# dns_8328.dll-dns_8457.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [StringCchVPrintfW](#stringcchvprintfw) * [API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s](#api-ms-win-crt-string-l1-1-0dllmemmove_s) * [API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_memcpy_s](#api-ms-win-crt-private-l1-1-0dll_o_memcpy_s) * [Added](#added) * [wistd::__function::__base::`scalar_deleting_destructor'](#wistd__function__basebool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor) * [Feature_2032384314__private_IsEnabledDeviceUsageNoInline](#feature_2032384314__private_isenableddeviceusagenoinline) * [memmove_s](#memmove_s) * [API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno](#api-ms-win-crt-private-l1-1-0dll_o__errno) * [API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo](#api-ms-win-crt-private-l1-1-0dll_o__invalid_parameter_noinfo) * [Modified](#modified) * [wil::details_abi::UsageIndexProperty::Write](#wildetails_abiusageindexpropertywrite) * [wil::details_abi::SemaphoreValue::CreateFromValueInternal](#wildetails_abisemaphorevaluecreatefromvalueinternal) * [wil::details_abi::RawUsageIndex::Iterate](#wildetails_abirawusageindexiterate) * [UploadAllDnsStatistics](#uploadalldnsstatistics) * [wil::details_abi::SemaphoreValue::TryGetValueInternal](#wildetails_abisemaphorevaluetrygetvalueinternal) * [UploadQueryStatistics](#uploadquerystatistics) * [UploadServerDnsStatistics](#uploadserverdnsstatistics) * [UploadFailuresDnsStatistics](#uploadfailuresdnsstatistics) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil::details_abi::UsageIndexProperty::UpdateCount](#wildetails_abiusageindexpropertyupdatecount) * [wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor'](#wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor) * [wil::details_abi::RawUsageIndex::RecordUsageInternal](#wildetails_abirawusageindexrecordusageinternal) * [wil::details::LogStringPrintf](#wildetailslogstringprintf) * [Dns_CacheServiceInitEx](#dns_cacheserviceinitex) * [_tlgWriteTransfer_EtwEventWriteTransfer](#_tlgwritetransfer_etweventwritetransfer) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [DnsRawCreateQueryResult](#dnsrawcreatequeryresult) * [Trace_LogQueryDuration](#trace_logqueryduration) * [DnsCheckServerConfig](#dnscheckserverconfig) * [DnsRawTruncateMessageForUdp](#dnsrawtruncatemessageforudp) * [StringCchCatW](#stringcchcatw) * [StringCchCopyA](#stringcchcopya) * [Modified (No Code Changes)](#modified-no-code-changes) * [StringCchCopyW](#stringcchcopyw) * [StringCchPrintfW](#stringcchprintfw) * [API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress](#api-ms-win-core-libraryloader-l1-2-0dllgetprocaddress) * [__GSHandlerCheck](#__gshandlercheck) * [API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW](#api-ms-win-core-libraryloader-l1-2-0dllgetmodulehandlew) * [__security_check_cookie](#__security_check_cookie) * [WPP_SF_D](#wpp_sf_d) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [memcpy_s](#memcpy_s) * [StringCchCatW](#stringcchcatw) * [StringCchCopyW](#stringcchcopyw) * [StringCchCopyA](#stringcchcopya) * [StringCchPrintfW](#stringcchprintfw) * [wil_details_GetNtDllProcedureAddress](#wil_details_getntdllprocedureaddress) # Visual Chart Diff ```mermaid flowchart LR wildetails_abiUsageIndexPropertyWrite-3-old<--Match 90%-->wildetails_abiUsageIndexPropertyWrite-3-new wildetails_abiSemaphoreValueCreateFromValueInternal-4-old<--Match 93%-->wildetails_abiSemaphoreValueCreateFromValueInternal-4-new wildetails_abiRawUsageIndexIterate-2-old<--Match 94%-->wildetails_abiRawUsageIndexIterate-2-new UploadAllDnsStatistics-4-old<--Match 98%-->UploadAllDnsStatistics-4-new wildetails_abiSemaphoreValueTryGetValueInternal-4-old<--Match 96%-->wildetails_abiSemaphoreValueTryGetValueInternal-4-new UploadQueryStatistics-1-old<--Match 99%-->UploadQueryStatistics-1-new UploadServerDnsStatistics-4-old<--Match 99%-->UploadServerDnsStatistics-4-new UploadFailuresDnsStatistics-6-old<--Match 73%-->UploadFailuresDnsStatistics-6-new wil_details_FeatureReporting_IncrementUsageInCache-4-old<--Match 98%-->wil_details_FeatureReporting_IncrementUsageInCache-4-new wildetails_abiUsageIndexPropertyUpdateCount-2-old<--Match 88%-->wildetails_abiUsageIndexPropertyUpdateCount-2-new wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor-2-old<--Match 96%-->wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor-2-new wildetails_abiRawUsageIndexRecordUsageInternal-6-old<--Match 85%-->wildetails_abiRawUsageIndexRecordUsageInternal-6-new wildetailsLogStringPrintf-3-old<--Match 72%-->wildetailsLogStringPrintf-3-new Dns_CacheServiceInitEx-3-old<--Match 95%-->Dns_CacheServiceInitEx-3-new _tlgWriteTransfer_EtwEventWriteTransfer-6-old<--Match 96%-->_tlgWriteTransfer_EtwEventWriteTransfer-6-new wil_details_FeatureReporting_RecordUsageInCache-4-old<--Match 99%-->wil_details_FeatureReporting_RecordUsageInCache-4-new wil_details_FeatureReporting_IncrementOpportunityInCache-4-old<--Match 98%-->wil_details_FeatureReporting_IncrementOpportunityInCache-4-new DnsRawCreateQueryResult-5-old<--Match 99%-->DnsRawCreateQueryResult-5-new Trace_LogQueryDuration-4-old<--Match 99%-->Trace_LogQueryDuration-4-new DnsCheckServerConfig-4-old<--Match 97%-->DnsCheckServerConfig-4-new DnsRawTruncateMessageForUdp-3-old<--Match 85%-->DnsRawTruncateMessageForUdp-3-new StringCchCatW-3-old<--Match 88%-->StringCchCatW-3-new StringCchCopyA-3-old<--Match 43%-->StringCchCopyA-3-new subgraph dns_8457.dll wildetails_abiUsageIndexPropertyWrite-3-new wildetails_abiSemaphoreValueCreateFromValueInternal-4-new wildetails_abiRawUsageIndexIterate-2-new UploadAllDnsStatistics-4-new wildetails_abiSemaphoreValueTryGetValueInternal-4-new UploadQueryStatistics-1-new UploadServerDnsStatistics-4-new UploadFailuresDnsStatistics-6-new wil_details_FeatureReporting_IncrementUsageInCache-4-new wildetails_abiUsageIndexPropertyUpdateCount-2-new wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor-2-new wildetails_abiRawUsageIndexRecordUsageInternal-6-new wildetailsLogStringPrintf-3-new Dns_CacheServiceInitEx-3-new _tlgWriteTransfer_EtwEventWriteTransfer-6-new wil_details_FeatureReporting_RecordUsageInCache-4-new wil_details_FeatureReporting_IncrementOpportunityInCache-4-new DnsRawCreateQueryResult-5-new Trace_LogQueryDuration-4-new DnsCheckServerConfig-4-new DnsRawTruncateMessageForUdp-3-new StringCchCatW-3-new StringCchCopyA-3-new subgraph Added direction LR wistd-__function-__basebool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_int-scalar_deleting_destructor Feature_2032384314__private_IsEnabledDeviceUsageNoInline memmove_s API-MS-WIN-CRT-PRIVATE-L1-1-0DLL-_o__errno API-MS-WIN-CRT-PRIVATE-L1-1-0DLL-_o__invalid_parameter_noinfo end end subgraph dns_8328.dll wildetails_abiUsageIndexPropertyWrite-3-old wildetails_abiSemaphoreValueCreateFromValueInternal-4-old wildetails_abiRawUsageIndexIterate-2-old UploadAllDnsStatistics-4-old wildetails_abiSemaphoreValueTryGetValueInternal-4-old UploadQueryStatistics-1-old UploadServerDnsStatistics-4-old UploadFailuresDnsStatistics-6-old wil_details_FeatureReporting_IncrementUsageInCache-4-old wildetails_abiUsageIndexPropertyUpdateCount-2-old wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor-2-old wildetails_abiRawUsageIndexRecordUsageInternal-6-old wildetailsLogStringPrintf-3-old Dns_CacheServiceInitEx-3-old _tlgWriteTransfer_EtwEventWriteTransfer-6-old wil_details_FeatureReporting_RecordUsageInCache-4-old wil_details_FeatureReporting_IncrementOpportunityInCache-4-old DnsRawCreateQueryResult-5-old Trace_LogQueryDuration-4-old DnsCheckServerConfig-4-old DnsRawTruncateMessageForUdp-3-old StringCchCatW-3-old StringCchCopyA-3-old subgraph Deleted direction LR StringCchVPrintfW API-MS-WIN-CRT-STRING-L1-1-0DLL-memmove_s API-MS-WIN-CRT-PRIVATE-L1-1-0DLL-_o_memcpy_s end end ``` ```mermaid pie showData title Function Matches - 99.8929% "unmatched_funcs_len" : 8 "matched_funcs_len" : 7460 ``` ```mermaid pie showData title Matched Function Similarity - 99.4236% "matched_funcs_with_code_changes_len" : 23 "matched_funcs_with_non_code_changes_len" : 20 "matched_funcs_no_changes_len" : 7417 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 dns_8328.dll dns_8457.dll ``` #### Verbose Args
``` --old ['dns_8328.dll'] --new [['dns_8457.dll']] --engine VersionTrackingDiff --output-path dns_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/dnsapi/9E09EBBE132000/dnsapi -O dnsapi.x64.10.0.26100.8328 wget https://msdl.microsoft.com/download/symbols/dnsapi/07EA1346132000/dnsapi -O dnsapi.x64.10.0.26100.8457 ``` ## Binary Metadata Diff ```diff --- dns_8328.dll Meta +++ dns_8457.dll Meta @@ -1,44 +1,44 @@ -Program Name: dns_8328.dll +Program Name: dns_8457.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1257464 +# of Bytes: 1257472 # of Memory Blocks: 11 -# of Instructions: 219626 -# of Defined Data: 10650 -# of Functions: 3732 -# of Symbols: 36840 +# of Instructions: 219819 +# of Defined Data: 10654 +# of Functions: 3736 +# of Symbols: 36832 # of Data Types: 1173 # of Data Type Categories: 56 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 22 11:41:43 SGT 2026 +Date Created: Sat Aug 22 11:41:47 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/dns/dns_8328.dll -Executable MD5: a94faa0973deb4bd489d0eeceb279a6d -Executable SHA256: 3cc0796f0a0acfcbae892f82a36ece4aad30b0f0afa2c9a85b39dff04e7f094b -FSRL: file:///tmp/dns/dns_8328.dll?MD5=a94faa0973deb4bd489d0eeceb279a6d +Executable Location: /tmp/dns/dns_8457.dll +Executable MD5: 20c6b798286d529ac918f228135d97cd +Executable SHA256: f00e35d79d4fea4d6ed3964c9a57f3306db75bd83afc92b619778b9b1d0ce3d9 +FSRL: file:///tmp/dns/dns_8457.dll?MD5=20c6b798286d529ac918f228135d97cd PDB Age: 1 PDB File: dnsapi.pdb -PDB GUID: fe53a962-8572-8275-5dc8-87916119bcc1 +PDB GUID: 6b86f6c2-f1a5-cbb0-d100-83e58cb858c9 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: DNS Client API DLL -PE Property[FileVersion]: 10.0.26100.8328 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8457 (WinBuild.160101.0800) PE Property[InternalName]: dnsapi PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: dnsapi PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8328 +PE Property[ProductVersion]: 10.0.26100.8457 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra dns_8328.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra dns_8328.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra dns_8328.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra dns_8457.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra dns_8457.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra dns_8457.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|3| |modified_funcs_len|43| |added_symbols_len|7| |deleted_symbols_len|3| |diff_time|5.677704095840454| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 3703, 'ExternalsName': 349, 'SigCallingCalledHasher': 12, 'ExactInstructionsFunctionHasher': 8, 'ExactBytesFunctionHasher': 3, 'Implied Match': 3})| |items_to_process|61| |diff_types|Counter({'address': 40, 'length': 25, 'code': 23, 'refcount': 23, 'calling': 19, 'sig': 10, 'called': 9})| |unmatched_funcs_len|8| |total_funcs_len|7468| |matched_funcs_len|7460| |matched_funcs_with_code_changes_len|23| |matched_funcs_with_non_code_changes_len|20| |matched_funcs_no_changes_len|7417| |match_func_similarity_percent|99.4236%| |func_match_overall_percent|99.8929%| |first_matches|Counter({'SymbolsHash': 3703, 'SigCallingCalledHasher': 12, 'ExactInstructionsFunctionHasher': 8, 'ExactBytesFunctionHasher': 3, 'Implied Match': 3})| ```mermaid pie showData title All Matches "SymbolsHash" : 3703 "ExternalsName" : 349 "ExactBytesFunctionHasher" : 3 "ExactInstructionsFunctionHasher" : 8 "SigCallingCalledHasher" : 12 "Implied-Match" : 3 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 3703 "ExactBytesFunctionHasher" : 3 "ExactInstructionsFunctionHasher" : 8 "SigCallingCalledHasher" : 12 "Implied-Match" : 3 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 3 "modified_funcs_len" : 43 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 7 "deleted_symbols_len" : 3 ``` ## Strings *No string differences found* # Deleted ## StringCchVPrintfW ### Function Meta |Key|dns_8328.dll| | :---: | :---: | |name|StringCchVPrintfW| |fullname|StringCchVPrintfW| |refcount|2| |length|123| |called|_vsnwprintf_s| |calling|wil::details::LogStringPrintf| |paramcount|4| |address|180059d70| |sig|HRESULT __stdcall StringCchVPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, va_list argList)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- StringCchVPrintfW +++ StringCchVPrintfW @@ -1,30 +0,0 @@ - -HRESULT __stdcall -StringCchVPrintfW(STRSAFE_LPWSTR pszDest,size_t cchDest,STRSAFE_LPCWSTR pszFormat,va_list argList) - -{ - size_t _MaxCount; - int iVar1; - HRESULT HVar2; - - if (cchDest - 1 < 0x7fffffff) { - _MaxCount = cchDest - 1; - HVar2 = 0; - iVar1 = _vsnwprintf_s(pszDest,cchDest,_MaxCount,pszFormat,argList); - if ((iVar1 < 0) || (_MaxCount < (ulonglong)(longlong)iVar1)) { - HVar2 = -0x7ff8ff86; - } - else if ((longlong)iVar1 != _MaxCount) { - return 0; - } - pszDest[_MaxCount] = L'\0'; - } - else { - HVar2 = -0x7ff8ffa9; - if (cchDest != 0) { - *pszDest = L'\0'; - } - } - return HVar2; -} - ``` ## API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s ### Function Meta |Key|dns_8328.dll| | :---: | :---: | |name|memmove_s| |fullname|API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s| |refcount|2| |length|0| |called|| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|4| |address|EXTERNAL:00000008| |sig|errno_t __cdecl memmove_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s* ## API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_memcpy_s ### Function Meta |Key|dns_8328.dll| | :---: | :---: | |name|_o_memcpy_s| |fullname|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_memcpy_s| |refcount|3| |length|0| |called|| |calling|| |paramcount|0| |address|EXTERNAL:0000001d| |sig|undefined _o_memcpy_s(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_memcpy_s* # Added ## wistd::__function::__base::`scalar_deleting_destructor' ### Function Meta |Key|dns_8457.dll| | :---: | :---: | |name|`scalar_deleting_destructor'| |fullname|wistd::__function::__base::`scalar_deleting_destructor'| |refcount|3| |length|43| |called|operator_delete[]| |calling|| |paramcount|2| |address|1800a4760| |sig|void * __thiscall `scalar_deleting_destructor'(__base * this, uint param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wistd::__function::__base::`scalar_deleting_destructor' +++ wistd::__function::__base::`scalar_deleting_destructor' @@ -0,0 +1,20 @@ + +/* public: virtual void * __ptr64 __cdecl wistd::__function::__base::`scalar deleting + destructor'(unsigned int) __ptr64 */ + +void * __thiscall +wistd::__function:: +__base:: +_scalar_deleting_destructor_ + (__base + *this,uint param_1) + +{ + *(undefined ***)this = &_vftable_; + if ((param_1 & 1) != 0) { + operator_delete__(this); + } + return this; +} + ``` ## Feature_2032384314__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|dns_8457.dll| | :---: | :---: | |name|Feature_2032384314__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_2032384314__private_IsEnabledDeviceUsageNoInline| |refcount|3| |length|51| |called|wil_details_IsEnabledFallback| |calling|DnsRawTruncateMessageForUdp| |paramcount|0| |address|1800aab58| |sig|uint __fastcall Feature_2032384314__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_2032384314__private_IsEnabledDeviceUsageNoInline +++ Feature_2032384314__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_2032384314__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + ulonglong local_res8; + + local_res8 = (ulonglong)Feature_2032384314__private_featureState; + if ((Feature_2032384314__private_featureState & 0x10) != 0) { + return Feature_2032384314__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3,&Feature_2032384314__private_descriptor); + return uVar1; +} + ``` ## memmove_s ### Function Meta |Key|dns_8457.dll| | :---: | :---: | |name|memmove_s| |fullname|memmove_s| |refcount|2| |length|95| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno
_invalid_parameter_noinfo
memmove| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|4| |address|1800aaee8| |sig|errno_t __cdecl memmove_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- memmove_s +++ memmove_s @@ -0,0 +1,30 @@ + +errno_t __cdecl memmove_s(void *_Dst,rsize_t _DstSize,void *_Src,rsize_t _MaxCount) + +{ + errno_t *peVar1; + errno_t eVar2; + + if (_MaxCount == 0) { +LAB_1800aaf3f: + eVar2 = 0; + } + else { + if ((_Dst == (void *)0x0) || (_Src == (void *)0x0)) { + peVar1 = (errno_t *)_o__errno(); + eVar2 = 0x16; + } + else { + if (_MaxCount <= _DstSize) { + memmove(_Dst,_Src,_MaxCount); + goto LAB_1800aaf3f; + } + peVar1 = (errno_t *)_o__errno(); + eVar2 = 0x22; + } + *peVar1 = eVar2; + _invalid_parameter_noinfo(); + } + return eVar2; +} + ``` ## API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno ### Function Meta |Key|dns_8457.dll| | :---: | :---: | |name|_o__errno| |fullname|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno| |refcount|5| |length|0| |called|| |calling|memcpy_s
memmove_s| |paramcount|0| |address|EXTERNAL:0000002b| |sig|undefined _o__errno(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno* ## API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo ### Function Meta |Key|dns_8457.dll| | :---: | :---: | |name|_o__invalid_parameter_noinfo| |fullname|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo| |refcount|3| |length|0| |called|| |calling|| |paramcount|0| |address|EXTERNAL:0000000c| |sig|undefined _o__invalid_parameter_noinfo(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo* # Modified *Modified functions contain code changes* ## wil::details_abi::UsageIndexProperty::Write ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.42| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|Write|Write| |fullname|wil::details_abi::UsageIndexProperty::Write|wil::details_abi::UsageIndexProperty::Write| |refcount|3|3| |`length`|232|239| |`called`|__security_check_cookie
memcpy_s|memcpy_s| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3|3| |`address`|1800c9ce8|1800a9f78| |sig|bool __thiscall Write(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)|bool __thiscall Write(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::UsageIndexProperty::Write Called Diff ```diff --- wil::details_abi::UsageIndexProperty::Write called +++ wil::details_abi::UsageIndexProperty::Write called @@ -1 +0,0 @@ -__security_check_cookie ``` ### wil::details_abi::UsageIndexProperty::Write Diff ```diff --- wil::details_abi::UsageIndexProperty::Write +++ wil::details_abi::UsageIndexProperty::Write @@ -1,59 +1,56 @@ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: bool __cdecl wil::details_abi::UsageIndexProperty::Write(unsigned char * __ptr64 & __ptr64,unsigned char * __ptr64)const __ptr64 */ bool __thiscall wil::details_abi::UsageIndexProperty::Write(UsageIndexProperty *this,uchar **param_1,uchar *param_2) { - undefined8 uVar1; - uchar *puVar2; - uchar *puVar3; - UsageIndexProperty *pUVar4; - undefined8 uVar5; - undefined1 auStack_58 [32]; - undefined2 local_38 [4]; - ulonglong local_30; + rsize_t _DstSize; + uchar *_Dst; + UsageIndexProperty *_Src; + rsize_t _MaxCount; + ulonglong _MaxCount_00; + uchar *puVar1; + undefined2 local_res8 [4]; - local_30 = __security_cookie ^ (ulonglong)auStack_58; - puVar2 = *param_1; + _Dst = *param_1; if (this[2] == (UsageIndexProperty)0x1) { - puVar3 = puVar2 + 2; - if (param_2 < puVar3) { + puVar1 = _Dst + 2; + if (param_2 < puVar1) { return false; } - local_38[0] = *(undefined2 *)(this + 4); - pUVar4 = (UsageIndexProperty *)local_38; - uVar5 = 2; - uVar1 = 2; + local_res8[0] = *(undefined2 *)(this + 4); + _Src = (UsageIndexProperty *)local_res8; + _MaxCount = 2; + _DstSize = 2; } else { if (this[2] != (UsageIndexProperty)0x2) goto LAB_0; - puVar3 = puVar2 + 4; - if (param_2 < puVar3) { + puVar1 = _Dst + 4; + if (param_2 < puVar1) { return false; } - uVar1 = 4; - pUVar4 = this + 4; - uVar5 = 4; + _DstSize = 4; + _Src = this + 4; + _MaxCount = 4; } - memcpy_s(puVar2,uVar1,pUVar4,uVar5); - puVar2 = puVar3; + memcpy_s(_Dst,_DstSize,_Src,_MaxCount); + _Dst = puVar1; LAB_0: - puVar3 = puVar2; if (*(short *)this == 0) { - puVar3 = puVar2 + 2; - if (param_2 < puVar3) { + if (param_2 < _Dst + 2) { return false; } - memcpy_s(puVar2,(longlong)param_2 - (longlong)puVar2,this + 8,2); + memcpy_s(_Dst,(longlong)param_2 - (longlong)_Dst,this + 8,2); + _Dst = _Dst + 2; } - if (param_2 < puVar3 + *(ushort *)(this + 8)) { + _MaxCount_00 = (ulonglong)*(ushort *)(this + 8); + if (param_2 < _Dst + _MaxCount_00) { return false; } - memcpy_s(puVar3,(longlong)param_2 - (longlong)puVar3,*(undefined8 *)(this + 0x18)); - *param_1 = puVar3 + *(ushort *)(this + 8); + memcpy_s(_Dst,(longlong)param_2 - (longlong)_Dst,*(void **)(this + 0x18),_MaxCount_00); + *param_1 = _Dst + *(ushort *)(this + 8); return true; } ``` ## wil::details_abi::SemaphoreValue::CreateFromValueInternal ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.67| |i_ratio|0.65| |m_ratio|0.96| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|CreateFromValueInternal|CreateFromValueInternal| |fullname|wil::details_abi::SemaphoreValue::CreateFromValueInternal|wil::details_abi::SemaphoreValue::CreateFromValueInternal| |refcount|3|3| |`length`|280|260| |called|StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_Hr
wil::details::in1diag3::_FailFastImmediate_Unexpected
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create|StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_Hr
wil::details::in1diag3::_FailFastImmediate_Unexpected
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |paramcount|4|4| |`address`|1800c5fa0|1800a4bd4| |sig|long __thiscall CreateFromValueInternal(SemaphoreValue * this, ushort * param_1, bool param_2, __uint64 param_3)|long __thiscall CreateFromValueInternal(SemaphoreValue * this, ushort * param_1, bool param_2, __uint64 param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::SemaphoreValue::CreateFromValueInternal Diff ```diff --- wil::details_abi::SemaphoreValue::CreateFromValueInternal +++ wil::details_abi::SemaphoreValue::CreateFromValueInternal @@ -1,63 +1,66 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: long __cdecl wil::details_abi::SemaphoreValue::CreateFromValueInternal(unsigned short const * __ptr64,bool,unsigned __int64) __ptr64 */ long __thiscall wil::details_abi::SemaphoreValue::CreateFromValueInternal (SemaphoreValue *this,ushort *param_1,bool param_2,__uint64 param_3) { long lVar1; uint uVar2; - uint uVar3; - char *pcVar4; + __uint64 _Var3; + uint uVar4; + char *pcVar5; void *unaff_retaddr; undefined1 auStackY_278 [32]; ulong in_stack_fffffffffffffda8; _SECURITY_ATTRIBUTES *in_stack_fffffffffffffdb0; bool *in_stack_fffffffffffffdb8; - wchar_t local_238 [264]; + ushort local_238 [264]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_278; if ((param_3 & 0xc000000000000000) != 0) { /* WARNING: Subroutine does not return */ details::in1diag3::_FailFastImmediate_Unexpected(); } - StringCchCopyW(local_238,0x104,(STRSAFE_LPCWSTR)param_1); - StringCchCatW(local_238,0x104,L"_p0"); - uVar3 = (uint)param_3 & 0x7fffffff; + _Var3 = 0x104; + StringCchCopyW(local_238,0x104,param_1); + StringCchCatW(local_238,_Var3,(ushort *)L"_p0"); + uVar4 = (uint)param_3 & 0x7fffffff; + _Var3 = (__uint64)uVar4; uVar2 = 1; if ((param_3 & 0x7fffffff) != 0) { - uVar2 = uVar3; + uVar2 = uVar4; } - pcVar4 = (char *)(ulonglong)uVar2; + pcVar5 = (char *)(ulonglong)uVar2; lVar1 = semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> ::create((semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> - *)this,uVar3,uVar2,(ushort *)local_238,in_stack_fffffffffffffda8, - in_stack_fffffffffffffdb0,in_stack_fffffffffffffdb8); + *)this,uVar4,uVar2,local_238,in_stack_fffffffffffffda8,in_stack_fffffffffffffdb0 + ,in_stack_fffffffffffffdb8); if (lVar1 < 0) { uVar2 = 0x88; } else { - StringCchCatW(local_238,0x104,L"h"); - uVar3 = (uint)(param_3 >> 0x1f); + StringCchCatW(local_238,_Var3,(ushort *)L"h"); + uVar4 = (uint)(param_3 >> 0x1f); uVar2 = 1; - if (uVar3 != 0) { - uVar2 = uVar3; + if (uVar4 != 0) { + uVar2 = uVar4; } - pcVar4 = (char *)(ulonglong)uVar2; + pcVar5 = (char *)(ulonglong)uVar2; lVar1 = semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> ::create((semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> - *)(this + 8),uVar3,uVar2,(ushort *)local_238,in_stack_fffffffffffffda8, + *)(this + 8),uVar4,uVar2,local_238,in_stack_fffffffffffffda8, in_stack_fffffffffffffdb0,in_stack_fffffffffffffdb8); if (-1 < lVar1) { return 0; } uVar2 = 0x8d; } - details::in1diag3::Return_Hr(unaff_retaddr,uVar2,pcVar4,lVar1); + details::in1diag3::Return_Hr(unaff_retaddr,uVar2,pcVar5,lVar1); return lVar1; } ``` ## wil::details_abi::RawUsageIndex::Iterate ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.34| |i_ratio|0.39| |m_ratio|0.99| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|Iterate|Iterate| |fullname|wil::details_abi::RawUsageIndex::Iterate|wil::details_abi::RawUsageIndex::Iterate| |refcount|2|2| |`length`|351|350| |called|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::_FailFastImmediate_Unexpected
