# cx_8115.dll-cx_8457.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1881917752__private_IsEnabledDeviceUsageNoInline](#feature_1881917752__private_isenableddeviceusagenoinline) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_details_AreDependenciesEnabled](#wil_details_aredependenciesenabled) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [NTDLL.DLL::RtlNotifyFeatureUsage](#ntdlldllrtlnotifyfeatureusage) * [NTDLL.DLL::RtlQueryFeatureConfiguration](#ntdlldllrtlqueryfeatureconfiguration) * [Modified](#modified) * [I_XmlUnmarshallKeyInfo](#i_xmlunmarshallkeyinfo) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [__security_check_cookie](#__security_check_cookie) * [_DBG_BASENAME](#_dbg_basename) # Visual Chart Diff ```mermaid flowchart LR I_XmlUnmarshallKeyInfo-6-old<--Match 42%-->I_XmlUnmarshallKeyInfo-6-new subgraph cx_8457.dll I_XmlUnmarshallKeyInfo-6-new subgraph Added direction LR Feature_1881917752__private_IsEnabledDeviceUsageNoInline wil_RtlStagingConfig_QueryFeatureState wil_details_AreDependenciesEnabled wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_GetCurrentFeatureEnabledState wil_details_IsEnabledFallback wil_details_MapReportingKind NTDLLDLL-RtlNotifyFeatureUsage NTDLLDLL-RtlQueryFeatureConfiguration end end subgraph cx_8115.dll I_XmlUnmarshallKeyInfo-6-old end ``` ```mermaid pie showData title Function Matches - 97.7169% "unmatched_funcs_len" : 15 "matched_funcs_len" : 642 ``` ```mermaid pie showData title Matched Function Similarity - 99.0654% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 5 "matched_funcs_no_changes_len" : 636 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 cx_8115.dll cx_8457.dll ``` #### Verbose Args

``` --old ['cx_8115.dll'] --new [['cx_8457.dll']] --engine VersionTrackingDiff --output-path cx_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/cryptxml.dll/8720C80A29000/cryptxml.dll -O cryptxml.dll.x64.10.0.26100.8115 wget https://msdl.microsoft.com/download/symbols/cryptxml.dll/1546C5F129000/cryptxml.dll -O cryptxml.dll.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- cx_8115.dll Meta +++ cx_8457.dll Meta @@ -1,44 +1,44 @@ -Program Name: cx_8115.dll +Program Name: cx_8457.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 170224 +# of Bytes: 170296 # of Memory Blocks: 10 -# of Instructions: 23128 -# of Defined Data: 2152 -# of Functions: 321 -# of Symbols: 3014 +# of Instructions: 23987 +# of Defined Data: 2184 +# of Functions: 336 +# of Symbols: 3114 # of Data Types: 359 # of Data Type Categories: 20 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Tue Aug 18 23:54:46 SGT 2026 +Date Created: Tue Aug 18 23:54:49 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/cx/cx_8115.dll -Executable MD5: 9ed4b17b8d7085fcb60e8af12b731c49 -Executable SHA256: 3ab1410c0a9f419821978db0a2fc5626e9d3d794f4fe7cb82c24709e3334806f -FSRL: file:///tmp/cx/cx_8115.dll?MD5=9ed4b17b8d7085fcb60e8af12b731c49 +Executable Location: /tmp/cx/cx_8457.dll +Executable MD5: 307c682c5d3c0f642c73151466c4abb6 +Executable SHA256: 0cb1f25a5ab9a542a182654340895b65c00777c11e5c29e6d12526e13b7d9617 +FSRL: file:///tmp/cx/cx_8457.dll?MD5=307c682c5d3c0f642c73151466c4abb6 PDB Age: 1 PDB File: CryptXml.pdb -PDB GUID: 46e728c7-0f5c-9294-d3f3-22999cbaa25d +PDB GUID: c1df50d8-60bc-c59e-4c7d-4872ac65dd31 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: XML DigSig API -PE Property[FileVersion]: 10.0.26100.8115 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: cryptxml.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: cryptxml.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8115 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra cx_8115.dll Decompiler Options

Ghidra cx_8115.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cx_8115.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra cx_8457.dll Decompiler Options

Ghidra cx_8457.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra cx_8457.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|15| |deleted_funcs_len|0| |modified_funcs_len|6| |added_symbols_len|13| |deleted_symbols_len|2| |diff_time|4.341732501983643| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 316, 'ExternalsName': 127, 'ExactInstructionsFunctionHasher': 3, 'BSIM': 1})| |items_to_process|36| |diff_types|Counter({'refcount': 5, 'address': 5, 'calling': 3, 'code': 1, 'length': 1, 'called': 1})| |unmatched_funcs_len|15| |total_funcs_len|657| |matched_funcs_len|642| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|5| |matched_funcs_no_changes_len|636| |match_func_similarity_percent|99.0654%| |func_match_overall_percent|97.7169%| |first_matches|Counter({'SymbolsHash': 316, 'ExactInstructionsFunctionHasher': 3, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 316 "ExternalsName" : 127 "ExactInstructionsFunctionHasher" : 3 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 316 "ExactInstructionsFunctionHasher" : 3 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 15 "deleted_funcs_len" : 0 "modified_funcs_len" : 6 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 13 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_1881917752__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|Feature_1881917752__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1881917752__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|44| |called|wil_details_IsEnabledFallback| |calling|I_XmlUnmarshallKeyInfo| |paramcount|0| |address|180018398| |sig|uint __fastcall Feature_1881917752__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1881917752__private_IsEnabledDeviceUsageNoInline +++ Feature_1881917752__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_1881917752__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + undefined8 local_res8; + + local_res8 = (undefined4 *)(ulonglong)Feature_1881917752__private_featureState; + if ((Feature_1881917752__private_featureState & 0x10) != 0) { + return Feature_1881917752__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3); + return uVar1; +} + ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|197| |called|NTDLL.DLL::RtlQueryFeatureConfiguration
__security_check_cookie| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|3| |address|1800183d4| |sig|undefined8 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -0,0 +1,35 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +undefined8 wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3) + +{ + int iVar1; + undefined1 auStack_48 [32]; + undefined8 local_28; + undefined8 local_20; + uint local_18; + ulonglong local_10; + + local_10 = __security_cookie ^ (ulonglong)auStack_48; + local_28 = 0; + local_20 = 0; + local_18 = 0; + iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,&local_28,&local_20); + if (iVar1 == 0) { + *param_1 = local_20._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_20 >> 0x28) & 0x3f; + param_1[3] = local_18; + param_1[2] = local_20._4_4_ >> 0xe & 3; + param_1[5] = local_20._4_4_ >> 6 & 1; + param_1[4] = local_20._4_4_ >> 7 & 1; + } + else { + if (iVar1 != 0x117) { + return 0; + } + param_1[4] = local_20._4_4_ >> 7 & 1; + } + return 1; +} + ``` ## wil_details_AreDependenciesEnabled ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_AreDependenciesEnabled| |fullname|wil_details_AreDependenciesEnabled| |refcount|2| |length|150| |called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|1| |address|1800184a0| |sig|int __fastcall wil_details_AreDependenciesEnabled(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_AreDependenciesEnabled +++ wil_details_AreDependenciesEnabled @@ -0,0 +1,48 @@ + +int wil_details_AreDependenciesEnabled(longlong param_1) + +{ + uint uVar1; + undefined8 *puVar2; + int iVar3; + int iVar4; + longlong *plVar5; + ulonglong local_res8; + + plVar5 = *(longlong **)(param_1 + 0x20); + iVar3 = 1; + iVar4 = iVar3; + if (plVar5 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar5; + if (puVar2 == (undefined8 *)0x0) { + return iVar3; + } + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((iVar3 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + return 0; + } + iVar3 = 1; + plVar5 = plVar5 + 1; + } + uVar1 = *(uint *)*puVar2; + local_res8 = (ulonglong)uVar1; + if ((uVar1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_res8,(longlong)puVar2); + } + if ((iVar3 == 0) || ((local_res8 & 1) == 0)) { + iVar3 = 0; + } + else { + iVar3 = 1; + } + plVar5 = plVar5 + 1; + iVar4 = 0; + } while (iVar3 != 0); + } + return iVar4; +} + ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|218| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|180018540| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -0,0 +1,54 @@ + +void wil_details_FeatureReporting_IncrementOpportunityInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar3 = *param_1; + do { + uVar1 = uVar3; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar3 = (uVar1 & 0x3f8000) >> 0xf; + if (uVar3 != 0) { + param_4[1] = uVar3; + uVar3 = 5; + if (param_2 != 1) { + uVar3 = 1; + } + uVar2 = uVar1 & 0xffc07fff | 1; + param_4[2] = uVar3; + } + uVar3 = 0; + if (param_2 == 5) { + uVar3 = 0x400000; + } + uVar2 = uVar3 | uVar2 & 0xffbfffff; + } + uVar3 = uVar2 >> 0xf & 0x7f; + uVar4 = uVar3 + 1; + if ((0x7f < uVar4) || (uVar4 < uVar3)) { + uVar4 = 