# cbs_7309.dll-cbs_7623.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::`dynamic_initializer_for_'g_featureStateManager''](#wildetailsdynamic_initializer_for_g_featurestatemanager) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingheaderinternalapi) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingsrumfeaturereporting) * [wil::details_abi::SemaphoreValue::Destroy](#wildetails_abisemaphorevaluedestroy) * [wil::ProcessShutdownInProgress](#wilprocessshutdowninprogress) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsreleasemutexvoid___ptr64struct_wistdintegral_constantunsigned___int642void___ptr64void___ptr640stdnullptr_t_reset) * [::](#lambda_152aa9d2a3a0648fa2fa7fcef514b376lambda_invoker_cdecl) * [::](#lambda_1ad7ecfab602a777ecf020873216a663lambda_invoker_cdecl) * [::](#lambda_5035b992506f4af81a770c5842624510lambda_invoker_cdecl) * [::](#lambda_d51448ba32f8ef42e59400edd4566183lambda_invoker_cdecl) * [wistd::function::function<,void>](#wistdfunctionvoid___cdeclvoidfunctionvoid___cdeclvoidlambda_eda1cf2fd3cd86dd27b5a777412c3e93void) * [wil::ScopeExit<_>](#wilscopeexitlambda_1344a53bf6f58267d70c2a2450964362_) * [CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_>](#ccrashdetectortakeownershipofhandleandstartmonitoringlambda_652d99b017fc03eadfd20048eacf929a_) * [::](#lambda_1344a53bf6f58267d70c2a2450964362lambda_1344a53bf6f58267d70c2a2450964362) * [wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataprocesslocalstoragedataclass_wildetails_abifeaturestatedata) * [wil::details_abi::RawUsageIndex::RawUsageIndex](#wildetails_abirawusageindexrawusageindex) * [wil::details_abi::SubscriptionList::SubscriptionList](#wildetails_abisubscriptionlistsubscriptionlist) * [wil::details_abi::UsageIndexes::UsageIndexes](#wildetails_abiusageindexesusageindexes) * [wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage](#wildetails_abiprocesslocalstorageclass_wildetails_abifeaturestatedataprocesslocalstorageclass_wildetails_abifeaturestatedata) * [wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataprocesslocalstoragedataclass_wildetails_abifeaturestatedata) * [wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailsunsubscribeprocesswideusageflushstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailsunsubscribeprocesswideusageflushstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_) * [wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_) * [wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__rtl_critical_section___ptr64void___cdeclstruct__rtl_critical_section___ptr64void___cdecl_leavecriticalsectionstruct__rtl_critical_section___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_critical_section___ptr64struct__rtl_critical_section___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__rtl_critical_section___ptr64void___cdeclstruct__rtl_critical_section___ptr64void___cdecl_leavecriticalsectionstruct__rtl_critical_section___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_critical_section___ptr64struct__rtl_critical_section___ptr640stdnullptr_t_) * [wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlocksharedstruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlocksharedstruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_) * [wil::details::EnabledStateManager::~EnabledStateManager](#wildetailsenabledstatemanagerenabledstatemanager) * [wil::details_abi::FeatureStateData::~FeatureStateData](#wildetails_abifeaturestatedatafeaturestatedata) * [wil::details::FeatureStateManager::~FeatureStateManager](#wildetailsfeaturestatemanagerfeaturestatemanager) * [wil::details_abi::SubscriptionList::~SubscriptionList](#wildetails_abisubscriptionlistsubscriptionlist) * [wistd::unique_ptr::operator=](#wistdunique_ptrvoidstruct_wilprocess_heap_deleteroperator) * [::operator()](#lambda_1344a53bf6f58267d70c2a2450964362operator) * [wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()](#wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intoperator) * [wil::details_abi::ProcessLocalStorageData::Acquire](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataacquire) * [wil::details_abi::UsageIndexProperty::Compare](#wildetails_abiusageindexpropertycompare) * [wil::details::DestroyThreadPoolTimer::Destroy](#wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroy) * [wil::details::EnsureCoalescedTimer_SetTimer](#wildetailsensurecoalescedtimer_settimer) * [wil::details::FeatureStateManager::EnsureStateData](#wildetailsfeaturestatemanagerensurestatedata) * [wil::details::EnsureSubscribedToFeatureConfigurationChanges](#wildetailsensuresubscribedtofeatureconfigurationchanges) * [wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl](#wildetailsenabledstatemanagerensuresubscribedtofeatureconfigurationchangesimpl) * [wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock](#wildetailsfeaturestatemanagerensuresubscribedtoprocesswideusageflushunderlock) * [wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush](#wildetailsenabledstatemanagerensuresubscribedtousageflush) * [wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement](#wildetails_abirawusageindexfindinsertionpointorincrement) * [wil::details::FeatureStateManager::FlushUsage](#wildetailsfeaturestatemanagerflushusage) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3404159289getcachedfeatureenabledstate) * [wil::details::FeatureImpl::GetCurrentFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3404159289getcurrentfeatureenabledstate) * [ClipboardServer::GetEnterpriseIdOfContentInternal](#clipboardservergetenterpriseidofcontentinternal) * [wil::details_abi::UsageIndexProperty::GetSize](#wildetails_abiusageindexpropertygetsize) * [wil::details::IsFeatureConfigured](#wildetailsisfeatureconfigured) * [wil::details_abi::RawUsageIndex::Iterate](#wildetails_abirawusageindexiterate) * [wil::details_abi::RawUsageIndex::LowerBound](#wildetails_abirawusageindexlowerbound) * [wil::details_abi::ProcessLocalStorageData::MakeAndInitialize](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedatamakeandinitialize) * [wil::details_abi::SubscriptionList::OnSignaled](#wildetails_abisubscriptionlistonsignaled) * [wil::details::EnabledStateManager::OnStateChange](#wildetailsenabledstatemanageronstatechange) * [wil::details_abi::FeatureStateData::ProcessShutdown](#wildetails_abifeaturestatedataprocessshutdown) * [wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting](#wildetailsfeaturestatemanagerqueuebackgroundsrumusagereporting) * [wil::details::EnabledStateManager::QueueBackgroundUsageReporting](#wildetailsenabledstatemanagerqueuebackgroundusagereporting) * [wil::details_abi::UsageIndexProperty::Read](#wildetails_abiusageindexpropertyread) * [wil::details_abi::UsageIndexes::Record](#wildetails_abiusageindexesrecord) * [wil::details::EnabledStateManager::RecordCachedUsageUnderLock](#wildetailsenabledstatemanagerrecordcachedusageunderlock) * [wil::details_abi::FeatureStateData::RecordFeatureUsage](#wildetails_abifeaturestatedatarecordfeatureusage) * [wil::details::FeatureStateManager::RecordFeatureUsage](#wildetailsfeaturestatemanagerrecordfeatureusage) * [wil::details_abi::UsageIndex::RecordUsage](#wildetails_abiusageindexenum_wil_details_servicereportingkindunsigned_int2recordusage) * [wil::details_abi::UsageIndex::RecordUsage](#wildetails_abiusageindexenum_wil_details_servicereportingkindunsigned_int0recordusage) * [wil::details_abi::FeatureStateData::RecordUsage](#wildetails_abifeaturestatedatarecordusage) * [wil::details_abi::RawUsageIndex::RecordUsage](#wildetails_abirawusageindexrecordusage) * [wil::details_abi::RawUsageIndex::RecordUsageInternal](#wildetails_abirawusageindexrecordusageinternal) * [wil::details_abi::RecordWnfUsageIndex](#wildetails_abirecordwnfusageindex) * [wil::details_abi::ProcessLocalStorageData::Release](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedatarelease) * [wil::details::FeatureImpl::ReportUsage](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3404159289reportusage) * [wil::details::ReportUsageToServiceDirect](#wildetailsreportusagetoservicedirect) * [wil::details_abi::FeatureStateData::RetrieveUsageUnderLock](#wildetails_abifeaturestatedataretrieveusageunderlock) * [wil::details_abi::RawUsageIndex::SetBuffer](#wildetails_abirawusageindexsetbuffer) * [wil::details_abi::RawUsageIndex::SkipValues](#wildetails_abirawusageindexskipvalues) * [wil::details::FeatureStateManager::SubscribeToEnabledStateChanges](#wildetailsfeaturestatemanagersubscribetoenabledstatechanges) * [wil::details::FeatureStateManager::SubscribeToUsageFlush](#wildetailsfeaturestatemanagersubscribetousageflush) * [wil::details_abi::SubscriptionList::SubscribeUnderLock](#wildetails_abisubscriptionlistsubscribeunderlock) * [wil::details_abi::RawUsageIndex::Swap](#wildetails_abirawusageindexswap) * [wil::details_abi::SubscriptionList::Unsubscribe](#wildetails_abisubscriptionlistunsubscribe) * [wil::details::UnsubscribeProcessWideUsageFlush](#wildetailsunsubscribeprocesswideusageflush) * [wil::details_abi::UsageIndexProperty::UpdateCount](#wildetails_abiusageindexpropertyupdatecount) * [wil::details::WilApiImpl_GetFeatureEnabledState](#wildetailswilapiimpl_getfeatureenabledstate) * [wil::details::WilApiImpl_RecordFeatureUsage](#wildetailswilapiimpl_recordfeatureusage) * [wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification](#wildetailswilapiimpl_subscribefeaturestatechangenotification) * [wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification](#wildetailswilapiimpl_unsubscribefeaturestatechangenotification) * [wil::details::WilApi_RecordFeatureUsage](#wildetailswilapi_recordfeatureusage) * [wil::details::WilApi_RecordFeatureUsageReports](#wildetailswilapi_recordfeatureusagereports) * [wil::details::WilApi_UnsubscribeFeatureStateChangeNotification](#wildetailswilapi_unsubscribefeaturestatechangenotification) * [wil::details_abi::UsageIndexProperty::Write](#wildetails_abiusageindexpropertywrite) * [wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone](#wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_int__clone) * [wil::details::FeatureImpl::__private_IsEnabled](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3404159289__private_isenabled) * [wil::details_abi::heap_buffer::ensure](#wildetails_abiheap_bufferensure) * [wil::details_abi::heap_buffer::push_back](#wildetails_abiheap_bufferpush_back) * [wil::details_abi::heap_buffer::reserve](#wildetails_abiheap_bufferreserve) * [wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset](#wildetailsunique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_reset) * [wil_details_WriteSRUMWnfUsageBuffer](#wil_details_writesrumwnfusagebuffer) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_RtlStagingConfig_RecordFeatureUsage](#wil_rtlstagingconfig_recordfeatureusage) * [wil_StagingConfig_LogStagedFeatureUsage](#wil_stagingconfig_logstagedfeatureusage) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [wil_details_NtQueryWnfStateData](#wil_details_ntquerywnfstatedata) * [wil_details_NtUpdateWnfStateData](#wil_details_ntupdatewnfstatedata) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil_details_RtlRegisterFeatureConfigurationChangeNotification](#wil_details_rtlregisterfeatureconfigurationchangenotification) * [`wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0](#wildetails_abirawusageindexiterate__l1dtor0) * [wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''](#wildetailsdynamic_atexit_destructor_for_g_enabledstatemanager) * [wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''](#wildetailsdynamic_atexit_destructor_for_g_featurestatemanager) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer](#api-ms-win-core-threadpool-l1-2-0dllsetthreadpooltimer) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection](#api-ms-win-core-synch-l1-1-0dllleavecriticalsection) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionEx](#api-ms-win-core-synch-l1-1-0dllinitializecriticalsectionex) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection](#api-ms-win-core-synch-l1-1-0dllentercriticalsection) * [MSVCRT.DLL::memmove_s](#msvcrtdllmemmove_s) * [MSVCRT.DLL::memcmp](#msvcrtdllmemcmp) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolTimerCallbacks](#api-ms-win-core-threadpool-l1-2-0dllwaitforthreadpooltimercallbacks) * [API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer](#api-ms-win-core-threadpool-l1-2-0dllcreatethreadpooltimer) * [Modified](#modified) * [wil::details::WilFailureNotifyWatchers](#wildetailswilfailurenotifywatchers) * [wil::details_abi::ProcessLocalStorageData::Release](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldatarelease) * [ClipboardServer::RequestAccessForProcess](#clipboardserverrequestaccessforprocess) * [ClipboardServer::UpdateEdpDataPackageLockState](#clipboardserverupdateedpdatapackagelockstate) * [wil::details_abi::ProcessLocalStorageData::Acquire](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldataacquire) * [ClipboardServer::GetEnterpriseIdOfContent](#clipboardservergetenterpriseidofcontent) * [ClipboardServer::SubscribeToMDMPolicyChange](#clipboardserversubscribetomdmpolicychange) * [wil::details::in1diag3::_FailFast_Unexpected](#wildetailsin1diag3_failfast_unexpected) * [wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>](#wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_cotaskmemfreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___) * [ClipboardServer::GetContentInternal](#clipboardservergetcontentinternal) * [wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>](#wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsfreeprocessheapvoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___) * [wil_details_GetKernelBaseProcAddress](#wil_details_getkernelbaseprocaddress) * [ClipboardServer::RegisterOsTaskCompletionIfRequired](#clipboardserverregisterostaskcompletionifrequired) * [ClipboardServer::EnsureClipboardInitialized](#clipboardserverensureclipboardinitialized) * [wil::details::ScopeExitFn<_>::~ScopeExitFn<_>](#wildetailsscopeexitfnlambda_72de26d775ae95225285d8e66058739b_scopeexitfnlambda_72de26d775ae95225285d8e66058739b_) * [::operator()](#lambda_a48a94a6a32a30d5245553aa2ddbc81doperator) * [ClipboardAllowListEntry::~ClipboardAllowListEntry](#clipboardallowlistentryclipboardallowlistentry) * [wil::details_abi::SemaphoreValue::TryGetValueInternal](#wildetails_abisemaphorevaluetrygetvalueinternal) * [ClipboardAllowListEntry::~ClipboardAllowListEntry](#clipboardallowlistentryclipboardallowlistentry) * [ClipboardAllowListEntry::~ClipboardAllowListEntry](#clipboardallowlistentryclipboardallowlistentry) * [wil::details::ScopeExitFn<_>::~ScopeExitFn<_>](#wildetailsscopeexitfnlambda_72de26d775ae95225285d8e66058739b_scopeexitfnlambda_72de26d775ae95225285d8e66058739b_) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_) * [NtStatusToHr](#ntstatustohr) * [last_error_context](#last_error_context) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [atexit](#atexit) * [API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree](#api-ms-win-core-heap-l1-1-0dllheapfree) * [Initialize](#initialize) * [StringCchPrintfW](#stringcchprintfw) * [API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId](#api-ms-win-core-processthreads-l1-1-0dllgetcurrentprocessid) * [Return_Hr](#return_hr) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared](#api-ms-win-core-synch-l1-1-0dllreleasesrwlockshared) * [__GSHandlerCheck_EH4](#__gshandlercheck_eh4) * [reset](#reset) * [ProcessHeapAlloc](#processheapalloc) * [~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [_Throw_Hr](#_throw_hr) * [~last_error_context](#last_error_context) * [__security_check_cookie](#__security_check_cookie) * [GetContentDetails](#getcontentdetailsunsigned_short___ptr64unsigned_short_const___ptr64) * [unique_ptr<1,void>](#unique_ptrvoidstruct_wilprocess_heap_deleter1void) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW](#api-ms-win-core-synch-l1-1-0dllcreatemutexexw) * [GetLastErrorFailHr](#getlasterrorfailhr) * [__chkstk](#__chkstk) * [reset](#reset) * [acquire](#acquire) * [MSVCRT.DLL::memcpy_s](#msvcrtdllmemcpy_s) * [GetEnterpriseIdFromDataPackage](#getenterpriseidfromdatapackage) * [API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap](#api-ms-win-core-heap-l1-1-0dllgetprocessheap) * [~SemaphoreValue](#semaphorevalue) * [~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsreleasemutexvoid___ptr64struct_wistdintegral_constantunsigned___int642void___ptr64void___ptr640stdnullptr_t_) * [~ClipboardAllowListEntry](#clipboardallowlistentry) * [LockShared](#lockshared) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockshared) * [MSVCRT.DLL::exception::exception](#msvcrtdllexceptionexception) # Visual Chart Diff ```mermaid flowchart LR wildetailsWilFailureNotifyWatchers-3-old<--Match 98%-->wildetailsWilFailureNotifyWatchers-3-new wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataRelease-1-old<--Match 65%-->wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataRelease-1-new ClipboardServerRequestAccessForProcess-3-old<--Match 87%-->ClipboardServerRequestAccessForProcess-3-new ClipboardServerUpdateEdpDataPackageLockState-2-old<--Match 19%-->ClipboardServerUpdateEdpDataPackageLockState-2-new wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataAcquire-2-old<--Match 92%-->wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataAcquire-2-new ClipboardServerGetEnterpriseIdOfContent-2-old<--Match 34%-->ClipboardServerGetEnterpriseIdOfContent-2-new ClipboardServerSubscribeToMDMPolicyChange-1-old<--Match 97%-->ClipboardServerSubscribeToMDMPolicyChange-1-new wildetailsin1diag3_FailFast_Unexpected-3-old<--Match 83%-->wildetailsin1diag3_FailFast_Unexpected-3-new wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_CoTaskMemFreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-old<--Match 97%-->wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_CoTaskMemFreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-new ClipboardServerGetContentInternal-1-old<--Match 56%-->ClipboardServerGetContentInternal-1-new wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsFreeProcessHeapvoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-old<--Match 97%-->wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsFreeProcessHeapvoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-new wil_details_GetKernelBaseProcAddress-1-old<--Match 89%-->wil_details_GetKernelBaseProcAddress-1-new ClipboardServerRegisterOsTaskCompletionIfRequired-3-old<--Match 93%-->ClipboardServerRegisterOsTaskCompletionIfRequired-3-new ClipboardServerEnsureClipboardInitialized-1-old<--Match 96%-->ClipboardServerEnsureClipboardInitialized-1-new wildetailsScopeExitFnlambda_72de26d775ae95225285d8e66058739b_ScopeExitFnlambda_72de26d775ae95225285d8e66058739b_-1-old<--Match 56%-->wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsUnregisterWilFeatureConfigurationChangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsUnregisterWilFeatureConfigurationChangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_-1-new lambda_a48a94a6a32a30d5245553aa2ddbc81doperator-4-old<--Match 91%-->lambda_7ce5c7f9bfbf0ed99f41f5e2a2f58f65operator-4-new ClipboardAllowListEntryClipboardAllowListEntry-1-old<--Match 0%-->wildetails_abiUsageIndexesUsageIndexes-1-new wildetails_abiSemaphoreValueTryGetValueInternal-4-old<--Match 25%-->wildetails_abiSemaphoreValueTryGetPointer-4-new ClipboardAllowListEntryClipboardAllowListEntry-1-old<--Match 0%-->wildetailsEnabledStateManagerOnTimer-1-new ClipboardAllowListEntryClipboardAllowListEntry-1-old<--Match 0%-->wildetails_abiRawUsageIndexRawUsageIndex-1-new wildetailsScopeExitFnlambda_72de26d775ae95225285d8e66058739b_ScopeExitFnlambda_72de26d775ae95225285d8e66058739b_-1-old<--Match 46%-->wildetailsScopeExitFnlambda_1344a53bf6f58267d70c2a2450964362_ScopeExitFnlambda_1344a53bf6f58267d70c2a2450964362_-1-new subgraph cbs_7623.dll wildetailsWilFailureNotifyWatchers-3-new wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataRelease-1-new ClipboardServerRequestAccessForProcess-3-new ClipboardServerUpdateEdpDataPackageLockState-2-new wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataAcquire-2-new ClipboardServerGetEnterpriseIdOfContent-2-new ClipboardServerSubscribeToMDMPolicyChange-1-new wildetailsin1diag3_FailFast_Unexpected-3-new wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_CoTaskMemFreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-new ClipboardServerGetContentInternal-1-new wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsFreeProcessHeapvoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-new wil_details_GetKernelBaseProcAddress-1-new ClipboardServerRegisterOsTaskCompletionIfRequired-3-new ClipboardServerEnsureClipboardInitialized-1-new wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsUnregisterWilFeatureConfigurationChangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsUnregisterWilFeatureConfigurationChangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_-1-new lambda_7ce5c7f9bfbf0ed99f41f5e2a2f58f65operator-4-new wildetails_abiUsageIndexesUsageIndexes-1-new wildetails_abiSemaphoreValueTryGetPointer-4-new wildetailsEnabledStateManagerOnTimer-1-new wildetails_abiRawUsageIndexRawUsageIndex-1-new wildetailsScopeExitFnlambda_1344a53bf6f58267d70c2a2450964362_ScopeExitFnlambda_1344a53bf6f58267d70c2a2450964362_-1-new subgraph Added direction LR wil-details-dynamic_initializer_for_g_featureStateManager wil-details-dynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi wil-details-dynamic_initializer_for_g_header_init_InitializeStagingSRUMFeatureReporting wil-details_abi-SemaphoreValue-Destroy wil-ProcessShutdownInProgress wil-details-unique_storagestruct_wil-details-resource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wil-details-ReleaseMutexvoid___ptr64struct_wistd-integral_constantunsigned___int642void___ptr64void___ptr640std-nullptr_t_-reset lambda_152aa9d2a3a0648fa2fa7fcef514b376-lambda_invoker_cdecl lambda_1ad7ecfab602a777ecf020873216a663-lambda_invoker_cdecl lambda_5035b992506f4af81a770c5842624510-lambda_invoker_cdecl lambda_d51448ba32f8ef42e59400edd4566183-lambda_invoker_cdecl wistd-functionvoid___cdeclvoid-functionvoid___cdeclvoidlambda_eda1cf2fd3cd86dd27b5a777412c3e93void wil-ScopeExitlambda_1344a53bf6f58267d70c2a2450964362_ CCrashDetector-TakeOwnershipOfHandleAndStartMonitoringlambda_652d99b017fc03eadfd20048eacf929a_ lambda_1344a53bf6f58267d70c2a2450964362-lambda_1344a53bf6f58267d70c2a2450964362 wil-details_abi-ProcessLocalStorageDataclass_wil-details_abi-FeatureStateData-ProcessLocalStorageDataclass_wil-details_abi-FeatureStateData wil-details_abi-RawUsageIndex-RawUsageIndex wil-details_abi-SubscriptionList-SubscriptionList wil-details_abi-UsageIndexes-UsageIndexes wil-details_abi-ProcessLocalStorageclass_wil-details_abi-FeatureStateData-ProcessLocalStorageclass_wil-details_abi-FeatureStateData wil-details_abi-ProcessLocalStorageDataclass_wil-details_abi-FeatureStateData-ProcessLocalStorageDataclass_wil-details_abi-FeatureStateData wil-details-unique_storagestruct_wil-details-resource_policystruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-UnsubscribeProcessWideUsageFlushstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_wistd-integral_constantunsigned___int640struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_-unique_storagestruct_wil-details-resource_policystruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-UnsubscribeProcessWideUsageFlushstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_wistd-integral_constantunsigned___int640struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_ wil-details-unique_storagestruct_wil-details-resource_policystruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-WilApi_UnsubscribeFeatureStateChangeNotificationstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_wistd-integral_constantunsigned___int640struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_-unique_storagestruct_wil-details-resource_policystruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-WilApi_UnsubscribeFeatureStateChangeNotificationstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_wistd-integral_constantunsigned___int640struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64struct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_ wil-details-unique_storagestruct_wil-details-resource_policystruct__RTL_CRITICAL_SECTION___ptr64void___cdeclstruct__RTL_CRITICAL_SECTION___ptr64void___cdecl_LeaveCriticalSectionstruct__RTL_CRITICAL_SECTION___ptr64struct_wistd-integral_constantunsigned___int641struct__RTL_CRITICAL_SECTION___ptr64struct__RTL_CRITICAL_SECTION___ptr640std-nullptr_t_-unique_storagestruct_wil-details-resource_policystruct__RTL_CRITICAL_SECTION___ptr64void___cdeclstruct__RTL_CRITICAL_SECTION___ptr64void___cdecl_LeaveCriticalSectionstruct__RTL_CRITICAL_SECTION___ptr64struct_wistd-integral_constantunsigned___int641struct__RTL_CRITICAL_SECTION___ptr64struct__RTL_CRITICAL_SECTION___ptr640std-nullptr_t_ wil-details-unique_storagestruct_wil-details-resource_policystruct__RTL_SRWLOCK___ptr64void___cdeclstruct__RTL_SRWLOCK___ptr64void___cdecl_ReleaseSRWLockSharedstruct__RTL_SRWLOCK___ptr64struct_wistd-integral_constantunsigned___int641struct__RTL_SRWLOCK___ptr64struct__RTL_SRWLOCK___ptr640std-nullptr_t_-unique_storagestruct_wil-details-resource_policystruct__RTL_SRWLOCK___ptr64void___cdeclstruct__RTL_SRWLOCK___ptr64void___cdecl_ReleaseSRWLockSharedstruct__RTL_SRWLOCK___ptr64struct_wistd-integral_constantunsigned___int641struct__RTL_SRWLOCK___ptr64struct__RTL_SRWLOCK___ptr640std-nullptr_t_ wil-details-unique_storagestruct_wil-details-resource_policystruct__TP_TIMER___ptr64void___cdeclstruct__TP_TIMER___ptr64public_static_void___cdecl_wil-details-DestroyThreadPoolTimerstruct_wil-details-SystemThreadPoolMethods0-Destroystruct__TP_TIMER___ptr64struct_wistd-integral_constantunsigned___int640struct__TP_TIMER___ptr64struct__TP_TIMER___ptr640std-nullptr_t_-unique_storagestruct_wil-details-resource_policystruct__TP_TIMER___ptr64void___cdeclstruct__TP_TIMER___ptr64public_static_void___cdecl_wil-details-DestroyThreadPoolTimerstruct_wil-details-SystemThreadPoolMethods0-Destroystruct__TP_TIMER___ptr64struct_wistd-integral_constantunsigned___int640struct__TP_TIMER___ptr64struct__TP_TIMER___ptr640std-nullptr_t_ wil-details-EnabledStateManager-EnabledStateManager wil-details_abi-FeatureStateData-FeatureStateData 92_more_added_funcs_omitted end end subgraph cbs_7309.dll wildetailsWilFailureNotifyWatchers-3-old wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataRelease-1-old ClipboardServerRequestAccessForProcess-3-old ClipboardServerUpdateEdpDataPackageLockState-2-old wildetails_abiProcessLocalStorageDatastruct_wildetails_abiProcessLocalDataAcquire-2-old ClipboardServerGetEnterpriseIdOfContent-2-old ClipboardServerSubscribeToMDMPolicyChange-1-old wildetailsin1diag3_FailFast_Unexpected-3-old wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_CoTaskMemFreevoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-old ClipboardServerGetContentInternal-1-old wilmake_unique_string_nothrowclass_wilunique_any_tclass_wildetailsunique_storagestruct_wildetailsresource_policyunsigned_short___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsFreeProcessHeapvoid___ptr64struct_wistdintegral_constantunsigned___int640unsigned_short___ptr64unsigned_short___ptr640stdnullptr_t___-2-old wil_details_GetKernelBaseProcAddress-1-old ClipboardServerRegisterOsTaskCompletionIfRequired-3-old ClipboardServerEnsureClipboardInitialized-1-old wildetailsScopeExitFnlambda_72de26d775ae95225285d8e66058739b_ScopeExitFnlambda_72de26d775ae95225285d8e66058739b_-1-old lambda_a48a94a6a32a30d5245553aa2ddbc81doperator-4-old ClipboardAllowListEntryClipboardAllowListEntry-1-old wildetails_abiSemaphoreValueTryGetValueInternal-4-old ClipboardAllowListEntryClipboardAllowListEntry-1-old ClipboardAllowListEntryClipboardAllowListEntry-1-old wildetailsScopeExitFnlambda_72de26d775ae95225285d8e66058739b_ScopeExitFnlambda_72de26d775ae95225285d8e66058739b_-1-old end ``` ```mermaid pie showData title Function Matches - 95.7639% "unmatched_funcs_len" : 117 "matched_funcs_len" : 2645 ``` ```mermaid pie showData title Matched Function Similarity - 97.3157% "matched_funcs_with_code_changes_len" : 21 "matched_funcs_with_non_code_changes_len" : 50 "matched_funcs_no_changes_len" : 2574 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cbs_7309.dll cbs_7623.dll ``` #### Verbose Args
``` --old ['cbs_7309.dll'] --new [['cbs_7623.dll']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/ClipboardServer.dll/1DD9886137000/ClipboardServer.dll -O clipboardserver.dll.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/ClipboardServer.dll/A435E19C3C000/ClipboardServer.dll -O clipboardserver.dll.x64.10.0.26100.7623 ``` ## Binary Metadata Diff ```diff --- cbs_7309.dll Meta +++ cbs_7623.dll Meta @@ -1,44 +1,44 @@ -Program Name: cbs_7309.dll +Program Name: cbs_7623.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 231504 +# of Bytes: 251984 # of Memory Blocks: 10 -# of Instructions: 31248 -# of Defined Data: 4112 -# of Functions: 1316 -# of Symbols: 9821 -# of Data Types: 928 +# of Instructions: 35366 +# of Defined Data: 4259 +# of Functions: 1446 +# of Symbols: 10760 +# of Data Types: 1003 # of Data Type Categories: 184 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 22:42:29 SGT 2026 +Date Created: Sun Aug 16 22:42:32 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/cbs/cbs_7309.dll -Executable MD5: db61a408bd3fcfc319c80371ede0c04f -Executable SHA256: 2eb79a6b3542a8fcaec984faacb5f137b114179f89f9ae45a0b9355ef4c53879 -FSRL: file:///tmp/cbs/cbs_7309.dll?MD5=db61a408bd3fcfc319c80371ede0c04f +Executable Location: /tmp/cbs/cbs_7623.dll +Executable MD5: a19d0ca11401de9b06b601f736e0c937 +Executable SHA256: 73a6e152f6ce90fd19db87572514f57550837fe6e12397278339cb97ae70f5a2 +FSRL: file:///tmp/cbs/cbs_7623.dll?MD5=a19d0ca11401de9b06b601f736e0c937 PDB Age: 1 PDB File: ClipboardServer.pdb -PDB GUID: 6c659728-864f-ac63-e940-880ea0ced7c2 +PDB GUID: 466db15e-722b-2fb6-585f-e57f3856e445 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Modern Clipboard API Server -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7623 (WinBuild.160101.0800) PE Property[InternalName]: Modern Clipboard API Server PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: ClipboardServer.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7623 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra cbs_7309.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cbs_7309.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cbs_7309.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra cbs_7623.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra cbs_7623.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra cbs_7623.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|117| |deleted_funcs_len|0| |modified_funcs_len|71| |added_symbols_len|48| |deleted_symbols_len|0| |diff_time|5.676962614059448| |deleted_strings_len|0| |added_strings_len|9| |match_types|Counter({'SymbolsHash': 1288, 'ExternalsName': 170, 'BulkBasicBlockMnemonicHash': 19, 'ExactInstructionsFunctionHasher': 7, 'Implied Match': 5, 'ExactBytesFunctionHasher': 2, 'StructuralGraphExactHash': 2, 'SigCallingCalledHasher': 2, 'BSIM': 1, 'StructuralGraphHash': 1})| |items_to_process|236| |diff_types|Counter({'address': 71, 'refcount': 57, 'calling': 47, 'code': 21, 'length': 21, 'called': 20, 'sig': 17, 'fullname': 16, 'parent': 15, 'name': 13})| |unmatched_funcs_len|117| |total_funcs_len|2762| |matched_funcs_len|2645| |matched_funcs_with_code_changes_len|21| |matched_funcs_with_non_code_changes_len|50| |matched_funcs_no_changes_len|2574| |match_func_similarity_percent|97.3157%| |func_match_overall_percent|95.7639%| |first_matches|Counter({'SymbolsHash': 1288, 'BulkBasicBlockMnemonicHash': 19, 'ExactInstructionsFunctionHasher': 7, 'Implied Match': 5, 'ExactBytesFunctionHasher': 2, 'StructuralGraphExactHash': 2, 'SigCallingCalledHasher': 2, 'BSIM': 1, 'StructuralGraphHash': 1, 'ExternalsName': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1288 "ExternalsName" : 170 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 7 "StructuralGraphExactHash" : 2 "BSIM" : 1 "SigCallingCalledHasher" : 2 "StructuralGraphHash" : 1 "BulkBasicBlockMnemonicHash" : 19 "Implied-Match" : 5 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1288 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 7 "StructuralGraphExactHash" : 2 "BSIM" : 1 "SigCallingCalledHasher" : 2 "StructuralGraphHash" : 1 "BulkBasicBlockMnemonicHash" : 19 "Implied-Match" : 5 "ExternalsName" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 117 "deleted_funcs_len" : 0 "modified_funcs_len" : 71 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 48 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 9 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,9 @@ +s_LogStagedFeatureUsage +s_NtQueryWnfStateData +s_NtUpdateWnfStateData +s_RtlNotifyFeatureUsage +s_RtlQueryFeatureConfiguration +s_RtlRegisterFeatureConfiguration +s_RtlUnregisterFeatureConfigurati +s_WilStaging +s_onecore\internal\sdk\inc\wil\St ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_onecore\internal\sdk\inc\wil\St|1|SetBuffer| |s_NtQueryWnfStateData|1|wil_details_NtQueryWnfStateData| |s_RtlNotifyFeatureUsage|1|wil_RtlStagingConfig_RecordFeatureUsage| |s_LogStagedFeatureUsage|1|wil_StagingConfig_LogStagedFeatureUsage| |s_RtlQueryFeatureConfiguration|1|wil_RtlStagingConfig_QueryFeatureState| |s_RtlRegisterFeatureConfiguration|1|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |s_WilStaging_02|1|| |s_NtUpdateWnfStateData|1|wil_details_NtUpdateWnfStateData| |s_RtlUnregisterFeatureConfigurati|1|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| # Deleted # Added ## wil::details::`dynamic_initializer_for_'g_featureStateManager'' ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_featureStateManager''| |fullname|wil::details::`dynamic_initializer_for_'g_featureStateManager''| |refcount|3| |length|89| |called|atexit
wil::details_abi::SubscriptionList::SubscriptionList| |calling|| |paramcount|0| |address|1800024a0| |sig|undefined __fastcall `dynamic_initializer_for_'g_featureStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_initializer_for_'g_featureStateManager'' +++ wil::details::`dynamic_initializer_for_'g_featureStateManager'' @@ -0,0 +1,19 @@ + +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ + +void wil::details::_dynamic_initializer_for__g_featureStateManager__(void) + +{ + details_abi::SubscriptionList::SubscriptionList((SubscriptionList *)&DAT_1800350a8); + _DAT_1800350f0 = 0; + details_abi::SubscriptionList::SubscriptionList((SubscriptionList *)&DAT_1800350f8); + _DAT_180035160 = 0; + g_featureStateManager = (shutdown_aware_object)0x1; + _DAT_180035140 = 0; + uRam0000000180035148 = 0; + _DAT_180035150 = 0; + uRam0000000180035158 = 0; + atexit(_dynamic_atexit_destructor_for__g_featureStateManager__); + return; +} + ``` ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |refcount|2| |length|71| |called|| |calling|| |paramcount|0| |address|180002500| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' +++ wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' @@ -0,0 +1,15 @@ + +void wil::details::_dynamic_initializer_for__g_header_init_InitializeStagingHeaderInternalApi__ + (void) + +{ + g_wil_details_internalGetFeatureEnabledState = WilApiImpl_GetFeatureEnabledState; + g_wil_details_internalRecordFeatureUsage = WilApiImpl_RecordFeatureUsage; + g_wil_details_internalSubscribeFeatureStateChangeNotification = + WilApiImpl_SubscribeFeatureStateChangeNotification; + g_wil_details_internalUnsubscribeFeatureStateChangeNotification = + WilApiImpl_UnsubscribeFeatureStateChangeNotification; + g_wil_details_realtimeFeatureUsageHook = wil_StagingConfig_LogStagedFeatureUsage; + return; +} + ``` ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting'' ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''| |refcount|2| |length|15| |called|| |calling|| |paramcount|0| |address|180002550| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting'' +++ wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting'' @@ -0,0 +1,9 @@ + +void wil::details::_dynamic_initializer_for__g_header_init_InitializeStagingSRUMFeatureReporting__ + (void) + +{ + g_wil_details_RecordSRUMFeatureUsage = RecordSRUMFeatureUsage; + return; +} + ``` ## wil::details_abi::SemaphoreValue::Destroy ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Destroy| |fullname|wil::details_abi::SemaphoreValue::Destroy| |refcount|3| |length|32| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |calling|wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|18000a654| |sig|void __thiscall Destroy(SemaphoreValue * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SemaphoreValue::Destroy +++ wil::details_abi::SemaphoreValue::Destroy @@ -0,0 +1,17 @@ + +/* public: void __cdecl wil::details_abi::SemaphoreValue::Destroy(void) __ptr64 */ + +void __thiscall wil::details_abi::SemaphoreValue::Destroy(SemaphoreValue *this) + +{ + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)this,(void *)0x0); + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)(this + 8),(void *)0x0); + return; +} + ``` ## wil::ProcessShutdownInProgress ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ProcessShutdownInProgress| |fullname|wil::ProcessShutdownInProgress| |refcount|10| |length|47| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|0| |address|18000b408| |sig|bool __cdecl ProcessShutdownInProgress(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::ProcessShutdownInProgress +++ wil::ProcessShutdownInProgress @@ -0,0 +1,22 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* bool __cdecl wil::ProcessShutdownInProgress(void) */ + +bool __cdecl wil::ProcessShutdownInProgress(void) + +{ + uchar uVar1; + + if (!details::g_processShutdownInProgress) { + if (details::g_pfnDllShutdownInProgress == (_func_uchar *)0x0) { + return false; + } + uVar1 = (*details::g_pfnDllShutdownInProgress)(); + if (uVar1 == '\0') { + return false; + } + } + return true; +} + ``` ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|reset| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |refcount|3| |length|76| |called|wil::details::ReleaseMutex
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|2| |address|18000c3fc| |sig|void __thiscall reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this, void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset @@ -0,0 +1,26 @@ + +/* public: void __cdecl wil::details::unique_storage,void * __ptr64,void * + __ptr64,0,std::nullptr_t> >::reset(void * __ptr64) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> +::reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *this,void *param_1) + +{ + void *pvVar1; + last_error_context local_res8 [8]; + + pvVar1 = *(void **)this; + if (pvVar1 != (void *)0x0) { + last_error_context::last_error_context(local_res8); + ReleaseMutex(pvVar1); + last_error_context::~last_error_context(local_res8); + } + *(void **)this = param_1; + return; +} + ``` ## :: ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|30| |called|wil::details_abi::SubscriptionList::OnSignaled| |calling|| |paramcount|1| |address|18000c6c0| |sig|undefined __cdecl (void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- :: +++ :: @@ -0,0 +1,15 @@ + +/* private: static __cdecl ::(void * + __ptr64) */ + +void __cdecl ::(void *param_1) + +{ + if (*(char *)param_1 != '\0') { + wil::details_abi::SubscriptionList::OnSignaled + ((SubscriptionList *)((longlong)param_1 + 0x98),(srwlock *)((longlong)param_1 + 0x20)) + ; + } + return; +} + ``` ## :: ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|27| |called|wil::details_abi::SubscriptionList::OnSignaled| |calling|| |paramcount|1| |address|18000c750| |sig|undefined __cdecl (void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- :: +++ :: @@ -0,0 +1,15 @@ + +/* private: static __cdecl ::(void * + __ptr64) */ + +void __cdecl ::(void *param_1) + +{ + if (*(char *)param_1 != '\0') { + wil::details_abi::SubscriptionList::OnSignaled + ((SubscriptionList *)((longlong)param_1 + 0x48),(srwlock *)((longlong)param_1 + 0x20)) + ; + } + return; +} + ``` ## :: ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|102| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil_details_WriteSRUMWnfUsageBuffer| |calling|| |paramcount|3| |address|18000c780| |sig|undefined __cdecl (_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_TIMER * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- :: +++ :: @@ -0,0 +1,33 @@ + +/* private: static __cdecl ::(struct + _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_TIMER * __ptr64) */ + +void __cdecl +:: + (_TP_CALLBACK_INSTANCE *param_1,void *param_2,_TP_TIMER *param_3) + +{ + PSRWLOCK SRWLock; + heap_vector *phVar1; + PSRWLOCK local_res10 [3]; + + if (*(char *)param_2 != '\0') { + SRWLock = (PSRWLOCK)((longlong)param_2 + 0x28); + AcquireSRWLockExclusive(SRWLock); + phVar1 = (heap_vector *)((longlong)param_2 + 0xe8); + local_res10[0] = SRWLock; + if (0xb < (ulonglong)(*(longlong *)((longlong)param_2 + 0xf0) - *(longlong *)phVar1)) { + wil_details_WriteSRUMWnfUsageBuffer(phVar1); + *(undefined8 *)((longlong)param_2 + 0xf0) = *(undefined8 *)phVar1; + } + *(undefined1 *)((longlong)param_2 + 0x40) = 0; + wil::details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_res10); + } + return; +} + ``` ## :: ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|75| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::FeatureStateManager::FlushUsage