wil::details_abi::UsageIndexProperty::Read
wistd::function::~function|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::in1diag3::_FailFastImmediate_Unexpected
wil::details_abi::UsageIndexProperty::Read
wistd::function::~function| |calling|wil::details_abi::RecordWnfUsageIndex|wil::details_abi::RecordWnfUsageIndex| |paramcount|2|2| |`address`|1800c72b8|1800a7448| |sig|bool __thiscall Iterate(RawUsageIndex * this, function param_1)|bool __thiscall Iterate(RawUsageIndex * this, function param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::RawUsageIndex::Iterate Diff ```diff --- wil::details_abi::RawUsageIndex::Iterate +++ wil::details_abi::RawUsageIndex::Iterate @@ -1,102 +1,104 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: bool __cdecl wil::details_abi::RawUsageIndex::Iterate(class wistd::function)const __ptr64 */ bool __thiscall wil::details_abi::RawUsageIndex::Iterate (RawUsageIndex *this, function *param_2) { longlong *plVar1; - char cVar2; - bool bVar3; - uint uVar4; - uchar *puVar5; - undefined1 auStack_d8 [32]; - ulonglong *local_b8; - undefined4 *local_b0; - uchar *local_98; - undefined2 local_90; - RawUsageIndex local_8e; - uint local_8c; - ushort local_88; - undefined8 local_80; - undefined8 uStack_78; - undefined2 local_70; - RawUsageIndex local_6e; - undefined4 local_6c; - ushort local_68; + undefined8 uVar2; + char cVar3; + bool bVar4; + uint uVar5; + uchar *puVar6; + undefined1 auStack_e8 [32]; + ulonglong *local_c8; + undefined4 *local_c0; + uchar *local_a8; + undefined2 local_a0; + RawUsageIndex local_9e; + uint local_9c; + ushort local_98; + undefined8 local_90; + undefined8 uStack_88; + undefined2 local_80; + RawUsageIndex local_7e; + undefined4 local_7c; + ushort local_78; + undefined8 local_70; + undefined8 uStack_68; undefined8 local_60; - undefined8 uStack_58; - undefined8 local_50; - undefined8 local_48; - undefined4 local_40 [2]; + undefined8 local_58; + undefined4 local_50 [2]; + ulonglong local_48; + ulonglong local_40; ulonglong local_38; - ulonglong local_30; - ulonglong local_28; - local_28 = __security_cookie ^ (ulonglong)auStack_d8; - puVar5 = *(uchar **)(this + 0x20); - local_98 = (uchar *)(*(longlong *)(this + 0x18) + 10); - local_90 = *(undefined2 *)(this + 2); - local_8e = this[4]; - local_70 = *(undefined2 *)(this + 6); - local_6e = this[8]; - local_8c = 0; - local_88 = 0; - local_80 = 0; - uStack_78 = 0; - local_6c = 0; - local_68 = 0; - local_60 = 0; - uStack_58 = 0; + local_38 = __security_cookie ^ (ulonglong)auStack_e8; + puVar6 = *(uchar **)(this + 0x20); + local_a8 = (uchar *)(*(longlong *)(this + 0x18) + 10); + local_a0 = *(undefined2 *)(this + 2); + local_9e = this[4]; + local_80 = *(undefined2 *)(this + 6); + local_7e = this[8]; + local_9c = 0; + local_98 = 0; + local_90 = 0; + uStack_88 = 0; + local_7c = 0; + local_78 = 0; + local_70 = 0; + uStack_68 = 0; do { - bVar3 = UsageIndexProperty::Read((UsageIndexProperty *)&local_90,&local_98,puVar5); - if (!bVar3) { + bVar4 = UsageIndexProperty::Read((UsageIndexProperty *)&local_a0,&local_a8,puVar6); + uVar2 = uStack_88; + if (!bVar4) { wistd:: function :: ~function (param_2); return true; } - uVar4 = 0; - if (local_8c != 0) { + uVar5 = 0; + if (local_9c != 0) { do { - bVar3 = UsageIndexProperty::Read - ((UsageIndexProperty *)&local_70,&local_98,*(uchar **)(this + 0x20)); - if (!bVar3) break; + bVar4 = UsageIndexProperty::Read + ((UsageIndexProperty *)&local_80,&local_a8,*(uchar **)(this + 0x20)); + if (!bVar4) break; plVar1 = *(longlong **)(param_2 + 0x70); - local_40[0] = local_6c; - local_38 = (ulonglong)local_68; - local_50 = uStack_58; - local_30 = (ulonglong)local_88; - local_48 = uStack_78; + local_50[0] = local_7c; + local_48 = (ulonglong)local_78; + local_60 = uStack_68; + local_40 = (ulonglong)local_98; + local_58 = uVar2; if (plVar1 == (longlong *)0x0) { /* WARNING: Subroutine does not return */ details::in1diag3::_FailFastImmediate_Unexpected(); } - local_b0 = local_40; - local_b8 = &local_38; - cVar2 = (**(code **)(*plVar1 + 0x20))(plVar1,&local_48,&local_30,&local_50); - if (cVar2 == '\0') { + local_c0 = local_50; + local_c8 = &local_48; + cVar3 = (**(code **)(*plVar1 + 0x20))(plVar1,&local_58,&local_40,&local_60); + if (cVar3 == '\0') { wistd:: function :: ~function (param_2); return false; } - uVar4 = uVar4 + 1; - } while (uVar4 < local_8c); + uVar5 = uVar5 + 1; + } while (uVar5 < local_9c); } - puVar5 = *(uchar **)(this + 0x20); + puVar6 = *(uchar **)(this + 0x20); } while( true ); } ``` ## UploadAllDnsStatistics ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.83| |i_ratio|0.79| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|UploadAllDnsStatistics|UploadAllDnsStatistics| |fullname|UploadAllDnsStatistics|UploadAllDnsStatistics| |refcount|5|5| |`length`|397|410| |called|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount64
ConvertInterfaceIndexToGuid
UploadQueryStatistics
UploadServerDnsStatistics
WPP_SF_
WPP_SF__guid_dq
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount64
ConvertInterfaceIndexToGuid
UploadQueryStatistics
UploadServerDnsStatistics
WPP_SF_
WPP_SF__guid_dq
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset| |calling|DnsTraceLlmnrCompletion
Query_BroadcastComplete
Trace_ServerResponse
UploadAllDnsStatisticsIfNeeded|DnsTraceLlmnrCompletion
Query_BroadcastComplete
Trace_ServerResponse
UploadAllDnsStatisticsIfNeeded| |paramcount|4|1| |`address`|18003ed64|18003ed84| |`sig`|undefined __fastcall UploadAllDnsStatistics(uint * param_1, undefined8 param_2, undefined8 param_3, GUID * param_4)|undefined __fastcall UploadAllDnsStatistics(uint * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UploadAllDnsStatistics Diff ```diff --- UploadAllDnsStatistics +++ UploadAllDnsStatistics @@ -1,79 +1,75 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void UploadAllDnsStatistics(uint *param_1,undefined8 param_2,undefined8 param_3,GUID *param_4) +void UploadAllDnsStatistics(uint *param_1) { bool bVar1; NTSTATUS NVar2; ULONGLONG UVar3; - uint *puVar4; - uint uVar5; - ulonglong uVar6; + uint uVar4; + ulonglong uVar5; undefined1 auStackY_98 [32]; uint local_68 [2]; GUID local_60; undefined8 local_50 [4]; uint *local_30; undefined8 local_28; ulonglong local_20; local_20 = __security_cookie ^ (ulonglong)auStackY_98; local_60.Data1 = 0; local_60.Data2 = 0; local_60.Data3 = 0; local_60.Data4[0] = '\0'; local_60.Data4[1] = '\0'; local_60.Data4[2] = '\0'; local_60.Data4[3] = '\0'; local_60.Data4[4] = '\0'; local_60.Data4[5] = '\0'; local_60.Data4[6] = '\0'; local_60.Data4[7] = '\0'; local_68[0] = local_68[0] & 0xffff0000; if ((DAT_0 & 8) != 0) { - WPP_SF_(0x40b,0xc,0x1800f3ec0); + WPP_SF_(0x40b,0xc,0x1800f3ea0); } if (param_1 != (uint *)0x0) { - uVar6 = 0; + uVar5 = 0; bVar1 = true; if (*param_1 != 0) { do { NVar2 = ConvertInterfaceIndexToGuid - (param_1[uVar6 * 0x2c22 + 2],&local_60,(undefined2 *)local_68); + (param_1[uVar5 * 0x2c22 + 2],&local_60,(undefined2 *)local_68); if (NVar2 == 0) { if ((DAT_0 & 8) != 0) { - param_4 = &local_60; WPP_SF__guid_dq(); } UploadServerDnsStatistics ((longlong)&local_60,(ushort)local_68[0], - (longlong)(param_1 + uVar6 * 0x2c22 + 2),(ulonglong)param_4); + (longlong)(param_1 + uVar5 * 0x2c22 + 2)); } - uVar5 = (int)uVar6 + 1; - uVar6 = (ulonglong)uVar5; - } while (uVar5 < *param_1); + uVar4 = (int)uVar5 + 1; + uVar5 = (ulonglong)uVar4; + } while (uVar4 < *param_1); } - puVar4 = param_1; UploadQueryStatistics((longlong)param_1); if ((param_1[1] != 0) && (5 < DAT_1)) { if (((_DAT_2 & 0x400000000000) == 0) || ((DAT_3 & 0x400000000000) != DAT_3)) { bVar1 = false; } if (bVar1) { local_30 = local_68; local_28 = 4; local_68[0] = param_1[1]; - _tlgWriteTransfer_EtwEventWriteTransfer - (puVar4,&DAT_4,0x400000000000,param_4,3,local_50); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_4,0,0,3,local_50); } } memset(param_1,0,0xb08c8); UVar3 = GetTickCount64(); *(ULONGLONG *)(param_1 + 0x2c230) = UVar3; } return; } ``` ## wil::details_abi::SemaphoreValue::TryGetValueInternal ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.59| |i_ratio|0.58| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|TryGetValueInternal|TryGetValueInternal| |fullname|wil::details_abi::SemaphoreValue::TryGetValueInternal|wil::details_abi::SemaphoreValue::TryGetValueInternal| |refcount|2|2| |`length`|448|441| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenSemaphoreW
StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_GetLastError
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SemaphoreValue::GetValueFromSemaphore|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenSemaphoreW
StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_GetLastError
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SemaphoreValue::GetValueFromSemaphore| |calling|wil::details_abi::SemaphoreValue::TryGetPointer|wil::details_abi::SemaphoreValue::TryGetPointer| |paramcount|4|4| |`address`|1800c96d0|1800a9990| |sig|long __cdecl TryGetValueInternal(ushort * param_1, bool param_2, __uint64 * param_3, bool * param_4)|long __cdecl TryGetValueInternal(ushort * param_1, bool param_2, __uint64 * param_3, bool * param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::SemaphoreValue::TryGetValueInternal Diff ```diff --- wil::details_abi::SemaphoreValue::TryGetValueInternal +++ wil::details_abi::SemaphoreValue::TryGetValueInternal @@ -1,88 +1,92 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: static long __cdecl wil::details_abi::SemaphoreValue::TryGetValueInternal(unsigned short const * __ptr64,bool,unsigned __int64 * __ptr64,bool * __ptr64) */ long __cdecl wil::details_abi::SemaphoreValue::TryGetValueInternal (ushort *param_1,bool param_2,__uint64 *param_3,bool *param_4) { DWORD DVar1; long lVar2; - LPCWSTR pWVar3; + __uint64 _Var3; + long *plVar4; + LPCWSTR pWVar5; void *unaff_retaddr; - undefined1 auStack_278 [32]; - long local_258; - long local_254; - HANDLE local_250; - HANDLE local_248 [2]; - wchar_t local_238 [264]; - ulonglong local_28; + undefined1 auStack_268 [32]; + long local_248; + long local_244; + HANDLE local_240; + HANDLE local_238 [2]; + WCHAR local_228 [264]; + ulonglong local_18; - local_28 = __security_cookie ^ (ulonglong)auStack_278; + local_18 = __security_cookie ^ (ulonglong)auStack_268; *param_3 = 0; - StringCchCopyW(local_238,0x104,(STRSAFE_LPCWSTR)param_1); - StringCchCatW(local_238,0x104,L"_p0"); - pWVar3 = local_238; - local_248[0] = OpenSemaphoreW(0x1f0003,0,pWVar3); - if (local_248[0] == (HANDLE)0x0) { + _Var3 = 0x104; + StringCchCopyW((ushort *)local_228,0x104,param_1); + StringCchCatW((ushort *)local_228,_Var3,(ushort *)L"_p0"); + pWVar5 = local_228; + local_238[0] = OpenSemaphoreW(0x1f0003,0,pWVar5); + if (local_238[0] == (HANDLE)0x0) { DVar1 = GetLastError(); lVar2 = 0; if (DVar1 != 2) { - lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xcd,(char *)pWVar3); + lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xcd,(char *)pWVar5); } } else { - local_254 = 0; - local_258 = 0; - lVar2 = GetValueFromSemaphore(local_248[0],&local_254); + plVar4 = &local_244; + local_244 = 0; + local_248 = 0; + lVar2 = GetValueFromSemaphore(local_238[0],plVar4); if (lVar2 < 0) { - details::in1diag3::Return_Hr(unaff_retaddr,0xd3,(char *)pWVar3,lVar2); + details::in1diag3::Return_Hr(unaff_retaddr,0xd3,(char *)pWVar5,lVar2); } else { - StringCchCatW(local_238,0x104,L"h"); - pWVar3 = local_238; - local_250 = OpenSemaphoreW(0x1f0003,0,pWVar3); - if (local_250 == (HANDLE)0x0) { - lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xd9,(char *)pWVar3); + StringCchCatW((ushort *)local_228,(__uint64)plVar4,(ushort *)L"h"); + pWVar5 = local_228; + local_240 = OpenSemaphoreW(0x1f0003,0,pWVar5); + if (local_240 == (HANDLE)0x0) { + lVar2 = details::in1diag3::Return_GetLastError(unaff_retaddr,0xd9,(char *)pWVar5); details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_250); + *)&local_240); } else { - lVar2 = GetValueFromSemaphore(local_250,&local_258); + lVar2 = GetValueFromSemaphore(local_240,&local_248); if (lVar2 < 0) { - details::in1diag3::Return_Hr(unaff_retaddr,0xdb,(char *)pWVar3,lVar2); + details::in1diag3::Return_Hr(unaff_retaddr,0xdb,(char *)pWVar5,lVar2); details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_250); + *)&local_240); } else { details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)&local_250); - *param_3 = (longlong)local_258 << 0x1f | (longlong)local_254; + *)&local_240); + *param_3 = (longlong)local_248 << 0x1f | (longlong)local_244; lVar2 = 0; } } } } details:: unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ((unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> - *)local_248); + *)local_238); return lVar2; } ``` ## UploadQueryStatistics ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.98| |i_ratio|0.92| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|UploadQueryStatistics|UploadQueryStatistics| |fullname|UploadQueryStatistics|UploadQueryStatistics| |refcount|2|2| |`length`|524|534| |called|__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer|__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer| |calling|UploadAllDnsStatistics|UploadAllDnsStatistics| |paramcount|1|1| |`address`|18007e670|18007e640| |sig|undefined __fastcall UploadQueryStatistics(longlong param_1)|undefined __fastcall UploadQueryStatistics(longlong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UploadQueryStatistics Diff ```diff --- UploadQueryStatistics +++ UploadQueryStatistics @@ -1,110 +1,109 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void UploadQueryStatistics(longlong param_1) { bool bVar1; undefined1 auStackY_188 [32]; undefined4 local_158; undefined4 local_154; undefined4 local_150; undefined4 local_14c; undefined4 local_148; undefined4 local_144; undefined4 local_140; undefined4 local_13c; undefined4 local_138; undefined4 local_134; undefined4 local_130; undefined4 local_12c; undefined4 local_128; undefined4 local_124 [3]; undefined8 local_118 [4]; undefined4 *local_f8; undefined8 local_f0; undefined4 *local_e8; undefined8 local_e0; undefined4 *local_d8; undefined8 local_d0; undefined4 *local_c8; undefined8 local_c0; undefined4 *local_b8; undefined8 local_b0; undefined4 *local_a8; undefined8 local_a0; undefined4 *local_98; undefined8 local_90; undefined4 *local_88; undefined8 local_80; undefined4 *local_78; undefined8 local_70; undefined4 *local_68; undefined8 local_60; undefined4 *local_58; undefined8 local_50; undefined4 *local_48; undefined8 local_40; undefined4 *local_38; undefined8 local_30; undefined4 *local_28; undefined8 local_20; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStackY_188; if (5 < DAT_0) { if (((_DAT_1 & 0x400000000000) == 0) || (bVar1 = true, (DAT_2 & 0x400000000000) != DAT_2)) { bVar1 = false; } if (bVar1) { local_158 = *(undefined4 *)(param_1 + 0xb08a4); local_f8 = &local_158; + local_f0 = 4; local_154 = *(undefined4 *)(param_1 + 0xb08a8); local_e8 = &local_154; local_150 = *(undefined4 *)(param_1 + 0xb08ac); local_d8 = &local_150; local_14c = *(undefined4 *)(param_1 + 0xb08b0); local_c8 = &local_14c; local_148 = *(undefined4 *)(param_1 + 0xb08b4); local_b8 = &local_148; local_144 = *(undefined4 *)(param_1 + 0xb08b8); local_a8 = &local_144; local_140 = *(undefined4 *)(param_1 + 0xb08bc); local_98 = &local_140; local_13c = DAT_3; local_88 = &local_13c; local_138 = *(undefined4 *)(param_1 + 0xb0890); local_78 = &local_138; local_134 = *(undefined4 *)(param_1 + 0xb0894); local_68 = &local_134; local_130 = *(undefined4 *)(param_1 + 0xb0898); local_58 = &local_130; local_12c = *(undefined4 *)(param_1 + 0xb089c); local_48 = &local_12c; local_128 = *(undefined4 *)(param_1 + 0xb08a0); local_38 = &local_128; local_124[0] = DAT_4; local_28 = local_124; - local_f0 = 4; local_e0 = 4; local_d0 = 4; local_c0 = 4; local_b0 = 4; local_a0 = 4; local_90 = 4; local_80 = 4; local_70 = 4; local_60 = 4; local_50 = 4; local_40 = 4; local_30 = 4; local_20 = 4; - _tlgWriteTransfer_EtwEventWriteTransfer - (param_1,&DAT_5,0,0x400000000000,0x10,local_118); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_5,0,0,0x10,local_118); } } return; } ``` ## UploadServerDnsStatistics ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.97| |i_ratio|0.9| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|UploadServerDnsStatistics|UploadServerDnsStatistics| |fullname|UploadServerDnsStatistics|UploadServerDnsStatistics| |refcount|2|2| |`length`|971|984| |called|DnsAddr_IsClear
DnsAddr_WriteIpString_W
UploadFailuresDnsStatistics
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset|DnsAddr_IsClear
DnsAddr_WriteIpString_W
UploadFailuresDnsStatistics
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset| |calling|UploadAllDnsStatistics|UploadAllDnsStatistics| |paramcount|4|3| |`address`|18004014c|18004017c| |`sig`|undefined __fastcall UploadServerDnsStatistics(longlong param_1, ushort param_2, longlong param_3, ulonglong param_4)|undefined __fastcall UploadServerDnsStatistics(longlong param_1, ushort param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UploadServerDnsStatistics Diff ```diff --- UploadServerDnsStatistics +++ UploadServerDnsStatistics @@ -1,186 +1,178 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void UploadServerDnsStatistics(longlong param_1,ushort param_2,longlong param_3,ulonglong param_4) +void UploadServerDnsStatistics(longlong param_1,ushort param_2,longlong param_3) { ushort uVar1; bool bVar2; undefined7 extraout_var; longlong lVar3; ushort *puVar4; uint uVar5; - ulonglong uVar6; - ulonglong uVar7; undefined1 auStackY_308 [32]; uint local_2d8; uint local_2d4; undefined4 local_2d0; undefined4 local_2cc; undefined4 local_2c8; undefined4 local_2c4; undefined4 local_2c0; undefined4 local_2bc; undefined4 local_2b8; undefined4 local_2b4; undefined4 local_2b0 [2]; ulonglong local_2a8; undefined8 local_2a0; undefined8 local_298; undefined8 local_290; undefined8 local_288; ulonglong local_280; ulonglong local_278; undefined8 local_270; undefined8 local_268 [2]; undefined8 local_258 [4]; longlong local_238; undefined8 local_230; ulonglong *local_228; undefined8 local_220; wchar_t *local_218; int local_210; undefined4 local_20c; uint *local_208; undefined8 local_200; uint *local_1f8; undefined8 local_1f0; undefined4 *local_1e8; undefined8 local_1e0; undefined4 *local_1d8; undefined8 local_1d0; undefined4 *local_1c8; undefined8 local_1c0; undefined4 *local_1b8; undefined8 local_1b0; undefined8 *local_1a8; undefined8 local_1a0; undefined4 *local_198; undefined8 local_190; undefined4 *local_188; undefined8 local_180; undefined8 *local_178; undefined8 local_170; undefined8 *local_168; undefined8 local_160; undefined8 *local_158; undefined8 local_150; undefined4 *local_148; undefined8 local_140; undefined4 *local_138; undefined8 local_130; ulonglong *local_128; undefined8 local_120; ulonglong *local_118; undefined8 local_110; undefined8 *local_108; undefined8 local_100; undefined8 *local_f8; undefined8 local_f0; undefined4 *local_e8; undefined8 local_e0; wchar_t local_d8; undefined1 local_d6 [142]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_308; - uVar6 = 0x82; memset(local_d6,0,0x82); for (uVar5 = 0; uVar5 < *(uint *)(param_3 + 4); uVar5 = uVar5 + 1) { local_d8 = L'\0'; puVar4 = (ushort *)((ulonglong)uVar5 * 0xb08 + 8 + param_3); bVar2 = DnsAddr_IsClear((short *)puVar4); - uVar7 = uVar6; if ((((int)CONCAT71(extraout_var,bVar2) == 0) && (*(int *)(puVar4 + 0x20) - 1U < 2)) && ((*(int *)(puVar4 + 0x22) != 0 || (*(int *)(puVar4 + 0x24) != 0)))) { DnsAddr_WriteIpString_W(&local_d8,(short *)puVar4); uVar1 = *puVar4; - uVar7 = (ulonglong)uVar1; if (5 < DAT_0) { if (((_DAT_1 & 0x400000000000) == 0) || (bVar2 = true, (DAT_2 & 0x400000000000) != DAT_2)) { bVar2 = false; } if (bVar2) { local_228 = &local_2a8; lVar3 = -1; local_230 = 0x10; local_220 = 8; do { lVar3 = lVar3 + 1; } while (*(short *)(local_d6 + lVar3 * 2 + -2) != 0); local_210 = (int)lVar3 * 2 + 2; local_20c = 0; local_218 = &local_d8; local_208 = &local_2d8; local_288 = *(undefined8 *)(puVar4 + 0x4c); local_1f8 = &local_2d4; local_2d0 = *(undefined4 *)(puVar4 + 0x22); local_1e8 = &local_2d0; local_2cc = *(undefined4 *)(puVar4 + 0x34); local_1d8 = &local_2cc; local_2c8 = *(undefined4 *)(puVar4 + 0x44); local_1c8 = &local_2c8; local_2c4 = *(undefined4 *)(puVar4 + 0x24); local_1b8 = &local_2c4; local_2a0 = *(undefined8 *)(puVar4 + 0x2c); local_1a8 = &local_2a0; local_2c0 = *(undefined4 *)(puVar4 + 0x28); local_198 = &local_2c0; local_2bc = *(undefined4 *)(puVar4 + 0x26); local_188 = &local_2bc; local_298 = *(undefined8 *)(puVar4 + 0x30); local_178 = &local_298; local_290 = *(undefined8 *)(puVar4 + 0x3c); local_168 = &local_290; local_158 = &local_288; local_2b8 = *(undefined4 *)(puVar4 + 0x38); local_148 = &local_2b8; local_2b4 = *(undefined4 *)(puVar4 + 0x36); local_138 = &local_2b4; local_280 = (ulonglong)*(uint *)(puVar4 + 0x48); local_128 = &local_280; local_278 = (ulonglong)*(uint *)(puVar4 + 0x46); local_118 = &local_278; local_200 = 4; local_1f0 = 4; local_1e0 = 4; local_1d0 = 4; local_1c0 = 4; local_1b0 = 4; local_1a0 = 8; local_190 = 4; local_180 = 4; local_170 = 8; local_160 = 8; local_150 = 8; local_140 = 4; local_130 = 4; local_120 = 8; local_270 = *(undefined8 *)(puVar4 + 0x40); local_108 = &local_270; local_f8 = local_268; + local_110 = 8; local_2b0[0] = *(undefined4 *)(puVar4 + 0x20); local_e8 = local_2b0; - local_110 = 8; local_100 = 8; local_f0 = 8; local_e0 = 4; local_2d8 = (uint)uVar1; local_2d4 = uVar5; local_2a8 = (ulonglong)param_2; local_268[0] = local_288; local_238 = param_1; - _tlgWriteTransfer_EtwEventWriteTransfer - (local_288,&DAT_3,uVar6,param_4,0x18,local_258); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_3,0,0,0x18,local_258); } } - param_4 = (ulonglong)uVar5; UploadFailuresDnsStatistics(param_1,param_2,(uint)uVar1,uVar5,&local_d8,(longlong)puVar4); } - uVar6 = uVar7; } return; } ``` ## UploadFailuresDnsStatistics ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.7| |i_ratio|0.81| |m_ratio|0.98| |b_ratio|0.73| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|UploadFailuresDnsStatistics|UploadFailuresDnsStatistics| |fullname|UploadFailuresDnsStatistics|UploadFailuresDnsStatistics| |refcount|2|2| |`length`|1204|1243| |called|WPP_SF_
__security_check_cookie
_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer|WPP_SF_