1; + param_4[2] = param_2; + param_4[1] = uVar3; + } + LOCK(); + uVar3 = *param_1; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *param_1 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|230| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|180018624| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -0,0 +1,50 @@ + +void wil_details_FeatureReporting_IncrementUsageInCache + (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar1 = uVar4; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar1 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar2 = uVar1 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar3 = uVar4 + 1; + if ((0x1ff < uVar3) || (uVar3 < uVar4)) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar1 == uVar4; + if (bVar5) { + *param_1 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; + uVar4 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|381| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|180018714| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -0,0 +1,101 @@ + +uint * wil_details_FeatureReporting_RecordUsageInCache + (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_180018870: + wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_180018860: + wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_180018870; + if (uVar3 == 5) goto LAB_180018860; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar5 = uVar3 - 0x140; + if ((int)uVar5 < 0x40) { + uVar4 = param_2[1]; + do { + if (((uVar4 & 0x10) == 0) || (uVar2 = 1, (uVar4 >> 5 & 0x3f) != uVar5)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar4 == uVar2; + if (bVar6) { + param_2[1] = (uVar5 * 0x20 ^ uVar4) & 0x7e0 ^ uVar4 | 0x10; + uVar2 = uVar4; + } + uVar4 = uVar2; + UNLOCK(); + } while (!bVar6); + if (param_1[4] != 0) { + return param_1; + } + } + param_1[2] = uVar3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + } + uVar5 = 0; + if (uVar3 == 2) { + uVar5 = 2; + } + else if (uVar3 == 3) { + uVar5 = 8; + } + else if (uVar3 == 6) { + uVar5 = 4; + } + else if (uVar3 == 7) { + uVar5 = 0x10; + } + uVar4 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar5 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar4 = 0; + } + *param_1 = uVar4; + } + return param_1; +} + ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|114| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|180018898| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -0,0 +1,28 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +void wil_details_FeatureReporting_ReportUsageToService + (undefined8 param_1,undefined8 param_2,uint param_3) + +{ + bool bVar1; + uint uVar2; + undefined7 extraout_var; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + local_res18[0] = param_3; + uVar2 = wil_details_MapReportingKind(param_3,uVar4); + bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && + (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook) + (0x3ae5442,&Feature_1881917752_logged_traits,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|226| |called|NTDLL.DLL::RtlNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|180018914| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -0,0 +1,48 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool wil_details_FeatureReporting_ReportUsageToServiceDirect + (undefined8 param_1,undefined8 param_2,ulonglong param_3) + +{ + uint6 uVar1; + uint *puVar2; + undefined1 auStack_88 [32]; + uint *local_68; + undefined8 local_58; + uint local_50 [6]; + uint local_38; + uint uStack_34; + uint uStack_30; + uint uStack_2c; + undefined8 local_28; + ulonglong local_20; + + local_20 = __security_cookie ^ (ulonglong)auStack_88; + puVar2 = wil_details_FeatureReporting_RecordUsageInCache + (local_50,(uint *)&Feature_1881917752__private_reporting,param_3, + (uint)((ulonglong)param_2 >> 0x20)); + local_38 = *puVar2; + uStack_34 = puVar2[1]; + uStack_30 = puVar2[2]; + uStack_2c = puVar2[3]; + local_28 = *(undefined8 *)(puVar2 + 4); + if (g_wil_details_recordFeatureUsage != (code *)0x0) { + local_68 = &local_38; + (*g_wil_details_recordFeatureUsage) + (0x3ae5442,param_3 & 0xffffffff,1,&Feature_1881917752__private_reporting); + } + if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { + local_58._0_6_ = CONCAT24((short)(param_3 & 0xffffffff),0x3ae5442); + uVar1 = (uint6)local_58; + local_58 = (ulonglong)(uint6)local_58; + if (((uint)param_2 >> 0xb & 1) != 0) { + local_58 = CONCAT26(1,uVar1); + } + RtlNotifyFeatureUsage(&local_58); + } + return (int)local_28 == 0; +} + ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|263| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_AreDependenciesEnabled
wil_details_IsEnabledFallback| |paramcount|3| |address|180018a00| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -0,0 +1,68 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ + +ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (uint *param_1,ulonglong param_2,longlong param_3) + +{ + int iVar1; + uint uVar2; + ulonglong uVar3; + uint uVar4; + uint uVar5; + ulonglong uVar6; + bool bVar7; + uint local_res8 [2]; + undefined8 local_res10; + + iVar1 = 0; + local_res8[0] = 0; + local_res10 = param_2; + if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { + iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); + } + uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); + if (*(char *)(param_3 + 0x1c) == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); + } + uVar3 = param_2 & 0xffffffff; + do { + uVar6 = param_2; + uVar5 = (uint)uVar3; + local_res10 = CONCAT44(local_res10._4_4_,uVar5); + if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0)) + { + uVar4 = uVar5 & 0xfffff63e | uVar2 & 0x9c1; + uVar5 = uVar4 | 2; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; + } + if ((uVar6 & 4) == 0) { + uVar4 = uVar2 & 0x400 | uVar5 & 0xfffffbff; + uVar5 = uVar4 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; + } + uVar3 = uVar6 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar7 = (uint)uVar6 == uVar4; + if (bVar7) { + *param_1 = uVar5; + } + else { + uVar3 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar3; + } while (!bVar7); + if (((uVar6 & 4) == 0) && + (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { + (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) + (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar2 & 0x9c1 | uVar5 & 0xfffff63e); + } + return local_res10; +} + ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|1| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|180018b10| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -0,0 +1,41 @@ + +void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + if ((Feature_1881917752__private_featureState & 2) != 0) { + uVar2 = Feature_1881917752__private_featureState; + while ((uVar2 & 1) == (param_1 & 1)) { + LOCK(); + bVar4 = uVar2 == Feature_1881917752__private_featureState; + uVar1 = uVar3 | uVar2; + if (!bVar4) { + uVar2 = Feature_1881917752__private_featureState; + uVar1 = Feature_1881917752__private_featureState; + } + Feature_1881917752__private_featureState = uVar1; + UNLOCK(); + if (bVar4) { + return; + } + if ((uVar2 & 2) == 0) { + return; + } + } + } + return; +} + ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|266| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_AreDependenciesEnabled| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|180018b64| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -0,0 +1,56 @@ + +uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) + +{ + char cVar1; + uint uVar2; + undefined8 uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + uint uVar7; + uint uVar8; + uint uVar9; + uint local_38 [8]; + + cVar1 = *(char *)(param_1 + 0x1c); + local_38[0] = 0; + local_38[1] = 0; + local_38[2] = 0; + local_38[3] = 0; + uVar6 = 1; + *param_2 = 1; + local_38[4] = 0; + local_38[5] = 0; + uVar3 = wil_RtlStagingConfig_QueryFeatureState + (local_38,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2)); + uVar7 = -(uint)(local_38[5] != 0) & 0x800; + uVar8 = uVar7 | -(uint)(local_38[4] != 0) & 0x400; + uVar2 = -(uint)((int)uVar3 != 0) & local_38[0] & 3; + uVar4 = uVar2 << 7; + if (uVar2 == 0) { + uVar2 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar2 = 0; + if (local_38[0] == 2) { + uVar2 = 0x40; + } + } + uVar5 = uVar2 | uVar4 | uVar8; + uVar9 = uVar6; + if ((uVar8 == 0xc00) || (uVar9 = 0, uVar2 != 0)) { + uVar8 = uVar6; + if (*(longlong *)(param_1 + 0x20) != 0) { + uVar8 = wil_details_AreDependenciesEnabled(param_1); + } + if ((uVar9 != 0) && (uVar8 == 0)) { + uVar5 = uVar2 | uVar4 | uVar7; + } + if (((uVar5 & 0x40) != 0) && (uVar8 != 0)) goto LAB_180018c4d; + } + uVar6 = 0; +LAB_180018c4d: + return uVar5 | uVar6; +} + ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_1881917752__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|180018c78| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -0,0 +1,26 @@ + +uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) + +{ + uint uVar1; + undefined4 *puVar2; + ulonglong local_res18; + + uVar1 = (uint)param_1; + local_res18 = (ulonglong)param_1 & 0xffffffff; + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &Feature_1881917752__private_featureState; + local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + (&Feature_1881917752__private_featureState,(ulonglong)param_1, + 