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|| |paramcount|3| |address|18000c830| |sig|undefined __cdecl (_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_TIMER * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- :: +++ :: @@ -0,0 +1,26 @@ + +/* private: static __cdecl ::(struct + _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_TIMER * __ptr64) */ + +void __cdecl +:: + (_TP_CALLBACK_INSTANCE *param_1,void *param_2,_TP_TIMER *param_3) + +{ + PSRWLOCK local_res10 [3]; + + if (*(char *)param_2 != '\0') { + AcquireSRWLockExclusive((PSRWLOCK)((longlong)param_2 + 0x20)); + *(undefined1 *)((longlong)param_2 + 0x41) = 0; + local_res10[0] = (PSRWLOCK)((longlong)param_2 + 0x20); + wil::details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_res10); + wil::details::FeatureStateManager::FlushUsage(param_2); + } + return; +} + ``` ## wistd::function::function<,void> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|function<,void>| |fullname|wistd::function::function<,void>| |refcount|1| |length|26| |called|| |calling|ClipboardServer::SubscribeToMDMPolicyChange| |paramcount|2| |address|18000ca44| |sig|longlong __fastcall function<,void>(longlong param_1, undefined8 param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wistd::function::function<,void> +++ wistd::function::function<,void> @@ -0,0 +1,12 @@ + +longlong wistd::function:: + function<,void> + (longlong param_1,undefined8 param_2) + +{ + *(undefined8 *)(param_1 + 0x10) = param_2; + *(undefined8 *)(param_1 + 8) = &PTR__scalar_deleting_destructor__1800286d8; + *(undefined8 **)(param_1 + 0x70) = (undefined8 *)(param_1 + 8); + return param_1; +} + ``` ## wil::ScopeExit<_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ScopeExit<_>| |fullname|wil::ScopeExit<_>| |refcount|1| |length|15| |called|| |calling|ClipboardServer::RegisterOsTaskCompletionIfRequired| |paramcount|2| |address|18000dafc| |sig|undefined8 * __fastcall ScopeExit<_>(undefined8 * param_1, undefined8 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::ScopeExit<_> +++ wil::ScopeExit<_> @@ -0,0 +1,16 @@ + +undefined8 * +wil::ScopeExit<_>(undefined8 *param_1,undefined8 *param_2) + +{ + undefined8 uVar1; + undefined8 uVar2; + + uVar1 = *param_2; + uVar2 = param_2[1]; + *(undefined1 *)(param_1 + 2) = 1; + *param_1 = uVar1; + param_1[1] = uVar2; + return param_1; +} + ``` ## CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|TakeOwnershipOfHandleAndStartMonitoring<_>| |fullname|CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_>| |refcount|2| |length|72| |called|CCrashDetector::_TakeOwnershipOfHandleAndStartMonitoring
operator_new| |calling|ClipboardServer::RegisterOsTaskCompletionIfRequired| |paramcount|2| |address|18000db98| |sig|undefined __fastcall TakeOwnershipOfHandleAndStartMonitoring<_>(CCrashDetector * param_1, void * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_> +++ CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_> @@ -0,0 +1,16 @@ + +void CCrashDetector:: + TakeOwnershipOfHandleAndStartMonitoring<_> + (CCrashDetector *param_1,void *param_2) + +{ + CHandler *pCVar1; + + pCVar1 = operator_new(0x10,&std::nothrow); + if (pCVar1 != (CHandler *)0x0) { + *(undefined ***)pCVar1 = &PTR__scalar_deleting_destructor__1800286c8; + } + _TakeOwnershipOfHandleAndStartMonitoring(param_1,param_2,pCVar1); + return; +} + ``` ## :: ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|| |fullname|::| |refcount|1| |length|11| |called|| |calling|ClipboardServer::RegisterOsTaskCompletionIfRequired| |paramcount|3| |address|18000e3c8| |sig|undefined8 * __fastcall (undefined8 * param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- :: +++ :: @@ -0,0 +1,11 @@ + +undefined8 * +:: + (undefined8 *param_1,undefined8 param_2,undefined8 param_3) + +{ + *param_1 = param_2; + param_1[1] = param_3; + return param_1; +} + ``` ## wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ProcessLocalStorageData| |fullname|wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |refcount|2| |length|102| |called|memset
wil::details_abi::SubscriptionList::SubscriptionList
wil::details_abi::UsageIndexes::UsageIndexes| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |paramcount|3| |address|18000e4c4| |sig|undefined __thiscall ProcessLocalStorageData(ProcessLocalStorageData * this, unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> * param_1, SemaphoreValue * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData +++ wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData @@ -0,0 +1,32 @@ + +/* public: __cdecl wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData(class wil::unique_any_t,void * __ptr64,void * + __ptr64,0,std::nullptr_t> >,struct wil::err_returncode_policy> > && __ptr64,class + wil::details_abi::SemaphoreValue && __ptr64) __ptr64 */ + +ProcessLocalStorageData * __thiscall +wil::details_abi::ProcessLocalStorageData:: +ProcessLocalStorageData + (ProcessLocalStorageData *this, + unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> + *param_1,SemaphoreValue *param_2) + +{ + *(undefined4 *)this = 1; + *(undefined8 *)(this + 8) = *(undefined8 *)param_1; + *(undefined8 *)param_1 = 0; + *(undefined8 *)(this + 0x10) = *(undefined8 *)param_2; + *(undefined8 *)param_2 = 0; + *(undefined8 *)(this + 0x18) = *(undefined8 *)(param_2 + 8); + *(undefined8 *)(param_2 + 8) = 0; + memset(this + 0x28,0,0x108); + *(undefined8 *)(this + 0x20) = 0; + UsageIndexes::UsageIndexes((UsageIndexes *)(this + 0x28)); + SubscriptionList::SubscriptionList((SubscriptionList *)(this + 0xe8)); + return this; +} + ``` ## wil::details_abi::RawUsageIndex::RawUsageIndex ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RawUsageIndex| |fullname|wil::details_abi::RawUsageIndex::RawUsageIndex| |refcount|5| |length|125| |called|wil::details_abi::UsageIndexProperty::GetSize| |calling|wil::details_abi::RecordWnfUsageIndex
wil::details_abi::UsageIndexes::UsageIndexes| |paramcount|6| |address|18000e7c4| |sig|undefined __thiscall RawUsageIndex(RawUsageIndex * this, ushort param_1, ushort param_2, CountSize param_3, ushort param_4, CountSize param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::RawUsageIndex +++ wil::details_abi::RawUsageIndex::RawUsageIndex @@ -0,0 +1,45 @@ + +/* public: __cdecl wil::details_abi::RawUsageIndex::RawUsageIndex(unsigned short,unsigned short,enum + wil::details_abi::CountSize,unsigned short,enum wil::details_abi::CountSize) __ptr64 */ + +RawUsageIndex * __thiscall +wil::details_abi::RawUsageIndex::RawUsageIndex + (RawUsageIndex *this,ushort param_1,ushort param_2,CountSize param_3,ushort param_4, + CountSize param_5) + +{ + __uint64 _Var1; + __uint64 _Var2; + ushort local_28; + undefined1 local_26; + undefined4 local_24; + undefined2 local_20; + undefined8 local_18; + undefined8 uStack_10; + + *(ushort *)(this + 2) = param_2; + _Var1 = 0; + *(ushort *)(this + 6) = param_4; + *(ushort *)this = param_1; + this[4] = SUB41(param_3,0); + this[8] = (RawUsageIndex)(undefined1)param_5; + _Var2 = _Var1; + if (param_4 != 0) { + local_26 = (undefined1)param_5; + local_28 = param_4; + local_18 = 0; + uStack_10 = 0; + local_24 = 0; + local_20 = 0; + _Var1 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_28); + } + *(__uint64 *)(this + 0x10) = _Var1; + *(__uint64 *)(this + 0x18) = _Var2; + *(__uint64 *)(this + 0x20) = _Var2; + *(__uint64 *)(this + 0x28) = _Var2; + *(__uint64 *)(this + 0x30) = _Var2; + *(short *)(this + 0x38) = (short)_Var2; + this[0x3a] = SUB81(_Var2,0); + return this; +} + ``` ## wil::details_abi::SubscriptionList::SubscriptionList ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SubscriptionList| |fullname|wil::details_abi::SubscriptionList::SubscriptionList| |refcount|4| |length|53| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionEx| |calling|wil::details::`dynamic_initializer_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |paramcount|1| |address|18000e848| |sig|undefined __thiscall SubscriptionList(SubscriptionList * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SubscriptionList::SubscriptionList +++ wil::details_abi::SubscriptionList::SubscriptionList @@ -0,0 +1,15 @@ + +/* public: __cdecl wil::details_abi::SubscriptionList::SubscriptionList(void) __ptr64 */ + +SubscriptionList * __thiscall +wil::details_abi::SubscriptionList::SubscriptionList(SubscriptionList *this) + +{ + InitializeCriticalSectionEx((LPCRITICAL_SECTION)this,0,0); + *(undefined8 *)(this + 0x28) = 0; + *(undefined8 *)(this + 0x30) = 0; + *(undefined8 *)(this + 0x38) = 0; + *(undefined8 *)(this + 0x40) = 0; + return this; +} + ``` ## wil::details_abi::UsageIndexes::UsageIndexes ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|UsageIndexes| |fullname|wil::details_abi::UsageIndexes::UsageIndexes| |refcount|4| |length|108| |called|wil::details_abi::RawUsageIndex::RawUsageIndex| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |paramcount|1| |address|18000e884| |sig|undefined __thiscall UsageIndexes(UsageIndexes * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexes::UsageIndexes +++ wil::details_abi::UsageIndexes::UsageIndexes @@ -0,0 +1,21 @@ + +/* public: __cdecl wil::details_abi::UsageIndexes::UsageIndexes(void) __ptr64 */ + +UsageIndexes * __thiscall wil::details_abi::UsageIndexes::UsageIndexes(UsageIndexes *this) + +{ + undefined4 in_R9D; + CountSize CVar1; + CountSize in_stack_fffffffffffffff0; + CountSize CVar2; + + CVar2 = in_stack_fffffffffffffff0 & 0xffffff00; + CVar1 = CONCAT31((int3)((uint)in_R9D >> 8),1); + RawUsageIndex::RawUsageIndex((RawUsageIndex *)this,0,4,CVar1,4,CVar2); + CVar2 = CONCAT31((int3)(CVar2 >> 8),2); + RawUsageIndex::RawUsageIndex((RawUsageIndex *)(this + 0x40),0,4,CVar1,4,CVar2); + RawUsageIndex::RawUsageIndex + ((RawUsageIndex *)(this + 0x80),0,4,CVar1,0,CONCAT31((int3)(CVar2 >> 8),(char)CVar1)); + return this; +} + ``` ## wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~ProcessLocalStorage| |fullname|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |refcount|3| |length|24| |called|wil::details_abi::ProcessLocalStorageData::Release| |calling|wil::details::FeatureStateManager::~FeatureStateManager
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''| |paramcount|1| |address|18000ea20| |sig|void __thiscall ~ProcessLocalStorage(ProcessLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage +++ wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage @@ -0,0 +1,19 @@ + +/* public: __cdecl wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage(void) __ptr64 */ + +void __thiscall +wil::details_abi::ProcessLocalStorage:: +~ProcessLocalStorage + (ProcessLocalStorage *this) + +{ + if (*(ProcessLocalStorageData **)(this + 8) != + (ProcessLocalStorageData *)0x0) { + ProcessLocalStorageData::Release + (*(ProcessLocalStorageData **)(this + 8)); + } + return; +} + ``` ## wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~ProcessLocalStorageData| |fullname|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |refcount|2| |length|41| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::~FeatureStateData
wil::details_abi::SemaphoreValue::~SemaphoreValue| |calling|wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|18000ea40| |sig|void __thiscall ~ProcessLocalStorageData(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData +++ wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData @@ -0,0 +1,22 @@ + +/* public: __cdecl wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData(void) __ptr64 */ + +void __thiscall +wil::details_abi::ProcessLocalStorageData:: +~ProcessLocalStorageData + (ProcessLocalStorageData *this) + +{ + FeatureStateData::~FeatureStateData((FeatureStateData *)(this + 0x20)); + SemaphoreValue::~SemaphoreValue((SemaphoreValue *)(this + 0x10)); + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)(this + 8)); + return; +} + ``` ## wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |refcount|2| |length|22| |called|wil::details::UnsubscribeProcessWideUsageFlush| |calling|wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1| |address|18000ecec| |sig|void __thiscall ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>(unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> @@ -0,0 +1,30 @@ + +/* public: __cdecl wil::details::unique_storage,struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * + __ptr64,0,std::nullptr_t> >::~unique_storage,struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * + __ptr64,0,std::nullptr_t> >(void) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + (unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + *this) + +{ + if (*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { + UnsubscribeProcessWideUsageFlush(*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this); + } + return; +} + ``` ## wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |refcount|3| |length|23| |called|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |calling|wil::details::EnabledStateManager::~EnabledStateManager| |paramcount|1| |address|18000ed0c| |sig|void __thiscall ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>(unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> @@ -0,0 +1,30 @@ + +/* public: __cdecl wil::details::unique_storage,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,0,std::nullptr_t> >::~unique_storage,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,0,std::nullptr_t> >(void) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + (unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + *this) + +{ + if (*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { + WilApi_UnsubscribeFeatureStateChangeNotification(*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this); + } + return; +} + ``` ## wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>| |refcount|3| |length|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection| |calling|wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe| |paramcount|1| |address|18000ed2c| |sig|void __thiscall ~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> @@ -0,0 +1,26 @@ + +/* public: __cdecl wil::details::unique_storage,struct _RTL_CRITICAL_SECTION * __ptr64,struct + _RTL_CRITICAL_SECTION * __ptr64,0,std::nullptr_t> >::~unique_storage,struct _RTL_CRITICAL_SECTION * + __ptr64,struct _RTL_CRITICAL_SECTION * __ptr64,0,std::nullptr_t> >(void) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + (unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + *this) + +{ + if (*(LPCRITICAL_SECTION *)this != (LPCRITICAL_SECTION)0x0) { + LeaveCriticalSection(*(LPCRITICAL_SECTION *)this); + } + return; +} + ``` ## wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |refcount|2| |length|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared| |calling|wil::details_abi::SubscriptionList::OnSignaled| |paramcount|1| |address|18000ed50| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> @@ -0,0 +1,25 @@ + +/* public: __cdecl wil::details::unique_storage,struct _RTL_SRWLOCK * __ptr64,struct _RTL_SRWLOCK * __ptr64,0,std::nullptr_t> + >::~unique_storage,struct _RTL_SRWLOCK * + __ptr64,struct _RTL_SRWLOCK * __ptr64,0,std::nullptr_t> >(void) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + (unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *this) + +{ + if (*(PSRWLOCK *)this != (PSRWLOCK)0x0) { + ReleaseSRWLockShared(*(PSRWLOCK *)this); + } + return; +} + ``` ## wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |refcount|4| |length|22| |called|wil::details::DestroyThreadPoolTimer::Destroy| |calling|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1| |address|18000ed74| |sig|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> @@ -0,0 +1,29 @@ + +/* public: __cdecl wil::details::unique_storage::Destroy(struct _TP_TIMER * __ptr64),struct + wistd::integral_constant,struct _TP_TIMER * __ptr64,struct _TP_TIMER * + __ptr64,0,std::nullptr_t> >::~unique_storage::Destroy(struct _TP_TIMER * __ptr64),struct + wistd::integral_constant,struct _TP_TIMER * __ptr64,struct _TP_TIMER * + __ptr64,0,std::nullptr_t> >(void) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + (unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *this) + +{ + if (*(_TP_TIMER **)this != (_TP_TIMER *)0x0) { + DestroyThreadPoolTimer::Destroy + (*(_TP_TIMER **)this); + } + return; +} + ``` ## wil::details::EnabledStateManager::~EnabledStateManager ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~EnabledStateManager| |fullname|wil::details::EnabledStateManager::~EnabledStateManager| |refcount|2| |length|113| |called|wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::FreeProcessHeap
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|18000f110| |sig|void __thiscall ~EnabledStateManager(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::~EnabledStateManager +++ wil::details::EnabledStateManager::~EnabledStateManager @@ -0,0 +1,42 @@ + +/* public: __cdecl wil::details::EnabledStateManager::~EnabledStateManager(void) __ptr64 */ + +void __thiscall wil::details::EnabledStateManager::~EnabledStateManager(EnabledStateManager *this) + +{ + void *pvVar1; + + *this = (EnabledStateManager)0x0; + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x10),(_TP_TIMER *)0x0); + *this = (EnabledStateManager)0x0; + RecordCachedUsageUnderLock(this); + pvVar1 = *(void **)(this + 0x68); + *(undefined8 *)(this + 0x68) = 0; + if (pvVar1 != (void *)0x0) { + FreeProcessHeap(pvVar1); + } + pvVar1 = *(void **)(this + 0x48); + *(undefined8 *)(this + 0x48) = 0; + if (pvVar1 != (void *)0x0) { + FreeProcessHeap(pvVar1); + } + unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + *)(this + 0x28)); + unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + *)(this + 0x20)); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x10)); + return; +} + ``` ## wil::details_abi::FeatureStateData::~FeatureStateData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~FeatureStateData| |fullname|wil::details_abi::FeatureStateData::~FeatureStateData| |refcount|2| |length|40| |called|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::SubscriptionList::~SubscriptionList
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |paramcount|1| |address|18000f200| |sig|void __thiscall ~FeatureStateData(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::FeatureStateData::~FeatureStateData +++ wil::details_abi::FeatureStateData::~FeatureStateData @@ -0,0 +1,12 @@ + +/* public: __cdecl wil::details_abi::FeatureStateData::~FeatureStateData(void) __ptr64 */ + +void __thiscall wil::details_abi::FeatureStateData::~FeatureStateData(FeatureStateData *this) + +{ + ProcessShutdown(this); + SubscriptionList::~SubscriptionList((SubscriptionList *)(this + 200)); + UsageIndexes::~UsageIndexes((UsageIndexes *)(this + 8)); + return; +} + ``` ## wil::details::FeatureStateManager::~FeatureStateManager ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~FeatureStateManager| |fullname|wil::details::FeatureStateManager::~FeatureStateManager| |refcount|2| |length|155| |called|wil::details::FreeProcessHeap
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage
wil::details_abi::SubscriptionList::~SubscriptionList| |calling|wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''| |paramcount|1| |address|18000f230| |sig|void __thiscall ~FeatureStateManager(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::~FeatureStateManager +++ wil::details::FeatureStateManager::~FeatureStateManager @@ -0,0 +1,48 @@ + +/* public: __cdecl wil::details::FeatureStateManager::~FeatureStateManager(void) __ptr64 */ + +void __thiscall wil::details::FeatureStateManager::~FeatureStateManager(FeatureStateManager *this) + +{ + void *pvVar1; + + *this = (FeatureStateManager)0x0; + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x30),(_TP_TIMER *)0x0); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x38),(_TP_TIMER *)0x0); + pvVar1 = *(void **)(this + 0x100); + *(undefined8 *)(this + 0x100) = 0; + if (pvVar1 != (void *)0x0) { + FreeProcessHeap(pvVar1); + } + unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> + *)(this + 0xe0)); + details_abi::SubscriptionList::~SubscriptionList((SubscriptionList *)(this + 0x98)); + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)(this + 0x90)); + details_abi::SubscriptionList::~SubscriptionList((SubscriptionList *)(this + 0x48)); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x38)); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x30)); + details_abi::ProcessLocalStorage:: + ~ProcessLocalStorage + ((ProcessLocalStorage *)(this + 8)); + return; +} + ``` ## wil::details_abi::SubscriptionList::~SubscriptionList ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|~SubscriptionList| |fullname|wil::details_abi::SubscriptionList::~SubscriptionList| |refcount|4| |length|43| |called|wil::details::FreeProcessHeap| |calling|wil::details::FeatureStateManager::~FeatureStateManager
wil::details_abi::FeatureStateData::~FeatureStateData| |paramcount|1| |address|18000f440| |sig|void __thiscall ~SubscriptionList(SubscriptionList * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SubscriptionList::~SubscriptionList +++ wil::details_abi::SubscriptionList::~SubscriptionList @@ -0,0 +1,19 @@ + +/* public: __cdecl wil::details_abi::SubscriptionList::~SubscriptionList(void) __ptr64 */ + +void __thiscall wil::details_abi::SubscriptionList::~SubscriptionList(SubscriptionList *this) + +{ + void *pvVar1; + + pvVar1 = *(void **)(this + 0x40); + *(undefined8 *)(this + 0x40) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); + } + /* WARNING: Could not recover jumptable at 0x00018000f464. Too many branches */ + /* WARNING: Treating indirect jump as call */ + DeleteCriticalSection(this); + return; +} + ``` ## wistd::unique_ptr::operator= ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|operator=| |fullname|wistd::unique_ptr::operator=| |refcount|4| |length|41| |called|wil::details::FreeProcessHeap| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RawUsageIndex::Swap| |paramcount|2| |address|18000f65c| |sig|unique_ptr * __thiscall operator=(unique_ptr * this, unique_ptr * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wistd::unique_ptr::operator= +++ wistd::unique_ptr::operator= @@ -0,0 +1,24 @@ + +/* public: class wistd::unique_ptr & __ptr64 __cdecl + wistd::unique_ptr::operator=(class + wistd::unique_ptr && __ptr64) __ptr64 */ + +unique_ptr * __thiscall +wistd::unique_ptr::operator= + (unique_ptr *this, + unique_ptr *param_1) + +{ + undefined8 uVar1; + void *pvVar2; + + uVar1 = *(undefined8 *)param_1; + *(undefined8 *)param_1 = 0; + pvVar2 = *(void **)this; + *(undefined8 *)this = uVar1; + if (pvVar2 != (void *)0x0) { + wil::details::FreeProcessHeap(pvVar2); + } + return this; +} + ``` ## ::operator() ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|operator()| |fullname|::operator()| |refcount|2| |length|84| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::_Log_Hr| |calling|wil::details::ScopeExitFn<_>::~ScopeExitFn<_>| |paramcount|1| |address|18000f69c| |sig|undefined __fastcall operator()(undefined8 * param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- ::operator() +++ ::operator() @@ -0,0 +1,23 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +void ::operator()(undefined8 *param_1) + +{ + longlong *plVar1; + int iVar2; + void *unaff_retaddr; + + plVar1 = *(longlong **)*param_1; + if (plVar1 != (longlong *)0x0) { + iVar2 = (**(code **)(*plVar1 + 0x20))(plVar1,-(ulonglong)(param_1[1] != 0) & param_1[1] + 0x80); + if (iVar2 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x4b9, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); + } + } + return; +} + ``` ## wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator() ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|operator()| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()| |refcount|3| |length|95| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|| |paramcount|6| |address|18000f910| |sig|bool __thiscall operator()(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, void * * param_1, __uint64 * param_2, void * * param_3, __uint64 * param_4, uint * param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator() +++ wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator() @@ -0,0 +1,25 @@ + +/* public: virtual bool __cdecl wistd::__function::__func,bool __cdecl(void * __ptr64,unsigned __int64,void * + __ptr64,unsigned __int64,unsigned int)>::operator()(void * __ptr64 && __ptr64,unsigned __int64 && + __ptr64,void * __ptr64 && __ptr64,unsigned __int64 && __ptr64,unsigned int && __ptr64) __ptr64 */ + +bool __thiscall +wistd::__function:: +__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> +::operator()(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> + *this,void **param_1,__uint64 *param_2,void **param_3,__uint64 *param_4,uint *param_5) + +{ + bool bVar1; + + if ((**(ulonglong **)(this + 0x10) <= **(ulonglong **)(this + 8)) && + (bVar1 = wil::details_abi::RawUsageIndex::RecordUsage + (*(RawUsageIndex **)(this + 0x18),*param_1,*param_2,*param_3,*param_4, + *param_5), !bVar1)) { + return false; + } + **(longlong **)(this + 8) = **(longlong **)(this + 8) + 1; + return true; +} + ``` ## wil::details_abi::ProcessLocalStorageData::Acquire ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Acquire| |fullname|wil::details_abi::ProcessLocalStorageData::Acquire| |refcount|2| |length|364| |called|
Expand for full list:
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW
StringCchPrintfW
__security_check_cookie
wil::details::GetLastErrorFailHr
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::TryGetPointerwil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire
| |calling|wil::details::FeatureStateManager::EnsureStateData| |paramcount|2| |address|18000ff4c| |sig|long __cdecl Acquire(char * param_1, ProcessLocalStorageData * * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorageData::Acquire +++ wil::details_abi::ProcessLocalStorageData::Acquire @@ -0,0 +1,94 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* public: static long __cdecl wil::details_abi::ProcessLocalStorageData::Acquire(char const * __ptr64,class + wil::details_abi::ProcessLocalStorageData * __ptr64 * + __ptr64) */ + +long __cdecl +wil::details_abi::ProcessLocalStorageData::Acquire + (char *param_1,ProcessLocalStorageData **param_2 + ) + +{ + DWORD DVar1; + long lVar2; + HANDLE pvVar3; + uint uVar4; + ulong uVar5; + int iVar6; + void *unaff_retaddr; + undefined1 auStack_278 [32]; + undefined4 local_258; + char *local_250; + longlong local_248; + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + local_240 [8]; + ProcessLocalStorageData *local_238 [2]; + WCHAR local_228 [264]; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_278; + *param_2 = (ProcessLocalStorageData *)0x0; + DVar1 = GetCurrentProcessId(); + local_258 = 0x130; + local_250 = param_1; + StringCchPrintfW((ushort *)local_228,0x104,(ushort *)L"Local\\SM0:%lu:%lu:%hs",(ulonglong)DVar1); + local_248 = 0; + iVar6 = 0x1f0001; + uVar5 = 0; + pvVar3 = CreateMutexExW((LPSECURITY_ATTRIBUTES)0x0,local_228,0,0x1f0001); + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)&local_248,pvVar3); + if (local_248 == 0) { + lVar2 = details::GetLastErrorFailHr(); + goto LAB_180010066; + } + mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> + ::acquire((mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> + *)&local_248,(ulong *)local_240,uVar5,iVar6); + local_238[0] = (ProcessLocalStorageData *)0x0; + lVar2 = SemaphoreValue::TryGetPointer((ushort *)local_228,local_238); + if (lVar2 < 0) { + uVar4 = 299; +LAB_180010022: + details::in1diag3::Return_Hr(unaff_retaddr,uVar4,"wil",lVar2); + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + (local_240); + } + else { + if (local_238[0] == (ProcessLocalStorageData *)0x0) { + lVar2 = MakeAndInitialize((ushort *)local_228, + (unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> + *)&local_248,param_2); + if (lVar2 < 0) { + uVar4 = 0x134; + goto LAB_180010022; + } + } + else { + *param_2 = local_238[0]; + *(int *)*param_2 = *(int *)local_238[0] + 1; + } + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + (local_240); + lVar2 = 0; + } +LAB_180010066: + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *)&local_248); + return lVar2; +} + ``` ## wil::details_abi::UsageIndexProperty::Compare ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Compare| |fullname|wil::details_abi::UsageIndexProperty::Compare| |refcount|5| |length|44| |called|memcmp| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|1800104d8| |sig|int __thiscall Compare(UsageIndexProperty * this, void * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexProperty::Compare +++ wil::details_abi::UsageIndexProperty::Compare @@ -0,0 +1,20 @@ + +/* public: int __cdecl wil::details_abi::UsageIndexProperty::Compare(void * __ptr64,unsigned + __int64)const __ptr64 */ + +int __thiscall +wil::details_abi::UsageIndexProperty::Compare + (UsageIndexProperty *this,void *param_1,__uint64 param_2) + +{ + int iVar1; + + if (param_2 == *(ushort *)(this + 8)) { + iVar1 = memcmp(param_1,*(void **)(this + 0x18),param_2); + } + else { + iVar1 = (int)param_2 - (uint)*(ushort *)(this + 8); + } + return iVar1; +} + ``` ## wil::details::DestroyThreadPoolTimer::Destroy ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Destroy| |fullname|wil::details::DestroyThreadPoolTimer::Destroy| |refcount|3| |length|64| |called|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolTimerCallbacks| |calling|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|1800107a4| |sig|void __cdecl Destroy(_TP_TIMER * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::DestroyThreadPoolTimer::Destroy +++ wil::details::DestroyThreadPoolTimer::Destroy @@ -0,0 +1,17 @@ + +/* public: static void __cdecl wil::details::DestroyThreadPoolTimer::Destroy(struct _TP_TIMER * __ptr64) */ + +void __cdecl +wil::details::DestroyThreadPoolTimer::Destroy + (_TP_TIMER *param_1) + +{ + SetThreadpoolTimer(param_1,(PFILETIME)0x0,0,0); + WaitForThreadpoolTimerCallbacks(param_1,1); + /* WARNING: Could not recover jumptable at 0x0001800107dd. Too many branches */ + /* WARNING: Treating indirect jump as call */ + CloseThreadpoolTimer(param_1); + return; +} + ``` ## wil::details::EnsureCoalescedTimer_SetTimer ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureCoalescedTimer_SetTimer| |fullname|wil::details::EnsureCoalescedTimer_SetTimer| |refcount|4| |length|65| |called|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage| |paramcount|3| |address|1800108b4| |sig|void __cdecl EnsureCoalescedTimer_SetTimer(unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> * param_1, bool * param_2, __int64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnsureCoalescedTimer_SetTimer +++ wil::details::EnsureCoalescedTimer_SetTimer @@ -0,0 +1,26 @@ + +/* void __cdecl wil::details::EnsureCoalescedTimer_SetTimer(class wil::unique_any_t::Destroy(struct _TP_TIMER * __ptr64),struct + wistd::integral_constant,struct _TP_TIMER * __ptr64,struct _TP_TIMER * + __ptr64,0,std::nullptr_t> > > & __ptr64,bool & __ptr64,__int64) */ + +void __cdecl +wil::details::EnsureCoalescedTimer_SetTimer + (unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> + *param_1,bool *param_2,__int64 param_3) + +{ + _FILETIME local_res8 [4]; + + if (*(PTP_TIMER *)param_1 != (PTP_TIMER)0x0) { + local_res8[0] = (_FILETIME)(param_3 * -10000); + SetThreadpoolTimer(*(PTP_TIMER *)param_1,local_res8,0, + (uint)((ulonglong)param_3 >> 2) & 0x3fffffff); + *param_2 = true; + } + return; +} + ``` ## wil::details::FeatureStateManager::EnsureStateData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureStateData| |fullname|wil::details::FeatureStateManager::EnsureStateData| |refcount|4| |length|193| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|1| |address|1800108fc| |sig|bool __thiscall EnsureStateData(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::EnsureStateData +++ wil::details::FeatureStateManager::EnsureStateData @@ -0,0 +1,43 @@ + +/* private: bool __cdecl wil::details::FeatureStateManager::EnsureStateData(void) __ptr64 */ + +bool __thiscall wil::details::FeatureStateManager::EnsureStateData(FeatureStateManager *this) + +{ + long lVar1; + ulonglong uVar2; + ProcessLocalStorageData *local_res8; + last_error_context local_res10 [8]; + + if (*(longlong *)(this + 0x18) == 0) { + last_error_context::last_error_context(local_res10); + if (*(longlong *)(this + 0x18) == 0) { + if (*(longlong *)(this + 0x10) == 0) { + local_res8 = (ProcessLocalStorageData *)0x0; + lVar1 = details_abi::ProcessLocalStorageData:: + Acquire(*(char **)(this + 8),&local_res8); + if ((-1 < lVar1) && (*(longlong *)(this + 0x10) == 0)) { + *(ProcessLocalStorageData **)(this + 0x10) = + local_res8; + } + } + uVar2 = -(ulonglong)(*(longlong *)(this + 0x10) != 0) & *(longlong *)(this + 0x10) + 0x20U; + } + else { + uVar2 = 0; + } + AcquireSRWLockExclusive((PSRWLOCK)(this + 0x20)); + if (*(longlong *)(this + 0x18) == 0) { + *(ulonglong *)(this + 0x18) = uVar2; + } + local_res8 = (ProcessLocalStorageData *)(this + 0x20); + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + last_error_context::~last_error_context(local_res10); + } + return *(longlong *)(this + 0x18) != 0; +} + ``` ## wil::details::EnsureSubscribedToFeatureConfigurationChanges ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |refcount|3| |length|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0| |address|1800109c4| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges @@ -0,0 +1,16 @@ + +/* unsigned int __cdecl wil::details::EnsureSubscribedToFeatureConfigurationChanges(void) */ + +uint __cdecl wil::details::EnsureSubscribedToFeatureConfigurationChanges(void) + +{ + uint uVar1; + + uVar1 = DAT_1800355d4; + if (DAT_1800355d4 == 0) { + uVar1 = EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl + ((EnabledStateManager *)&g_enabledStateManager); + } + return uVar1; +} + ``` ## wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChangesImpl| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |refcount|2| |length|150| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |paramcount|1| |address|1800109ec| |sig|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl +++ wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl @@ -0,0 +1,54 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* private: unsigned int __cdecl + wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl(void) + __ptr64 */ + +uint __thiscall +wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl + (EnabledStateManager *this) + +{ + EnabledStateManager *SRWLock; + EnabledStateManager *pEVar1; + code *pcVar2; + uint uVar3; + EnabledStateManager *local_res8; + + if (*this == (EnabledStateManager)0x0) { + uVar3 = 0; + } + else { + SRWLock = this + 8; + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + pEVar1 = this + 0x20; + local_res8 = SRWLock; + if (*(longlong *)pEVar1 == 0) { + *(longlong *)pEVar1 = 0; + pcVar2 = g_wil_details_internalSubscribeFeatureStateChangeNotification; + if ((g_wil_details_internalSubscribeFeatureStateChangeNotification != (code *)0x0) || + (pcVar2 = g_wil_details_apiSubscribeFeatureStateChangeNotification, + g_wil_details_apiSubscribeFeatureStateChangeNotification != (code *)0x0)) { + (*pcVar2)(pEVar1,::,this); + } + if (*(longlong *)pEVar1 == 0) { + uVar3 = 0; + } + else { + uVar3 = 1; + *(undefined4 *)(this + 0x1c) = 1; + } + } + else { + uVar3 = *(uint *)(this + 0x1c); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + } + return uVar3; +} + ``` ## wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureSubscribedToProcessWideUsageFlushUnderLock| |fullname|wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock| |refcount|2| |length|115| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock| |calling|wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|1| |address|180010a8c| |sig|void __thiscall EnsureSubscribedToProcessWideUsageFlushUnderLock(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock +++ wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock @@ -0,0 +1,32 @@ + +/* private: void __cdecl + wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock(void) __ptr64 + */ + +void __thiscall +wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock + (FeatureStateManager *this) + +{ + FeatureStateManager *pFVar1; + PSRWLOCK SRWLock; + PSRWLOCK local_res8; + + pFVar1 = this + 0xe0; + if ((*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)pFVar1 == (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0 + ) && (SRWLock = *(PSRWLOCK *)(this + 0x18), SRWLock != (PSRWLOCK)0x0)) { + *(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)pFVar1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0; + AcquireSRWLockExclusive(SRWLock); + local_res8 = SRWLock; + details_abi::SubscriptionList::SubscribeUnderLock + ((SubscriptionList *)(SRWLock + 0x19),(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)pFVar1, + ::,this); + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + } + return; +} + ``` ## wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnsureSubscribedToUsageFlush| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush| |refcount|2| |length|127| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::ReportUsageToServiceDirect| |paramcount|2| |address|180010b08| |sig|void __thiscall EnsureSubscribedToUsageFlush(EnabledStateManager * this, _func_void_void_ptr * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush +++ wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush @@ -0,0 +1,39 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* public: void __cdecl wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush(void + (__cdecl*)(void * __ptr64)) __ptr64 */ + +void __thiscall +wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush + (EnabledStateManager *this,_func_void_void_ptr *param_1) + +{ + EnabledStateManager *SRWLock; + EnabledStateManager *pEVar1; + code *pcVar2; + EnabledStateManager *local_res8; + + if (*this != (EnabledStateManager)0x0) { + SRWLock = this + 8; + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + pEVar1 = this + 0x28; + local_res8 = SRWLock; + if (*(longlong *)pEVar1 == 0) { + *(longlong *)pEVar1 = 0; + pcVar2 = g_wil_details_internalSubscribeFeatureStateChangeNotification; + if ((g_wil_details_internalSubscribeFeatureStateChangeNotification != (code *)0x0) || + (pcVar2 = g_wil_details_apiSubscribeFeatureStateChangeNotification, + g_wil_details_apiSubscribeFeatureStateChangeNotification != (code *)0x0)) { + (*pcVar2)(pEVar1,param_1,0xffffffffffffffff); + } + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + } + return; +} + ``` ## wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|FindInsertionPointOrIncrement| |fullname|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement| |refcount|2| |length|367| |called|wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|6| |address|180010bd8| |sig|uchar * __thiscall FindInsertionPointOrIncrement(RawUsageIndex * this, UsageIndexProperty * param_1, uchar * param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement +++ wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement @@ -0,0 +1,87 @@ + +/* private: unsigned char * __ptr64 __cdecl + wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement(struct + wil::details_abi::UsageIndexProperty & __ptr64,unsigned char * __ptr64,void * __ptr64,unsigned + __int64,unsigned int) __ptr64 */ + +uchar * __thiscall +wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement + (RawUsageIndex *this,UsageIndexProperty *param_1,uchar *param_2,void *param_3, + __uint64 param_4,uint param_5) + +{ + undefined1 auVar1 [16]; + undefined1 auVar2 [16]; + bool bVar3; + int iVar4; + uchar *puVar5; + uint uVar6; + uint uVar7; + uchar *local_res8; + undefined2 local_48; + RawUsageIndex local_46; + int local_44; + undefined2 local_40; + undefined8 local_38; + undefined8 uStack_30; + + local_48 = *(undefined2 *)(this + 6); + uVar6 = 0; + iVar4 = -1; + local_46 = this[8]; + local_44 = 0; + local_40 = 0; + local_38 = 0; + uStack_30 = 0; + if (*(longlong *)(this + 0x10) == 0) { + uVar7 = uVar6; + if (*(int *)(param_1 + 4) == 0) { + return param_2; + } + while (local_res8 = param_2, + bVar3 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_48,&local_res8,*(uchar **)(this + 0x20)), + bVar3) { + iVar4 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_48,param_3,param_4); + if (iVar4 < 1) goto LAB_180010d15; + uVar7 = uVar7 + 1; + param_2 = local_res8; + if (*(uint *)(param_1 + 4) <= uVar7) { + return local_res8; + } + } + UsageIndexProperty::UpdateCount(param_1,uVar7); + } + else { + auVar1._8_8_ = 0; + auVar1._0_8_ = *(ulonglong *)(this + 0x10); + auVar2._8_8_ = 0; + auVar2._0_8_ = *(longlong *)(this + 0x20) - (longlong)param_2; + if (SUB168(auVar2 / auVar1,0) < (ulonglong)*(uint *)(param_1 + 4)) { + UsageIndexProperty::UpdateCount(param_1,SUB164(auVar2 / auVar1,0)); + } + puVar5 = param_2 + (ulonglong)*(uint *)(param_1 + 4) * *(longlong *)(this + 0x10); + param_2 = LowerBound(this,param_2,(ulonglong)*(uint *)(param_1 + 4),param_3,param_4); + if (puVar5 <= param_2) { + return param_2; + } + local_res8 = param_2; + UsageIndexProperty::Read((UsageIndexProperty *)&local_48,&local_res8,*(uchar **)(this + 0x20)); + iVar4 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_48,param_3,param_4); + } +LAB_180010d15: + if (iVar4 != 0) { + return param_2; + } + if (local_46 == (RawUsageIndex)0x0) { + if (this[0x38] == (RawUsageIndex)0x0) goto LAB_180010d41; + } + else { + UsageIndexProperty::UpdateCount((UsageIndexProperty *)&local_48,local_44 + param_5); + } + uVar6 = 1; +LAB_180010d41: + this[0x38] = SUB41(uVar6,0); + return (uchar *)0x0; +} + ``` ## wil::details::FeatureStateManager::FlushUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|FlushUsage| |fullname|wil::details::FeatureStateManager::FlushUsage| |refcount|3| |length|62| |called|wil::ProcessShutdownInProgress
wil::details::FeatureStateManager::EnsureStateData
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled| |calling|::
wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|1| |address|1800110b8| |sig|void __thiscall FlushUsage(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::FlushUsage +++ wil::details::FeatureStateManager::FlushUsage @@ -0,0 +1,20 @@ + +/* public: void __cdecl wil::details::FeatureStateManager::FlushUsage(void) __ptr64 */ + +void __thiscall wil::details::FeatureStateManager::FlushUsage(FeatureStateManager *this) + +{ + bool bVar1; + + bVar1 = ProcessShutdownInProgress(); + if (!bVar1) { + bVar1 = EnsureStateData(this); + if (bVar1) { + details_abi::SubscriptionList::OnSignaled + ((SubscriptionList *)(*(srwlock **)(this + 0x18) + 200),*(srwlock **)(this + 0x18)); + details_abi::FeatureStateData::RecordUsage(*(FeatureStateData **)(this + 0x18)); + } + } + return; +} + ``` ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|293| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|1800112f8| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,82 @@ + +/* WARNING: Removing unreachable block (ram,0x00018001134a) */ +/* WARNING: Removing unreachable block (ram,0x000180011350) */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + FeatureImpl *this_00; + uint uVar4; + uint *in_RDX; + bool bVar5; + uint local_res10 [2]; + undefined *local_res18 [2]; + undefined4 local_38; + undefined4 local_34; + FeatureImpl *local_30; + + in_RDX[0] = 0; + in_RDX[1] = 0; + uVar3 = *(uint *)this; + *in_RDX = uVar3; + if (((byte)uVar3 & 6) == 6) { + return; + } + this_00 = this; + uVar2 = EnsureSubscribedToFeatureConfigurationChanges(); + GetCurrentFeatureEnabledState(this_00,(int *)local_res10); + uVar3 = *in_RDX; + do { + uVar1 = uVar3; + *in_RDX = uVar1; + uVar4 = uVar1; + if ((uVar1 & 4) == 0) { + uVar4 = uVar1 & 0xfffffbff | local_res10[0] & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + uVar3 = *(uint *)this; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *(uint *)this = uVar4; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + if (((uVar1 & 4) != 0) || + (g_enabledStateManager == (shutdown_aware_object)0x0)) + goto LAB_1800113f6; + AcquireSRWLockExclusive((PSRWLOCK)&DAT_1800355c0); + local_res18[0] = &DAT_1800355c0; + if ((uVar2 == 0) || (uVar2 != DAT_1800355d4)) { +LAB_1800113e9: + LOCK(); + *(uint *)this = *(uint *)this & 0xfffffffb; + UNLOCK(); + } + else { + local_34 = 0; + local_38 = 3; + local_30 = this; + bVar5 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_180035608,&local_38,0x10); + if (!bVar5) goto LAB_1800113e9; + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_res18); +LAB_1800113f6: + if ((*in_RDX & 2) == 0) { + *in_RDX = *in_RDX & 0xfffff63e | local_res10[0] & 0x9c1; + } + return; +} + ``` ## wil::details::FeatureImpl::GetCurrentFeatureEnabledState ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |refcount|2| |length|195| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |paramcount|2| |address|180012044| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState @@ -0,0 +1,52 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ + +int * __thiscall +wil::details::FeatureImpl:: +GetCurrentFeatureEnabledState + (FeatureImpl *this,int *param_1) + +{ + uint uVar1; + bool bVar2; + uint uVar3; + code *pcVar4; + uint uVar5; + + pcVar4 = g_wil_details_internalGetFeatureEnabledState; + if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && + (pcVar4 = g_wil_details_apiGetFeatureEnabledState, + g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { + uVar3 = 0; + } + else { + uVar3 = (*pcVar4)(0x38ae72c,3); + } + param_1[0] = 0; + param_1[1] = 0; + uVar1 = (((uVar3 & 3) << 2 | uVar3 & 0x40) << 2 | uVar3 & 0x80) * 8; + *param_1 = uVar1; + if ((uVar3 & 0xffffff3f) == 0) { + uVar5 = 0x40; + } + else { + uVar5 = 0; + if ((uVar3 & 0xffffff3f) == 2) { + uVar5 = 0x40; + } + } + bVar2 = false; + uVar3 = 1; + if (((uVar1 & 0xc00) == 0xc00) || (uVar5 != 0)) { + bVar2 = true; + } + if ((uVar5 == 0) || (!bVar2)) { + uVar3 = 0; + } + *param_1 = uVar5 | uVar1 | uVar3; + return param_1; +} + ``` ## ClipboardServer::GetEnterpriseIdOfContentInternal ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|GetEnterpriseIdOfContentInternal| |fullname|ClipboardServer::GetEnterpriseIdOfContentInternal| |refcount|3| |length|15| |called|EDPPolicyManager::GetEnterpriseIdFromDataPackage| |calling|ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState| |paramcount|2| |address|1800121f8| |sig|long __thiscall GetEnterpriseIdOfContentInternal(ClipboardServer * this, ushort * * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- ClipboardServer::GetEnterpriseIdOfContentInternal +++ ClipboardServer::GetEnterpriseIdOfContentInternal @@ -0,0 +1,15 @@ + +/* private: long __cdecl ClipboardServer::GetEnterpriseIdOfContentInternal(unsigned short * __ptr64 + * __ptr64) __ptr64 */ + +long __thiscall +ClipboardServer::GetEnterpriseIdOfContentInternal(ClipboardServer *this,ushort **param_1) + +{ + long lVar1; + + lVar1 = EDPPolicyManager::GetEnterpriseIdFromDataPackage + ((EDPPolicyManager *)this,*(DataPackageViewMUX **)(this + 200),param_1); + return lVar1; +} + ``` ## wil::details_abi::UsageIndexProperty::GetSize ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|GetSize| |fullname|wil::details_abi::UsageIndexProperty::GetSize| |refcount|3| |length|44| |called|| |calling|wil::details_abi::RawUsageIndex::RawUsageIndex
wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|1| |address|180012790| |sig|__uint64 __thiscall GetSize(UsageIndexProperty * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexProperty::GetSize +++ wil::details_abi::UsageIndexProperty::GetSize @@ -0,0 +1,24 @@ + +/* public: unsigned __int64 __cdecl wil::details_abi::UsageIndexProperty::GetSize(void)const __ptr64 + */ + +__uint64 __thiscall wil::details_abi::UsageIndexProperty::GetSize(UsageIndexProperty *this) + +{ + ulonglong uVar1; + + if (*(short *)this == 0) { + uVar1 = (ulonglong)*(ushort *)(this + 8) + 2; + } + else { + uVar1 = (ulonglong)*(ushort *)this; + } + if (this[2] == (UsageIndexProperty)0x1) { + return uVar1 + 2; + } + if (this[2] == (UsageIndexProperty)0x2) { + uVar1 = uVar1 + 4; + } + return uVar1; +} + ``` ## wil::details::IsFeatureConfigured ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|IsFeatureConfigured| |fullname|wil::details::IsFeatureConfigured| |refcount|2| |length|307| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back
wil_RtlStagingConfig_QueryFeatureState| |calling|wil::details::WilApiImpl_GetFeatureEnabledState| |paramcount|5| |address|180013048| |sig|bool __cdecl IsFeatureConfigured(wil_FeatureState * param_1, uint param_2, bool param_3, wil_FeatureStore param_4, int * param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::IsFeatureConfigured +++ wil::details::IsFeatureConfigured @@ -0,0 +1,77 @@ + +/* bool __cdecl wil::details::IsFeatureConfigured(struct wil_FeatureState * __ptr64,unsigned + int,bool,enum wil_FeatureStore,int * __ptr64) */ + +bool __cdecl +wil::details::IsFeatureConfigured + (wil_FeatureState *param_1,uint param_2,bool param_3,wil_FeatureStore param_4,int *param_5 + ) + +{ + uint uVar1; + bool bVar2; + int iVar3; + uint uVar4; + wil_details_FeatureStateCache *pwVar5; + bool bVar6; + uint local_res20 [2]; + undefined *local_38; + undefined4 local_30; + undefined4 local_2c; + wil_details_FeatureStateCache *local_28; + + pwVar5 = &`bool___cdecl_wil::details::IsFeatureConfigured(struct_wil_FeatureState*___ptr64,unsigned_int,bool,enum_wil_FeatureStore,int*___ptr64)' + ::__l2::machineStoreProbe; + if (param_4 != 0) { + pwVar5 = &`bool___cdecl_wil::details::IsFeatureConfigured(struct_wil_FeatureState*___ptr64,unsigned_int,bool,enum_wil_FeatureStore,int*___ptr64)' + ::__l2::userStoreProbe; + } + if ((*(uint *)pwVar5 & 2) != 0) { + if ((*(uint *)pwVar5 & 1) == 0) { + return false; + } + *param_5 = 1; + iVar3 = wil_RtlStagingConfig_QueryFeatureState + ((uint *)param_1,param_2,(uint)param_3,(uint *)0x0); + return iVar3 != 0; + } + uVar4 = EnsureSubscribedToFeatureConfigurationChanges(); + local_res20[0] = 0; + *param_5 = 1; + iVar3 = wil_RtlStagingConfig_QueryFeatureState((uint *)param_1,param_2,(uint)param_3,local_res20); + bVar6 = iVar3 != 0; + LOCK(); + uVar1 = *(uint *)pwVar5; + *(uint *)pwVar5 = (local_res20[0] != 0) + 6; + UNLOCK(); + if (local_res20[0] != 0) { + return bVar6; + } + if ((uVar1 & 4) != 0) { + return bVar6; + } + if (g_enabledStateManager == (shutdown_aware_object)0x0) + { + return bVar6; + } + AcquireSRWLockExclusive((PSRWLOCK)&DAT_1800355c0); + local_38 = &DAT_1800355c0; + if ((uVar4 != 0) && (uVar4 == DAT_1800355d4)) { + local_2c = 0; + local_30 = 0; + local_28 = pwVar5; + bVar2 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_180035608,&local_30,0x10); + if (bVar2) goto LAB_18001315b; + } + LOCK(); + *(uint *)pwVar5 = *(uint *)pwVar5 & 0xfffff7c1; + UNLOCK(); +LAB_18001315b: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_38); + return bVar6; +} + ``` ## wil::details_abi::RawUsageIndex::Iterate ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Iterate| |fullname|wil::details_abi::RawUsageIndex::Iterate| |refcount|2| |length|306| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details_abi::UsageIndexProperty::Read
wistd::__throw_bad_function_call
wistd::function::~function| |calling|wil::details_abi::RecordWnfUsageIndex| |paramcount|2| |address|1800132b8| |sig|bool __thiscall Iterate(RawUsageIndex * this, function param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::Iterate +++ wil::details_abi::RawUsageIndex::Iterate @@ -0,0 +1,96 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* public: bool __cdecl wil::details_abi::RawUsageIndex::Iterate(class wistd::function)const + __ptr64 */ + +bool __thiscall +wil::details_abi::RawUsageIndex::Iterate + (RawUsageIndex *this, + function + *param_2) + +{ + longlong *plVar1; + char cVar2; + bool bVar3; + uint uVar4; + undefined4 local_res8 [2]; + function + *local_res10; + uchar *local_res18; + ulonglong local_res20; + undefined8 local_88; + ulonglong local_80; + undefined8 local_78; + undefined2 local_70; + RawUsageIndex local_6e; + uint local_6c; + ushort local_68; + undefined8 local_60; + undefined8 uStack_58; + undefined2 local_50; + RawUsageIndex local_4e; + undefined4 local_4c; + ushort local_48; + undefined8 local_40; + undefined8 uStack_38; + + local_res18 = (uchar *)(*(longlong *)(this + 0x18) + 10); + local_6e = this[4]; + local_70 = *(undefined2 *)(this + 2); + local_6c = 0; + local_68 = 0; + local_60 = 0; + uStack_58 = 0; + local_4e = this[8]; + local_50 = *(undefined2 *)(this + 6); + local_4c = 0; + local_48 = 0; + local_40 = 0; + uStack_38 = 0; + local_res10 = param_2; + do { + do { + bVar3 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_70,&local_res18,*(uchar **)(this + 0x20)); + if (!bVar3) { + wistd:: + function + :: + ~function + (param_2); + return true; + } + uVar4 = 0; + } while (local_6c == 0); + do { + bVar3 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_50,&local_res18,*(uchar **)(this + 0x20)); + if (!bVar3) break; + local_res8[0] = local_4c; + local_res20 = (ulonglong)local_48; + local_88 = uStack_38; + local_80 = (ulonglong)local_68; + local_78 = uStack_58; + plVar1 = *(longlong **)(param_2 + 0x70); + if (plVar1 == (longlong *)0x0) { + /* WARNING: Subroutine does not return */ + wistd::__throw_bad_function_call(); + } + cVar2 = (**(code **)(*plVar1 + 0x20)) + (plVar1,&local_78,&local_80,&local_88,&local_res20,local_res8); + if (cVar2 == '\0') { + wistd:: + function + :: + ~function + (param_2); + return false; + } + uVar4 = uVar4 + 1; + } while (uVar4 < local_6c); + } while( true ); +} + ``` ## wil::details_abi::RawUsageIndex::LowerBound ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|LowerBound| |fullname|wil::details_abi::RawUsageIndex::LowerBound| |refcount|2| |length|197| |called|wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::Read| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement| |paramcount|5| |address|1800136fc| |sig|uchar * __thiscall LowerBound(RawUsageIndex * this, uchar * param_1, __uint64 param_2, void * param_3, __uint64 param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::LowerBound +++ wil::details_abi::RawUsageIndex::LowerBound @@ -0,0 +1,38 @@ + +/* private: unsigned char * __ptr64 __cdecl wil::details_abi::RawUsageIndex::LowerBound(unsigned + char * __ptr64,unsigned __int64,void * __ptr64,unsigned __int64) __ptr64 */ + +uchar * __thiscall +wil::details_abi::RawUsageIndex::LowerBound + (RawUsageIndex *this,uchar *param_1,__uint64 param_2,void *param_3,__uint64 param_4) + +{ + ulonglong uVar1; + int iVar2; + uchar *local_res8; + undefined2 local_38; + RawUsageIndex local_36; + undefined4 local_34; + undefined2 local_30; + undefined8 local_28; + undefined8 uStack_20; + + local_38 = *(undefined2 *)(this + 6); + local_36 = this[8]; + local_34 = 0; + local_30 = 0; + local_28 = 0; + uStack_20 = 0; + while (uVar1 = param_2, uVar1 != 0) { + param_2 = uVar1 >> 1; + local_res8 = param_1 + param_2 * *(longlong *)(this + 0x10); + UsageIndexProperty::Read((UsageIndexProperty *)&local_38,&local_res8,*(uchar **)(this + 0x20)); + iVar2 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_38,param_3,param_4); + if (0 < iVar2) { + param_1 = local_res8; + param_2 = uVar1 + (-1 - param_2); + } + } + return param_1; +} + ``` ## wil::details_abi::ProcessLocalStorageData::MakeAndInitialize ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|MakeAndInitialize| |fullname|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |refcount|2| |length|234| |called|wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::details::in1diag3::Return_Hr
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue
wistd::__throw_bad_function_call| |calling|wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3| |address|1800137c8| |sig|long __cdecl MakeAndInitialize(ushort * param_1, unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> * param_2, ProcessLocalStorageData * * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorageData::MakeAndInitialize +++ wil::details_abi::ProcessLocalStorageData::MakeAndInitialize @@ -0,0 +1,57 @@ + +/* private: static long __cdecl wil::details_abi::ProcessLocalStorageData::MakeAndInitialize(unsigned short const * __ptr64,class + wil::unique_any_t,void * __ptr64,void * __ptr64,0,std::nullptr_t> >,struct wil::err_returncode_policy> > + && __ptr64,class wil::details_abi::ProcessLocalStorageData * __ptr64 * __ptr64) */ + +long __cdecl +wil::details_abi::ProcessLocalStorageData:: +MakeAndInitialize(ushort *param_1, + unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> + *param_2,ProcessLocalStorageData + **param_3) + +{ + long lVar1; + ProcessLocalStorageData *this; + ProcessLocalStorageData **ppPVar2; + void *unaff_retaddr; + undefined8 local_18; + undefined8 uStack_10; + + *param_3 = (ProcessLocalStorageData *)0x0; + ppPVar2 = param_3; + this = details::ProcessHeapAlloc(8,0x130); + if (this == (ProcessLocalStorageData *)0x0) { + lVar1 = -0x7ff8fff2; + details::in1diag3::Return_Hr(unaff_retaddr,0x148,"wil",-0x7ff8fff2); + } + else { + local_18 = 0; + uStack_10 = 0; + if (((ulonglong)this & 3) != 0) { + /* WARNING: Subroutine does not return */ + wistd::__throw_bad_function_call(); + } + lVar1 = SemaphoreValue::CreateFromValueInternal + ((SemaphoreValue *)&local_18,param_1,SUB81(ppPVar2,0),(ulonglong)this >> 2); + if (lVar1 < 0) { + details::in1diag3::Return_Hr(unaff_retaddr,0x14b,"wil",lVar1); + SemaphoreValue::~SemaphoreValue((SemaphoreValue *)&local_18); + details::FreeProcessHeap(this); + } + else { + ProcessLocalStorageData + (this,param_2,(SemaphoreValue *)&local_18); + *param_3 = this; + SemaphoreValue::~SemaphoreValue((SemaphoreValue *)&local_18); + lVar1 = 0; + } + } + return lVar1; +} + ``` ## wil::details_abi::SubscriptionList::OnSignaled ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|OnSignaled| |fullname|wil::details_abi::SubscriptionList::OnSignaled| |refcount|4| |length|254| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|::
::
wil::details::FeatureStateManager::FlushUsage| |paramcount|2| |address|180014374| |sig|void __thiscall OnSignaled(SubscriptionList * this, srwlock * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SubscriptionList::OnSignaled +++ wil::details_abi::SubscriptionList::OnSignaled @@ -0,0 +1,73 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* public: void __cdecl wil::details_abi::SubscriptionList::OnSignaled(class wil::srwlock & __ptr64) + __ptr64 */ + +void __thiscall +wil::details_abi::SubscriptionList::OnSignaled(SubscriptionList *this,srwlock *param_1) + +{ + undefined8 *puVar1; + longlong *plVar2; + ulonglong uVar3; + ulonglong uVar4; + ulonglong uVar5; + code *pcVar6; + undefined8 uVar7; + srwlock *local_res8; + SubscriptionList *local_res10; + + AcquireSRWLockShared((PSRWLOCK)param_1); + uVar5 = (ulonglong)(*(longlong *)(this + 0x30) - *(longlong *)(this + 0x28)) >> 4; + local_res8 = param_1; + details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + uVar3 = 0; + local_res8 = param_1; + local_res10 = this; + if (uVar5 != 0) { + do { + pcVar6 = (code *)0x0; + uVar7 = 0; + EnterCriticalSection((LPCRITICAL_SECTION)this); + AcquireSRWLockExclusive((PSRWLOCK)param_1); + if (uVar3 < uVar5) { + plVar2 = (longlong *)(uVar3 * 0x10 + *(longlong *)(this + 0x28)); + uVar4 = uVar3; + do { + uVar3 = uVar4 + 1; + if (*plVar2 != 0) { + puVar1 = (undefined8 *)(*(longlong *)(this + 0x28) + uVar4 * 0x10); + pcVar6 = (code *)*puVar1; + uVar7 = puVar1[1]; + break; + } + plVar2 = plVar2 + 2; + uVar4 = uVar3; + } while (uVar3 < uVar5); + } + details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + if (pcVar6 != (code *)0x0) { + (*pcVar6)(uVar7); + } + details:: + unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + *)&local_res10); + } while (uVar3 < uVar5); + } + return; +} + ``` ## wil::details::EnabledStateManager::OnStateChange ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|OnStateChange| |fullname|wil::details::EnabledStateManager::OnStateChange| |refcount|2| |length|132| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|| |paramcount|1| |address|18001447c| |sig|void __thiscall OnStateChange(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::OnStateChange +++ wil::details::EnabledStateManager::OnStateChange @@ -0,0 +1,35 @@ + +/* public: void __cdecl wil::details::EnabledStateManager::OnStateChange(void) __ptr64 */ + +void __thiscall wil::details::EnabledStateManager::OnStateChange(EnabledStateManager *this) + +{ + int *piVar1; + int iVar2; + int *piVar3; + EnabledStateManager *local_res8; + + if (*this != (EnabledStateManager)0x0) { + AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); + piVar1 = *(int **)(this + 0x58); + for (piVar3 = *(int **)(this + 0x50); piVar3 != piVar1; piVar3 = piVar3 + 4) { + LOCK(); + **(uint **)(piVar3 + 2) = **(uint **)(piVar3 + 2) & (-(uint)(*piVar3 != 0) & 0x83a) - 0x83f; + UNLOCK(); + } + *(undefined8 *)(this + 0x58) = *(undefined8 *)(this + 0x50); + iVar2 = 1; + if (*(int *)(this + 0x1c) + 1 != 0) { + iVar2 = *(int *)(this + 0x1c) + 1; + } + *(int *)(this + 0x1c) = iVar2; + local_res8 = this + 8; + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + } + return; +} + ``` ## wil::details_abi::FeatureStateData::ProcessShutdown ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ProcessShutdown| |fullname|wil::details_abi::FeatureStateData::ProcessShutdown| |refcount|3| |length|66| |called|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock
wil::details_abi::UsageIndexes::Record
wil::details_abi::UsageIndexes::UsageIndexes
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details_abi::FeatureStateData::~FeatureStateData
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|1800145bc| |sig|void __thiscall ProcessShutdown(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::FeatureStateData::ProcessShutdown +++ wil::details_abi::FeatureStateData::ProcessShutdown @@ -0,0 +1,15 @@ + +/* public: void __cdecl wil::details_abi::FeatureStateData::ProcessShutdown(void) __ptr64 */ + +void __thiscall wil::details_abi::FeatureStateData::ProcessShutdown(FeatureStateData *this) + +{ + UsageIndexes local_c8 [192]; + + UsageIndexes::UsageIndexes(local_c8); + RetrieveUsageUnderLock(this,local_c8); + UsageIndexes::Record(local_c8); + UsageIndexes::~UsageIndexes(local_c8); + return; +} + ``` ## wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|QueueBackgroundSRUMUsageReporting| |fullname|wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting| |refcount|2| |length|256| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
__security_check_cookie
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|4| |address|180014a0c| |sig|void __thiscall QueueBackgroundSRUMUsageReporting(FeatureStateManager * this, uint param_1, ushort param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting +++ wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting @@ -0,0 +1,61 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* public: void __cdecl + wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting(unsigned int,unsigned + short,unsigned int) __ptr64 */ + +void __thiscall +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting + (FeatureStateManager *this,uint param_1,ushort param_2,uint param_3) + +{ + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *this_00; + bool bVar1; + PTP_TIMER p_Var2; + undefined1 auStack_88 [32]; + last_error_context local_68 [8]; + FeatureStateManager *local_60; + uint local_58; + ushort local_54; + undefined2 local_52; + uint local_50; + ulonglong local_48; + + local_48 = __security_cookie ^ (ulonglong)auStack_88; + if (*this != (FeatureStateManager)0x0) { + bVar1 = ProcessShutdownInProgress(); + if (!bVar1) { + AcquireSRWLockExclusive((PSRWLOCK)(this + 0x28)); + local_52 = 0; + local_60 = this + 0x28; + local_58 = param_1; + local_54 = param_2; + local_50 = param_3; + details_abi::heap_buffer::push_back((heap_buffer *)(this + 0xe8),&local_58,0xc); + this_00 = (unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x38); + if (this[0x40] == (FeatureStateManager)0x0) { + if (*(longlong *)this_00 == 0) { + last_error_context::last_error_context(local_68); + p_Var2 = CreateThreadpoolTimer + (::,this + ,(PTP_CALLBACK_ENVIRON)0x0); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset(this_00,p_Var2); + last_error_context::~last_error_context(local_68); + } + EnsureCoalescedTimer_SetTimer + ((unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> + *)this_00,(bool *)(this + 0x40),5000); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_60); + } + } + return; +} + ``` ## wil::details::EnabledStateManager::QueueBackgroundUsageReporting ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|QueueBackgroundUsageReporting| |fullname|wil::details::EnabledStateManager::QueueBackgroundUsageReporting| |refcount|2| |length|218| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::ReportUsageToServiceDirect| |paramcount|3| |address|180014b14| |sig|void __thiscall QueueBackgroundUsageReporting(EnabledStateManager * this, uint param_1, wil_details_FeatureReportingCache * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::QueueBackgroundUsageReporting +++ wil::details::EnabledStateManager::QueueBackgroundUsageReporting @@ -0,0 +1,52 @@ + +/* public: void __cdecl wil::details::EnabledStateManager::QueueBackgroundUsageReporting(unsigned + int,struct wil_details_FeatureReportingCache * __ptr64) __ptr64 */ + +void __thiscall +wil::details::EnabledStateManager::QueueBackgroundUsageReporting + (EnabledStateManager *this,uint param_1,wil_details_FeatureReportingCache *param_2) + +{ + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *this_00; + bool bVar1; + PTP_TIMER p_Var2; + last_error_context local_res8 [8]; + EnabledStateManager *local_res20; + undefined8 local_18; + wil_details_FeatureReportingCache *local_10; + + if (*this != (EnabledStateManager)0x0) { + bVar1 = ProcessShutdownInProgress(); + if (!bVar1) { + AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); + local_18 = 0x38ae72c; + local_res20 = this + 8; + local_10 = param_2; + details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x30),&local_18,0x10); + this_00 = (unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x10); + if (this[0x18] == (EnabledStateManager)0x0) { + if (*(longlong *)this_00 == 0) { + last_error_context::last_error_context(local_res8); + p_Var2 = CreateThreadpoolTimer + (::,this + ,(PTP_CALLBACK_ENVIRON)0x0); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset(this_00,p_Var2); + last_error_context::~last_error_context(local_res8); + } + EnsureCoalescedTimer_SetTimer + ((unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> + *)this_00,(bool *)(this + 0x18),300000); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res20); + } + } + return; +} + ``` ## wil::details_abi::UsageIndexProperty::Read ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Read| |fullname|wil::details_abi::UsageIndexProperty::Read| |refcount|8| |length|248| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues| |paramcount|3| |address|180014c14| |sig|bool __thiscall Read(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexProperty::Read +++ wil::details_abi::UsageIndexProperty::Read @@ -0,0 +1,53 @@ + +/* public: bool __cdecl wil::details_abi::UsageIndexProperty::Read(unsigned char * __ptr64 & + __ptr64,unsigned char * __ptr64) __ptr64 */ + +bool __thiscall +wil::details_abi::UsageIndexProperty::Read(UsageIndexProperty *this,uchar **param_1,uchar *param_2) + +{ + UsageIndexProperty *_Dst; + uchar *_Src; + uchar *puVar1; + ushort local_res8 [4]; + + puVar1 = *param_1; + if (this[2] == (UsageIndexProperty)0x1) { + _Src = puVar1 + 2; + if (param_2 < _Src) { + return false; + } + *(uchar **)(this + 0x10) = puVar1; + local_res8[0] = 0; + memcpy_s(local_res8,2,puVar1,2); + *(uint *)(this + 4) = (uint)local_res8[0]; + } + else { + _Src = puVar1; + if (this[2] == (UsageIndexProperty)0x2) { + _Src = puVar1 + 4; + if (param_2 < _Src) { + return false; + } + *(uchar **)(this + 0x10) = puVar1; + memcpy_s(this + 4,4,puVar1,4); + } + } + _Dst = this + 8; + *(ushort *)_Dst = *(ushort *)this; + puVar1 = _Src; + if (*(ushort *)this == 0) { + puVar1 = _Src + 2; + if (param_2 < puVar1) { + return false; + } + memcpy_s(_Dst,2,_Src,2); + } + if (param_2 < puVar1 + *(ushort *)_Dst) { + return false; + } + *(uchar **)(this + 0x18) = puVar1; + *param_1 = puVar1 + *(ushort *)_Dst; + return true; +} + ``` ## wil::details_abi::UsageIndexes::Record ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Record| |fullname|wil::details_abi::UsageIndexes::Record| |refcount|3| |length|262| |called|__security_check_cookie
wil::details_abi::RecordWnfUsageIndex| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage| |paramcount|1| |address|180014d14| |sig|void __thiscall Record(UsageIndexes * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexes::Record +++ wil::details_abi::UsageIndexes::Record @@ -0,0 +1,41 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* public: void __cdecl wil::details_abi::UsageIndexes::Record(void) __ptr64 */ + +void __thiscall wil::details_abi::UsageIndexes::Record(UsageIndexes *this) + +{ + undefined1 auStack_68 [32]; + undefined8 local_48; + undefined8 local_40; + undefined8 local_38; + undefined8 local_30; + undefined8 local_28; + undefined8 local_20; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_68; + if (this[0x38] != (UsageIndexes)0x0) { + local_48 = 0x418a073aa3bc1c75; + local_40 = 0x418a073aa3bc2475; + local_38 = 0x418a073aa3bc2c75; + RecordWnfUsageIndex((__WIL__WNF_STATE_NAME *)&local_48,3,(RawUsageIndex *)this); + } + if (this[0x78] != (UsageIndexes)0x0) { + local_48 = 0x418a073aa3bc3475; + local_40 = 0x418a073aa3bc3c75; + local_38 = 0x418a073aa3bc4475; + RecordWnfUsageIndex((__WIL__WNF_STATE_NAME *)&local_48,3,(RawUsageIndex *)(this + 0x40)); + } + if (this[0xb8] != (UsageIndexes)0x0) { + local_48 = 0x418a073aa3bc4c75; + local_40 = 0x418a073aa3bc5475; + local_38 = 0x418a073aa3bc5c75; + local_30 = 0x418a073aa3bc6475; + local_28 = 0x418a073aa3bc6c75; + local_20 = 0x418a073aa3bc7475; + RecordWnfUsageIndex((__WIL__WNF_STATE_NAME *)&local_48,6,(RawUsageIndex *)(this + 0x80)); + } + return; +} + ``` ## wil::details::EnabledStateManager::RecordCachedUsageUnderLock ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordCachedUsageUnderLock| |fullname|wil::details::EnabledStateManager::RecordCachedUsageUnderLock| |refcount|4| |length|100| |called|wil::details::WilApi_RecordFeatureUsage
wil_details_RecordCachedUsage| |calling|wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|180014e24| |sig|void __thiscall RecordCachedUsageUnderLock(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::RecordCachedUsageUnderLock +++ wil::details::EnabledStateManager::RecordCachedUsageUnderLock @@ -0,0 +1,24 @@ + +/* private: void __cdecl wil::details::EnabledStateManager::RecordCachedUsageUnderLock(void) __ptr64 + */ + +void __thiscall +wil::details::EnabledStateManager::RecordCachedUsageUnderLock(EnabledStateManager *this) + +{ + undefined4 *puVar1; + undefined4 *puVar2; + char *in_R9; + + puVar1 = *(undefined4 **)(this + 0x38); + puVar2 = *(undefined4 **)(this + 0x30); + if (0xf < (ulonglong)((longlong)puVar1 - (longlong)puVar2)) { + for (; puVar2 != puVar1; puVar2 = puVar2 + 4) { + wil_details_RecordCachedUsage(*puVar2,*(uint **)(puVar2 + 2)); + } + *(undefined8 *)(this + 0x38) = *(undefined8 *)(this + 0x30); + WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); + } + return; +} + ``` ## wil::details_abi::FeatureStateData::RecordFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordFeatureUsage| |fullname|wil::details_abi::FeatureStateData::RecordFeatureUsage| |refcount|2| |length|191| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage| |calling|wil::details::FeatureStateManager::RecordFeatureUsage| |paramcount|4| |address|180014e90| |sig|bool __thiscall RecordFeatureUsage(FeatureStateData * this, uint param_1, wil_details_ServiceReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::FeatureStateData::RecordFeatureUsage +++ wil::details_abi::FeatureStateData::RecordFeatureUsage @@ -0,0 +1,47 @@ + +/* public: bool __cdecl wil::details_abi::FeatureStateData::RecordFeatureUsage(unsigned int,enum + wil_details_ServiceReportingKind,unsigned __int64) __ptr64 */ + +bool __thiscall +wil::details_abi::FeatureStateData::RecordFeatureUsage + (FeatureStateData *this,uint param_1,wil_details_ServiceReportingKind param_2, + __uint64 param_3) + +{ + FeatureStateData FVar1; + uint uVar2; + FeatureStateData *local_18 [2]; + + if (param_2 == 0xfe) { + RecordUsage(this); + FVar1 = (FeatureStateData)0x1; + } + else if ((param_2 < 200) || ((0xff < (int)param_2 && (param_2 < 0x200)))) { + uVar2 = (uint)param_3; + AcquireSRWLockExclusive((PSRWLOCK)this); + local_18[0] = this; + if (((param_2 < 8) && ((0xccU >> (param_2 & 0x1f) & 1) != 0)) || (param_2 - 0x100 < 0x80)) { + UsageIndex::RecordUsage + ((UsageIndex *)(this + 8), + param_2,param_1,uVar2); + FVar1 = this[0x40]; + } + else { + FVar1 = (FeatureStateData) + UsageIndex::RecordUsage + ((UsageIndex *) + (this + 0x48),param_2,param_1,(uint)param_3); + } + details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_18); + } + else { + FVar1 = (FeatureStateData)0x0; + } + return (bool)FVar1; +} + ``` ## wil::details::FeatureStateManager::RecordFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordFeatureUsage| |fullname|wil::details::FeatureStateManager::RecordFeatureUsage| |refcount|2| |length|233| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::FeatureStateManager::EnsureStateData
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|4| |address|180014f58| |sig|void __thiscall RecordFeatureUsage(FeatureStateManager * this, uint param_1, wil_details_ServiceReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::RecordFeatureUsage +++ wil::details::FeatureStateManager::RecordFeatureUsage @@ -0,0 +1,57 @@ + +/* public: void __cdecl wil::details::FeatureStateManager::RecordFeatureUsage(unsigned int,enum + wil_details_ServiceReportingKind,unsigned __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureStateManager::RecordFeatureUsage + (FeatureStateManager *this,uint param_1,wil_details_ServiceReportingKind param_2, + __uint64 param_3) + +{ + FeatureStateManager *SRWLock; + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *this_00; + bool bVar1; + PTP_TIMER p_Var2; + last_error_context local_res8 [8]; + FeatureStateManager *local_18 [2]; + + if (*this != (FeatureStateManager)0x0) { + bVar1 = EnsureStateData(this); + if (bVar1) { + bVar1 = details_abi::FeatureStateData::RecordFeatureUsage + (*(FeatureStateData **)(this + 0x18),param_1,param_2,param_3); + if (bVar1) { + bVar1 = ProcessShutdownInProgress(); + if (!bVar1) { + SRWLock = this + 0x20; + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + this_00 = (unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)(this + 0x30); + local_18[0] = SRWLock; + if (this[0x41] == (FeatureStateManager)0x0) { + if (*(longlong *)this_00 == 0) { + last_error_context::last_error_context(local_res8); + p_Var2 = CreateThreadpoolTimer + (::, + this,(PTP_CALLBACK_ENVIRON)0x0); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset(this_00,p_Var2); + last_error_context::~last_error_context(local_res8); + } + EnsureCoalescedTimer_SetTimer + ((unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> + *)this_00,(bool *)(this + 0x41),300000); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_18); + } + } + } + } + return; +} + ``` ## wil::details_abi::UsageIndex::RecordUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::UsageIndex::RecordUsage| |refcount|2| |length|46| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|4| |address|180015060| |sig|bool __thiscall RecordUsage(UsageIndex * this, wil_details_ServiceReportingKind param_1, uint param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndex::RecordUsage +++ wil::details_abi::UsageIndex::RecordUsage @@ -0,0 +1,20 @@ + +/* public: bool __cdecl wil::details_abi::UsageIndex::RecordUsage(enum wil_details_ServiceReportingKind,unsigned int,unsigned int) __ptr64 */ + +bool __thiscall +wil::details_abi::UsageIndex::RecordUsage + (UsageIndex *this, + wil_details_ServiceReportingKind param_1,uint param_2,uint param_3) + +{ + bool bVar1; + wil_details_ServiceReportingKind local_res10 [2]; + uint local_res18 [4]; + + local_res10[0] = param_1; + local_res18[0] = param_2; + bVar1 = RawUsageIndex::RecordUsage((RawUsageIndex *)this,local_res10,4,local_res18,4,param_3); + return bVar1; +} + ``` ## wil::details_abi::UsageIndex::RecordUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::UsageIndex::RecordUsage| |refcount|2| |length|49| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|4| |address|180015098| |sig|bool __thiscall RecordUsage(UsageIndex * this, wil_details_ServiceReportingKind param_1, uint param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndex::RecordUsage +++ wil::details_abi::UsageIndex::RecordUsage @@ -0,0 +1,20 @@ + +/* public: bool __cdecl wil::details_abi::UsageIndex::RecordUsage(enum wil_details_ServiceReportingKind,unsigned int,unsigned int) __ptr64 */ + +bool __thiscall +wil::details_abi::UsageIndex::RecordUsage + (UsageIndex *this, + wil_details_ServiceReportingKind param_1,uint param_2,uint param_3) + +{ + bool bVar1; + wil_details_ServiceReportingKind local_res10 [2]; + uint local_res18 [4]; + + local_res10[0] = param_1; + local_res18[0] = param_2; + bVar1 = RawUsageIndex::RecordUsage((RawUsageIndex *)this,local_res10,4,local_res18,4,1); + return bVar1; +} + ``` ## wil::details_abi::FeatureStateData::RecordUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::FeatureStateData::RecordUsage| |refcount|3| |length|102| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::RetrieveUsageUnderLock
wil::details_abi::UsageIndexes::Record
wil::details_abi::UsageIndexes::UsageIndexes
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details::FeatureStateManager::FlushUsage
wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|1| |address|1800150d0| |sig|void __thiscall RecordUsage(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::FeatureStateData::RecordUsage +++ wil::details_abi::FeatureStateData::RecordUsage @@ -0,0 +1,24 @@ + +/* public: void __cdecl wil::details_abi::FeatureStateData::RecordUsage(void) __ptr64 */ + +void __thiscall wil::details_abi::FeatureStateData::RecordUsage(FeatureStateData *this) + +{ + FeatureStateData *local_res8 [4]; + UsageIndexes local_c8 [192]; + + UsageIndexes::UsageIndexes(local_c8); + AcquireSRWLockExclusive((PSRWLOCK)this); + local_res8[0] = this; + RetrieveUsageUnderLock(this,local_c8); + details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_res8); + UsageIndexes::Record(local_c8); + UsageIndexes::~UsageIndexes(local_c8); + return; +} + ``` ## wil::details_abi::RawUsageIndex::RecordUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::RawUsageIndex::RecordUsage| |refcount|4| |length|252| |called|wil::details::FreeProcessHeap
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SetBuffer
wil::details_abi::heap_buffer::ensure
wistd::unique_ptr::operator=| |calling|wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()| |paramcount|6| |address|180015140| |sig|bool __thiscall RecordUsage(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::RecordUsage +++ wil::details_abi::RawUsageIndex::RecordUsage @@ -0,0 +1,48 @@ + +/* public: bool __cdecl wil::details_abi::RawUsageIndex::RecordUsage(void * __ptr64,unsigned + __int64,void * __ptr64,unsigned __int64,unsigned int) __ptr64 */ + +bool __thiscall +wil::details_abi::RawUsageIndex::RecordUsage + (RawUsageIndex *this,void *param_1,__uint64 param_2,void *param_3,__uint64 param_4, + uint param_5) + +{ + bool bVar1; + __uint64 _Var2; + void *local_38; + undefined8 uStack_30; + longlong local_28; + void *pvStack_20; + + bVar1 = RecordUsageInternal(this,param_1,param_2,param_3,param_4,param_5); + if (bVar1) { + bVar1 = true; + } + else { + _Var2 = param_4 + 0x20 + param_2; + if (*(longlong *)(this + 0x18) == 0) { + local_38 = (void *)0x0; + uStack_30 = 0; + local_28 = 0; + pvStack_20 = (void *)0x0; + bVar1 = heap_buffer::ensure((heap_buffer *)&local_38,_Var2 + 10); + if (bVar1) { + SetBuffer(this,local_38,0,local_28 - (longlong)local_38); + wistd::unique_ptr::operator= + ((unique_ptr *)(this + 0x30), + (unique_ptr *)&pvStack_20); + this[0x3a] = (RawUsageIndex)0x1; + } + if (pvStack_20 != (void *)0x0) { + details::FreeProcessHeap(pvStack_20); + } + } + else if (this[0x3a] != (RawUsageIndex)0x0) { + heap_buffer::ensure((heap_buffer *)(this + 0x18),_Var2); + } + bVar1 = RecordUsageInternal(this,param_1,param_2,param_3,param_4,param_5); + } + return bVar1; +} + ``` ## wil::details_abi::RawUsageIndex::RecordUsageInternal ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordUsageInternal| |fullname|wil::details_abi::RawUsageIndex::RecordUsageInternal| |refcount|3| |length|506| |called|MSVCRT.DLL::memmove_s
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::GetSize
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write| |calling|wil::details_abi::RawUsageIndex::RecordUsage| |paramcount|6| |address|180015244| |sig|bool __thiscall RecordUsageInternal(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::RecordUsageInternal +++ wil::details_abi::RawUsageIndex::RecordUsageInternal @@ -0,0 +1,109 @@ + +/* WARNING: Removing unreachable block (ram,0x0001800153ee) */ +/* private: bool __cdecl wil::details_abi::RawUsageIndex::RecordUsageInternal(void * + __ptr64,unsigned __int64,void * __ptr64,unsigned __int64,unsigned int) __ptr64 */ + +bool __thiscall +wil::details_abi::RawUsageIndex::RecordUsageInternal + (RawUsageIndex *this,void *param_1,__uint64 param_2,void *param_3,__uint64 param_4, + uint param_5) + +{ + ulonglong uVar1; + ulonglong uVar2; + ulonglong uVar3; + longlong lVar4; + bool bVar5; + bool bVar6; + int iVar7; + __uint64 _Var8; + __uint64 _Var9; + uchar *puVar10; + uchar *local_res8; + undefined2 local_68; + RawUsageIndex local_66; + int local_64; + undefined2 local_60; + undefined8 local_58; + void *pvStack_50; + undefined2 local_48; + RawUsageIndex local_46; + uint local_44; + undefined2 local_40; + undefined8 local_38; + void *local_30; + + if (*(longlong *)(this + 0x18) != 0) { + local_68 = *(undefined2 *)(this + 2); + puVar10 = (uchar *)(*(longlong *)(this + 0x18) + 10); + local_66 = this[4]; + bVar5 = false; + local_64 = 0; + local_60 = 0; + local_58 = 0; + pvStack_50 = (void *)0x0; + while (local_res8 = puVar10, + bVar6 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_68,&local_res8,*(uchar **)(this + 0x20)), + bVar6) { + iVar7 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_68,param_1,param_2); + if (iVar7 < 0) goto LAB_1800152fc; + if (iVar7 == 0) { + puVar10 = FindInsertionPointOrIncrement + (this,(UsageIndexProperty *)&local_68,local_res8,param_3,param_4,param_5 + ); + if (puVar10 == (uchar *)0x0) { + return true; + } + bVar5 = true; + goto LAB_1800152fc; + } + puVar10 = SkipValues(this,(UsageIndexProperty *)&local_68,local_res8); + } + bVar5 = false; + *(uchar **)(this + 0x20) = local_res8; + puVar10 = local_res8; +LAB_1800152fc: + local_res8 = puVar10; + puVar10 = local_res8; + _Var8 = 0; + if (!bVar5) { + local_58 = 0; + local_64 = 1; + local_60 = (undefined2)param_2; + pvStack_50 = param_1; + _Var8 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_68); + } + local_48 = *(undefined2 *)(this + 6); + local_38 = 0; + local_46 = this[8]; + local_44 = param_5; + local_40 = (undefined2)param_4; + local_30 = param_3; + _Var9 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_48); + uVar2 = *(ulonglong *)(this + 0x28); + uVar3 = *(ulonglong *)(this + 0x20); + uVar1 = _Var8 + _Var9; + if (uVar1 <= (-(ulonglong)(uVar3 < uVar2) & uVar2 - uVar3)) { + memmove_s(puVar10 + uVar1,(uVar2 - uVar1) - (longlong)puVar10,puVar10, + uVar3 - (longlong)puVar10); + lVar4 = *(longlong *)(this + 0x20); + *(uchar **)(this + 0x20) = (uchar *)(lVar4 + uVar1); + if (bVar5) { + if (local_66 != (RawUsageIndex)0x0) { + UsageIndexProperty::UpdateCount((UsageIndexProperty *)&local_68,local_64 + 1); + } + } + else { + UsageIndexProperty::Write + ((UsageIndexProperty *)&local_68,&local_res8,(uchar *)(lVar4 + uVar1)); + } + UsageIndexProperty::Write + ((UsageIndexProperty *)&local_48,&local_res8,*(uchar **)(this + 0x20)); + this[0x38] = (RawUsageIndex)0x1; + return true; + } + } + return false; +} + ``` ## wil::details_abi::RecordWnfUsageIndex ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RecordWnfUsageIndex| |fullname|wil::details_abi::RecordWnfUsageIndex| |refcount|4| |length|501| |called|__chkstk
__security_check_cookie
wil::details::FreeProcessHeap
wil::details::NtStatusToHr
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::RawUsageIndex
wil::details_abi::RawUsageIndex::SetBuffer
