7 = *(ushort *)((longlong)puVar8 + 0x3a) + uVar5, - (ushort)puVar8[0xe] != 0x11 || (uVar7 < uVar5)) || (uVar6 < uVar7)))))) { - uVar6 = 0xc0000225; + iVar5 = FUN_1c0075048(local_80,uVar17,(longlong *)local_a8[0x14],&local_a0); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { + if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && + (1 < (byte)PTR_LOOP_1c0026170[0x29])) { + uVar15 = 0x49; + goto LAB_11; + } + } + else if (local_a0 == 1) { + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x40; + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x80; + } + else { + *(longlong *)(local_a8[0x14] + 0x38) = local_80; + local_80 = 0; + } + } + } + } + } + uVar21 = 0; + uVar17 = local_88; + if ((*(uint *)((longlong)local_a8 + 0x1c) & 0x100) == 0) { + if (uVar9 < 0x18) { + FUN_1c0004140(-0x3ffffddb); + uVar17 = local_88; } else { - if ((puVar8[0xf] == 0) || (*(short *)((longlong)puVar8 + 0x3a) == 0)) { - local_50 = 0; + uVar6 = 0; + if ((((*(ushort *)((longlong)puVar13 + 0xe) < 6) || (uVar19 = puVar13[2], uVar19 < 0x40)) + || ((0x11 < (ushort)puVar13[0xe] || + ((uVar8 = puVar13[0xf], uVar8 != 0 && + ((uVar8 < (uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 || + (uVar19 < uVar8)))))))) || + ((uVar19 < *(ushort *)((longlong)puVar13 + 0x3a) || + (((uVar7 = *(ushort *)((longlong)puVar13 + 0x3a) + uVar8, uVar7 < uVar8 || + (uVar19 < uVar7)) || ((ushort)puVar13[0xe] != 0x11)))))) { + uVar19 = 0xc0000225; } else { - local_50 = (ulonglong)puVar8[0xf] + (longlong)puVar8; - } - uVar22 = (uint)*(ushort *)((longlong)puVar8 + 0x3a); - uVar6 = 0; - } - uVar12 = (ulonglong)uVar6; - if ((int)uVar6 < 0) { - uVar22 = 0; - } - FUN_1c0004140(uVar6); - if (-1 < (int)uVar6) { - pplVar23 = (longlong **)0x4256; - uVar19 = param_1; - iVar4 = FUN_1c0069dfc(uVar12,param_1,local_88,*(longlong *)local_98[0x14],0x4256,local_50, - uVar22,&local_70); - FUN_1c0004140(iVar4); - if (iVar4 < 0) { - if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && - (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x49; -LAB_12: - pplVar23 = param_2; - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar14,&DAT_0,param_1 - ); - } - } - else { - iVar4 = FUN_1c00670c8(local_70,uVar19,(longlong *)local_98[0x14],local_90); - FUN_1c0004140(iVar4); - lVar11 = local_70; - if (iVar4 < 0) { + uVar19 = uVar6; + if ((puVar13[0xf] == 0) || (*(short *)((longlong)puVar13 + 0x3a) == 0)) { + uVar21 = (uint)*(ushort *)((longlong)puVar13 + 0x3a); + local_58 = (longlong **)0x0; + } + else { + uVar21 = (uint)*(ushort *)((longlong)puVar13 + 0x3a); + local_58 = (longlong **)((ulonglong)puVar13[0xf] + (longlong)puVar13); + } + } + if ((int)uVar19 < 0) { + uVar21 = uVar6; + } + FUN_1c0004140(uVar19); + uVar17 = local_88; + if (-1 < (int)uVar19) { + uVar18 = local_88; + pplVar23 = local_58; + uVar12 = FUN_1c0077140(param_1,local_88,*(longlong *)local_a8[0x14],0x4256, + (longlong)local_58,uVar21,&local_78); + iVar5 = (int)uVar12; + FUN_1c0004140(iVar5); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x4a; - goto LAB_12; - } - } - else if (local_90[0] == 1) { - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x100; - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x200; + uVar15 = 0x4a; +LAB_12: + pplVar23 = param_2; + FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar15,&DAT_0, + param_1); + } } else { - local_70 = 0; - *(longlong *)(local_98[0x14] + 0x40) = lVar11; - } - } - } - } - } - uVar12 = 0; - if ((*(uint *)((longlong)local_98 + 0x1c) & 0x400) == 0) { - if (uVar21 < 0x18) { - FUN_1c0004140(-0x3ffffddb); - } - else { - uVar19 = local_48; - if (((((6 < *(ushort *)((longlong)puVar8 + 0xe)) && (uVar21 = puVar8[2], 0x47 < uVar21)) && - (((ushort)puVar8[0x10] < 0x12 && - ((uVar22 = puVar8[0x11], uVar22 == 0 || - (((uint)*(ushort *)((longlong)puVar8 + 0xe) * 8 + 0x10 <= uVar22 && - (uVar22 <= uVar21)))))))) && (*(ushort *)((longlong)puVar8 + 0x42) <= uVar21)) && - (((uVar6 = *(ushort *)((longlong)puVar8 + 0x42) + uVar22, (ushort)puVar8[0x10] == 0x11 && - (uVar22 <= uVar6)) && (uVar6 <= uVar21)))) { - uVar19 = uVar12; - if ((puVar8[0x11] != 0) && (*(short *)((longlong)puVar8 + 0x42) != 0)) { - uVar19 = (longlong)puVar8 + (ulonglong)puVar8[0x11]; - } - uVar12 = (ulonglong)*(ushort *)((longlong)puVar8 + 0x42); - uVar15 = 0; - } - uVar13 = (ulonglong)uVar15; - uVar21 = (uint)uVar12; - if ((int)uVar15 < 0) { + iVar5 = FUN_1c0075048(local_78,uVar18,(longlong *)local_a8[0x14],&local_a0); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { + if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && + (1 < (byte)PTR_LOOP_1c0026170[0x29])) { + uVar15 = 0x4b; + goto LAB_12; + } + } + else if (local_a0 == 1) { + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x100; + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x200; + } + else { + *(longlong *)(local_a8[0x14] + 0x40) = local_78; + local_78 = 0; + } + } + } + } + } + if ((*(uint *)((longlong)local_a8 + 0x1c) & 0x400) == 0) { + if (uVar9 < 0x18) { + FUN_1c0004140(-0x3ffffddb); + } + else { uVar21 = 0; - } - FUN_1c0004140(uVar15); - if (-1 < (int)uVar15) { - pplVar23 = (longlong **)0x424d; - uVar12 = param_1; - iVar4 = FUN_1c0069dfc(uVar13,param_1,local_88,*(longlong *)local_98[0x14],0x424d,uVar19, - uVar21,&local_68); - FUN_1c0004140(iVar4); - if (iVar4 < 0) { - if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && - (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x4b; -LAB_13: - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar14,&DAT_0,param_1 - ); - pplVar23 = param_2; - } - } - else { - iVar4 = FUN_1c00670c8(local_68,uVar12,(longlong *)local_98[0x14],local_90); - FUN_1c0004140(iVar4); - lVar11 = local_68; - if (iVar4 < 0) { + uVar6 = 0; + uVar9 = uVar6; + if (((((6 < *(ushort *)((longlong)puVar13 + 0xe)) && + (uVar19 = puVar13[2], uVar9 = uVar21, 0x47 < uVar19)) && + (((ushort)puVar13[0x10] < 0x12 && + ((uVar21 = puVar13[0x11], uVar21 == 0 || + (((uint)*(ushort *)((longlong)puVar13 + 0xe) * 8 + 0x10 <= uVar21 && + (uVar21 <= uVar19)))))))) && (*(ushort *)((longlong)puVar13 + 0x42) <= uVar19)) && + (((uVar8 = *(ushort *)((longlong)puVar13 + 0x42) + uVar21, uVar21 <= uVar8 && + (uVar8 <= uVar19)) && ((ushort)puVar13[0x10] == 0x11)))) { + if ((puVar13[0x11] == 0) || (*(short *)((longlong)puVar13 + 0x42) == 0)) { + local_50 = (longlong **)0x0; + } + else { + local_50 = (longlong **)((ulonglong)puVar13[0x11] + (longlong)puVar13); + } + uVar9 = (uint)*(ushort *)((longlong)puVar13 + 0x42); + uVar20 = uVar6; + } + if ((int)uVar20 < 0) { + uVar9 = uVar6; + } + FUN_1c0004140(uVar20); + if (-1 < (int)uVar20) { + pplVar23 = local_50; + uVar12 = FUN_1c0077140(param_1,uVar17,*(longlong *)local_a8[0x14],0x424d, + (longlong)local_50,uVar9,&local_70); + iVar5 = (int)uVar12; + FUN_1c0004140(iVar5); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) { - uVar14 = 0x4c; - goto LAB_13; - } - } - else if (local_90[0] == 1) { - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x400; - *(uint *)((longlong)local_98 + 0x1c) = *(uint *)((longlong)local_98 + 0x1c) | 0x800; + uVar15 = 0x4c; +LAB_13: + FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar15,&DAT_0, + param_1); + pplVar23 = param_2; + } } else { - local_68 = 0; - *(longlong *)(local_98[0x14] + 0x48) = lVar11; - } - } - } - } - } - } - iVar4 = (*DAT_14)(local_98,*(undefined8 *)(param_1 + 0x10),*(undefined8 *)(local_98[2] + 8) - ,local_98 + 1,pplVar23); - FUN_1c0004140(iVar4); - if (iVar4 < 0) { - if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && - ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && (1 < (byte)PTR_LOOP_1c0026170[0x29])) - { - FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),0x4d,&DAT_0,param_1); - } - } - else { - *param_6 = local_98; - local_98 = (longlong *)0x0; - } + iVar5 = FUN_1c0075048(local_70,uVar17,(longlong *)local_a8[0x14],&local_a0); + FUN_1c0004140(iVar5); + if (iVar5 < 0) { + if ((((undefined **)PTR_LOOP_1c0026170 != &PTR_LOOP_1c0026170) && + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) != 0)) && + (1 < (byte)PTR_LOOP_1c0026170[0x29])) { + uVar15 = 0x4d; + goto LAB_13; + } + } + else if (local_a0 == 1) { + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x400; + *(uint *)((longlong)local_a8 + 0x1c) = *(uint *)((longlong)local_a8 + 0x1c) | 0x800; + } + else { + *(longlong *)(local_a8[0x14] + 0x48) = local_70; + local_70 = 0; + } + } + } + } + } + } + iVar5 = (*DAT_14)(local_a8,*(undefined8 *)(param_1 + 0x10), + *(undefined8 *)(local_a8[2] + 8),local_a8 + 1,pplVar23); + FUN_1c0004140(iVar5); + plVar10 = local_a8; + if (-1 < iVar5) { + local_a8 = (longlong *)0x0; + *param_6 = plVar10; + goto LAB_1; + } + if ((((undefined **)PTR_LOOP_1c0026170 == &PTR_LOOP_1c0026170) || + ((*(uint *)(PTR_LOOP_1c0026170 + 0x2c) & 1) == 0)) || ((byte)PTR_LOOP_1c0026170[0x29] < 2)) + goto LAB_1; + uVar15 = 0x4e; + } +LAB_6: + FUN_1c000a234(*(undefined8 *)(PTR_LOOP_1c0026170 + 0x18),uVar15,&DAT_0,param_1); +LAB_1: + lVar14 = local_80; + if (local_80 != 0) { + uVar9 = *(uint *)(local_80 + 0x10) & 7; + if (uVar9 == 0) { + FUN_1c0079998(local_80); + } + else if (uVar9 == 1) { + LOCK(); + piVar11 = (int *)(local_80 + 0x14); + iVar3 = *piVar11; + *piVar11 = *piVar11 + -1; + UNLOCK(); + if (iVar3 < 2) { + FsRtlUninitializeBaseMcb(local_80 + 0x30); + ExFreePoolWithTag(lVar14,0x6d427348); + } + } + } + lVar14 = local_78; if (local_78 != 0) { - FUN_1c00313b0(local_78); - } + uVar9 = *(uint *)(local_78 + 0x10) & 7; + if (uVar9 == 0) { + FUN_1c0079998(local_78); + } + else if (uVar9 == 1) { + LOCK(); + piVar11 = (int *)(local_78 + 0x14); + iVar3 = *piVar11; + *piVar11 = *piVar11 + -1; + UNLOCK(); + if (iVar3 < 2) { + FsRtlUninitializeBaseMcb(local_78 + 0x30); + ExFreePoolWithTag(lVar14,0x6d427348); + } + } + } + lVar14 = local_70; if (local_70 != 0) { - FUN_1c00313b0(local_70); + uVar9 = *(uint *)(local_70 + 0x10) & 7; + if (uVar9 == 0) { + FUN_1c0079998(local_70); + } + else if (uVar9 == 1) { + LOCK(); + piVar11 = (int *)(local_70 + 0x14); + iVar3 = *piVar11; + *piVar11 = *piVar11 + -1; + UNLOCK(); + if (iVar3 < 2) { + FsRtlUninitializeBaseMcb(local_70 + 0x30); + ExFreePoolWithTag(lVar14,0x6d427348); + } + } + } + if (local_a8 != (longlong *)0x0) { + FltReleaseContext(); } if (local_68 != 0) { - FUN_1c00313b0(local_68); - } -LAB_1: - if (local_98 != (longlong *)0x0) { - FltReleaseContext(); - } - if (local_60[0] != 0) { - FltReleaseContext(local_60[0]); - } - return iVar4; + FltReleaseContext(local_68); + } + return iVar5; } ``` ## FUN_1c0069dfc ### Match Info |Key|cldflt-2024-05.sys - cldflt-2024-06.sys| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling,called| |ratio|0.36| |i_ratio|0.06| |m_ratio|0.74| |b_ratio|0.23| |match_types|BSIM| ### Function Meta Diff |Key|cldflt-2024-05.sys|cldflt-2024-06.sys| | :---: | :---: | :---: | |`name`|FUN_1c0069dfc|FUN_1c00102e4| |`fullname`|FUN_1c0069dfc|FUN_1c00102e4| |refcount|3|3| |`length`|82|49| |`called`|FUN_1c0004140
FUN_1c006963c|FUN_1c001031c| |`calling`|FUN_1c00671a0|FUN_1c0077140