0x180021618); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && + (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), + param_2 - 3 < 2)) { + wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## wil_details_MapReportingKind ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|1| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|180018d08| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -0,0 +1,33 @@ + +uint wil_details_MapReportingKind(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## NTDLL.DLL::RtlNotifyFeatureUsage ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|RtlNotifyFeatureUsage| |fullname|NTDLL.DLL::RtlNotifyFeatureUsage| |refcount|2| |length|0| |called|| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|0| |address|EXTERNAL:0000000f| |sig|undefined RtlNotifyFeatureUsage(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTDLL.DLL::RtlNotifyFeatureUsage* ## NTDLL.DLL::RtlQueryFeatureConfiguration ### Function Meta |Key|cx_8457.dll| | :---: | :---: | |name|RtlQueryFeatureConfiguration| |fullname|NTDLL.DLL::RtlQueryFeatureConfiguration| |refcount|2| |length|0| |called|| |calling|wil_RtlStagingConfig_QueryFeatureState| |paramcount|0| |address|EXTERNAL:00000010| |sig|undefined RtlQueryFeatureConfiguration(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for NTDLL.DLL::RtlQueryFeatureConfiguration* # Modified *Modified functions contain code changes* ## I_XmlUnmarshallKeyInfo ### Match Info |Key|cx_8115.dll - cx_8457.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.05| |i_ratio|0.23| |m_ratio|0.95| |b_ratio|0.42| |match_types|SymbolsHash| ### Function Meta Diff |Key|cx_8115.dll|cx_8457.dll| | :---: | :---: | :---: | |name|I_XmlUnmarshallKeyInfo|I_XmlUnmarshallKeyInfo| |fullname|I_XmlUnmarshallKeyInfo|I_XmlUnmarshallKeyInfo| |refcount|3|3| |`length`|4849|5197| |`called`|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
I_DecStringToBigEndianBytes
I_XmlAllocAndCopyKeyInfo
I_XmlGetEncoded
WPPTraceLogA
_DBG_BASENAME
memcpy|API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
Feature_1881917752__private_IsEnabledDeviceUsageNoInline
I_DecStringToBigEndianBytes
I_XmlAllocAndCopyKeyInfo
I_XmlGetEncoded
WPPTraceLogA
memcpy| |calling|I_CryptXmlDecode
I_CryptXmlDecodeKeyInfo|I_CryptXmlDecode
I_CryptXmlDecodeKeyInfo| |paramcount|6|6| |`address`|180001010|1800137d0| |sig|long __cdecl I_XmlUnmarshallKeyInfo(void * param_1, WS_CHARSET param_2, ulong param_3, WS_TYPE_KeyInfo * param_4, _CRYPT_XML_WS_STATE * param_5, _CRYPT_XML_KEY_INFO * * param_6)|long __cdecl I_XmlUnmarshallKeyInfo(void * param_1, WS_CHARSET param_2, ulong param_3, WS_TYPE_KeyInfo * param_4, _CRYPT_XML_WS_STATE * param_5, _CRYPT_XML_KEY_INFO * * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### I_XmlUnmarshallKeyInfo Called Diff ```diff --- I_XmlUnmarshallKeyInfo called +++ I_XmlUnmarshallKeyInfo called @@ -3,0 +4 @@ +Feature_1881917752__private_IsEnabledDeviceUsageNoInline @@ -8 +8,0 @@ -_DBG_BASENAME ``` ### I_XmlUnmarshallKeyInfo Diff ```diff --- I_XmlUnmarshallKeyInfo +++ I_XmlUnmarshallKeyInfo @@ -1,703 +1,824 @@ /* long __cdecl I_XmlUnmarshallKeyInfo(void * __ptr64,enum WS_CHARSET,unsigned long,struct WS_TYPE_KeyInfo * __ptr64,struct _CRYPT_XML_WS_STATE * __ptr64,struct _CRYPT_XML_KEY_INFO * __ptr64 * __ptr64) */ long __cdecl I_XmlUnmarshallKeyInfo (void *param_1,WS_CHARSET param_2,ulong param_3,WS_TYPE_KeyInfo *param_4, _CRYPT_XML_WS_STATE *param_5,_CRYPT_XML_KEY_INFO **param_6) { - int iVar1; - HLOCAL hMem; + char cVar1; uint uVar2; int iVar3; - char *pcVar4; - ulonglong uVar5; - undefined4 uVar6; - ulonglong uVar7; - char cVar8; - int *piVar9; + undefined4 *puVar4; + undefined4 uVar5; + int *piVar6; + char *pcVar7; + long lVar8; + uint uVar9; + SIZE_T dwBytes; longlong lVar10; - longlong lVar11; - uint uVar12; - SIZE_T dwBytes; - undefined4 *puVar13; - LPVOID pvVar14; - char *pcVar15; - undefined8 uVar16; - char *pcVar17; - longlong lVar18; + ulonglong uVar11; + ulonglong uVar12; + ulonglong uVar13; + longlong lVar14; + longlong lVar15; + char *pcVar16; + LPVOID pvVar17; + undefined8 uVar18; longlong lVar19; undefined4 *puVar20; - void *_Dst; + void *pvVar21; uint local_res20; + uint local_58; HLOCAL local_50; longlong local_48; longlong local_40; local_50 = (HLOCAL)0x0; - local_res20 = 0; + local_58 = 0; + *param_6 = (_CRYPT_XML_KEY_INFO *)0x0; + uVar2 = *(uint *)(param_4 + 0x10); local_48 = 0; - *param_6 = (_CRYPT_XML_KEY_INFO *)0x0; - if ((*(uint *)(param_4 + 0x10) < 0x7ff9) && (*(uint *)param_4 < 0x101)) { - dwBytes = (ulonglong)*(uint *)(param_4 + 0x10) * 0x80 + 0x50 + + if ((uVar2 < 0x7ff9) && (*(uint *)param_4 < 0x101)) { + uVar13 = 0; + local_res20 = 0; + dwBytes = (ulonglong)uVar2 * 0x80 + 0x50 + ((ulonglong)(*(uint *)param_4 + 1) * 2 + 7 & 0xfffffffffffffff8); - uVar7 = 0; + if (uVar2 != 0) { LAB_0: - uVar12 = (uint)uVar7; - if (*(uint *)(param_4 + 0x10) <= uVar12) goto LAB_1; - lVar19 = uVar7 * 0xa0; - piVar9 = (int *)(*(longlong *)(param_4 + 0x18) + lVar19); - iVar3 = *piVar9; - if (iVar3 == 4) { - uVar7 = 0; - dwBytes = dwBytes + (ulonglong)(uint)piVar9[2] * 0x18; - while( true ) { - if (*(uint *)(*(longlong *)(param_4 + 0x18) + 8 + lVar19) <= (uint)uVar7) break; - puVar13 = (undefined4 *) - (uVar7 * 0x38 + *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar19)); - switch(*puVar13) { - case 1: - dwBytes = dwBytes + ((ulonglong)(puVar13[2] + 1) * 2 + 7 & 0xfffffffffffffff8) + - ((ulonglong)(puVar13[6] + 1) * 2 + 7 & 0xfffffffffffffff8); - break; - case 2: - case 4: - case 5: - dwBytes = dwBytes + ((ulonglong)(uint)puVar13[2] + 7 & 0xfffffffffffffff8); - break; - case 3: - dwBytes = dwBytes + ((ulonglong)(puVar13[2] + 1) * 2 + 7 & 0xfffffffffffffff8); - break; - case 6: - uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(puVar13 + 2),param_2,param_3, - (_CRYPT_XML_BLOB *)(puVar13 + 10)); - if ((int)uVar2 < 0) { - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x651; - goto LAB_2; - } - } - uVar7 = (ulonglong)((uint)uVar7 + 1); - } - } - else { + lVar10 = *(longlong *)(param_4 + 0x18); + lVar14 = uVar13 * 0xa0; + iVar3 = *(int *)(lVar10 + lVar14); if (iVar3 == 1) { - dwBytes = dwBytes + ((ulonglong)(piVar9[2] + 1) * 2 + 7 & 0xfffffffffffffff8); - goto LAB_3; - } - if (iVar3 == 2) { - iVar3 = piVar9[2]; - if (iVar3 == 2) { - uVar7 = (ulonglong)(uint)piVar9[8] + 7 & 0xfffffffffffffff8; -LAB_4: - dwBytes = dwBytes + ((ulonglong)(uint)piVar9[4] + 7 & 0xfffffffffffffff8); + dwBytes = dwBytes + ((ulonglong)(*(int *)(lVar10 + 8 + lVar14) + 1) * 2 + 7 & + 0xfffffffffffffff8); + } + else if (iVar3 == 2) { + iVar3 = *(int *)(lVar10 + 8 + lVar14); + if (iVar3 == 1) { + uVar13 = ((ulonglong)*(uint *)(lVar10 + 0x70 + lVar14) + 7 & 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar10 + 0x60 + lVar14) + 7 & 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar10 + 0x50 + lVar14) + 7 & 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar10 + 0x40 + lVar14) + 7 & 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar10 + 0x30 + lVar14) + 7 & 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar10 + 0x20 + lVar14) + 7 & 0xfffffffffffffff8); } else { - if (iVar3 == 1) { - uVar7 = ((ulonglong)(uint)piVar9[0x1c] + 7 & 0xfffffffffffffff8) + - ((ulonglong)(uint)piVar9[0x18] + 7 & 0xfffffffffffffff8) + - ((ulonglong)(uint)piVar9[0x14] + 7 & 0xfffffffffffffff8) + - ((ulonglong)(uint)piVar9[0x10] + 7 & 0xfffffffffffffff8) + - ((ulonglong)(uint)piVar9[0xc] + 7 & 0xfffffffffffffff8) + - ((ulonglong)(uint)piVar9[8] + 7 & 0xfffffffffffffff8); + if (iVar3 != 2) { + if (iVar3 == 3) { + iVar3 = *(int *)(lVar10 + 0x10 + lVar14); + if (iVar3 == 2) { + dwBytes = dwBytes + ((ulonglong)(*(int *)(lVar10 + 0x18 + lVar14) + 1) * 2 + 7 & + 0xfffffffffffffff8); + } + else if (iVar3 == 1) { + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(lVar10 + 0x18 + lVar14) + ,param_2,param_3,(_CRYPT_XML_BLOB *)(lVar10 + 0x28 + lVar14) + ); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_1; + } + } + dwBytes = dwBytes + ((ulonglong) + *(uint *)(lVar14 + 0x38 + *(longlong *)(param_4 + 0x18)) + 7 & + 0xfffffffffffffff8) + + ((ulonglong)*(uint *)(lVar14 + 0x48 + *(longlong *)(param_4 + 0x18)) + 7 & + 0xfffffffffffffff8); + } + else if (iVar3 == 4) { + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(lVar10 + 0x10 + lVar14), + param_2,param_3,(_CRYPT_XML_BLOB *)(lVar10 + 0x80 + lVar14)); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_2; + } + } + else if (iVar3 == 5) { + iVar3 = *(int *)(lVar10 + 0x10 + lVar14); + if (iVar3 == 2) { + dwBytes = dwBytes + ((ulonglong)(*(int *)(lVar10 + 0x18 + lVar14) + 1) * 2 + 7 & + 0xfffffffffffffff8); + } + else if (iVar3 == 1) { + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(lVar10 + 0x18 + lVar14) + ,param_2,param_3,(_CRYPT_XML_BLOB *)(lVar10 + 0x28 + lVar14) + ); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_3; + } + } + uVar2 = *(uint *)(lVar14 + 0x38 + *(longlong *)(param_4 + 0x18)); + if ((uVar2 & 1) != 0) { + local_48 = *(longlong *)(lVar14 + 0x40 + *(longlong *)(param_4 + 0x18)); + local_58 = uVar2 - 1 >> 1; + uVar2 = Feature_1881917752__private_IsEnabledDeviceUsageNoInline(); + if (uVar2 == 0) { + dwBytes = dwBytes + local_58 * 2; + } + else { + dwBytes = dwBytes + ((ulonglong)local_58 + 7 & 0xfffffffffffffff8) * 