__security_check_cookie
_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer| |calling|UploadServerDnsStatistics|UploadServerDnsStatistics| |paramcount|6|6| |`address`|180040520|18004055c| |sig|undefined __fastcall UploadFailuresDnsStatistics(longlong param_1, ushort param_2, uint param_3, uint param_4, wchar_t * param_5, longlong param_6)|undefined __fastcall UploadFailuresDnsStatistics(longlong param_1, ushort param_2, uint param_3, uint param_4, wchar_t * param_5, longlong param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UploadFailuresDnsStatistics Diff ```diff --- UploadFailuresDnsStatistics +++ UploadFailuresDnsStatistics @@ -1,195 +1,182 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void UploadFailuresDnsStatistics (longlong param_1,ushort param_2,uint param_3,uint param_4,wchar_t *param_5, longlong param_6) { uint uVar1; bool bVar2; int iVar3; longlong lVar4; - longlong *plVar5; - ulonglong uVar6; - uint *puVar7; - undefined2 *puVar8; - ulonglong uVar9; - uint uVar10; - undefined8 uVar11; - undefined8 uVar12; - undefined4 uVar13; + ulonglong uVar5; + uint *puVar6; + undefined2 *puVar7; + ulonglong uVar8; + uint uVar9; + undefined4 uVar10; undefined1 auStackY_148 [32]; uint local_100; uint local_fc; uint local_f8; uint local_f4; uint local_f0; uint local_ec; uint local_e8 [4]; undefined8 local_d8 [4]; longlong local_b8; undefined8 local_b0; uint *local_a8; undefined8 local_a0; longlong local_98 [2]; uint *local_88; undefined8 local_80; uint *local_78; undefined8 local_70; uint *local_68; undefined8 local_60; uint *local_58; undefined8 local_50; uint *local_48; undefined8 local_40; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_148; - uVar10 = 0; + uVar9 = 0; if (((param_6 != 0) && (param_1 != 0)) && (param_5 != (wchar_t *)0x0)) { uVar1 = *(uint *)(param_6 + 0x40); - puVar7 = (uint *)(param_6 + 0xa8); - uVar6 = DAT_0; + puVar6 = (uint *)(param_6 + 0xa8); + uVar5 = DAT_0; local_ec = uVar1; if (uVar1 - 1 < 2) { do { - uVar12 = 4; - uVar11 = 0x400000000000; - if (*puVar7 == 0) break; + if (*puVar6 == 0) break; if (5 < DAT_1) { if (((_DAT_2 & 0x400000000000) == 0) || - (bVar2 = true, (uVar6 & 0x400000000000) != uVar6)) { + (bVar2 = true, (uVar5 & 0x400000000000) != uVar5)) { bVar2 = false; } if (bVar2) { - plVar5 = local_98; local_f0 = (uint)param_2; local_a8 = &local_f0; local_b0 = 0x10; local_a0 = 4; local_b8 = param_1; - _tlgCreate1Sz_wchar_t(plVar5,param_5); + _tlgCreate1Sz_wchar_t(local_98,param_5); local_88 = local_e8; local_78 = &local_100; local_80 = 4; - local_fc = *puVar7; + local_fc = *puVar6; local_68 = &local_fc; - local_f8 = puVar7[1]; + local_f8 = puVar6[1]; local_58 = &local_f8; local_48 = &local_f4; local_70 = 4; local_60 = 4; local_50 = 4; local_40 = 4; local_100 = param_4; local_f4 = uVar1; local_e8[0] = param_3; - _tlgWriteTransfer_EtwEventWriteTransfer(plVar5,&DAT_3,uVar11,uVar12,10,local_d8) - ; - uVar6 = DAT_0; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_3,0,0,10,local_d8); + uVar5 = DAT_0; } } - uVar10 = uVar10 + 1; - puVar7 = puVar7 + 2; - } while (uVar10 < 0x20); - uVar11 = 4; - uVar9 = 0; - puVar8 = (undefined2 *)(param_6 + 0x3ac); + uVar9 = uVar9 + 1; + puVar6 = puVar6 + 2; + } while (uVar9 < 0x20); + uVar8 = 0; + puVar7 = (undefined2 *)(param_6 + 0x3ac); do { - uVar13 = 0; - uVar12 = 0x400000000000; - if (*(char *)(puVar8 + -0x82) == '\0') break; + uVar10 = 0; + if (*(char *)(puVar7 + -0x82) == '\0') break; if (5 < DAT_1) { if (((_DAT_2 & 0x400000000000) == 0) || - (bVar2 = true, (uVar6 & 0x400000000000) != uVar6)) { + (bVar2 = true, (uVar5 & 0x400000000000) != uVar5)) { bVar2 = false; } if (bVar2) { local_f4 = (uint)param_2; local_a8 = &local_f4; local_b0 = 0x10; local_a0 = 4; local_b8 = param_1; _tlgCreate1Sz_wchar_t(local_98,param_5); local_88 = &local_f8; local_78 = &local_fc; - local_100 = *(uint *)(puVar8 + 2); + local_100 = *(uint *)(puVar7 + 2); local_68 = &local_100; local_80 = 4; local_70 = 4; local_60 = 4; - local_58 = (uint *)(uVar9 * 0x10c + param_6 + 0x2a8); + local_58 = (uint *)(uVar8 * 0x10c + param_6 + 0x2a8); if (local_58 == (uint *)0x0) { - local_58 = (uint *)0x1800f4370; + local_58 = (uint *)0x1800f4350; iVar3 = 1; } else { lVar4 = -1; do { lVar4 = lVar4 + 1; - } while (*(char *)((longlong)local_58 + lVar4) != (char)uVar13); + } while (*(char *)((longlong)local_58 + lVar4) != (char)uVar10); iVar3 = (int)lVar4 + 1; } - local_f0 = CONCAT22(local_f0._2_2_,*puVar8); + local_f0 = CONCAT22(local_f0._2_2_,*puVar7); local_48 = &local_f0; - local_50 = CONCAT44(uVar13,iVar3); + local_50 = CONCAT44(uVar10,iVar3); local_40 = 2; local_fc = param_4; local_f8 = param_3; - _tlgWriteTransfer_EtwEventWriteTransfer - (local_58,&DAT_4,uVar12,uVar11,10,local_d8); - uVar6 = DAT_0; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_4,0,0,10,local_d8); + uVar5 = DAT_0; } } - uVar10 = (int)uVar9 + 1; - uVar9 = (ulonglong)uVar10; - puVar8 = puVar8 + 0x86; - } while (uVar10 < 8); - uVar9 = 0; - uVar11 = 0x400000000000; + uVar9 = (int)uVar8 + 1; + uVar8 = (ulonglong)uVar9; + puVar7 = puVar7 + 0x86; + } while (uVar9 < 8); + uVar8 = 0; if (local_ec == 2) { - while ((uVar10 = (uint)uVar9, uVar10 < 0x20 && - (*(short *)(param_6 + 0x1a8 + uVar9 * 8) != 0))) { + while ((uVar9 = (uint)uVar8, uVar9 < 0x20 && (*(short *)(param_6 + 0x1a8 + uVar8 * 8) != 0)) + ) { if (5 < DAT_1) { if (((_DAT_2 & 0x400000000000) == 0) || - (bVar2 = true, (uVar6 & 0x400000000000) != uVar6)) { + (bVar2 = true, (uVar5 & 0x400000000000) != uVar5)) { bVar2 = false; } if (bVar2) { local_a8 = &local_ec; - plVar5 = local_98; local_b0 = 0x10; local_ec = (uint)param_2; local_a0 = 4; local_b8 = param_1; - _tlgCreate1Sz_wchar_t(plVar5,param_5); + _tlgCreate1Sz_wchar_t(local_98,param_5); local_88 = &local_f4; + local_80 = 4; local_78 = &local_f8; - local_fc = (uint)*(ushort *)(param_6 + 0x1a8 + uVar9 * 8); + local_fc = (uint)*(ushort *)(param_6 + 0x1a8 + uVar8 * 8); local_68 = &local_fc; - local_100 = *(uint *)(param_6 + 0x1ac + uVar9 * 8); + local_100 = *(uint *)(param_6 + 0x1ac + uVar8 * 8); local_58 = &local_100; - local_80 = 4; local_70 = 4; local_60 = 4; local_50 = 4; local_f8 = param_4; local_f4 = param_3; - _tlgWriteTransfer_EtwEventWriteTransfer(plVar5,&DAT_5,uVar11,uVar9,9,local_d8) - ; - uVar6 = DAT_0; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_5,0,0,9,local_d8); + uVar5 = DAT_0; } } - uVar9 = (ulonglong)(uVar10 + 1); + uVar8 = (ulonglong)(uVar9 + 1); } } } else if ((DAT_6 & 8) != 0) { - WPP_SF_(0x40b,0xb,0x1800f3ec0); + WPP_SF_(0x40b,0xb,0x1800f3ea0); } } return; } ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.7| |i_ratio|0.25| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2|2| |`length`|220|230| |called||| |calling|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4|4| |`address`|1800ab980|1800ab268| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_IncrementUsageInCache Diff ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -1,50 +1,50 @@ void wil_details_FeatureReporting_IncrementUsageInCache (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) { uint uVar1; uint uVar2; uint uVar3; uint uVar4; bool bVar5; uVar4 = *param_1; do { - uVar3 = uVar4; + uVar1 = uVar4; param_4[1] = 0; - uVar1 = uVar3 | 1; - if ((uVar3 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { - uVar4 = (uVar3 & 0x3fe0) >> 5; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar1 & 0x3fe0) >> 5; if (uVar4 != 0) { param_4[1] = uVar4; param_4[2] = ~-(uint)(param_2 != 0) & 4; - uVar1 = uVar3 & 0xffffc01f | 1; + uVar2 = uVar1 & 0xffffc01f | 1; } uVar4 = 0; if (param_2 == 4) { uVar4 = 0x4000; } - uVar1 = uVar4 | uVar1 & 0xffffbfff; + uVar2 = uVar4 | uVar2 & 0xffffbfff; } - uVar4 = uVar1 >> 5 & 0x1ff; - uVar2 = uVar4 + 1; - if ((0x1ff < uVar2) || (uVar2 < uVar4)) { - uVar2 = 1; + uVar4 = uVar2 >> 5 & 0x1ff; + uVar3 = uVar4 + 1; + if ((0x1ff < uVar3) || (uVar3 < uVar4)) { + uVar3 = 1; param_4[2] = param_2; param_4[1] = uVar4; } LOCK(); uVar4 = *param_1; - bVar5 = uVar3 == uVar4; + bVar5 = uVar1 == uVar4; if (bVar5) { - *param_1 = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1; - uVar4 = uVar3; + *param_1 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; + uVar4 = uVar1; } UNLOCK(); } while (!bVar5); param_4[4] = 0; - *param_4 = ~uVar3 & 1; + *param_4 = ~uVar1 & 1; return; } ``` ## wil::details_abi::UsageIndexProperty::UpdateCount ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.46| |i_ratio|0.52| |m_ratio|0.88| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|UpdateCount|UpdateCount| |fullname|wil::details_abi::UsageIndexProperty::UpdateCount|wil::details_abi::UsageIndexProperty::UpdateCount| |refcount|7|7| |`length`|101|73| |`called`|__security_check_cookie
memcpy_s|memcpy_s| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues| |paramcount|2|2| |`address`|1800c9968|1800a9c20| |sig|void __thiscall UpdateCount(UsageIndexProperty * this, uint param_1)|void __thiscall UpdateCount(UsageIndexProperty * this, uint param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::UsageIndexProperty::UpdateCount Called Diff ```diff --- wil::details_abi::UsageIndexProperty::UpdateCount called +++ wil::details_abi::UsageIndexProperty::UpdateCount called @@ -1 +0,0 @@ -__security_check_cookie ``` ### wil::details_abi::UsageIndexProperty::UpdateCount Diff ```diff --- wil::details_abi::UsageIndexProperty::UpdateCount +++ wil::details_abi::UsageIndexProperty::UpdateCount @@ -1,37 +1,33 @@ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: void __cdecl wil::details_abi::UsageIndexProperty::UpdateCount(unsigned int) __ptr64 */ void __thiscall wil::details_abi::UsageIndexProperty::UpdateCount(UsageIndexProperty *this,uint param_1) { - undefined8 uVar1; - UsageIndexProperty *pUVar2; - undefined8 uVar3; - undefined1 auStack_38 [32]; - undefined2 local_18 [4]; - ulonglong local_10; + rsize_t _DstSize; + UsageIndexProperty *_Src; + rsize_t _MaxCount; + undefined2 local_res10 [12]; - local_10 = __security_cookie ^ (ulonglong)auStack_38; - pUVar2 = this + 4; - if (*(uint *)pUVar2 != param_1) { - *(uint *)pUVar2 = param_1; + _Src = this + 4; + if (*(uint *)_Src != param_1) { + *(uint *)_Src = param_1; if (this[2] == (UsageIndexProperty)0x1) { - uVar3 = 2; - local_18[0] = (undefined2)param_1; - pUVar2 = (UsageIndexProperty *)local_18; - uVar1 = 2; + _MaxCount = 2; + local_res10[0] = (undefined2)param_1; + _Src = (UsageIndexProperty *)local_res10; + _DstSize = 2; } else { if (this[2] != (UsageIndexProperty)0x2) { return; } - uVar1 = 4; - uVar3 = 4; + _DstSize = 4; + _MaxCount = 4; } - memcpy_s(*(undefined8 *)(this + 0x10),uVar1,pUVar2,uVar3); + memcpy_s(*(void **)(this + 0x10),_DstSize,_Src,_MaxCount); } return; } ``` ## wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.9| |i_ratio|0.72| |m_ratio|0.96| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|`scalar_deleting_destructor'|`scalar_deleting_destructor'| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor'|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor'| |`refcount`|4|3| |`length`|38|43| |`called`|operator_delete|operator_delete[]| |calling||| |paramcount|2|2| |`address`|1800c5b70|1800a47a0| |sig|void * __thiscall `scalar_deleting_destructor'(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, uint param_1)|void * __thiscall `scalar_deleting_destructor'(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, uint param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' Called Diff ```diff --- wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' called +++ wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' called @@ -1 +1 @@ -operator_delete +operator_delete[] ``` ### wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' Diff ```diff --- wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' +++ wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::`scalar_deleting_destructor' @@ -1,22 +1,22 @@ /* public: virtual void * __ptr64 __cdecl wistd::__function::__func,bool __cdecl(void * __ptr64,unsigned __int64,void * __ptr64,unsigned __int64,unsigned int)>::`scalar deleting destructor'(unsigned int) __ptr64 */ void * __thiscall wistd::__function:: __func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> ::_scalar_deleting_destructor_ (__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> *this,uint param_1) { *(undefined ***)this = &__base ::_vftable_; if ((param_1 & 1) != 0) { - operator_delete(this); + operator_delete__(this); } return this; } ``` ## wil::details_abi::RawUsageIndex::RecordUsageInternal ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.71| |i_ratio|0.47| |m_ratio|1.0| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|RecordUsageInternal|RecordUsageInternal| |fullname|wil::details_abi::RawUsageIndex::RecordUsageInternal|wil::details_abi::RawUsageIndex::RecordUsageInternal| |refcount|3|3| |`length`|540|527| |`called`|API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s
__security_check_cookie
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::GetSize
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write|__security_check_cookie
memmove_s
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::GetSize
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write| |calling|wil::details_abi::RawUsageIndex::RecordUsage|wil::details_abi::RawUsageIndex::RecordUsage| |paramcount|6|6| |`address`|1800c87b4|1800a8974| |sig|bool __thiscall RecordUsageInternal(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)|bool __thiscall RecordUsageInternal(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details_abi::RawUsageIndex::RecordUsageInternal Called Diff ```diff --- wil::details_abi::RawUsageIndex::RecordUsageInternal called +++ wil::details_abi::RawUsageIndex::RecordUsageInternal called @@ -1 +0,0 @@ -API-MS-WIN-CRT-STRING-L1-1-0.DLL::memmove_s @@ -2,0 +2 @@ +memmove_s ``` ### wil::details_abi::RawUsageIndex::RecordUsageInternal Diff ```diff --- wil::details_abi::RawUsageIndex::RecordUsageInternal +++ wil::details_abi::RawUsageIndex::RecordUsageInternal @@ -1,116 +1,118 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Removing unreachable block (ram,0x0001800c8977) */ +/* WARNING: Removing unreachable block (ram,0x0001800a8aa7) */ /* private: bool __cdecl wil::details_abi::RawUsageIndex::RecordUsageInternal(void * __ptr64,unsigned __int64,void * __ptr64,unsigned __int64,unsigned int) __ptr64 */ bool __thiscall wil::details_abi::RawUsageIndex::RecordUsageInternal (RawUsageIndex *this,void *param_1,__uint64 param_2,void *param_3,__uint64 param_4, uint param_5) { ulonglong uVar1; ulonglong uVar2; ulonglong uVar3; longlong lVar4; bool bVar5; bool bVar6; int iVar7; __uint64 _Var8; __uint64 _Var9; uchar *puVar10; undefined1 auStackY_c8 [32]; uchar *local_98; uint local_90; __uint64 local_88; undefined2 local_80; RawUsageIndex local_7e; - int local_7c; + uint local_7c; undefined2 local_78; undefined8 local_70; - void *pvStack_68; + void *local_68; undefined2 local_60; RawUsageIndex local_5e; - uint local_5c; + int local_5c; undefined2 local_58; undefined8 local_50; - void *local_48; + void *pvStack_48; ulonglong local_40; local_40 = __security_cookie ^ (ulonglong)auStackY_c8; local_88 = param_4; local_90 = param_5; if (*(longlong *)(this + 0x18) != 0) { - local_80 = *(undefined2 *)(this + 2); + local_60 = *(undefined2 *)(this + 2); puVar10 = (uchar *)(*(longlong *)(this + 0x18) + 10); - local_7e = this[4]; + local_5e = this[4]; bVar5 = false; - local_7c = 0; - local_78 = 0; - local_70 = 0; - pvStack_68 = (void *)0x0; + local_5c = 0; + local_58 = 0; + local_50 = 0; + pvStack_48 = (void *)0x0; while (local_98 = puVar10, bVar6 = UsageIndexProperty::Read - ((UsageIndexProperty *)&local_80,&local_98,*(uchar **)(this + 0x20)), + ((UsageIndexProperty *)&local_60,&local_98,*(uchar **)(this + 0x20)), bVar6) { - iVar7 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_80,param_1,param_2); + iVar7 = UsageIndexProperty::Compare((UsageIndexProperty *)&local_60,param_1,param_2); if (iVar7 < 0) goto LAB_0; if (iVar7 == 0) { puVar10 = FindInsertionPointOrIncrement - (this,(UsageIndexProperty *)&local_80,local_98,param_3,local_88,local_90 + (this,(UsageIndexProperty *)&local_60,local_98,param_3,local_88,local_90 ); if (puVar10 == (uchar *)0x0) { return true; } bVar5 = true; goto LAB_0; } - puVar10 = SkipValues(this,(UsageIndexProperty *)&local_80,local_98); + puVar10 = SkipValues(this,(UsageIndexProperty *)&local_60,local_98); } bVar5 = false; *(uchar **)(this + 0x20) = local_98; puVar10 = local_98; LAB_0: local_98 = puVar10; puVar10 = local_98; _Var8 = 0; + iVar7 = local_5c; if (!bVar5) { - local_70 = 0; - local_7c = 1; - local_78 = (undefined2)param_2; - pvStack_68 = param_1; - _Var8 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_80); + local_50 = 0; + local_5c = 1; + local_58 = (undefined2)param_2; + pvStack_48 = param_1; + _Var8 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_60); + iVar7 = 1; } - local_60 = *(undefined2 *)(this + 6); - local_50 = 0; - local_5e = this[8]; - local_5c = local_90; - local_58 = (undefined2)local_88; - local_48 = param_3; - _Var9 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_60); + local_80 = *(undefined2 *)(this + 6); + local_70 = 0; + local_7e = this[8]; + local_7c = local_90; + local_78 = (undefined2)local_88; + local_68 = param_3; + _Var9 = UsageIndexProperty::GetSize((UsageIndexProperty *)&local_80); uVar2 = *(ulonglong *)(this + 0x28); uVar3 = *(ulonglong *)(this + 0x20); uVar1 = _Var8 + _Var9; if (uVar1 <= (-(ulonglong)(uVar3 < uVar2) & uVar2 - uVar3)) { memmove_s(puVar10 + uVar1,(uVar2 - uVar1) - (longlong)puVar10,puVar10, uVar3 - (longlong)puVar10); lVar4 = *(longlong *)(this + 0x20); *(uchar **)(this + 0x20) = (uchar *)(lVar4 + uVar1); if (bVar5) { - if (local_7e != (RawUsageIndex)0x0) { - UsageIndexProperty::UpdateCount((UsageIndexProperty *)&local_80,local_7c + 1); + if (local_5e != (RawUsageIndex)0x0) { + UsageIndexProperty::UpdateCount((UsageIndexProperty *)&local_60,iVar7 + 1); } } else { UsageIndexProperty::Write - ((UsageIndexProperty *)&local_80,&local_98,(uchar *)(lVar4 + uVar1)); + ((UsageIndexProperty *)&local_60,&local_98,(uchar *)(lVar4 + uVar1)); } - UsageIndexProperty::Write((UsageIndexProperty *)&local_60,&local_98,*(uchar **)(this + 0x20)); + UsageIndexProperty::Write((UsageIndexProperty *)&local_80,&local_98,*(uchar **)(this + 0x20)); this[0x38] = (RawUsageIndex)0x1; return true; } } return false; } ``` ## wil::details::LogStringPrintf ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.36| |i_ratio|0.34| |m_ratio|0.77| |b_ratio|0.72| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|LogStringPrintf|LogStringPrintf| |fullname|wil::details::LogStringPrintf|wil::details::LogStringPrintf| |refcount|11|11| |`length`|102|151| |`called`|StringCchVPrintfW
__security_check_cookie|__security_check_cookie
_vsnwprintf_s| |calling|wil::GetFailureLogString|wil::GetFailureLogString| |paramcount|3|3| |`address`|1800c7730|1800a78c0| |sig|ushort * __cdecl LogStringPrintf(ushort * param_1, ushort * param_2, ushort * param_3, ...)|ushort * __cdecl LogStringPrintf(ushort * param_1, ushort * param_2, ushort * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::LogStringPrintf Called Diff ```diff --- wil::details::LogStringPrintf called +++ wil::details::LogStringPrintf called @@ -1 +0,0 @@ -StringCchVPrintfW @@ -2,0 +2 @@ +_vsnwprintf_s ``` ### wil::details::LogStringPrintf Diff ```diff --- wil::details::LogStringPrintf +++ wil::details::LogStringPrintf @@ -1,28 +1,41 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* unsigned short * __ptr64 __cdecl wil::details::LogStringPrintf(unsigned short * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,...) */ ushort * __cdecl wil::details::LogStringPrintf(ushort *param_1,ushort *param_2,ushort *param_3,...) { - longlong lVar1; + size_t _MaxCount; + int iVar1; + longlong lVar2; + size_t _SizeInWords; undefined8 in_R9; undefined8 local_res20; - undefined1 auStack_48 [40]; - ulonglong local_20; - local_20 = __security_cookie ^ (ulonglong)auStack_48; - local_res20 = in_R9; - StringCchVPrintfW((STRSAFE_LPWSTR)param_1,(longlong)param_2 - (longlong)param_1 >> 1, - (STRSAFE_LPCWSTR)param_3,(va_list)&local_res20); + _SizeInWords = (longlong)param_2 - (longlong)param_1 >> 1; + if (_SizeInWords != 0) { + if (_SizeInWords < 0x80000000) { + _MaxCount = _SizeInWords - 1; + local_res20 = in_R9; + iVar1 = _vsnwprintf_s((wchar_t *)param_1,_SizeInWords,_MaxCount,(wchar_t *)param_3, + (va_list)&local_res20); + if (((iVar1 < 0) || (_MaxCount < (ulonglong)(longlong)iVar1)) || + ((longlong)iVar1 == _MaxCount)) { + param_1[_MaxCount] = 0; + } + } + else { + *param_1 = 0; + } + } if (param_2 != param_1) { - lVar1 = -1; + lVar2 = -1; do { - lVar1 = lVar1 + 1; - } while (param_1[lVar1] != 0); - param_1 = param_1 + lVar1; + lVar2 = lVar2 + 1; + } while (param_1[lVar2] != 0); + param_1 = param_1 + lVar2; } return param_1; } ``` ## Dns_CacheServiceInitEx ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.91| |i_ratio|0.59| |m_ratio|0.99| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|Dns_CacheServiceInitEx|Dns_CacheServiceInitEx| |fullname|Dns_CacheServiceInitEx|Dns_CacheServiceInitEx| |refcount|4|4| |`length`|1056|1069| |called|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-1.DLL::CreateSemaphoreW
AdaptiveTimeout_InitializeGlobals
DnsCreateSocketClosingWork
DnsInitDdr
DnsInitWinsock
Dns_IsCallerDns
DotCleanupInitialize
InitializeDnsApiStatistics
InitializeDnsStatisticsMicrosoftTelemetryAssertTriggeredNoArgs
NTDLL.DLL::RtlGetCurrentServiceSessionId
WPP_SF_
WPP_SF_D
WPP_SF_lqd
WS2_32.DLL::Ordinal_115
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
memset
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-1.DLL::CreateSemaphoreW
AdaptiveTimeout_InitializeGlobals
DnsCreateSocketClosingWork
DnsInitDdr
DnsInitWinsock
Dns_IsCallerDns
DotCleanupInitialize
InitializeDnsApiStatistics
InitializeDnsStatisticsMicrosoftTelemetryAssertTriggeredNoArgs
NTDLL.DLL::RtlGetCurrentServiceSessionId
WPP_SF_
WPP_SF_D
WPP_SF_lqd
WS2_32.DLL::Ordinal_115
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
memset