FUN_1c007a7c0| |paramcount|8|0| |`address`|1c0069dfc|1c00102e4| |`sig`|int __fastcall FUN_1c0069dfc(undefined8 param_1, ulonglong param_2, undefined8 param_3, longlong param_4, undefined4 param_5, longlong param_6, uint param_7, undefined8 * param_8)|ulonglong __fastcall FUN_1c00102e4(void)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_1c0069dfc Called Diff ```diff --- FUN_1c0069dfc called +++ FUN_1c00102e4 called @@ -1,2 +1 @@ -FUN_1c0004140 -FUN_1c006963c +FUN_1c001031c ``` ### FUN_1c0069dfc Calling Diff ```diff --- FUN_1c0069dfc calling +++ FUN_1c00102e4 calling @@ -1 +1,2 @@ -FUN_1c00671a0 +FUN_1c0077140 +FUN_1c007a7c0 ``` ### FUN_1c0069dfc Diff ```diff --- FUN_1c0069dfc +++ FUN_1c00102e4 @@ -1,12 +1,17 @@ -int FUN_1c0069dfc(undefined8 param_1,ulonglong param_2,undefined8 param_3,longlong param_4, - undefined4 param_5,longlong param_6,uint param_7,undefined8 *param_8) +ulonglong FUN_1c00102e4(void) { - int iVar1; + ulonglong uVar1; + undefined8 local_res8; - iVar1 = FUN_1c006963c(param_2,param_3,param_4,param_5,param_6,param_7,param_8); - FUN_1c0004140(iVar1); - return iVar1; + local_res8 = (ulonglong)DAT_0; + if ((DAT_0 & 0x10) == 0) { + uVar1 = FUN_1c001031c(local_res8,3); + } + else { + uVar1 = (ulonglong)(DAT_0 & 1); + } + return uVar1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|cldflt-2024-05.sys - cldflt-2024-06.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2024-05.sys|cldflt-2024-06.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|237|240| |length|0|0| |called||| |`calling`|

Expand for full list:
FUN_1c0005014
FUN_1c0007260
FUN_1c00079d0
FUN_1c0008f60
FUN_1c000a428
FUN_1c000ff64
FUN_1c00101a0
FUN_1c0010608
FUN_1c0010cc8
FUN_1c00116d4
FUN_1c0011bc8

FUN_1c0011f84
FUN_1c0012358
FUN_1c0012730
FUN_1c00129d0
FUN_1c0013880
FUN_1c0015e50
FUN_1c001a394
FUN_1c001c51c
FUN_1c00313dc
FUN_1c003163c
FUN_1c00326f8
FUN_1c0032d04
FUN_1c003488c
FUN_1c0034c14
FUN_1c0034db0
FUN_1c0034f20
FUN_1c00352c0
FUN_1c0035bf0
FUN_1c003629c
FUN_1c00362f8
FUN_1c0036688
FUN_1c0036960
FUN_1c0036c30
FUN_1c0036e3c
FUN_1c00372f0
FUN_1c0037590
FUN_1c0037a30
FUN_1c0037bc0
FUN_1c003b4fc
FUN_1c003d130
FUN_1c003d688
FUN_1c003ed3c
FUN_1c003ef34
FUN_1c003f518
FUN_1c003f720
FUN_1c003f874
FUN_1c003fae8
FUN_1c0041254
FUN_1c0042d98
FUN_1c0043ad4
FUN_1c0043ca8
FUN_1c0043d94
FUN_1c0044348
FUN_1c00445a0
FUN_1c00446f0
FUN_1c0044b00
FUN_1c0044ca0
FUN_1c0044e50
FUN_1c0045320
FUN_1c0045484
FUN_1c0045d8c
FUN_1c00473d0
FUN_1c00475c4
FUN_1c004801c
FUN_1c00486cc
FUN_1c00488d0
FUN_1c00495c8
FUN_1c004a4d8
FUN_1c004acd4
FUN_1c004c850
FUN_1c004d060
FUN_1c004d390
FUN_1c004d620
FUN_1c004db30
FUN_1c004e650
FUN_1c004f980
FUN_1c0050410
FUN_1c0051000
FUN_1c005150c
FUN_1c0051f50
FUN_1c0053a1c
FUN_1c00547b8
FUN_1c005a120
FUN_1c005a1d8
FUN_1c005a5e4
FUN_1c005a808
FUN_1c005b3a0
FUN_1c005b800
FUN_1c005be50
FUN_1c005bea8
FUN_1c005bfe0
FUN_1c005d9a0
FUN_1c005e630
FUN_1c005e9b0
FUN_1c005f1b0
FUN_1c00605a0
FUN_1c0060650
FUN_1c0060790
FUN_1c0060cb0
FUN_1c00610f0
FUN_1c0061714
FUN_1c0061744
FUN_1c0061900
FUN_1c0061d8c
FUN_1c00625f4