2; + } + goto LAB_4; + } + uVar13 = 0x8009210f; + pcVar16 = ""; + goto LAB_5; + } goto LAB_4; } - if (iVar3 == 3) { - if (piVar9[4] == 2) { - dwBytes = dwBytes + ((ulonglong)(piVar9[6] + 1) * 2 + 7 & 0xfffffffffffffff8); - } - else if ((piVar9[4] == 1) && - (uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(piVar9 + 6), - param_2,param_3,(_CRYPT_XML_BLOB *)(piVar9 + 10)), - (int)uVar2 < 0)) { - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x5d1; - goto LAB_2; - } - dwBytes = dwBytes + ((ulonglong)*(uint *)(*(longlong *)(param_4 + 0x18) + 0x38 + lVar19) - + 7 & 0xfffffffffffffff8) + - ((ulonglong)*(uint *)(*(longlong *)(param_4 + 0x18) + 0x48 + lVar19) + 7 & - 0xfffffffffffffff8); - goto LAB_3; + uVar13 = (ulonglong)*(uint *)(lVar10 + 0x20 + lVar14) + 7 & 0xfffffffffffffff8; + } + dwBytes = dwBytes + ((ulonglong)*(uint *)(lVar10 + 0x10 + lVar14) + 7 & 0xfffffffffffffff8) + + uVar13; + } + else if (iVar3 == 3) { + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(lVar10 + 8 + lVar14),param_2, + param_3,(_CRYPT_XML_BLOB *)(lVar10 + 0x90 + lVar14)); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_6; + } + } + else if (iVar3 == 4) { + uVar2 = *(uint *)(lVar10 + 8 + lVar14); + uVar12 = 0; + dwBytes = dwBytes + (ulonglong)uVar2 * 0x18; + if (uVar2 != 0) { + do { + puVar4 = (undefined4 *)(*(longlong *)(lVar10 + 0x10 + lVar14) + uVar12 * 0x38); + switch(*puVar4) { + case 1: + dwBytes = dwBytes + ((ulonglong)(puVar4[2] + 1) * 2 + 7 & 0xfffffffffffffff8) + + ((ulonglong)(puVar4[6] + 1) * 2 + 7 & 0xfffffffffffffff8); + break; + case 2: + case 4: + case 5: + dwBytes = dwBytes + ((ulonglong)(uint)puVar4[2] + 7 & 0xfffffffffffffff8); + break; + case 3: + dwBytes = dwBytes + ((ulonglong)(puVar4[2] + 1) * 2 + 7 & 0xfffffffffffffff8); + break; + case 6: + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(puVar4 + 2),param_2, + param_3,(_CRYPT_XML_BLOB *)(puVar4 + 10)); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_7; + } + } + lVar10 = *(longlong *)(param_4 + 0x18); + uVar2 = (int)uVar12 + 1; + uVar12 = (ulonglong)uVar2; + } while (uVar2 < *(uint *)(lVar14 + 8 + lVar10)); + } + } + else if (iVar3 == 5) { + uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(lVar10 + 8 + lVar14),param_2, + param_3,(_CRYPT_XML_BLOB *)(lVar10 + 0x90 + lVar14)); + uVar13 = (ulonglong)uVar2; + if ((int)uVar2 < 0) { + pcVar16 = ""; + goto LAB_8; + } + } +LAB_4: + local_res20 = local_res20 + 1; + uVar13 = (ulonglong)local_res20; + if (*(uint *)(param_4 + 0x10) <= local_res20) goto LAB_9; + goto LAB_0; + } +LAB_9: + puVar4 = HeapAlloc(param_1,8,dwBytes); + if (puVar4 != (undefined4 *)0x0) { + *puVar4 = 0x28; + puVar20 = puVar4 + 10; + if (*(int *)param_4 != 0) { + *(undefined4 **)(puVar4 + 2) = puVar20; + memcpy(puVar20,*(void **)(param_4 + 8),(ulonglong)*(uint *)param_4 * 2); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)(*(int *)param_4 + 1) * 2 + 7 & 0xfffffffffffffff8)); + } + *(undefined4 **)(puVar4 + 6) = puVar20; + uVar13 = 0; + uVar2 = *(uint *)(param_4 + 0x10); + puVar4[4] = uVar2; + puVar20 = puVar20 + (ulonglong)uVar2 * 0x20; + local_res20 = 0; + if (uVar2 != 0) { + do { + lVar10 = uVar13 * 0xa0; + lVar14 = uVar13 * 0x80; + *(undefined4 *)(lVar14 + *(longlong *)(puVar4 + 6)) = + *(undefined4 *)(lVar10 + *(longlong *)(param_4 + 0x18)); + piVar6 = (int *)(*(longlong *)(param_4 + 0x18) + lVar10); + iVar3 = *piVar6; + if (iVar3 == 1) { + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 8 + lVar14) = puVar20; + memcpy(puVar20,*(void **)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x18) + 8 + lVar10) * 2); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)(*(int *)(*(longlong *)(param_4 + 0x18) + 8 + lVar10) + 1) * 2 + 7 + & 0xfffffffffffffff8)); } - if (iVar3 == 4) { - uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(piVar9 + 4),param_2,param_3 - ,(_CRYPT_XML_BLOB *)(piVar9 + 0x20)); - if (-1 < (int)uVar2) goto LAB_3; - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x60e; - goto LAB_2; + else if (iVar3 == 2) { + iVar3 = piVar6[2]; + if (iVar3 == 1) { + uVar5 = 1; + } + else if (iVar3 == 2) { + uVar5 = 2; + } + else if ((iVar3 == 3) || (iVar3 == 5)) { + uVar5 = 3; + } + else { + uVar5 = 4; + } + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 8 + lVar14) = uVar5; + lVar15 = *(longlong *)(param_4 + 0x18) + lVar10; + iVar3 = *(int *)(lVar15 + 8); + if (iVar3 == 1) { + if (*(int *)(lVar15 + 0x10) != 0) { + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x18 + lVar14) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + memcpy(puVar20,*(void **)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(*(longlong *)(param_4 + 0x18) + 0x20 + lVar10) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x28 + lVar14) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x20 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x28 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(uVar13 * 0xa0 + 0x50 + *(longlong *)(param_4 + 0x18)) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x58 + lVar10) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x50 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x50 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x58 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x50 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x50 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(uVar13 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x48 + lVar10) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x40 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x48 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x40 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x40 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(uVar13 * 0xa0 + 0x30 + *(longlong *)(param_4 + 0x18)) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x38 + lVar10) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x30 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x30 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x38 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x30 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x30 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(uVar13 * 0xa0 + 0x60 + *(longlong *)(param_4 + 0x18)) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x68 + lVar10) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x60 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x60 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x68 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x60 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x60 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + if (*(int *)(uVar13 * 0xa0 + 0x70 + *(longlong *)(param_4 + 0x18)) != 0) { + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x78 + lVar10) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x70 + lVar10) = + *(undefined4 *)(uVar13 * 0xa0 + 0x70 + *(longlong *)(param_4 + 0x18)); + memcpy(puVar20,*(void **)(uVar13 * 0xa0 + 0x78 + *(longlong *)(param_4 + 0x18)), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x70 + lVar10)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x70 + lVar10) + 7 & + 0xfffffffffffffff8)); + } + } + else if (iVar3 == 2) { + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x18 + lVar14) = puVar20; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + memcpy(puVar20,*(void **)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14)); + pvVar21 = (void *)((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 7 + & 0xfffffffffffffff8)); + *(void **)(*(longlong *)(puVar4 + 6) + 0x28 + lVar14) = pvVar21; + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x20 + lVar10); + memcpy(pvVar21,*(void **)(*(longlong *)(param_4 + 0x18) + 0x28 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar14)); + puVar20 = (undefined4 *) + ((longlong)pvVar21 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x20 + lVar14) + 7 & + 0xfffffffffffffff8)); + } + else if (iVar3 == 3) { + if (*(int *)(lVar15 + 0x10) == 2) { + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = puVar20; + memcpy(puVar20,*(void **)(*(longlong *)(param_4 + 0x18) + 0x20 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10) * 2); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)(*(int *)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10) + 1) + * 2 + 7 & 0xfffffffffffffff8)); + } + else if (*(int *)(lVar15 + 0x10) == 1) { + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x3c + lVar14) = + *(undefined4 *)(lVar15 + 0x2c); + *(undefined8 *)(*(longlong *)(puVar4 + 6) + 0x40 + lVar14) = + *(undefined8 *)(*(longlong *)(param_4 + 0x18) + 0x30 + lVar10); + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x38 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x28 + lVar10); + } + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x20 + lVar14) = puVar20; + if (local_50 != (HLOCAL)0x0) { + LocalFree(local_50); + local_50 = (HLOCAL)0x0; + } + uVar12 = I_DecStringToBigEndianBytes + (*(short **)(uVar13 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)), + *(uint *)(uVar13 * 0xa0 + 0x38 + *(longlong *)(param_4 + 0x18)), + &local_50,(uint *)(*(longlong *)(puVar4 + 6) + 0x18 + lVar14)); + uVar11 = uVar12 & 0xffffffff; + if ((int)uVar12 < 0) { + pcVar16 = ""; + goto LAB_10; + } + lVar10 = uVar13 * 0x80; + memcpy(puVar20,local_50, + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x18 + lVar10)); + pvVar21 = (void *)((longlong)puVar20 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x18 + lVar10) + 7 + & 0xfffffffffffffff8)); + *(void **)(*(longlong *)(puVar4 + 6) + 0x30 + lVar10) = pvVar21; + if (local_50 != (HLOCAL)0x0) { + LocalFree(local_50); + local_50 = (HLOCAL)0x0; + } + uVar12 = I_DecStringToBigEndianBytes + (*(short **)(uVar13 * 0xa0 + 0x50 + *(longlong *)(param_4 + 0x18)), + *(uint *)(uVar13 * 0xa0 + 0x48 + *(longlong *)(param_4 + 0x18)), + &local_50,(uint *)(*(longlong *)(puVar4 + 6) + 0x28 + lVar14)); + uVar11 = uVar12 & 0xffffffff; + if ((int)uVar12 < 0) { + pcVar16 = ""; + goto LAB_11; + } + memcpy(pvVar21,local_50, + (ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x28 + uVar13 * 0x80)); + puVar20 = (undefined4 *) + ((longlong)pvVar21 + + ((ulonglong)*(uint *)(*(longlong *)(puVar4 + 6) + 0x28 + uVar13 * 0x80) + 7 + & 0xfffffffffffffff8)); + } + else if (iVar3 == 4) { + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x14 + lVar14) = + *(undefined4 *)(lVar15 + 0x84); + *(undefined8 *)(*(longlong *)(puVar4 + 6) + 0x18 + lVar14) = + *(undefined8 *)(*(longlong *)(param_4 + 0x18) + 0x88 + lVar10); + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x80 + lVar10); + } + else if (iVar3 == 5) { + if (*(int *)(lVar15 + 0x10) == 2) { + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = puVar20; + memcpy(puVar20,*(void **)(*(longlong *)(param_4 + 0x18) + 0x20 + lVar10), + (ulonglong)*(uint *)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10) * 2); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)(*(int *)(*(longlong *)(param_4 + 0x18) + 0x18 + lVar10) + 1) + * 2 + 7 & 0xfffffffffffffff8)); + } + else if (*(int *)(lVar15 + 0x10) == 1) { + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x3c + lVar14) = + *(undefined4 *)(lVar15 + 0x2c); + *(undefined8 *)(*(longlong *)(puVar4 + 6) + 0x40 + lVar14) = + *(undefined8 *)(*(longlong *)(param_4 + 0x18) + 0x30 + lVar10); + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 0x38 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x28 + lVar10); + } + uVar2 = Feature_1881917752__private_IsEnabledDeviceUsageNoInline(); + if (uVar2 != 0) { + local_48 = *(longlong *)(uVar13 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)); + local_58 = *(int *)(uVar13 * 0xa0 + 0x38 + *(longlong *)(param_4 + 0x18)) - 1U >> 1; + } + lVar10 = uVar13 * 0x80; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x20 + lVar10) = puVar20; + *(uint *)(*(longlong *)(puVar4 + 6) + 0x18 + lVar10) = local_58; + memcpy(puVar20,(void *)(local_48 + 1),(ulonglong)local_58); + uVar12 = (ulonglong)local_58 + 7 & 0xfffffffffffffff8; + pvVar21 = (void *)((longlong)puVar20 + uVar12); + *(void **)(*(longlong *)(puVar4 + 6) + 0x30 + lVar10) = pvVar21; + *(uint *)(*(longlong *)(puVar4 + 6) + 0x28 + lVar10) = local_58; + memcpy(pvVar21,(void *)(local_48 + 1 + (ulonglong)local_58),(ulonglong)local_58); + puVar20 = (undefined4 *)((longlong)pvVar21 + uVar12); + } } - if (iVar3 != 5) goto LAB_3; - if (piVar9[4] == 2) { - dwBytes = dwBytes + ((ulonglong)(piVar9[6] + 1) * 2 + 7 & 0xfffffffffffffff8); + else if (iVar3 == 3) { +LAB_12: + *(int *)(*(longlong *)(puVar4 + 6) + 0xc + lVar14) = piVar6[0x25]; + *(undefined8 *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = + *(undefined8 *)(*(longlong *)(param_4 + 0x18) + 0x98 + lVar10); + *(undefined4 *)(*(longlong *)(puVar4 + 6) + 8 + lVar14) = + *(undefined4 *)(*(longlong *)(param_4 + 0x18) + 0x90 + lVar10); } - else if ((piVar9[4] == 1) && - (uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(piVar9 + 6),param_2, - param_3,(_CRYPT_XML_BLOB *)(piVar9 + 10)), (int)uVar2 < 0 - )) { - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x5ee; - goto LAB_2; + else if (iVar3 == 4) { + uVar13 = 0; + *(int *)(*(longlong *)(puVar4 + 6) + 8 + lVar14) = piVar6[2]; + *(undefined4 **)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) = puVar20; + lVar15 = *(longlong *)(param_4 + 0x18); + uVar2 = *(uint *)(lVar15 + 8 + lVar10); + puVar20 = puVar20 + (ulonglong)uVar2 * 6; + if (uVar2 != 0) { + do { + lVar19 = uVar13 * 0x38; + local_40 = uVar13 * 0x18; + *(undefined4 *)(local_40 + *(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14)) + = *(undefined4 *)(lVar19 + *(longlong *)(lVar15 + 0x10 + lVar10)); + lVar15 = *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + switch(*(undefined4 *)(lVar15 + lVar19)) { + case 1: + *(undefined4 **) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + local_40) = + puVar20; + lVar15 = *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + memcpy(puVar20,*(void **)(lVar15 + 0x10 + lVar19), + (ulonglong)*(uint *)(lVar15 + 8 + lVar19) * 2); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong) + (*(int *)(*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + + 8 + lVar19) + 1) * 2 + 7 & 0xfffffffffffffff8)); + *(undefined4 **) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 0x10 + local_40) = + puVar20; + lVar15 = *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + memcpy(puVar20,*(void **)(lVar15 + 0x20 + lVar19), + (ulonglong)*(uint *)(lVar15 + 0x18 + lVar19) * 2); + iVar3 = *(int *)(*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + + 0x18 + lVar19); + goto LAB_13; + case 2: + *(undefined4 **) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 0x10 + local_40) = + puVar20; + *(undefined4 *) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + local_40) = + *(undefined4 *) + (*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 8 + lVar19); + memcpy(puVar20,*(void **)(*(longlong *) + (*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 0x10 + + lVar19), + (ulonglong) + *(uint *)(*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + + local_40)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong) + *(uint *)(*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + + 8 + lVar19) + 7 & 0xfffffffffffffff8)); + break; + case 3: + *(undefined4 **) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + local_40) = + puVar20; + lVar15 = *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10); + memcpy(puVar20,*(void **)(lVar15 + 0x10 + lVar19), + (ulonglong)*(uint *)(lVar15 + 8 + lVar19) * 2); + iVar3 = *(int *)(*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 8 + + lVar19); +LAB_13: + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong)(iVar3 + 1) * 2 + 7 & 0xfffffffffffffff8)); + break; + case 4: + case 5: + *(undefined4 **) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 0x10 + local_40) = + puVar20; + *(undefined4 *) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + local_40) = + *(undefined4 *) + (*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 8 + lVar19); + memcpy(puVar20,*(void **)(*(longlong *) + (*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 0x10 + + lVar19), + (ulonglong) + *(uint *)(*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + + local_40)); + puVar20 = (undefined4 *) + ((longlong)puVar20 + + ((ulonglong) + *(uint *)(*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + + 8 + lVar19) + 7 & 0xfffffffffffffff8)); + break; + case 6: + *(undefined4 *) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 0xc + local_40) = + *(undefined4 *)(lVar15 + 0x2c + lVar19); + *(undefined8 *) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 0x10 + local_40) = + *(undefined8 *) + (*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 0x30 + + lVar19); + *(undefined4 *) + (*(longlong *)(*(longlong *)(puVar4 + 6) + 0x10 + lVar14) + 8 + local_40) = + *(undefined4 *) + (*(longlong *)(*(longlong *)(param_4 + 0x18) + 0x10 + lVar10) + 0x28 + + lVar19); + } + lVar15 = *(longlong *)(param_4 + 0x18); + uVar2 = (int)uVar13 + 1; + uVar13 = (ulonglong)uVar2; + } while (uVar2 < *(uint *)(lVar10 + 8 + lVar15)); + } + uVar13 = (ulonglong)local_res20; } - uVar2 = *(uint *)(*(longlong *)(param_4 + 0x18) + 0x38 + lVar19); - if ((uVar2 & 1) == 0) { - uVar2 = 0x8009210f; - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x5f9; - goto LAB_2; + else if (iVar3 == 5) goto LAB_12; + local_res20 = (int)uVar13 + 1; + uVar13 = (ulonglong)local_res20; + } while (local_res20 < (uint)puVar4[4]); + } + uVar13 = I_XmlAllocAndCopyKeyInfo(param_1,(longlong)puVar4,param_6); + uVar11 = uVar13 & 0xffffffff; + if (-1 < (int)uVar13) { + lVar8 = 0; + goto LAB_14; + } + pcVar16 = ""; + do { + pcVar7 = pcVar16; + pcVar16 = pcVar7 + -1; + if (pcVar7[-1] == '\\') break; + } while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16); + if (pcVar7[-1] == '\\') { + pcVar16 = pcVar7; + } + uVar18 = 0x7e6; + goto LAB_15; + } + uVar13 = 0x8007000e; + pcVar16 = ""; + do { + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16); + uVar18 = 0x688; + } + else { + uVar13 = 0x80092101; + pcVar16 = ""; + do { + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16); + uVar18 = 0x5a3; + } + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_1: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x5db; + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_2: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x61f; + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_3: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x5f8; + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_5: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x603; + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_6: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x633; + goto