| |calling||| |paramcount|3|3| |`address`|180092c30|180092c10| |sig|DWORD __fastcall Dns_CacheServiceInitEx(int param_1, longlong * param_2, uint param_3)|DWORD __fastcall Dns_CacheServiceInitEx(int param_1, longlong * param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Dns_CacheServiceInitEx Diff ```diff --- Dns_CacheServiceInitEx +++ Dns_CacheServiceInitEx @@ -1,196 +1,189 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ DWORD Dns_CacheServiceInitEx(int param_1,longlong *param_2,uint param_3) { undefined8 *puVar1; bool bVar2; DWORD DVar3; int iVar4; undefined8 uVar5; undefined1 *_Dst; ushort uVar6; - undefined *puVar7; - undefined *_Size; - longlong *plVar8; + longlong *plVar7; LPCSTR unaff_retaddr; undefined1 auStackY_258 [32]; int local_228 [2]; undefined8 local_220; undefined1 local_218 [416]; undefined8 local_78 [4]; undefined8 *local_58; undefined4 local_50; undefined4 local_4c; int *local_48; undefined4 local_40; undefined4 local_3c; ulonglong local_38; - /* 0x92c30 264 Dns_CacheServiceInitEx */ + /* 0x92c10 264 Dns_CacheServiceInitEx */ local_38 = __security_cookie ^ (ulonglong)auStackY_258; - _Size = (undefined *)(ulonglong)param_3; _Dst = local_218; - plVar8 = (longlong *)0x0; + plVar7 = (longlong *)0x0; memset(_Dst,0,0x198); if ((DAT_0 & 8) != 0) { - WPP_SF_lqd(_Dst,10,0x1800f6f78,param_1,param_2); + WPP_SF_lqd(_Dst,10,0x1800f6f58,param_1,param_2); } if (((g_fVelocitySuppressInternalExports != 0) && (g_DnsIsCache == 0)) && (uVar5 = Dns_IsCallerDns(unaff_retaddr), (int)uVar5 == 0)) { MicrosoftTelemetryAssertTriggeredNoArgs(); DVar3 = 0x78; goto LAB_1; } if (param_2 != (longlong *)0x0) { bVar2 = true; if (g_fVelocityZtdnsProbing == 0) { if ((param_1 == 1) && (param_3 == 0x90)) goto LAB_2; } else if (((param_1 == 2) && ((param_3 == 0x10 && (param_2[1] != 0)))) && - (plVar8 = param_2, *param_2 != 0)) { + (plVar7 = param_2, *param_2 != 0)) { LAB_2: - uVar5 = 0; g_DnsIsCache = 1; - puVar7 = (undefined *)0xa; g_hSettingsSemaphore = CreateSemaphoreW((LPSECURITY_ATTRIBUTES)0x0,10,10,(LPCWSTR)0x0); if (g_hSettingsSemaphore != (HANDLE)0x0) { DVar3 = DnsCreateSocketClosingWork(); if (DVar3 == 0) { if (g_fVelocityDisableInternalExports == 0) { DVar3 = DnsInitWinsock(); if (DVar3 == 0) goto LAB_3; if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0xd; } else { DVar3 = Ordinal_115(0x202,local_218); if (DVar3 == 0) { g_fWinsockStarted = 1; LAB_3: DVar3 = DnsInitDdr(); if (DVar3 == 0) { DVar3 = DotCleanupInitialize(); if (DVar3 == 0) { g_DnsCacheServiceStopPending = 0; AdaptiveTimeout_InitializeGlobals(); iVar4 = RtlGetCurrentServiceSessionId(); if ((iVar4 != 0) && (g_IsArgon = 1, (DAT_0 & 8) != 0)) { - puVar7 = &WPP_91e50558be533056065562a944b5a4a4_Traceguids; - WPP_SF_(0x40b,0x10,0x1800f6f78); + WPP_SF_(0x40b,0x10,0x1800f6f58); } DVar3 = InitializeDnsApiStatistics(); if (DVar3 == 0) { DVar3 = InitializeDnsStatistics(); if (DVar3 == 0) { if (g_fVelocityZtdnsProbing == 0) { AcquireSRWLockExclusive((PSRWLOCK)&g_rwResolverDataLock); - memcpy(&g_ResolverData,param_2,(size_t)_Size); + memcpy(&g_ResolverData,param_2,(ulonglong)param_3); ReleaseSRWLockExclusive((PSRWLOCK)&g_rwResolverDataLock); } else { AcquireSRWLockExclusive((PSRWLOCK)&g_rwResolverDataLock); - puVar1 = (undefined8 *)*plVar8; + puVar1 = (undefined8 *)*plVar7; g_ResolverData = *puVar1; DAT_4 = puVar1[1]; DAT_5 = puVar1[2]; DAT_6 = puVar1[3]; DAT_7 = puVar1[4]; DAT_8 = puVar1[5]; DAT_9 = puVar1[6]; DAT_10 = puVar1[7]; DAT_11 = puVar1[8]; DAT_12 = puVar1[9]; DAT_13 = puVar1[10]; DAT_14 = puVar1[0xb]; DAT_15 = puVar1[0xc]; DAT_16 = puVar1[0xd]; DAT_17._0_4_ = *(undefined4 *)(puVar1 + 0xe); DAT_17._4_4_ = *(undefined4 *)((longlong)puVar1 + 0x74); DAT_18._0_4_ = *(undefined4 *)(puVar1 + 0xf); DAT_18._4_4_ = *(undefined4 *)((longlong)puVar1 + 0x7c); DAT_19._0_4_ = *(undefined4 *)(puVar1 + 0x10); DAT_19._4_4_ = *(undefined4 *)((longlong)puVar1 + 0x84); DAT_20._0_4_ = *(undefined4 *)(puVar1 + 0x11); DAT_20._4_4_ = *(undefined4 *)((longlong)puVar1 + 0x8c); ReleaseSRWLockExclusive((PSRWLOCK)&g_rwResolverDataLock); - *(code **)plVar8[1] = NetInfo_BuildEx2; - _Size = puVar7; + *(code **)plVar7[1] = NetInfo_BuildEx2; } if (5 < DAT_21) { if (((_DAT_22 & 0x200000000000) == 0) || ((DAT_23 & 0x200000000000) != DAT_23)) { bVar2 = false; } if (bVar2) { local_4c = 0; local_58 = &local_220; local_3c = 0; local_228[0] = g_DnsIsCache; local_48 = local_228; + local_40 = 4; local_220 = 0x2000000; local_50 = 8; - local_40 = 4; _tlgWriteTransfer_EtwEventWriteTransfer - (4,&DAT_24,_Size,uVar5,4,local_78); + (0x180111218,&DAT_24,0,0,4,local_78); } } goto LAB_1; } if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0x12; } else { if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0x11; } } else { if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0xf; } } else { if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0xe; } } else { if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0xc; } } } else { if ((DAT_0 & 8) == 0) { return DVar3; } uVar6 = 0xb; } - WPP_SF_D(0x40b,uVar6,0x1800f6f78,DVar3); + WPP_SF_D(0x40b,uVar6,0x1800f6f58,DVar3); goto LAB_1; } } } DVar3 = 0x57; LAB_1: if ((DAT_0 & 8) != 0) { - WPP_SF_D(0x40b,0x13,0x1800f6f78,DVar3); + WPP_SF_D(0x40b,0x13,0x1800f6f58,DVar3); } return DVar3; } ``` ## _tlgWriteTransfer_EtwEventWriteTransfer ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.89| |i_ratio|0.65| |m_ratio|0.99| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|_tlgWriteTransfer_EtwEventWriteTransfer|_tlgWriteTransfer_EtwEventWriteTransfer| |fullname|_tlgWriteTransfer_EtwEventWriteTransfer|_tlgWriteTransfer_EtwEventWriteTransfer| |refcount|10|10| |`length`|197|185| |called|NTDLL.DLL::EtwEventWriteTransfer
__security_check_cookie|NTDLL.DLL::EtwEventWriteTransfer
__security_check_cookie| |calling|DnsCheckServerConfig
Dns_CacheServiceInitEx
Trace_LogQueryDuration
UploadAllDnsStatistics
UploadFailuresDnsStatistics
UploadQueryStatistics
UploadServerDnsStatistics|DnsCheckServerConfig
Dns_CacheServiceInitEx
Trace_LogQueryDuration
UploadAllDnsStatistics
UploadFailuresDnsStatistics
UploadQueryStatistics
UploadServerDnsStatistics| |paramcount|6|6| |`address`|180040a1c|180040a80| |`sig`|undefined __fastcall _tlgWriteTransfer_EtwEventWriteTransfer(undefined8 param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)|undefined __fastcall _tlgWriteTransfer_EtwEventWriteTransfer(longlong param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgWriteTransfer_EtwEventWriteTransfer Diff ```diff --- _tlgWriteTransfer_EtwEventWriteTransfer +++ _tlgWriteTransfer_EtwEventWriteTransfer @@ -1,34 +1,34 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void _tlgWriteTransfer_EtwEventWriteTransfer - (undefined8 param_1,byte *param_2,undefined8 param_3,undefined8 param_4, + (longlong param_1,byte *param_2,undefined8 param_3,undefined8 param_4, undefined4 param_5,undefined8 *param_6) { undefined1 auStack_58 [32]; undefined4 local_38; undefined8 *local_30; undefined4 local_28; int local_20; uint local_1c; undefined8 local_18; ulonglong local_10; local_10 = __security_cookie ^ (ulonglong)auStack_58; local_20 = (uint)*param_2 << 0x18; local_1c = (uint)*(ushort *)(param_2 + 1); local_18 = *(undefined8 *)(param_2 + 3); - *param_6 = PTR_DAT_0; + *param_6 = *(undefined8 *)(param_1 + 8); local_30 = param_6; - *(uint *)(param_6 + 1) = (uint)*(ushort *)PTR_DAT_0; + *(uint *)(param_6 + 1) = (uint)**(ushort **)(param_1 + 8); param_6[2] = param_2 + 0xb; *(undefined4 *)((longlong)param_6 + 0xc) = 2; *(uint *)(param_6 + 3) = (uint)*(ushort *)(param_2 + 0xb); *(undefined4 *)((longlong)param_6 + 0x1c) = 1; local_28 = 0x8b9; local_38 = param_5; - EtwEventWriteTransfer(DAT_1,&local_20,0,0); + EtwEventWriteTransfer(*(undefined8 *)(param_1 + 0x20),&local_20); return; } ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.82| |i_ratio|0.53| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2|2| |`length`|374|381| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4|4| |`address`|1800aba64|1800ab358| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_RecordUsageInCache Diff ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -1,101 +1,101 @@ uint * wil_details_FeatureReporting_RecordUsageInCache (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) { uint uVar1; uint uVar2; uint uVar3; uint uVar4; uint uVar5; bool bVar6; uVar3 = (uint)param_3; param_1[0] = 0; param_1[1] = 0; param_1[2] = 0; param_1[3] = 0; param_1[4] = 0; param_1[5] = 0; if (uVar3 == 0) { LAB_0: wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); } else { if (uVar3 == 1) { LAB_1: wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); return param_1; } if ((uVar3 != 2) && (uVar3 != 3)) { if (uVar3 == 4) goto LAB_0; if (uVar3 == 5) goto LAB_1; if ((uVar3 != 6) && (uVar3 != 7)) { - uVar4 = uVar3 - 0x140; - if ((int)uVar4 < 0x40) { - uVar5 = param_2[1]; + uVar5 = uVar3 - 0x140; + if ((int)uVar5 < 0x40) { + uVar4 = param_2[1]; do { - if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) { + if (((uVar4 & 0x10) == 0) || (uVar2 = 1, (uVar4 >> 5 & 0x3f) != uVar5)) { uVar2 = 0; } param_1[4] = uVar2; LOCK(); uVar2 = param_2[1]; - bVar6 = uVar5 == uVar2; + bVar6 = uVar4 == uVar2; if (bVar6) { - param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10; - uVar2 = uVar5; + param_2[1] = (uVar5 * 0x20 ^ uVar4) & 0x7e0 ^ uVar4 | 0x10; + uVar2 = uVar4; } - uVar5 = uVar2; + uVar4 = uVar2; UNLOCK(); } while (!bVar6); if (param_1[4] != 0) { return param_1; } } param_1[2] = uVar3; param_1[1] = 1; param_1[3] = param_4; return param_1; } } - uVar4 = 0; + uVar5 = 0; if (uVar3 == 2) { - uVar4 = 2; + uVar5 = 2; } else if (uVar3 == 3) { - uVar4 = 8; + uVar5 = 8; } else if (uVar3 == 6) { - uVar4 = 4; + uVar5 = 4; } else if (uVar3 == 7) { - uVar4 = 0x10; + uVar5 = 0x10; } - uVar5 = 1; + uVar4 = 1; uVar3 = *param_2; do { uVar1 = uVar3; - uVar3 = uVar4 | uVar1; + uVar3 = uVar5 | uVar1; param_1[4] = (uint)(uVar3 == uVar1); uVar2 = uVar3 | 1; if (uVar3 == uVar1) { uVar2 = uVar3; } LOCK(); uVar3 = *param_2; bVar6 = uVar1 == uVar3; if (bVar6) { *param_2 = uVar2; uVar3 = uVar1; } UNLOCK(); } while (!bVar6); if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { - uVar5 = 0; + uVar4 = 0; } - *param_1 = uVar5; + *param_1 = uVar4; } return param_1; } ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.52| |i_ratio|0.24| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2|2| |`length`|208|218| |called||| |calling|wil_details_FeatureReporting_RecordUsageInCache|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4|4| |`address`|1800ab8a8|1800ab184| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_FeatureReporting_IncrementOpportunityInCache Diff ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -1,54 +1,54 @@ void wil_details_FeatureReporting_IncrementOpportunityInCache (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) { uint uVar1; uint uVar2; uint uVar3; uint uVar4; bool bVar5; - uVar2 = *param_1; + uVar3 = *param_1; do { - uVar4 = uVar2; + uVar1 = uVar3; param_4[1] = 0; - uVar1 = uVar4 | 1; - if ((uVar4 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { - uVar2 = (uVar4 & 0x3f8000) >> 0xf; - if (uVar2 != 0) { - param_4[1] = uVar2; - uVar2 = 5; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar3 = (uVar1 & 0x3f8000) >> 0xf; + if (uVar3 != 0) { + param_4[1] = uVar3; + uVar3 = 5; if (param_2 != 1) { - uVar2 = 1; + uVar3 = 1; } - uVar1 = uVar4 & 0xffc07fff | 1; - param_4[2] = uVar2; + uVar2 = uVar1 & 0xffc07fff | 1; + param_4[2] = uVar3; } - uVar2 = 0; + uVar3 = 0; if (param_2 == 5) { - uVar2 = 0x400000; + uVar3 = 0x400000; } - uVar1 = uVar2 | uVar1 & 0xffbfffff; + uVar2 = uVar3 | uVar2 & 0xffbfffff; } - uVar2 = uVar1 >> 0xf & 0x7f; - uVar3 = uVar2 + 1; - if ((0x7f < uVar3) || (uVar3 < uVar2)) { - uVar3 = 1; + uVar3 = uVar2 >> 0xf & 0x7f; + uVar4 = uVar3 + 1; + if ((0x7f < uVar4) || (uVar4 < uVar3)) { + uVar4 = 1; param_4[2] = param_2; - param_4[1] = uVar2; + param_4[1] = uVar3; } LOCK(); - uVar2 = *param_1; - bVar5 = uVar4 == uVar2; + uVar3 = *param_1; + bVar5 = uVar1 == uVar3; if (bVar5) { - *param_1 = (uVar3 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1; - uVar2 = uVar4; + *param_1 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; + uVar3 = uVar1; } UNLOCK(); } while (!bVar5); param_4[4] = 0; - *param_4 = ~uVar4 & 1; + *param_4 = ~uVar1 & 1; return; } ``` ## DnsRawCreateQueryResult ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.88| |i_ratio|0.67| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|DnsRawCreateQueryResult|DnsRawCreateQueryResult| |fullname|DnsRawCreateQueryResult|DnsRawCreateQueryResult| |refcount|2|2| |`length`|507|506| |called|DnsApiFree
DnsRawParseHeaderBits
Dns_Allocate
WPP_SF_D
WPP_SF_dD
WPP_SF_ii|DnsApiFree
DnsRawParseHeaderBits
Dns_Allocate
WPP_SF_D
WPP_SF_dD
WPP_SF_ii| |calling|DnsQueryRaw|DnsQueryRaw| |paramcount|5|5| |`address`|1800a366c|1800a5024| |sig|undefined4 __fastcall DnsRawCreateQueryResult(longlong param_1, longlong param_2, int param_3, int param_4, undefined8 * param_5)|undefined4 __fastcall DnsRawCreateQueryResult(longlong param_1, longlong param_2, int param_3, int param_4, undefined8 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DnsRawCreateQueryResult Diff ```diff --- DnsRawCreateQueryResult +++ DnsRawCreateQueryResult @@ -1,100 +1,100 @@ undefined4 DnsRawCreateQueryResult (longlong param_1,longlong param_2,int param_3,int param_4,undefined8 *param_5) { undefined4 uVar1; ulonglong uVar2; undefined8 *puVar3; ulonglong uVar4; undefined4 *puVar5; undefined8 uVar6; ushort uVar7; undefined4 uVar8; puVar3 = param_5; uVar8 = 0; if (param_5 != (undefined8 *)0x0) { *param_5 = 0; } if (((param_1 == 0) || (param_5 == (undefined8 *)0x0)) || (param_2 == 0)) { uVar8 = 0x57; goto LAB_0; } uVar2 = *(ulonglong *)(param_1 + 0x28); uVar4 = uVar2 | 0x200; if ((uVar2 & 0x10) == 0) { if ((uVar2 >> 10 & 1) == 0) { if ((uVar2 >> 0x11 & 1) == 0) { if ((uVar2 >> 0x2e & 1) == 0) { if (param_3 != 0) { uVar4 = uVar2 | 0x200000000000200; } if (param_4 != 0) { uVar4 = uVar4 | 0x1000000; } if (*(int *)(param_1 + 0x60) == 1) { uVar4 = uVar4 | 1; } else if (*(int *)(param_1 + 0x60) == 2) { uVar4 = uVar4 | 2; } param_5 = (undefined8 *)(uVar4 | 0x80010808); if ((g_fVelocityRawQueryFQDN != 0) && (*(longlong *)(param_1 + 0x10) != 0)) { param_5 = (undefined8 *)(uVar4 | 0x80011808); } DnsRawParseHeaderBits(param_2,(ulonglong *)¶m_5); if (*(int *)(param_1 + 4) == 1) { uVar6 = 0x60; puVar5 = Dns_Allocate(0x60); if (puVar5 == (undefined4 *)0x0) { uVar8 = 0xe; } else { uVar1 = *(undefined4 *)(param_1 + 4); *(undefined8 **)(puVar5 + 2) = param_5; *puVar5 = uVar1; *(undefined8 *)(puVar5 + 4) = *(undefined8 *)(param_1 + 0x48); if ((DAT_1 & 8) != 0) { - WPP_SF_ii(uVar6,0x56,0x1800f8a18,param_5); + WPP_SF_ii(uVar6,0x58,0x1800f8e38,param_5); } *puVar3 = puVar5; } } else { uVar8 = 0x57; if ((DAT_1 & 8) != 0) { - WPP_SF_dD(0x40b,0x55,0x1800f8a18,0x57); + WPP_SF_dD(0x40b,0x57,0x1800f8e38,0x57); } } goto LAB_0; } uVar8 = 0x57; - if ((DAT_1 & 8) == 0) goto LAB_1800a3848; - uVar7 = 0x54; + if ((DAT_1 & 8) == 0) goto LAB_1800a51ff; + uVar7 = 0x56; } else { uVar8 = 0x57; - if ((DAT_1 & 8) == 0) goto LAB_1800a3848; - uVar7 = 0x53; + if ((DAT_1 & 8) == 0) goto LAB_1800a51ff; + uVar7 = 0x55; } } else { uVar8 = 0x57; - if ((DAT_1 & 8) == 0) goto LAB_1800a3848; - uVar7 = 0x52; + if ((DAT_1 & 8) == 0) goto LAB_1800a51ff; + uVar7 = 0x54; } } else { uVar8 = 0x57; - if ((DAT_1 & 8) == 0) goto LAB_1800a3848; - uVar7 = 0x51; + if ((DAT_1 & 8) == 0) goto LAB_1800a51ff; + uVar7 = 0x53; } uVar8 = 0x57; - WPP_SF_D(0x40b,uVar7,0x1800f8a18,0x57); + WPP_SF_D(0x40b,uVar7,0x1800f8e38,0x57); LAB_0: DnsApiFree((void *)0x0); return uVar8; } ``` ## Trace_LogQueryDuration ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig| |ratio|0.95| |i_ratio|0.88| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|Trace_LogQueryDuration|Trace_LogQueryDuration| |fullname|Trace_LogQueryDuration|Trace_LogQueryDuration| |refcount|7|7| |`length`|724|737| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
UpdateDnsSeriesStatistics
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
UpdateDnsSeriesStatistics
__security_check_cookie
_tlgWriteTransfer_EtwEventWriteTransfer
memset| |calling|DnsQueryEx
DnsQuery_W
DnsResolverQueryHvsi
Query_Shim
SyncResolverQueryRpc
Trace_LogQueryDurationFromStart|DnsQueryEx
DnsQuery_W
DnsResolverQueryHvsi
Query_Shim
SyncResolverQueryRpc
Trace_LogQueryDurationFromStart| |paramcount|4|3| |address|18001256c|18001256c| |`sig`|undefined __fastcall Trace_LogQueryDuration(uint param_1, ulonglong param_2, int param_3, undefined8 param_4)|undefined __fastcall Trace_LogQueryDuration(uint param_1, ulonglong param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### Trace_LogQueryDuration Diff ```diff --- Trace_LogQueryDuration +++ Trace_LogQueryDuration @@ -1,138 +1,136 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void Trace_LogQueryDuration(uint param_1,ulonglong param_2,int param_3,undefined8 param_4) +void Trace_LogQueryDuration(uint param_1,ulonglong param_2,int param_3) { int iVar1; uint uVar2; undefined8 uVar3; PSRWLOCK pRVar5; int *piVar6; int *piVar7; ulonglong uVar8; ulonglong uVar9; bool bVar10; undefined1 auStackY_148 [32]; - uint local_118; + int local_118; int local_114; undefined8 local_110; ulonglong local_108; ulonglong local_100; undefined8 local_f8; undefined8 local_f0; undefined8 local_e8 [4]; - uint *local_c8; + int *local_c8; undefined8 local_c0; undefined8 *local_b8; undefined8 local_b0; ulonglong *local_a8; undefined8 local_a0; ulonglong *local_98; undefined8 local_90; undefined8 *local_88; undefined8 local_80; int *local_78; undefined8 local_70; longlong local_68; undefined8 local_60; longlong local_58; undefined8 local_50; undefined8 *local_48; undefined8 local_40; ulonglong local_38; ulonglong uVar4; local_38 = __security_cookie ^ (ulonglong)auStackY_148; uVar8 = 0; if ((((DAT_0 != 0) && ((_DAT_180111228 & 0x400000000000) != 0)) && ((DAT_1 & 0x400000000000) == DAT_1)) && (g_pTlmQueryStats != (void *)0x0)) { pRVar5 = (PSRWLOCK)&g_rwApiTelemetryLock; if (g_fVelocityDisableInternalExports == 0) { pRVar5 = (PSRWLOCK)&g_rwTelemetryLock; } AcquireSRWLockExclusive(pRVar5); piVar7 = (int *)((param_2 & 0xffffffff) * 0x120 + (longlong)g_pTlmQueryStats); uVar3 = UpdateDnsSeriesStatistics(param_1,piVar7); bVar10 = false; if ((int)uVar3 != 0) { piVar6 = piVar7 + 8; uVar4 = uVar8; do { if ((*piVar6 == param_3) || (*piVar6 == 0)) { piVar7[uVar4 + 8] = param_3; piVar7[uVar4 + 0x28] = piVar7[uVar4 + 0x28] + 1; bVar10 = true; break; } uVar2 = (int)uVar4 + 1; uVar4 = (ulonglong)uVar2; piVar6 = piVar6 + 1; bVar10 = false; } while (uVar2 < 0x20); } LOCK(); iVar1 = g_ulTlgFlushCounter + 1; UNLOCK(); uVar4 = DAT_1; uVar9 = uVar8; if ((!bVar10) || (bVar10 = g_ulTlgFlushCounter == 0x3ff, g_ulTlgFlushCounter = iVar1, bVar10)) { do { g_ulTlgFlushCounter = iVar1; - uVar2 = *(uint *)(uVar8 + (longlong)g_pTlmQueryStats); - if ((uVar2 != 0) && (5 < DAT_0)) { + if ((*(int *)(uVar8 + (longlong)g_pTlmQueryStats) != 0) && (5 < DAT_0)) { if (((_DAT_2 & 0x400000000000) == 0) || (bVar10 = true, (uVar4 & 0x400000000000) != uVar4)) { bVar10 = false; } if (bVar10) { local_c8 = &local_118; local_c0 = 4; local_110 = *(undefined8 *)(uVar8 + 0x10 + (longlong)g_pTlmQueryStats); local_b8 = &local_110; local_b0 = 8; local_108 = (ulonglong)*(uint *)(uVar8 + 4 + (longlong)g_pTlmQueryStats); local_a8 = &local_108; local_a0 = 8; local_100 = (ulonglong)*(uint *)(uVar8 + 8 + (longlong)g_pTlmQueryStats); local_98 = &local_100; local_f8 = g_liFrequency; local_88 = &local_f8; local_78 = &local_114; local_68 = (longlong)g_pTlmQueryStats + uVar8 + 0x20; local_90 = 8; local_58 = (longlong)g_pTlmQueryStats + uVar8 + 0xa0; local_80 = 8; local_48 = &local_f0; local_70 = 4; local_60 = 0x80; local_50 = 0x80; local_f0 = 0x1000000; local_40 = 8; - local_118 = uVar2; + local_118 = *(int *)(uVar8 + (longlong)g_pTlmQueryStats); local_114 = (int)uVar9; - _tlgWriteTransfer_EtwEventWriteTransfer - (uVar4,&DAT_3,(ulonglong)uVar2,param_4,0xb,local_e8); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180111218,&DAT_3,0,0,0xb,local_e8); uVar4 = DAT_1; } } uVar2 = (int)uVar9 + 1; uVar8 = uVar8 + 0x120; uVar9 = (ulonglong)uVar2; iVar1 = g_ulTlgFlushCounter; } while (uVar2 < 5); LOCK(); g_ulTlgFlushCounter = 0; UNLOCK(); memset(g_pTlmQueryStats,0,0x5a0); } pRVar5 = (PSRWLOCK)&g_rwApiTelemetryLock; if (g_fVelocityDisableInternalExports == 0) { pRVar5 = (PSRWLOCK)&g_rwTelemetryLock; } ReleaseSRWLockExclusive(pRVar5); } return; } ``` ## DnsCheckServerConfig ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.87| |i_ratio|0.74| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|DnsCheckServerConfig|DnsCheckServerConfig| |fullname|DnsCheckServerConfig|DnsCheckServerConfig| |refcount|2|2| |`length`|1382|1395| |called|
Expand for full list:
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount64
CopyServersFromAdapterToStats
DnsAddr_IsClear
DnsApiFree
DnsCompareAddrArraysPerFamily
GetIpAddressStringFromDnsAddrArray
IPHLPAPI.DLL::ConvertInterfaceIndexToLuid
IPHLPAPI.DLL::ConvertInterfaceLuidToGuid
McTemplateU0qq_EtwEventWriteTransfer
UploadAllDnsStatisticsIfNeeded
__security_check_cookie_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer
memset
|
Expand for full list:
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount64
CopyServersFromAdapterToStats
DnsAddr_IsClear
DnsApiFree
DnsCompareAddrArraysPerFamily
GetIpAddressStringFromDnsAddrArray
IPHLPAPI.DLL::ConvertInterfaceIndexToLuid
IPHLPAPI.DLL::ConvertInterfaceLuidToGuid
McTemplateU0qq_EtwEventWriteTransfer
UploadAllDnsStatisticsIfNeeded
__security_check_cookie_tlgCreate1Sz_wchar_t
_tlgWriteTransfer_EtwEventWriteTransfer
memset
| |calling|DnsTraceServerConfig|DnsTraceServerConfig| |paramcount|4|4| |`address`|18003db94|18003dba4| |`sig`|undefined __fastcall DnsCheckServerConfig(longlong param_1, undefined8 param_2, undefined8 param_3, GUID * param_4)|undefined __fastcall DnsCheckServerConfig(longlong param_1, undefined8 param_2, undefined8 param_3, short * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DnsCheckServerConfig Diff ```diff --- DnsCheckServerConfig +++ DnsCheckServerConfig @@ -1,274 +1,272 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void DnsCheckServerConfig(longlong param_1,undefined8 param_2,undefined8 param_3,GUID *param_4) +void DnsCheckServerConfig(longlong param_1,undefined8 param_2,undefined8 param_3,short *param_4) { longlong lVar1; undefined8 uVar2; bool bVar3; uint *_Dst; bool bVar4; NTSTATUS NVar5; int iVar6; ULONGLONG UVar7; undefined7 extraout_var; NET_LUID NVar8; NET_LUID NVar9; ulonglong uVar10; longlong lVar11; NET_LUID NVar12; uint *puVar13; uint uVar14; NET_LUID NVar15; NET_LUID NVar16; uint uVar17; ulonglong uVar18; - undefined8 uVar19; - uint uVar20; - ulonglong uVar21; + uint uVar19; + ulonglong uVar20; + NET_LUID NVar21; NET_LUID NVar22; - NET_LUID NVar23; - bool bVar24; + bool bVar23; undefined1 auStackY_958 [32]; uint local_928; uint local_924; uint local_920; uint local_918; NET_LUID local_8f8; NET_LUID local_8f0; GUID local_8e8; - undefined1 local_8d8 [32]; + undefined8 local_8d8 [4]; GUID *local_8b8; undefined8 local_8b0; NET_LUID *local_8a8; undefined8 local_8a0; longlong local_898 [2]; uint local_888 [16]; NET_LUID local_848 [258]; ulonglong local_38; _Dst = g_pTlmDnsStats; local_38 = __security_cookie ^ (ulonglong)auStackY_958; NVar9.Value = 0; local_918 = 0; local_928 = 0; bVar3 = false; NVar8.Value = (ULONG64)local_888; local_8e8.Data1 = 0; local_8e8.Data2 = 0; local_8e8.Data3 = 0; local_8e8.Data4[0] = '\0'; local_8e8.Data4[1] = '\0'; local_8e8.Data4[2] = '\0'; local_8e8.Data4[3] = '\0'; local_8e8.Data4[4] = '\0'; local_8e8.Data4[5] = '\0'; local_8e8.Data4[6] = '\0'; local_8e8.Data4[7] = '\0'; memset((void *)NVar8,0,0x40); local_924 = 0; local_8f0.Value = 0; local_848[0].Value._0_2_ = 0; if (_Dst != (uint *)0x0) { UVar7 = GetTickCount64(); - bVar24 = 3599999 < UVar7 - _g_ullServerConfigLastUpload; + bVar23 = 3599999 < UVar7 - _g_ullServerConfigLastUpload; NVar12.Value = NVar9.Value; NVar16.Value = NVar9.Value; + NVar21.Value = NVar9.Value; NVar22.Value = NVar9.Value; - NVar23.Value = NVar9.Value; - if (bVar24) { + if (bVar23) { _g_ullServerConfigLastUpload = GetTickCount64(); } while( true ) { - uVar19 = 1; uVar18 = 0; uVar14 = (uint)NVar9.Value; if ((*(uint *)(param_1 + 0x44) <= uVar14) || (0xf < (uint)NVar16.Value)) break; lVar11 = NVar9.Value * 0xa0; lVar1 = *(longlong *)(lVar11 + 0x90 + param_1); if (((lVar1 == 0) || (*(int *)(lVar1 + 4) == 0)) || - (uVar20 = *(uint *)(lVar11 + 0x98 + param_1), uVar20 == 0)) { + (uVar19 = *(uint *)(lVar11 + 0x98 + param_1), uVar19 == 0)) { NVar12.Value._4_4_ = 0; NVar12.Value._0_4_ = local_928; } else { while (local_920 = (uint)uVar18, local_920 < *_Dst) { NVar8.Value = uVar18 * 0xb088; - if (uVar20 == *(uint *)((longlong)(NVar8.Value + 8) + (longlong)_Dst)) goto LAB_0; + if (uVar19 == *(uint *)((longlong)(NVar8.Value + 8) + (longlong)_Dst)) goto LAB_0; uVar18 = (ulonglong)(local_920 + 1); } if (*_Dst < 0x10) { - _Dst[(ulonglong)*_Dst * 0x2c22 + 2] = uVar20; + _Dst[(ulonglong)*_Dst * 0x2c22 + 2] = uVar19; local_920 = *_Dst; uVar18 = (ulonglong)local_920; *_Dst = local_920 + 1; LAB_0: - uVar20 = *(uint *)(lVar11 + 0x98 + param_1); + uVar19 = *(uint *)(lVar11 + 0x98 + param_1); NVar8.Value._4_4_ = 0; - NVar8.Value._0_4_ = uVar20; + NVar8.Value._0_4_ = uVar19; local_8f8.Value = 0; local_8e8.Data1 = 0; local_8e8.Data2 = 0; local_8e8.Data3 = 0; local_8e8.Data4[0] = '\0'; local_8e8.Data4[1] = '\0'; local_8e8.Data4[2] = '\0'; local_8e8.Data4[3] = '\0'; local_8e8.Data4[4] = '\0'; local_8e8.Data4[5] = '\0'; local_8e8.Data4[6] = '\0'; local_8e8.Data4[7] = '\0'; - NVar5 = ConvertInterfaceIndexToLuid(uVar20,&local_8f8); + NVar5 = ConvertInterfaceIndexToLuid(uVar19,&local_8f8); if (NVar5 == 0) { NVar8.Value = (ULONG64)&local_8f8; NVar5 = ConvertInterfaceLuidToGuid((NET_LUID *)NVar8,&local_8e8); uVar10 = 0; if (NVar5 == 0) { - uVar20 = 0; + uVar19 = 0; local_8f8.Value = local_8f8.Value >> 