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData| |calling|wil::details_abi::UsageIndexes::Record| |paramcount|3| |address|180015448| |sig|void __cdecl RecordWnfUsageIndex(__WIL__WNF_STATE_NAME * param_1, __uint64 param_2, RawUsageIndex * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RecordWnfUsageIndex +++ wil::details_abi::RecordWnfUsageIndex @@ -0,0 +1,129 @@ + +/* WARNING: Function: __chkstk replaced with injection: alloca_probe */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* void __cdecl wil::details_abi::RecordWnfUsageIndex(struct __WIL__WNF_STATE_NAME const * + __ptr64,unsigned __int64,class wil::details_abi::RawUsageIndex const & __ptr64) */ + +void __cdecl +wil::details_abi::RecordWnfUsageIndex + (__WIL__WNF_STATE_NAME *param_1,__uint64 param_2,RawUsageIndex *param_3) + +{ + __WIL__WNF_STATE_NAME *p_Var1; + void *pvVar2; + bool bVar3; + __int64 _Var4; + ulonglong uVar5; + ulonglong uVar6; + ulonglong uVar7; + undefined8 in_R9; + undefined1 auStackY_1178 [32]; + undefined1 *puVar8; + uint *in_stack_ffffffffffffeeb0; + uint local_1138 [2]; + uint local_1130 [2]; + undefined8 local_1128; + undefined8 local_1120; + undefined8 *local_1118; + undefined8 *puStack_1110; + RawUsageIndex *local_1108; + RawUsageIndex local_10f8 [24]; + undefined8 local_10e0; + int local_10d8; + void *local_10c8; + char local_10c0; + char local_10bf; + undefined1 local_10b8 [8]; + undefined **local_10b0; + undefined8 local_10a8; + undefined8 uStack_10a0; + RawUsageIndex *local_1098; + undefined ***local_1048; + undefined1 local_1038 [4096]; + ulonglong local_38; + undefined8 uStack_30; + + uStack_30 = 0x180015466; + local_38 = __security_cookie ^ (ulonglong)auStackY_1178; + p_Var1 = param_1 + param_2 * 8; + uVar6 = 0; + local_1120 = 0; + do { + uVar7 = (ulonglong)*(ushort *)(param_3 + 2); + uVar5 = (ulonglong)*(ushort *)param_3; + RawUsageIndex::RawUsageIndex + (local_10f8,*(ushort *)param_3,*(ushort *)(param_3 + 2), + (CountSize)CONCAT71((int7)((ulonglong)in_R9 >> 8),param_3[4]), + *(ushort *)(param_3 + 6), + (CountSize)CONCAT71((int7)((ulonglong)in_stack_ffffffffffffeeb0 >> 8),param_3[8])); + local_1138[0] = 0; + local_1130[0] = 0x1000; + in_stack_ffffffffffffeeb0 = local_1130; + puVar8 = local_1038; + _Var4 = wil_details_NtQueryWnfStateData + (param_1,uVar5,uVar7,local_1138,puVar8,in_stack_ffffffffffffeeb0); + details::NtStatusToHr((long)_Var4); + if ((long)_Var4 != 0) { + local_1130[0] = 0; + local_1138[0] = 0; + } + in_R9 = 0x1000; + RawUsageIndex::SetBuffer(local_10f8,local_1038,(ulonglong)local_1130[0],0x1000); + pvVar2 = local_10c8; + if (local_10bf != '\0') { + local_10c8 = (void *)0x0; + if (pvVar2 != (void *)0x0) { + details::FreeProcessHeap(pvVar2); + } + return; + } + local_1128 = 0; + local_1118 = &local_1128; + puStack_1110 = &local_1120; + local_1108 = local_10f8; + local_10b0 = &wistd::__function:: + __func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> + ::_vftable_; + local_1048 = &local_10b0; + local_1098 = local_1108; + local_10a8 = local_1118; + uStack_10a0 = puStack_1110; + bVar3 = RawUsageIndex::Iterate(param_3,local_10b8); + if (local_10c0 == '\0') { +LAB_1800155ce: + param_1 = param_1 + 8; + local_1120 = local_1128; + } + else { + in_stack_ffffffffffffeeb0 = (uint *)(ulonglong)local_1138[0]; + _Var4 = wil_details_NtUpdateWnfStateData + (param_1,local_10e0,local_10d8 - (int)local_10e0,in_R9,puVar8,local_1138[0], + 1); + if ((int)_Var4 != -0x3fffffff) { + if ((int)_Var4 != 0) { + in_stack_ffffffffffffeeb0 = (uint *)0x0; + wil_details_NtUpdateWnfStateData + (param_1,local_10e0,local_10d8 - (int)local_10e0,in_R9,puVar8,0,0); + } + goto LAB_1800155ce; + } + uVar6 = uVar6 + 1; + bVar3 = false; + } + pvVar2 = local_10c8; + local_10c8 = (void *)0x0; + if (pvVar2 != (void *)0x0) { + details::FreeProcessHeap(pvVar2); + } + if (bVar3 != false) { + return; + } + if (p_Var1 <= param_1) { + return; + } + if (0x31 < uVar6) { + return; + } + } while( true ); +} + ``` ## wil::details_abi::ProcessLocalStorageData::Release ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Release| |fullname|wil::details_abi::ProcessLocalStorageData::Release| |refcount|2| |length|147| |called|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
wil::ProcessShutdownInProgress
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::Destroy
wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |calling|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |paramcount|1| |address|180015960| |sig|void __thiscall Release(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::ProcessLocalStorageData::Release +++ wil::details_abi::ProcessLocalStorageData::Release @@ -0,0 +1,47 @@ + +/* public: void __cdecl wil::details_abi::ProcessLocalStorageData::Release(void) __ptr64 */ + +void __thiscall +wil::details_abi::ProcessLocalStorageData::Release + (ProcessLocalStorageData *this) + +{ + bool bVar1; + HANDLE hHeap; + ulong in_R8D; + int in_R9D; + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + local_res10 [24]; + + bVar1 = ProcessShutdownInProgress(); + if (bVar1) { + *(int *)this = *(int *)this + -1; + if (*(int *)this == 0) { + FeatureStateData::ProcessShutdown((FeatureStateData *)(this + 0x20)); + return; + } + } + else { + mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> + ::acquire((mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> + *)(this + 8),(ulong *)local_res10,in_R8D,in_R9D); + *(int *)this = *(int *)this + -1; + if (*(int *)this == 0) { + SemaphoreValue::Destroy((SemaphoreValue *)(this + 0x10)); + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ::reset(local_res10,(void *)0x0); + ~ProcessLocalStorageData(this); + hHeap = GetProcessHeap(); + HeapFree(hHeap,0,this); + } + details:: + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + (local_res10); + } + return; +} + ``` ## wil::details::FeatureImpl::ReportUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl::ReportUsage| |refcount|2| |length|212| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|4| |address|180015f90| |sig|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::ReportUsage +++ wil::details::FeatureImpl::ReportUsage @@ -0,0 +1,49 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned + __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl::ReportUsage + (FeatureImpl *this,bool param_1, + ReportingKind param_2,__uint64 param_3) + +{ + wil_details_ServiceReportingKind wVar1; + int iVar2; + ulonglong *puVar3; + uint uVar4; + ulonglong uVar5; + undefined4 local_res8; + undefined2 local_resc; + undefined4 local_res18 [2]; + __uint64 local_res20; + uint in_stack_ffffffffffffffb0; + undefined1 in_stack_ffffffffffffffb8; + undefined7 in_stack_ffffffffffffffb9; + + local_res18[0] = CONCAT31(local_res18[0]._1_3_,(char)param_2); + uVar5 = (ulonglong)*(uint *)this; + local_res20 = param_3; + if ((*(uint *)this & 4) == 0) { + puVar3 = (ulonglong *)GetCachedFeatureEnabledState(this); + local_res20 = *puVar3; + uVar5 = local_res20 & 0xffffffff; + } + local_resc = 2; + local_res8 = 0; + local_res18[0] = 3; + uVar4 = (uint)param_1; + wVar1 = wil_details_MapReportingKind(3,uVar4); + iVar2 = ReportUsageToServiceDirect + ((wil_details_FeatureReportingCache *)(this + 8),uVar4,(uint)uVar5 >> 10 & 1, + (uint)(uVar5 >> 0xb) & 1,wVar1,in_stack_ffffffffffffffb0, + CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8),'\x02'); + if ((iVar2 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook)(0x38ae72c,&local_res8,0,param_1,local_res18,0,0,1); + } + return; +} + ``` ## wil::details::ReportUsageToServiceDirect ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ReportUsageToServiceDirect| |fullname|wil::details::ReportUsageToServiceDirect| |refcount|2| |length|315| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::WilApi_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil::details::FeatureImpl::ReportUsage| |paramcount|8| |address|18001606c| |sig|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::ReportUsageToServiceDirect +++ wil::details::ReportUsageToServiceDirect @@ -0,0 +1,72 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* int __cdecl wil::details::ReportUsageToServiceDirect(struct wil_details_FeatureReportingCache * + __ptr64,unsigned int,int,int,enum wil_details_ServiceReportingKind,unsigned int,unsigned + __int64,unsigned char) */ + +int __cdecl +wil::details::ReportUsageToServiceDirect + (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, + wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7,uchar param_8) + +{ + undefined8 uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint *puVar5; + wil_details_ServiceReportingKind wVar6; + int iVar8; + int iVar9; + undefined4 in_register_0000008c; + int local_28; + uint local_20 [6]; + wil_details_FeatureReportingCache *pwVar7; + + pwVar7 = param_1; + iVar9 = param_4; + puVar5 = wil_details_FeatureReporting_RecordUsageInCache + (local_20,(uint *)param_1,(ulonglong)param_5); + wVar6 = (wil_details_ServiceReportingKind)pwVar7; + iVar8 = 1; + uVar2 = *puVar5; + uVar3 = puVar5[1]; + uVar4 = puVar5[2]; + uVar1 = *(undefined8 *)(puVar5 + 4); + if ((g_wil_details_RecordSRUMFeatureUsage != (code *)0x0) && + ((param_5 == 0 || (param_5 - 100 < 0x32)))) { + wVar6 = param_5; + (*g_wil_details_RecordSRUMFeatureUsage)(0x38ae72c,param_5,1); + } + if (uVar2 != 0) { + EnabledStateManager::QueueBackgroundUsageReporting + ((EnabledStateManager *)&g_enabledStateManager,wVar6,param_1); + } + if (uVar3 != 0) { + WilApi_RecordFeatureUsage(0x38ae72c,uVar4,uVar3,(char *)CONCAT44(in_register_0000008c,iVar9)); + } + local_28 = (int)uVar1; + if (local_28 == 0) { + EnabledStateManager::EnsureSubscribedToUsageFlush + ((EnabledStateManager *)&g_enabledStateManager, + ::); + } + if (param_3 != 0) { + wVar6 = param_5 | 0x80000000; + if (param_4 == 0) { + wVar6 = param_5; + } + WilApi_RecordFeatureUsage(0x38ae72c,wVar6,0,(char *)CONCAT44(in_register_0000008c,iVar9)); + } + if (local_28 == 0) { + if (g_wil_details_realtimeFeatureUsageHook != (code *)0x0) { + (*g_wil_details_realtimeFeatureUsageHook)(0x38ae72c,param_5,param_8); + } + } + else { + iVar8 = 0; + } + return iVar8; +} + ``` ## wil::details_abi::FeatureStateData::RetrieveUsageUnderLock ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|RetrieveUsageUnderLock| |fullname|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock| |refcount|3| |length|95| |called|wil::details_abi::RawUsageIndex::Swap| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage| |paramcount|2| |address|1800167b4| |sig|void __thiscall RetrieveUsageUnderLock(FeatureStateData * this, UsageIndexes * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::FeatureStateData::RetrieveUsageUnderLock +++ wil::details_abi::FeatureStateData::RetrieveUsageUnderLock @@ -0,0 +1,21 @@ + +/* private: void __cdecl wil::details_abi::FeatureStateData::RetrieveUsageUnderLock(struct + wil::details_abi::UsageIndexes & __ptr64) __ptr64 */ + +void __thiscall +wil::details_abi::FeatureStateData::RetrieveUsageUnderLock + (FeatureStateData *this,UsageIndexes *param_1) + +{ + if (this[0x40] != (FeatureStateData)0x0) { + RawUsageIndex::Swap((RawUsageIndex *)param_1,(RawUsageIndex *)(this + 8)); + } + if (this[0x80] != (FeatureStateData)0x0) { + RawUsageIndex::Swap((RawUsageIndex *)(param_1 + 0x40),(RawUsageIndex *)(this + 0x48)); + } + if (this[0xc0] != (FeatureStateData)0x0) { + RawUsageIndex::Swap((RawUsageIndex *)(param_1 + 0x80),(RawUsageIndex *)(this + 0x88)); + } + return; +} + ``` ## wil::details_abi::RawUsageIndex::SetBuffer ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SetBuffer| |fullname|wil::details_abi::RawUsageIndex::SetBuffer| |refcount|3| |length|274| |called|wil::details::FreeProcessHeap
wil::details::in1diag3::_FailFast_Unexpected| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RecordWnfUsageIndex| |paramcount|4| |address|18001689c| |sig|void __thiscall SetBuffer(RawUsageIndex * this, void * param_1, __uint64 param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::SetBuffer +++ wil::details_abi::RawUsageIndex::SetBuffer @@ -0,0 +1,51 @@ + +/* public: void __cdecl wil::details_abi::RawUsageIndex::SetBuffer(void * __ptr64,unsigned + __int64,unsigned __int64) __ptr64 */ + +void __thiscall +wil::details_abi::RawUsageIndex::SetBuffer + (RawUsageIndex *this,void *param_1,__uint64 param_2,__uint64 param_3) + +{ + void *pvVar1; + RawUsageIndex RVar2; + void *unaff_retaddr; + + if (param_3 < 10) { + /* WARNING: Subroutine does not return */ + details::in1diag3::_FailFast_Unexpected + (unaff_retaddr,0x137b,"onecore\\internal\\sdk\\inc\\wil\\Staging.h"); + } + pvVar1 = *(void **)(this + 0x30); + *(undefined8 *)(this + 0x30) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); + } + *(void **)(this + 0x18) = param_1; + *(__uint64 *)(this + 0x20) = (longlong)param_1 + param_2; + *(__uint64 *)(this + 0x28) = (longlong)param_1 + param_3; + this[0x39] = (RawUsageIndex)0x0; + if (9 < param_2) { + if ((*(short *)param_1 != 0) || + (RVar2 = (RawUsageIndex)0x0, *(ushort *)this < *(ushort *)((longlong)param_1 + 2))) { + RVar2 = (RawUsageIndex)0x1; + } + this[0x39] = RVar2; + if ((((*(short *)param_1 == 0) && (*(ushort *)((longlong)param_1 + 2) == *(ushort *)this)) && + (*(short *)((longlong)param_1 + 4) == *(short *)(this + 2))) && + (((*(RawUsageIndex *)((longlong)param_1 + 8) == this[4] && + (*(short *)((longlong)param_1 + 6) == *(short *)(this + 6))) && + (*(RawUsageIndex *)((longlong)param_1 + 9) == this[8])))) { + return; + } + } + *(undefined2 *)param_1 = 0; + *(undefined2 *)((longlong)param_1 + 2) = *(undefined2 *)this; + *(undefined2 *)((longlong)param_1 + 4) = *(undefined2 *)(this + 2); + *(RawUsageIndex *)((longlong)param_1 + 8) = this[4]; + *(undefined2 *)((longlong)param_1 + 6) = *(undefined2 *)(this + 6); + *(RawUsageIndex *)((longlong)param_1 + 9) = this[8]; + *(longlong *)(this + 0x20) = *(longlong *)(this + 0x18) + 10; + return; +} + ``` ## wil::details_abi::RawUsageIndex::SkipValues ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SkipValues| |fullname|wil::details_abi::RawUsageIndex::SkipValues| |refcount|2| |length|198| |called|wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|180017618| |sig|uchar * __thiscall SkipValues(RawUsageIndex * this, UsageIndexProperty * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::SkipValues +++ wil::details_abi::RawUsageIndex::SkipValues @@ -0,0 +1,55 @@ + +/* private: unsigned char * __ptr64 __cdecl wil::details_abi::RawUsageIndex::SkipValues(struct + wil::details_abi::UsageIndexProperty & __ptr64,unsigned char * __ptr64) __ptr64 */ + +uchar * __thiscall +wil::details_abi::RawUsageIndex::SkipValues + (RawUsageIndex *this,UsageIndexProperty *param_1,uchar *param_2) + +{ + undefined1 auVar1 [16]; + undefined1 auVar2 [16]; + bool bVar3; + uchar *puVar4; + uint uVar5; + uchar *local_res18 [2]; + undefined2 local_38; + RawUsageIndex local_36; + undefined4 local_34; + undefined2 local_30; + undefined8 local_28; + undefined8 uStack_20; + + uVar5 = 0; + local_res18[0] = param_2; + if (*(longlong *)(this + 0x10) == 0) { + local_38 = *(undefined2 *)(this + 6); + local_36 = this[8]; + local_34 = 0; + local_30 = 0; + local_28 = 0; + uStack_20 = 0; + if (*(int *)(param_1 + 4) != 0) { + do { + bVar3 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_38,local_res18,*(uchar **)(this + 0x20)); + if (!bVar3) break; + uVar5 = uVar5 + 1; + } while (uVar5 < *(uint *)(param_1 + 4)); + } + puVar4 = local_res18[0]; + UsageIndexProperty::UpdateCount(param_1,uVar5); + } + else { + auVar1._8_8_ = 0; + auVar1._0_8_ = *(ulonglong *)(this + 0x10); + auVar2._8_8_ = 0; + auVar2._0_8_ = *(longlong *)(this + 0x20) - *(longlong *)(this + 0x18); + if (SUB168(auVar2 / auVar1,0) < (ulonglong)*(uint *)(param_1 + 4)) { + UsageIndexProperty::UpdateCount(param_1,SUB164(auVar2 / auVar1,0)); + } + puVar4 = param_2 + (ulonglong)*(uint *)(param_1 + 4) * *(longlong *)(this + 0x10); + } + return puVar4; +} + ``` ## wil::details::FeatureStateManager::SubscribeToEnabledStateChanges ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SubscribeToEnabledStateChanges| |fullname|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges| |refcount|2| |length|146| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock
wil_details_RtlRegisterFeatureConfigurationChangeNotification| |calling|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |paramcount|4| |address|1800195a4| |sig|void __thiscall SubscribeToEnabledStateChanges(FeatureStateManager * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::SubscribeToEnabledStateChanges +++ wil::details::FeatureStateManager::SubscribeToEnabledStateChanges @@ -0,0 +1,44 @@ + +/* public: void __cdecl wil::details::FeatureStateManager::SubscribeToEnabledStateChanges(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64 * __ptr64,void (__cdecl*)(void * __ptr64),void * + __ptr64) __ptr64 */ + +void __thiscall +wil::details::FeatureStateManager::SubscribeToEnabledStateChanges + (FeatureStateManager *this,FEATURE_STATE_CHANGE_SUBSCRIPTION__ **param_1, + _func_void_void_ptr *param_2,void *param_3) + +{ + FeatureStateManager *SRWLock; + FeatureStateManager *pFVar1; + __int64 _Var2; + _func_void_void_ptr *p_Var3; + FeatureStateManager *local_res8; + + *param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0; + if (*this == (FeatureStateManager)0x0) { + return; + } + SRWLock = this + 0x20; + p_Var3 = param_2; + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + pFVar1 = this + 0x90; + local_res8 = SRWLock; + if (*(longlong *)pFVar1 == 0) { + *(longlong *)pFVar1 = 0; + _Var2 = wil_details_RtlRegisterFeatureConfigurationChangeNotification + (::,this,p_Var3 + ,pFVar1); + if ((int)_Var2 != 0) goto LAB_180019619; + } + details_abi::SubscriptionList::SubscribeUnderLock + ((SubscriptionList *)(this + 0x48),param_1,param_2,param_3); +LAB_180019619: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + return; +} + ``` ## wil::details::FeatureStateManager::SubscribeToUsageFlush ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SubscribeToUsageFlush| |fullname|wil::details::FeatureStateManager::SubscribeToUsageFlush| |refcount|2| |length|162| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::ProcessShutdownInProgress
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock| |calling|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |paramcount|3| |address|180019744| |sig|void __thiscall SubscribeToUsageFlush(FeatureStateManager * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureStateManager::SubscribeToUsageFlush +++ wil::details::FeatureStateManager::SubscribeToUsageFlush @@ -0,0 +1,39 @@ + +/* public: void __cdecl wil::details::FeatureStateManager::SubscribeToUsageFlush(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64 * __ptr64,void (__cdecl*)(void * __ptr64)) __ptr64 + */ + +void __thiscall +wil::details::FeatureStateManager::SubscribeToUsageFlush + (FeatureStateManager *this,FEATURE_STATE_CHANGE_SUBSCRIPTION__ **param_1, + _func_void_void_ptr *param_2) + +{ + bool bVar1; + FeatureStateManager *local_res8; + + *param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0; + if (*this != (FeatureStateManager)0x0) { + bVar1 = ProcessShutdownInProgress(); + if (!bVar1) { + bVar1 = EnsureStateData(this); + if (bVar1) { + AcquireSRWLockExclusive((PSRWLOCK)(this + 0x20)); + local_res8 = this + 0x20; + EnsureSubscribedToProcessWideUsageFlushUnderLock(this); + details_abi::SubscriptionList::SubscribeUnderLock + ((SubscriptionList *)(this + 0x98),param_1,param_2,(void *)0x0); + if (*param_1 != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { + *param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)((ulonglong)*param_1 | 0x80000000); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + } + } + } + return; +} + ``` ## wil::details_abi::SubscriptionList::SubscribeUnderLock ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SubscribeUnderLock| |fullname|wil::details_abi::SubscriptionList::SubscribeUnderLock| |refcount|4| |length|145| |called|wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|4| |address|1800197f0| |sig|void __thiscall SubscribeUnderLock(SubscriptionList * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SubscriptionList::SubscribeUnderLock +++ wil::details_abi::SubscriptionList::SubscribeUnderLock @@ -0,0 +1,51 @@ + +/* public: void __cdecl wil::details_abi::SubscriptionList::SubscribeUnderLock(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64 * __ptr64,void (__cdecl*)(void * __ptr64),void * + __ptr64) __ptr64 */ + +void __thiscall +wil::details_abi::SubscriptionList::SubscribeUnderLock + (SubscriptionList *this,FEATURE_STATE_CHANGE_SUBSCRIPTION__ **param_1, + _func_void_void_ptr *param_2,void *param_3) + +{ + heap_buffer *this_00; + FEATURE_STATE_CHANGE_SUBSCRIPTION__ *pFVar1; + longlong *plVar2; + bool bVar3; + FEATURE_STATE_CHANGE_SUBSCRIPTION__ *pFVar4; + longlong *plVar5; + FEATURE_STATE_CHANGE_SUBSCRIPTION__ *pFVar6; + _func_void_void_ptr *local_18; + void *local_10; + + *param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0; + this_00 = (heap_buffer *)(this + 0x28); + plVar2 = *(longlong **)this_00; + pFVar4 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0; + pFVar6 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *) + ((ulonglong)(*(longlong *)(this + 0x30) - (longlong)plVar2) >> 4); + plVar5 = plVar2; + if (pFVar6 != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { + do { + pFVar1 = pFVar4 + 1; + if (*plVar5 == 0) { + plVar2[(longlong)pFVar4 * 2] = (longlong)param_2; + plVar2[(longlong)pFVar4 * 2 + 1] = (longlong)param_3; + *param_1 = pFVar1; + return; + } + pFVar4 = pFVar1; + plVar5 = plVar5 + 2; + } while (pFVar1 < pFVar6); + } + local_18 = param_2; + local_10 = param_3; + bVar3 = heap_buffer::push_back(this_00,&local_18,0x10); + if (bVar3) { + *param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *) + ((ulonglong)(*(longlong *)(this + 0x30) - *(longlong *)this_00) >> 4); + } + return; +} + ``` ## wil::details_abi::RawUsageIndex::Swap ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Swap| |fullname|wil::details_abi::RawUsageIndex::Swap| |refcount|4| |length|181| |called|wil::details::FreeProcessHeap
wistd::unique_ptr::operator=| |calling|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock| |paramcount|2| |address|180019888| |sig|void __thiscall Swap(RawUsageIndex * this, RawUsageIndex * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::RawUsageIndex::Swap +++ wil::details_abi::RawUsageIndex::Swap @@ -0,0 +1,45 @@ + +/* public: void __cdecl wil::details_abi::RawUsageIndex::Swap(class wil::details_abi::RawUsageIndex + & __ptr64) __ptr64 */ + +void __thiscall wil::details_abi::RawUsageIndex::Swap(RawUsageIndex *this,RawUsageIndex *param_1) + +{ + undefined8 uVar1; + RawUsageIndex RVar2; + undefined8 uVar3; + undefined8 uVar4; + undefined8 uVar5; + unique_ptr *this_00; + void *local_10; + + uVar3 = *(undefined8 *)(this + 0x18); + uVar4 = *(undefined8 *)(this + 0x20); + uVar1 = *(undefined8 *)(this + 0x28); + this_00 = (unique_ptr *)(this + 0x30); + local_10 = *(void **)this_00; + *(undefined8 *)this_00 = 0; + uVar5 = *(undefined8 *)(param_1 + 0x20); + *(undefined8 *)(this + 0x18) = *(undefined8 *)(param_1 + 0x18); + *(undefined8 *)(this + 0x20) = uVar5; + *(undefined8 *)(this + 0x28) = *(undefined8 *)(param_1 + 0x28); + wistd::unique_ptr::operator= + (this_00,(unique_ptr *)(param_1 + 0x30)); + *(undefined8 *)(param_1 + 0x18) = uVar3; + *(undefined8 *)(param_1 + 0x20) = uVar4; + *(undefined8 *)(param_1 + 0x28) = uVar1; + wistd::unique_ptr::operator= + ((unique_ptr *)(param_1 + 0x30), + (unique_ptr *)&local_10); + if (local_10 != (void *)0x0) { + details::FreeProcessHeap(local_10); + } + RVar2 = this[0x38]; + this[0x38] = param_1[0x38]; + param_1[0x38] = RVar2; + RVar2 = this[0x39]; + this[0x39] = param_1[0x39]; + param_1[0x39] = RVar2; + return; +} + ``` ## wil::details_abi::SubscriptionList::Unsubscribe ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Unsubscribe| |fullname|wil::details_abi::SubscriptionList::Unsubscribe| |refcount|3| |length|141| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::UnsubscribeProcessWideUsageFlush
wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification| |paramcount|3| |address|180019d30| |sig|void __thiscall Unsubscribe(SubscriptionList * this, srwlock * param_1, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::SubscriptionList::Unsubscribe +++ wil::details_abi::SubscriptionList::Unsubscribe @@ -0,0 +1,41 @@ + +/* public: void __cdecl wil::details_abi::SubscriptionList::Unsubscribe(class wil::srwlock & + __ptr64,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64) __ptr64 */ + +void __thiscall +wil::details_abi::SubscriptionList::Unsubscribe + (SubscriptionList *this,srwlock *param_1,FEATURE_STATE_CHANGE_SUBSCRIPTION__ *param_2) + +{ + undefined8 *puVar1; + srwlock *local_res18; + SubscriptionList *local_res20; + + if (param_2 != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { + EnterCriticalSection((LPCRITICAL_SECTION)this); + local_res20 = this; + AcquireSRWLockExclusive((PSRWLOCK)param_1); + if (param_2 + -1 < + (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *) + ((ulonglong)(*(longlong *)(this + 0x30) - *(longlong *)(this + 0x28)) >> 4)) { + puVar1 = (undefined8 *)(*(longlong *)(this + 0x28) + (longlong)(param_2 + -1) * 0x10); + *puVar1 = 0; + puVar1[1] = 0; + } + local_res18 = param_1; + details:: + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res18); + details:: + unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> + *)&local_res20); + } + return; +} + ``` ## wil::details::UnsubscribeProcessWideUsageFlush ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|UnsubscribeProcessWideUsageFlush| |fullname|wil::details::UnsubscribeProcessWideUsageFlush| |refcount|2| |length|41| |called|wil::details_abi::SubscriptionList::Unsubscribe| |calling|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|180019e58| |sig|void __cdecl UnsubscribeProcessWideUsageFlush(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::UnsubscribeProcessWideUsageFlush +++ wil::details::UnsubscribeProcessWideUsageFlush @@ -0,0 +1,16 @@ + +/* void __cdecl wil::details::UnsubscribeProcessWideUsageFlush(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64) */ + +void __cdecl +wil::details::UnsubscribeProcessWideUsageFlush(FEATURE_STATE_CHANGE_SUBSCRIPTION__ *param_1) + +{ + if ((param_1 != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) && (DAT_180035078 != (srwlock *)0x0)) + { + details_abi::SubscriptionList::Unsubscribe + ((SubscriptionList *)(DAT_180035078 + 200),DAT_180035078,param_1); + } + return; +} + ``` ## wil::details_abi::UsageIndexProperty::UpdateCount ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|UpdateCount| |fullname|wil::details_abi::UsageIndexProperty::UpdateCount| |refcount|7| |length|80| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues| |paramcount|2| |address|180019e88| |sig|void __thiscall UpdateCount(UsageIndexProperty * this, uint param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexProperty::UpdateCount +++ wil::details_abi::UsageIndexProperty::UpdateCount @@ -0,0 +1,33 @@ + +/* public: void __cdecl wil::details_abi::UsageIndexProperty::UpdateCount(unsigned int) __ptr64 */ + +void __thiscall +wil::details_abi::UsageIndexProperty::UpdateCount(UsageIndexProperty *this,uint param_1) + +{ + rsize_t _DstSize; + UsageIndexProperty *_Src; + rsize_t _MaxCount; + undefined2 local_res10 [12]; + + _Src = this + 4; + if (*(uint *)_Src != param_1) { + *(uint *)_Src = param_1; + if (this[2] == (UsageIndexProperty)0x1) { + _MaxCount = 2; + local_res10[0] = (undefined2)param_1; + _Src = (UsageIndexProperty *)local_res10; + _DstSize = 2; + } + else { + if (this[2] != (UsageIndexProperty)0x2) { + return; + } + _DstSize = 4; + _MaxCount = 4; + } + memcpy_s(*(void **)(this + 0x10),_DstSize,_Src,_MaxCount); + } + return; +} + ``` ## wil::details::WilApiImpl_GetFeatureEnabledState ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApiImpl_GetFeatureEnabledState| |fullname|wil::details::WilApiImpl_GetFeatureEnabledState| |refcount|3| |length|101| |called|wil::details::IsFeatureConfigured| |calling|| |paramcount|3| |address|18001a6e0| |sig|FEATURE_ENABLED_STATE __cdecl WilApiImpl_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApiImpl_GetFeatureEnabledState +++ wil::details::WilApiImpl_GetFeatureEnabledState @@ -0,0 +1,34 @@ + +/* enum FEATURE_ENABLED_STATE __cdecl wil::details::WilApiImpl_GetFeatureEnabledState(unsigned + int,enum FEATURE_CHANGE_TIME,int * __ptr64) */ + +FEATURE_ENABLED_STATE __cdecl +wil::details::WilApiImpl_GetFeatureEnabledState + (uint param_1,FEATURE_CHANGE_TIME param_2,int *param_3) + +{ + bool bVar1; + FEATURE_ENABLED_STATE FVar2; + FEATURE_ENABLED_STATE local_28 [10]; + + local_28[0] = 0; + local_28[1] = 0; + local_28[2] = 0; + local_28[3] = 0; + local_28[4] = 0; + local_28[5] = 0; + bVar1 = IsFeatureConfigured((wil_FeatureState *)local_28,param_1,(param_2 & 0xffffff7f) - 2 < 2, + param_2 >> 7 & 1,param_3); + FVar2 = 0; + if (bVar1) { + FVar2 = local_28[0]; + } + if (local_28[4] != 0) { + FVar2 = FVar2 | 0x80; + } + if (local_28[5] != 0) { + FVar2 = FVar2 | 0x40; + } + return FVar2; +} + ``` ## wil::details::WilApiImpl_RecordFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApiImpl_RecordFeatureUsage| |fullname|wil::details::WilApiImpl_RecordFeatureUsage| |refcount|2| |length|102| |called|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil_RtlStagingConfig_RecordFeatureUsage| |calling|| |paramcount|4| |address|18001a750| |sig|void __cdecl WilApiImpl_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApiImpl_RecordFeatureUsage +++ wil::details::WilApiImpl_RecordFeatureUsage @@ -0,0 +1,29 @@ + +/* void __cdecl wil::details::WilApiImpl_RecordFeatureUsage(unsigned int,unsigned int,unsigned + int,char const * __ptr64) */ + +void __cdecl +wil::details::WilApiImpl_RecordFeatureUsage(uint param_1,uint param_2,uint param_3,char *param_4) + +{ + wil_details_ServiceReportingKind wVar1; + + wVar1 = param_2 & 0x7fffffff; + if (((param_1 == 0) && (param_3 == 0)) && (wVar1 == 0)) { + FeatureStateManager::FlushUsage((FeatureStateManager *)&g_featureStateManager); + return; + } + if (wVar1 >> 0x1e != 0) { + FeatureStateManager::QueueBackgroundSRUMUsageReporting + ((FeatureStateManager *)&g_featureStateManager,param_1,(ushort)wVar1,param_3); + return; + } + if ((param_3 == 0) && (wVar1 != 0xfe)) { + wil_RtlStagingConfig_RecordFeatureUsage(param_1,(ushort)wVar1,param_2 >> 0x1f); + return; + } + FeatureStateManager::RecordFeatureUsage + ((FeatureStateManager *)&g_featureStateManager,param_1,wVar1,(ulonglong)param_3); + return; +} + ``` ## wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApiImpl_SubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |refcount|2| |length|45| |called|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush| |calling|| |paramcount|3| |address|18001a7c0| |sig|void __cdecl WilApiImpl_SubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification +++ wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification @@ -0,0 +1,20 @@ + +/* void __cdecl wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64 * __ptr64,void (__cdecl*)(void * __ptr64),void * + __ptr64) */ + +void __cdecl +wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification + (FEATURE_STATE_CHANGE_SUBSCRIPTION__ **param_1,_func_void_void_ptr *param_2,void *param_3) + +{ + if (param_3 == (void *)0xffffffffffffffff) { + FeatureStateManager::SubscribeToUsageFlush + ((FeatureStateManager *)&g_featureStateManager,param_1,param_2); + return; + } + FeatureStateManager::SubscribeToEnabledStateChanges + ((FeatureStateManager *)&g_featureStateManager,param_1,param_2,param_3); + return; +} + ``` ## wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApiImpl_UnsubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification| |refcount|3| |length|78| |called|wil::details_abi::SubscriptionList::Unsubscribe| |calling|| |paramcount|1| |address|18001a800| |sig|void __cdecl WilApiImpl_UnsubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification +++ wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification @@ -0,0 +1,30 @@ + +/* void __cdecl wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64) */ + +void __cdecl +wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification + (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *param_1) + +{ + SubscriptionList *this; + + if (((ulonglong)param_1 >> 0x1f & 1) == 0) { + if (g_featureStateManager == (shutdown_aware_object)0x0 + ) { + return; + } + this = (SubscriptionList *)&DAT_1800350a8; + } + else { + if (g_featureStateManager == (shutdown_aware_object)0x0 + ) { + return; + } + param_1 = (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)((ulonglong)param_1 & 0xffffffff7fffffff); + this = (SubscriptionList *)&DAT_1800350f8; + } + details_abi::SubscriptionList::Unsubscribe(this,(srwlock *)&DAT_180035080,param_1); + return; +} + ``` ## wil::details::WilApi_RecordFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsage| |fullname|wil::details::WilApi_RecordFeatureUsage| |refcount|6| |length|41| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::RecordSRUMFeatureUsage
wil::details::ReportUsageToServiceDirect
wil::details::WilApi_RecordFeatureUsageReports| |paramcount|4| |address|18001a858| |sig|void __cdecl WilApi_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_RecordFeatureUsage +++ wil::details::WilApi_RecordFeatureUsage @@ -0,0 +1,21 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* void __cdecl wil::details::WilApi_RecordFeatureUsage(unsigned int,unsigned int,unsigned int,char + const * __ptr64) */ + +void __cdecl +wil::details::WilApi_RecordFeatureUsage(uint param_1,uint param_2,uint param_3,char *param_4) + +{ + code *pcVar1; + + pcVar1 = g_wil_details_internalRecordFeatureUsage; + if ((g_wil_details_internalRecordFeatureUsage != (code *)0x0) || + (pcVar1 = g_wil_details_apiRecordFeatureUsage, + g_wil_details_apiRecordFeatureUsage != (code *)0x0)) { + (*pcVar1)(); + } + return; +} + ``` ## wil::details::WilApi_RecordFeatureUsageReports ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsageReports| |fullname|wil::details::WilApi_RecordFeatureUsageReports| |refcount|2| |length|59| |called|wil::details::WilApi_RecordFeatureUsage| |calling|wil_details_RecordCachedUsage| |paramcount|2| |address|18001a888| |sig|void __cdecl WilApi_RecordFeatureUsageReports(__WIL_RTL_FEATURE_USAGE_DATA * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_RecordFeatureUsageReports +++ wil::details::WilApi_RecordFeatureUsageReports @@ -0,0 +1,25 @@ + +/* void __cdecl wil::details::WilApi_RecordFeatureUsageReports(struct __WIL_RTL_FEATURE_USAGE_DATA * + __ptr64,unsigned __int64) */ + +void __cdecl +wil::details::WilApi_RecordFeatureUsageReports + (__WIL_RTL_FEATURE_USAGE_DATA *param_1,__uint64 param_2) + +{ + __WIL_RTL_FEATURE_USAGE_DATA *p_Var1; + char *in_R9; + + if (param_2 != 0) { + p_Var1 = param_1 + 4; + do { + WilApi_RecordFeatureUsage + (*(uint *)(p_Var1 + -4),(uint)*(ushort *)p_Var1,(uint)*(ushort *)(p_Var1 + 2),in_R9) + ; + p_Var1 = p_Var1 + 8; + param_2 = param_2 - 1; + } while (param_2 != 0); + } + return; +} + ``` ## wil::details::WilApi_UnsubscribeFeatureStateChangeNotification ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WilApi_UnsubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |refcount|2| |length|38| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|18001a8cc| |sig|void __cdecl WilApi_UnsubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_UnsubscribeFeatureStateChangeNotification +++ wil::details::WilApi_UnsubscribeFeatureStateChangeNotification @@ -0,0 +1,22 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* void __cdecl wil::details::WilApi_UnsubscribeFeatureStateChangeNotification(struct + FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64) */ + +void __cdecl +wil::details::WilApi_UnsubscribeFeatureStateChangeNotification + (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *param_1) + +{ + code *pcVar1; + + pcVar1 = g_wil_details_internalUnsubscribeFeatureStateChangeNotification; + if ((g_wil_details_internalUnsubscribeFeatureStateChangeNotification != (code *)0x0) || + (pcVar1 = g_wil_details_apiUnsubscribeFeatureStateChangeNotification, + g_wil_details_apiUnsubscribeFeatureStateChangeNotification != (code *)0x0)) { + (*pcVar1)(); + } + return; +} + ``` ## wil::details_abi::UsageIndexProperty::Write ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|Write| |fullname|wil::details_abi::UsageIndexProperty::Write| |refcount|3| |length|264| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|18001a8fc| |sig|bool __thiscall Write(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::UsageIndexProperty::Write +++ wil::details_abi::UsageIndexProperty::Write @@ -0,0 +1,56 @@ + +/* public: bool __cdecl wil::details_abi::UsageIndexProperty::Write(unsigned char * __ptr64 & + __ptr64,unsigned char * __ptr64)const __ptr64 */ + +bool __thiscall +wil::details_abi::UsageIndexProperty::Write(UsageIndexProperty *this,uchar **param_1,uchar *param_2) + +{ + rsize_t _DstSize; + uchar *_Dst; + UsageIndexProperty *_Src; + rsize_t _MaxCount; + ulonglong _MaxCount_00; + uchar *puVar1; + undefined2 local_res8 [4]; + + _Dst = *param_1; + if (this[2] == (UsageIndexProperty)0x1) { + puVar1 = _Dst + 2; + if (param_2 < puVar1) { + return false; + } + local_res8[0] = *(undefined2 *)(this + 4); + _Src = (UsageIndexProperty *)local_res8; + _MaxCount = 2; + _DstSize = 2; + } + else { + if (this[2] != (UsageIndexProperty)0x2) goto LAB_18001a979; + puVar1 = _Dst + 4; + if (param_2 < puVar1) { + return false; + } + _DstSize = 4; + _Src = this + 4; + _MaxCount = 4; + } + memcpy_s(_Dst,_DstSize,_Src,_MaxCount); + _Dst = puVar1; +LAB_18001a979: + if (*(short *)this == 0) { + if (param_2 < _Dst + 2) { + return false; + } + memcpy_s(_Dst,(longlong)param_2 - (longlong)_Dst,this + 8,2); + _Dst = _Dst + 2; + } + _MaxCount_00 = (ulonglong)*(ushort *)(this + 8); + if (param_2 < _Dst + _MaxCount_00) { + return false; + } + memcpy_s(_Dst,(longlong)param_2 - (longlong)_Dst,*(void **)(this + 0x18),_MaxCount_00); + *param_1 = _Dst + *(ushort *)(this + 8); + return true; +} + ``` ## wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|__clone| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone| |refcount|3| |length|29| |called|| |calling|| |paramcount|2| |address|18001ae50| |sig|void __thiscall __clone(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, __base * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone +++ wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone @@ -0,0 +1,25 @@ + +/* public: virtual void __cdecl wistd::__function::__func,bool __cdecl(void * __ptr64,unsigned __int64,void * + __ptr64,unsigned __int64,unsigned int)>::__clone(class wistd::__function::__base * + __ptr64)const __ptr64 */ + +void __thiscall +wistd::__function:: +__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> +::__clone(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> + *this,__base + *param_1) + +{ + undefined8 uVar1; + + *(undefined ***)param_1 = &_vftable_; + uVar1 = *(undefined8 *)(this + 0x10); + *(undefined8 *)(param_1 + 8) = *(undefined8 *)(this + 8); + *(undefined8 *)(param_1 + 0x10) = uVar1; + *(undefined8 *)(param_1 + 0x18) = *(undefined8 *)(this + 0x18); + return; +} + ``` ## wil::details::FeatureImpl::__private_IsEnabled ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl::__private_IsEnabled| |refcount|6| |length|53| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |calling|ClipboardServer::GetContentInternal
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState| |paramcount|1| |address|18001ae9c| |sig|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::__private_IsEnabled +++ wil::details::FeatureImpl::__private_IsEnabled @@ -0,0 +1,18 @@ + +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) + +{ + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; + + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + return (bool)(local_res10 & 1); +} + ``` ## wil::details_abi::heap_buffer::ensure ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|ensure| |fullname|wil::details_abi::heap_buffer::ensure| |refcount|3| |length|41| |called|wil::details_abi::heap_buffer::reserve| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::heap_buffer::push_back| |paramcount|2| |address|18001afd8| |sig|bool __thiscall ensure(heap_buffer * this, __uint64 param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::heap_buffer::ensure +++ wil::details_abi::heap_buffer::ensure @@ -0,0 +1,21 @@ + +/* public: bool __cdecl wil::details_abi::heap_buffer::ensure(unsigned __int64) __ptr64 */ + +bool __thiscall wil::details_abi::heap_buffer::ensure(heap_buffer *this,__uint64 param_1) + +{ + ulonglong uVar1; + bool bVar2; + + if ((*(longlong *)(this + 8) - *(longlong *)this) + param_1 < + (ulonglong)(*(longlong *)(this + 0x10) - *(longlong *)this)) { + return true; + } + uVar1 = (*(longlong *)(this + 0x10) - *(longlong *)this) * 2; + if (param_1 < uVar1) { + param_1 = uVar1; + } + bVar2 = reserve(this,param_1); + return bVar2; +} + ``` ## wil::details_abi::heap_buffer::push_back ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|push_back| |fullname|wil::details_abi::heap_buffer::push_back| |refcount|6| |length|97| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3| |address|18001b020| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::heap_buffer::push_back +++ wil::details_abi::heap_buffer::push_back @@ -0,0 +1,21 @@ + +/* public: bool __cdecl wil::details_abi::heap_buffer::push_back(void const * __ptr64,unsigned + __int64) __ptr64 */ + +bool __thiscall +wil::details_abi::heap_buffer::push_back(heap_buffer *this,void *param_1,__uint64 param_2) + +{ + void *_Dst; + bool bVar1; + + bVar1 = ensure(this,param_2); + if (bVar1) { + _Dst = *(void **)(this + 8); + memcpy_s(_Dst,-(ulonglong)(_Dst < *(void **)(this + 0x10)) & + *(longlong *)(this + 0x10) - (longlong)_Dst,param_1,param_2); + *(__uint64 *)(this + 8) = *(longlong *)(this + 8) + param_2; + } + return bVar1; +} + ``` ## wil::details_abi::heap_buffer::reserve ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|reserve| |fullname|wil::details_abi::heap_buffer::reserve| |refcount|2| |length|190| |called|MSVCRT.DLL::memcpy_s
wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details_abi::heap_buffer::ensure| |paramcount|2| |address|18001b088| |sig|bool __thiscall reserve(heap_buffer * this, __uint64 param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details_abi::heap_buffer::reserve +++ wil::details_abi::heap_buffer::reserve @@ -0,0 +1,37 @@ + +/* public: bool __cdecl wil::details_abi::heap_buffer::reserve(unsigned __int64) __ptr64 */ + +bool __thiscall wil::details_abi::heap_buffer::reserve(heap_buffer *this,__uint64 param_1) + +{ + longlong lVar1; + longlong lVar2; + void *pvVar3; + void *_Dst; + __uint64 _DstSize; + last_error_context local_res8 [8]; + + if ((ulonglong)(*(longlong *)(this + 0x10) - *(longlong *)this) < param_1) { + last_error_context::last_error_context(local_res8); + _DstSize = (param_1 & 0xffffffffffffffc0) + 0x40; + _Dst = details::ProcessHeapAlloc(0,_DstSize); + if (_Dst == (void *)0x0) { + last_error_context::~last_error_context(local_res8); + return false; + } + lVar1 = *(longlong *)(this + 8); + lVar2 = *(longlong *)this; + memcpy_s(_Dst,_DstSize,*(void **)this,lVar1 - lVar2); + pvVar3 = *(void **)(this + 0x18); + *(void **)(this + 0x18) = _Dst; + if (pvVar3 != (void *)0x0) { + details::FreeProcessHeap(pvVar3); + } + *(void **)this = _Dst; + *(longlong *)(this + 8) = (lVar1 - lVar2) + (longlong)_Dst; + *(__uint64 *)(this + 0x10) = (longlong)_Dst + _DstSize; + last_error_context::~last_error_context(local_res8); + } + return true; +} + ``` ## wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|reset| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset| |refcount|7| |length|76| |called|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|2| |address|18001b2c8| |sig|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset @@ -0,0 +1,28 @@ + +/* public: void __cdecl wil::details::unique_storage::Destroy(struct _TP_TIMER * __ptr64),struct + wistd::integral_constant,struct _TP_TIMER * __ptr64,struct _TP_TIMER * + __ptr64,0,std::nullptr_t> >::reset(struct _TP_TIMER * __ptr64) __ptr64 */ + +void __thiscall +wil::details:: +unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> +::reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *this,_TP_TIMER *param_1) + +{ + _TP_TIMER *p_Var1; + last_error_context local_res8 [8]; + + p_Var1 = *(_TP_TIMER **)this; + if (p_Var1 != (_TP_TIMER *)0x0) { + last_error_context::last_error_context(local_res8); + DestroyThreadPoolTimer::Destroy(p_Var1); + last_error_context::~last_error_context(local_res8); + } + *(_TP_TIMER **)this = param_1; + return; +} + ``` ## wil_details_WriteSRUMWnfUsageBuffer ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_WriteSRUMWnfUsageBuffer| |fullname|wil_details_WriteSRUMWnfUsageBuffer| |refcount|2| |length|492| |called|__chkstk
__security_check_cookie
memset
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData| |calling|::| |paramcount|1| |address|18001b584| |sig|long __cdecl wil_details_WriteSRUMWnfUsageBuffer(heap_vector * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil_details_WriteSRUMWnfUsageBuffer +++ wil_details_WriteSRUMWnfUsageBuffer @@ -0,0 +1,96 @@ + +/* WARNING: Function: __chkstk replaced with injection: alloca_probe */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* long __cdecl wil_details_WriteSRUMWnfUsageBuffer(class wil::details_abi::heap_vector * __ptr64) */ + +long __cdecl +wil_details_WriteSRUMWnfUsageBuffer(heap_vector *param_1) + +{ + int *piVar1; + int *piVar2; + int iVar3; + __int64 _Var4; + ulonglong uVar5; + int *piVar6; + undefined8 uVar7; + int iVar8; + long lVar9; + undefined8 uVar10; + int *piVar11; + ulonglong uVar12; + undefined1 auStackY_1078 [32]; + int *piVar13; + uint local_1038; + undefined4 local_1034 [3]; + int local_1028 [1024]; + ulonglong local_28; + undefined8 local_20; + + local_20 = 0x18001b5a9; + local_28 = __security_cookie ^ (ulonglong)auStackY_1078; + iVar3 = 0; + uVar5 = 0; + lVar9 = 0; + if (0xb < (ulonglong)(*(longlong *)(param_1 + 8) - *(longlong *)param_1)) { + iVar8 = 0; + do { + uVar7 = 0; + uVar10 = 0x1000; + memset(local_1028,0,0x1000); + local_1034[0] = 0; + piVar13 = local_1028; + local_1038 = 0x1000; + _Var4 = wil_details_NtQueryWnfStateData + (&__WIL_WNF_WIL_FEATURE_USAGE_FOR_SRUM,uVar7,uVar10,local_1034,piVar13, + &local_1038); + iVar3 = (int)_Var4; + if (iVar3 == 0) { + uVar5 = (ulonglong)local_1038; + if (uVar5 != (uVar5 / 0xc) * 0xc) { + uVar5 = 0; + local_1038 = 0; + } + piVar11 = *(int **)param_1; + uVar12 = uVar5 / 0xc; + piVar1 = piVar11 + ((ulonglong)(*(longlong *)(param_1 + 8) - (longlong)piVar11) / 0xc) * 3; + while( true ) { + if (piVar11 == piVar1) break; + piVar2 = local_1028 + uVar12 * 3; + piVar6 = local_1028; + if (local_1028 != piVar2) { + do { + if ((*piVar6 == *piVar11) && ((short)piVar6[1] == (short)piVar11[1])) { + piVar6[2] = piVar6[2] + piVar11[2]; + uVar5 = (ulonglong)local_1038; + goto LAB_18001b6e6; + } + piVar6 = piVar6 + 3; + } while (piVar6 != piVar2); + } + if (uVar5 + 0xc < 0x1001) { + local_1038 = (uint)uVar5 + 0xc; + uVar5 = (ulonglong)local_1038; + *(undefined8 *)piVar2 = *(undefined8 *)piVar11; + local_1028[uVar12 * 3 + 2] = piVar11[2]; + uVar12 = (ulonglong)((int)uVar12 + 1); + } +LAB_18001b6e6: + piVar11 = piVar11 + 3; + } + uVar5 = wil_details_NtUpdateWnfStateData + (&__WIL_WNF_WIL_FEATURE_USAGE_FOR_SRUM,local_1028,(uint)uVar5,uVar5, + piVar13,local_1034[0],1); + uVar5 = uVar5 & 0xffffffff; + } + iVar8 = iVar8 + 1; + lVar9 = (long)uVar5; + } while (((lVar9 == -0x3fffffff) && (iVar8 < 100)) && (iVar3 == 0)); + } + if (iVar3 == 0) { + iVar3 = lVar9; + } + return iVar3; +} + ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|3| |length|271| |called|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::IsFeatureConfigured| |paramcount|4| |address|18001b820| |sig|undefined4 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, uint param_2, int param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -0,0 +1,52 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +undefined4 +wil_RtlStagingConfig_QueryFeatureState(uint *param_1,uint param_2,int param_3,uint *param_4) + +{ + int iVar1; + __int64 _Var2; + undefined4 uVar3; + undefined1 auStack_78 [48]; + undefined8 local_48; + undefined8 local_40; + uint local_38; + ulonglong local_30; + + local_30 = __security_cookie ^ (ulonglong)auStack_78; + local_48 = 0; + uVar3 = 0; + local_40 = 0; + local_38 = 0; + if ((g_wil_details_pfnRtlQueryFeatureConfiguration == (_func___int64 *)0x0) && + (g_wil_details_pfnRtlQueryFeatureConfiguration = + wil_details_GetNtDllProcedureAddress("RtlQueryFeatureConfiguration"), + g_wil_details_pfnRtlQueryFeatureConfiguration == (_func___int64 *)0x0)) { + iVar1 = -0x3ffffec7; + uVar3 = 0; + } + else { + _Var2 = (*g_wil_details_pfnRtlQueryFeatureConfiguration) + ((ulonglong)param_2,(ulonglong)(param_3 == 0),&local_48,&local_40); + iVar1 = (int)_Var2; + if (iVar1 == 0) { + *param_1 = local_40._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_40 >> 0x28) & 0x3f; + param_1[3] = local_38; + param_1[2] = local_40._4_4_ >> 0xe & 3; + param_1[5] = local_40._4_4_ >> 6 & 1; + } + else if (iVar1 != 0x117) goto LAB_18001b8fb; + uVar3 = 1; + param_1[4] = local_40._4_4_ >> 7 & 1; + } +LAB_18001b8fb: + if (param_4 != (uint *)0x0) { + *param_4 = (uint)(iVar1 != -0x7fffffde); + } + return uVar3; +} + ``` ## wil_RtlStagingConfig_RecordFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_RtlStagingConfig_RecordFeatureUsage| |fullname|wil_RtlStagingConfig_RecordFeatureUsage| |refcount|2| |length|87| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|3| |address|18001b938| |sig|__int64 __fastcall wil_RtlStagingConfig_RecordFeatureUsage(undefined4 param_1, undefined2 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_RecordFeatureUsage +++ wil_RtlStagingConfig_RecordFeatureUsage @@ -0,0 +1,27 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +__int64 wil_RtlStagingConfig_RecordFeatureUsage(undefined4 param_1,undefined2 param_2,int param_3) + +{ + uint6 uVar1; + __int64 _Var2; + undefined8 local_res20; + + local_res20._0_6_ = CONCAT24(param_2,param_1); + uVar1 = (uint6)local_res20; + local_res20 = (ulonglong)(uint6)local_res20; + if (param_3 != 0) { + local_res20 = CONCAT26(1,uVar1); + } + if ((g_wil_details_pfnRtlNotifyFeatureUsage == (_func___int64 *)0x0) && + (g_wil_details_pfnRtlNotifyFeatureUsage = + wil_details_GetNtDllProcedureAddress("RtlNotifyFeatureUsage"), + g_wil_details_pfnRtlNotifyFeatureUsage == (_func___int64 *)0x0)) { + return 0xc0000139; + } + _Var2 = (*g_wil_details_pfnRtlNotifyFeatureUsage)(&local_res20); + return _Var2; +} + ``` ## wil_StagingConfig_LogStagedFeatureUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_StagingConfig_LogStagedFeatureUsage| |fullname|wil_StagingConfig_LogStagedFeatureUsage| |refcount|3| |length|86| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetKernelBaseProcAddress| |calling|| |paramcount|3| |address|18001b9a0| |sig|undefined __fastcall wil_StagingConfig_LogStagedFeatureUsage(uint param_1, uint param_2, undefined1 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_StagingConfig_LogStagedFeatureUsage +++ wil_StagingConfig_LogStagedFeatureUsage @@ -0,0 +1,17 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +void wil_StagingConfig_LogStagedFeatureUsage(uint param_1,uint param_2,undefined1 param_3) + +{ + if ((g_wil_details_pfnLogStagedFeatureUsage == (_func___int64 *)0x0) && + (g_wil_details_pfnLogStagedFeatureUsage = + wil_details_GetKernelBaseProcAddress("LogStagedFeatureUsage"), + g_wil_details_pfnLogStagedFeatureUsage == (_func___int64 *)0x0)) { + return; + } + (*g_wil_details_pfnLogStagedFeatureUsage)((ulonglong)param_1,(ulonglong)param_2,param_3); + return; +} + ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|218| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|18001ba00| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -0,0 +1,54 @@ + +void wil_details_FeatureReporting_IncrementOpportunityInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar3 = *param_1; + do { + uVar1 = uVar3; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar3 = (uVar1 & 0x3f8000) >> 0xf; + if (uVar3 != 0) { + param_4[1] = uVar3; + uVar3 = 5; + if (param_2 != 1) { + uVar3 = 1; + } + uVar2 = uVar1 & 0xffc07fff | 1; + param_4[2] = uVar3; + } + uVar3 = 0; + if (param_2 == 5) { + uVar3 = 0x400000; + } + uVar2 = uVar3 | uVar2 & 0xffbfffff; + } + uVar3 = uVar2 >> 0xf & 0x7f; + uVar4 = uVar3 + 1; + if ((0x7f < uVar4) || (uVar4 < uVar3)) { + uVar4 = 1; + param_4[2] = param_2; + param_4[1] = uVar3; + } + LOCK(); + uVar3 = *param_1; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *param_1 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|230| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|18001bae4| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -0,0 +1,50 @@ + +void wil_details_FeatureReporting_IncrementUsageInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar1 = uVar4; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar1 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar2 = uVar1 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar3 = uVar4 + 1; + if ((0x1ff < uVar3) || (uVar3 < uVar4)) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar1 == uVar4; + if (bVar5) { + *param_1 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; + uVar4 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|369| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil::details::ReportUsageToServiceDirect| |paramcount|3| |address|18001bbd4| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,101 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,undefined8 param_3) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_18001bd29: + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_18001bd19: + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_18001bd29; + if (uVar3 == 5) goto LAB_18001bd19; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar5 = uVar3 - 0x140; + if ((int)uVar5 < 0x40) { + uVar4 = param_2[1]; + do { + if (((uVar4 & 0x10) == 0) || (uVar2 = 1, (uVar4 >> 5 & 0x3f) != uVar5)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar4 == uVar2; + if (bVar6) { + param_2[1] = (uVar5 * 0x20 ^ uVar4) & 0x7e0 ^ uVar4 | 0x10; + uVar2 = uVar4; + } + uVar4 = uVar2; + UNLOCK(); + } while (!bVar6); + if (param_1[4] != 0) { + return param_1; + } + } + param_1[3] = 0; + param_1[2] = uVar3; + param_1[1] = 1; + return param_1; + } + } + uVar5 = 0; + if (uVar3 == 2) { + uVar5 = 2; + } + else if (uVar3 == 3) { + uVar5 = 8; + } + else if (uVar3 == 6) { + uVar5 = 4; + } + else if (uVar3 == 7) { + uVar5 = 0x10; + } + uVar4 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar5 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar4 = 0; + } + *param_1 = uVar4; + } + return param_1; +} + ``` ## wil_details_MapReportingKind ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|1| |length|144| |called|| |calling|wil::details::FeatureImpl::ReportUsage| |paramcount|2| |address|18001bd4c| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -0,0 +1,33 @@ + +uint wil_details_MapReportingKind(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## wil_details_NtQueryWnfStateData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_NtQueryWnfStateData| |fullname|wil_details_NtQueryWnfStateData| |refcount|3| |length|112| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details_abi::RecordWnfUsageIndex
wil_details_WriteSRUMWnfUsageBuffer| |paramcount|6| |address|18001bdec| |sig|__int64 __fastcall wil_details_NtQueryWnfStateData(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_NtQueryWnfStateData +++ wil_details_NtQueryWnfStateData @@ -0,0 +1,21 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +__int64 wil_details_NtQueryWnfStateData + (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, + undefined8 param_5,undefined8 param_6) + +{ + __int64 _Var1; + + if ((g_wil_details_pfnNtQueryWnfStateData == (_func___int64 *)0x0) && + (g_wil_details_pfnNtQueryWnfStateData = + wil_details_GetNtDllProcedureAddress("NtQueryWnfStateData"), + g_wil_details_pfnNtQueryWnfStateData == (_func___int64 *)0x0)) { + return 0xc0000139; + } + _Var1 = (*g_wil_details_pfnNtQueryWnfStateData)(param_1,0,0,param_4,param_5,param_6); + return _Var1; +} + ``` ## wil_details_NtUpdateWnfStateData ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_NtUpdateWnfStateData| |fullname|wil_details_NtUpdateWnfStateData| |refcount|4| |length|131| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details_abi::RecordWnfUsageIndex
wil_details_WriteSRUMWnfUsageBuffer| |paramcount|7| |address|18001be64| |sig|__int64 __fastcall wil_details_NtUpdateWnfStateData(undefined8 param_1, undefined8 param_2, uint param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_NtUpdateWnfStateData +++ wil_details_NtUpdateWnfStateData @@ -0,0 +1,21 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +__int64 wil_details_NtUpdateWnfStateData + (undefined8 param_1,undefined8 param_2,uint param_3,undefined8 param_4, + undefined8 param_5,undefined4 param_6,undefined4 param_7) + +{ + __int64 _Var1; + + if ((g_wil_details_pfnNtUpdateWnfStateData == (_func___int64 *)0x0) && + (g_wil_details_pfnNtUpdateWnfStateData = + wil_details_GetNtDllProcedureAddress("NtUpdateWnfStateData"), + g_wil_details_pfnNtUpdateWnfStateData == (_func___int64 *)0x0)) { + return 0xc0000139; + } + _Var1 = (*g_wil_details_pfnNtUpdateWnfStateData)(param_1,param_2,param_3,0,0,param_6,param_7); + return _Var1; +} + ``` ## wil_details_RecordCachedUsage ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|2| |length|325| |called|__security_check_cookie
wil::details::WilApi_RecordFeatureUsageReports| |calling|wil::details::EnabledStateManager::RecordCachedUsageUnderLock| |paramcount|2| |address|18001bef0| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordCachedUsage +++ wil_details_RecordCachedUsage @@ -0,0 +1,90 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + undefined4 *puVar5; + __uint64 _Var6; + bool bVar7; + undefined1 auStack_68 [32]; + undefined4 local_48; + short local_44 [2]; + undefined4 local_40 [10]; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStack_68; + uVar2 = *param_2; + do { + LOCK(); + uVar4 = *param_2; + bVar7 = uVar2 == uVar4; + if (bVar7) { + *param_2 = uVar2 & 0xffc0401e; + uVar4 = uVar2; + } + uVar2 = uVar4; + UNLOCK(); + } while (!bVar7); + uVar3 = uVar2 >> 1 & 0xf; + uVar4 = 0; + if (uVar3 != 0) { + uVar4 = param_2[1]; + do { + LOCK(); + uVar1 = param_2[1]; + bVar7 = uVar4 == uVar1; + if (bVar7) { + param_2[1] = uVar4 | uVar3; + uVar1 = uVar4; + } + uVar4 = uVar1; + UNLOCK(); + } while (!bVar7); + uVar4 = uVar3 & ~uVar4; + } + puVar5 = &local_48; + if ((uVar4 & 1) != 0) { + local_44[0] = 2; + local_44[1] = 1; + puVar5 = local_40; + local_48 = param_1; + } + if ((uVar4 & 2) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10006; + puVar5 = puVar5 + 2; + } + if ((uVar4 & 4) != 0) { + *puVar5 = param_1; + puVar5[1] = 0x10003; + puVar5 = puVar5 + 2; + } + if (7 < uVar4) { + *puVar5 = param_1; + puVar5[1] = 0x10007; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 5 & 0x1ff) != 0) { + *puVar5 = param_1; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff; + puVar5 = puVar5 + 2; + } + if ((uVar2 >> 0xf & 0x7f) != 0) { + *puVar5 = param_1; + *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1; + *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f; + puVar5 = puVar5 + 2; + } + _Var6 = (longlong)puVar5 - (longlong)&local_48 >> 3; + if (0 < (longlong)_Var6) { + wil::details::WilApi_RecordFeatureUsageReports((__WIL_RTL_FEATURE_USAGE_DATA *)&local_48,_Var6); + } + return; +} + ``` ## wil_details_RtlRegisterFeatureConfigurationChangeNotification ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |fullname|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |refcount|2| |length|100| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges| |paramcount|4| |address|18001c03c| |sig|__int64 __fastcall wil_details_RtlRegisterFeatureConfigurationChangeNotification(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RtlRegisterFeatureConfigurationChangeNotification +++ wil_details_RtlRegisterFeatureConfigurationChangeNotification @@ -0,0 +1,23 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +__int64 wil_details_RtlRegisterFeatureConfigurationChangeNotification + (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) + +{ + __int64 _Var1; + + if ((g_wil_details_pfnRtlRegisterFeatureConfigurationChangeNotification == (_func___int64 *)0x0) + && (g_wil_details_pfnRtlRegisterFeatureConfigurationChangeNotification = + wil_details_GetNtDllProcedureAddress + ("RtlRegisterFeatureConfigurationChangeNotification"), + g_wil_details_pfnRtlRegisterFeatureConfigurationChangeNotification == (_func___int64 *)0x0)) + { + return 0xc0000139; + } + _Var1 = (*g_wil_details_pfnRtlRegisterFeatureConfigurationChangeNotification) + (param_1,param_2,0,param_4); + return _Var1; +} + ``` ## `wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0 ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|dtor$0| |fullname|`wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0| |refcount|0| |length|12| |called|wistd::function::~function| |calling|| |paramcount|2| |address|180024b87| |sig|undefined __fastcall dtor$0(undefined8 param_1, longlong param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- `wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0 +++ `wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0 @@ -0,0 +1,13 @@ + +void `wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor_0(undefined8 param_1,longlong param_2) + +{ + wistd:: + function + :: + ~function + (*(function + **)(param_2 + 0xd8)); + return; +} + ``` ## wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|`dynamic_atexit_destructor_for_'g_enabledStateManager''| |fullname|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |refcount|3| |length|45| |called|wil::ProcessShutdownInProgress
wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::EnabledStateManager::~EnabledStateManager| |calling|| |paramcount|0| |address|180025550| |sig|undefined __fastcall `dynamic_atexit_destructor_for_'g_enabledStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' +++ wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' @@ -0,0 +1,17 @@ + +void wil::details::_dynamic_atexit_destructor_for__g_enabledStateManager__(void) + +{ + bool bVar1; + + bVar1 = ProcessShutdownInProgress(); + if (bVar1) { + g_enabledStateManager = (shutdown_aware_object)0x0; + EnabledStateManager::RecordCachedUsageUnderLock((EnabledStateManager *)&g_enabledStateManager); + } + else { + EnabledStateManager::~EnabledStateManager((EnabledStateManager *)&g_enabledStateManager); + } + return; +} + ``` ## wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager'' ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|`dynamic_atexit_destructor_for_'g_featureStateManager''| |fullname|wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''| |refcount|3| |length|52| |called|wil::ProcessShutdownInProgress
wil::details::FeatureStateManager::~FeatureStateManager
wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |calling|| |paramcount|0| |address|180025590| |sig|undefined __fastcall `dynamic_atexit_destructor_for_'g_featureStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager'' +++ wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager'' @@ -0,0 +1,20 @@ + +void wil::details::_dynamic_atexit_destructor_for__g_featureStateManager__(void) + +{ + bool bVar1; + + bVar1 = ProcessShutdownInProgress(); + if (bVar1) { + g_featureStateManager = (shutdown_aware_object)0x0; + details_abi::ProcessLocalStorage:: + ~ProcessLocalStorage + ((ProcessLocalStorage *) + &PTR_s_WilStaging_02_180035068); + } + else { + FeatureStateManager::~FeatureStateManager((FeatureStateManager *)&g_featureStateManager); + } + return; +} + ``` ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|SetThreadpoolTimer| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer| |refcount|3| |length|0| |called|| |calling|wil::details::DestroyThreadPoolTimer::Destroy
wil::details::EnsureCoalescedTimer_SetTimer| |paramcount|4| |address|EXTERNAL:00000089| |sig|void __stdcall SetThreadpoolTimer(PTP_TIMER pti, PFILETIME pftDueTime, DWORD msPeriod, DWORD msWindowLength)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolTimer* ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|LeaveCriticalSection| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection| |refcount|2| |length|0| |called|| |calling|wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|EXTERNAL:00000038| |sig|void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection* ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionEx ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|InitializeCriticalSectionEx| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionEx| |refcount|2| |length|0| |called|| |calling|wil::details_abi::SubscriptionList::SubscriptionList| |paramcount|3| |address|EXTERNAL:0000003d| |sig|BOOL __stdcall InitializeCriticalSectionEx(LPCRITICAL_SECTION lpCriticalSection, DWORD dwSpinCount, DWORD Flags)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeCriticalSectionEx* ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|EnterCriticalSection| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection| |refcount|3| |length|0| |called|| |calling|wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe| |paramcount|1| |address|EXTERNAL:0000003e| |sig|void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection* ## MSVCRT.DLL::memmove_s ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|memmove_s| |fullname|MSVCRT.DLL::memmove_s| |refcount|2| |length|0| |called|| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|4| |address|EXTERNAL:00000016| |sig|errno_t __cdecl memmove_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for MSVCRT.DLL::memmove_s* ## MSVCRT.DLL::memcmp ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|memcmp| |fullname|MSVCRT.DLL::memcmp| |refcount|3| |length|0| |called|| |calling|| |paramcount|3| |address|EXTERNAL:00000007| |sig|int __cdecl memcmp(void * _Buf1, void * _Buf2, size_t _Size)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for MSVCRT.DLL::memcmp* ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolTimerCallbacks ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|WaitForThreadpoolTimerCallbacks| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolTimerCallbacks| |refcount|2| |length|0| |called|| |calling|wil::details::DestroyThreadPoolTimer::Destroy| |paramcount|2| |address|EXTERNAL:0000008b| |sig|void __stdcall WaitForThreadpoolTimerCallbacks(PTP_TIMER pti, BOOL fCancelPendingCallbacks)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::WaitForThreadpoolTimerCallbacks* ## API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer ### Function Meta |Key|cbs_7623.dll| | :---: | :---: | |name|CreateThreadpoolTimer| |fullname|API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer| |refcount|4| |length|0| |called|| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage| |paramcount|3| |address|EXTERNAL:0000008a| |sig|PTP_TIMER __stdcall CreateThreadpoolTimer(PTP_TIMER_CALLBACK pfnti, PVOID pv, PTP_CALLBACK_ENVIRON pcbe)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer* # Modified *Modified functions contain code changes* ## wil::details::WilFailureNotifyWatchers ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.89| |i_ratio|0.7| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|WilFailureNotifyWatchers|WilFailureNotifyWatchers| |fullname|wil::details::WilFailureNotifyWatchers|wil::details::WilFailureNotifyWatchers| |refcount|2|2| |`length`|70|77| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetKernelBaseProcAddress|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetKernelBaseProcAddress| |calling|wil::details::MicrosoftInternalNotifyFailure|wil::details::MicrosoftInternalNotifyFailure| |paramcount|3|3| |`address`|18000c0cc|18000c20c| |sig|void __cdecl WilFailureNotifyWatchers(uint param_1, WilFailureReport * param_2, WilFailureReportInformation * param_3)|void __cdecl WilFailureNotifyWatchers(uint param_1, WilFailureReport * param_2, WilFailureReportInformation * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::WilFailureNotifyWatchers Diff ```diff --- wil::details::WilFailureNotifyWatchers +++ wil::details::WilFailureNotifyWatchers @@ -1,30 +1,28 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* void __cdecl wil::details::WilFailureNotifyWatchers(unsigned int,struct WilFailureReport const * __ptr64,struct WilFailureReportInformation * __ptr64) */ void __cdecl wil::details::WilFailureNotifyWatchers (uint param_1,WilFailureReport *param_2,WilFailureReportInformation *param_3) { - undefined4 in_register_0000000c; - if ((`void___cdecl_wil::details::WilFailureNotifyWatchers(unsigned_int,struct_WilFailureReport_const*___ptr64,struct_WilFailureReportInformation*___ptr64)' ::__l2::s_pfnFailureNotifyWatchers == (_func_void_uint_WilFailureReport_ptr_WilFailureReportInformation_ptr *)0x0) && (`void___cdecl_wil::details::WilFailureNotifyWatchers(unsigned_int,struct_WilFailureReport_const*___ptr64,struct_WilFailureReportInformation*___ptr64)' ::__l2::s_pfnFailureNotifyWatchers = (_func_void_uint_WilFailureReport_ptr_WilFailureReportInformation_ptr *) - wil_details_GetKernelBaseProcAddress((char *)CONCAT44(in_register_0000000c,param_1)), + wil_details_GetKernelBaseProcAddress("WilFailureNotifyWatchers"), `void___cdecl_wil::details::WilFailureNotifyWatchers(unsigned_int,struct_WilFailureReport_const*___ptr64,struct_WilFailureReportInformation*___ptr64)' ::__l2::s_pfnFailureNotifyWatchers == (_func_void_uint_WilFailureReport_ptr_WilFailureReportInformation_ptr *)0x0)) { return; } (*`void___cdecl_wil::details::WilFailureNotifyWatchers(unsigned_int,struct_WilFailureReport_const*___ptr64,struct_WilFailureReportInformation*___ptr64)' ::__l2::s_pfnFailureNotifyWatchers)(0,param_2,param_3); return; } ``` ## wil::details_abi::ProcessLocalStorageData::Release ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.59| |i_ratio|0.29| |m_ratio|0.81| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|Release|Release| |fullname|wil::details_abi::ProcessLocalStorageData::Release|wil::details_abi::ProcessLocalStorageData::Release| |refcount|2|2| |`length`|214|131| |`called`|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReleaseMutex
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context
wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
wil::ProcessShutdownInProgress
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::Destroy
wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |calling|wil::details::`dynamic_atexit_destructor_for_'g_processLocalData''|wil::details::`dynamic_atexit_destructor_for_'g_processLocalData''| |paramcount|1|1| |`address`|18000b428|18000b538| |sig|void __thiscall Release(ProcessLocalStorageData * this)|void __thiscall Release(ProcessLocalStorageData * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::ProcessLocalStorageData::Release Called Diff ```diff --- wil::details_abi::ProcessLocalStorageData::Release called +++ wil::details_abi::ProcessLocalStorageData::Release called @@ -3,3 +3,2 @@ -_guard_dispatch_icall$thunk$10345483385596137414 -wil::details::ReleaseMutex -wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset +wil::ProcessShutdownInProgress +wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset @@ -8,2 +7 @@ -wil::last_error_context::last_error_context -wil::last_error_context::~last_error_context +wil::details_abi::SemaphoreValue::Destroy ``` ### wil::details_abi::ProcessLocalStorageData::Release Diff ```diff --- wil::details_abi::ProcessLocalStorageData::Release +++ wil::details_abi::ProcessLocalStorageData::Release @@ -1,60 +1,43 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ /* public: void __cdecl wil::details_abi::ProcessLocalStorageData::Release(void) __ptr64 */ void __thiscall wil::details_abi::ProcessLocalStorageData::Release (ProcessLocalStorageData *this) { - uchar uVar1; + bool bVar1; HANDLE hHeap; ulong in_R8D; int in_R9D; - void *local_res10; - last_error_context local_res18 [16]; + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + local_res10 [24]; - if (details::g_processShutdownInProgress) { -LAB_0: + bVar1 = ProcessShutdownInProgress(); + if (bVar1) { *(int *)this = *(int *)this + -1; } else { - if (details::g_pfnDllShutdownInProgress != (_func_uchar *)0x0) { - uVar1 = (*details::g_pfnDllShutdownInProgress)(); - if (uVar1 != '\0') goto LAB_0; - } mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> ::acquire((mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> - *)(this + 8),(ulong *)&local_res10,in_R8D,in_R9D); + *)(this + 8),(ulong *)local_res10,in_R8D,in_R9D); *(int *)this = *(int *)this + -1; if (*(int *)this == 0) { + SemaphoreValue::Destroy((SemaphoreValue *)(this + 0x10)); details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)(this + 0x10),(void *)0x0); - details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)(this + 0x18),(void *)0x0); - if (local_res10 != (void *)0x0) { - last_error_context::last_error_context(local_res18); - details::ReleaseMutex(local_res10); - last_error_context::~last_error_context(local_res18); - } - local_res10 = (void *)0x0; + unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + ::reset(local_res10,(void *)0x0); ~ProcessLocalStorageData(this); hHeap = GetProcessHeap(); HeapFree(hHeap,0,this); } details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_res10); + (local_res10); } return; } ``` ## ClipboardServer::RequestAccessForProcess ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.57| |i_ratio|0.43| |m_ratio|0.95| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|RequestAccessForProcess|RequestAccessForProcess| |fullname|ClipboardServer::RequestAccessForProcess|ClipboardServer::RequestAccessForProcess| |refcount|3|3| |`length`|722|806| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
ClipboardServer::GetEnterpriseIdOfContent
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetSourceAppId
EDPPolicyManager::EvaluateClipboardReadPolicy
EDPUTIL.DLL::EdpGetAppLockerUniqueAppIdentifier
EDPUTIL.DLL::EdpGetContextForProcess
EDPUTIL.DLL::EdpGetIsManaged
Microsoft::WRL::Wrappers::SRWLock::LockShared
wil::com_ptr_t::operator=
wil::com_ptr_t::~com_ptr_twil::details::in1diag3::_Log_Hr
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetEnterpriseIdOfContentInternal
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetSourceAppId
EDPPolicyManager::EvaluateClipboardReadPolicy
EDPUTIL.DLL::EdpGetAppLockerUniqueAppIdentifier
EDPUTIL.DLL::EdpGetContextForProcess
EDPUTIL.DLL::EdpGetIsManaged
Microsoft::WRL::Wrappers::SRWLock::LockShared
wil::com_ptr_t::operator=wil::com_ptr_t::~com_ptr_t
wil::details::FeatureImpl::__private_IsEnabled
wil::details::in1diag3::_Log_Hr
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
| |calling||| |paramcount|3|3| |`address`|1800139a0|1800161b0| |sig|long __thiscall RequestAccessForProcess(ClipboardServer * this, ulong param_1, int * param_2)|long __thiscall RequestAccessForProcess(ClipboardServer * this, ulong param_1, int * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::RequestAccessForProcess Called Diff ```diff --- ClipboardServer::RequestAccessForProcess called +++ ClipboardServer::RequestAccessForProcess called @@ -2,0 +3 @@ +ClipboardServer::GetEnterpriseIdOfContentInternal @@ -11,0 +13 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### ClipboardServer::RequestAccessForProcess Diff ```diff --- ClipboardServer::RequestAccessForProcess +++ ClipboardServer::RequestAccessForProcess @@ -1,144 +1,161 @@ /* public: virtual long __cdecl ClipboardServer::RequestAccessForProcess(unsigned long,int * __ptr64) __ptr64 */ long __thiscall ClipboardServer::RequestAccessForProcess(ClipboardServer *this,ulong param_1,int *param_2) { longlong lVar1; - int iVar2; - long lVar3; + bool bVar2; + int iVar3; + long lVar4; void *unaff_retaddr; _RTL_SRWLOCK local_res18; - byte *local_res20; - ushort *local_48; + ushort *local_res20; + byte *local_48; ushort *local_40; ushort *local_38; ushort *local_30; longlong local_28 [2]; *param_2 = 1; - iVar2 = EdpGetIsManaged(); - if (iVar2 != 0) { - local_res20 = (byte *)0x0; - iVar2 = EdpGetContextForProcess(param_1,&local_res20); - if (iVar2 < 0) { + iVar3 = EdpGetIsManaged(); + if (iVar3 != 0) { + local_48 = (byte *)0x0; + iVar3 = EdpGetContextForProcess(param_1,&local_48); + if (iVar3 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x2f7, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); + (unaff_retaddr,0x317, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar3); } - if (((*local_res20 & 1) == 0) && (((*local_res20 & 2) == 0 || (*(int *)(local_res20 + 4) == 0))) - ) { - local_38 = (ushort *)0x0; + if (((*local_48 & 1) == 0) && (((*local_48 & 2) == 0 || (*(int *)(local_48 + 4) == 0)))) { + local_res20 = (ushort *)0x0; local_28[0] = 0; Microsoft::WRL::Wrappers::SRWLock::LockShared(&local_res18); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_38,(ushort *)0x0); - lVar3 = GetEnterpriseIdOfContent(this,&local_38); - if (lVar3 < 0) { + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_res20,(ushort *)0x0); + lVar4 = GetEnterpriseIdOfContentInternal(this,&local_res20); + if (lVar4 < 0) { /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x306, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar3); + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x328, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); + } + } + else { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_res20,(ushort *)0x0); + lVar4 = GetEnterpriseIdOfContent(this,&local_res20); + if (lVar4 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x32c, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); + } } wil::com_ptr_t::operator= ((com_ptr_t *)local_28, (com_ptr_t *) (this + 200)); if ((PSRWLOCK)CONCAT71(local_res18.Ptr._1_7_,(char)local_res18.Ptr) != (PSRWLOCK)0x0) { ReleaseSRWLockShared((PSRWLOCK)CONCAT71(local_res18.Ptr._1_7_,(char)local_res18.Ptr)); } lVar1 = local_28[0]; + local_38 = (ushort *)0x0; + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_38,(ushort *)0x0); + lVar4 = DataPackageViewMUX::GetSourceAppId((DataPackageViewMUX *)(lVar1 + 0x20),&local_38); + if (lVar4 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x335, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); + } local_40 = (ushort *)0x0; wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> *)&local_40,(ushort *)0x0); - lVar3 = DataPackageViewMUX::GetSourceAppId((DataPackageViewMUX *)(lVar1 + 0x20),&local_40); - if (lVar3 < 0) { + lVar4 = DataPackageViewMUX::GetDataInfo((DataPackageViewMUX *)(lVar1 + 0x20),2,&local_40); + if (lVar4 < 0) { wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x30e, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar3); - } - local_48 = (ushort *)0x0; - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_48,(ushort *)0x0); - lVar3 = DataPackageViewMUX::GetDataInfo((DataPackageViewMUX *)(lVar1 + 0x20),2,&local_48); - if (lVar3 < 0) { - wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x311, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar3); + (unaff_retaddr,0x338, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); } local_30 = (ushort *)0x0; - iVar2 = EdpGetAppLockerUniqueAppIdentifier(param_1,&local_30); - if (iVar2 < 0) { + iVar3 = EdpGetAppLockerUniqueAppIdentifier(param_1,&local_30); + if (iVar3 < 0) { wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x314, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); + (unaff_retaddr,0x33b, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar3); } local_res18.Ptr._0_1_ = '\0'; - lVar3 = EDPPolicyManager::EvaluateClipboardReadPolicy - ((EDPPolicyManager *)(this + 0xd8),local_38,local_40,local_30,local_48, - param_1,*(ushort **)(local_res20 + 8),1,(HWND__ *)0x0,(bool *)&local_res18) - ; - if (lVar3 < 0) { + lVar4 = EDPPolicyManager::EvaluateClipboardReadPolicy + ((EDPPolicyManager *)(this + 0xd8),local_res20,local_38,local_30,local_40, + param_1,*(ushort **)(local_48 + 8),1,(HWND__ *)0x0,(bool *)&local_res18); + if (lVar4 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x321, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar3); + (unaff_retaddr,0x348, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); } if ((char)local_res18.Ptr == '\0') { *param_2 = 0; } wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> *)&local_30); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_48); + *)&local_40); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_40); + *)&local_38); wil::com_ptr_t:: ~com_ptr_t ((com_ptr_t *)local_28); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_38); + *)&local_res20); wil::details:: unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> - *)&local_res20); + *)&local_48); } else { wil::details:: unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> - *)&local_res20); + *)&local_48); } } return 0; } ``` ## ClipboardServer::UpdateEdpDataPackageLockState ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.34| |m_ratio|0.97| |b_ratio|0.19| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|UpdateEdpDataPackageLockState|UpdateEdpDataPackageLockState| |fullname|ClipboardServer::UpdateEdpDataPackageLockState|ClipboardServer::UpdateEdpDataPackageLockState| |refcount|2|2| |`length`|1169|1279| |`called`|
Expand for full list:
CallerIdentity::GetCoreWindowHandleForCallingThread
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::LockDataPackage
ClipboardServer::UnlockDataPackage
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::ReadPolicyEvaluation
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::StartActivity
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::~UpdateEdpDataPackageLockStateActivity
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetSourceAppId
EDPPolicyManager::EvaluateClipboardReadPolicy
EDPUTIL.DLL::EdpGetAppLockerUniqueAppIdentifierEDPUTIL.DLL::EdpGetContextForProcess
EDPUTIL.DLL::EdpGetContextForWindow
EDPUTIL.DLL::EdpGetIsManaged
UserAwareCallerIdentity::GetCallingProcessId
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::ActivityBase::ActivityBase
wil::ActivityBase::Stop
wil::com_ptr_t::~com_ptr_t
wil::details::in1diag3::_Log_Hr
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
|
Expand for full list:
CallerIdentity::GetCoreWindowHandleForCallingThread
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetEnterpriseIdOfContentInternal
ClipboardServer::LockDataPackage
ClipboardServer::UnlockDataPackage
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::ReadPolicyEvaluation
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::StartActivity
ClipboardTracing::UpdateEdpDataPackageLockStateActivity::~UpdateEdpDataPackageLockStateActivity
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetSourceAppId
EDPPolicyManager::EvaluateClipboardReadPolicyEDPUTIL.DLL::EdpGetAppLockerUniqueAppIdentifier
EDPUTIL.DLL::EdpGetContextForProcess
EDPUTIL.DLL::EdpGetContextForWindow
EDPUTIL.DLL::EdpGetIsManaged
UserAwareCallerIdentity::GetCallingProcessId
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::ActivityBase::ActivityBase
wil::ActivityBase::Stop
wil::com_ptr_t::~com_ptr_t
wil::details::FeatureImpl::__private_IsEnabled
wil::details::in1diag3::_Log_Hr
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