FUN_1c0062770
FUN_1c0062c10
FUN_1c00635c0
FUN_1c0063c48
FUN_1c0064020
FUN_1c0064450
FUN_1c0064590
FUN_1c0064ed8
FUN_1c0065764
FUN_1c0065f3c
FUN_1c0066658
FUN_1c006a140
FUN_1c006a7b0
FUN_1c006af00
FUN_1c006b110
FUN_1c006b3b0
FUN_1c006bc5c
FUN_1c006c138
FUN_1c006e2d8
FUN_1c006e3bc
FUN_1c006eb2c
FUN_1c0070a20
FUN_1c0071260
FUN_1c0071520
FUN_1c0072944
FUN_1c00733a8
FUN_1c0073510
FUN_1c0073560
FUN_1c0073820
FUN_1c007463c
FUN_1c00754c8
FUN_1c0075bf4
FUN_1c0076148
FUN_1c0076dc4
FUN_1c0077348
FUN_1c00799bc
FUN_1c007a138
FUN_1c007aa88
FUN_1c007ac50
FUN_1c007b8ac
FUN_1c007d840
FUN_1c007f56c
FUN_1c007fe30
FUN_1c0080c18
FUN_1c0081ee4
SepSddlAddAceToAcl

Expand for full list:
FUN_1c0005014
FUN_1c0007260
FUN_1c00079d0
FUN_1c0008f60
FUN_1c000a428
FUN_1c000ff64
FUN_1c00101a0
FUN_1c001065c
FUN_1c0010d1c
FUN_1c0011728
FUN_1c0011c1c

FUN_1c0011fd8
FUN_1c00123ac
FUN_1c0012784
FUN_1c0012a24
FUN_1c00138d4
FUN_1c0015ea4
FUN_1c001a3e4
FUN_1c001c56c
FUN_1c00313dc
FUN_1c003163c
FUN_1c00326f8
FUN_1c0032d04
FUN_1c003488c
FUN_1c0034c14
FUN_1c0034db0
FUN_1c0034f20
FUN_1c00352c0
FUN_1c0035bf0
FUN_1c003629c
FUN_1c00362f8
FUN_1c0036688
FUN_1c0036960
FUN_1c0036c30
FUN_1c0036e3c
FUN_1c00372f0
FUN_1c0037590
FUN_1c0037a30
FUN_1c0037bc0
FUN_1c003b4fc
FUN_1c003d130
FUN_1c003d688
FUN_1c003ed3c
FUN_1c003ef34
FUN_1c003f518
FUN_1c003f720
FUN_1c003f874
FUN_1c003fae8
FUN_1c0041254
FUN_1c0042d98
FUN_1c0043ad4
FUN_1c0043ca8
FUN_1c0043d94
FUN_1c0044348
FUN_1c00445a0
FUN_1c00446f0
FUN_1c0044b00
FUN_1c0044ca0
FUN_1c0044e50
FUN_1c0045320
FUN_1c0045484
FUN_1c0045d8c
FUN_1c00473d0
FUN_1c00475c4
FUN_1c004801c
FUN_1c00486cc
FUN_1c00488d0
FUN_1c00495c8
FUN_1c004a4d8
FUN_1c004acd4
FUN_1c004c850
FUN_1c004d060
FUN_1c004d390
FUN_1c004d620
FUN_1c004db30
FUN_1c004e650
FUN_1c004f980
FUN_1c0050410
FUN_1c0051000
FUN_1c005150c
FUN_1c0051f50
FUN_1c0053a1c
FUN_1c00547b8
FUN_1c005a120
FUN_1c005a1d8
FUN_1c005a5e4
FUN_1c005a808
FUN_1c005b3a0
FUN_1c005b800
FUN_1c005be50
FUN_1c005bea8
FUN_1c005bfe0
FUN_1c005d9a0
FUN_1c005e630
FUN_1c005e9b0
FUN_1c005f1b0
FUN_1c00605a0
FUN_1c0060650
FUN_1c0060790
FUN_1c0060cb0
FUN_1c00610f0
FUN_1c0061714
FUN_1c0061744
FUN_1c0061900
FUN_1c0061d8c
FUN_1c00625f4
FUN_1c0062770
FUN_1c0062c10
FUN_1c00635c0
FUN_1c0063c48
FUN_1c0064020
FUN_1c0064450
FUN_1c0064590
FUN_1c0064ed8
FUN_1c0065764
FUN_1c0065f3c
FUN_1c0066658
FUN_1c00681a0
FUN_1c0068810
FUN_1c0068f60
FUN_1c0069710
FUN_1c00699b0
FUN_1c006a25c
FUN_1c006a738
FUN_1c006c8d8
FUN_1c006c9bc
FUN_1c006d12c
FUN_1c006f020
FUN_1c006f860
FUN_1c006fb20
FUN_1c0070f44
FUN_1c00719a8
FUN_1c0071b10
FUN_1c0071b60
FUN_1c0071e20
FUN_1c0072c3c
FUN_1c0073ac8
FUN_1c00741f4
FUN_1c0074748
FUN_1c00754b4
FUN_1c0075a38
FUN_1c00788cc
FUN_1c0079048
FUN_1c0079998
FUN_1c0079b60
FUN_1c007a7c0
FUN_1c007b888
FUN_1c007d820
FUN_1c007f54c
FUN_1c007fe10
FUN_1c0080bf8
FUN_1c0081ec4