0x30; NVar15._0_4_ = (uint)NVar16.Value + 1; lVar1 = *(longlong *)(lVar11 + 0x90 + param_1); local_888[NVar16.Value] = uVar14; if (lVar1 != 0) { - uVar17 = uVar20; + uVar17 = uVar19; if (*(int *)(lVar1 + 4) != 0) { - param_4 = (GUID *)(lVar1 + 0x20); + param_4 = (short *)(lVar1 + 0x20); uVar18 = uVar10; - uVar21 = uVar10; + uVar20 = uVar10; do { iVar6 = (int)uVar10; NVar9.Value = uVar10 * 0x40 + 0x20 + lVar1; bVar4 = DnsAddr_IsClear((short *)NVar9); if ((int)CONCAT71(extraout_var,bVar4) == 0) { - if ((short)param_4->Data1 == 2) { - uVar21 = 1; + if (*param_4 == 2) { + uVar20 = 1; } else { uVar18 = uVar18 & 0xffffffff; - if ((short)param_4->Data1 == 0x17) { + if (*param_4 == 0x17) { uVar18 = 1; } - if ((int)uVar21 == 0) goto LAB_1; + if ((int)uVar20 == 0) goto LAB_1; } - uVar20 = (uint)uVar21; + uVar19 = (uint)uVar20; uVar17 = (uint)uVar18; if (uVar17 != 0) break; } LAB_1: uVar17 = (uint)uVar18; - uVar20 = (uint)uVar21; + uVar19 = (uint)uVar20; uVar10 = (ulonglong)(iVar6 + 1U); - param_4 = param_4 + 4; + param_4 = param_4 + 0x20; } while (iVar6 + 1U < *(uint *)(lVar1 + 4)); uVar18 = (ulonglong)local_920; } - NVar23.Value._4_4_ = 0; - NVar23.Value._0_4_ = uVar20; NVar22.Value._4_4_ = 0; - NVar22.Value._0_4_ = uVar17; + NVar22.Value._0_4_ = uVar19; + NVar21.Value._4_4_ = 0; + NVar21.Value._0_4_ = uVar17; } - local_918 = local_918 | (uint)NVar22.Value; - local_928 = local_928 | (uint)NVar23.Value; - if (((uint)NVar23.Value != 0) || ((uint)NVar22.Value != 0)) { + local_918 = local_918 | (uint)NVar21.Value; + local_928 = local_928 | (uint)NVar22.Value; + if (((uint)NVar22.Value != 0) || ((uint)NVar21.Value != 0)) { puVar13 = _Dst + uVar18 * 0x2c22 + 2; if (((lVar1 == 0) || ((puVar13 == (uint *)0x0 || (iVar6 = DnsCompareAddrArraysPerFamily(lVar1,(longlong)puVar13,2), iVar6 == 0)) )) || (iVar6 = DnsCompareAddrArraysPerFamily(lVar1,(longlong)puVar13,0x17), iVar6 == 0)) { bVar3 = true; } else { bVar3 = false; } NVar9.Value = 1; - if (bVar24) { + if (bVar23) { local_848[0].Value._0_2_ = 0; GetIpAddressStringFromDnsAddrArray (lVar1,1,(STRSAFE_LPWSTR)&local_848[0].Value,param_4,&local_8f0); NVar9 = local_8f0; NVar8.Value = (ULONG64)local_848; if ((NET_LUID *)local_8f0.Value != (NET_LUID *)0x0) { NVar8 = local_8f0; } if (5 < DAT_2) { - uVar19 = 0x400000000000; if (((_DAT_3 & 0x400000000000) == 0) || ((DAT_4 & 0x400000000000) != DAT_4)) { bVar4 = false; } else { bVar4 = true; } if (bVar4) { local_8b8 = &local_8e8; local_8b0 = 0x10; local_8f0.Value = local_8f8.Value; local_8a8 = &local_8f0; local_8a0 = 8; _tlgCreate1Sz_wchar_t(local_898,(wchar_t *)NVar8); + param_4 = (short *)0x0; _tlgWriteTransfer_EtwEventWriteTransfer - (local_8d8,&DAT_5,uVar19,param_4,5,(undefined8 *)local_8d8); + (0x180111218,&DAT_5,0,0,5,local_8d8); } } DnsApiFree((void *)NVar9); local_8f0.Value = 0; } } NVar15.Value._4_4_ = 0; NVar8 = NVar9; NVar16 = NVar15; local_924 = NVar15._0_4_; } } NVar12.Value._4_4_ = 0; NVar12.Value._0_4_ = local_928; } else { NVar12.Value._4_4_ = 0; NVar12.Value._0_4_ = local_928; } } NVar9._0_4_ = uVar14 + 1; NVar9.Value._4_4_ = 0; } if (((int)NVar12.Value == 0) && (((byte)Microsoft_Windows_DNS_ClientEnableBits & 4) != 0)) { McTemplateU0qq_EtwEventWriteTransfer(NVar8,&DNS_NO_SERVER_CONFIG_V4); } if ((local_918 == 0) && (((byte)Microsoft_Windows_DNS_ClientEnableBits & 4) != 0)) { McTemplateU0qq_EtwEventWriteTransfer(NVar8,&DNS_NO_SERVER_CONFIG_V6); } if ((bVar3) && (((int)NVar12.Value != 0 || (local_918 != 0)))) { uVar2 = *(undefined8 *)(_Dst + 0x2c230); - iVar6 = UploadAllDnsStatisticsIfNeeded(1,_Dst,uVar19,param_4); + iVar6 = UploadAllDnsStatisticsIfNeeded(1,_Dst); if (iVar6 == 0) { memset(_Dst,0,0xb08c0); *(undefined8 *)(_Dst + 0x2c230) = uVar2; } if (local_924 != 0) { puVar13 = local_888; do { if (*(uint *)(param_1 + 0x44) <= *puVar13) break; lVar11 = (ulonglong)*puVar13 * 0xa0 + 0x68 + param_1; lVar1 = *(longlong *)(lVar11 + 0x28); if ((lVar1 != 0) && (*(int *)(lVar1 + 4) != 0)) { uVar14 = *_Dst; if (0xf < uVar14) break; *_Dst = uVar14 + 1; _Dst[(ulonglong)uVar14 * 0x2c22 + 2] = *(uint *)(lVar11 + 0x30); CopyServersFromAdapterToStats (lVar1,lVar11,(longlong)(_Dst + (ulonglong)uVar14 * 0x2c22 + 2)); } uVar14 = (int)uVar18 + 1; uVar18 = (ulonglong)uVar14; puVar13 = puVar13 + 1; } while (uVar14 < local_924); } } } DnsApiFree((void *)0x0); return; } ``` ## DnsRawTruncateMessageForUdp ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.25| |i_ratio|0.5| |m_ratio|0.9| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|DnsRawTruncateMessageForUdp|DnsRawTruncateMessageForUdp| |fullname|DnsRawTruncateMessageForUdp|DnsRawTruncateMessageForUdp| |refcount|2|2| |`length`|651|803| |`called`|
Expand for full list:
DnsRawFindOptRecord
Packet_SkipToRecord
WPP_SF_D
WPP_SF_Did
WPP_SF_Dlid
WPP_SF_dD
WPP_SF_di
WPP_SF_qDq
__security_check_cookie
memmove
memset
|
Expand for full list:
DnsRawFindOptRecord
Feature_2032384314__private_IsEnabledDeviceUsageNoInline
Packet_SkipToRecord
WPP_SF_D
WPP_SF_Did
WPP_SF_Dlid
WPP_SF_dD
WPP_SF_di
WPP_SF_qDq
__security_check_cookie
memmovememset
| |calling|DnsRawProcessMessageResponse|DnsRawProcessMessageResponse| |paramcount|3|3| |`address`|1800a42c4|1800a5c84| |`sig`|undefined4 __fastcall DnsRawTruncateMessageForUdp(byte * param_1, uint param_2, undefined4 * param_3)|undefined4 __fastcall DnsRawTruncateMessageForUdp(longlong param_1, uint param_2, undefined4 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DnsRawTruncateMessageForUdp Called Diff ```diff --- DnsRawTruncateMessageForUdp called +++ DnsRawTruncateMessageForUdp called @@ -1,0 +2 @@ +Feature_2032384314__private_IsEnabledDeviceUsageNoInline ``` ### DnsRawTruncateMessageForUdp Diff ```diff --- DnsRawTruncateMessageForUdp +++ DnsRawTruncateMessageForUdp @@ -1,99 +1,128 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -undefined4 DnsRawTruncateMessageForUdp(byte *param_1,uint param_2,undefined4 *param_3) +undefined4 DnsRawTruncateMessageForUdp(longlong param_1,uint param_2,undefined4 *param_3) { uint uVar1; - byte *_Dst; - byte *pbVar2; + ushort uVar2; undefined4 uVar3; byte *pbVar4; + undefined2 uVar5; + byte *_Dst; undefined1 auStackY_98 [32]; undefined8 in_stack_ffffffffffffff88; - ushort local_54 [2]; - void *local_50; - ulonglong local_48; + undefined2 local_54; + ushort local_50 [4]; + byte *local_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStackY_98; + local_40 = __security_cookie ^ (ulonglong)auStackY_98; uVar3 = 0; - local_50 = (void *)0x0; - local_54[0] = 0; + local_48 = (byte *)0x0; + uVar5 = 0; + local_50[0] = 0; + local_54 = 0; if ((DAT_0 & 8) != 0) { - WPP_SF_qDq(0x40b,0x14,0x1800f8a18,param_1, + WPP_SF_qDq(0x40b,0x14,0x1800f8e38,param_1, CONCAT44((int)((ulonglong)in_stack_ffffffffffffff88 >> 0x20),param_2),param_3); } if (param_3 != (undefined4 *)0x0) { *param_3 = 0; } - if ((param_1 != (byte *)0x0) && (param_3 != (undefined4 *)0x0)) { - if (((param_1[0x2be] & 2) == 0) && (*(ushort *)(param_1 + 0x2ba) <= param_2)) { - if ((DAT_0 & 8) == 0) { - return 0; + if ((param_1 == 0) || (param_3 == (undefined4 *)0x0)) { +LAB_1: + uVar3 = 0x57; + goto LAB_2; + } + if (((*(byte *)(param_1 + 0x2be) & 2) == 0) && (*(ushort *)(param_1 + 0x2ba) <= param_2)) { + if ((DAT_0 & 8) == 0) { + return 0; + } + WPP_SF_dD(0x40b,0x15,0x1800f8e38,*(byte *)(param_1 + 0x2be) >> 1 & 1); + goto LAB_2; + } + if ((*(longlong *)(param_1 + 0x250) - param_1) - 700U == (ulonglong)*(uint *)(param_1 + 0x248)) { + uVar1 = Feature_2032384314__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 == 0) { +LAB_3: + _Dst = Packet_SkipToRecord(param_1 + 700,*(byte **)(param_1 + 0x250),1); + if (_Dst == (byte *)0x0) goto LAB_1; + } + else { + uVar2 = *(ushort *)(param_1 + 0x2c0); + if (uVar2 != 0) { + if ((1 < uVar2) && ((DAT_0 & 8) != 0)) { + WPP_SF_D(0x40b,0x17,0x1800f8e38,(uint)uVar2); + } + uVar5 = 1; + goto LAB_3; } - WPP_SF_dD(0x40b,0x15,0x1800f8a18,param_1[0x2be] >> 1 & 1); - goto LAB_1; + _Dst = (byte *)(param_1 + 0x2c8); + uVar5 = 0; } - if (*(byte **)(param_1 + 0x250) + (-700 - (longlong)param_1) != - (byte *)(ulonglong)*(uint *)(param_1 + 0x248)) { + uVar1 = DnsRawFindOptRecord(param_1,&local_48,local_50); + if (uVar1 != 0) { + uVar1 = Feature_2032384314__private_IsEnabledDeviceUsageNoInline(); + if ((uVar1 != 0) && (local_48 < _Dst)) { + if ((DAT_0 & 8) == 0) { + return 0x251e; + } + uVar2 = 0x18; + goto LAB_4; + } + memmove(_Dst,local_48,(ulonglong)local_50[0]); + _Dst = _Dst + local_50[0]; + local_54 = 1; + } + pbVar4 = _Dst + (-700 - param_1); + if (pbVar4 < (byte *)0x10000) { + if ((byte *)(ulonglong)param_2 < pbVar4) { + uVar3 = 0x251e; + if ((DAT_0 & 8) == 0) { + return 0x251e; + } + WPP_SF_Dlid(); + } + else { + uVar3 = 0; + if ((DAT_0 & 8) != 0) { + WPP_SF_di((byte *)(ulonglong)param_2,0x1b,0x1800f8e38,(uint)*(ushort *)(param_1 + 0x2ba)); + } + *(short *)(param_1 + 0x2ba) = (short)pbVar4; + memset(_Dst,0,*(longlong *)(param_1 + 0x250) - (longlong)_Dst); + *(byte *)(param_1 + 0x2be) = *(byte *)(param_1 + 0x2be) | 2; + uVar1 = Feature_2032384314__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 == 0) { + uVar5 = 1; + } + *(undefined2 *)(param_1 + 0x2c0) = uVar5; + *(undefined4 *)(param_1 + 0x2c2) = 0; + *(undefined2 *)(param_1 + 0x2c6) = local_54; + *param_3 = 1; + } + } + else { uVar3 = 0x251e; if ((DAT_0 & 8) == 0) { return 0x251e; } - WPP_SF_D(0x40b,0x16,0x1800f8a18,0x251e); - goto LAB_1; - } - _Dst = Packet_SkipToRecord((longlong)(param_1 + 700),*(byte **)(param_1 + 0x250),1); - if (_Dst != (byte *)0x0) { - pbVar2 = param_1; - uVar1 = DnsRawFindOptRecord((longlong)param_1,&local_50,local_54); - if (uVar1 != 0) { - pbVar2 = _Dst; - memmove(_Dst,local_50,(ulonglong)local_54[0]); - _Dst = _Dst + local_54[0]; - } - pbVar4 = _Dst + (-700 - (longlong)param_1); - if (pbVar4 < (byte *)0x10000) { - if ((byte *)(ulonglong)param_2 < pbVar4) { - uVar3 = 0x251e; - if ((DAT_0 & 8) == 0) { - return 0x251e; - } - WPP_SF_Dlid(); - } - else { - uVar3 = 0; - if ((DAT_0 & 8) != 0) { - WPP_SF_di(pbVar2,0x19,0x1800f8a18,(uint)*(ushort *)(param_1 + 0x2ba)); - } - *(short *)(param_1 + 0x2ba) = (short)pbVar4; - memset(_Dst,0,*(longlong *)(param_1 + 0x250) - (longlong)_Dst); - param_1[0x2be] = param_1[0x2be] | 2; - *(ushort *)(param_1 + 0x2c6) = (ushort)(uVar1 != 0); - param_1[0x2c0] = 1; - param_1[0x2c1] = 0; - param_1[0x2c2] = 0; - param_1[0x2c3] = 0; - param_1[0x2c4] = 0; - param_1[0x2c5] = 0; - *param_3 = 1; - } - } - else { - uVar3 = 0x251e; - if ((DAT_0 & 8) == 0) { - return 0x251e; - } - WPP_SF_Did(); - } - goto LAB_1; + WPP_SF_Did(); } } - uVar3 = 0x57; -LAB_1: + else { + if ((DAT_0 & 8) == 0) { + return 0x251e; + } + uVar2 = 0x16; +LAB_4: + uVar3 = 0x251e; + WPP_SF_D(0x40b,uVar2,0x1800f8e38,0x251e); + } +LAB_2: if ((DAT_0 & 8) != 0) { - WPP_SF_D(0x40b,0x1a,0x1800f8a18,uVar3); + WPP_SF_D(0x40b,0x1c,0x1800f8e38,uVar3); } return uVar3; } ``` ## StringCchCatW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.13| |i_ratio|0.2| |m_ratio|0.9| |b_ratio|0.88| |match_types|Implied Match| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCatW|StringCchCatW| |fullname|StringCchCatW|StringCchCatW| |`refcount`|6|5| |`length`|205|159| |called||| |`calling`|Dns_ReadDwordEnvar
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal|wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|3|3| |`address`|180050688|1800a94f8| |`sig`|HRESULT __stdcall StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)|long __cdecl StringCchCatW(ushort * param_1, __uint64 param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### StringCchCatW Calling Diff ```diff --- StringCchCatW calling +++ StringCchCatW calling @@ -1 +0,0 @@ -Dns_ReadDwordEnvar ``` ### StringCchCatW Diff ```diff --- StringCchCatW +++ StringCchCatW @@ -1,53 +1,49 @@ -HRESULT __stdcall StringCchCatW(STRSAFE_LPWSTR pszDest,size_t cchDest,STRSAFE_LPCWSTR pszSrc) +/* long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * + __ptr64) */ + +long __cdecl StringCchCatW(ushort *param_1,__uint64 param_2,ushort *param_3) { - wchar_t wVar1; - STRSAFE_LPWSTR pwVar2; - longlong lVar3; - STRSAFE_LPWSTR pwVar4; - longlong lVar5; - uint uVar6; - ulonglong uVar7; - size_t sVar8; - longlong lVar9; + ushort uVar1; + uint uVar2; + ushort *puVar3; + longlong lVar4; + ushort *puVar5; + ulonglong uVar6; + longlong lVar7; + longlong lVar8; - pwVar2 = pszDest; - sVar8 = cchDest; - if (cchDest - 1 < 0x7fffffff) { - do { - if (*pwVar2 == L'\0') break; - sVar8 = sVar8 - 1; - pwVar2 = pwVar2 + 1; - } while (sVar8 != 0); - uVar6 = ~-(uint)(sVar8 != 0) & 0x80070057; - uVar7 = -(ulonglong)(sVar8 != 0) & cchDest - sVar8; - if (sVar8 != 0) { - pwVar2 = pszDest + uVar7; - lVar5 = cchDest - uVar7; - if (lVar5 != 0) { - lVar3 = (uVar7 - cchDest) + 0x7ffffffe + lVar5; - lVar9 = (longlong)pszSrc - (longlong)pwVar2; - do { - if ((lVar3 == 0) || (wVar1 = *(wchar_t *)(lVar9 + (longlong)pwVar2), wVar1 == L'\0')) - break; - *pwVar2 = wVar1; - lVar3 = lVar3 + -1; - pwVar2 = pwVar2 + 1; - lVar5 = lVar5 + -1; - } while (lVar5 != 0); - } - pwVar4 = pwVar2 + -1; - if (lVar5 != 0) { - pwVar4 = pwVar2; - } - uVar6 = ~-(uint)(lVar5 != 0) & 0x8007007a; - *pwVar4 = L'\0'; + lVar7 = 0x104; + puVar3 = param_1; + do { + if (*puVar3 == 0) break; + puVar3 = puVar3 + 1; + lVar7 = lVar7 + -1; + } while (lVar7 != 0); + uVar6 = -(ulonglong)(lVar7 != 0) & 0x104U - lVar7; + uVar2 = ~-(uint)(lVar7 != 0) & 0x80070057; + if (lVar7 != 0) { + puVar3 = param_1 + uVar6; + lVar7 = 0x104 - uVar6; + if (lVar7 != 0) { + lVar4 = 0x7ffffffe; + lVar8 = (longlong)param_3 - (longlong)puVar3; + do { + if ((lVar4 == 0) || (uVar1 = *(ushort *)(lVar8 + (longlong)puVar3), uVar1 == 0)) break; + *puVar3 = uVar1; + lVar4 = lVar4 + -1; + puVar3 = puVar3 + 1; + lVar7 = lVar7 + -1; + } while (lVar7 != 0); } + puVar5 = puVar3 + -1; + if (lVar7 != 0) { + puVar5 = puVar3; + } + *puVar5 = 0; + uVar2 = ~-(uint)(lVar7 != 0) & 0x8007007a; } - else { - uVar6 = 0x80070057; - } - return uVar6; + return uVar2; } ``` ## StringCchCopyA ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling,called| |ratio|0.33| |i_ratio|0.04| |m_ratio|0.7| |b_ratio|0.43| |match_types|Implied Match| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCopyA|StringCchCopyA| |fullname|StringCchCopyA|StringCchCopyA| |`refcount`|18|1| |`length`|49|90| |`called`|StringCopyWorkerA
StringValidateDestW|| |`calling`|AtmaRecordCopy
Dns_AllocateAndInitializeCredentialsA
Dns_KeyRecordFlagToString
HostsFile_OpenRESLIB
UpdateDnsQueryStatisticsFailureCounts
Wks_RecordBuildA
Wks_RecordBuildW
Wks_RecordRead
Wks_RecordRead_New
wil::details::GetModuleInformation|wil::details::GetModuleInformation| |paramcount|3|3| |`address`|18006b534|1800a95a0| |`sig`|HRESULT __stdcall StringCchCopyA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPCSTR pszSrc)|long __cdecl StringCchCopyA(char * param_1, __uint64 param_2, char * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### StringCchCopyA Called Diff ```diff --- StringCchCopyA called +++ StringCchCopyA called @@ -1,2 +0,0 @@ -StringCopyWorkerA -StringValidateDestW ``` ### StringCchCopyA Calling Diff ```diff --- StringCchCopyA calling +++ StringCchCopyA calling @@ -1,9 +0,0 @@ -AtmaRecordCopy -Dns_AllocateAndInitializeCredentialsA -Dns_KeyRecordFlagToString -HostsFile_OpenRESLIB -UpdateDnsQueryStatisticsFailureCounts -Wks_RecordBuildA -Wks_RecordBuildW -Wks_RecordRead -Wks_RecordRead_New ``` ### StringCchCopyA Diff ```diff --- StringCchCopyA +++ StringCchCopyA @@ -1,19 +1,32 @@ -HRESULT __stdcall StringCchCopyA(STRSAFE_LPSTR pszDest,size_t cchDest,STRSAFE_LPCSTR pszSrc) +/* long __cdecl StringCchCopyA(char * __ptr64,unsigned __int64,char const * __ptr64) */ + +long __cdecl StringCchCopyA(char *param_1,__uint64 param_2,char *param_3) { - HRESULT HVar1; - size_t in_stack_ffffffffffffffe8; + char *pcVar1; + longlong lVar2; + longlong lVar3; - HVar1 = StringValidateDestW((STRSAFE_PCNZWCH)pszDest,cchDest,(size_t)pszSrc); - if (HVar1 < 0) { - if (cchDest != 0) { - *pszDest = '\0'; + if (0x7ffffffe < param_2 - 1) { + if (param_2 != 0) { + *param_1 = '\0'; } + return -0x7ff8ffa9; } - else { - HVar1 = StringCopyWorkerA(pszDest,cchDest,(size_t *)pszSrc,pszSrc,in_stack_ffffffffffffffe8); + lVar3 = 0x7ffffffe - param_2; + lVar2 = (longlong)param_3 - (longlong)param_1; + do { + if ((lVar3 + param_2 == 0) || (param_1[lVar2] == '\0')) break; + *param_1 = param_1[lVar2]; + param_1 = param_1 + 1; + param_2 = param_2 - 1; + } while (param_2 != 0); + pcVar1 = param_1 + -1; + if (param_2 != 0) { + pcVar1 = param_1; } - return HVar1; + *pcVar1 = '\0'; + return ~-(uint)(param_2 != 0) & 0x8007007a; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## StringCchCopyW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCopyW|StringCchCopyW| |fullname|StringCchCopyW|StringCchCopyW| |`refcount`|3|5| |length|102|102| |called||| |`calling`|AddDnssdRegEntry
DnsConnectionManager::WriteConnectionPolicyRule
Dns_RegisterLocal|AddDnssdRegEntry
DnsConnectionManager::WriteConnectionPolicyRule
Dns_RegisterLocal
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|3|3| |`address`|1800154b0|1800154c0| |sig|long __cdecl StringCchCopyW(ushort * param_1, __uint64 param_2, ushort * param_3)|long __cdecl StringCchCopyW(ushort * param_1, __uint64 param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchCopyW Calling Diff ```diff --- StringCchCopyW calling +++ StringCchCopyW calling @@ -3,0 +4,2 @@ +wil::details_abi::SemaphoreValue::CreateFromValueInternal +wil::details_abi::SemaphoreValue::TryGetValueInternal ``` ## StringCchPrintfW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|2|4| |length|142|142| |called|__security_check_cookie
_vsnwprintf_s|__security_check_cookie
_vsnwprintf_s| |`calling`|RecordsFromServiceInstance|RecordsFromServiceInstance
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3|3| |`address`|18006756c|18006753c| |sig|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -1,0 +2,2 @@ +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::Acquire ``` ## API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|GetProcAddress|GetProcAddress| |fullname|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress| |`refcount`|8|7| |length|0|0| |called||| |calling|IsSKUDirectAccessEnabled
MicrosoftTelemetryAssertTriggeredNoArgs
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress|IsSKUDirectAccessEnabled
MicrosoftTelemetryAssertTriggeredNoArgs
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress| |paramcount|2|2| |`address`|EXTERNAL:00000044|EXTERNAL:00000048| |sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## __GSHandlerCheck ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|617|615| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|1800cb104|1800cb3f4| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|GetModuleHandleW|GetModuleHandleW| |fullname|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW| |`refcount`|7|6| |length|0|0| |called||| |`calling`|InitializeTracePrivate
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress
wil_details_GetNtDllModuleHandle
wil_details_GetNtDllProcedureAddress|InitializeTracePrivate
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress
wil_details_GetNtDllModuleHandle| |paramcount|1|1| |`address`|EXTERNAL:00000047|EXTERNAL:00000044| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW Calling Diff ```diff --- API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW calling +++ API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW calling @@ -6 +5,0 @@ -wil_details_GetNtDllProcedureAddress ``` ## __security_check_cookie ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|1106|1104| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
::
::
AdapterInfo_CreateMulticastAddrs
AdapterInfo_GetStaticDnsServerConfig
AdapterInfo_UpdateDnsInterfaceConfig
AdapterInfo_UpdateNetworkSignature
AdaptiveTimeout_GetInterfaceSpecificTimeouts
AddAddressToAdapter
AddDhcpConfiguration
AddDhcpv6ConfigurationArray
AddDnsConfigurationAddDnsGlobalsToAdapter
AddDnsServerAddressesToAdapter
AddQMIPSECPolicy
AddSecureSocketOptions
AsyncResolverQueryRPC
Atma_RecordBuildA
Atma_RecordBuildW
AutoTokenImpersonate::Impersonate
BreakRecordsIntoBlob
BrowseContext::InvokeCallback
BuildAdapterInfo
BuildAdapterSearchList
BuildHostfileRecords
BuildServerArrayAndList
CWxRefMap::Find
CWxRefMap::Insert
CWxRefMap::Find
CWxRefMap::Find
CWxRefMap::Insert
CWxRefMap::Find
CWxRefMap::Find
CWxRefMap::Delete
CWxRefMap::Find
CWxRefMap::Insert
CWxRpcBinding::Initialize
CWxRpcBinding::~CWxRpcBinding
CWxSelectableConnectionsEx::AcquireEx
CWxSelectableConnectionsEx::AcquireInternal
CWxString::Format
CWxString::Set
CWxString::Set
CallbackContext::buildServiceInstance
CheckHostnameIpLiteral
CheckNrptRules
CombinedQueryEx
ComputeIfIndex
Config_GetDnsServerList
Config_GetDnsServerListIp4
ConnectionAppIdPolicyNode::DeletePolicyNodes
ConnectionAppIdPolicyNode::MatchHostPolicyRule
ConnectionAppIdPolicyNode::UpdateAppIdHostPolicyRules
ConnectionAppIdPolicyNode::~ConnectionAppIdPolicyNode
ConnectionHostPolicyNode::CreateInstance
ConnectionHostPolicyNode::Initialize
ConnectionHostPolicyNode::MatchWithSuffixRules
ConnectionHostPolicyNode::SetSuffixMatchingRules
ConnectionPolicyMap::AddPolicyRule
ConnectionPolicyMap::MatchPolicyRule
ConvertCustomServers
ConvertCustomServersOld
ConvertInterfaceIndexToGuid
ConvertZtTrustedServersToCustomServers
CopyServersFromAdapterToStats
CopyZtTrustedServerToInternalProperty
CreateCustomNetInfo
CreateIpAdaptersInfoList
CreatePersistedRegistryKeyHelper
CreateZtTrustedServerAddrArray
DNSETW_TRACE_SERVER_CONFIG
DNS_RPC_HANDLE_bind
DNS_RPC_HANDLE_unbind
DdrCleanupCallback
DdrCleanupTree
DdrCleanupTreeList
DdrCreateDohServerSettings
DdrCreateDotServerSettings
DdrCreateNetInfo
DdrExtractEncryptionSettings
DdrGetNode
DdrQueryAndVerifyServerCertChainContext
DdrQueryCallback
DdrQueueMapForDeletion
DdrRenewCallback
DdrRenewTimerCallback
DdrSendAndRecv
DdrServerNode::AttachDdrContext
DdrServerNode::CreateInstance
DdrServerNode::GetDdrInfo
DdrServerNode::RenewTimerCallback
DdrServerNode::UpdateNode
DdrServerNode::UpdateNodeInternal
DdrSkipCertVerification
DdrSvcbGetDotHostname
DdrUpdateAdapter
DdrVerifyServerCertChainContext
DeRefTcpConnection
DnrParseInstanceV4
DnrParseInstanceV6
DnrRequestAndParseOptionV4Old
DnrRequestAndParseOptionV6Old
DnsAddUdpSocketToCache
DnsAddWinhttpSession
DnsAddrArray_AddAddrFromDnsRecord
DnsAddrArray_AddIp4
DnsAddrArray_AddSockaddr
DnsAddr_BuildFromDnsRecord
DnsAddr_BuildFromIp4
DnsAddr_BuildMcast
DnsBuildDotHostInternal
DnsCheckCallingProcess
DnsCheckServerConfig
DnsCleanupDdrSync
DnsConnectionDeletePolicyEntries
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::GetConnectionIfIndexes
DnsConnectionInterfaceIndexTable::GetConnectionNameForIfIndex
DnsConnectionInterfaceIndexTable::UpdateConnectionIfIndexes
DnsConnectionManager::AddDnsPolicyConfigurationEntry
DnsConnectionManager::ConnectionDeletePolicyEntries
DnsConnectionManager::ConnectionDeletePolicyEntriesRegistry
DnsConnectionManager::ConnectionSetPolicyEntries
DnsConnectionManager::ConnectionSetPolicyEntriesRegistry
DnsConnectionManager::ConnectionUpdateIfIndexTable
DnsConnectionManager::DeleteConnectionIfIndexTable
DnsConnectionManager::GetConnectionConfigForUrl
DnsConnectionManager::GetConnectionHandleForUrl
DnsConnectionManager::GetConnectionIfIndexes
DnsConnectionManager::GetConnectionNameForIfIndex
DnsConnectionManager::Initialize
DnsConnectionManager::ReadConnectionIfIndexTable
DnsConnectionManager::ReadConnectionPolicyRule
DnsConnectionManager::ReadConnectionPolicyRules
DnsConnectionManager::WriteConnectionIfIndexTable
DnsConnectionManager::WriteConnectionPolicyRule
DnsConnectionSetPolicyEntries
DnsConvertInternalProperties
DnsCreateDohUrl
DnsDeRegisterLocalRpc
DnsDeleteSettings
DnsDeleteWellKnownServerProperty
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInitEx
DnsDisableIdnEncoding
DnsDoSecureUpdate
DnsDoSecureUpdateHelper
DnsEtwTraceCacheLookupExit
DnsEtwTraceHttpStatusSecureFailure
DnsEtwTraceNetBiosQueryComplete