| |calling|ClipboardServer::GetContentInternal|ClipboardServer::GetContentInternal| |paramcount|2|2| |`address`|180017058|180019ee0| |sig|void __thiscall UpdateEdpDataPackageLockState(ClipboardServer * this, IDataPackageView * param_1)|void __thiscall UpdateEdpDataPackageLockState(ClipboardServer * this, IDataPackageView * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::UpdateEdpDataPackageLockState Called Diff ```diff --- ClipboardServer::UpdateEdpDataPackageLockState called +++ ClipboardServer::UpdateEdpDataPackageLockState called @@ -2,0 +3 @@ +ClipboardServer::GetEnterpriseIdOfContentInternal @@ -20,0 +22 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### ClipboardServer::UpdateEdpDataPackageLockState Diff ```diff --- ClipboardServer::UpdateEdpDataPackageLockState +++ ClipboardServer::UpdateEdpDataPackageLockState @@ -1,231 +1,250 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: void __cdecl ClipboardServer::UpdateEdpDataPackageLockState(struct Windows::ApplicationModel::DataTransfer::IDataPackageView * __ptr64) __ptr64 */ void __thiscall ClipboardServer::UpdateEdpDataPackageLockState(ClipboardServer *this,IDataPackageView *param_1) { longlong lVar1; ulong uVar2; ushort *puVar3; - int iVar4; - long lVar5; + bool bVar4; + int iVar5; + long lVar6; undefined1 in_R8B; void *unaff_retaddr; undefined1 auStackY_248 [32]; bool local_1f8 [4]; ulong local_1f4; - longlong local_1f0; - ushort *local_1e8; + ushort *local_1f0; + longlong local_1e8; ushort *local_1e0; ushort *local_1d8; ushort *local_1d0; HWND__ *local_1c8; longlong *local_1c0; ushort *local_1b8; ushort *local_1b0; ushort *local_1a8; _GUID local_1a0; undefined **local_188 [42]; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_248; - iVar4 = EdpGetIsManaged(); - if (iVar4 == 1) { + iVar5 = EdpGetIsManaged(); + if (iVar5 == 1) { wil:: ActivityBase :: ActivityBase ((ActivityBase *)local_188,"UpdateEdpDataPackageLockStateActivity",(bool)in_R8B); local_188[0] = &ClipboardTracing::UpdateEdpDataPackageLockStateActivity::_vftable_; ClipboardTracing::UpdateEdpDataPackageLockStateActivity::StartActivity ((UpdateEdpDataPackageLockStateActivity *)local_188); local_1f4 = 0; - lVar5 = UserAwareCallerIdentity::GetCallingProcessId(&local_1f4); - if (lVar5 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x198, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); - } + lVar6 = UserAwareCallerIdentity::GetCallingProcessId(&local_1f4); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1a4, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + local_1f0 = (ushort *)0x0; + bVar4 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar4) { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_1f0,(ushort *)0x0); + lVar6 = GetEnterpriseIdOfContentInternal(this,&local_1f0); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1a9, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + } + else { + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_1f0,(ushort *)0x0); + lVar6 = GetEnterpriseIdOfContent(this,&local_1f0); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1ad, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + } + local_1c8 = (HWND__ *)0x0; + lVar6 = CallerIdentity::GetCoreWindowHandleForCallingThread(&local_1c8); + if (lVar6 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x1b2, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + uVar2 = local_1f4; local_1d0 = (ushort *)0x0; - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_1d0,(ushort *)0x0); - lVar5 = GetEnterpriseIdOfContent(this,&local_1d0); - if (lVar5 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x19b, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); - } - local_1c8 = (HWND__ *)0x0; - lVar5 = CallerIdentity::GetCoreWindowHandleForCallingThread(&local_1c8); - if (lVar5 < 0) { - wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x19f, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); - } - uVar2 = local_1f4; - local_1d8 = (ushort *)0x0; - iVar4 = EdpGetAppLockerUniqueAppIdentifier(local_1f4); - if (iVar4 < 0) { - wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x1a3, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); - } - local_1e8 = (ushort *)0x0; - lVar1 = *(longlong *)(this + 200); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_1e8,(ushort *)0x0); - lVar5 = DataPackageViewMUX::GetSourceAppId((DataPackageViewMUX *)(lVar1 + 0x20),&local_1e8); - if (lVar5 < 0) { - wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x1a6, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); + iVar5 = EdpGetAppLockerUniqueAppIdentifier(local_1f4); + if (iVar5 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x1b6, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar5); } local_1e0 = (ushort *)0x0; lVar1 = *(longlong *)(this + 200); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> *)&local_1e0,(ushort *)0x0); - lVar5 = DataPackageViewMUX::GetDataInfo((DataPackageViewMUX *)(lVar1 + 0x20),2,&local_1e0); - if (lVar5 < 0) { - wil::details::in1diag3::_Log_Hr - (unaff_retaddr,0x1a9, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); - } - local_1f0 = 0; + lVar6 = DataPackageViewMUX::GetSourceAppId((DataPackageViewMUX *)(lVar1 + 0x20),&local_1e0); + if (lVar6 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x1b9, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + local_1d8 = (ushort *)0x0; + lVar1 = *(longlong *)(this + 200); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_1d8,(ushort *)0x0); + lVar6 = DataPackageViewMUX::GetDataInfo((DataPackageViewMUX *)(lVar1 + 0x20),2,&local_1d8); + if (lVar6 < 0) { + wil::details::in1diag3::_Log_Hr + (unaff_retaddr,0x1bc, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); + } + local_1e8 = 0; if (local_1c8 == (HWND__ *)0x0) { - iVar4 = EdpGetContextForProcess(uVar2,&local_1f0); - if (iVar4 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1b3, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); + iVar5 = EdpGetContextForProcess(uVar2,&local_1e8); + if (iVar5 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1c6, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar5); } } else { - iVar4 = EdpGetContextForWindow(); - if (iVar4 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1af, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); - } - } - puVar3 = local_1d0; + iVar5 = EdpGetContextForWindow(); + if (iVar5 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1c2, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar5); + } + } + puVar3 = local_1f0; local_1f8[0] = false; - lVar5 = EDPPolicyManager::EvaluateClipboardReadPolicy - ((EDPPolicyManager *)(this + 0xd8),local_1d0,local_1e8,local_1d8,local_1e0, - uVar2,*(ushort **)(local_1f0 + 8),0,local_1c8,local_1f8); - local_1b8 = local_1d8; - local_1b0 = local_1e8; + lVar6 = EDPPolicyManager::EvaluateClipboardReadPolicy + ((EDPPolicyManager *)(this + 0xd8),local_1f0,local_1e0,local_1d0,local_1d8, + uVar2,*(ushort **)(local_1e8 + 8),0,local_1c8,local_1f8); + local_1b8 = local_1d0; + local_1b0 = local_1e0; local_1a8 = puVar3; ClipboardTracing::UpdateEdpDataPackageLockStateActivity:: ReadPolicyEvaluation ((UpdateEdpDataPackageLockStateActivity *)local_188,&local_1a8,&local_1b0,&local_1b8, &local_1f4,local_1f8); - if (lVar5 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1c4, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1d7, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); } local_1c0 = (longlong *)0x0; - iVar4 = (*(code *)**(undefined8 **)param_1) + iVar5 = (*(code *)**(undefined8 **)param_1) (param_1,&_GUID_6f9bf6c5_569e_4980_b12a_596a08bef5a8,&local_1c0); - if (iVar4 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1c9, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); + if (iVar5 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1dc, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar5); } local_1a0.Data1 = 0; local_1a0.Data2 = 0; local_1a0.Data3 = 0; local_1a0.Data4[0] = '\0'; local_1a0.Data4[1] = '\0'; local_1a0.Data4[2] = '\0'; local_1a0.Data4[3] = '\0'; local_1a0.Data4[4] = '\0'; local_1a0.Data4[5] = '\0'; local_1a0.Data4[6] = '\0'; local_1a0.Data4[7] = '\0'; - iVar4 = (**(code **)(*local_1c0 + 0x40))(local_1c0,&local_1a0); - if (iVar4 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1cc, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); + iVar5 = (**(code **)(*local_1c0 + 0x40))(local_1c0,&local_1a0); + if (iVar5 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1df, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar5); } if (local_1f8[0] == false) { - lVar5 = LockDataPackage(this + 0x78,&local_1a0,uVar2); - if (lVar5 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1d4, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); + lVar6 = LockDataPackage(this + 0x78,&local_1a0,uVar2); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1e7, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); } } else { - lVar5 = UnlockDataPackage(this + 0x78,&local_1a0,uVar2); - if (lVar5 < 0) { - /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x1d0, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar5); + lVar6 = UnlockDataPackage(this + 0x78,&local_1a0,uVar2); + if (lVar6 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x1e3, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar6); } } wil:: ActivityBase ::Stop((ActivityBase *)local_188,0); wil::com_ptr_t:: ~com_ptr_t ((com_ptr_t *)&local_1c0); wil::details:: unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_EDP_CONTEXT*___ptr64,struct_EDP_CONTEXT*___ptr64,0,std::nullptr_t>_> - *)&local_1f0); + *)&local_1e8); + wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_1d8); wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> *)&local_1e0); wil::details:: + unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> + *)&local_1d0); + wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_1e8); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_1d8); - wil::details:: - unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_1d0); + *)&local_1f0); ClipboardTracing::UpdateEdpDataPackageLockStateActivity::~UpdateEdpDataPackageLockStateActivity ((UpdateEdpDataPackageLockStateActivity *)local_188); } return; } ``` ## wil::details_abi::ProcessLocalStorageData::Acquire ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.63| |i_ratio|0.65| |m_ratio|0.93| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|Acquire|Acquire| |fullname|wil::details_abi::ProcessLocalStorageData::Acquire|wil::details_abi::ProcessLocalStorageData::Acquire| |refcount|2|2| |`length`|432|364| |`called`|
Expand for full list:
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW
StringCchPrintfW
__security_check_cookie
wil::details::GetLastErrorFailHr
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::TryGetValueInternalwil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire
|
Expand for full list:
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW
StringCchPrintfW
__security_check_cookie
wil::details::GetLastErrorFailHr
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::TryGetPointerwil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire
| |calling|wil::details_abi::GetThreadLocalDataCache|wil::details_abi::GetThreadLocalDataCache| |paramcount|2|2| |`address`|18000a1d0|18000a2c0| |sig|long __cdecl Acquire(char * param_1, ProcessLocalStorageData * * param_2)|long __cdecl Acquire(char * param_1, ProcessLocalStorageData * * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::ProcessLocalStorageData::Acquire Called Diff ```diff --- wil::details_abi::ProcessLocalStorageData::Acquire called +++ wil::details_abi::ProcessLocalStorageData::Acquire called @@ -11 +11 @@ -wil::details_abi::SemaphoreValue::TryGetValueInternal +wil::details_abi::SemaphoreValue::TryGetPointer ``` ### wil::details_abi::ProcessLocalStorageData::Acquire Diff ```diff --- wil::details_abi::ProcessLocalStorageData::Acquire +++ wil::details_abi::ProcessLocalStorageData::Acquire @@ -1,102 +1,94 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: static long __cdecl wil::details_abi::ProcessLocalStorageData::Acquire(char const * __ptr64,class wil::details_abi::ProcessLocalStorageData * __ptr64 * __ptr64) */ long __cdecl wil::details_abi::ProcessLocalStorageData::Acquire (char *param_1, ProcessLocalStorageData **param_2) { - ProcessLocalStorageData *pPVar1; - DWORD DVar2; - long lVar3; - HANDLE pvVar4; - uint uVar5; - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *puVar6; - ulong uVar7; - bool *pbVar8; + DWORD DVar1; + long lVar2; + HANDLE pvVar3; + uint uVar4; + ulong uVar5; + int iVar6; void *unaff_retaddr; undefined1 auStack_278 [32]; undefined4 local_258; char *local_250; longlong local_248; unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> local_240 [8]; - __uint64 local_238 [2]; + ProcessLocalStorageData *local_238 [2]; WCHAR local_228 [264]; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStack_278; *param_2 = (ProcessLocalStorageData *)0x0; - DVar2 = GetCurrentProcessId(); + DVar1 = GetCurrentProcessId(); local_258 = 0x78; local_250 = param_1; - StringCchPrintfW((ushort *)local_228,0x104,(ushort *)L"Local\\SM0:%lu:%lu:%hs",(ulonglong)DVar2); + StringCchPrintfW((ushort *)local_228,0x104,(ushort *)L"Local\\SM0:%lu:%lu:%hs",(ulonglong)DVar1); local_248 = 0; - pbVar8 = (bool *)0x1f0001; - uVar7 = 0; - pvVar4 = CreateMutexExW((LPSECURITY_ATTRIBUTES)0x0,local_228,0,0x1f0001); + iVar6 = 0x1f0001; + uVar5 = 0; + pvVar3 = CreateMutexExW((LPSECURITY_ATTRIBUTES)0x0,local_228,0,0x1f0001); details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ::reset((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_248,pvVar4); + *)&local_248,pvVar3); if (local_248 == 0) { - lVar3 = details::GetLastErrorFailHr(); + lVar2 = details::GetLastErrorFailHr(); goto LAB_0; } - puVar6 = local_240; mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> ::acquire((mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> - *)&local_248,(ulong *)puVar6,uVar7,(int)pbVar8); - local_238[0] = 0; - lVar3 = SemaphoreValue::TryGetValueInternal((ushort *)local_228,SUB81(puVar6,0),local_238,pbVar8); - if (lVar3 < 0) { - details::in1diag3::Return_Hr(unaff_retaddr,100,"wil",lVar3); - details::in1diag3::Return_Hr(unaff_retaddr,0x6d,"wil",lVar3); - uVar5 = 299; + *)&local_248,(ulong *)local_240,uVar5,iVar6); + local_238[0] = (ProcessLocalStorageData *)0x0; + lVar2 = SemaphoreValue::TryGetPointer((ushort *)local_228,local_238); + if (lVar2 < 0) { + uVar4 = 299; LAB_1: - details::in1diag3::Return_Hr(unaff_retaddr,uVar5,"wil",lVar3); + details::in1diag3::Return_Hr(unaff_retaddr,uVar4,"wil",lVar2); details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> (local_240); } else { - pPVar1 = (ProcessLocalStorageData *) - (local_238[0] * 4); - if (pPVar1 == (ProcessLocalStorageData *)0x0) { - lVar3 = MakeAndInitialize((ushort *)local_228, + if (local_238[0] == (ProcessLocalStorageData *)0x0) { + lVar2 = MakeAndInitialize((ushort *)local_228, (unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> *)&local_248,param_2); - if (lVar3 < 0) { - uVar5 = 0x134; + if (lVar2 < 0) { + uVar4 = 0x134; goto LAB_1; } } else { - *param_2 = pPVar1; - *(int *)*param_2 = *(int *)pPVar1 + 1; + *param_2 = local_238[0]; + *(int *)*param_2 = *(int *)local_238[0] + 1; } details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> (local_240); - lVar3 = 0; + lVar2 = 0; } LAB_0: details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> *)&local_248); - return lVar3; + return lVar2; } ``` ## ClipboardServer::GetEnterpriseIdOfContent ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.1| |m_ratio|0.51| |b_ratio|0.34| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetEnterpriseIdOfContent|GetEnterpriseIdOfContent| |fullname|ClipboardServer::GetEnterpriseIdOfContent|ClipboardServer::GetEnterpriseIdOfContent| |refcount|5|5| |`length`|57|171| |`called`|EDPPolicyManager::GetEnterpriseIdFromDataPackage
wil::details::in1diag3::_Throw_Hr|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
ClipboardServer::GetEnterpriseIdOfContentInternal
EDPPolicyManager::GetEnterpriseIdFromDataPackage
Microsoft::WRL::Wrappers::SRWLock::LockShared
wil::details::FeatureImpl::__private_IsEnabled
wil::details::in1diag3::_Throw_Hr| |calling|ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState|ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState| |paramcount|2|2| |`address`|180010f10|180012120| |sig|long __thiscall GetEnterpriseIdOfContent(ClipboardServer * this, ushort * * param_1)|long __thiscall GetEnterpriseIdOfContent(ClipboardServer * this, ushort * * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::GetEnterpriseIdOfContent Called Diff ```diff --- ClipboardServer::GetEnterpriseIdOfContent called +++ ClipboardServer::GetEnterpriseIdOfContent called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared +ClipboardServer::GetEnterpriseIdOfContentInternal @@ -1,0 +4,2 @@ +Microsoft::WRL::Wrappers::SRWLock::LockShared +wil::details::FeatureImpl::__private_IsEnabled ``` ### ClipboardServer::GetEnterpriseIdOfContent Diff ```diff --- ClipboardServer::GetEnterpriseIdOfContent +++ ClipboardServer::GetEnterpriseIdOfContent @@ -1,21 +1,44 @@ /* public: virtual long __cdecl ClipboardServer::GetEnterpriseIdOfContent(unsigned short * __ptr64 * __ptr64) __ptr64 */ long __thiscall ClipboardServer::GetEnterpriseIdOfContent(ClipboardServer *this,ushort **param_1) { - long lVar1; + bool bVar1; + long lVar2; + FeatureImpl *this_00; void *unaff_retaddr; + _RTL_SRWLOCK local_res18 [2]; - lVar1 = EDPPolicyManager::GetEnterpriseIdFromDataPackage - ((EDPPolicyManager *)this,*(DataPackageViewMUX **)(this + 200),param_1); - if (lVar1 < 0) { + this_00 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + Microsoft::WRL::Wrappers::SRWLock::LockShared(local_res18); + lVar2 = GetEnterpriseIdOfContentInternal(this,param_1); + if (lVar2 < 0) { /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x269,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp" - ,lVar1); + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x27e, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar2); + } + if (local_res18[0].Ptr != (PSRWLOCK)0x0) { + ReleaseSRWLockShared(local_res18[0].Ptr); + } + } + else { + lVar2 = EDPPolicyManager::GetEnterpriseIdFromDataPackage + ((EDPPolicyManager *)this_00,*(DataPackageViewMUX **)(this + 200),param_1); + if (lVar2 < 0) { + /* WARNING: Subroutine does not return */ + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0x282, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar2); + } } return 0; } ``` ## ClipboardServer::SubscribeToMDMPolicyChange ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,calling,called| |ratio|0.69| |i_ratio|0.53| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|SubscribeToMDMPolicyChange|SubscribeToMDMPolicyChange| |fullname|ClipboardServer::SubscribeToMDMPolicyChange|ClipboardServer::SubscribeToMDMPolicyChange| |refcount|2|2| |`length`|250|248| |`called`|EXT-MS-WIN-DEVMGMT-POLICY-L1-1-0.DLL::PolicyManager_GetExperiencePolicy_AllowCopyPaste
IsPolicyManager_GetExperiencePolicy_AllowCopyPastePresent
__security_check_cookie
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>
wil::make_wnf_subscription_nothrow
wil::unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_>::operator=
wistd::function::~function|EXT-MS-WIN-DEVMGMT-POLICY-L1-1-0.DLL::PolicyManager_GetExperiencePolicy_AllowCopyPaste
IsPolicyManager_GetExperiencePolicy_AllowCopyPastePresent
__security_check_cookie
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>
wil::make_wnf_subscription_nothrow
wil::unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_>::operator=
wistd::function::~function
wistd::function::function<,void>
wistd::unique_ptr::unique_ptr<1,void>| |`calling`|::operator()|::operator()| |paramcount|1|1| |`address`|180016ae4|180019640| |sig|void __thiscall SubscribeToMDMPolicyChange(ClipboardServer * this)|void __thiscall SubscribeToMDMPolicyChange(ClipboardServer * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::SubscribeToMDMPolicyChange Called Diff ```diff --- ClipboardServer::SubscribeToMDMPolicyChange called +++ ClipboardServer::SubscribeToMDMPolicyChange called @@ -8 +8,3 @@ -wistd::function::~function +wistd::function::~function +wistd::function::function<,void> +wistd::unique_ptr::unique_ptr<1,void> ``` ### ClipboardServer::SubscribeToMDMPolicyChange Calling Diff ```diff --- ClipboardServer::SubscribeToMDMPolicyChange calling +++ ClipboardServer::SubscribeToMDMPolicyChange calling @@ -1 +1 @@ -::operator() +::operator() ``` ### ClipboardServer::SubscribeToMDMPolicyChange Diff ```diff --- ClipboardServer::SubscribeToMDMPolicyChange +++ ClipboardServer::SubscribeToMDMPolicyChange @@ -1,58 +1,64 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: void __cdecl ClipboardServer::SubscribeToMDMPolicyChange(void) __ptr64 */ void __thiscall ClipboardServer::SubscribeToMDMPolicyChange(ClipboardServer *this) { undefined4 uVar1; int iVar2; unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_> *puVar3; void *unaff_retaddr; undefined1 auStack_b8 [32]; - _WNF_STATE_NAME local_98 [8]; - function local_90 [8]; - undefined **local_88; - ClipboardServer *local_80; - undefined ***local_20; + undefined8 local_98; + function + local_90 [120]; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStack_b8; uVar1 = IsPolicyManager_GetExperiencePolicy_AllowCopyPastePresent(); if ((char)uVar1 != '\0') { iVar2 = PolicyManager_GetExperiencePolicy_AllowCopyPaste(this + 0x148); if (iVar2 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x221, + (unaff_retaddr,0x234, "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); } - local_88 = &PTR__scalar_deleting_destructor__1800246b0; - local_20 = &local_88; - local_80 = this; + wistd::unique_ptr:: + unique_ptr<1,void> + ((unique_ptr *)&local_98,this); + wistd::function:: + function<,void> + ((longlong)local_90,local_98); puVar3 = (unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_> *)wil::make_wnf_subscription_nothrow - (local_98,(function *) - &WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED,(ulong)local_90); + ((_WNF_STATE_NAME *)&local_98, + (function *)&WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED + ,(ulong)local_90); wil:: unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_> ::operator=((unique_any_t,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>_> *)(this + 0x140),puVar3); wil::details:: unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_> - *)local_98); - wistd::function::~function(local_90); + *)&local_98); + wistd:: + function + :: + ~function + (local_90); if (*(longlong *)(this + 0x140) == 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x22e, + (unaff_retaddr,0x241, "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",-0x7fff0001); } } return; } ``` ## wil::details::in1diag3::_FailFast_Unexpected ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.8| |i_ratio|0.67| |m_ratio|0.83| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|_FailFast_Unexpected|_FailFast_Unexpected| |fullname|wil::details::in1diag3::_FailFast_Unexpected|wil::details::in1diag3::_FailFast_Unexpected| |`refcount`|3|4| |`length`|39|27| |called|wil::details::ReportFailure_Hr<3>|wil::details::ReportFailure_Hr<3>| |`calling`|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::details_abi::RawUsageIndex::SetBuffer
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |paramcount|3|3| |`address`|18001e780|18001abb4| |`sig`|void __cdecl _FailFast_Unexpected(void * param_1, uint param_2, char * param_3)|noreturn void __cdecl _FailFast_Unexpected(void * param_1, uint param_2, char * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::in1diag3::_FailFast_Unexpected Calling Diff ```diff --- wil::details::in1diag3::_FailFast_Unexpected calling +++ wil::details::in1diag3::_FailFast_Unexpected calling @@ -0,0 +1 @@ +wil::details_abi::RawUsageIndex::SetBuffer ``` ### wil::details::in1diag3::_FailFast_Unexpected Diff ```diff --- wil::details::in1diag3::_FailFast_Unexpected +++ wil::details::in1diag3::_FailFast_Unexpected @@ -1,16 +1,16 @@ /* void __cdecl wil::details::in1diag3::_FailFast_Unexpected(void * __ptr64,unsigned int,char const * __ptr64) */ void __cdecl wil::details::in1diag3::_FailFast_Unexpected(void *param_1,uint param_2,char *param_3) { char *in_R9; void *unaff_retaddr; char *in_stack_ffffffffffffffd8; /* WARNING: Subroutine does not return */ - ReportFailure_Hr<3>(param_1,0xdbf,"onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", - in_R9,in_stack_ffffffffffffffd8,unaff_retaddr,-0x7fff0001); + ReportFailure_Hr<3>(param_1,param_2,param_3,in_R9,in_stack_ffffffffffffffd8,unaff_retaddr, + -0x7fff0001); } ``` ## wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.55| |i_ratio|0.82| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |fullname|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |refcount|2|2| |`length`|168|179| |called|API-MS-WIN-CORE-COM-L1-1-0.DLL::CoTaskMemAlloc
MSVCRT.DLL::memcpy_s
wil::details::in1diag3::_FailFast_Unexpected|API-MS-WIN-CORE-COM-L1-1-0.DLL::CoTaskMemAlloc
MSVCRT.DLL::memcpy_s
wil::details::in1diag3::_FailFast_Unexpected| |calling|wil::make_unique_string,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::make_unique_string,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |paramcount|2|2| |`address`|18001d76c|18002164c| |sig|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> Diff ```diff --- wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> +++ wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> @@ -1,49 +1,45 @@ /* class wil::unique_any_t,unsigned short * __ptr64,unsigned short * __ptr64,0,std::nullptr_t> > > __cdecl wil::make_unique_string_nothrow,unsigned short * __ptr64,unsigned short * __ptr64,0,std::nullptr_t> > > >(unsigned short const * __ptr64,unsigned __int64) */ ushort * __cdecl wil:: make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> (ushort *param_1,__uint64 param_2) { - code *pcVar1; rsize_t _MaxCount; - ushort *puVar2; - short *psVar3; + short *psVar1; LPVOID _Dst; - longlong lVar4; - char *in_R8; + longlong lVar2; void *unaff_retaddr; if (param_2 == 0) { - details::in1diag3::_FailFast_Unexpected(unaff_retaddr,0,in_R8); - pcVar1 = (code *)swi(3); - puVar2 = (ushort *)(*pcVar1)(); - return puVar2; + /* WARNING: Subroutine does not return */ + details::in1diag3::_FailFast_Unexpected + (unaff_retaddr,0xdbf,"onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h"); } - lVar4 = 0x7fffffff; - psVar3 = (short *)param_2; + lVar2 = 0x7fffffff; + psVar1 = (short *)param_2; do { - if (*psVar3 == 0) break; - psVar3 = psVar3 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); - _MaxCount = ((longlong)((longlong)psVar3 - param_2) >> 1) * 2; + if (*psVar1 == 0) break; + psVar1 = psVar1 + 1; + lVar2 = lVar2 + -1; + } while (lVar2 != 0); + _MaxCount = ((longlong)((longlong)psVar1 - param_2) >> 1) * 2; _Dst = CoTaskMemAlloc(_MaxCount + 2); if (_Dst != (LPVOID)0x0) { memcpy_s(_Dst,_MaxCount + 2,(void *)param_2,_MaxCount); *(undefined2 *)(_MaxCount + (longlong)_Dst) = 0; } *(LPVOID *)param_1 = _Dst; return param_1; } ``` ## ClipboardServer::GetContentInternal ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.46| |i_ratio|0.42| |m_ratio|0.9| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetContentInternal|GetContentInternal| |fullname|ClipboardServer::GetContentInternal|ClipboardServer::GetContentInternal| |refcount|3|3| |`length`|321|385| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardTracing::GetContentInternalActivity::GetContentDetails
ClipboardTracing::GetContentInternalActivity::StartActivity
ClipboardTracing::GetContentInternalActivity::~GetContentInternalActivity
Microsoft::WRL::Wrappers::SRWLock::LockShared
UserAwareCallerIdentity::GetCallingProcessAppId
__security_check_cookie
wil::ActivityBase::ActivityBase
wil::ActivityBase::Stop
wil::com_ptr_t::copy_towil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardTracing::GetContentInternalActivity::GetContentDetails
ClipboardTracing::GetContentInternalActivity::StartActivity
ClipboardTracing::GetContentInternalActivity::~GetContentInternalActivity
Microsoft::WRL::Wrappers::SRWLock::LockShared
UserAwareCallerIdentity::GetCallingProcessAppId
__security_check_cookie
wil::ActivityBase::ActivityBase
wil::ActivityBase::Stop
wil::com_ptr_t::copy_towil::details::FeatureImpl::__private_IsEnabled
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>
| |calling|ClipboardServer::GetContent
ClipboardServer::HasTextData|ClipboardServer::GetContent
ClipboardServer::HasTextData| |paramcount|1|1| |`address`|180010dac|180011ebc| |sig|com_ptr_t __thiscall GetContentInternal(ClipboardServer * this)|com_ptr_t __thiscall GetContentInternal(ClipboardServer * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::GetContentInternal Called Diff ```diff --- ClipboardServer::GetContentInternal called +++ ClipboardServer::GetContentInternal called @@ -11,0 +12 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### ClipboardServer::GetContentInternal Diff ```diff --- ClipboardServer::GetContentInternal +++ ClipboardServer::GetContentInternal @@ -1,66 +1,85 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: class wil::com_ptr_t __cdecl ClipboardServer::GetContentInternal(void) __ptr64 */ void __thiscall ClipboardServer::GetContentInternal(ClipboardServer *this) { + ushort *puVar1; + bool bVar2; IDataPackageView **in_RDX; bool in_R8B; - undefined1 auStack_1b8 [32]; - PSRWLOCK local_198; - undefined4 local_190; - _RTL_SRWLOCK local_188; - ushort *local_180 [3]; - undefined **local_168 [42]; - ulonglong local_18; + undefined1 auStack_1c8 [32]; + ushort *local_1a8; + undefined4 local_1a0; + ushort *local_198; + ushort *local_190; + _RTL_SRWLOCK local_188 [2]; + undefined **local_178 [42]; + ulonglong local_28; - local_18 = __security_cookie ^ (ulonglong)auStack_1b8; - local_190 = 0; + local_28 = __security_cookie ^ (ulonglong)auStack_1c8; + local_1a0 = 0; wil:: ActivityBase:: ActivityBase ((ActivityBase - *)local_168,"GetContentInternalActivity",in_R8B); - local_168[0] = &ClipboardTracing::GetContentInternalActivity::_vftable_; + *)local_178,"GetContentInternalActivity",in_R8B); + local_178[0] = &ClipboardTracing::GetContentInternalActivity::_vftable_; ClipboardTracing::GetContentInternalActivity::StartActivity - ((GetContentInternalActivity *)local_168); - local_198 = (PSRWLOCK)0x0; + ((GetContentInternalActivity *)local_178); + local_1a8 = (ushort *)0x0; wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ::reset((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_198,(ushort *)0x0); - UserAwareCallerIdentity::GetCallingProcessAppId((ushort **)&local_198); - local_180[0] = *(ushort **)(this + 0x100); - local_188.Ptr = local_198; - ClipboardTracing::GetContentInternalActivity:: - GetContentDetails - ((GetContentInternalActivity *)local_168,&local_188.Ptr,local_180); - Microsoft::WRL::Wrappers::SRWLock::LockShared(&local_188); - local_190 = 1; + *)&local_1a8,(ushort *)0x0); + UserAwareCallerIdentity::GetCallingProcessAppId(&local_1a8); + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + puVar1 = local_1a8; + if (!bVar2) { + local_198 = *(ushort **)(this + 0x100); + local_190 = local_1a8; + ClipboardTracing::GetContentInternalActivity:: + GetContentDetails + ((GetContentInternalActivity *)local_178,&local_190,&local_198); + } + Microsoft::WRL::Wrappers::SRWLock::LockShared(local_188); + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + local_190 = *(ushort **)(this + 0x100); + local_198 = puVar1; + ClipboardTracing::GetContentInternalActivity:: + GetContentDetails + ((GetContentInternalActivity *)local_178,&local_198,&local_190); + } + local_1a0 = 1; *in_RDX = (IDataPackageView *)0x0; wil::com_ptr_t:: copy_to ((com_ptr_t *)(this + 200), in_RDX); UpdateEdpDataPackageLockState(this,*in_RDX); wil:: ActivityBase:: Stop((ActivityBase - *)local_168,0); - if (local_188.Ptr != (PSRWLOCK)0x0) { - ReleaseSRWLockShared(local_188.Ptr); + *)local_178,0); + if (local_188[0].Ptr != (PSRWLOCK)0x0) { + ReleaseSRWLockShared(local_188[0].Ptr); } wil::details:: unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> ((unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> - *)&local_198); + *)&local_1a8); ClipboardTracing::GetContentInternalActivity::~GetContentInternalActivity - ((GetContentInternalActivity *)local_168); + ((GetContentInternalActivity *)local_178); return; } ``` ## wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.55| |i_ratio|0.82| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |fullname|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |refcount|5|5| |`length`|161|172| |called|MSVCRT.DLL::memcpy_s
wil::details::heap_allocator::allocate
wil::details::in1diag3::_FailFast_Unexpected|MSVCRT.DLL::memcpy_s
wil::details::heap_allocator::allocate
wil::details::in1diag3::_FailFast_Unexpected| |calling|::operator()|::operator()| |paramcount|2|2| |`address`|18001d81c|180021708| |sig|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)|unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_> __cdecl make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>(ushort * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> Diff ```diff --- wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> +++ wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> @@ -1,49 +1,45 @@ /* class wil::unique_any_t,unsigned short * __ptr64,unsigned short * __ptr64,0,std::nullptr_t> > > __cdecl wil::make_unique_string_nothrow,unsigned short * __ptr64,unsigned short * __ptr64,0,std::nullptr_t> > > >(unsigned short const * __ptr64,unsigned __int64) */ ushort * __cdecl wil:: make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_> (ushort *param_1,__uint64 param_2) { - code *pcVar1; rsize_t _MaxCount; - ushort *puVar2; - short *psVar3; + short *psVar1; void *_Dst; - longlong lVar4; - char *in_R8; + longlong lVar2; void *unaff_retaddr; if (param_2 == 0) { - details::in1diag3::_FailFast_Unexpected(unaff_retaddr,0,in_R8); - pcVar1 = (code *)swi(3); - puVar2 = (ushort *)(*pcVar1)(); - return puVar2; + /* WARNING: Subroutine does not return */ + details::in1diag3::_FailFast_Unexpected + (unaff_retaddr,0xdbf,"onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h"); } - lVar4 = 0x7fffffff; - psVar3 = (short *)param_2; + lVar2 = 0x7fffffff; + psVar1 = (short *)param_2; do { - if (*psVar3 == 0) break; - psVar3 = psVar3 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); - _MaxCount = ((longlong)((longlong)psVar3 - param_2) >> 1) * 2; + if (*psVar1 == 0) break; + psVar1 = psVar1 + 1; + lVar2 = lVar2 + -1; + } while (lVar2 != 0); + _MaxCount = ((longlong)((longlong)psVar1 - param_2) >> 1) * 2; _Dst = details::heap_allocator::allocate(_MaxCount + 2); if (_Dst != (void *)0x0) { memcpy_s(_Dst,_MaxCount + 2,(void *)param_2,_MaxCount); *(undefined2 *)(_MaxCount + (longlong)_Dst) = 0; } *(void **)param_1 = _Dst; return param_1; } ``` ## wil_details_GetKernelBaseProcAddress ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling| |ratio|0.94| |i_ratio|0.49| |m_ratio|0.93| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|wil_details_GetKernelBaseProcAddress|wil_details_GetKernelBaseProcAddress| |fullname|wil_details_GetKernelBaseProcAddress|wil_details_GetKernelBaseProcAddress| |`refcount`|2|3| |`length`|85|93| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress| |`calling`|wil::details::WilFailureNotifyWatchers|wil::details::WilFailureNotifyWatchers
wil_StagingConfig_LogStagedFeatureUsage| |paramcount|1|1| |`address`|18000c418|18000c5a8| |sig|_func___int64 * __cdecl wil_details_GetKernelBaseProcAddress(char * param_1)|_func___int64 * __cdecl wil_details_GetKernelBaseProcAddress(char * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil_details_GetKernelBaseProcAddress Calling Diff ```diff --- wil_details_GetKernelBaseProcAddress calling +++ wil_details_GetKernelBaseProcAddress calling @@ -1,0 +2 @@ +wil_StagingConfig_LogStagedFeatureUsage ``` ### wil_details_GetKernelBaseProcAddress Diff ```diff --- wil_details_GetKernelBaseProcAddress +++ wil_details_GetKernelBaseProcAddress @@ -1,21 +1,21 @@ /* __int64 (__cdecl*__cdecl wil_details_GetKernelBaseProcAddress(char const * __ptr64))(void) */ _func___int64 * __cdecl wil_details_GetKernelBaseProcAddress(char *param_1) { FARPROC pFVar1; if ((`__int64_(__cdecl*__cdecl_wil_details_GetKernelBaseProcAddress(char_const*___ptr64))(void)':: __l2::wil_details_kernelbaseModuleHandle == (HINSTANCE__ *)0x0) && (`__int64_(__cdecl*__cdecl_wil_details_GetKernelBaseProcAddress(char_const*___ptr64))(void)':: __l2::wil_details_kernelbaseModuleHandle = GetModuleHandleW(L"kernelbase.dll"), `__int64_(__cdecl*__cdecl_wil_details_GetKernelBaseProcAddress(char_const*___ptr64))(void)':: __l2::wil_details_kernelbaseModuleHandle == (HMODULE)0x0)) { return (_func___int64 *)0x0; } pFVar1 = GetProcAddress(`__int64_(__cdecl*__cdecl_wil_details_GetKernelBaseProcAddress(char_const*___ptr64))(void)' - ::__l2::wil_details_kernelbaseModuleHandle,"WilFailureNotifyWatchers"); + ::__l2::wil_details_kernelbaseModuleHandle,param_1); return (_func___int64 *)pFVar1; } ``` ## ClipboardServer::RegisterOsTaskCompletionIfRequired ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.68| |i_ratio|0.61| |m_ratio|1.0| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|RegisterOsTaskCompletionIfRequired|RegisterOsTaskCompletionIfRequired| |fullname|ClipboardServer::RegisterOsTaskCompletionIfRequired|ClipboardServer::RegisterOsTaskCompletionIfRequired| |refcount|2|2| |`length`|695|688| |`called`|
Expand for full list:
CCrashDetector::StopMonitoring
CCrashDetector::_TakeOwnershipOfHandleAndStartMonitoring
ClipboardServer::UnregisterOsTaskCompletion
ClipboardTracing::RegisterOSTaskCompletionActivity::StartActivity
ClipboardTracing::RegisterOSTaskCompletionActivity::TaskCompletionDetails
ClipboardTracing::RegisterOSTaskCompletionActivity::~RegisterOSTaskCompletionActivity
IsAnyFormatDelayRendered
Microsoft::WRL::Wrappers::Details::SyncLockExclusive::InternalUnlock
Microsoft::WRL::Wrappers::SRWLock::LockExclusive
UserAwareCallerIdentity::GetCallingProcessHandle
UserAwareCallerIdentity::GetCallingProcessId__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
operator_new
wil::ActivityBase::Stop
wil::ActivityBase::ActivityBase
wil::com_ptr_t::~com_ptr_t
wil::com_ptr_t::query
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage_>::reset
wil::details::unique_storage_>::~unique_storage_>
|
Expand for full list:
::
CCrashDetector::StopMonitoring
CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_>
ClipboardServer::UnregisterOsTaskCompletion
ClipboardTracing::RegisterOSTaskCompletionActivity::StartActivity
ClipboardTracing::RegisterOSTaskCompletionActivity::TaskCompletionDetails
ClipboardTracing::RegisterOSTaskCompletionActivity::~RegisterOSTaskCompletionActivity
IsAnyFormatDelayRendered
Microsoft::WRL::Wrappers::Details::SyncLockExclusive::InternalUnlock
Microsoft::WRL::Wrappers::SRWLock::LockExclusive
UserAwareCallerIdentity::GetCallingProcessHandleUserAwareCallerIdentity::GetCallingProcessId
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::ActivityBase::Stop
wil::ActivityBase::ActivityBase
wil::ScopeExit<_>
wil::com_ptr_t::~com_ptr_t
wil::com_ptr_t::query
wil::details::ScopeExitFn<_>::~ScopeExitFn<_>
wil::details::in1diag3::_Throw_Hr
wil::details::unique_storage_>::reset
wil::details::unique_storage_>::~unique_storage_>
| |calling|ClipboardServer::SetContentInternal|ClipboardServer::SetContentInternal| |paramcount|3|3| |`address`|1800130e8|180015644| |sig|void __thiscall RegisterOsTaskCompletionIfRequired(ClipboardServer * this, IDataPackagePriv * param_1, bool param_2)|void __thiscall RegisterOsTaskCompletionIfRequired(ClipboardServer * this, IDataPackagePriv * param_1, bool param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::RegisterOsTaskCompletionIfRequired Called Diff ```diff --- ClipboardServer::RegisterOsTaskCompletionIfRequired called +++ ClipboardServer::RegisterOsTaskCompletionIfRequired called @@ -0,0 +1 @@ +:: @@ -2 +3 @@ -CCrashDetector::_TakeOwnershipOfHandleAndStartMonitoring +CCrashDetector::TakeOwnershipOfHandleAndStartMonitoring<_> @@ -14 +14,0 @@ -operator_new @@ -16,0 +17 @@ +wil::ScopeExit<_> @@ -18,0 +20 @@ +wil::details::ScopeExitFn<_>::~ScopeExitFn<_> ``` ### ClipboardServer::RegisterOsTaskCompletionIfRequired Diff ```diff --- ClipboardServer::RegisterOsTaskCompletionIfRequired +++ ClipboardServer::RegisterOsTaskCompletionIfRequired @@ -1,142 +1,140 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: void __cdecl ClipboardServer::RegisterOsTaskCompletionIfRequired(struct IDataPackagePriv * __ptr64,bool) __ptr64 */ void __thiscall ClipboardServer::RegisterOsTaskCompletionIfRequired (ClipboardServer *this,IDataPackagePriv *param_1,bool param_2) { longlong *plVar1; bool bVar2; - int iVar3; - long lVar4; - CHandler *pCVar5; - long lVar6; + long lVar3; + int iVar4; + undefined8 *puVar5; + void *pvVar6; void *unaff_retaddr; undefined1 auStack_1c8 [32]; void *local_1a8; longlong *local_1a0; longlong *local_198; - _RTL_SRWLOCK local_190; - longlong **local_188; - ClipboardServer *local_180; - undefined1 local_178; + _RTL_SRWLOCK local_190 [2]; + undefined8 local_180 [2]; + undefined1 local_170; undefined **local_168 [42]; ulonglong local_18; - void *pvVar7; local_18 = __security_cookie ^ (ulonglong)auStack_1c8; if (param_2) { bVar2 = IsAnyFormatDelayRendered(param_1); if (bVar2) { bVar2 = true; goto LAB_0; } } bVar2 = false; LAB_0: UnregisterOsTaskCompletion(this); if (bVar2) { wil:: ActivityBase :: ActivityBase ((ActivityBase *)local_168,"RegisterOSTaskCompletionActivity",param_2); local_168[0] = &ClipboardTracing::RegisterOSTaskCompletionActivity::_vftable_; ClipboardTracing::RegisterOSTaskCompletionActivity::StartActivity ((RegisterOSTaskCompletionActivity *)local_168); local_1a0 = (longlong *)0x0; - iVar3 = (**(code **)(**(longlong **)(this + 0x118) + 0x68)) + iVar4 = (**(code **)(**(longlong **)(this + 0x118) + 0x68)) (*(longlong **)(this + 0x118),&local_1a0); - if (iVar3 < 0) { + if (iVar4 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x489, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar3); + (unaff_retaddr,0x4b0, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); } wil::com_ptr_t:: query ((com_ptr_t *)&local_1a0); - local_188 = &local_198; - local_178 = 1; - local_180 = this; - iVar3 = (**(code **)(*local_198 + 0x18))(); - if (iVar3 < 0) { + puVar5 = :: + (local_190,&local_198,this); + wil::ScopeExit<_>(local_180,puVar5); + iVar4 = (**(code **)(*local_198 + 0x18))(); + if (iVar4 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x495, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar3); + (unaff_retaddr,0x4bc, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); } local_1a8 = (void *)0x0; wil::details:: unique_storage_> ::reset((unique_storage_> *)&local_1a8,(void *)0x0); - lVar4 = UserAwareCallerIdentity::GetCallingProcessHandle(0x100400,&local_1a8); - pvVar7 = local_1a8; - if (lVar4 < 0) { + lVar3 = UserAwareCallerIdentity::GetCallingProcessHandle(0x100400,&local_1a8); + pvVar6 = local_1a8; + if (lVar3 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x498, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); + (unaff_retaddr,0x4bf, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar3); } - iVar3 = (**(code **)(*local_1a0 + 0x20))(local_1a0,local_1a8,0x4000); - if (iVar3 < 0) { + iVar4 = (**(code **)(*local_1a0 + 0x20))(local_1a0,local_1a8,0x4000); + if (iVar4 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x499, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar3); + (unaff_retaddr,0x4c0, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); } local_1a8 = (void *)((ulonglong)local_1a8 & 0xffffffff00000000); UserAwareCallerIdentity::GetCallingProcessId((ulong *)&local_1a8); ClipboardTracing::RegisterOSTaskCompletionActivity:: TaskCompletionDetails ((RegisterOSTaskCompletionActivity *)local_168,(ulong *)&local_1a8); - Microsoft::WRL::Wrappers::SRWLock::LockExclusive(&local_190); + Microsoft::WRL::Wrappers::SRWLock::LockExclusive(local_190); plVar1 = *(longlong **)(this + 0x120); *(longlong **)(this + 0x120) = local_1a0; local_1a0 = plVar1; CCrashDetector::StopMonitoring((CCrashDetector *)(this + 0x128)); local_1a8 = (void *)0x0; - pCVar5 = operator_new(0x10,&std::nothrow); - if (pCVar5 != (CHandler *)0x0) { - *(undefined ***)pCVar5 = &PTR__scalar_deleting_destructor__1800246a0; - } - lVar4 = CCrashDetector::_TakeOwnershipOfHandleAndStartMonitoring - ((CCrashDetector *)(this + 0x128),pvVar7,pCVar5); - lVar6 = (long)pvVar7; - if (lVar4 < 0) { + iVar4 = CCrashDetector:: + TakeOwnershipOfHandleAndStartMonitoring<_> + ((CCrashDetector *)(this + 0x128),pvVar6); + lVar3 = (long)pvVar6; + if (iVar4 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0x4ab, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",lVar4); + (unaff_retaddr,0x4d2, + "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar4); } Microsoft::WRL::Wrappers::Details::SyncLockExclusive::InternalUnlock - ((SyncLockExclusive *)&local_190); + ((SyncLockExclusive *)local_190); + local_170 = 0; wil:: ActivityBase ::Stop((ActivityBase - *)local_168,lVar6); + *)local_168,lVar3); wil::details:: unique_storage_> :: ~unique_storage_> ((unique_storage_> *)&local_1a8); + wil::details::ScopeExitFn<_>:: + ~ScopeExitFn<_>(local_180); wil::com_ptr_t:: ~com_ptr_t ((com_ptr_t *)&local_198); wil::com_ptr_t:: ~com_ptr_t ((com_ptr_t *)&local_1a0); ClipboardTracing::RegisterOSTaskCompletionActivity::~RegisterOSTaskCompletionActivity ((RegisterOSTaskCompletionActivity *)local_168); } return; } ``` ## ClipboardServer::EnsureClipboardInitialized ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.55| |m_ratio|0.99| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|EnsureClipboardInitialized|EnsureClipboardInitialized| |fullname|ClipboardServer::EnsureClipboardInitialized|ClipboardServer::EnsureClipboardInitialized| |refcount|15|15| |`length`|147|148| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::InitOnceExecuteOnce