LAB_16; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_8: + pcVar7 = pcVar16; + pcVar16 = pcVar7 + -1; + if (pcVar7[-1] == '\\') break; + } + if (pcVar7[-1] == '\\') { + pcVar16 = pcVar7; + } + uVar18 = 0x678; + goto LAB_17; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_10: + pcVar7 = pcVar16; + pcVar16 = pcVar7 + -1; + if (pcVar7[-1] == '\\') break; + } + if (pcVar7[-1] == '\\') { + pcVar16 = pcVar7; + } + uVar18 = 0x729; + goto LAB_15; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_11: + pcVar7 = pcVar16; + pcVar16 = pcVar7 + -1; + if (pcVar7[-1] == '\\') break; + } + if (pcVar7[-1] == '\\') { + pcVar16 = pcVar7; + } + uVar18 = 0x744; +LAB_15: + lVar8 = (long)uVar11; + WPPTraceLogA("ERROR : (0x%08x) %s:%u",uVar11,pcVar16,uVar18); +LAB_14: + if (local_50 != (HLOCAL)0x0) { + LocalFree(local_50); + } + uVar2 = 0; + if (puVar4[4] != 0) { + do { + lVar14 = *(longlong *)(puVar4 + 6); + lVar15 = (ulonglong)uVar2 * 0x80; + iVar3 = *(int *)(lVar15 + lVar14); + lVar10 = lVar15 + lVar14; + if (iVar3 == 2) { + if (*(int *)(lVar10 + 8) == 3) { + pvVar17 = *(LPVOID *)(lVar10 + 0x40); + } + else { + if (*(int *)(lVar10 + 8) != 4) goto LAB_18; + pvVar17 = *(LPVOID *)(lVar10 + 0x18); + } +LAB_19: + if (pvVar17 != (LPVOID)0x0) { + HeapFree(param_1,0,pvVar17); + } + } + else { + if (iVar3 == 3) { +LAB_20: + pvVar17 = *(LPVOID *)(lVar10 + 0x10); + goto LAB_19; + } + if (iVar3 == 4) { + uVar13 = 0; + if (*(int *)(lVar10 + 8) != 0) { + do { + lVar10 = *(longlong *)(lVar14 + 0x10 + lVar15); + if ((*(int *)(lVar10 + uVar13 * 0x18) == 6) && + (pvVar17 = *(LPVOID *)(lVar10 + 0x10 + uVar13 * 0x18), pvVar17 != (LPVOID)0x0)) { + HeapFree(param_1,0,pvVar17); + } + lVar14 = *(longlong *)(puVar4 + 6); + uVar9 = (int)uVar13 + 1; + uVar13 = (ulonglong)uVar9; + } while (uVar9 < *(uint *)(lVar14 + 8 + lVar15)); } - local_48 = *(longlong *)(*(longlong *)(param_4 + 0x18) + 0x40 + lVar19); - local_res20 = uVar2 - 1 >> 1; - uVar7 = (ulonglong)(local_res20 * 2); - } - dwBytes = dwBytes + uVar7; - uVar7 = (ulonglong)(uVar12 + 1); - goto LAB_0; - } - if (iVar3 == 3) { - uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(piVar9 + 2),param_2,param_3, - (_CRYPT_XML_BLOB *)(piVar9 + 0x24)); - if (-1 < (int)uVar2) goto LAB_3; - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x622; - goto LAB_2; - } - if ((iVar3 == 5) && - (uVar2 = I_XmlGetEncoded(param_1,param_5,*(_WS_XML_BUFFER **)(piVar9 + 2),param_2,param_3, - (_CRYPT_XML_BLOB *)(piVar9 + 0x24)), (int)uVar2 < 0)) { - pcVar17 = "ERROR : (0x%08x) %s:%u"; - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x667; - goto LAB_2; - } - } -LAB_3: - uVar7 = (ulonglong)(uVar12 + 1); - goto LAB_0; - } - uVar2 = 0x80092101; - pcVar4 = ""; - do { - pcVar15 = pcVar4; - cVar8 = pcVar15[-1]; - pcVar4 = pcVar15 + -1; - if (cVar8 == '\\') break; - } while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar4); - uVar16 = 0x599; -LAB_5: - pcVar17 = "ERROR : (0x%08x) %s:%u"; - if (cVar8 == '\\') { - pcVar4 = pcVar15; - } -LAB_2: - WPPTraceLogA(pcVar17,(ulonglong)uVar2,pcVar4,uVar16); - uVar7 = 0; + } + else if (iVar3 == 5) goto LAB_20; + } +LAB_18: + uVar2 = uVar2 + 1; + } while (uVar2 < (uint)puVar4[4]); + } + HeapFree(param_1,0,puVar4); + return lVar8; + while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar16) { +LAB_7: + pcVar7 = pcVar16; + cVar1 = pcVar7[-1]; + pcVar16 = pcVar7 + -1; + if (cVar1 == '\\') break; + } + uVar18 = 0x662; +LAB_16: + if (cVar1 == '\\') { + pcVar16 = pcVar7; + } +LAB_17: + WPPTraceLogA("ERROR : (0x%08x) %s:%u",uVar13,pcVar16,uVar18); + uVar12 = 0; if (*(int *)(param_4 + 0x10) != 0) { do { - lVar19 = *(longlong *)(param_4 + 0x18); - lVar11 = uVar7 * 0xa0; - iVar3 = *(int *)(lVar11 + lVar19); + lVar14 = *(longlong *)(param_4 + 0x18); + lVar15 = uVar12 * 0xa0; + iVar3 = *(int *)(lVar14 + lVar15); + lVar10 = lVar14 + lVar15; if (iVar3 == 2) { - iVar3 = *(int *)(lVar11 + 8 + lVar19); + iVar3 = *(int *)(lVar10 + 8); + if (iVar3 != 3) { + if (iVar3 == 4) { + pvVar17 = *(LPVOID *)(lVar10 + 0x88); + goto LAB_21; + } + if (iVar3 != 5) goto LAB_22; + } + pvVar17 = *(LPVOID *)(lVar10 + 0x30); +LAB_21: + if (pvVar17 != (LPVOID)0x0) { + HeapFree(param_1,0,pvVar17); + } + } + else { if (iVar3 == 3) { - pvVar14 = *(LPVOID *)(lVar11 + 0x30 + lVar19); - goto joined_r0x0001800022d0; +LAB_23: + pvVar17 = *(LPVOID *)(lVar10 + 0x98); + goto LAB_21; } if (iVar3 == 4) { - pvVar14 = *(LPVOID *)(lVar11 + 0x88 + lVar19); - } - else { - if (iVar3 != 5) goto LAB_6; - pvVar14 = *(LPVOID *)(lVar11 + 0x30 + lVar19); - } - if (pvVar14 == (LPVOID)0x0) goto LAB_6; -LAB_7: - HeapFree(param_1,0,pvVar14); - } - else if (iVar3 == 3) { -LAB_8: - pvVar14 = *(LPVOID *)(lVar11 + 0x98 + lVar19); -joined_r0x0001800022d0: - if (pvVar14 != (LPVOID)0x0) goto LAB_7; - } - else if (iVar3 == 4) { - uVar5 = 0; - if (*(int *)(lVar11 + 8 + lVar19) != 0) { - do { - lVar19 = *(longlong *)(lVar11 + 0x10 + lVar19); - if ((*(int *)(lVar19 + uVar5 * 0x38) == 6) && - (pvVar14 = *(LPVOID *)(lVar19 + 0x30 + uVar5 * 0x38), pvVar14 != (LPVOID)0x0)) { - HeapFree(param_1,0,pvVar14); - } - lVar19 = *(longlong *)(param_4 + 0x18); - uVar12 = (int)uVar5 + 1; - uVar5 = (ulonglong)uVar12; - } while (uVar12 < *(uint *)(lVar11 + 8 + lVar19)); - } - } - else if (iVar3 == 5) goto LAB_8; -LAB_6: - uVar12 = (int)uVar7 + 1; - uVar7 = (ulonglong)uVar12; - } while (uVar12 < *(uint *)(param_4 + 0x10)); - } - return uVar2; -LAB_1: - puVar13 = HeapAlloc(param_1,8,dwBytes); - if (puVar13 != (undefined4 *)0x0) { - *puVar13 = 0x28; - puVar20 = puVar13 + 10; - if (*(int *)param_4 != 0) { - *(undefined4 **)(puVar13 + 2) = puVar20; - memcpy(puVar20,*(void **)(param_4 + 8),(ulonglong)*(uint *)param_4 * 2); - puVar20 = (undefined4 *) - ((longlong)puVar20 + ((ulonglong)(*(int *)param_4 + 1) * 2 + 7 & 0xfffffffffffffff8) - ); - } - *(undefined4 **)(puVar13 + 6) = puVar20; - uVar12 = *(uint *)(param_4 + 0x10); - puVar13[4] = uVar12; - puVar20 = puVar20 + (ulonglong)uVar12 * 0x20; - uVar7 = 0; -LAB_9: - uVar12 = (uint)uVar7; - if ((uint)puVar13[4] <= uVar12) goto LAB_10; - lVar19 = uVar7 * 0xa0; - lVar11 = uVar7 * 0x80; - *(undefined4 *)(lVar11 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + *(longlong *)(param_4 + 0x18)); - piVar9 = (int *)(*(longlong *)(param_4 + 0x18) + lVar19); - iVar3 = *piVar9; - if (iVar3 == 2) { - iVar3 = piVar9[2]; - if (iVar3 == 2) { - uVar6 = 2; - } - else if (iVar3 == 1) { - uVar6 = 1; - } - else if ((iVar3 == 3) || (iVar3 == 5)) { - uVar6 = 3; - } - else { - uVar6 = 4; - } - *(undefined4 *)(lVar11 + 8 + *(longlong *)(puVar13 + 6)) = uVar6; - lVar10 = *(longlong *)(param_4 + 0x18) + lVar19; - iVar3 = *(int *)(lVar10 + 8); - if (iVar3 == 2) { - *(undefined4 **)(lVar11 + 0x18 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(*(longlong *)(puVar13 + 6) + 0x10 + lVar11) + 7 & - 0xfffffffffffffff8)); - *(undefined4 **)(*(longlong *)(puVar13 + 6) + 0x28 + lVar11) = puVar20; - *(undefined4 *)(lVar11 + 0x20 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x20 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar19 + 0x28 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar11 + 0x20 + *(longlong *)(puVar13 + 6))); - uVar7 = (ulonglong)*(uint *)(lVar11 + 0x20 + *(longlong *)(puVar13 + 6)); -LAB_11: - puVar20 = (undefined4 *)((longlong)puVar20 + (uVar7 + 7 & 0xfffffffffffffff8)); - } - else { - if (iVar3 == 1) { - if (*(int *)(lVar10 + 0x10) != 0) { - *(undefined4 **)(lVar11 + 0x18 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); + uVar11 = 0; + if (*(int *)(lVar10 + 8) != 0) { + do { + lVar10 = *(longlong *)(lVar14 + 0x10 + lVar15); + if ((*(int *)(lVar10 + uVar11 * 0x38) == 6) && + (pvVar17 = *(LPVOID *)(lVar10 + 0x30 + uVar11 * 0x38), pvVar17 != (LPVOID)0x0)) { + HeapFree(param_1,0,pvVar17); + } + lVar14 = *(longlong *)(param_4 + 0x18); + uVar2 = (int)uVar11 + 1; + uVar11 = (ulonglong)uVar2; + } while (uVar2 < *(uint *)(lVar14 + 8 + lVar15)); } - if (*(int *)(lVar19 + 0x20 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar11 + 0x28 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x20 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x20 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x28 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x20 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar19 + 0x20 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); - } - if (*(int *)(uVar7 * 0xa0 + 0x50 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar19 + 0x58 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x50 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x50 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x58 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x50 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar19 + 0x50 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); - } - if (*(int *)(uVar7 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar19 + 0x48 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x40 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x40 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x48 