DnsEtwTraceNetBiosQueryStart
DnsEtwTraceNetworkQuery
DnsEtwTraceQueryExComplete
DnsEtwTraceQueryResponse
DnsEtwTraceSendQueryToDnsServer
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_W
DnsFree
DnsGetAdaptersInfo
DnsGetCacheDataTableEx
DnsGetCacheRecords
DnsGetConfigRpc
DnsGetDdrInfoCallbackV1
DnsGetDdrInfoCallbackV2
DnsGetDdrInfoInternal
DnsGetDdrInfoPrivate
DnsGetDdrInfoPrivateV1
DnsGetDdrInfoPrivateV2
DnsGetDdrInfoRpc
DnsGetDdrInfoSendQuery
DnsGetDhcpServerPropertiesImpl
DnsGetDnrServerProperties
DnsGetDnrServerPropertiesOld
DnsGetInterfaceSettings
DnsGetInterfaceSettingsInProc
DnsGetInterfaceSettingsInProcImpl
DnsGetMulticastDataRPC
DnsGetNetinfoProperties
DnsGetNetworkServers
DnsGetNrptRule
DnsGetNrptRuleNamesList
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPolicyTableInfoRpc
DnsGetProxyInfoPrivate
DnsGetProxyInformationEx
DnsGetProxyInformationRpc
DnsGetQueryRetryTimeouts
DnsGetQueryRetryTimeoutsRegistryHandle
DnsGetSettings
DnsGetSharedWinhttpSession
DnsGetSvcbData
DnsGetTcpipLegacyServerProperties
DnsGetUdpSocketFromCache
DnsGetWellKnownServerProperty
DnsGetWellKnownServers
DnsGetWinhttpSession
DnsGetZtClientCertConfig
DnsGetZtConfig
DnsGetZtFilterIds
DnsGetZtRules
DnsGetZtSettings
DnsGetZtTrustedCa
DnsGetZtTrustedServers
DnsInitWinsock
DnsIsZtEnabled
DnsLogEvent
DnsNbt_CheckAndConvertName
DnsNbt_CreateReverseRecords
DnsNbt_Open
DnsNbt_ResolveAddr
DnsNbt_ResolveName
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsParseUnknownRecords
DnsPinModule
DnsPrint_Message
DnsPrint_NetworkInfo
DnsPrint_PacketName
DnsPrint_PacketRecord
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigAllocExOld
DnsQueryDdrMap
DnsQueryEx
DnsQueryRaw
DnsQuery_W
DnsRawExtractQueryInfo
DnsRawParseRawQuery
DnsRawProcessMessageResponse
DnsRawTruncateMessageForUdp
DnsRegisterLocalRpc
DnsRemoveNrptRule
DnsResetQueryRetryTimeouts
DnsResolverOp
DnsResolverQueryHvsi
DnsScreenLocalAddrsForRegistration
DnsSd_SplitServiceName
DnsSendAndRecvSync
DnsSendSecureUpdate
DnsServiceBrowse
DnsServiceRegister
DnsSetConfigDword
DnsSetInterfaceSettings
DnsSetNrptRule
DnsSetNrptRulesRpc
DnsSetQueryRetryTimeouts
DnsSetSettings
DnsSetWellKnownServerProperty
DnsSetZtSettings
DnsSocketClosingCb
DnsSplitDotHostInternal
DnsSplitServiceName
DnsStartMulticastQueryImpl
DnsStartMulticastQueryRpc
DnsStopMulticastQuery
DnsStopMulticastQueryRpc
DnsTraceCheckRecordSet
DnsTraceQueryTimeout
DnsUpdateMachinePresence
DnsUpdateTest_W
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateServerArray_A
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsWinhttpCreateSession
DnsWinhttpSessionNode::CreateInstance
DnsZtHelperGetSettings
DnsZtHelperProcessClientCerts
DnsZtHelperPromoteConfig
DnsZtNotifyDnscache
DnsZtRequireTrustedServers
DnsZtVerifyServerRootCa
Dns_AcquireCredHandle
Dns_CacheServiceInitEx
Dns_CheckNrptRuleIntegrity
Dns_CopyAndCanonicalizeWireName
Dns_CreatePtrTypeRecord
Dns_CreateRecordForIpString_W
Dns_CreateSocketEx
Dns_CreateStandardDnsNameCopy
Dns_DeRegisterLocal
Dns_DowncaseNameLabel
Dns_ExtractRecordsFromBuffer
Dns_ExtractRecordsFromMessageEx
Dns_FindOrCreateSecurityContext
Dns_GenerateNsecTypeBitMaps
Dns_GetApplicationIdentifier
Dns_GetNetinfoProperties
Dns_InitClientSecurityContext
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeSecurityPackage
Dns_Ip4ReverseNameToAddress_W
Dns_Ip4StringToAddress_A
Dns_Ip4StringToAddress_W
Dns_Ip6AddressToReverseName_W
Dns_Ip6LiteralNameToAddress
Dns_Ip6ReverseNameToAddress_W
Dns_Ip6StringToAddressEx_A
Dns_Ip6StringToAddress_A
Dns_Ip6StringToAddress_W
Dns_IsCallerDns
Dns_IsMicrosoftDnsServer
Dns_IsNetworkSignatureInvalid
Dns_IsServer
Dns_MakeCanonicalNameInPlaceW
Dns_NameCompareEx
Dns_NameCompare_A
Dns_NameCompare_UTF8
Dns_NegotiateTkeyWithServer
Dns_OpenTcpConnectionAndSend
Dns_ParseSigTime
Dns_ParseSigTimeW
Dns_PrioritizeSingleRecordSet
Dns_ReadNrptRuleFromRegistry
Dns_RecordListBuildCombinedAAAAInPlace
Dns_RecordListConvertAToAAAA
Dns_RecordListCopyEx
Dns_RecordListScreenEx
Dns_RecordTypeForNameA
Dns_RecordTypeForNameW
Dns_RecvTcp
Dns_RecvTcpAsync
Dns_RegisterLocal
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SendServiceControl
Dns_SigTimeString
Dns_SignMessageWithGssTsig
Dns_SprintfPointerA
Dns_SprintfPointerW
Dns_StringCopyAllocate
Dns_StringToAddressEx
Dns_StringToDnsAddrEx
Dns_StringToGuid
Dns_Utf8ToOrFromAnsi
Dns_Utf8ToOrFromAnsi_New
Dns_ValidateName_W
Dns_VerifySignatureOnPacket
Dns_WriteNrptRuleToRegistry
Dns_WriteStringToPacket
DoEKUCheck
DohContextHandleHeadersAvailableCallback
DohContextHandleSendingRequestCallback
DohContextPrepare
DohCreateWinhttpStaticResolverCacheEntry
DotCacheCleanupIdleConnections
DotCacheGetConnection
DotCleanupWork::AddConnection
DotCleanupWork::CleanupCallback
DotConnectionCreate
DotConnectionDeRef
DotConnectionGetHttpCompatServer
DotConnectionHandleReceivedMessage
DotConnectionMap::RemoveIdleConnections
DotConnectionNode::CreateInstance
DotConnectionNode::FindAvailableConnection
DotConnectionPostReceive
DotConnectionPrepareRequest
DotCreateWinhttpStaticResolverCacheEntry
DotHandleCompleteUpgradeCallback
DotHandleUpgradeSendingCallback
DynDnsAddEntry
DynDnsAddForwardDhcid
DynDnsDeleteEntry
DynDnsDeleteForwardEntryDhcid
FastWppCallbackDnsapi
FastWppInit
FastWppTraceMessage
Faz_AreServerListsInSameNameSpace
Faz_CollapseDnsServerListsForUpdate
Faz_CompareTwoAdaptersForSameNameSpace
Faz_GetNameServersListForDomain
Faz_PrivateEx
Faz_ValidateSingleLabelZone
FillAdapterInfo
FindWellKnownDohProperty
FindWellKnownDotProperty
FixNetworkInfoForConnectionPolicy
FlushResolverCacheEntryNarrow
GetAppContainerSidFromToken
GetBestInterfaceIndex
GetCertConfig
GetCustomServersFromSettings
GetDevolutionLevelFromForestName
GetDnsRpcBindingHandleRef
GetDnsRulePolicyConfig
GetDnsServerRRSet
GetDnsServersString
GetFilteredIpAddressStringFromDnsAddrArray
GetNextQueryName
GetRADnsSettingsImpl
GetRADnsSettingsImplOld
GetRegistryBinaryBlob
GetRegistryDword
GetRegistryMultiString
GetRegistryString
GetTunnelPhysicalAdapter
GetTunnelPhysicalIpAdapter
GetWellKnownServers
GetXboxProductType
GetZtHelperRpcBindingHandleRef
HostsFile_OpenRESLIB
HostsFile_Query
Idn_IsMappable
Idn_IsPunycode
Idn_MapUnicode
Idn_PunycodeToUnicode
Idn_UnicodeToPunycode
InitializeTracePrivate
IpHelp_GetAdaptersAddresses
IpHelp_GetZtProbeAddrsAndProperties
IpHelp_GetZtdnsAddrsAndProperties
IpHelp_IsAddrOnLinkEx
IpHelp_IsReachableInterfaceOnSameLink
IpHelp_IsRouteExists
IpHelp_ReadAddrsAndPropertiesFromListImpl
IpHelp_ReadAddrsFromList
Ip_RegisterNotification
Ipv6AddressScope
IsCallerAllowedToTriggerVPN
IsDhcpRACoexistenceEnabled
IsInterfaceConnected
IsInterfaceVirtual
IsSKUDirectAccessEnabled
IsServiceNameLocal
KeyRecordPrint
LoadAutoDohTemplate
LoadAutoDotHost
LookUpTableFlushComplete
MDns_IncrementName
MakeCredKey
MakeKerberosName
MatchCertificateEKU
McTemplateU0qbr0_EtwEventWriteTransfer
McTemplateU0qq_EtwEventWriteTransfer
McTemplateU0qqq_EventWriteTransfer
McTemplateU0z_EtwEventWriteTransfer
McTemplateU0zq_EtwEventWriteTransfer
McTemplateU0zqbr1q_EtwEventWriteTransfer
McTemplateU0zqbr1qbr3qpp_EtwEventWriteTransfer
McTemplateU0zqbr1qpp_EtwEventWriteTransfer
McTemplateU0zqp_EtwEventWriteTransfer
McTemplateU0zqqqqp_EtwEventWriteTransfer
McTemplateU0zqqqzqqqz_EtwEventWriteTransfer
McTemplateU0zqqzzqp_EtwEventWriteTransfer
McTemplateU0zqzqp_EtwEventWriteTransfer
McTemplateU0zzq_EtwEventWriteTransfer
McTemplateU0zzqbr2qpp_EtwEventWriteTransfer
McTemplateU0zzqqqzqzzqqp_EtwEventWriteTransfer
McTemplateU0zzzx_EtwEventWriteTransfer
McTemplateU0zzzzq_EtwEventWriteTransfer
McastRegisterContext::InvokeCallback
Minfo_RecordRead
Minfo_RecordRead_New
Mx_RecordRead
Mx_RecordRead_New
NRPTLookupDdrServerProperty
Naptr_RecordRead
Naptr_RecordRead_New
NetInfo_BuildEx
NetInfo_BuildEx2
NetInfo_CloneForMulticast
NetInfo_CreateFromZtTrustedServers
NetInfo_CreateLocalAddrArray
NetInfo_CreateNRPTCopy
NetInfo_CreatePerNetworkNetinfo
NetInfo_FindEncryptedSettings
NetInfo_FindPropertyForServer
NetInfo_FindPropertyOnAllAdapters
NetInfo_FindPropertyOnBestAdapter
NetInfo_Get
NetInfo_GetLocalAddrArray
NetInfo_NRPTLookupServerProperties
NetworkQuery_BuildNetworkQueryBlob
NetworkQuery_HandleAllServerTimeout
Nsec3RecordPrint
Nsec_RecordRead
Nsec_RecordRead_New
OpenAdapterDhcpPersistedKey
OpenRegistryPaths
Packet_GetRandomXid
Packet_ParseMessage
Packet_ReadPacketNameAllocate
Packet_WriteDottedNameToPacket
PrepareWinhttpRequestCommon
Ptr_RecordRead
Ptr_RecordRead_New
QueryDirectEx
Query_BroadcastMulticastRequired
Query_BroadcastStart
Query_BypassLearningMode
Query_CacheEntry
Query_CheckPtrAddrOffLink
Query_GetPtrDnsAddr
Query_InProcPrepare
Query_InProcess
Query_IsNetBiosRequired
Query_LearningModeTimerCallback
Query_Main
Query_MatchAndGetlocalMachineRecord
Query_Multicast
Query_MulticastStart
Query_NetBios
Query_NextName
Query_Private
Query_PrivateExW
Query_PrivateOld
Query_ProcessQuery
Query_ProcessResponse
Query_ProcessResult
Query_Shim
ReadDaMultisiteKey
ReadDnsPolicyConfigInformation
ReadDnsPolicyTableConfigInfo
ReadRegIpAdapterInfo
RecordsFromServiceInstance
Recv_ProcessUdpResponse
Recv_Udp
Recv_UdpCallbackCompletion
Recv_UpdateControlInfo
Reg_CreateKey
Reg_GetDword
Reg_GetFullHostName
Reg_GetHostName
Reg_GetValueEx2
Reg_Init
Reg_OpenSession
Reg_ReadAdapterInfo
Reg_ReadAndValidateQueryTimeouts
Reg_ReadGlobalInfo
Reg_ReadGlobalsEx
Reg_ReadIpAdapterInfoEx
Reg_ReadPrimaryDomainName
Reg_ReadUpdateInfo
ReleaseAndRebindDnsRpcGlobalBindingHandle
ReleaseAndRebindZtHelperRpcGlobalBindingHandle
ReleaseStaleGlobalRpcBindingHandle
ReleaseStaleZtHelperGlobalRpcBindingHandle
ReleaseZtHelperGlobalRpcBindingHandle
ResolveContext::StartDnsQueries
ResolverZtGetClientAuthCertContext
ResolverZtGetTrustedServers
Rpc_ProcessQueryResult
Rpc_QueryComplete
Rpc_ResolverQuery
Rpc_RetryQuery
SaveDnsRecords
SearchList_BuildFromRegistry
SendDohQueryToNetinfoServers
SendDotQueryToNetinfoServers
SendQueryToDdrServer
SendSecureQueryToServer
SendUdpMessagePrivate
Send_AndRecvComplete
Send_AndRecvDohAsync
Send_AndRecvInitialize
Send_AndRecvTcp
Send_AndRecvUdp
Send_CleanupCompletedDdrList
Send_CleanupDdrList
Send_FallbackToInsecureRequired
Send_PrepareWinhttpSession
Send_ProcessDohBlobStatus
Send_ProcessDotBlobStatus
Send_QueryToDdrServers
ShimDnsQueryEx
Sig_RecordRead
Sig_RecordRead_New
Soa_RecordRead
Soa_RecordRead_New
Socket_Bind
Socket_CreateEx
Socket_CreateMessageSocket
Socket_JoinMulticast
Socket_PrepareAsyncMessage
Socket_RecvFrom
Socket_SetInterfaceIndexSocketOption
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
SortDnsAddrArray
Srv_RecordRead
Srv_RecordRead_New
StartDnsServiceOnDemand
StringCbPrintfA
StringCbPrintfW
StringCchPrintfA
StringCchPrintfExW
StringCchPrintfW
StringCchPrintfW
SyncResolverQueryRpc
TcpConnectionConnect
TcpIoCompletionCb
ThreadPool_CreateTimer
Threadpool_SetTimer
TraceLoggingRegisterEx_EventRegister_EventSetInformation
Trace_LogQueryDuration
Trace_LogQueryDurationFromStart
Trace_LogQueryEvent
Trace_LogRecvEvent
Trace_LogResponseEvent
Trace_LogSendEvent
Trace_ServerResponse
Txt_RecordRead
UpdateDnsConfig
Update_FazSendFlush
Update_MultiMaster
Update_Private
Update_Send
UploadAllDnsStatistics
UploadFailuresDnsStatistics
UploadQueryStatistics
UploadServerDnsStatistics
ValidateCustomServers
WPP_SF_D
WPP_SF_DDD
WPP_SF_DDDq
WPP_SF_DDS
WPP_SF_DDSD
WPP_SF_DDSDS
WPP_SF_DDd
WPP_SF_DDdd
WPP_SF_DDiiDDi
WPP_SF_DDiq
WPP_SF_DDlq
WPP_SF_DH
WPP_SF_DID
WPP_SF_DL
WPP_SF_DPq
WPP_SF_DS
WPP_SF_DSD
WPP_SF_DSS
WPP_SF_DSq
WPP_SF_D_HEX_
WPP_SF_D_SOCKADDR_
WPP_SF_D_SOCKADDR_Sq
WPP_SF_DdL
WPP_SF_DddS
WPP_SF_Dddl
WPP_SF_Ddl
WPP_SF_Ddq
WPP_SF_Ddqdqqd
WPP_SF_Ddqdqqdq
WPP_SF_Ddqqd
WPP_SF_Di
WPP_SF_Did
WPP_SF_DlD
WPP_SF_Dld
WPP_SF_Dlid
WPP_SF_Dll
WPP_SF_Dlq
WPP_SF_Dq
WPP_SF_DqDd
WPP_SF_Dq_SOCKADDR_D
WPP_SF_Dqd
WPP_SF_Dqdq
WPP_SF_Dqi
WPP_SF_Dql
WPP_SF_Dqq
WPP_SF_Dqqddq_COUNTEDSTRING__COUNTEDSTRINGW_ddd
WPP_SF_Dqqq
WPP_SF_Ds
WPP_SF_Dssdsd
WPP_SF_HHLsLsLLLLLLsHHHH
WPP_SF_I
WPP_SF_IDD
WPP_SF_IDDqDDDq
WPP_SF_LLd
WPP_SF_P
WPP_SF_PD
WPP_SF_PPP
WPP_SF_Pd
WPP_SF_Pd_SOCKADDR_D
WPP_SF_Pd_SOCKADDR_d
WPP_SF_Pdd
WPP_SF_Pdd_SOCKADDR_D
WPP_SF_Pddd
WPP_SF_Pdddd
WPP_SF_Pdqd
WPP_SF_Pdqdd
WPP_SF_Pl
WPP_SF_Pq
WPP_SF_Pql
WPP_SF_SDDDDdq
WPP_SF_SDDDqq
WPP_SF_SDdll_SOCKADDR_Slqq
WPP_SF_SDq
WPP_SF_SDqq
WPP_SF_SDqqqqq
WPP_SF_SIqdq
WPP_SF_SSSqd
WPP_SF_SSq
WPP_SF_SSqD
WPP_SF_SSqDl
WPP_SF_SSqq
WPP_SF_S_sid_q
WPP_SF_SdDq
WPP_SF_Sddq
WPP_SF_Sdidq
WPP_SF_Sdiqq
WPP_SF_Sdiqql
WPP_SF_Sdq
WPP_SF_Slq
WPP_SF_Sq
WPP_SF_Sqdd
WPP_SF_Sqq
WPP_SF_Sqqqq
WPP_SF_Sqqqqill
WPP_SF_Sqqqqq
WPP_SF_SsdDq
WPP_SF__COUNTEDSTRINGW_
WPP_SF__COUNTEDSTRINGW_d
WPP_SF__COUNTEDSTRINGW_dD
WPP_SF__COUNTEDSTRING_
WPP_SF__COUNTEDSTRING_d
WPP_SF__COUNTEDSTRING_dD
WPP_SF__COUNTEDSTRING_dd_COUNTEDSTRING_D
WPP_SF__COUNTEDSTRING_s
WPP_SF__HEX_
WPP_SF__IPV4_Sq
WPP_SF__SOCKADDR_dlqq
WPP_SF__SOCKADDR_dq
WPP_SF__SOCKADDR_dqD
WPP_SF__SOCKADDR_dqq
WPP_SF__SOCKADDR_q
WPP_SF__SOCKADDR_qD
WPP_SF__SOCKADDR_qP
WPP_SF__SOCKADDR_qdq
WPP_SF__SOCKADDR_qq
WPP_SF__guid_dq
WPP_SF_c
WPP_SF_cD_COUNTEDSTRING_
WPP_SF_cP
WPP_SF_dD
WPP_SF_dDD
WPP_SF_dDDSq
WPP_SF_dDSd
WPP_SF_dDdD
WPP_SF_dDdDdddddidqql_SOCKADDR_lS
WPP_SF_dDddDs
WPP_SF_dDq
WPP_SF_dI
WPP_SF_dP
WPP_SF_dPP
WPP_SF_dPq
WPP_SF_dS
WPP_SF_dSD
WPP_SF_dSDdD
WPP_SF_dSSDSdq
WPP_SF_dSSdD
WPP_SF_dSSdq
WPP_SF_dSd
WPP_SF_dSl
WPP_SF_dSl_sid__sid_dSd
WPP_SF_dSs
WPP_SF_d_IPV4_
WPP_SF_d_SOCKADDR_
WPP_SF_d_SOCKADDR_SS
WPP_SF_d_guid_
WPP_SF_ddS
WPP_SF_ddSSS
WPP_SF_ddSsSsSsSs
WPP_SF_dd_IPV4_
WPP_SF_dd_SOCKADDR_
WPP_SF_dd_SOCKADDR_dDD
WPP_SF_ddd
WPP_SF_dddDD_SOCKADDR_
WPP_SF_dddDD_SOCKADDR_d
WPP_SF_dddSs
WPP_SF_ddd_guid_
WPP_SF_ddddDD_SOCKADDR_ddDD
WPP_SF_ddddd
WPP_SF_dddddd
WPP_SF_ddddddD
WPP_SF_dddddddd
WPP_SF_dddddqdq
WPP_SF_dddqqPP
WPP_SF_ddl
WPP_SF_ddqd
WPP_SF_ddqq
WPP_SF_di
WPP_SF_diqdiqdiq
WPP_SF_dld
WPP_SF_dqDddd
WPP_SF_dqPqiqq
WPP_SF_dqdd
WPP_SF_dqdq
WPP_SF_dqdqDqd
WPP_SF_dqq
WPP_SF_dqql
WPP_SF_dqqq
WPP_SF_dqqqq
WPP_SF_dqqqqS
WPP_SF_dsdsd
WPP_SF_hdd
WPP_SF_id
WPP_SF_idd
WPP_SF_idddd
WPP_SF_ii
WPP_SF_il
WPP_SF_iq
WPP_SF_lDD
WPP_SF_lPP
WPP_SF_lS
WPP_SF_lSDD
WPP_SF_l_SOCKADDR_d
WPP_SF_ldD
WPP_SF_ldiilDl
WPP_SF_ldq
WPP_SF_liD
WPP_SF_liiDDl
WPP_SF_ll
WPP_SF_lld
WPP_SF_lldd
WPP_SF_lllD
WPP_SF_llll
WPP_SF_lllll
WPP_SF_llllll
WPP_SF_lq
WPP_SF_lqd
WPP_SF_lsDlll
WPP_SF_lsdqd
WPP_SF_qDDSD
WPP_SF_qDDq
WPP_SF_qDS
WPP_SF_qDSq
WPP_SF_qD_SOCKADDR_
WPP_SF_qDdq
WPP_SF_qDds
WPP_SF_qDl
WPP_SF_qDll
WPP_SF_qDllD
WPP_SF_qDlq
WPP_SF_qDq
WPP_SF_qDqDS
WPP_SF_qDqd
WPP_SF_qDqqq
WPP_SF_qDqqqd
WPP_SF_qL
WPP_SF_qPD
WPP_SF_qPddd
WPP_SF_qPdldqq
WPP_SF_qPq
WPP_SF_qPqdd
WPP_SF_qPqq
WPP_SF_qPqqDd
WPP_SF_qPqqdd
WPP_SF_qS
WPP_SF_qSD
WPP_SF_qSDd
WPP_SF_qSDlq
WPP_SF_qSDq
WPP_SF_qSS
WPP_SF_qSSD_SOCKADDR_d
WPP_SF_qSSS
WPP_SF_qSSSdDd
WPP_SF_qSSd
WPP_SF_qSSid
WPP_SF_qSSl
WPP_SF_qSSqD
WPP_SF_qSSqDq
WPP_SF_qSSqq
WPP_SF_qSd
WPP_SF_qSdD
WPP_SF_qSdDd
WPP_SF_qSdDiql_SOCKADDR_SlDiql_SOCKADDR_Sl
WPP_SF_qSdDql_SOCKADDR_Sl
WPP_SF_qSdDqll_SOCKADDR_Sl
WPP_SF_qSdddd
WPP_SF_qSdl
WPP_SF_qSdq
WPP_SF_qSiDllD
WPP_SF_qSq
WPP_SF_qSqD
WPP_SF_qSqDDSq
WPP_SF_qSqDSD
WPP_SF_qSqSqD
WPP_SF_qSqdD
WPP_SF_qSqqqD
WPP_SF_qSqqqq
WPP_SF_q_COUNTEDSTRING_d
WPP_SF_q_COUNTEDSTRING_dD
WPP_SF_q_COUNTEDSTRING_ddd
WPP_SF_q_IPV4_D
WPP_SF_q_IPV4_q
WPP_SF_q_IPV6_DD
WPP_SF_q_SOCKADDR_
WPP_SF_q_SOCKADDR_D
WPP_SF_q_SOCKADDR_d
WPP_SF_q_SOCKADDR_dd
WPP_SF_q_SOCKADDR_dl
WPP_SF_q_SOCKADDR_qq
WPP_SF_q_sid_SS
WPP_SF_qdD
WPP_SF_qdDD
WPP_SF_qdDd
WPP_SF_qdDll
WPP_SF_qdS
WPP_SF_qdSSSD
WPP_SF_qdSd
WPP_SF_qd_SOCKADDR_qq
WPP_SF_qd_SOCKADDR_qqq
WPP_SF_qdd
WPP_SF_qddl
WPP_SF_qddq
WPP_SF_qdi
WPP_SF_qdl
WPP_SF_qdlq
WPP_SF_qdq_COUNTEDSTRING_ddd
WPP_SF_qdqd
WPP_SF_qdqq
WPP_SF_qdqqld
WPP_SF_qdqqq
WPP_SF_qdqqqd
WPP_SF_qi
WPP_SF_qiddqqq
WPP_SF_qidqd
WPP_SF_qii
WPP_SF_ql
WPP_SF_qlDSSSqqqq
WPP_SF_qlDllqll_SOCKADDR_Slqq
WPP_SF_qlSSqqqq
WPP_SF_qlSlSD
WPP_SF_qlll
WPP_SF_qlllqqq
WPP_SF_qllq
WPP_SF_qllqq
WPP_SF_qlq
WPP_SF_qlqq
WPP_SF_qlsSdqild
WPP_SF_qq
WPP_SF_qqDddd
WPP_SF_qqDqSq
WPP_SF_qqDqq
WPP_SF_qqDqqD
WPP_SF_qqSdSdDq
WPP_SF_qqSssdDdddddd
WPP_SF_qqSssddDddddddddd
WPP_SF_qqd
WPP_SF_qqddDqq
WPP_SF_qqdddd
WPP_SF_qqdl
WPP_SF_qqdq
WPP_SF_qql
WPP_SF_qqlD
WPP_SF_qqlDqqqqq
WPP_SF_qqll
WPP_SF_qqlq
WPP_SF_qqq
WPP_SF_qqqDDd
WPP_SF_qqqDqqqd
WPP_SF_qqq_SOCKADDR_
WPP_SF_qqqd
WPP_SF_qqqddq
WPP_SF_qqqlsdqDqq
WPP_SF_qqqq
WPP_SF_qqqqSSSS
WPP_SF_qqqqdDl
WPP_SF_qqqqdddd
WPP_SF_qqqqdq
WPP_SF_qqqqq
WPP_SF_qqqqql
WPP_SF_qs
WPP_SF_qsD
WPP_SF_qsDi
WPP_SF_qsdddd
WPP_SF_qss
WPP_SF_qsss
WPP_SF_qsssssss
WPP_SF_sDqq
WPP_SF_sqSSSqqdDddDdDddd
WPP_SF_sqSSqdddDDddd
WPP_SF_sqd
WPP_SF_sqdd
WPP_SF_sqddd
WPP_SF_sql
WPP_SF_sqq
WPP_SF_sqqDdqqqqSSq
WPP_SF_sqq_SOCKADDR_ssdqqqqddddddd
WPP_SF_sqqd
WPP_SF_sqqq
WPP_SF_sqqsdqqdqdqd
WPP_SF_sqs
WPP_SF_ssqsPPP
Winsr_RecordRead
Winsr_RecordRead_New
Wks_RecordBuildA
Wks_RecordBuildW
WnfParams::StaticCallback
WxAlloc
WxAlloc
WxAlloc
WxAllocZero
WxConnectionDeleteProxyInfo
WxConnectionGetNameList
WxConnectionGetProxyInfo
WxConnectionGetProxyList
WxConnectionSetProxyInfo
WxGetAdaptersAddresses
WxGetFirstConnectedInterfaceFromConnectionsListEx
WxGetFirstConnectedInterfaceFromInterfaceList
WxGetModuleName
WxGetPersistedRegistryLocation
WxGetRegistryDword
WxGetRegistryString
WxGetTokenAppContainerSID
WxGetTokenIntegrityLevel
WxGetTokenSessionId
WxGetTokenUserSID
WxIsInterfaceConnected
WxIsProcessAppContainer
WxIsTokenAppContainer
WxOpenRegistryKey
ZtServersConfigured
ZtTrustedServerGetTemplate
_AdapterIsConnected
_CheckForDuplicateFriendlyName
_NormalizeConnectionName
_OpenProxyRegistryKey
_ProcessUserSIDInitOnceCallback
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
_tlgWriteTransfer_EtwEventWriteTransfer
buildUnmatchedRecordSet
buildUpdateNetworkInfoFromFAZ
checkForAnyOnLinkRecords
hostsFileGetLine
hostsFileLineToUnicode
hostsFileSniffBom
idnNrptDepunify
idnQueryDepunify
idnQueryWireFormat
idnValidateMapping
isServiceDisabled
local_GetLocalAddressRecord
local_GetLocalPtrRecord
modifyRecordsInSetPrivate
netinfo_StrikeOutUnreachableDnsServers
privateRegReadDwordValue
privateRegReadStringValueW
privateRegReadValue
replaceRecordSetPrivate
sendUdpToNextDnsServers
swprintf_s<256>
up_ReplaceAddressRecordsPrivate
wil::GetFailureLogString
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::GetModuleInformation
wil::details::LogStringPrintf
wil::details::MicrosoftInternalNotifyFailure
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
wistd::swap_wil
|
Expand for full list:
::
::
AdapterInfo_CreateMulticastAddrs
AdapterInfo_GetStaticDnsServerConfig
AdapterInfo_UpdateDnsInterfaceConfig
AdapterInfo_UpdateNetworkSignature
AdaptiveTimeout_GetInterfaceSpecificTimeouts
AddAddressToAdapter
AddDhcpConfiguration
AddDhcpv6ConfigurationArray
AddDnsConfigurationAddDnsGlobalsToAdapter
AddDnsServerAddressesToAdapter
AddQMIPSECPolicy
AddSecureSocketOptions
AsyncResolverQueryRPC
Atma_RecordBuildA
Atma_RecordBuildW
AutoTokenImpersonate::Impersonate
BreakRecordsIntoBlob
BrowseContext::InvokeCallback
BuildAdapterInfo
BuildAdapterSearchList
BuildHostfileRecords
BuildServerArrayAndList
CWxRefMap::Find
CWxRefMap::Insert
CWxRefMap::Find
CWxRefMap::Find
CWxRefMap::Insert
CWxRefMap::Find
CWxRefMap::Find
CWxRefMap::Delete
CWxRefMap::Find
CWxRefMap::Insert
CWxRpcBinding::Initialize
CWxRpcBinding::~CWxRpcBinding
CWxSelectableConnectionsEx::AcquireEx
CWxSelectableConnectionsEx::AcquireInternal
CWxString::Format
CWxString::Set
CWxString::Set
CallbackContext::buildServiceInstance
CheckHostnameIpLiteral
CheckNrptRules
CombinedQueryEx
ComputeIfIndex
Config_GetDnsServerList
Config_GetDnsServerListIp4
ConnectionAppIdPolicyNode::DeletePolicyNodes
ConnectionAppIdPolicyNode::MatchHostPolicyRule
ConnectionAppIdPolicyNode::UpdateAppIdHostPolicyRules
ConnectionAppIdPolicyNode::~ConnectionAppIdPolicyNode
ConnectionHostPolicyNode::CreateInstance
ConnectionHostPolicyNode::Initialize
ConnectionHostPolicyNode::MatchWithSuffixRules
ConnectionHostPolicyNode::SetSuffixMatchingRules
ConnectionPolicyMap::AddPolicyRule
ConnectionPolicyMap::MatchPolicyRule
ConvertCustomServers
ConvertCustomServersOld
ConvertInterfaceIndexToGuid
ConvertZtTrustedServersToCustomServers
CopyServersFromAdapterToStats
CopyZtTrustedServerToInternalProperty
CreateCustomNetInfo
CreateIpAdaptersInfoList
CreatePersistedRegistryKeyHelper
CreateZtTrustedServerAddrArray
DNSETW_TRACE_SERVER_CONFIG
DNS_RPC_HANDLE_bind
DNS_RPC_HANDLE_unbind
DdrCleanupCallback
DdrCleanupTree
DdrCleanupTreeList
DdrCreateDohServerSettings
DdrCreateDotServerSettings
DdrCreateNetInfo
DdrExtractEncryptionSettings
DdrGetNode
DdrQueryAndVerifyServerCertChainContext
DdrQueryCallback
DdrQueueMapForDeletion
DdrRenewCallback
DdrRenewTimerCallback
DdrSendAndRecv
DdrServerNode::AttachDdrContext
DdrServerNode::CreateInstance
DdrServerNode::GetDdrInfo
DdrServerNode::RenewTimerCallback
DdrServerNode::UpdateNode
DdrServerNode::UpdateNodeInternal
DdrSkipCertVerification
DdrSvcbGetDotHostname
DdrUpdateAdapter
DdrVerifyServerCertChainContext
DeRefTcpConnection
DnrParseInstanceV4
DnrParseInstanceV6
DnrRequestAndParseOptionV4Old
DnrRequestAndParseOptionV6Old
DnsAddUdpSocketToCache
DnsAddWinhttpSession
DnsAddrArray_AddAddrFromDnsRecord
DnsAddrArray_AddIp4
DnsAddrArray_AddSockaddr
DnsAddr_BuildFromDnsRecord
DnsAddr_BuildFromIp4
DnsAddr_BuildMcast
DnsBuildDotHostInternal
DnsCheckCallingProcess
DnsCheckServerConfig
DnsCleanupDdrSync
DnsConnectionDeletePolicyEntries
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::GetConnectionIfIndexes
DnsConnectionInterfaceIndexTable::GetConnectionNameForIfIndex
DnsConnectionInterfaceIndexTable::UpdateConnectionIfIndexes
DnsConnectionManager::AddDnsPolicyConfigurationEntry
DnsConnectionManager::ConnectionDeletePolicyEntries
DnsConnectionManager::ConnectionDeletePolicyEntriesRegistry
DnsConnectionManager::ConnectionSetPolicyEntries
DnsConnectionManager::ConnectionSetPolicyEntriesRegistry
DnsConnectionManager::ConnectionUpdateIfIndexTable
DnsConnectionManager::DeleteConnectionIfIndexTable
DnsConnectionManager::GetConnectionConfigForUrl
DnsConnectionManager::GetConnectionHandleForUrl
DnsConnectionManager::GetConnectionIfIndexes
DnsConnectionManager::GetConnectionNameForIfIndex
DnsConnectionManager::Initialize
DnsConnectionManager::ReadConnectionIfIndexTable
DnsConnectionManager::ReadConnectionPolicyRule
DnsConnectionManager::ReadConnectionPolicyRules
DnsConnectionManager::WriteConnectionIfIndexTable
DnsConnectionManager::WriteConnectionPolicyRule
DnsConnectionSetPolicyEntries
DnsConvertInternalProperties
DnsCreateDohUrl
DnsDeRegisterLocalRpc
DnsDeleteSettings
DnsDeleteWellKnownServerProperty
DnsDhcpSrvRegisterHostNameEx
DnsDhcpSrvRegisterInitEx
DnsDisableIdnEncoding
DnsDoSecureUpdate
DnsDoSecureUpdateHelper
DnsEtwTraceCacheLookupExit
DnsEtwTraceHttpStatusSecureFailure
DnsEtwTraceNetBiosQueryComplete
DnsEtwTraceNetBiosQueryStart
DnsEtwTraceNetworkQuery
DnsEtwTraceQueryExComplete
DnsEtwTraceQueryResponse
DnsEtwTraceSendQueryToDnsServer
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_W
DnsFree
DnsGetAdaptersInfo
DnsGetCacheDataTableEx
DnsGetCacheRecords
DnsGetConfigRpc
DnsGetDdrInfoCallbackV1
DnsGetDdrInfoCallbackV2
DnsGetDdrInfoInternal
DnsGetDdrInfoPrivate
DnsGetDdrInfoPrivateV1
DnsGetDdrInfoPrivateV2
DnsGetDdrInfoRpc
DnsGetDdrInfoSendQuery
DnsGetDhcpServerPropertiesImpl
DnsGetDnrServerProperties
DnsGetDnrServerPropertiesOld
DnsGetInterfaceSettings
DnsGetInterfaceSettingsInProc
DnsGetInterfaceSettingsInProcImpl
DnsGetMulticastDataRPC
DnsGetNetinfoProperties
DnsGetNetworkServers
DnsGetNrptRule
DnsGetNrptRuleNamesList
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPolicyTableInfoRpc
DnsGetProxyInfoPrivate
DnsGetProxyInformationEx
DnsGetProxyInformationRpc
DnsGetQueryRetryTimeouts
DnsGetQueryRetryTimeoutsRegistryHandle
DnsGetSettings
DnsGetSharedWinhttpSession
DnsGetSvcbData
DnsGetTcpipLegacyServerProperties
DnsGetUdpSocketFromCache
DnsGetWellKnownServerProperty
DnsGetWellKnownServers
DnsGetWinhttpSession
DnsGetZtClientCertConfig
DnsGetZtConfig
DnsGetZtFilterIds
DnsGetZtRules
DnsGetZtSettings
DnsGetZtTrustedCa
DnsGetZtTrustedServers
DnsInitWinsock
DnsIsZtEnabled
DnsLogEvent
DnsNbt_CheckAndConvertName
DnsNbt_CreateReverseRecords
DnsNbt_Open