wil::details::in1diag3::_Throw_Hr|::operator_int_(__cdecl*)(_RTL_RUN_ONCE_*,void_*,void_*_*)
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::InitOnceExecuteOnce
wil::details::in1diag3::_Throw_Hr| |calling|
Expand for full list:
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetProcessIdFromUniqueId
ClipboardServer::GetTextData
ClipboardServer::HasTextData
ClipboardServer::IsDataPackageLocked
ClipboardServer::LockDataPackage
ClipboardServer::RequestAccessToReadContent
ClipboardServer::SetClipboardEnterpriseId
ClipboardServer::SetClipboardSourceAppId
ClipboardServer::SetClipboardSourceIsEdpAwareClipboardServer::SetContent
ClipboardServer::SetTextData
ClipboardServer::UnlockDataPackage
|
Expand for full list:
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetProcessIdFromUniqueId
ClipboardServer::GetTextData
ClipboardServer::HasTextData
ClipboardServer::IsDataPackageLocked
ClipboardServer::LockDataPackage
ClipboardServer::RequestAccessToReadContent
ClipboardServer::SetClipboardEnterpriseId
ClipboardServer::SetClipboardSourceAppId
ClipboardServer::SetClipboardSourceIsEdpAwareClipboardServer::SetContent
ClipboardServer::SetTextData
ClipboardServer::UnlockDataPackage
| |paramcount|1|1| |`address`|18000fcc4|180010814| |sig|void __thiscall EnsureClipboardInitialized(ClipboardServer * this)|void __thiscall EnsureClipboardInitialized(ClipboardServer * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardServer::EnsureClipboardInitialized Called Diff ```diff --- ClipboardServer::EnsureClipboardInitialized called +++ ClipboardServer::EnsureClipboardInitialized called @@ -0,0 +1 @@ +::operator_int_(__cdecl*)(_RTL_RUN_ONCE_*,void_*,void_*_*) ``` ### ClipboardServer::EnsureClipboardInitialized Diff ```diff --- ClipboardServer::EnsureClipboardInitialized +++ ClipboardServer::EnsureClipboardInitialized @@ -1,38 +1,42 @@ /* private: void __cdecl ClipboardServer::EnsureClipboardInitialized(void) __ptr64 */ void __thiscall ClipboardServer::EnsureClipboardInitialized(ClipboardServer *this) { BOOL BVar1; DWORD DVar2; + PINIT_ONCE_FN InitFn; + ClipboardServer *Parameter; void *unaff_retaddr; int local_res8 [2]; int *local_res10 [3]; local_res8[0] = 0; local_res10[0] = local_res8; - BVar1 = InitOnceExecuteOnce((PINIT_ONCE)(this + 0xb8), - ::,this - ,local_res10); + Parameter = this; + InitFn = (PINIT_ONCE_FN) + :: + operator_int____cdecl____RTL_RUN_ONCE___void___void_____(); + BVar1 = InitOnceExecuteOnce((PINIT_ONCE)(this + 0xb8),InitFn,Parameter,local_res10); if (BVar1 == 0) { DVar2 = GetLastError(); if (0 < (int)DVar2) { DVar2 = DVar2 & 0xffff | 0x80070000; } if ((int)DVar2 < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0xbc, + (unaff_retaddr,0xbe, "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",DVar2); } } if (local_res8[0] < 0) { /* WARNING: Subroutine does not return */ wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0xbe,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp", + (unaff_retaddr,0xc0,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp", local_res8[0]); } return; } ``` ## wil::details::ScopeExitFn<_>::~ScopeExitFn<_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling,called,parent| |ratio|0.36| |i_ratio|0.09| |m_ratio|0.83| |b_ratio|0.57| |match_types|StructuralGraphExactHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|~ScopeExitFn<_>|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |`fullname`|wil::details::ScopeExitFn<_>::~ScopeExitFn<_>|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |refcount|2|2| |`length`|95|65| |`called`|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::_Log_Hr|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |`calling`|`ClipboardServer::RegisterOsTaskCompletionIfRequired'::__l1::dtor$3|wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1|1| |`address`|18000e524|18000edd8| |`sig`|undefined __fastcall ~ScopeExitFn<_>(undefined8 * param_1)|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Called Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> called +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> called @@ -2 +2 @@ -wil::details::in1diag3::_Log_Hr +wil_details_GetNtDllProcedureAddress ``` ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Calling Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> calling +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling @@ -1 +1 @@ -`ClipboardServer::RegisterOsTaskCompletionIfRequired'::__l1::dtor$3 +wil::details::FeatureStateManager::~FeatureStateManager ``` ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> @@ -1,27 +1,39 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ +/* public: __cdecl wil::details::unique_storage,void * __ptr64,void * __ptr64,0,std::nullptr_t> + >::~unique_storage,void * __ptr64,void * + __ptr64,0,std::nullptr_t> >(void) __ptr64 */ -void wil::details::ScopeExitFn<_>:: - ~ScopeExitFn<_>(undefined8 *param_1) +void __thiscall +wil::details:: +unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> +:: +~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + (unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> + *this) { - longlong *plVar1; - int iVar2; - void *unaff_retaddr; + longlong lVar1; - if (*(char *)(param_1 + 2) != '\0') { - *(undefined1 *)(param_1 + 2) = 0; - plVar1 = *(longlong **)*param_1; - if (plVar1 != (longlong *)0x0) { - iVar2 = (**(code **)(*plVar1 + 0x20)) - (plVar1,-(ulonglong)(param_1[1] != 0) & param_1[1] + 0x80); - if (iVar2 < 0) { - in1diag3::_Log_Hr(unaff_retaddr,0x492, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); - } + lVar1 = *(longlong *)this; + if (lVar1 != 0) { + if ((g_wil_details_pfnRtlUnregisterFeatureConfigurationChangeNotification == + (_func___int64 *)0x0) && + (g_wil_details_pfnRtlUnregisterFeatureConfigurationChangeNotification = + wil_details_GetNtDllProcedureAddress + ("RtlUnregisterFeatureConfigurationChangeNotification"), + g_wil_details_pfnRtlUnregisterFeatureConfigurationChangeNotification == (_func___int64 *)0x0) + ) { + return; } + (*g_wil_details_pfnRtlUnregisterFeatureConfigurationChangeNotification)(lVar1); } return; } ``` ## ::operator() ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,fullname,length,address,calling,parent| |ratio|0.73| |i_ratio|0.72| |m_ratio|1.0| |b_ratio|0.91| |match_types|StructuralGraphExactHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|operator()|operator()| |`fullname`|::operator()|::operator()| |refcount|2|2| |`length`|412|417| |called|
Expand for full list:
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegGetValueW
ClipboardServer::SetContentInternal
ClipboardServer::SubscribeToMDMPolicyChange
Microsoft::WRL::ComPtr::InternalRelease
Windows::Foundation::Collections::Internal::detail::CreateExternalVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0>_>
_guard_dispatch_icall$thunk$10345483385596137414
operator_new
wil::GetActivationFactory
wil::com_ptr_t::~com_ptr_t
wil::details::in1diag3::_Throw_Hr
wil::details::in1diag3::_Throw_NullAllocwistd::unique_ptr_>::reset
|
Expand for full list:
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegGetValueW
ClipboardServer::SetContentInternal
ClipboardServer::SubscribeToMDMPolicyChange
Microsoft::WRL::ComPtr::InternalRelease
Windows::Foundation::Collections::Internal::detail::CreateExternalVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0>_>
_guard_dispatch_icall$thunk$10345483385596137414
operator_new
wil::GetActivationFactory
wil::com_ptr_t::~com_ptr_t
wil::details::in1diag3::_Throw_Hr
wil::details::in1diag3::_Throw_NullAllocwistd::unique_ptr_>::reset
| |`calling`|::|::| |paramcount|4|4| |`address`|18000ee1c|18000f6f8| |sig|uint __fastcall operator()(undefined8 param_1, undefined8 param_2, ClipboardServer * param_3, undefined8 * param_4)|uint __fastcall operator()(undefined8 param_1, undefined8 param_2, ClipboardServer * param_3, undefined8 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### ::operator() Calling Diff ```diff --- ::operator() calling +++ ::operator() calling @@ -1 +1 @@ -:: +:: ``` ### ::operator() Diff ```diff --- ::operator() +++ ::operator() @@ -1,84 +1,89 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ -uint ::operator() +uint ::operator() (undefined8 param_1,undefined8 param_2,ClipboardServer *param_3,undefined8 *param_4) { ComPtr *this; uint *puVar1; code *pcVar2; longlong *plVar3; - int iVar4; + long lVar4; + long extraout_EAX; EdpDataPackageProtectMap *pEVar5; ComPtr *pCVar6; void *unaff_retaddr; DWORD local_res8; undefined4 uStackX_c; int local_res10 [2]; longlong *local_res18; uint *local_res20; puVar1 = (uint *)*param_4; local_res10[1] = (int)((ulonglong)param_2 >> 0x20); local_res10[0] = 0x3e800; _local_res8 = CONCAT44((int)((ulonglong)param_1 >> 0x20),4); local_res20 = puVar1; RegGetValueW((HKEY)0xffffffff80000002,L"Software\\Microsoft\\ClipboardServer", L"MaxSizeAllowedInKBytes",0x10,(LPDWORD)0x0,local_res10,&local_res8); *(ulonglong *)(param_3 + 0xc0) = (ulonglong)(uint)(local_res10[0] << 10); ClipboardServer::SubscribeToMDMPolicyChange(param_3); ClipboardServer::SetContentInternal(param_3,(IUnknown *)0x0,true); pEVar5 = operator_new(0x10,&std::nothrow); if (pEVar5 == (EdpDataPackageProtectMap *)0x0) { pEVar5 = (EdpDataPackageProtectMap *)0x0; } else { *(undefined8 *)pEVar5 = 0; this = (ComPtr *)(pEVar5 + 8); *(undefined8 *)this = 0; pCVar6 = this; Microsoft::WRL::ComPtr::InternalRelease(this); Windows::Foundation::Collections::Internal::detail:: CreateExternalVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0>_> ((_func_long_IVector_ptr_ptr *)pCVar6, (AgileVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0> **)this); } local_res10[0] = 0; local_res10[1] = 0; wistd:: unique_ptr_> ::reset((unique_ptr_> *)(param_3 + 0x158),pEVar5); wistd:: unique_ptr_> ::reset((unique_ptr_> *)local_res10,(EdpDataPackageProtectMap *)0x0); if (*(longlong *)(param_3 + 0x158) == 0) { wil::details::in1diag3::_Throw_NullAlloc - (unaff_retaddr,0xab,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp") + (unaff_retaddr,0xad,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp") ; + lVar4 = extraout_EAX; } - wil::GetActivationFactory - ((ushort *)&local_res18); - pcVar2 = *(code **)(*local_res18 + 0x30); - plVar3 = *(longlong **)(param_3 + 0x150); - *(undefined8 *)(param_3 + 0x150) = 0; - if (plVar3 != (longlong *)0x0) { - (**(code **)(*plVar3 + 0x10))(); + else { + wil::GetActivationFactory + ((ushort *)&local_res18); + pcVar2 = *(code **)(*local_res18 + 0x30); + plVar3 = *(longlong **)(param_3 + 0x150); + *(undefined8 *)(param_3 + 0x150) = 0; + if (plVar3 != (longlong *)0x0) { + (**(code **)(*plVar3 + 0x10))(); + } + lVar4 = (*pcVar2)(local_res18,1,param_3 + 0x150); + if (-1 < lVar4) { + wil::com_ptr_t:: + ~com_ptr_t + ((com_ptr_t *)&local_res18 + ); + return ~*puVar1 >> 0x1f; + } } - iVar4 = (*pcVar2)(local_res18,1,param_3 + 0x150); - if (iVar4 < 0) { /* WARNING: Subroutine does not return */ - wil::details::in1diag3::_Throw_Hr - (unaff_retaddr,0xad,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp", - iVar4); - } - wil::com_ptr_t:: - ~com_ptr_t - ((com_ptr_t *)&local_res18); - return ~*puVar1 >> 0x1f; + wil::details::in1diag3::_Throw_Hr + (unaff_retaddr,0xaf,"onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp", + lVar4); } ``` ## ClipboardAllowListEntry::~ClipboardAllowListEntry ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.36| |i_ratio|0.0| |m_ratio|0.09| |b_ratio|0.0| |match_types|Implied Match| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|~ClipboardAllowListEntry|~UsageIndexes| |`fullname`|ClipboardAllowListEntry::~ClipboardAllowListEntry|wil::details_abi::UsageIndexes::~UsageIndexes| |`refcount`|15|5| |`length`|5|78| |`called`||wil::details::FreeProcessHeap| |`calling`|
Expand for full list:
`ClipboardServer::GetContentInternal'::__l1::dtor$1
`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3
`DataPackageViewCommon::TryUnlock'::__l1::dtor$6
`DataPackageViewCommon::TryUnlock'::__l1::dtor$7`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0
`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0
`std::_Wrap_alloc_>::construct'::__l1::dtor$0
`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0
|`wil::details_abi::FeatureStateData::ProcessShutdown'::__l1::dtor$0
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::FeatureStateData::~FeatureStateData| |paramcount|1|1| |`address`|18000e698|18000f50c| |`sig`|void __thiscall ~ClipboardAllowListEntry(ClipboardAllowListEntry * this)|void __thiscall ~UsageIndexes(UsageIndexes * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardAllowListEntry::~ClipboardAllowListEntry Called Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry called +++ wil::details_abi::UsageIndexes::~UsageIndexes called @@ -0,0 +1 @@ +wil::details::FreeProcessHeap ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Calling Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry calling +++ wil::details_abi::UsageIndexes::~UsageIndexes calling @@ -1,15 +1,4 @@ -`ClipboardServer::GetContentInternal'::__l1::dtor$1 -`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$6 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$7 -`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0 -`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0 -`std::_Wrap_alloc_>::construct'::__l1::dtor$0 -`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0 +`wil::details_abi::FeatureStateData::ProcessShutdown'::__l1::dtor$0 +wil::details_abi::FeatureStateData::ProcessShutdown +wil::details_abi::FeatureStateData::RecordUsage +wil::details_abi::FeatureStateData::~FeatureStateData ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry +++ wil::details_abi::UsageIndexes::~UsageIndexes @@ -1,12 +1,26 @@ -/* public: __cdecl ClipboardAllowListEntry::~ClipboardAllowListEntry(void) __ptr64 */ +/* public: __cdecl wil::details_abi::UsageIndexes::~UsageIndexes(void) __ptr64 */ -void __thiscall ClipboardAllowListEntry::~ClipboardAllowListEntry(ClipboardAllowListEntry *this) +void __thiscall wil::details_abi::UsageIndexes::~UsageIndexes(UsageIndexes *this) { - if (*(LPVOID *)this != (LPVOID)0x0) { - CoTaskMemFree(*(LPVOID *)this); + void *pvVar1; + + pvVar1 = *(void **)(this + 0xb0); + *(undefined8 *)(this + 0xb0) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); + } + pvVar1 = *(void **)(this + 0x70); + *(undefined8 *)(this + 0x70) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); + } + pvVar1 = *(void **)(this + 0x30); + *(undefined8 *)(this + 0x30) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); } return; } ``` ## wil::details_abi::SemaphoreValue::TryGetValueInternal ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.15| |i_ratio|0.06| |m_ratio|0.46| |b_ratio|0.25| |match_types|Implied Match| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|TryGetValueInternal|TryGetPointer| |`fullname`|wil::details_abi::SemaphoreValue::TryGetValueInternal|wil::details_abi::SemaphoreValue::TryGetPointer| |`refcount`|2|3| |`length`|455|118| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenSemaphoreW
StringCchCatW
StringCopyWorkerW
__security_check_cookie
wil::details::in1diag3::Return_GetLastError
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SemaphoreValue::GetValueFromSemaphore|wil::details::in1diag3::Return_Hr
wil::details_abi::SemaphoreValue::TryGetValueInternal| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|4|2| |`address`|18000be88|18000bf48| |`sig`|long __cdecl TryGetValueInternal(ushort * param_1, bool param_2, __uint64 * param_3, bool * param_4)|long __cdecl TryGetPointer(ushort * param_1, void * * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::SemaphoreValue::TryGetValueInternal Called Diff ```diff --- wil::details_abi::SemaphoreValue::TryGetValueInternal called +++ wil::details_abi::SemaphoreValue::TryGetPointer called @@ -1,6 +0,0 @@ -API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError -API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenSemaphoreW -StringCchCatW -StringCopyWorkerW -__security_check_cookie -wil::details::in1diag3::Return_GetLastError @@ -8,2 +2 @@ -wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> -wil::details_abi::SemaphoreValue::GetValueFromSemaphore +wil::details_abi::SemaphoreValue::TryGetValueInternal ``` ### wil::details_abi::SemaphoreValue::TryGetValueInternal Calling Diff ```diff --- wil::details_abi::SemaphoreValue::TryGetValueInternal calling +++ wil::details_abi::SemaphoreValue::TryGetPointer calling @@ -0,0 +1 @@ +wil::details_abi::ProcessLocalStorageData::Acquire ``` ### wil::details_abi::SemaphoreValue::TryGetValueInternal Diff ```diff --- wil::details_abi::SemaphoreValue::TryGetValueInternal +++ wil::details_abi::SemaphoreValue::TryGetPointer @@ -1,93 +1,26 @@ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* private: static long __cdecl wil::details_abi::SemaphoreValue::TryGetValueInternal(unsigned short - const * __ptr64,bool,unsigned __int64 * __ptr64,bool * __ptr64) */ +/* public: static long __cdecl wil::details_abi::SemaphoreValue::TryGetPointer(unsigned short const + * __ptr64,void * __ptr64 * __ptr64) */ -long __cdecl -wil::details_abi::SemaphoreValue::TryGetValueInternal - (ushort *param_1,bool param_2,__uint64 *param_3,bool *param_4) +long __cdecl wil::details_abi::SemaphoreValue::TryGetPointer(ushort *param_1,void **param_2) { - DWORD DVar1; - long lVar2; - __uint64 _Var3; - long *plVar4; - LPCWSTR pWVar5; + long lVar1; + bool *in_R9; void *unaff_retaddr; - undefined1 auStackY_278 [32]; - size_t in_stack_fffffffffffffda8; - long local_248; - long local_244; - HANDLE local_240; - HANDLE local_238 [2]; - wchar_t local_228 [264]; - ulonglong local_18; + __uint64 local_res10 [3]; - local_18 = __security_cookie ^ (ulonglong)auStackY_278; - *param_3 = 0; - _Var3 = 0x104; - StringCopyWorkerW(local_228,0x104,param_3,(STRSAFE_PCNZWCH)param_1,in_stack_fffffffffffffda8); - StringCchCatW((ushort *)local_228,_Var3,(ushort *)L"_p0"); - pWVar5 = local_228; - local_238[0] = OpenSemaphoreW(0x1f0003,0,pWVar5); - if (local_238[0] == (HANDLE)0x0) { - DVar1 = GetLastError(); - lVar2 = 0; - if (DVar1 != 2) { - lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xcd,(char *)pWVar5); - } + *param_2 = (void *)0x0; + local_res10[0] = 0; + lVar1 = TryGetValueInternal(param_1,SUB81(param_2,0),local_res10,in_R9); + if (lVar1 < 0) { + details::in1diag3::Return_Hr(unaff_retaddr,100,"wil",lVar1); + details::in1diag3::Return_Hr(unaff_retaddr,0x6d,"wil",lVar1); } else { - plVar4 = &local_244; - local_244 = 0; - local_248 = 0; - lVar2 = GetValueFromSemaphore(local_238[0],plVar4); - if (lVar2 < 0) { - details::in1diag3::Return_Hr(unaff_retaddr,0xd3,"wil",lVar2); - } - else { - StringCchCatW((ushort *)local_228,(__uint64)plVar4,(ushort *)L"h"); - pWVar5 = local_228; - local_240 = OpenSemaphoreW(0x1f0003,0,pWVar5); - if (local_240 == (HANDLE)0x0) { - lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xd9,(char *)pWVar5); - details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_240); - } - else { - lVar2 = GetValueFromSemaphore(local_240,&local_248); - if (lVar2 < 0) { - details::in1diag3::Return_Hr(unaff_retaddr,0xdb,"wil",lVar2); - details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_240); - } - else { - details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_240); - *param_3 = (longlong)local_248 << 0x1f | (longlong)local_244; - lVar2 = 0; - } - } - } + *param_2 = (void *)(local_res10[0] << 2); + lVar1 = 0; } - details:: - unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)local_238); - return lVar2; + return lVar1; } ``` ## ClipboardAllowListEntry::~ClipboardAllowListEntry ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.42| |i_ratio|0.0| |m_ratio|0.1| |b_ratio|0.0| |match_types|Implied Match| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|~ClipboardAllowListEntry|OnTimer| |`fullname`|ClipboardAllowListEntry::~ClipboardAllowListEntry|wil::details::EnabledStateManager::OnTimer| |`refcount`|15|3| |`length`|5|75| |`called`||API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`calling`|
Expand for full list:
`ClipboardServer::GetContentInternal'::__l1::dtor$1
`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3
`DataPackageViewCommon::TryUnlock'::__l1::dtor$6
`DataPackageViewCommon::TryUnlock'::__l1::dtor$7`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0
`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0
`std::_Wrap_alloc_>::construct'::__l1::dtor$0
`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0
|::
::| |paramcount|1|1| |`address`|18000e698|180014508| |`sig`|void __thiscall ~ClipboardAllowListEntry(ClipboardAllowListEntry * this)|void __thiscall OnTimer(EnabledStateManager * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardAllowListEntry::~ClipboardAllowListEntry Called Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry called +++ wil::details::EnabledStateManager::OnTimer called @@ -0,0 +1,3 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive +wil::details::EnabledStateManager::RecordCachedUsageUnderLock +wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Calling Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry calling +++ wil::details::EnabledStateManager::OnTimer calling @@ -1,15 +1,2 @@ -`ClipboardServer::GetContentInternal'::__l1::dtor$1 -`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$6 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$7 -`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0 -`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0 -`std::_Wrap_alloc_>::construct'::__l1::dtor$0 -`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0 +:: +:: ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry +++ wil::details::EnabledStateManager::OnTimer @@ -1,12 +1,22 @@ -/* public: __cdecl ClipboardAllowListEntry::~ClipboardAllowListEntry(void) __ptr64 */ +/* public: void __cdecl wil::details::EnabledStateManager::OnTimer(void) __ptr64 */ -void __thiscall ClipboardAllowListEntry::~ClipboardAllowListEntry(ClipboardAllowListEntry *this) +void __thiscall wil::details::EnabledStateManager::OnTimer(EnabledStateManager *this) { - if (*(LPVOID *)this != (LPVOID)0x0) { - CoTaskMemFree(*(LPVOID *)this); + EnabledStateManager *local_res8; + + if (*this != (EnabledStateManager)0x0) { + AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); + local_res8 = this + 8; + RecordCachedUsageUnderLock(this); + this[0x18] = (EnabledStateManager)0x0; + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res8); } return; } ``` ## ClipboardAllowListEntry::~ClipboardAllowListEntry ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.56| |i_ratio|0.0| |m_ratio|0.2| |b_ratio|0.0| |match_types|Implied Match| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|~ClipboardAllowListEntry|~RawUsageIndex| |`fullname`|ClipboardAllowListEntry::~ClipboardAllowListEntry|wil::details_abi::RawUsageIndex::~RawUsageIndex| |`refcount`|15|2| |`length`|5|31| |`called`||wil::details::FreeProcessHeap| |`calling`|
Expand for full list:
`ClipboardServer::GetContentInternal'::__l1::dtor$1
`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3
`DataPackageViewCommon::TryUnlock'::__l1::dtor$6
`DataPackageViewCommon::TryUnlock'::__l1::dtor$7`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0
`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0
`std::_Wrap_alloc_>::construct'::__l1::dtor$0
`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0
|`wil::details_abi::RecordWnfUsageIndex'::__l1::dtor$0| |paramcount|1|1| |`address`|18000e698|18000f394| |`sig`|void __thiscall ~ClipboardAllowListEntry(ClipboardAllowListEntry * this)|void __thiscall ~RawUsageIndex(RawUsageIndex * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ClipboardAllowListEntry::~ClipboardAllowListEntry Called Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry called +++ wil::details_abi::RawUsageIndex::~RawUsageIndex called @@ -0,0 +1 @@ +wil::details::FreeProcessHeap ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Calling Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry calling +++ wil::details_abi::RawUsageIndex::~RawUsageIndex calling @@ -1,15 +1 @@ -`ClipboardServer::GetContentInternal'::__l1::dtor$1 -`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4 -`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1 -`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$6 -`DataPackageViewCommon::TryUnlock'::__l1::dtor$7 -`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0 -`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0 -`std::_Wrap_alloc_>::construct'::__l1::dtor$0 -`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0 +`wil::details_abi::RecordWnfUsageIndex'::__l1::dtor$0 ``` ### ClipboardAllowListEntry::~ClipboardAllowListEntry Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry +++ wil::details_abi::RawUsageIndex::~RawUsageIndex @@ -1,12 +1,16 @@ -/* public: __cdecl ClipboardAllowListEntry::~ClipboardAllowListEntry(void) __ptr64 */ +/* public: __cdecl wil::details_abi::RawUsageIndex::~RawUsageIndex(void) __ptr64 */ -void __thiscall ClipboardAllowListEntry::~ClipboardAllowListEntry(ClipboardAllowListEntry *this) +void __thiscall wil::details_abi::RawUsageIndex::~RawUsageIndex(RawUsageIndex *this) { - if (*(LPVOID *)this != (LPVOID)0x0) { - CoTaskMemFree(*(LPVOID *)this); + void *pvVar1; + + pvVar1 = *(void **)(this + 0x30); + *(undefined8 *)(this + 0x30) = 0; + if (pvVar1 != (void *)0x0) { + details::FreeProcessHeap(pvVar1); } return; } ``` ## wil::details::ScopeExitFn<_>::~ScopeExitFn<_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.5| |i_ratio|0.34| |m_ratio|0.46| |b_ratio|0.46| |match_types|Implied Match| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |`name`|~ScopeExitFn<_>|~ScopeExitFn<_>| |`fullname`|wil::details::ScopeExitFn<_>::~ScopeExitFn<_>|wil::details::ScopeExitFn<_>::~ScopeExitFn<_>| |`refcount`|2|3| |`length`|95|25| |`called`|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::_Log_Hr|::operator()| |`calling`|`ClipboardServer::RegisterOsTaskCompletionIfRequired'::__l1::dtor$3|ClipboardServer::RegisterOsTaskCompletionIfRequired
`ClipboardServer::RegisterOsTaskCompletionIfRequired'::__l1::dtor$3| |paramcount|1|1| |`address`|18000e524|18000eac0| |`sig`|undefined __fastcall ~ScopeExitFn<_>(undefined8 * param_1)|undefined __fastcall ~ScopeExitFn<_>(undefined8 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Called Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> called +++ wil::details::ScopeExitFn<_>::~ScopeExitFn<_> called @@ -1,2 +1 @@ -_guard_dispatch_icall$thunk$10345483385596137414 -wil::details::in1diag3::_Log_Hr +::operator() ``` ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Calling Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> calling +++ wil::details::ScopeExitFn<_>::~ScopeExitFn<_> calling @@ -0,0 +1 @@ +ClipboardServer::RegisterOsTaskCompletionIfRequired ``` ### wil::details::ScopeExitFn<_>::~ScopeExitFn<_> Diff ```diff --- wil::details::ScopeExitFn<_>::~ScopeExitFn<_> +++ wil::details::ScopeExitFn<_>::~ScopeExitFn<_> @@ -1,27 +1,12 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ - -void wil::details::ScopeExitFn<_>:: - ~ScopeExitFn<_>(undefined8 *param_1) +void wil::details::ScopeExitFn<_>:: + ~ScopeExitFn<_>(undefined8 *param_1) { - longlong *plVar1; - int iVar2; - void *unaff_retaddr; - if (*(char *)(param_1 + 2) != '\0') { *(undefined1 *)(param_1 + 2) = 0; - plVar1 = *(longlong **)*param_1; - if (plVar1 != (longlong *)0x0) { - iVar2 = (**(code **)(*plVar1 + 0x20)) - (plVar1,-(ulonglong)(param_1[1] != 0) & param_1[1] + 0x80); - if (iVar2 < 0) { - in1diag3::_Log_Hr(unaff_retaddr,0x492, - "onecoreuap\\base\\appmodel\\clipboard\\lib\\clipboardserver.cpp",iVar2); - } - } + ::operator()(param_1); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|34|37| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18001fa94|180023954| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |`refcount`|9|11| |length|22|22| |called|wil::details::CloseHandle|wil::details::CloseHandle| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue| |paramcount|1|1| |`address`|18000a078|18000a168| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling @@ -0,0 +1,2 @@ +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData ``` ## NtStatusToHr ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|NtStatusToHr|NtStatusToHr| |fullname|wil::details::NtStatusToHr|wil::details::NtStatusToHr| |`refcount`|2|3| |length|85|85| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::ReportFailure_NtStatus<1>|wil::details::ReportFailure_NtStatus<1>
wil::details_abi::RecordWnfUsageIndex| |paramcount|1|1| |`address`|180012a5c|18001416c| |sig|long __cdecl NtStatusToHr(long param_1)|long __cdecl NtStatusToHr(long param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### NtStatusToHr Calling Diff ```diff --- wil::details::NtStatusToHr calling +++ wil::details::NtStatusToHr calling @@ -1,0 +2 @@ +wil::details_abi::RecordWnfUsageIndex ``` ## last_error_context ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|last_error_context|last_error_context| |fullname|wil::last_error_context::last_error_context|wil::last_error_context::last_error_context| |`refcount`|7|13| |length|36|36| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError| |`calling`|wil::details::unique_storage_>::reset
wil::details::unique_storage,struct__WNF_USER_SUBSCRIPTION*___ptr64,struct__WNF_USER_SUBSCRIPTION*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::ProcessLocalStorageData::Release|
Expand for full list:
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::unique_storage_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct__WNF_USER_SUBSCRIPTION*___ptr64,struct__WNF_USER_SUBSCRIPTION*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::resetwil::details_abi::heap_buffer::reserve
| |paramcount|1|1| |`address`|180009ec4|180009fb4| |sig|undefined __thiscall last_error_context(last_error_context * this)|undefined __thiscall last_error_context(last_error_context * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### last_error_context Calling Diff ```diff --- wil::last_error_context::last_error_context calling +++ wil::last_error_context::last_error_context calling @@ -0,0 +1,4 @@ +wil::details::EnabledStateManager::QueueBackgroundUsageReporting +wil::details::FeatureStateManager::EnsureStateData +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting +wil::details::FeatureStateManager::RecordFeatureUsage @@ -1,0 +6 @@ +wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset @@ -6 +11,2 @@ -wil::details_abi::ProcessLocalStorageData::Release +wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset +wil::details_abi::heap_buffer::reserve ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|19|38| |length|0|0| |called||| |`calling`|
Expand for full list:
CWRLObjectWithGITSite::SetSite
ClipboardTracing::SubscribedToServicesActivity::StartActivity
DllCanUnloadNow
DllGetClassObject
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
Microsoft::WRL::Details::TerminateMap
Microsoft::WRL::Wrappers::SRWLock::LockExclusive
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStopwil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::zInternalStart
wil::ActivityBase::LockExclusive
wil::ActivityBase::zInternalStop
|
Expand for full list:
::
::
CWRLObjectWithGITSite::SetSite
ClipboardTracing::SubscribedToServicesActivity::StartActivity
DllCanUnloadNow
DllGetClassObject
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
Microsoft::WRL::Details::TerminateMap
Microsoft::WRL::Wrappers::SRWLock::LockExclusivewil::ActivityBase::Stop
wil::ActivityBase::zInternalStop
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::zInternalStart
wil::ActivityBase::LockExclusive
wil::ActivityBase::zInternalStop
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|EXTERNAL:00000034|EXTERNAL:00000031| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -0,0 +1,2 @@ +:: +:: @@ -16,0 +19,17 @@ +wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl +wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush +wil::details::EnabledStateManager::OnStateChange +wil::details::EnabledStateManager::OnTimer +wil::details::EnabledStateManager::QueueBackgroundUsageReporting +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureStateManager::EnsureStateData +wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting +wil::details::FeatureStateManager::RecordFeatureUsage +wil::details::FeatureStateManager::SubscribeToEnabledStateChanges +wil::details::FeatureStateManager::SubscribeToUsageFlush +wil::details::IsFeatureConfigured +wil::details_abi::FeatureStateData::RecordFeatureUsage +wil::details_abi::FeatureStateData::RecordUsage +wil::details_abi::SubscriptionList::OnSignaled +wil::details_abi::SubscriptionList::Unsubscribe ``` ## atexit ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|atexit|atexit| |fullname|atexit|atexit| |`refcount`|8|10| |length|23|23| |called|_onexit|_onexit| |`calling`|`dynamic_initializer_for_'Microsoft::WRL::Details::StaticStorage,0,int>::instance_''
`dynamic_initializer_for_'std::_Error_objects::_Generic_object''
`dynamic_initializer_for_'std::_Error_objects::_Iostream_object''
`dynamic_initializer_for_'std::_Error_objects::_System_object''
wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''
wil::details::`dynamic_initializer_for_'g_processLocalData''
wil::details::static_lazy::get|`dynamic_initializer_for_'Microsoft::WRL::Details::StaticStorage,0,int>::instance_''
`dynamic_initializer_for_'std::_Error_objects::_Generic_object''
`dynamic_initializer_for_'std::_Error_objects::_Iostream_object''
`dynamic_initializer_for_'std::_Error_objects::_System_object''
wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''
wil::details::`dynamic_initializer_for_'g_enabledStateManager''
wil::details::`dynamic_initializer_for_'g_featureStateManager''
wil::details::`dynamic_initializer_for_'g_processLocalData''
wil::details::static_lazy::get| |paramcount|1|1| |`address`|180008210|180008300| |sig|int __cdecl atexit(_func_5014 * param_1)|int __cdecl atexit(_func_5014 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### atexit Calling Diff ```diff --- atexit calling +++ atexit calling @@ -5,0 +6,2 @@ +wil::details::`dynamic_initializer_for_'g_enabledStateManager'' +wil::details::`dynamic_initializer_for_'g_featureStateManager'' ``` ## API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|HeapFree|HeapFree| |fullname|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree| |`refcount`|12|13| |length|0|0| |called||| |`calling`|wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::details::shared_buffer::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ThreadLocalData::Clear
wil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage|wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::details::shared_buffer::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ThreadLocalData::Clear
wil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage| |paramcount|3|3| |`address`|EXTERNAL:0000003b|EXTERNAL:00000040| |sig|BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)|BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree Calling Diff ```diff --- API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree calling +++ API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree calling @@ -4,0 +5 @@ +wil::details_abi::ProcessLocalStorageData::Release ``` ## Initialize ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|Initialize|Initialize| |fullname|wil::TraceLoggingProvider::Initialize|wil::TraceLoggingProvider::Initialize| |`refcount`|7|8| |length|3|3| |called||| |calling|`Microsoft::WRL::Details::MakeAndInitialize'::__l1::dtor$1
`Windows::Internal::ComTaskPool::QueueTask<_>'::__l1::dtor$5|`Microsoft::WRL::Details::MakeAndInitialize'::__l1::dtor$1
`Windows::Internal::ComTaskPool::QueueTask<_>'::__l1::dtor$5| |paramcount|1|1| |`address`|18000ed70|18000f5b0| |sig|void __thiscall Initialize(TraceLoggingProvider * this)|void __thiscall Initialize(TraceLoggingProvider * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## StringCchPrintfW ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|8|9| |length|68|68| |called|StringVPrintfWorkerW|StringVPrintfWorkerW| |`calling`|EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
wil::details::MaybeGetExceptionString
wil::details::ReportFailure_Msg<2>
wil::details_abi::ProcessLocalStorageData::Acquire|EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
wil::details::MaybeGetExceptionString
wil::details::ReportFailure_Msg<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3|3| |`address`|18000bcb4|18000bd74| |sig|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -5,0 +6 @@ +wil::details_abi::ProcessLocalStorageData::Acquire ``` ## API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetCurrentProcessId|GetCurrentProcessId| |fullname|API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId|API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId| |`refcount`|6|7| |length|0|0| |called||| |`calling`|DataPackageViewCommon::GetCallerOrCurrentProcessId
EdpInlSetProcessTlsIndex
UserAwareCallerIdentity::GetCallingProcessId
__security_init_cookie
wil::details_abi::ProcessLocalStorageData::Acquire|DataPackageViewCommon::GetCallerOrCurrentProcessId
EdpInlSetProcessTlsIndex
UserAwareCallerIdentity::GetCallingProcessId
__security_init_cookie
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|0|0| |`address`|EXTERNAL:0000004b|EXTERNAL:00000053| |sig|DWORD __stdcall GetCurrentProcessId(void)|DWORD __stdcall GetCurrentProcessId(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId Calling Diff ```diff --- API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId calling +++ API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::GetCurrentProcessId calling @@ -4,0 +5 @@ +wil::details_abi::ProcessLocalStorageData::Acquire ``` ## Return_Hr ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|Return_Hr|Return_Hr| |fullname|wil::details::in1diag3::Return_Hr|wil::details::in1diag3::Return_Hr| |`refcount`|129|132| |length|30|30| |called|wil::details::ReportFailure_Hr<1>|wil::details::ReportFailure_Hr<1>| |`calling`|
Expand for full list:
::operator()
::operator()
CallerIdentity::GetCallingProcessAppId
CallerIdentity::GetCallingProcessHandle
CallerIdentity::GetProcessAppId
ClipboardNotificationClient::EnsureSubscribedToWNFNotifications
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterClipboardHistoryEnabledChangedCallbackClipboardNotificationClient::RegisterContentChangeCallback
ClipboardNotificationClient::RegisterHistoryChangedCallback
ClipboardNotificationClient::RegisterRoamingClipboardEnabledChangedCallback
ClipboardNotificationClient::UnregisterClipboardHistoryEnabledChangedCallback
ClipboardNotificationClient::UnregisterContentChangeCallback
ClipboardNotificationClient::UnregisterHistoryChangedCallback
ClipboardNotificationClient::UnregisterRoamingClipboardEnabledChangedCallback
ClipboardServerBroker::GetContent
ClipboardServerBroker::GetProcessIdFromUniqueId
ClipboardServerBroker::GetTextData
ClipboardServerBroker::IsDataPackageLocked
ClipboardServerBroker::LockDataPackage
ClipboardServerBroker::RequestAccessToReadContent
ClipboardServerBroker::SetClipboardEnterpriseId