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x40 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar19 + 0x40 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); - } - if (*(int *)(uVar7 * 0xa0 + 0x30 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar19 + 0x38 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x30 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x30 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x38 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x30 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar19 + 0x30 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); - } - if (*(int *)(uVar7 * 0xa0 + 0x60 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar19 + 0x68 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x60 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x60 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x68 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x60 + *(longlong *)(puVar13 + 6))); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(lVar19 + 0x60 + *(longlong *)(puVar13 + 6)) + 7 & - 0xfffffffffffffff8)); - } - if (*(int *)(uVar7 * 0xa0 + 0x70 + *(longlong *)(param_4 + 0x18)) != 0) { - lVar19 = uVar7 * 0x80; - *(undefined4 **)(lVar19 + 0x78 + *(longlong *)(puVar13 + 6)) = puVar20; - *(undefined4 *)(lVar19 + 0x70 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(uVar7 * 0xa0 + 0x70 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(uVar7 * 0xa0 + 0x78 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x70 + *(longlong *)(puVar13 + 6))); - uVar7 = (ulonglong)*(uint *)(lVar19 + 0x70 + *(longlong *)(puVar13 + 6)); - goto LAB_11; - } - goto LAB_12; - } - if (iVar3 == 3) { - if (*(int *)(lVar10 + 0x10) == 2) { - *(undefined4 **)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = puVar20; - memcpy(puVar20,*(void **)(lVar19 + 0x20 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)) * 2); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)(*(int *)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)) + 1) * 2 - + 7 & 0xfffffffffffffff8)); - } - else if (*(int *)(lVar10 + 0x10) == 1) { - *(undefined4 *)(lVar11 + 0x3c + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar10 + 0x2c); - *(undefined8 *)(lVar11 + 0x40 + *(longlong *)(puVar13 + 6)) = - *(undefined8 *)(lVar19 + 0x30 + *(longlong *)(param_4 + 0x18)); - *(undefined4 *)(lVar11 + 0x38 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x28 + *(longlong *)(param_4 + 0x18)); - } - *(undefined4 **)(lVar11 + 0x20 + *(longlong *)(puVar13 + 6)) = puVar20; - if (local_50 != (HLOCAL)0x0) { - LocalFree(local_50); - local_50 = (HLOCAL)0x0; - } - uVar7 = I_DecStringToBigEndianBytes - (*(short **)(*(longlong *)(param_4 + 0x18) + 0x40 + lVar19), - *(uint *)(*(longlong *)(param_4 + 0x18) + 0x38 + lVar19),&local_50, - (uint *)(*(longlong *)(puVar13 + 6) + 0x18 + lVar11)); - hMem = local_50; - if ((int)uVar7 < 0) { - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x718; - } - else { - memcpy(puVar20,local_50,(ulonglong)*(uint *)(lVar11 + 0x18 + *(longlong *)(puVar13 + 6)) - ); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)*(uint *)(*(longlong *)(puVar13 + 6) + 0x18 + lVar11) + 7 & - 0xfffffffffffffff8)); - *(undefined4 **)(*(longlong *)(puVar13 + 6) + 0x30 + lVar11) = puVar20; - if (hMem != (void *)0x0) { - LocalFree(hMem); - local_50 = (void *)0x0; - } - uVar7 = I_DecStringToBigEndianBytes - (*(short **)(*(longlong *)(param_4 + 0x18) + 0x50 + lVar19), - *(uint *)(*(longlong *)(param_4 + 0x18) + 0x48 + lVar19),&local_50, - (uint *)(*(longlong *)(puVar13 + 6) + 0x28 + lVar11)); - if (-1 < (int)uVar7) { - memcpy(puVar20,local_50, - (ulonglong)*(uint *)(lVar11 + 0x28 + *(longlong *)(puVar13 + 6))); - uVar7 = (ulonglong)*(uint *)(lVar11 + 0x28 + *(longlong *)(puVar13 + 6)); - goto LAB_11; - } - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - uVar16 = 0x733; - } - iVar3 = (int)uVar7; - WPPTraceLogA("ERROR : (0x%08x) %s:%u",uVar7 & 0xffffffff,pcVar4,uVar16); - goto LAB_13; - } - if (iVar3 == 4) { - *(undefined4 *)(lVar11 + 0x14 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar10 + 0x84); - *(undefined8 *)(lVar11 + 0x18 + *(longlong *)(puVar13 + 6)) = - *(undefined8 *)(lVar19 + 0x88 + *(longlong *)(param_4 + 0x18)); - *(undefined4 *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x80 + *(longlong *)(param_4 + 0x18)); - } - else if (iVar3 == 5) { - if (*(int *)(lVar10 + 0x10) == 2) { - *(undefined4 **)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = puVar20; - memcpy(puVar20,*(void **)(lVar19 + 0x20 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)) * 2); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)(*(int *)(lVar19 + 0x18 + *(longlong *)(param_4 + 0x18)) + 1) * 2 - + 7 & 0xfffffffffffffff8)); - } - else if (*(int *)(lVar10 + 0x10) == 1) { - *(undefined4 *)(lVar11 + 0x3c + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar10 + 0x2c); - *(undefined8 *)(lVar11 + 0x40 + *(longlong *)(puVar13 + 6)) = - *(undefined8 *)(lVar19 + 0x30 + *(longlong *)(param_4 + 0x18)); - *(undefined4 *)(lVar11 + 0x38 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x28 + *(longlong *)(param_4 + 0x18)); - } - uVar5 = (ulonglong)local_res20; - *(undefined4 **)(lVar11 + 0x20 + *(longlong *)(puVar13 + 6)) = puVar20; - *(uint *)(lVar11 + 0x18 + *(longlong *)(puVar13 + 6)) = local_res20; - memcpy(puVar20,(void *)(local_48 + 1),uVar5); - uVar7 = uVar5 + 7 & 0xfffffffffffffff8; - _Dst = (void *)((longlong)puVar20 + uVar7); - *(void **)(lVar11 + 0x30 + *(longlong *)(puVar13 + 6)) = _Dst; - *(uint *)(lVar11 + 0x28 + *(longlong *)(puVar13 + 6)) = local_res20; - memcpy(_Dst,(void *)(local_48 + 1 + uVar5),uVar5); - puVar20 = (undefined4 *)((longlong)_Dst + uVar7); - } - } - } - else { - if (iVar3 == 1) { - *(undefined4 **)(lVar11 + 8 + *(longlong *)(puVar13 + 6)) = puVar20; - memcpy(puVar20,*(void **)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)), - (ulonglong)*(uint *)(lVar19 + 8 + *(longlong *)(param_4 + 0x18)) * 2); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong)(*(int *)(lVar19 + 8 + *(longlong *)(param_4 + 0x18)) + 1) * 2 + 7 & - 0xfffffffffffffff8)); - goto LAB_12; - } - if (iVar3 != 3) { - if (iVar3 != 4) { - if (iVar3 == 5) goto LAB_14; - goto LAB_12; - } - uVar7 = 0; - *(int *)(lVar11 + 8 + *(longlong *)(puVar13 + 6)) = piVar9[2]; - *(undefined4 **)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = puVar20; - lVar10 = *(longlong *)(param_4 + 0x18); - uVar2 = *(uint *)(lVar10 + 8 + lVar19); - puVar20 = puVar20 + (ulonglong)uVar2 * 6; - if (uVar2 == 0) goto LAB_12; - do { - lVar18 = uVar7 * 0x38; - local_40 = uVar7 * 0x18; - *(undefined4 *)(local_40 + *(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6))) = - *(undefined4 *)(*(longlong *)(lVar19 + 0x10 + lVar10) + lVar18); - lVar10 = *(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - switch(*(undefined4 *)(lVar10 + lVar18)) { - case 1: - *(undefined4 **) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + local_40) = puVar20; - lVar10 = *(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar10 + 0x10 + lVar18), - (ulonglong)*(uint *)(lVar10 + 8 + lVar18) * 2); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong) - (*(int *)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + - lVar18) + 1) * 2 + 7 & 0xfffffffffffffff8)); - *(undefined4 **) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 0x10 + local_40) = puVar20 - ; - lVar10 = *(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar10 + 0x20 + lVar18), - (ulonglong)*(uint *)(lVar10 + 0x18 + lVar18) * 2); - iVar3 = *(int *)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 0x18 + - lVar18); - goto LAB_15; - case 2: - *(undefined4 **) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 0x10 + local_40) = puVar20 - ; - *(undefined4 *) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + local_40) = - *(undefined4 *) - (*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + lVar18); - memcpy(puVar20,*(void **)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + - 0x10 + lVar18), - (ulonglong) - *(uint *)(*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + - local_40)); - puVar20 = (undefined4 *) - ((longlong)puVar20 + - ((ulonglong) - *(uint *)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + - lVar18) + 7 & 0xfffffffffffffff8)); - break; - case 3: - *(undefined4 **) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + local_40) = puVar20; - lVar10 = *(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)); - memcpy(puVar20,*(void **)(lVar10 + 0x10 + lVar18), - (ulonglong)*(uint *)(lVar10 + 8 + lVar18) * 2); - iVar3 = *(int *)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + - lVar18); -LAB_15: - uVar5 = (ulonglong)(iVar3 + 1) * 2; -LAB_16: - puVar20 = (undefined4 *)((longlong)puVar20 + (uVar5 + 7 & 0xfffffffffffffff8)); - break; - case 4: - case 5: - *(undefined4 **) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 0x10 + local_40) = puVar20 - ; - *(undefined4 *) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + local_40) = - *(undefined4 *) - (*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + lVar18); - memcpy(puVar20,*(void **)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + - 0x10 + lVar18), - (ulonglong) - *(uint *)(*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + - local_40)); - uVar5 = (ulonglong) - *(uint *)(*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 8 + - lVar18); - goto LAB_16; - case 6: - *(undefined4 *) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 0xc + local_40) = - *(undefined4 *)(lVar10 + 0x2c + lVar18); - *(undefined8 *) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 0x10 + local_40) = - *(undefined8 *) - (*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 0x30 + lVar18); - *(undefined4 *) - (*(longlong *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) + 8 + local_40) = - *(undefined4 *) - (*(longlong *)(lVar19 + 0x10 + *(longlong *)(param_4 + 0x18)) + 0x28 + lVar18); - } - lVar10 = *(longlong *)(param_4 + 0x18); - uVar2 = (int)uVar7 + 1; - uVar7 = (ulonglong)uVar2; - } while (uVar2 < *(uint *)(lVar19 + 8 + lVar10)); - uVar7 = (ulonglong)(uVar12 + 1); - goto LAB_9; - } -LAB_14: - *(int *)(lVar11 + 0xc + *(longlong *)(puVar13 + 6)) = piVar9[0x25]; - *(undefined8 *)(lVar11 + 0x10 + *(longlong *)(puVar13 + 6)) = - *(undefined8 *)(lVar19 + 0x98 + *(longlong *)(param_4 + 0x18)); - *(undefined4 *)(lVar11 + 8 + *(longlong *)(puVar13 + 6)) = - *(undefined4 *)(lVar19 + 0x90 + *(longlong *)(param_4 + 0x18)); - } -LAB_12: - uVar7 = (ulonglong)(uVar12 + 1); - goto LAB_9; - } - uVar2 = 0x8007000e; - pcVar4 = ""; - do { - pcVar15 = pcVar4; - cVar8 = pcVar15[-1]; - pcVar4 = pcVar15 + -1; - if (cVar8 == '\\') break; - } while ("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp" < pcVar4); - uVar16 = 0x677; - goto LAB_5; -LAB_10: - uVar7 = I_XmlAllocAndCopyKeyInfo(param_1,(longlong)puVar13,param_6); - iVar3 = (int)uVar7; - if (iVar3 < 0) { - pcVar4 = _DBG_BASENAME("onecore\\ds\\security\\cryptoapi\\xml\\lib\\ws_marshall.cpp"); - WPPTraceLogA("ERROR : (0x%08x) %s:%u",uVar7 & 0xffffffff,pcVar4,0x7cc); - } - else { - iVar3 = 0; - } -LAB_13: - if (local_50 != (HLOCAL)0x0) { - LocalFree(local_50); - } - uVar12 = 0; - if (puVar13[4] != 0) { - do { - lVar11 = *(longlong *)(puVar13 + 6); - lVar10 = (ulonglong)uVar12 * 0x80; - iVar1 = *(int *)(lVar10 + lVar11); - lVar19 = lVar10 + lVar11; - if (iVar1 == 2) { - if (*(int *)(lVar19 + 8) == 3) { - pvVar14 = *(LPVOID *)(lVar19 + 0x40); - goto joined_r0x000180002188; - } - if ((*(int *)(lVar19 + 8) != 4) || - (pvVar14 = *(LPVOID *)(lVar19 + 0x18), pvVar14 == (LPVOID)0x0)) goto LAB_17; -LAB_18: - HeapFree(param_1,0,pvVar14); - } - else if (iVar1 == 3) { -LAB_19: - pvVar14 = *(LPVOID *)(lVar19 + 0x10); -joined_r0x000180002188: - if (pvVar14 != (LPVOID)0x0) goto LAB_18; - } - else if (iVar1 == 4) { - uVar7 = 0; - if (*(int *)(lVar19 + 8) != 0) { - do { - lVar19 = *(longlong *)(lVar10 + 0x10 + lVar11); - if ((*(int *)(lVar19 + uVar7 * 0x18) == 6) && - (pvVar14 = *(LPVOID *)(lVar19 + 0x10 + uVar7 * 0x18), pvVar14 != (LPVOID)0x0)) { - HeapFree(param_1,0,pvVar14); - } - lVar11 = *(longlong *)(puVar13 + 6); - uVar2 = (int)uVar7 + 1; - uVar7 = (ulonglong)uVar2; - } while (uVar2 < *(uint *)(lVar10 + 8 + lVar11)); - } - } - else if (iVar1 == 5) goto LAB_19; -LAB_17: - uVar12 = uVar12 + 1; - } while (uVar12 < (uint)puVar13[4]); - } - HeapFree(param_1,0,puVar13); - return iVar3; + } + else if (iVar3 == 5) goto LAB_23; + } +LAB_22: + uVar2 = (int)uVar12 + 1; + uVar12 = (ulonglong)uVar2; + } while (uVar2 < *(uint *)(param_4 + 0x10)); + } + return (long)uVar13; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|cx_8115.dll - cx_8457.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cx_8115.dll|cx_8457.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|26|28| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180018e98|1800199f8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## __security_check_cookie ### Match Info |Key|cx_8115.dll - cx_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cx_8115.dll|cx_8457.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|27|29| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|

Expand for full list:
CompareXmlTextA
CryptXmlCNGSign
CryptXmlCNGVerifySignature
CryptXmlCreateReference
CryptXmlDigestReference
CryptXmlGetStatus
I_CreateTransformChainEngine
I_CryptXmlCanonicalizeSignedInfo
I_CryptXmlExportPublicKey
I_CryptXmlGetCanonPropertiesForWsReader
I_CryptXmlHMACSign

I_CryptXmlImportPublicKeyExtension
I_CryptXmlResolveByIdOrElementName
I_CryptXmlResolveEmptyReference
I_CryptXmlSetEncodedCtxt
I_XmlCanonicalizeOnStream
I_XmlUnmarshallReference
InternalVerifyStackAvailable
SymCryptDetectCpuFeaturesByCpuid
WPPTraceLogA
WppInitUm
_IsMethodValidForKey
_LoadRegExtensions
_LoadRegKeyvalueExtensions
__GSHandlerCheckCommon
_resetstkoflw_static

| |paramcount|1|1| |`address`|180018f70|180019ad0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -26,0 +27,2 @@ +wil_RtlStagingConfig_QueryFeatureState +wil_details_FeatureReporting_ReportUsageToServiceDirect ``` ## _DBG_BASENAME ### Match Info |Key|cx_8115.dll - cx_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|cx_8115.dll|cx_8457.dll| | :---: | :---: | :---: | |name|_DBG_BASENAME|_DBG_BASENAME| |fullname|_DBG_BASENAME|_DBG_BASENAME| |`refcount`|403|393| |length|39|39| |called||| |`calling`|

Expand for full list:
C14N_ROUTINE
CRYPT_XML_ENCODE_ALGORITHM_CALLBACK
CRYPT_XML_ENCODE_REFERENCE_WRITE_CALLBACK
CRYPT_XML_SIGNEDINFO_CANONICAL_CALLBACK
CRYPT_XML_TRANSFORM_C14_WRITE_CALLBACK
CryptXmlAddObject
CryptXmlCAPI1Sign
CryptXmlCNGCreateDigest
CryptXmlCNGDigestData
CryptXmlCNGFinalizeDigest
CryptXmlCNGSign

CryptXmlCNGVerifySignature
CryptXmlCreateReference
CryptXmlDigestReference
CryptXmlEncode
CryptXmlGetAlgorithmInfo
CryptXmlGetDocContext
CryptXmlGetReference
CryptXmlGetSignature
CryptXmlGetStatus
CryptXmlImportPublicKey
CryptXmlOpenToDecode
CryptXmlOpenToEncode
CryptXmlSetHMACSecret
CryptXmlSign
CryptXmlVerifySignature
I_CRYPT_XML_C14N_DATA_PROVIDER_READ
I_CRYPT_XML_HANDLE_FREE_DOC
I_CRYPT_XML_TRANSFORM_C14N_CREATE
I_CreateTransformChainEngine
I_CryptXmlCanonicalizeSignedInfo
I_CryptXmlCheckUniqueId
I_CryptXmlDecode
I_CryptXmlDecodeKeyInfo
I_CryptXmlDecodeObject
I_CryptXmlEncodeAlgorithmProxy
I_CryptXmlEncodeInnerKeyValue
I_CryptXmlExportKeyValueFromHandle
I_CryptXmlExportPublicKey
I_CryptXmlGetCanonPropertiesForWsReader
I_CryptXmlHMACSign
I_CryptXmlHandleAllocObject
I_CryptXmlHandleAllocReference
I_CryptXmlHandleAllocSignature
I_CryptXmlImportPublicKeyExtension
I_CryptXmlObjectAddReference
I_CryptXmlPostSignEncode
I_CryptXmlPreSignEncode
I_CryptXmlResolveByIdOrElementName
I_CryptXmlResolveEmptyReference
I_CryptXmlSetEncodedCtxt
I_CryptXmlSignatureAddObject
I_CryptXmlSignatureAddReference
I_CryptXmlWsStateInitialize
I_DecStringToBigEndianBytes
I_EnvelopedXmlCanonicalizeOnStream
I_GetProperty
I_WS_READ_CALLBACK
I_XmlCanonicalizeOnStream
I_XmlEncodeFromBuffer
I_XmlEncodeInnerKeyValue
I_XmlGetEncoded
I_XmlGetEncodedElement
I_XmlGetKeyValueInnerElementName
I_XmlMarshallKeyInfo
I_XmlMarshallKeyValue
I_XmlMarshallObject
I_XmlMarshallReference
I_XmlMarshallSignature
I_XmlMarshallSignedInfo
I_XmlSetEncoded
I_XmlSetEncodedEx
I_XmlSetFromEncoded
I_XmlUnmarshallKeyInfo
I_XmlUnmarshallObject
I_XmlUnmarshallReference
I_XmlUnmarshallSignature
_IsMethodValidForKey
_LoadRegExtensions
_LoadRegKeyvalueExtensions

CryptXmlCNGVerifySignature
CryptXmlCreateReference
CryptXmlDigestReference
CryptXmlEncode
CryptXmlGetAlgorithmInfo
CryptXmlGetDocContext
CryptXmlGetReference
CryptXmlGetSignature
CryptXmlGetStatus
CryptXmlImportPublicKey
CryptXmlOpenToDecode
CryptXmlOpenToEncode
CryptXmlSetHMACSecret
CryptXmlSign
CryptXmlVerifySignature
I_CRYPT_XML_C14N_DATA_PROVIDER_READ
I_CRYPT_XML_HANDLE_FREE_DOC
I_CRYPT_XML_TRANSFORM_C14N_CREATE
I_CreateTransformChainEngine
I_CryptXmlCanonicalizeSignedInfo
I_CryptXmlCheckUniqueId
I_CryptXmlDecode
I_CryptXmlDecodeKeyInfo
I_CryptXmlDecodeObject
I_CryptXmlEncodeAlgorithmProxy
I_CryptXmlEncodeInnerKeyValue
I_CryptXmlExportKeyValueFromHandle
I_CryptXmlExportPublicKey
I_CryptXmlGetCanonPropertiesForWsReader
I_CryptXmlHMACSign
I_CryptXmlHandleAllocObject
I_CryptXmlHandleAllocReference
I_CryptXmlHandleAllocSignature
I_CryptXmlImportPublicKeyExtension
I_CryptXmlObjectAddReference
I_CryptXmlPostSignEncode
I_CryptXmlPreSignEncode
I_CryptXmlResolveByIdOrElementName
I_CryptXmlResolveEmptyReference
I_CryptXmlSetEncodedCtxt
I_CryptXmlSignatureAddObject
I_CryptXmlSignatureAddReference
I_CryptXmlWsStateInitialize
I_DecStringToBigEndianBytes
I_EnvelopedXmlCanonicalizeOnStream
I_GetProperty
I_WS_READ_CALLBACK
I_XmlCanonicalizeOnStream
I_XmlEncodeFromBuffer
I_XmlEncodeInnerKeyValue
I_XmlGetEncoded
I_XmlGetEncodedElement
I_XmlGetKeyValueInnerElementName
I_XmlMarshallKeyInfo
I_XmlMarshallKeyValue
I_XmlMarshallObject
I_XmlMarshallReference
I_XmlMarshallSignature
I_XmlMarshallSignedInfo
I_XmlSetEncoded
I_XmlSetEncodedEx
I_XmlSetFromEncoded
I_XmlUnmarshallObject
I_XmlUnmarshallReference
I_XmlUnmarshallSignature
_IsMethodValidForKey
_LoadRegExtensions
_LoadRegKeyvalueExtensions

| |paramcount|1|1| |`address`|18000dd8c|18000d4ac| |sig|char * __cdecl _DBG_BASENAME(char * param_1)|char * __cdecl _DBG_BASENAME(char * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### _DBG_BASENAME Calling Diff ```diff --- _DBG_BASENAME calling +++ _DBG_BASENAME calling @@ -74 +73,0 @@ -I_XmlUnmarshallKeyInfo ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-18T23:55:19}