SepSddlAddAceToAcl

| |paramcount|0|0| |address|EXTERNAL:000000c3|EXTERNAL:000000c3| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -8,12 +8,12 @@ -FUN_1c0010608 -FUN_1c0010cc8 -FUN_1c00116d4 -FUN_1c0011bc8 -FUN_1c0011f84 -FUN_1c0012358 -FUN_1c0012730 -FUN_1c00129d0 -FUN_1c0013880 -FUN_1c0015e50 -FUN_1c001a394 -FUN_1c001c51c +FUN_1c001065c +FUN_1c0010d1c +FUN_1c0011728 +FUN_1c0011c1c +FUN_1c0011fd8 +FUN_1c00123ac +FUN_1c0012784 +FUN_1c0012a24 +FUN_1c00138d4 +FUN_1c0015ea4 +FUN_1c001a3e4 +FUN_1c001c56c @@ -118,34 +118,35 @@ -FUN_1c006a140 -FUN_1c006a7b0 -FUN_1c006af00 -FUN_1c006b110 -FUN_1c006b3b0 -FUN_1c006bc5c -FUN_1c006c138 -FUN_1c006e2d8 -FUN_1c006e3bc -FUN_1c006eb2c -FUN_1c0070a20 -FUN_1c0071260 -FUN_1c0071520 -FUN_1c0072944 -FUN_1c00733a8 -FUN_1c0073510 -FUN_1c0073560 -FUN_1c0073820 -FUN_1c007463c -FUN_1c00754c8 -FUN_1c0075bf4 -FUN_1c0076148 -FUN_1c0076dc4 -FUN_1c0077348 -FUN_1c00799bc -FUN_1c007a138 -FUN_1c007aa88 -FUN_1c007ac50 -FUN_1c007b8ac -FUN_1c007d840 -FUN_1c007f56c -FUN_1c007fe30 -FUN_1c0080c18 -FUN_1c0081ee4 +FUN_1c00681a0 +FUN_1c0068810 +FUN_1c0068f60 +FUN_1c0069710 +FUN_1c00699b0 +FUN_1c006a25c +FUN_1c006a738 +FUN_1c006c8d8 +FUN_1c006c9bc +FUN_1c006d12c +FUN_1c006f020 +FUN_1c006f860 +FUN_1c006fb20 +FUN_1c0070f44 +FUN_1c00719a8 +FUN_1c0071b10 +FUN_1c0071b60 +FUN_1c0071e20 +FUN_1c0072c3c +FUN_1c0073ac8 +FUN_1c00741f4 +FUN_1c0074748 +FUN_1c00754b4 +FUN_1c0075a38 +FUN_1c00788cc +FUN_1c0079048 +FUN_1c0079998 +FUN_1c0079b60 +FUN_1c007a7c0 +FUN_1c007b888 +FUN_1c007d820 +FUN_1c007f54c +FUN_1c007fe10 +FUN_1c0080bf8 +FUN_1c0081ec4 ``` ## NTOSKRNL.EXE::FsRtlUninitializeBaseMcb ### Match Info |Key|cldflt-2024-05.sys - cldflt-2024-06.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cldflt-2024-05.sys|cldflt-2024-06.sys| | :---: | :---: | :---: | |name|FsRtlUninitializeBaseMcb|FsRtlUninitializeBaseMcb| |fullname|NTOSKRNL.EXE::FsRtlUninitializeBaseMcb|NTOSKRNL.EXE::FsRtlUninitializeBaseMcb| |`refcount`|10|13| |length|0|0| |called||| |`calling`|FUN_1c0041254
FUN_1c004801c
FUN_1c006a7b0
FUN_1c006b110
FUN_1c0073560
FUN_1c0078974
FUN_1c007aa88|FUN_1c0041254
FUN_1c004801c
FUN_1c0068810
FUN_1c0069710
FUN_1c0071b60
FUN_1c0077064
FUN_1c0079998
FUN_1c007a7c0| |paramcount|0|0| |address|EXTERNAL:0000009f|EXTERNAL:0000009f| |sig|undefined FsRtlUninitializeBaseMcb(void)|undefined FsRtlUninitializeBaseMcb(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::FsRtlUninitializeBaseMcb Calling Diff ```diff --- NTOSKRNL.EXE::FsRtlUninitializeBaseMcb calling +++ NTOSKRNL.EXE::FsRtlUninitializeBaseMcb calling @@ -3,5 +3,6 @@ -FUN_1c006a7b0 -FUN_1c006b110 -FUN_1c0073560 -FUN_1c0078974 -FUN_1c007aa88 +FUN_1c0068810 +FUN_1c0069710 +FUN_1c0071b60 +FUN_1c0077064 +FUN_1c0079998 +FUN_1c007a7c0 ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-07-26T18:42:00}