DnsNbt_ResolveAddr
DnsNbt_ResolveName
DnsNetworkInfo_CreateFromFAZ
DnsNetworkInformation_CreateFromFAZ
DnsParseUnknownRecords
DnsPinModule
DnsPrint_Message
DnsPrint_NetworkInfo
DnsPrint_PacketName
DnsPrint_PacketRecord
DnsQueryConfig
DnsQueryConfigAllocEx
DnsQueryConfigAllocExOld
DnsQueryDdrMap
DnsQueryEx
DnsQueryRaw
DnsQuery_W
DnsRawExtractQueryInfo
DnsRawParseRawQuery
DnsRawProcessMessageResponse
DnsRawTruncateMessageForUdp
DnsRegisterLocalRpc
DnsRemoveNrptRule
DnsResetQueryRetryTimeouts
DnsResolverOp
DnsResolverQueryHvsi
DnsScreenLocalAddrsForRegistration
DnsSd_SplitServiceName
DnsSendAndRecvSync
DnsSendSecureUpdate
DnsServiceBrowse
DnsServiceRegister
DnsSetConfigDword
DnsSetInterfaceSettings
DnsSetNrptRule
DnsSetNrptRulesRpc
DnsSetQueryRetryTimeouts
DnsSetSettings
DnsSetWellKnownServerProperty
DnsSetZtSettings
DnsSocketClosingCb
DnsSplitDotHostInternal
DnsSplitServiceName
DnsStartMulticastQueryImpl
DnsStartMulticastQueryRpc
DnsStopMulticastQuery
DnsStopMulticastQueryRpc
DnsTraceCheckRecordSet
DnsTraceQueryTimeout
DnsUpdateMachinePresence
DnsUpdateTest_W
DnsValidateNameOrIp_TempW
DnsValidateName_A
DnsValidateName_UTF8
DnsValidateServerArray_A
DnsValidateServerStatus
DnsValidateServer_A
DnsValidateServer_W
DnsWinhttpCreateSession
DnsWinhttpSessionNode::CreateInstance
DnsZtHelperGetSettings
DnsZtHelperProcessClientCerts
DnsZtHelperPromoteConfig
DnsZtNotifyDnscache
DnsZtRequireTrustedServers
DnsZtVerifyServerRootCa
Dns_AcquireCredHandle
Dns_CacheServiceInitEx
Dns_CheckNrptRuleIntegrity
Dns_CopyAndCanonicalizeWireName
Dns_CreatePtrTypeRecord
Dns_CreateRecordForIpString_W
Dns_CreateSocketEx
Dns_CreateStandardDnsNameCopy
Dns_DeRegisterLocal
Dns_DowncaseNameLabel
Dns_ExtractRecordsFromBuffer
Dns_ExtractRecordsFromMessageEx
Dns_FindOrCreateSecurityContext
Dns_GenerateNsecTypeBitMaps
Dns_GetApplicationIdentifier
Dns_GetNetinfoProperties
Dns_InitClientSecurityContext
Dns_InitializeMsgRemoteSockaddr
Dns_InitializeSecurityPackage
Dns_Ip4ReverseNameToAddress_W
Dns_Ip4StringToAddress_A
Dns_Ip4StringToAddress_W
Dns_Ip6AddressToReverseName_W
Dns_Ip6LiteralNameToAddress
Dns_Ip6ReverseNameToAddress_W
Dns_Ip6StringToAddressEx_A
Dns_Ip6StringToAddress_A
Dns_Ip6StringToAddress_W
Dns_IsCallerDns
Dns_IsMicrosoftDnsServer
Dns_IsNetworkSignatureInvalid
Dns_IsServer
Dns_MakeCanonicalNameInPlaceW
Dns_NameCompareEx
Dns_NameCompare_A
Dns_NameCompare_UTF8
Dns_NegotiateTkeyWithServer
Dns_OpenTcpConnectionAndSend
Dns_ParseSigTime
Dns_ParseSigTimeW
Dns_PrioritizeSingleRecordSet
Dns_ReadNrptRuleFromRegistry
Dns_RecordListBuildCombinedAAAAInPlace
Dns_RecordListConvertAToAAAA
Dns_RecordListCopyEx
Dns_RecordListScreenEx
Dns_RecordTypeForNameA
Dns_RecordTypeForNameW
Dns_RecvTcp
Dns_RecvTcpAsync
Dns_RegisterLocal
Dns_SendAndRecvUdp
Dns_SendEx
Dns_SendServiceControl
Dns_SigTimeString
Dns_SignMessageWithGssTsig
Dns_SprintfPointerA
Dns_SprintfPointerW
Dns_StringCopyAllocate
Dns_StringToAddressEx
Dns_StringToDnsAddrEx
Dns_StringToGuid
Dns_Utf8ToOrFromAnsi
Dns_Utf8ToOrFromAnsi_New
Dns_ValidateName_W
Dns_VerifySignatureOnPacket
Dns_WriteNrptRuleToRegistry
Dns_WriteStringToPacket
DoEKUCheck
DohContextHandleHeadersAvailableCallback
DohContextHandleSendingRequestCallback
DohContextPrepare
DohCreateWinhttpStaticResolverCacheEntry
DotCacheCleanupIdleConnections
DotCacheGetConnection
DotCleanupWork::AddConnection
DotCleanupWork::CleanupCallback
DotConnectionCreate
DotConnectionDeRef
DotConnectionGetHttpCompatServer
DotConnectionHandleReceivedMessage
DotConnectionMap::RemoveIdleConnections
DotConnectionNode::CreateInstance
DotConnectionNode::FindAvailableConnection
DotConnectionPostReceive
DotConnectionPrepareRequest
DotCreateWinhttpStaticResolverCacheEntry
DotHandleCompleteUpgradeCallback
DotHandleUpgradeSendingCallback
DynDnsAddEntry
DynDnsAddForwardDhcid
DynDnsDeleteEntry
DynDnsDeleteForwardEntryDhcid
FastWppCallbackDnsapi
FastWppInit
FastWppTraceMessage
Faz_AreServerListsInSameNameSpace
Faz_CollapseDnsServerListsForUpdate
Faz_CompareTwoAdaptersForSameNameSpace
Faz_GetNameServersListForDomain
Faz_PrivateEx
Faz_ValidateSingleLabelZone
FillAdapterInfo
FindWellKnownDohProperty
FindWellKnownDotProperty
FixNetworkInfoForConnectionPolicy
FlushResolverCacheEntryNarrow
GetAppContainerSidFromToken
GetBestInterfaceIndex
GetCertConfig
GetCustomServersFromSettings
GetDevolutionLevelFromForestName
GetDnsRpcBindingHandleRef
GetDnsRulePolicyConfig
GetDnsServerRRSet
GetDnsServersString
GetFilteredIpAddressStringFromDnsAddrArray
GetNextQueryName
GetRADnsSettingsImpl
GetRADnsSettingsImplOld
GetRegistryBinaryBlob
GetRegistryDword
GetRegistryMultiString
GetRegistryString
GetTunnelPhysicalAdapter
GetTunnelPhysicalIpAdapter
GetWellKnownServers
GetXboxProductType
GetZtHelperRpcBindingHandleRef
HostsFile_OpenRESLIB
HostsFile_Query
Idn_IsMappable
Idn_IsPunycode
Idn_MapUnicode
Idn_PunycodeToUnicode
Idn_UnicodeToPunycode
InitializeTracePrivate
IpHelp_GetAdaptersAddresses
IpHelp_GetZtProbeAddrsAndProperties
IpHelp_GetZtdnsAddrsAndProperties
IpHelp_IsAddrOnLinkEx
IpHelp_IsReachableInterfaceOnSameLink
IpHelp_IsRouteExists
IpHelp_ReadAddrsAndPropertiesFromListImpl
IpHelp_ReadAddrsFromList
Ip_RegisterNotification
Ipv6AddressScope
IsCallerAllowedToTriggerVPN
IsDhcpRACoexistenceEnabled
IsInterfaceConnected
IsInterfaceVirtual
IsSKUDirectAccessEnabled
IsServiceNameLocal
KeyRecordPrint
LoadAutoDohTemplate
LoadAutoDotHost
LookUpTableFlushComplete
MDns_IncrementName
MakeCredKey
MakeKerberosName
MatchCertificateEKU
McTemplateU0qbr0_EtwEventWriteTransfer
McTemplateU0qq_EtwEventWriteTransfer
McTemplateU0qqq_EventWriteTransfer
McTemplateU0z_EtwEventWriteTransfer
McTemplateU0zq_EtwEventWriteTransfer
McTemplateU0zqbr1q_EtwEventWriteTransfer
McTemplateU0zqbr1qbr3qpp_EtwEventWriteTransfer
McTemplateU0zqbr1qpp_EtwEventWriteTransfer
McTemplateU0zqp_EtwEventWriteTransfer
McTemplateU0zqqqqp_EtwEventWriteTransfer
McTemplateU0zqqqzqqqz_EtwEventWriteTransfer
McTemplateU0zqqzzqp_EtwEventWriteTransfer
McTemplateU0zqzqp_EtwEventWriteTransfer
McTemplateU0zzq_EtwEventWriteTransfer
McTemplateU0zzqbr2qpp_EtwEventWriteTransfer
McTemplateU0zzqqqzqzzqqp_EtwEventWriteTransfer
McTemplateU0zzzx_EtwEventWriteTransfer
McTemplateU0zzzzq_EtwEventWriteTransfer
McastRegisterContext::InvokeCallback
Minfo_RecordRead
Minfo_RecordRead_New
Mx_RecordRead
Mx_RecordRead_New
NRPTLookupDdrServerProperty
Naptr_RecordRead
Naptr_RecordRead_New
NetInfo_BuildEx
NetInfo_BuildEx2
NetInfo_CloneForMulticast
NetInfo_CreateFromZtTrustedServers
NetInfo_CreateLocalAddrArray
NetInfo_CreateNRPTCopy
NetInfo_CreatePerNetworkNetinfo
NetInfo_FindEncryptedSettings
NetInfo_FindPropertyForServer
NetInfo_FindPropertyOnAllAdapters
NetInfo_FindPropertyOnBestAdapter
NetInfo_Get
NetInfo_GetLocalAddrArray
NetInfo_NRPTLookupServerProperties
NetworkQuery_BuildNetworkQueryBlob
NetworkQuery_HandleAllServerTimeout
Nsec3RecordPrint
Nsec_RecordRead
Nsec_RecordRead_New
OpenAdapterDhcpPersistedKey
OpenRegistryPaths
Packet_GetRandomXid
Packet_ParseMessage
Packet_ReadPacketNameAllocate
Packet_WriteDottedNameToPacket
PrepareWinhttpRequestCommon
Ptr_RecordRead
Ptr_RecordRead_New
QueryDirectEx
Query_BroadcastMulticastRequired
Query_BroadcastStart
Query_BypassLearningMode
Query_CacheEntry
Query_CheckPtrAddrOffLink
Query_GetPtrDnsAddr
Query_InProcPrepare
Query_InProcess
Query_IsNetBiosRequired
Query_LearningModeTimerCallback
Query_Main
Query_MatchAndGetlocalMachineRecord
Query_Multicast
Query_MulticastStart
Query_NetBios
Query_NextName
Query_Private
Query_PrivateExW
Query_PrivateOld
Query_ProcessQuery
Query_ProcessResponse
Query_ProcessResult
Query_Shim
ReadDaMultisiteKey
ReadDnsPolicyConfigInformation
ReadDnsPolicyTableConfigInfo
ReadRegIpAdapterInfo
RecordsFromServiceInstance
Recv_ProcessUdpResponse
Recv_Udp
Recv_UdpCallbackCompletion
Recv_UpdateControlInfo
Reg_CreateKey
Reg_GetDword
Reg_GetFullHostName
Reg_GetHostName
Reg_GetValueEx2
Reg_Init
Reg_OpenSession
Reg_ReadAdapterInfo
Reg_ReadAndValidateQueryTimeouts
Reg_ReadGlobalInfo
Reg_ReadGlobalsEx
Reg_ReadIpAdapterInfoEx
Reg_ReadPrimaryDomainName
Reg_ReadUpdateInfo
ReleaseAndRebindDnsRpcGlobalBindingHandle
ReleaseAndRebindZtHelperRpcGlobalBindingHandle
ReleaseStaleGlobalRpcBindingHandle
ReleaseStaleZtHelperGlobalRpcBindingHandle
ReleaseZtHelperGlobalRpcBindingHandle
ResolveContext::StartDnsQueries
ResolverZtGetClientAuthCertContext
ResolverZtGetTrustedServers
Rpc_ProcessQueryResult
Rpc_QueryComplete
Rpc_ResolverQuery
Rpc_RetryQuery
SaveDnsRecords
SearchList_BuildFromRegistry
SendDohQueryToNetinfoServers
SendDotQueryToNetinfoServers
SendQueryToDdrServer
SendSecureQueryToServer
SendUdpMessagePrivate
Send_AndRecvComplete
Send_AndRecvDohAsync
Send_AndRecvInitialize
Send_AndRecvTcp
Send_AndRecvUdp
Send_CleanupCompletedDdrList
Send_CleanupDdrList
Send_FallbackToInsecureRequired
Send_PrepareWinhttpSession
Send_ProcessDohBlobStatus
Send_ProcessDotBlobStatus
Send_QueryToDdrServers
ShimDnsQueryEx
Sig_RecordRead
Sig_RecordRead_New
Soa_RecordRead
Soa_RecordRead_New
Socket_Bind
Socket_CreateEx
Socket_CreateMessageSocket
Socket_JoinMulticast
Socket_PrepareAsyncMessage
Socket_RecvFrom
Socket_SetInterfaceIndexSocketOption
Socket_SetMulticastInterface
Socket_SetMulticastLoopBack
Socket_SetTtl
SortDnsAddrArray
Srv_RecordRead
Srv_RecordRead_New
StartDnsServiceOnDemand
StringCbPrintfA
StringCbPrintfW
StringCchPrintfA
StringCchPrintfExW
StringCchPrintfW
StringCchPrintfW
SyncResolverQueryRpc
TcpConnectionConnect
TcpIoCompletionCb
ThreadPool_CreateTimer
Threadpool_SetTimer
TraceLoggingRegisterEx_EventRegister_EventSetInformation
Trace_LogQueryDuration
Trace_LogQueryDurationFromStart
Trace_LogQueryEvent
Trace_LogRecvEvent
Trace_LogResponseEvent
Trace_LogSendEvent
Trace_ServerResponse
Txt_RecordRead
UpdateDnsConfig
Update_FazSendFlush
Update_MultiMaster
Update_Private
Update_Send
UploadAllDnsStatistics
UploadFailuresDnsStatistics
UploadQueryStatistics
UploadServerDnsStatistics
ValidateCustomServers
WPP_SF_D
WPP_SF_DDD
WPP_SF_DDDq
WPP_SF_DDS
WPP_SF_DDSD
WPP_SF_DDSDS
WPP_SF_DDd
WPP_SF_DDdd
WPP_SF_DDiiDDi
WPP_SF_DDiq
WPP_SF_DDlq
WPP_SF_DH
WPP_SF_DID
WPP_SF_DL
WPP_SF_DPq
WPP_SF_DS
WPP_SF_DSD
WPP_SF_DSS
WPP_SF_DSq
WPP_SF_D_HEX_
WPP_SF_D_SOCKADDR_
WPP_SF_D_SOCKADDR_Sq
WPP_SF_DdL
WPP_SF_DddS
WPP_SF_Dddl
WPP_SF_Ddl
WPP_SF_Ddq
WPP_SF_Ddqdqqd
WPP_SF_Ddqdqqdq
WPP_SF_Ddqqd
WPP_SF_Di
WPP_SF_Did
WPP_SF_DlD
WPP_SF_Dld
WPP_SF_Dlid
WPP_SF_Dll
WPP_SF_Dlq
WPP_SF_Dq
WPP_SF_DqDd
WPP_SF_Dq_SOCKADDR_D
WPP_SF_Dqd
WPP_SF_Dqdq
WPP_SF_Dqi
WPP_SF_Dql
WPP_SF_Dqq
WPP_SF_Dqqddq_COUNTEDSTRING__COUNTEDSTRINGW_ddd
WPP_SF_Dqqq
WPP_SF_Ds
WPP_SF_Dssdsd
WPP_SF_HHLsLsLLLLLLsHHHH
WPP_SF_I
WPP_SF_IDD
WPP_SF_IDDqDDDq
WPP_SF_LLd
WPP_SF_P
WPP_SF_PD
WPP_SF_PPP
WPP_SF_Pd
WPP_SF_Pd_SOCKADDR_D
WPP_SF_Pd_SOCKADDR_d
WPP_SF_Pdd
WPP_SF_Pdd_SOCKADDR_D
WPP_SF_Pddd
WPP_SF_Pdddd
WPP_SF_Pdqd
WPP_SF_Pdqdd
WPP_SF_Pl
WPP_SF_Pq
WPP_SF_Pql
WPP_SF_SDDDDdq
WPP_SF_SDDDqq
WPP_SF_SDdll_SOCKADDR_Slqq
WPP_SF_SDq
WPP_SF_SDqq
WPP_SF_SDqqqqq
WPP_SF_SIqdq
WPP_SF_SSSqd
WPP_SF_SSq
WPP_SF_SSqD
WPP_SF_SSqDl
WPP_SF_SSqq
WPP_SF_S_sid_q
WPP_SF_SdDq
WPP_SF_Sddq
WPP_SF_Sdidq
WPP_SF_Sdiqq
WPP_SF_Sdiqql
WPP_SF_Sdq
WPP_SF_Slq
WPP_SF_Sq
WPP_SF_Sqdd
WPP_SF_Sqq
WPP_SF_Sqqqq
WPP_SF_Sqqqqill
WPP_SF_Sqqqqq
WPP_SF_SsdDq
WPP_SF__COUNTEDSTRINGW_
WPP_SF__COUNTEDSTRINGW_d
WPP_SF__COUNTEDSTRINGW_dD
WPP_SF__COUNTEDSTRING_
WPP_SF__COUNTEDSTRING_d
WPP_SF__COUNTEDSTRING_dD
WPP_SF__COUNTEDSTRING_dd_COUNTEDSTRING_D
WPP_SF__COUNTEDSTRING_s
WPP_SF__HEX_
WPP_SF__IPV4_Sq
WPP_SF__SOCKADDR_dlqq
WPP_SF__SOCKADDR_dq
WPP_SF__SOCKADDR_dqD
WPP_SF__SOCKADDR_dqq
WPP_SF__SOCKADDR_q
WPP_SF__SOCKADDR_qD
WPP_SF__SOCKADDR_qP
WPP_SF__SOCKADDR_qdq
WPP_SF__SOCKADDR_qq
WPP_SF__guid_dq
WPP_SF_c
WPP_SF_cD_COUNTEDSTRING_
WPP_SF_cP
WPP_SF_dD
WPP_SF_dDD
WPP_SF_dDDSq
WPP_SF_dDSd
WPP_SF_dDdD
WPP_SF_dDdDdddddidqql_SOCKADDR_lS
WPP_SF_dDddDs
WPP_SF_dDq
WPP_SF_dI
WPP_SF_dP
WPP_SF_dPP
WPP_SF_dPq
WPP_SF_dS
WPP_SF_dSD
WPP_SF_dSDdD
WPP_SF_dSSDSdq
WPP_SF_dSSdD
WPP_SF_dSSdq
WPP_SF_dSd
WPP_SF_dSl
WPP_SF_dSl_sid__sid_dSd
WPP_SF_dSs
WPP_SF_d_IPV4_
WPP_SF_d_SOCKADDR_
WPP_SF_d_SOCKADDR_SS
WPP_SF_d_guid_
WPP_SF_ddS
WPP_SF_ddSSS
WPP_SF_ddSsSsSsSs
WPP_SF_dd_IPV4_
WPP_SF_dd_SOCKADDR_
WPP_SF_dd_SOCKADDR_dDD
WPP_SF_ddd
WPP_SF_dddDD_SOCKADDR_
WPP_SF_dddDD_SOCKADDR_d
WPP_SF_dddSs
WPP_SF_ddd_guid_
WPP_SF_ddddDD_SOCKADDR_ddDD
WPP_SF_ddddd
WPP_SF_dddddd
WPP_SF_ddddddD
WPP_SF_dddddddd
WPP_SF_dddddqdq
WPP_SF_dddqqPP
WPP_SF_ddl
WPP_SF_ddqd
WPP_SF_ddqq
WPP_SF_di
WPP_SF_diqdiqdiq
WPP_SF_dld
WPP_SF_dqDddd
WPP_SF_dqPqiqq
WPP_SF_dqdd
WPP_SF_dqdq
WPP_SF_dqdqDqd
WPP_SF_dqq
WPP_SF_dqql
WPP_SF_dqqq
WPP_SF_dqqqq
WPP_SF_dqqqqS
WPP_SF_dsdsd
WPP_SF_hdd
WPP_SF_id
WPP_SF_idd
WPP_SF_idddd
WPP_SF_ii
WPP_SF_il
WPP_SF_iq
WPP_SF_lDD
WPP_SF_lPP
WPP_SF_lS
WPP_SF_lSDD
WPP_SF_l_SOCKADDR_d
WPP_SF_ldD
WPP_SF_ldiilDl
WPP_SF_ldq
WPP_SF_liD
WPP_SF_liiDDl
WPP_SF_ll
WPP_SF_lld
WPP_SF_lldd
WPP_SF_lllD
WPP_SF_llll
WPP_SF_lllll
WPP_SF_llllll
WPP_SF_lq
WPP_SF_lqd
WPP_SF_lsDlll
WPP_SF_lsdqd
WPP_SF_qDDSD
WPP_SF_qDDq
WPP_SF_qDS
WPP_SF_qDSq
WPP_SF_qD_SOCKADDR_
WPP_SF_qDdq
WPP_SF_qDds
WPP_SF_qDl
WPP_SF_qDll
WPP_SF_qDllD
WPP_SF_qDlq
WPP_SF_qDq
WPP_SF_qDqDS
WPP_SF_qDqd
WPP_SF_qDqqq
WPP_SF_qDqqqd
WPP_SF_qL
WPP_SF_qPD
WPP_SF_qPddd
WPP_SF_qPdldqq
WPP_SF_qPq
WPP_SF_qPqdd
WPP_SF_qPqq
WPP_SF_qPqqDd
WPP_SF_qPqqdd
WPP_SF_qS
WPP_SF_qSD
WPP_SF_qSDd
WPP_SF_qSDlq
WPP_SF_qSDq
WPP_SF_qSS
WPP_SF_qSSD_SOCKADDR_d
WPP_SF_qSSS
WPP_SF_qSSSdDd
WPP_SF_qSSd
WPP_SF_qSSid
WPP_SF_qSSl
WPP_SF_qSSqD
WPP_SF_qSSqDq
WPP_SF_qSSqq
WPP_SF_qSd
WPP_SF_qSdD
WPP_SF_qSdDd
WPP_SF_qSdDiql_SOCKADDR_SlDiql_SOCKADDR_Sl
WPP_SF_qSdDql_SOCKADDR_Sl
WPP_SF_qSdDqll_SOCKADDR_Sl
WPP_SF_qSdddd
WPP_SF_qSdl
WPP_SF_qSdq
WPP_SF_qSiDllD
WPP_SF_qSq
WPP_SF_qSqD
WPP_SF_qSqDDSq
WPP_SF_qSqDSD
WPP_SF_qSqSqD
WPP_SF_qSqdD
WPP_SF_qSqqqD
WPP_SF_qSqqqq
WPP_SF_q_COUNTEDSTRING_d
WPP_SF_q_COUNTEDSTRING_dD
WPP_SF_q_COUNTEDSTRING_ddd
WPP_SF_q_IPV4_D
WPP_SF_q_IPV4_q
WPP_SF_q_IPV6_DD
WPP_SF_q_SOCKADDR_
WPP_SF_q_SOCKADDR_D
WPP_SF_q_SOCKADDR_d
WPP_SF_q_SOCKADDR_dd
WPP_SF_q_SOCKADDR_dl
WPP_SF_q_SOCKADDR_qq
WPP_SF_q_sid_SS
WPP_SF_qdD
WPP_SF_qdDD
WPP_SF_qdDd
WPP_SF_qdDll
WPP_SF_qdS
WPP_SF_qdSSSD
WPP_SF_qdSd
WPP_SF_qd_SOCKADDR_qq
WPP_SF_qd_SOCKADDR_qqq
WPP_SF_qdd
WPP_SF_qddl
WPP_SF_qddq
WPP_SF_qdi
WPP_SF_qdl
WPP_SF_qdlq
WPP_SF_qdq_COUNTEDSTRING_ddd
WPP_SF_qdqd
WPP_SF_qdqq
WPP_SF_qdqqld
WPP_SF_qdqqq
WPP_SF_qdqqqd
WPP_SF_qi
WPP_SF_qiddqqq
WPP_SF_qidqd
WPP_SF_qii
WPP_SF_ql
WPP_SF_qlDSSSqqqq
WPP_SF_qlDllqll_SOCKADDR_Slqq
WPP_SF_qlSSqqqq
WPP_SF_qlSlSD
WPP_SF_qlll
WPP_SF_qlllqqq
WPP_SF_qllq
WPP_SF_qllqq
WPP_SF_qlq
WPP_SF_qlqq
WPP_SF_qlsSdqild
WPP_SF_qq
WPP_SF_qqDddd
WPP_SF_qqDqSq
WPP_SF_qqDqq
WPP_SF_qqDqqD
WPP_SF_qqSdSdDq
WPP_SF_qqSssdDdddddd
WPP_SF_qqSssddDddddddddd
WPP_SF_qqd
WPP_SF_qqddDqq
WPP_SF_qqdddd
WPP_SF_qqdl
WPP_SF_qqdq
WPP_SF_qql
WPP_SF_qqlD
WPP_SF_qqlDqqqqq
WPP_SF_qqll
WPP_SF_qqlq
WPP_SF_qqq
WPP_SF_qqqDDd
WPP_SF_qqqDqqqd
WPP_SF_qqq_SOCKADDR_
WPP_SF_qqqd
WPP_SF_qqqddq
WPP_SF_qqqlsdqDqq
WPP_SF_qqqq
WPP_SF_qqqqSSSS
WPP_SF_qqqqdDl
WPP_SF_qqqqdddd
WPP_SF_qqqqdq
WPP_SF_qqqqq
WPP_SF_qqqqql
WPP_SF_qs
WPP_SF_qsD
WPP_SF_qsDi
WPP_SF_qsdddd
WPP_SF_qss
WPP_SF_qsss
WPP_SF_qsssssss
WPP_SF_sDqq
WPP_SF_sqSSSqqdDddDdDddd
WPP_SF_sqSSqdddDDddd
WPP_SF_sqd
WPP_SF_sqdd
WPP_SF_sqddd
WPP_SF_sql
WPP_SF_sqq
WPP_SF_sqqDdqqqqSSq
WPP_SF_sqq_SOCKADDR_ssdqqqqddddddd
WPP_SF_sqqd
WPP_SF_sqqq
WPP_SF_sqqsdqqdqdqd
WPP_SF_sqs
WPP_SF_ssqsPPP
Winsr_RecordRead
Winsr_RecordRead_New
Wks_RecordBuildA
Wks_RecordBuildW
WnfParams::StaticCallback
WxAlloc
WxAlloc
WxAlloc
WxAllocZero
WxConnectionDeleteProxyInfo
WxConnectionGetNameList
WxConnectionGetProxyInfo
WxConnectionGetProxyList
WxConnectionSetProxyInfo
WxGetAdaptersAddresses
WxGetFirstConnectedInterfaceFromConnectionsListEx
WxGetFirstConnectedInterfaceFromInterfaceList
WxGetModuleName
WxGetPersistedRegistryLocation
WxGetRegistryDword
WxGetRegistryString
WxGetTokenAppContainerSID
WxGetTokenIntegrityLevel
WxGetTokenSessionId
WxGetTokenUserSID
WxIsInterfaceConnected
WxIsProcessAppContainer
WxIsTokenAppContainer
WxOpenRegistryKey
ZtServersConfigured
ZtTrustedServerGetTemplate
_AdapterIsConnected
_CheckForDuplicateFriendlyName
_NormalizeConnectionName
_OpenProxyRegistryKey
_ProcessUserSIDInitOnceCallback
__GSHandlerCheckCommon
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
_tlgWriteTransfer_EtwEventWriteTransfer
buildUnmatchedRecordSet
buildUpdateNetworkInfoFromFAZ
checkForAnyOnLinkRecords
hostsFileGetLine
hostsFileLineToUnicode
hostsFileSniffBom
idnNrptDepunify
idnQueryDepunify
idnQueryWireFormat
idnValidateMapping
isServiceDisabled
local_GetLocalAddressRecord
local_GetLocalPtrRecord
modifyRecordsInSetPrivate
netinfo_StrikeOutUnreachableDnsServers
privateRegReadDwordValue
privateRegReadStringValueW
privateRegReadValue
replaceRecordSetPrivate
sendUdpToNextDnsServers
swprintf_s<256>
up_ReplaceAddressRecordsPrivate
wil::GetFailureLogString
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::GetModuleInformation
wil::details::LogStringPrintf
wil::details::MicrosoftInternalNotifyFailure
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
wistd::swap_wil
| |paramcount|1|1| |`address`|180082010|180081ff0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -1091,2 +1090,0 @@ -wil::details_abi::UsageIndexProperty::UpdateCount -wil::details_abi::UsageIndexProperty::Write ``` ## WPP_SF_D ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|WPP_SF_D|WPP_SF_D| |fullname|WPP_SF_D|WPP_SF_D| |`refcount`|1114|1115| |length|72|72| |called|FastWppTraceMessage
__security_check_cookie|FastWppTraceMessage
__security_check_cookie| |`calling`|
Expand for full list:
AdapterInfo_CreateMulticastAddrs
AdapterInfo_GetNetworkAdapterList
AdapterInfo_UpdateDnsInterfaceConfig
AdapterInfo_UpdateNetworkSignature
AddDhcpConfiguration
AddDhcpv6ConfigurationArray
AddDhcpv6ConfigurationHelper
AddDnsAndDhcpConfiguration
AddDnsAndDhcpConfigurationHelper
AddDnsGlobalsToAdapter
AddDnsRulePolicyConfigAddDnsServerAddressesToAdapter
AddDnssdRegEntry
AddEntryToDnsPolicyTable
AddQMIPSECPolicy
AddRefDnsMessage
AddRefNetworkQueryBlob
AddSecureSocketOptions
AllocateDnsTcpConnection
AllocateMsgBuf
AppendServersAndPropertiesToAdapter
AsyncResolverQueryRPC
AtmaRecordPrint
BrowseContext::CancelQuery
BrowseContext::InvokeCallback
BuildAdapterInfo
BuildAdapterSearchList
BuildSearchList
CWxRpcBinding::CreateInstance
CWxRpcBinding::Initialize
CWxSelectableConnectionsEx::AcquireEx
CWxSelectableConnectionsEx::AcquireInternal
CheckDnsPolicyReachableStatus
CheckHostnameIpLiteral
CheckNrptRules
Coalesce_Complete
Coalesce_Lookup
CombinedQueryEx
ComputeIfIndex
Config_GetDnsServerList
ConnectionAppIdPolicyNode::CreateInstance
ConnectionAppIdPolicyNode::DeletePolicyNodes
ConnectionAppIdPolicyNode::Initialize
ConnectionAppIdPolicyNode::MatchHostPolicyRule
ConnectionAppIdPolicyNode::UpdateAppIdHostPolicyRules
ConnectionHostPolicyNode::CreateInstance
ConnectionHostPolicyNode::Initialize
ConnectionHostPolicyNode::MatchWithSuffixRules
ConnectionHostPolicyNode::SetHost
ConnectionHostPolicyNode::SetSuffixMatchingRules
ConnectionPolicyMap::AddPolicyRule
ConnectionPolicyMap::MatchPolicyRule
ConnectionToIfIndexesNode::AddIfIndex
ConnectionToIfIndexesNode::CreateInstance
ConnectionToIfIndexesNode::Initialize
ConvertAddrArrayToCustomServers
ConvertCustomServers
ConvertCustomServersOld
ConvertZtTrustedServersToCustomServers
CopyZtTrustedServerToInternalProperty
CountServerAddressesAndProperties
CreateCustomNetInfo
CreateDAPolicyObject
CreateGenericPolicyObject
CreateIPSECPolicy
CreatePersistedRegistryKeyHelper
CreateZtTrustedServerAddrArray
DdrCleanupTree
DdrCreateDohServerSettings
DdrCreateDotServerSettings
DdrCreateNetInfo
DdrExtractEncryptionSettings
DdrGetNode
DdrGetSvcbData
DdrIsAddressAllowed
DdrQueryAndVerifyServerCertChainContext
DdrRenewEntry::CreateInstance
DdrRenewTimerCallback
DdrSendAndRecv
DdrServerNode::AttachDdrContext
DdrServerNode::CreateInstance
DdrServerNode::GetDdrInfo
DdrServerNode::UpdateNode
DdrSkipCertVerification
DdrVerifyServerCert
DdrVerifyServerCertChainContext
DeRefDnsMessage
DeRefNetworkQueryBlob
DereferenceDAPolicyConfigNode
DereferenceDnsPolicyConfigNode
DereferenceDnsSecPolicyConfigNode
DereferenceDnsStatusObject
DereferenceGenericPolicyConfigNode
DereferenceIdnPolicyConfigNode
DnrConvertAddressToString
DnrConvertInstancesToServerProperties
DnrGetServerPropertiesFromAlpn
DnrGetServerPropertiesFromInstance
DnrIsAddressAllowed
DnrParseInstanceV4
DnrParseInstanceV6
DnrParseOptionV4
DnrParseOptionV6
DnrParseOptionV6_Old
DnsAddUdpSocketToCache
DnsAddrArray_AddSockaddr
DnsAddrArray_InitSingleWithSockaddr
DnsApiInit
DnsApiOnNetworkChange
DnsBuildDotHostInternal
DnsCancelQuery
DnsCancelQueryRaw
DnsCheckSecureUpdateResponse
DnsCleanupTcpConnectionsEx
DnsCleanupUdpSocketsCache
DnsConnectionDeletePolicyEntries
DnsConnectionGetHandleForHostUrlPrivate
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::GetConnectionIfIndexes
DnsConnectionInterfaceIndexTable::GetConnectionNameForIfIndex
DnsConnectionInterfaceIndexTable::UpdateConnectionIfIndexes
DnsConnectionManager::AddDnsPolicyConfigurationEntry
DnsConnectionManager::ConnectionDeletePolicyEntries
DnsConnectionManager::ConnectionDeletePolicyEntriesRegistry
DnsConnectionManager::ConnectionSetPolicyEntries
DnsConnectionManager::ConnectionSetPolicyEntriesRegistry
DnsConnectionManager::ConnectionUpdateIfIndexTable
DnsConnectionManager::DeleteConnectionIfIndexTable
DnsConnectionManager::GetConnectionConfigForUrl
DnsConnectionManager::GetConnectionHandleForUrl
DnsConnectionManager::GetConnectionIfIndexes
DnsConnectionManager::GetConnectionNameForIfIndex
DnsConnectionManager::Initialize
DnsConnectionManager::ReadConnectionIfIndexTable
DnsConnectionManager::ReadConnectionPolicyRule
DnsConnectionManager::ReadConnectionPolicyRules
DnsConnectionManager::WriteConnectionIfIndexTable
DnsConnectionManager::WriteConnectionPolicyRule
DnsConnectionManagerInitOnce
DnsConnectionSetPolicyEntries
DnsConvertDotPort
DnsConvertInternalProperties
DnsConvertIpToServerKey
DnsConvertServerAddrToString
DnsConvertSockAddrToServerKey
DnsCopyInternalProperties
DnsCopyInternalProperty
DnsCopyProperty
DnsCreateDohUrl
DnsCreateInternalProperty
DnsCreateSocketClosingWork
DnsDdrContextCopyResults
DnsDdrContextValid
DnsDeRegisterLocalRpc
DnsDeleteSettings
DnsDeleteWellKnownServerProperty
DnsDhcpRemoveRegistrations
DnsDoSecureUpdate
DnsDoSecureUpdateHelper
DnsFlushResolverCache
DnsFlushResolverCacheEntry_W
DnsGetAdaptersInfo
DnsGetApplicationSettings
DnsGetCacheDataTableEx
DnsGetCacheRecords
DnsGetConfigRpc
DnsGetDdrInfoCallbackV1
DnsGetDdrInfoCallbackV2
DnsGetDdrInfoCancel
DnsGetDdrInfoPrivate
DnsGetDdrInfoPrivateV2
DnsGetDdrInfoRpc
DnsGetDdrInfoSendQuery
DnsGetDhcpServerPropertiesImpl
DnsGetDnrServerProperties
DnsGetDnrServerPropertiesOld
DnsGetDohPropertiesFromNetinfo
DnsGetDotPropertiesFromNetinfo
DnsGetEmptyDnsSocket
DnsGetInterfaceSettings
DnsGetInterfaceSettingsInProc
DnsGetInterfaceSettingsInProcImpl
DnsGetMulticastData
DnsGetMulticastDataRPC
DnsGetNetinfoProperties
DnsGetNetworkServers
DnsGetNonSecureServersFromNetinfo
DnsGetNrptRule
DnsGetNrptRuleNamesList
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPolicyTableInfoRpc
DnsGetProxyInformationEx
DnsGetProxyInformationRpc
DnsGetSettings
DnsGetSvcParams
DnsGetSvcbData
DnsGetSvcbTargetName
DnsGetUdpSocketFromCache
DnsGetWellKnownServerProperty
DnsGetWellKnownServers
DnsGetWinhttpSession
DnsGetZtClientCertConfig
DnsGetZtConfig
DnsGetZtFilterIds
DnsGetZtRules
DnsGetZtSettings
DnsGetZtTrustedCa
DnsGetZtTrustedServers
DnsInitDdr
DnsInitWinsock
DnsIsZtEnabled
DnsLogEvent
DnsNbt_Cancel
DnsNbt_CreateReverseRecords
DnsNbt_ResolveAddr
DnsNbt_ResolveName
DnsNotifyProxyConfigChangePrivate
DnsParseUnknownRecords
DnsPrint_AdapterInfo
DnsPrint_ExtraInfo
DnsPrint_Message
DnsPrint_MessageNoContext
DnsPrint_PacketRecord
DnsPrint_QueryState
DnsQueryConfig
DnsQueryDdrMap
DnsQueryEx
DnsQueryRaw
DnsRawBuildMessageResponse
DnsRawCreateQueryResult
DnsRawDetermineResponseProtocol
DnsRawFindOptRecord
DnsRawInitializeQueryInfo
DnsRawParseRawQuery
DnsRawProcessMessageResponse
DnsRawStartInlineCompletion
DnsRawTruncateMessageForUdp
DnsRawValidateDnsQueryRawParameters