ClipboardServerBroker::SetClipboardSourceAppId
ClipboardServerBroker::SetClipboardSourceIsEdpAware
ClipboardServerBroker::UnlockDataPackage
DataPackageViewCommon::TryUnlock
DataPackageViewMUX::Contains
DataPackageViewMUX::GenerateDummyBitmapAsync
DataPackageViewMUX::GenerateDummyDataAsync
DataPackageViewMUX::GenerateDummyResourceMapAsync
DataPackageViewMUX::GenerateDummyStorageItemAsync
DataPackageViewMUX::GenerateDummyStringAsync
DataPackageViewMUX::GenerateDummyUriAsync
DataPackageViewMUX::GetApplicationLinkAsync
DataPackageViewMUX::GetAppropriateDataPackage
DataPackageViewMUX::GetBitmapAsync
DataPackageViewMUX::GetCustomTextAsync
DataPackageViewMUX::GetDataAsync
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetHtmlFormatAsync
DataPackageViewMUX::GetResourceMapAsync
DataPackageViewMUX::GetRtfAsync
DataPackageViewMUX::GetSourceAppId
DataPackageViewMUX::GetStorageItemsAsync
DataPackageViewMUX::GetTextAsync
DataPackageViewMUX::GetUnderlyingDataPackage
DataPackageViewMUX::GetUniqueId
DataPackageViewMUX::GetUriAsync
DataPackageViewMUX::GetWebLinkAsync
DataPackageViewMUX::ReportOperationCompleted
DataPackageViewMUX::RequestAccessWithEnterpriseIdAsync
DataPackageViewMUX::RuntimeClassInitialize
DataPackageViewMUX::UnlockAndAssumeEnterpriseIdentity
DataPackageViewMUX::get_AllowedDragDropOperations
DataPackageViewMUX::get_AvailableFormats
DataPackageViewMUX::get_Properties
DataPackageViewMUX::get_RequestedOperation
EDPPolicyManager::AddAppToEnterpriseAllowList
EDPPolicyManager::EvaluateClipboardReadPolicy
EDPPolicyManager::GetEnterpriseIdFromDataPackage
EDPPolicyManager::TagCopiedDataPackageWithEnterpriseId
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
GetClipboardProtectionServer
GetEdpContextOfCaller
UserAwareCallerIdentity::GetAppIdFromProcessId
UserAwareCallerIdentity::GetCallingProcessAppId
UserAwareCallerIdentity::GetCallingProcessHandle
UserAwareCallerIdentity::GetCallingProcessId
UserAwareCallerIdentity::GetCallingProcessPackageFullName
UserAwareCallerIdentity::GetCallingProcessPsmKey
UserAwareCallerIdentity::GetCallingProcessUserContext
UserAwareCallerIdentity::IsCallingProcessAppContainer
wil::details::make_wnf_subscription_state
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::wnf_query_nothrow
|
Expand for full list:
::operator()
::operator()
CallerIdentity::GetCallingProcessAppId
CallerIdentity::GetCallingProcessHandle
CallerIdentity::GetProcessAppId
ClipboardNotificationClient::EnsureSubscribedToWNFNotifications
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterClipboardHistoryEnabledChangedCallbackClipboardNotificationClient::RegisterContentChangeCallback
ClipboardNotificationClient::RegisterHistoryChangedCallback
ClipboardNotificationClient::RegisterRoamingClipboardEnabledChangedCallback
ClipboardNotificationClient::UnregisterClipboardHistoryEnabledChangedCallback
ClipboardNotificationClient::UnregisterContentChangeCallback
ClipboardNotificationClient::UnregisterHistoryChangedCallback
ClipboardNotificationClient::UnregisterRoamingClipboardEnabledChangedCallback
ClipboardServerBroker::GetContent
ClipboardServerBroker::GetProcessIdFromUniqueId
ClipboardServerBroker::GetTextData
ClipboardServerBroker::IsDataPackageLocked
ClipboardServerBroker::LockDataPackage
ClipboardServerBroker::RequestAccessToReadContent
ClipboardServerBroker::SetClipboardEnterpriseId
ClipboardServerBroker::SetClipboardSourceAppId
ClipboardServerBroker::SetClipboardSourceIsEdpAware
ClipboardServerBroker::UnlockDataPackage
DataPackageViewCommon::TryUnlock
DataPackageViewMUX::Contains
DataPackageViewMUX::GenerateDummyBitmapAsync
DataPackageViewMUX::GenerateDummyDataAsync
DataPackageViewMUX::GenerateDummyResourceMapAsync
DataPackageViewMUX::GenerateDummyStorageItemAsync
DataPackageViewMUX::GenerateDummyStringAsync
DataPackageViewMUX::GenerateDummyUriAsync
DataPackageViewMUX::GetApplicationLinkAsync
DataPackageViewMUX::GetAppropriateDataPackage
DataPackageViewMUX::GetBitmapAsync
DataPackageViewMUX::GetCustomTextAsync
DataPackageViewMUX::GetDataAsync
DataPackageViewMUX::GetDataInfo
DataPackageViewMUX::GetHtmlFormatAsync
DataPackageViewMUX::GetResourceMapAsync
DataPackageViewMUX::GetRtfAsync
DataPackageViewMUX::GetSourceAppId
DataPackageViewMUX::GetStorageItemsAsync
DataPackageViewMUX::GetTextAsync
DataPackageViewMUX::GetUnderlyingDataPackage
DataPackageViewMUX::GetUniqueId
DataPackageViewMUX::GetUriAsync
DataPackageViewMUX::GetWebLinkAsync
DataPackageViewMUX::ReportOperationCompleted
DataPackageViewMUX::RequestAccessWithEnterpriseIdAsync
DataPackageViewMUX::RuntimeClassInitialize
DataPackageViewMUX::UnlockAndAssumeEnterpriseIdentity
DataPackageViewMUX::get_AllowedDragDropOperations
DataPackageViewMUX::get_AvailableFormats
DataPackageViewMUX::get_Properties
DataPackageViewMUX::get_RequestedOperation
EDPPolicyManager::AddAppToEnterpriseAllowList
EDPPolicyManager::EvaluateClipboardReadPolicy
EDPPolicyManager::GetEnterpriseIdFromDataPackage
EDPPolicyManager::TagCopiedDataPackageWithEnterpriseId
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
GetClipboardProtectionServer
GetEdpContextOfCaller
UserAwareCallerIdentity::GetAppIdFromProcessId
UserAwareCallerIdentity::GetCallingProcessAppId
UserAwareCallerIdentity::GetCallingProcessHandle
UserAwareCallerIdentity::GetCallingProcessId
UserAwareCallerIdentity::GetCallingProcessPackageFullName
UserAwareCallerIdentity::GetCallingProcessPsmKey
UserAwareCallerIdentity::GetCallingProcessUserContext
UserAwareCallerIdentity::IsCallingProcessAppContainer
wil::details::make_wnf_subscription_state
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::wnf_query_nothrow
| |paramcount|4|4| |`address`|180006674|180006764| |sig|void __cdecl Return_Hr(void * param_1, uint param_2, char * param_3, long param_4)|void __cdecl Return_Hr(void * param_1, uint param_2, char * param_3, long param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Return_Hr Calling Diff ```diff --- wil::details::in1diag3::Return_Hr calling +++ wil::details::in1diag3::Return_Hr calling @@ -78,0 +79,2 @@ +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::MakeAndInitialize @@ -82,0 +85 @@ +wil::details_abi::SemaphoreValue::TryGetPointer ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|ReleaseSRWLockShared|ReleaseSRWLockShared| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared| |`refcount`|21|23| |length|0|0| |called||| |`calling`|
Expand for full list:
CWRLObjectWithGITSite::GetSite
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireHistoryChangedCallback
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::GetTextDataInternal
ClipboardServer::OnOSTaskCompletionRevoked
ClipboardServer::RequestAccessForProcessClipboardServer::SetContent
DllGetClassObject
EDPPolicyManager::FindAppInEnterpriseAllowList
Microsoft::WRL::Details::GetCacheEntry
Microsoft::WRL::Wrappers::Details::SyncLockShared::~SyncLockShared
|
Expand for full list:
CWRLObjectWithGITSite::GetSite
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireHistoryChangedCallback
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetTextDataInternal
ClipboardServer::OnOSTaskCompletionRevokedClipboardServer::RequestAccessForProcess
ClipboardServer::SetContent
DllGetClassObject
EDPPolicyManager::FindAppInEnterpriseAllowList
Microsoft::WRL::Details::GetCacheEntry
Microsoft::WRL::Wrappers::Details::SyncLockShared::~SyncLockShared
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
| |paramcount|1|1| |`address`|EXTERNAL:00000035|EXTERNAL:00000037| |sig|void __stdcall ReleaseSRWLockShared(PSRWLOCK SRWLock)|void __stdcall ReleaseSRWLockShared(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared calling @@ -8,0 +9 @@ +ClipboardServer::GetEnterpriseIdOfContent @@ -16,0 +18 @@ +wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ``` ## __GSHandlerCheck_EH4 ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck_EH4|__GSHandlerCheck_EH4| |fullname|__GSHandlerCheck_EH4|__GSHandlerCheck_EH4| |`refcount`|35|38| |length|127|127| |called|__CxxFrameHandler4
__GSHandlerCheckCommon|__CxxFrameHandler4
__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18001fb1c|1800239dc| |sig|undefined __fastcall __GSHandlerCheck_EH4(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined __fastcall __GSHandlerCheck_EH4(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## reset ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|reset|reset| |fullname|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset|wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset| |`refcount`|16|18| |length|83|83| |called|API-MS-WIN-CORE-COM-L1-1-0.DLL::CoTaskMemFree
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|API-MS-WIN-CORE-COM-L1-1-0.DLL::CoTaskMemFree
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|ClipboardServer::GetContentInternal
ClipboardServer::OnOSTaskCompletionRevoked
ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
DataPackageViewCommon::TryUnlock
UserAwareCallerIdentity::GetAppIdFromProcessId
wil::details::out_param_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::~out_param_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=|ClipboardServer::GetContentInternal
ClipboardServer::OnOSTaskCompletionRevoked
ClipboardServer::RequestAccessForProcess
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
DataPackageViewCommon::TryUnlock
UserAwareCallerIdentity::GetAppIdFromProcessId
wil::details::out_param_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>::~out_param_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::unique_any_t,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>::operator=| |paramcount|2|2| |`address`|180017e5c|18001b26c| |sig|void __thiscall reset(unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> * this, ushort * param_1)|void __thiscall reset(unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_> * this, ushort * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## ProcessHeapAlloc ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.61| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|ProcessHeapAlloc|ProcessHeapAlloc| |fullname|wil::details::ProcessHeapAlloc|wil::details::ProcessHeapAlloc| |`refcount`|4|6| |length|182|182| |called|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
_guard_dispatch_icall$thunk$10345483385596137414|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ThreadLocalData::SetLastError
wil::details_abi::ThreadLocalFailureInfo::Set|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ThreadLocalData::SetLastError
wil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::heap_buffer::reserve| |paramcount|2|2| |`address`|180007648|180007738| |sig|void * __cdecl ProcessHeapAlloc(ulong param_1, __uint64 param_2)|void * __cdecl ProcessHeapAlloc(ulong param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ProcessHeapAlloc Calling Diff ```diff --- wil::details::ProcessHeapAlloc calling +++ wil::details::ProcessHeapAlloc calling @@ -0,0 +1 @@ +wil::details_abi::ProcessLocalStorageData::MakeAndInitialize @@ -3,0 +5 @@ +wil::details_abi::heap_buffer::reserve ``` ## ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|20|39| |length|29|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
ClipboardTracing::FlushActivity::StartActivity
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
`EdpDataPackageProtectMap::IsPackageLockedForProcess'::__l1::dtor$0
`EdpDataPackageProtectMap::LockPackageForProcess'::__l1::dtor$0
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusivewil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStart
wil::ActivityBase::zInternalStop
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
|
Expand for full list:
::
::
ClipboardTracing::FlushActivity::StartActivity
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
`EdpDataPackageProtectMap::IsPackageLockedForProcess'::__l1::dtor$0
`EdpDataPackageProtectMap::LockPackageForProcess'::__l1::dtor$0
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stopwil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStart
wil::ActivityBase::zInternalStop
wil::ActivityBase::Destroy
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|1800062cc|1800063bc| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -0,0 +1,2 @@ +:: +:: @@ -18,0 +21,17 @@ +wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl +wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush +wil::details::EnabledStateManager::OnStateChange +wil::details::EnabledStateManager::OnTimer +wil::details::EnabledStateManager::QueueBackgroundUsageReporting +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureStateManager::EnsureStateData +wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting +wil::details::FeatureStateManager::RecordFeatureUsage +wil::details::FeatureStateManager::SubscribeToEnabledStateChanges +wil::details::FeatureStateManager::SubscribeToUsageFlush +wil::details::IsFeatureConfigured +wil::details_abi::FeatureStateData::RecordFeatureUsage +wil::details_abi::FeatureStateData::RecordUsage +wil::details_abi::SubscriptionList::OnSignaled +wil::details_abi::SubscriptionList::Unsubscribe ``` ## _Throw_Hr ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|_Throw_Hr|_Throw_Hr| |fullname|wil::details::in1diag3::_Throw_Hr|wil::details::in1diag3::_Throw_Hr| |`refcount`|84|87| |length|24|24| |called|wil::details::ReportFailure_Hr<0>|wil::details::ReportFailure_Hr<0>| |`calling`|
Expand for full list:
::operator()
ClipboardServer::Clear
ClipboardServer::EnsureClipboardInitialized
ClipboardServer::Flush
ClipboardServer::GetBroker
ClipboardServer::GetContent
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetProcessIdFromUniqueId
ClipboardServer::GetTextData
ClipboardServer::GetTextDataInternal
ClipboardServer::HasTextDataClipboardServer::IsDataPackageLocked
ClipboardServer::LockDataPackage
ClipboardServer::RegisterOsTaskCompletionIfRequired
ClipboardServer::RequestAccessForProcess
ClipboardServer::RequestAccessToReadContent
ClipboardServer::RuntimeClassInitialize
ClipboardServer::SetClipboardEnterpriseId
ClipboardServer::SetClipboardSourceAppId
ClipboardServer::SetClipboardSourceIsEdpAware
ClipboardServer::SetContentInternal
ClipboardServer::SetTextData
ClipboardServer::SubscribeToMDMPolicyChange
ClipboardServer::SubscribeToServices
ClipboardServer::UnlockDataPackage
ClipboardServer::UnregisterOsTaskCompletion
ClipboardServer::UnsubscribeFromServices
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
DataPackageViewCommon::IsEdpProtected
IsAnyFormatDelayRendered
wil::ActivateInstance
wil::GetActivationFactory
wil::com_ptr_t::copy_to
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::copy_to
wil::vector_range,struct_wil::err_exception_policy>::end
|
Expand for full list:
::operator()
ClipboardServer::Clear
ClipboardServer::EnsureClipboardInitialized
ClipboardServer::Flush
ClipboardServer::GetBroker
ClipboardServer::GetContent
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetProcessIdFromUniqueId
ClipboardServer::GetTextData
ClipboardServer::GetTextDataInternal
ClipboardServer::HasTextDataClipboardServer::IsDataPackageLocked
ClipboardServer::LockDataPackage
ClipboardServer::RegisterOsTaskCompletionIfRequired
ClipboardServer::RequestAccessForProcess
ClipboardServer::RequestAccessToReadContent
ClipboardServer::RuntimeClassInitialize
ClipboardServer::SetClipboardEnterpriseId
ClipboardServer::SetClipboardSourceAppId
ClipboardServer::SetClipboardSourceIsEdpAware
ClipboardServer::SetContentInternal
ClipboardServer::SetTextData
ClipboardServer::SubscribeToMDMPolicyChange
ClipboardServer::SubscribeToServices
ClipboardServer::UnlockDataPackage
ClipboardServer::UnregisterOsTaskCompletion
ClipboardServer::UnsubscribeFromServices
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
DataPackageViewCommon::IsEdpProtected
IsAnyFormatDelayRendered
wil::ActivateInstance
wil::GetActivationFactory
wil::com_ptr_t::copy_to
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::query
wil::com_ptr_t::copy_to
wil::vector_range,struct_wil::err_exception_policy>::end
| |paramcount|4|4| |`address`|180017bc0|18001ae04| |sig|noreturn void __cdecl _Throw_Hr(void * param_1, uint param_2, char * param_3, long param_4)|noreturn void __cdecl _Throw_Hr(void * param_1, uint param_2, char * param_3, long param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### _Throw_Hr Calling Diff ```diff --- wil::details::in1diag3::_Throw_Hr calling +++ wil::details::in1diag3::_Throw_Hr calling @@ -1 +1 @@ -::operator() +::operator() ``` ## ~last_error_context ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~last_error_context|~last_error_context| |fullname|wil::last_error_context::~last_error_context|wil::last_error_context::~last_error_context| |`refcount`|7|14| |length|29|29| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::SetLastError|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::SetLastError| |`calling`|wil::details::unique_storage_>::reset
wil::details::unique_storage,struct__WNF_USER_SUBSCRIPTION*___ptr64,struct__WNF_USER_SUBSCRIPTION*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::ProcessLocalStorageData::Release|
Expand for full list:
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::unique_storage_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct__WNF_USER_SUBSCRIPTION*___ptr64,struct__WNF_USER_SUBSCRIPTION*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,struct_wil::details::wnf_subscription_state_base*___ptr64,struct_wil::details::wnf_subscription_state_base*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::resetwil::details_abi::heap_buffer::reserve
| |paramcount|1|1| |`address`|18000a128|18000a218| |sig|void __thiscall ~last_error_context(last_error_context * this)|void __thiscall ~last_error_context(last_error_context * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~last_error_context Calling Diff ```diff --- wil::last_error_context::~last_error_context calling +++ wil::last_error_context::~last_error_context calling @@ -0,0 +1,4 @@ +wil::details::EnabledStateManager::QueueBackgroundUsageReporting +wil::details::FeatureStateManager::EnsureStateData +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting +wil::details::FeatureStateManager::RecordFeatureUsage @@ -1,0 +6 @@ +wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset @@ -6 +11,2 @@ -wil::details_abi::ProcessLocalStorageData::Release +wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset +wil::details_abi::heap_buffer::reserve ``` ## __security_check_cookie ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|80|87| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
::operator()
CServiceHostComponent::RegisterServiceInformation
CallerIdentity::GetCoreWindowForCurrentThread
CallerIdentity::GetPsmKeyFromProcessToken
CallerIdentity::_EnsureRuntimeBrokerPID
ClipboardNotificationClient::EnsureSubscribedToWNFNotifications
ClipboardNotificationClient::FireHistoryChangedCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallbackClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::HasTextData
ClipboardServer::RegisterOsTaskCompletionIfRequired
ClipboardServer::RuntimeClassInitialize
ClipboardServer::SetContent
ClipboardServer::SetContentInternal
ClipboardServer::SetTextData
ClipboardServer::SubscribeToMDMPolicyChange
ClipboardServer::SubscribeToServices
ClipboardServer::UnregisterOsTaskCompletion
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
ClipboardTracing::SubscribedToServicesActivity::StopActivity
DataPackageViewCommon::TryUnlock
DataPackageViewMUX::GetApplicationLinkAsync
DataPackageViewMUX::GetBitmapAsync
DataPackageViewMUX::GetHtmlFormatAsync
DataPackageViewMUX::GetRtfAsync
DataPackageViewMUX::GetStorageItemsAsync
DataPackageViewMUX::GetTextAsync
DataPackageViewMUX::GetUriAsync
DataPackageViewMUX::GetWebLinkAsync
DataPackageViewMUX::IsSourceDataPackageAlive
EDPPolicyManager::TagCopiedDataPackageWithEnterpriseId
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
EdpInlGetProcessTlsIndex
Microsoft::WRL::Details::GetActivationFactory<1>
TraceLoggingRegisterEx_EventRegister_EventSetInformation
UserAwareCallerIdentity::GetAppIdFromProcessId
UserAwareCallerIdentity::GetCallingProcessAppId
UserAwareCallerIdentity::GetCallingProcessPackageFullName
UserAwareCallerIdentity::GetCallingProcessPsmKey
Windows::Foundation::Collections::Internal::detail::CreateExternalVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0>_>
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz_>
_tlgWriteTemplate::Write_>
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
wil::ActivateInstance
wil::GetActivationFactory
wil::GetFailureLogString
wil::ResultException::what
wil::details::GetModuleInformation
wil::details::ReportFailure_CaughtException<1>
wil::details::ReportFailure_CaughtException<2>
wil::details::ReportFailure_Msg<2>
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
|
Expand for full list:
::operator()
CServiceHostComponent::RegisterServiceInformation
CallerIdentity::GetCoreWindowForCurrentThread
CallerIdentity::GetPsmKeyFromProcessToken
CallerIdentity::_EnsureRuntimeBrokerPID
ClipboardNotificationClient::EnsureSubscribedToWNFNotifications
ClipboardNotificationClient::FireHistoryChangedCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallback
ClipboardNotificationClient::RegisterChangeCallbackClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::HasTextData
ClipboardServer::RegisterOsTaskCompletionIfRequired
ClipboardServer::RuntimeClassInitialize
ClipboardServer::SetContent
ClipboardServer::SetContentInternal
ClipboardServer::SetTextData
ClipboardServer::SubscribeToMDMPolicyChange
ClipboardServer::SubscribeToServices
ClipboardServer::UnregisterOsTaskCompletion
ClipboardServer::UpdateEdpDataPackageLockState
ClipboardServer::ValidateFGPolicy
ClipboardTracing::SubscribedToServicesActivity::StopActivity
DataPackageViewCommon::TryUnlock
DataPackageViewMUX::GetApplicationLinkAsync
DataPackageViewMUX::GetBitmapAsync
DataPackageViewMUX::GetHtmlFormatAsync
DataPackageViewMUX::GetRtfAsync
DataPackageViewMUX::GetStorageItemsAsync
DataPackageViewMUX::GetTextAsync
DataPackageViewMUX::GetUriAsync
DataPackageViewMUX::GetWebLinkAsync
DataPackageViewMUX::IsSourceDataPackageAlive
EDPPolicyManager::TagCopiedDataPackageWithEnterpriseId
EdpDataPackageProtectMap::IsPackageLockedForProcess
EdpDataPackageProtectMap::LockPackageForProcess
EdpDataPackageProtectMap::UnlockPackageForProcess
EdpInlGetProcessTlsIndex
Microsoft::WRL::Details::GetActivationFactory<1>
TraceLoggingRegisterEx_EventRegister_EventSetInformation
UserAwareCallerIdentity::GetAppIdFromProcessId
UserAwareCallerIdentity::GetCallingProcessAppId
UserAwareCallerIdentity::GetCallingProcessPackageFullName
UserAwareCallerIdentity::GetCallingProcessPsmKey
Windows::Foundation::Collections::Internal::detail::CreateExternalVector,struct_Windows::Foundation::Collections::Internal::DefaultLifetimeTraits,0>_>
__GSHandlerCheckCommon
_tlgWriteTemplate::Write<>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz,struct__tlgWrapperByVal<4>,struct__tlgWrapSz,struct__tlgWrapSz_>
_tlgWriteTemplate::Write_>
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
std::_Func_impl,0>,class_std::allocator_>,void,class_ClipboardNotificationClient*___ptr64,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil,struct_std::_Nil>::_Do_call
wil::ActivateInstance
wil::GetActivationFactory
wil::GetFailureLogString
wil::ResultException::what
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure_CaughtException<1>
wil::details::ReportFailure_CaughtException<2>
wil::details::ReportFailure_Msg<2>
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
| |paramcount|1|1| |`address`|18001fbd0|180023aa0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -70,0 +71 @@ +wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting @@ -76,0 +78 @@ +wil::details_abi::ProcessLocalStorageData::Acquire @@ -77,0 +80 @@ +wil::details_abi::RecordWnfUsageIndex @@ -79,0 +83,4 @@ +wil::details_abi::UsageIndexes::Record +wil_RtlStagingConfig_QueryFeatureState +wil_details_RecordCachedUsage +wil_details_WriteSRUMWnfUsageBuffer ``` ## GetContentDetails ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetContentDetails|GetContentDetails| |fullname|ClipboardTracing::GetContentInternalActivity::GetContentDetails|ClipboardTracing::GetContentInternalActivity::GetContentDetails| |`refcount`|2|3| |length|156|156| |called|ClipboardTracing::Provider
_tlgKeywordOn
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>_>|ClipboardTracing::Provider
_tlgKeywordOn
_tlgWriteTemplate::Write,struct__tlgWrapSz,struct__tlgWrapperByVal<8>_>| |calling|ClipboardServer::GetContentInternal|ClipboardServer::GetContentInternal| |paramcount|3|3| |`address`|18000ccac|18000cfd8| |sig|void __thiscall GetContentDetails(GetContentInternalActivity * this, ushort * * param_1, ushort * * param_2)|void __thiscall GetContentDetails(GetContentInternalActivity * this, ushort * * param_1, ushort * * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## unique_ptr<1,void> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|unique_ptr<1,void>|unique_ptr<1,void>| |fullname|wistd::unique_ptr::unique_ptr<1,void>|wistd::unique_ptr::unique_ptr<1,void>| |`refcount`|1|2| |length|7|7| |called||| |`calling`|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize|ClipboardServer::SubscribeToMDMPolicyChange
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |paramcount|2|2| |`address`|180009700|1800097f0| |sig|undefined __thiscall unique_ptr<1,void>(unique_ptr * this, void * param_1)|undefined __thiscall unique_ptr<1,void>(unique_ptr * this, void * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### unique_ptr<1,void> Calling Diff ```diff --- wistd::unique_ptr::unique_ptr<1,void> calling +++ wistd::unique_ptr::unique_ptr<1,void> calling @@ -0,0 +1 @@ +ClipboardServer::SubscribeToMDMPolicyChange ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|CreateMutexExW|CreateMutexExW| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW| |`refcount`|2|3| |length|0|0| |called||| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|4|4| |`address`|EXTERNAL:0000002d|EXTERNAL:00000032| |sig|HANDLE __stdcall CreateMutexExW(LPSECURITY_ATTRIBUTES lpMutexAttributes, LPCWSTR lpName, DWORD dwFlags, DWORD dwDesiredAccess)|HANDLE __stdcall CreateMutexExW(LPSECURITY_ATTRIBUTES lpMutexAttributes, LPCWSTR lpName, DWORD dwFlags, DWORD dwDesiredAccess)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateMutexExW calling @@ -0,0 +1 @@ +wil::details_abi::ProcessLocalStorageData::Acquire ``` ## GetLastErrorFailHr ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetLastErrorFailHr|GetLastErrorFailHr| |fullname|wil::details::GetLastErrorFailHr|wil::details::GetLastErrorFailHr| |`refcount`|3|4| |length|43|43| |called|wil::details::GetLastErrorFail|wil::details::GetLastErrorFail| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |paramcount|0|0| |`address`|18000ab38|18000ac08| |sig|long __cdecl GetLastErrorFailHr(void)|long __cdecl GetLastErrorFailHr(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### GetLastErrorFailHr Calling Diff ```diff --- wil::details::GetLastErrorFailHr calling +++ wil::details::GetLastErrorFailHr calling @@ -0,0 +1 @@ +wil::details_abi::ProcessLocalStorageData::Acquire ``` ## __chkstk ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|__chkstk|__chkstk| |fullname|__chkstk|__chkstk| |`refcount`|9|11| |length|77|77| |called||| |`calling`|wil::ResultException::what
wil::details::ReportFailure_CaughtException<1>
wil::details::ReportFailure_CaughtException<2>
wil::details::ReportFailure_Msg<2>
wil::details::ReportFailure_NoReturn<0>
wil::details::ReportFailure_NoReturn<3>
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>|wil::ResultException::what
wil::details::ReportFailure_CaughtException<1>
wil::details::ReportFailure_CaughtException<2>
wil::details::ReportFailure_Msg<2>
wil::details::ReportFailure_NoReturn<0>
wil::details::ReportFailure_NoReturn<3>
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::RecordWnfUsageIndex
wil_details_WriteSRUMWnfUsageBuffer| |paramcount|0|0| |`address`|18001fc90|180023b60| |sig|undefined __fastcall __chkstk(void)|undefined __fastcall __chkstk(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __chkstk Calling Diff ```diff --- __chkstk calling +++ __chkstk calling @@ -8,0 +9,2 @@ +wil::details_abi::RecordWnfUsageIndex +wil_details_WriteSRUMWnfUsageBuffer ``` ## reset ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|reset|reset| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |`refcount`|5|6| |length|76|76| |called|wil::details::CloseHandle
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|wil::details::CloseHandle
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::SemaphoreValue::Destroy
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |paramcount|2|2| |`address`|18000c264|18000c3a8| |sig|void __thiscall reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this, void * param_1)|void __thiscall reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this, void * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### reset Calling Diff ```diff --- wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset calling +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset calling @@ -0,0 +1 @@ +wil::details_abi::ProcessLocalStorageData::Acquire @@ -2 +3 @@ -wil::details_abi::ProcessLocalStorageData::Release +wil::details_abi::SemaphoreValue::Destroy ``` ## acquire ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|acquire|acquire| |fullname|wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire|wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |`refcount`|3|5| |length|81|81| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObjectEx
wil::details::in1diag3::FailFast_Unexpected|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObjectEx
wil::details::in1diag3::FailFast_Unexpected| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|4|4| |`address`|18000c148|18000c28c| |sig|unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_> __thiscall acquire(mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> * this, ulong * param_1, ulong param_2, int param_3)|unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_> __thiscall acquire(mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> * this, ulong * param_1, ulong param_2, int param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### acquire Calling Diff ```diff --- wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire calling +++ wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire calling @@ -0,0 +1,2 @@ +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::Release ``` ## MSVCRT.DLL::memcpy_s ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|memcpy_s|memcpy_s| |fullname|MSVCRT.DLL::memcpy_s|MSVCRT.DLL::memcpy_s| |`refcount`|6|15| |length|0|0| |called||| |`calling`|wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details::WriteResultString
wil::details::WriteResultString
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>|wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details::WriteResultString
wil::details::WriteResultString
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write
wil::details_abi::heap_buffer::push_back
wil::details_abi::heap_buffer::reserve
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>
wil::make_unique_string_nothrow,unsigned_short*___ptr64,unsigned_short*___ptr64,0,std::nullptr_t>_>_>_>| |paramcount|4|4| |`address`|EXTERNAL:0000001a|EXTERNAL:0000001b| |sig|errno_t __cdecl memcpy_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)|errno_t __cdecl memcpy_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSVCRT.DLL::memcpy_s Calling Diff ```diff --- MSVCRT.DLL::memcpy_s calling +++ MSVCRT.DLL::memcpy_s calling @@ -3,0 +4,5 @@ +wil::details_abi::UsageIndexProperty::Read +wil::details_abi::UsageIndexProperty::UpdateCount +wil::details_abi::UsageIndexProperty::Write +wil::details_abi::heap_buffer::push_back +wil::details_abi::heap_buffer::reserve ``` ## GetEnterpriseIdFromDataPackage ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.74| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetEnterpriseIdFromDataPackage|GetEnterpriseIdFromDataPackage| |fullname|EDPPolicyManager::GetEnterpriseIdFromDataPackage|EDPPolicyManager::GetEnterpriseIdFromDataPackage| |`refcount`|2|3| |length|345|345| |called|API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL::WindowsDeleteString
API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL::WindowsGetStringRawBuffer
DataPackageViewMUX::get_Properties
Microsoft::WRL::ComPtr::InternalRelease
Microsoft::WRL::ComPtr::As
_AllocStringWorker
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::Return_Hr|API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL::WindowsDeleteString
API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL::WindowsGetStringRawBuffer
DataPackageViewMUX::get_Properties
Microsoft::WRL::ComPtr::InternalRelease
Microsoft::WRL::ComPtr::As
_AllocStringWorker
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::Return_Hr| |`calling`|ClipboardServer::GetEnterpriseIdOfContent|ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetEnterpriseIdOfContentInternal| |paramcount|3|3| |`address`|18001dfe4|180021edc| |sig|long __thiscall GetEnterpriseIdFromDataPackage(EDPPolicyManager * this, DataPackageViewMUX * param_1, ushort * * param_2)|long __thiscall GetEnterpriseIdFromDataPackage(EDPPolicyManager * this, DataPackageViewMUX * param_1, ushort * * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### GetEnterpriseIdFromDataPackage Calling Diff ```diff --- EDPPolicyManager::GetEnterpriseIdFromDataPackage calling +++ EDPPolicyManager::GetEnterpriseIdFromDataPackage calling @@ -1,0 +2 @@ +ClipboardServer::GetEnterpriseIdOfContentInternal ``` ## API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|GetProcessHeap|GetProcessHeap| |fullname|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap| |`refcount`|17|18| |length|0|0| |called||| |`calling`|
Expand for full list:
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ResultException::what
wil::StoredFailureInfo::SetFailureInfo
wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::details::heap_allocator::allocate
wil::details::shared_buffer::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ThreadLocalData::Clearwil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::ThreadLocalStorage::GetLocal
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
|
Expand for full list:
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ActivityBase::ActivityData::~ActivityData
wil::ResultException::what
wil::StoredFailureInfo::SetFailureInfo
wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::details::heap_allocator::allocate
wil::details::shared_buffer::reset
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Releasewil::details_abi::ThreadLocalData::Clear
wil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::ThreadLocalStorage::GetLocal
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage
| |paramcount|0|0| |`address`|EXTERNAL:0000003a|EXTERNAL:00000041| |sig|HANDLE __stdcall GetProcessHeap(void)|HANDLE __stdcall GetProcessHeap(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap Calling Diff ```diff --- API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap calling +++ API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap calling @@ -9,0 +10 @@ +wil::details_abi::ProcessLocalStorageData::Release ``` ## ~SemaphoreValue ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~SemaphoreValue|~SemaphoreValue| |fullname|wil::details_abi::SemaphoreValue::~SemaphoreValue|wil::details_abi::SemaphoreValue::~SemaphoreValue| |`refcount`|4|7| |length|31|31| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |`calling`|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |paramcount|1|1| |`address`|18000a0f4|18000a1e4| |sig|void __thiscall ~SemaphoreValue(SemaphoreValue * this)|void __thiscall ~SemaphoreValue(SemaphoreValue * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~SemaphoreValue Calling Diff ```diff --- wil::details_abi::SemaphoreValue::~SemaphoreValue calling +++ wil::details_abi::SemaphoreValue::~SemaphoreValue calling @@ -0,0 +1,2 @@ +wil::details_abi::ProcessLocalStorageData::MakeAndInitialize +wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData ``` ## ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |`refcount`|4|7| |length|22|22| |called|wil::details::ReleaseMutex|wil::details::ReleaseMutex| |`calling`|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1|1| |`address`|18000a098|18000a188| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> calling @@ -0,0 +1,2 @@ +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::Release ``` ## ~ClipboardAllowListEntry ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|~ClipboardAllowListEntry|~ClipboardAllowListEntry| |fullname|ClipboardAllowListEntry::~ClipboardAllowListEntry|ClipboardAllowListEntry::~ClipboardAllowListEntry| |`refcount`|15|14| |length|5|5| |called||| |`calling`|
Expand for full list:
`ClipboardServer::GetContentInternal'::__l1::dtor$1
`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3
`DataPackageViewCommon::TryUnlock'::__l1::dtor$6
`DataPackageViewCommon::TryUnlock'::__l1::dtor$7`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0
`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0
`std::_Wrap_alloc_>::construct'::__l1::dtor$0
`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0
|
Expand for full list:
`ClipboardServer::GetContentInternal'::__l1::dtor$1
`ClipboardServer::OnOSTaskCompletionRevoked'::__l1::dtor$0
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$1
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$4
`ClipboardServer::RequestAccessForProcess'::__l1::dtor$5
`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$3
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$1
`ClipboardServer::ValidateFGPolicy'::__l1::dtor$3
`DataPackageViewCommon::TryUnlock'::__l1::dtor$6
`DataPackageViewCommon::TryUnlock'::__l1::dtor$7
`UserAwareCallerIdentity::GetAppIdFromProcessId'::__l1::dtor$0`UserAwareCallerIdentity::GetCallingProcessAppId'::__l1::dtor$0
`std::_Wrap_alloc_>::construct'::__l1::dtor$0
`wil::make_unique_string,unsigned_short_*,unsigned_short_*,0,std::nullptr_t>_>_>_>'::__l1::dtor$0
| |paramcount|1|1| |`address`|18000e698|18000ebec| |sig|void __thiscall ~ClipboardAllowListEntry(ClipboardAllowListEntry * this)|void __thiscall ~ClipboardAllowListEntry(ClipboardAllowListEntry * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~ClipboardAllowListEntry Calling Diff ```diff --- ClipboardAllowListEntry::~ClipboardAllowListEntry calling +++ ClipboardAllowListEntry::~ClipboardAllowListEntry calling @@ -6,2 +6 @@ -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$1 -`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$4 +`ClipboardServer::UpdateEdpDataPackageLockState'::__l1::dtor$3 ``` ## LockShared ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|LockShared|LockShared| |fullname|Microsoft::WRL::Wrappers::SRWLock::LockShared|Microsoft::WRL::Wrappers::SRWLock::LockShared| |`refcount`|13|14| |length|48|48| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared| |`calling`|
Expand for full list:
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::GetTextDataInternal
ClipboardServer::OnOSTaskCompletionRevoked
ClipboardServer::RequestAccessForProcess
ClipboardServer::SetContent
EDPPolicyManager::FindAppInEnterpriseAllowListMicrosoft::WRL::Details::GetCacheEntry
|
Expand for full list:
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardNotificationClient::FireCallback
ClipboardServer::Flush
ClipboardServer::GetContent
ClipboardServer::GetContentInternal
ClipboardServer::GetEnterpriseIdOfContent
ClipboardServer::GetTextDataInternal
ClipboardServer::OnOSTaskCompletionRevoked
ClipboardServer::RequestAccessForProcess
ClipboardServer::SetContentEDPPolicyManager::FindAppInEnterpriseAllowList
Microsoft::WRL::Details::GetCacheEntry
| |paramcount|1|1| |`address`|180007b20|180007c10| |sig|SyncLockShared __cdecl LockShared(_RTL_SRWLOCK * param_1)|SyncLockShared __cdecl LockShared(_RTL_SRWLOCK * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### LockShared Calling Diff ```diff --- Microsoft::WRL::Wrappers::SRWLock::LockShared calling +++ Microsoft::WRL::Wrappers::SRWLock::LockShared calling @@ -6,0 +7 @@ +ClipboardServer::GetEnterpriseIdOfContent ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|AcquireSRWLockShared|AcquireSRWLockShared| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared| |`refcount`|5|6| |length|0|0| |called||| |`calling`|CWRLObjectWithGITSite::GetSite
ClipboardNotificationClient::FireHistoryChangedCallback
DllGetClassObject
Microsoft::WRL::Wrappers::SRWLock::LockShared|CWRLObjectWithGITSite::GetSite
ClipboardNotificationClient::FireHistoryChangedCallback
DllGetClassObject
Microsoft::WRL::Wrappers::SRWLock::LockShared
wil::details_abi::SubscriptionList::OnSignaled| |paramcount|1|1| |`address`|EXTERNAL:00000032|EXTERNAL:00000035| |sig|void __stdcall AcquireSRWLockShared(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockShared(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared calling @@ -4,0 +5 @@ +wil::details_abi::SubscriptionList::OnSignaled ``` ## MSVCRT.DLL::exception::exception ### Match Info |Key|cbs_7309.dll - cbs_7623.dll| | :---: | :---: | |diff_type|refcount,sig,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExternalsName| ### Function Meta Diff |Key|cbs_7309.dll|cbs_7623.dll| | :---: | :---: | :---: | |name|exception|exception| |fullname|MSVCRT.DLL::exception::exception|MSVCRT.DLL::exception::exception| |`refcount`|3|4| |length|0|0| |called||| |`calling`||wil::details::ThrowResultExceptionInternal| |paramcount|2|1| |`address`|EXTERNAL:0000001e|EXTERNAL:00000018| |`sig`|undefined __thiscall exception(exception * this, char * * param_1)|undefined __thiscall exception(exception * this)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSVCRT.DLL::exception::exception Calling Diff ```diff --- MSVCRT.DLL::exception::exception calling +++ MSVCRT.DLL::exception::exception calling @@ -0,0 +1 @@ +wil::details::ThrowResultExceptionInternal ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-16T22:43:04