DnsRegisterLocalRpc
DnsResolverOp
DnsResolverQueryHvsi
DnsSendAndRecvSync
DnsSendSecureUpdate
DnsServiceBrowse
DnsServiceDeRegister
DnsServiceRegister
DnsServiceResolve
DnsSetApplicationSettings
DnsSetInterfaceSettings
DnsSetNrptRules
DnsSetNrptRulesRpc
DnsSetSettings
DnsSetWellKnownServerProperty
DnsSetZtSettings
DnsShutdownWinsock
DnsSplitDotHostInternal
DnsStartMdnsQuery
DnsStartMulticastQueryImpl
DnsStartMulticastQueryRpc
DnsStopMdnsQuery
DnsStopMulticastQuery
DnsStopMulticastQueryRpc
DnsUpdateCaptivePortalPresence
DnsUpdateDdrSendBlob
DnsUpdateMachinePresence
DnsUpdateTest_W
DnsValidateDotPort
DnsWinhttpCreateSession
DnsZtHelperGetSettings
DnsZtHelperProcessClientCerts
DnsZtHelperPromoteConfig
DnsZtNotifyDnscache
DnsZtVerifyServerRootCa
Dns_AcquireCredHandle
Dns_AllocateMsgBufRpc
Dns_AllocateMsgBufRpc_New
Dns_BuildPacketInternal
Dns_CacheServiceInitEx
Dns_CapBufferSizeForEdns
Dns_CheckNrptRuleIntegrity
Dns_ConnectionDeletePolicyEntriesPrivate
Dns_ConnectionSetPolicyEntriesPrivate
Dns_CreateIpArray
Dns_ExtractGssTkeyFromMessage
Dns_ExtractGssTsigFromMessage
Dns_ExtractPacketFromMsgBuf
Dns_ExtractRecordsFromMessageEx
Dns_GetApplicationIdentifier
Dns_GetNetinfoProperties
Dns_InitClientSecurityContext
Dns_NameCompareEx
Dns_NegotiateTkeyWithServer
Dns_ReadNrptRuleFromRegistry
Dns_RecordBuild_A
Dns_RecordBuild_W
Dns_RecordCompare
Dns_RecordMinSize
Dns_RecvTcp
Dns_RefreshSSpiCredentialsHandle
Dns_RegisterLocal
Dns_SendServiceControl
Dns_SendTcpAsync
Dns_SetNrptRulesPrivate
Dns_SignMessageWithGssTsig
Dns_StringToDnsAddrEx
Dns_VerifySignatureOnPacket
Dns_WriteNrptRuleToRegistry
Dns_WriteRecordStructureToMessage
Dns_WriteRecordStructureToPacket
DoEKUCheck
DohContextAssignHttpStatus
DohContextAttachBlob
DohContextCreate
DohContextHandleHeadersAvailableCallback
DohContextHandleReadCompleteCallback
DohContextHandleSendRequestCompleteCallback
DohContextHandleSendingRequestCallback
DohContextPrepare
DohContextSend
DohCreateWinhttpStaticResolverCacheEntry
DotConnectionAttachBlob
DotConnectionCreate
DotConnectionGetHttpCompatServer
DotConnectionHandleReceivedMessage
DotConnectionIsReadyToSend
DotConnectionMap::RemoveIdleConnections
DotConnectionPostReceiveImpl
DotConnectionPrepareForSend
DotConnectionPrepareRequest
DotConnectionRemoveBlob
DotConnectionSendQuery
DotConnectionSendQueryImpl
DotConnectionSendUpgradeRequest
DotCreateWinhttpStaticResolverCacheEntry
DotHandleCompleteUpgradeCallback
DotHandleReadCompleteCallback
DotHandleUpgradeSendingCallback
DotUpdateReceivedBytes
DotWinhttpStatusCallback
DynDnsAddEntry
DynDnsAddForward
DynDnsAddForwardDhcid
DynDnsDeleteEntry
DynDnsDeleteForwards
DynDnsRegisterEntries
ExtractAdapterProperties
ExtractDAPolicyServers
ExtractGenericPolicyServers
Faz_AreServerListsInSameNameSpace
Faz_CollapseDnsServerListsForUpdate
Faz_GetNameServersListForDomain
FillZtTrustedServerProperties
FilterDnsServers
FindDohInternalSettings
FindPropertyOnAdapter
FindServerPropertyType
FindWellKnownDohProperty
FindWellKnownDotProperty
GetAppContainerSidFromToken
GetBestInterfaceIndex
GetCertConfig
GetCustomServersFromSettings
GetDevolutionLevelFromForestName
GetDnsResultsInString
GetDnsRpcBindingHandleRef
GetDnsRulePolicyConfig
GetDnsRulePolicyObjects
GetDnsServerRRSet
GetDnsServersString
GetIpAddressStringFromDnsAddrArray
GetNextQueryName
GetPolicyTableInfo
GetRegistryBinaryBlob
GetRegistryDword
GetRegistryMultiString
GetRegistryString
GetServerPropertiesByIndex
GetTcpConnection
GetWellKnownServers
GetXboxProductType
GetZtHelperRpcBindingHandleRef
HandleNonTcpResponse
HandleTcpResponse
IfIndexToConnectionNode::CreateInstance
IfIndexToConnectionNode::Initialize
InitializeDnsApiStatistics
InitializeDnsStatistics
InitializeTracePrivate
IpHelp_GetAdaptersAddresses
IpHelp_GetZtProbeAddrsAndProperties
IpHelp_GetZtdnsAddrsAndProperties
IpHelp_ReadAddrsAndPropertiesFromList
IpHelp_ReadAddrsAndPropertiesFromListImpl
IpHelp_ReadAddrsFromList
Ip_RegisterNotification
IsBehindCaptivePortal
IsBlobReachableUsingProtocol
IsCallerAllowedToTriggerVPN
IsDhcpRACoexistenceEnabled
IsDnsReachableOnAlternateInterface
IsDohQueryCompleted
IsDotQueryCompleted
IsEmptyDnsResponseFromResolver
IsMdnsAllowedOnNetwork
IsQueryDohCapable
IsQueryDotCapable
IsSKUDirectAccessEnabled
IsServiceNameLocal
LoadAutoDohTemplate
LoadAutoDotHost
LocalIp_IsAddrLocalEx
LocalIp_IsAddrLocalRegisterable
MarkSendBlobSecureProtocolUnreachable
MarshalDnsMsgBufFromRpcMsgBuf
MarshalDnsMsgBufFromRpcMsgBuf_New
MarshalDnsMsgBufToRpcMsgBuf
MarshalDnsMsgBufToRpcMsgBuf_New
MarshalDnsRecordListToRpcRecordList
MarshalDnsRecordListToRpcRecordList_New
MarshalDnsRecordToRpcRecord
MarshalDnsRecordToRpcRecord
MarshalRpcRecordListToDnsRecordList
MarshalRpcRecordToDnsRecord
MatchCertificateEKU
McastRegisterContext::CancelQuery
McastRegisterContext::InvokeCallback
MoveNRPTPropertiesToAdapter
NRPTLookupDdrServerProperty
NetInfo_BuildEx
NetInfo_BuildEx2
NetInfo_CloneForMulticast
NetInfo_CopyInternal
NetInfo_CreateForUpdate
NetInfo_CreateFromAddrArray
NetInfo_CreateFromNsResponse
NetInfo_CreateFromZtTrustedServers
NetInfo_CreateNRPTCopy
NetInfo_CreatePerNetworkNetinfo
NetInfo_FindEncryptedSettings
NetInfo_FindPropertyForServer
NetInfo_FindPropertyOnAllAdapters
NetInfo_FindPropertyOnBestAdapter
NetInfo_Get
NetInfo_GetLocalAddrArray
NetInfo_GetPropertiesForServers
NetInfo_NRPTLookupServerProperties
NetInfo_SetMulticastFlags
NetInfo_UpdateCaptivePortalPresence
NetInfo_UpdateNetworkProperties
NetInfo_UpdateServerReachability
NetworkQuery_BuildNetworkQueryBlob
NetworkQuery_BuildParallelQueryBlobs
NetworkQuery_ProcessComplete
NetworkQuery_QueueParallelNetworkQueries
NetworkQuery_QueueParallelQuery
OpenAdapterDhcpPersistedKey
OpenIPSECHandle
OpenRegistryPaths
Packet_AddRecordsToMessage
Packet_AllocateMsgBuf
Packet_GetRandomXid
Packet_ParseMessage
PrepareAsyncTcpMessageLocked
PrepareTcpConnectionIo
PrepareWinhttpRequestCommon
Ptr_RecordRead
Ptr_RecordRead_New
QueryDirectAccessServerReachable
QueryDirectEx
QueryRequiresTCP
Query_ActiveLearningModeCall
Query_AllLearningModeQueriesCancelled
Query_BroadcastComplete
Query_BroadcastHandleNonMulticastBlob
Query_BroadcastMulticastRequired
Query_BroadcastStart
Query_CacheEntry
Query_CancelLearningMode
Query_CancelNode
Query_CheckPtrAddrOffLink
Query_CreateMDNSBlob
Query_CreateMDNSContextForQueryBlob
Query_CreateNetBiosBlob
Query_DeRefBlobLearningModeTimer
Query_GetCompletedNetBiosMdns
Query_GetPtrDnsAddr
Query_InProcPrepare
Query_IsNetBiosRequired
Query_IsPreferedNetworkQuery
Query_LearningModeTimerCallback
Query_MDNS
Query_MDNSComplete
Query_MDNSCompleteCallback
Query_MDNSCompleteWork
Query_MDNSDualCompleteCallback
Query_MDNSDualTimerCallback
Query_MDNSProcessDualResults
Query_MDNSSerialTimerCallback
Query_MDNSStartSerialDual
Query_MDNSTimerCallback
Query_Main
Query_MatchAndGetlocalMachineRecord
Query_Multicast
Query_NetBios
Query_NextName
Query_PolicyTableDnsServer
Query_PrivateExW
Query_PrivateOld
Query_ProcessParallelQuery
Query_ProcessQuery
Query_ProcessQueryStatus
Query_ProcessResponse
Query_SingleNameDualAddr
Query_SingleNamePrivate
Query_SkipLearningMode
Query_StartLearningMode
Query_Wire
ReadDnsPolicyConfigInformation
ReadDnsPolicyTableConfigInfo
ReadHttpResponseData
ReadRegIpAdapterInfo
Recv_IoCompletionCallback
Recv_IsMsgStateProcessIo
Recv_ProcessTcpMessage
Recv_ProcessUdpResponse
Recv_SecureComplete
Recv_TimerCallback
Recv_Udp
Recv_UdpCallbackCompletion
Recv_UpdateControlInfo
ReferenceDAPolicyConfigNode
ReferenceDnsPolicyConfigNode
ReferenceDnsSecPolicyConfigNode
ReferenceDnsStatusObject
ReferenceGenericPolicyConfigNode
ReferenceIdnPolicyConfigNode
Reg_CreateKey
Reg_GetValueEx2
Reg_OpenSession
Reg_ReadAdapterInfo
Reg_ReadAndValidateQueryTimeouts
Reg_ReadGlobalInfo
Reg_ReadIpAdapterInfoEx
RegisterContext::InvokeCallback
ReleaseAndRebindDnsRpcGlobalBindingHandle
ReleaseAndRebindZtHelperRpcGlobalBindingHandle
ResolveContext::BuildInstance
ResolveContext::CancelQuery
ResolveContext::InvokeAddressCallbackInternal
ResolveContext::InvokeCallbackInternal
ResolveContext::StartDnsQueries
ResolveContext::StartMulticastAddressQueries
ResolveContext::StartMulticastQueries
ResolverGetCachedServerProperties
ResolverGetDohWellKnownServer
ResolverGetDotWellKnownServer
ResolverGetInterfaceProperties
RpcRecalculateDataLength
Rpc_PerformDnsQueryExCallback
Rpc_PerformDnsQueryRawCallback
Rpc_ProcessQueryResult
Rpc_QueryComplete
Rpc_ResolverQuery
Rpc_RetryQuery
SaveDnsRecords
SearchList_AddName
SearchList_BuildFromAdapter
SearchList_BuildFromPDN
SearchList_BuildFromRegistry
SearchList_ContainsName
SearchList_Parse
SendDohQueryToNetinfoServers
SendDotQueryToNetinfoServers
SendSecureQueryToServer
SendTcpMessage
SendUdpMessagePrivate
Send_AndRecv
Send_AndRecvComplete
Send_AndRecvDoh
Send_AndRecvDohAsync
Send_AndRecvDot
Send_AndRecvDotAsync
Send_AndRecvInitialize
Send_AndRecvSecureComplete
Send_AndRecvStart
Send_AndRecvTcp
Send_AndRecvUdpComplete
Send_CancelQuery
Send_FallbackToDotRequired
Send_FallbackToInsecureRequired
Send_GetAvailableDdrContext
Send_GetWorstFailureStatus
Send_OpenTcpConnectionAndSendEx
Send_PrepareDohBlob
Send_PrepareDotBlob
Send_PrepareWinhttpSession
Send_ProcessDohBlobStatus
Send_ProcessDotBlobStatus
Send_QueryToDdrServers
Send_RemoveCancelWait
Send_ResetMessageForFallback
Send_TcpConnectCompleteAsync
SetIgnoreAdapterFlagUsingInterfaceIndex
SetQueryRemoteServerInfo
Soa_RecordRead
Soa_RecordRead_New
Socket_CreateEx
Socket_CreateMessageSocket
Socket_CreateMessageSocketHelper
Socket_PrepareAsyncMessage
Socket_ProcessReturnStatus
Socket_SetInterfaceIndexSocketOption
Socket_SetMulticastInterface
StartDnsServiceOnDemand
StartZtHelperServiceOnDemand
SyncResolverQueryRpc
TcpCallbackConnectCompletion
TcpCallbackRecvCompletion
TcpConnectionConnect
TcpHandleReceivedMessage
ThreadPool_CreateWork
TimeoutDnsServers
TraceCustomServers
TraceRpcException
TraceSvcbData
Trace_ServerResponse
Tsig_RecordRead
Tsig_RecordRead_New
TxtRecordPrint
UpdateDnsConfig
UpdateDnsConfigPolicyTable
UpdateDnsHttpStatisticsFailureCounts
Update_MultiMaster
Update_MustPerformFallback
Update_Private
Update_Send
ValidateCustomServers
ValidateDnsQueryExParameters
ValidateSecureQueryFlags
WnfParams::StaticCallback
WriteNrptRulesToRegistry
WxConnectionDeleteProxyInfo
WxConnectionGetNameList
WxConnectionGetProxyInfo
WxConnectionGetProxyList
WxConnectionSetProxyInfo
WxGetFirstConnectedInterfaceFromConnectionsListEx
WxGetFirstConnectedInterfaceFromInterfaceList
WxGetModuleName
WxGetPersistedRegistryLocation
WxGetRegistryDword
WxGetRegistryString
WxIsInterfaceConnected
WxOpenRegistryKey
WxSetRegistryString
ZtServersConfigured
ZtTrustedServersIntersection
_CheckForDuplicateFriendlyName
_NormalizeConnectionName
_OpenProxyRegistryKey
_ProcessUserSIDInitOnceCallback
differentiateBroadcastQueries
getDefaultCredentialsHandle
idnQueryDepunify
idnQueryWireFormat
modifyRecordsInSetPrivate
netinfo_StrikeOutUnreachableDnsServers
privateRegReadStringValueW
privateRegReadValue
replaceRecordSetPrivate
resetServerAfterRecv
svcRegDeregMulticast
up_ReplaceAddressRecordsPrivate
validateDnsNamePrivate
|
Expand for full list:
AdapterInfo_CreateMulticastAddrs
AdapterInfo_GetNetworkAdapterList
AdapterInfo_UpdateDnsInterfaceConfig
AdapterInfo_UpdateNetworkSignature
AddDhcpConfiguration
AddDhcpv6ConfigurationArray
AddDhcpv6ConfigurationHelper
AddDnsAndDhcpConfiguration
AddDnsAndDhcpConfigurationHelper
AddDnsGlobalsToAdapter
AddDnsRulePolicyConfigAddDnsServerAddressesToAdapter
AddDnssdRegEntry
AddEntryToDnsPolicyTable
AddQMIPSECPolicy
AddRefDnsMessage
AddRefNetworkQueryBlob
AddSecureSocketOptions
AllocateDnsTcpConnection
AllocateMsgBuf
AppendServersAndPropertiesToAdapter
AsyncResolverQueryRPC
AtmaRecordPrint
BrowseContext::CancelQuery
BrowseContext::InvokeCallback
BuildAdapterInfo
BuildAdapterSearchList
BuildSearchList
CWxRpcBinding::CreateInstance
CWxRpcBinding::Initialize
CWxSelectableConnectionsEx::AcquireEx
CWxSelectableConnectionsEx::AcquireInternal
CheckDnsPolicyReachableStatus
CheckHostnameIpLiteral
CheckNrptRules
Coalesce_Complete
Coalesce_Lookup
CombinedQueryEx
ComputeIfIndex
Config_GetDnsServerList
ConnectionAppIdPolicyNode::CreateInstance
ConnectionAppIdPolicyNode::DeletePolicyNodes
ConnectionAppIdPolicyNode::Initialize
ConnectionAppIdPolicyNode::MatchHostPolicyRule
ConnectionAppIdPolicyNode::UpdateAppIdHostPolicyRules
ConnectionHostPolicyNode::CreateInstance
ConnectionHostPolicyNode::Initialize
ConnectionHostPolicyNode::MatchWithSuffixRules
ConnectionHostPolicyNode::SetHost
ConnectionHostPolicyNode::SetSuffixMatchingRules
ConnectionPolicyMap::AddPolicyRule
ConnectionPolicyMap::MatchPolicyRule
ConnectionToIfIndexesNode::AddIfIndex
ConnectionToIfIndexesNode::CreateInstance
ConnectionToIfIndexesNode::Initialize
ConvertAddrArrayToCustomServers
ConvertCustomServers
ConvertCustomServersOld
ConvertZtTrustedServersToCustomServers
CopyZtTrustedServerToInternalProperty
CountServerAddressesAndProperties
CreateCustomNetInfo
CreateDAPolicyObject
CreateGenericPolicyObject
CreateIPSECPolicy
CreatePersistedRegistryKeyHelper
CreateZtTrustedServerAddrArray
DdrCleanupTree
DdrCreateDohServerSettings
DdrCreateDotServerSettings
DdrCreateNetInfo
DdrExtractEncryptionSettings
DdrGetNode
DdrGetSvcbData
DdrIsAddressAllowed
DdrQueryAndVerifyServerCertChainContext
DdrRenewEntry::CreateInstance
DdrRenewTimerCallback
DdrSendAndRecv
DdrServerNode::AttachDdrContext
DdrServerNode::CreateInstance
DdrServerNode::GetDdrInfo
DdrServerNode::UpdateNode
DdrSkipCertVerification
DdrVerifyServerCert
DdrVerifyServerCertChainContext
DeRefDnsMessage
DeRefNetworkQueryBlob
DereferenceDAPolicyConfigNode
DereferenceDnsPolicyConfigNode
DereferenceDnsSecPolicyConfigNode
DereferenceDnsStatusObject
DereferenceGenericPolicyConfigNode
DereferenceIdnPolicyConfigNode
DnrConvertAddressToString
DnrConvertInstancesToServerProperties
DnrGetServerPropertiesFromAlpn
DnrGetServerPropertiesFromInstance
DnrIsAddressAllowed
DnrParseInstanceV4
DnrParseInstanceV6
DnrParseOptionV4
DnrParseOptionV6
DnrParseOptionV6_Old
DnsAddUdpSocketToCache
DnsAddrArray_AddSockaddr
DnsAddrArray_InitSingleWithSockaddr
DnsApiInit
DnsApiOnNetworkChange
DnsBuildDotHostInternal
DnsCancelQuery
DnsCancelQueryRaw
DnsCheckSecureUpdateResponse
DnsCleanupTcpConnectionsEx
DnsCleanupUdpSocketsCache
DnsConnectionDeletePolicyEntries
DnsConnectionGetHandleForHostUrlPrivate
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::AddConnectionIfIndexEntry
DnsConnectionInterfaceIndexTable::GetConnectionIfIndexes
DnsConnectionInterfaceIndexTable::GetConnectionNameForIfIndex
DnsConnectionInterfaceIndexTable::UpdateConnectionIfIndexes
DnsConnectionManager::AddDnsPolicyConfigurationEntry
DnsConnectionManager::ConnectionDeletePolicyEntries
DnsConnectionManager::ConnectionDeletePolicyEntriesRegistry
DnsConnectionManager::ConnectionSetPolicyEntries
DnsConnectionManager::ConnectionSetPolicyEntriesRegistry
DnsConnectionManager::ConnectionUpdateIfIndexTable
DnsConnectionManager::DeleteConnectionIfIndexTable
DnsConnectionManager::GetConnectionConfigForUrl
DnsConnectionManager::GetConnectionHandleForUrl
DnsConnectionManager::GetConnectionIfIndexes
DnsConnectionManager::GetConnectionNameForIfIndex
DnsConnectionManager::Initialize
DnsConnectionManager::ReadConnectionIfIndexTable
DnsConnectionManager::ReadConnectionPolicyRule
DnsConnectionManager::ReadConnectionPolicyRules
DnsConnectionManager::WriteConnectionIfIndexTable
DnsConnectionManager::WriteConnectionPolicyRule
DnsConnectionManagerInitOnce
DnsConnectionSetPolicyEntries
DnsConvertDotPort
DnsConvertInternalProperties
DnsConvertIpToServerKey
DnsConvertServerAddrToString
DnsConvertSockAddrToServerKey
DnsCopyInternalProperties
DnsCopyInternalProperty
DnsCopyProperty
DnsCreateDohUrl
DnsCreateInternalProperty
DnsCreateSocketClosingWork
DnsDdrContextCopyResults
DnsDdrContextValid
DnsDeRegisterLocalRpc
DnsDeleteSettings
DnsDeleteWellKnownServerProperty
DnsDhcpRemoveRegistrations
DnsDoSecureUpdate
DnsDoSecureUpdateHelper
DnsFlushResolverCache
DnsFlushResolverCacheEntry_W
DnsGetAdaptersInfo
DnsGetApplicationSettings
DnsGetCacheDataTableEx
DnsGetCacheRecords
DnsGetConfigRpc
DnsGetDdrInfoCallbackV1
DnsGetDdrInfoCallbackV2
DnsGetDdrInfoCancel
DnsGetDdrInfoPrivate
DnsGetDdrInfoPrivateV2
DnsGetDdrInfoRpc
DnsGetDdrInfoSendQuery
DnsGetDhcpServerPropertiesImpl
DnsGetDnrServerProperties
DnsGetDnrServerPropertiesOld
DnsGetDohPropertiesFromNetinfo
DnsGetDotPropertiesFromNetinfo
DnsGetEmptyDnsSocket
DnsGetInterfaceSettings
DnsGetInterfaceSettingsInProc
DnsGetInterfaceSettingsInProcImpl
DnsGetMulticastData
DnsGetMulticastDataRPC
DnsGetNetinfoProperties
DnsGetNetworkServers
DnsGetNonSecureServersFromNetinfo
DnsGetNrptRule
DnsGetNrptRuleNamesList
DnsGetPolicyTableInfo
DnsGetPolicyTableInfoPrivate
DnsGetPolicyTableInfoRpc
DnsGetProxyInformationEx
DnsGetProxyInformationRpc
DnsGetSettings
DnsGetSvcParams
DnsGetSvcbData
DnsGetSvcbTargetName
DnsGetUdpSocketFromCache
DnsGetWellKnownServerProperty
DnsGetWellKnownServers
DnsGetWinhttpSession
DnsGetZtClientCertConfig
DnsGetZtConfig
DnsGetZtFilterIds
DnsGetZtRules
DnsGetZtSettings
DnsGetZtTrustedCa
DnsGetZtTrustedServers
DnsInitDdr
DnsInitWinsock
DnsIsZtEnabled
DnsLogEvent
DnsNbt_Cancel
DnsNbt_CreateReverseRecords
DnsNbt_ResolveAddr
DnsNbt_ResolveName
DnsNotifyProxyConfigChangePrivate
DnsParseUnknownRecords
DnsPrint_AdapterInfo
DnsPrint_ExtraInfo
DnsPrint_Message
DnsPrint_MessageNoContext
DnsPrint_PacketRecord
DnsPrint_QueryState
DnsQueryConfig
DnsQueryDdrMap
DnsQueryEx
DnsQueryRaw
DnsRawBuildMessageResponse
DnsRawCreateQueryResult
DnsRawDetermineResponseProtocol
DnsRawFindOptRecord
DnsRawInitializeQueryInfo
DnsRawParseRawQuery
DnsRawProcessMessageResponse
DnsRawStartInlineCompletion
DnsRawTruncateMessageForUdp
DnsRawValidateDnsQueryRawParameters
DnsRegisterLocalRpc
DnsResolverOp
DnsResolverQueryHvsi
DnsSendAndRecvSync
DnsSendSecureUpdate
DnsServiceBrowse
DnsServiceDeRegister
DnsServiceRegister
DnsServiceResolve
DnsSetApplicationSettings
DnsSetInterfaceSettings
DnsSetNrptRules
DnsSetNrptRulesRpc
DnsSetSettings
DnsSetWellKnownServerProperty
DnsSetZtSettings
DnsShutdownWinsock
DnsSplitDotHostInternal
DnsStartMdnsQuery
DnsStartMulticastQueryImpl
DnsStartMulticastQueryRpc
DnsStopMdnsQuery
DnsStopMulticastQuery
DnsStopMulticastQueryRpc
DnsUpdateCaptivePortalPresence
DnsUpdateDdrSendBlob
DnsUpdateMachinePresence
DnsUpdateTest_W
DnsValidateDotPort
DnsWinhttpCreateSession
DnsZtHelperGetSettings
DnsZtHelperProcessClientCerts
DnsZtHelperPromoteConfig
DnsZtNotifyDnscache
DnsZtVerifyServerRootCa
Dns_AcquireCredHandle
Dns_AllocateMsgBufRpc
Dns_AllocateMsgBufRpc_New
Dns_BuildPacketInternal
Dns_CacheServiceInitEx
Dns_CapBufferSizeForEdns
Dns_CheckNrptRuleIntegrity
Dns_ConnectionDeletePolicyEntriesPrivate
Dns_ConnectionSetPolicyEntriesPrivate
Dns_CreateIpArray
Dns_ExtractGssTkeyFromMessage
Dns_ExtractGssTsigFromMessage
Dns_ExtractPacketFromMsgBuf
Dns_ExtractRecordsFromMessageEx
Dns_GetApplicationIdentifier
Dns_GetNetinfoProperties
Dns_InitClientSecurityContext
Dns_NameCompareEx
Dns_NegotiateTkeyWithServer
Dns_ReadNrptRuleFromRegistry
Dns_RecordBuild_A
Dns_RecordBuild_W
Dns_RecordCompare
Dns_RecordMinSize
Dns_RecvTcp
Dns_RefreshSSpiCredentialsHandle
Dns_RegisterLocal
Dns_SendServiceControl
Dns_SendTcpAsync
Dns_SetNrptRulesPrivate
Dns_SignMessageWithGssTsig
Dns_StringToDnsAddrEx
Dns_VerifySignatureOnPacket
Dns_WriteNrptRuleToRegistry
Dns_WriteRecordStructureToMessage
Dns_WriteRecordStructureToPacket
DoEKUCheck
DohContextAssignHttpStatus
DohContextAttachBlob
DohContextCreate
DohContextHandleHeadersAvailableCallback
DohContextHandleReadCompleteCallback
DohContextHandleSendRequestCompleteCallback
DohContextHandleSendingRequestCallback
DohContextPrepare
DohContextSend
DohCreateWinhttpStaticResolverCacheEntry
DotConnectionAttachBlob
DotConnectionCreate
DotConnectionGetHttpCompatServer
DotConnectionHandleReceivedMessage
DotConnectionIsReadyToSend
DotConnectionMap::RemoveIdleConnections
DotConnectionPostReceiveImpl
DotConnectionPrepareForSend
DotConnectionPrepareRequest
DotConnectionRemoveBlob
DotConnectionSendQuery
DotConnectionSendQueryImpl
DotConnectionSendUpgradeRequest
DotCreateWinhttpStaticResolverCacheEntry
DotHandleCompleteUpgradeCallback
DotHandleReadCompleteCallback
DotHandleUpgradeSendingCallback
DotUpdateReceivedBytes
DotWinhttpStatusCallback
DynDnsAddEntry
DynDnsAddForward
DynDnsAddForwardDhcid
DynDnsDeleteEntry
DynDnsDeleteForwards
DynDnsRegisterEntries
ExtractAdapterProperties
ExtractDAPolicyServers
ExtractGenericPolicyServers
Faz_AreServerListsInSameNameSpace
Faz_CollapseDnsServerListsForUpdate
Faz_GetNameServersListForDomain
FillZtTrustedServerProperties
FilterDnsServers
FindDohInternalSettings
FindPropertyOnAdapter
FindServerPropertyType
FindWellKnownDohProperty
FindWellKnownDotProperty
GetAppContainerSidFromToken
GetBestInterfaceIndex
GetCertConfig
GetCustomServersFromSettings
GetDevolutionLevelFromForestName
GetDnsResultsInString
GetDnsRpcBindingHandleRef
GetDnsRulePolicyConfig
GetDnsRulePolicyObjects
GetDnsServerRRSet
GetDnsServersString
GetIpAddressStringFromDnsAddrArray
GetNextQueryName
GetPolicyTableInfo
GetRegistryBinaryBlob
GetRegistryDword
GetRegistryMultiString
GetRegistryString
GetServerPropertiesByIndex
GetTcpConnection
GetWellKnownServers
GetXboxProductType
GetZtHelperRpcBindingHandleRef
HandleNonTcpResponse
HandleTcpResponse
IfIndexToConnectionNode::CreateInstance
IfIndexToConnectionNode::Initialize
InitializeDnsApiStatistics
InitializeDnsStatistics
InitializeTracePrivate
IpHelp_GetAdaptersAddresses
IpHelp_GetZtProbeAddrsAndProperties
IpHelp_GetZtdnsAddrsAndProperties
IpHelp_ReadAddrsAndPropertiesFromList
IpHelp_ReadAddrsAndPropertiesFromListImpl
IpHelp_ReadAddrsFromList
Ip_RegisterNotification
IsBehindCaptivePortal
IsBlobReachableUsingProtocol
IsCallerAllowedToTriggerVPN
IsDhcpRACoexistenceEnabled
IsDnsReachableOnAlternateInterface
IsDohQueryCompleted
IsDotQueryCompleted
IsEmptyDnsResponseFromResolver
IsMdnsAllowedOnNetwork
IsQueryDohCapable
IsQueryDotCapable
IsSKUDirectAccessEnabled
IsServiceNameLocal
LoadAutoDohTemplate
LoadAutoDotHost
LocalIp_IsAddrLocalEx
LocalIp_IsAddrLocalRegisterable
MarkSendBlobSecureProtocolUnreachable
MarshalDnsMsgBufFromRpcMsgBuf
MarshalDnsMsgBufFromRpcMsgBuf_New
MarshalDnsMsgBufToRpcMsgBuf
MarshalDnsMsgBufToRpcMsgBuf_New
MarshalDnsRecordListToRpcRecordList
MarshalDnsRecordListToRpcRecordList_New
MarshalDnsRecordToRpcRecord
MarshalDnsRecordToRpcRecord
MarshalRpcRecordListToDnsRecordList
MarshalRpcRecordToDnsRecord
MatchCertificateEKU
McastRegisterContext::CancelQuery
McastRegisterContext::InvokeCallback
MoveNRPTPropertiesToAdapter
NRPTLookupDdrServerProperty
NetInfo_BuildEx
NetInfo_BuildEx2
NetInfo_CloneForMulticast
NetInfo_CopyInternal
NetInfo_CreateForUpdate
NetInfo_CreateFromAddrArray
NetInfo_CreateFromNsResponse
NetInfo_CreateFromZtTrustedServers
NetInfo_CreateNRPTCopy
NetInfo_CreatePerNetworkNetinfo
NetInfo_FindEncryptedSettings
NetInfo_FindPropertyForServer
NetInfo_FindPropertyOnAllAdapters
NetInfo_FindPropertyOnBestAdapter
NetInfo_Get
NetInfo_GetLocalAddrArray
NetInfo_GetPropertiesForServers
NetInfo_NRPTLookupServerProperties
NetInfo_SetMulticastFlags
NetInfo_UpdateCaptivePortalPresence
NetInfo_UpdateNetworkProperties
NetInfo_UpdateServerReachability
NetworkQuery_BuildNetworkQueryBlob
NetworkQuery_BuildParallelQueryBlobs
NetworkQuery_ProcessComplete
NetworkQuery_QueueParallelNetworkQueries
NetworkQuery_QueueParallelQuery
OpenAdapterDhcpPersistedKey
OpenIPSECHandle
OpenRegistryPaths
Packet_AddRecordsToMessage
Packet_AllocateMsgBuf
Packet_GetRandomXid
Packet_ParseMessage
PrepareAsyncTcpMessageLocked
PrepareTcpConnectionIo
PrepareWinhttpRequestCommon
Ptr_RecordRead
Ptr_RecordRead_New
QueryDirectAccessServerReachable
QueryDirectEx
QueryRequiresTCP
Query_ActiveLearningModeCall
Query_AllLearningModeQueriesCancelled
Query_BroadcastComplete
Query_BroadcastHandleNonMulticastBlob
Query_BroadcastMulticastRequired
Query_BroadcastStart
Query_CacheEntry
Query_CancelLearningMode
Query_CancelNode
Query_CheckPtrAddrOffLink
Query_CreateMDNSBlob
Query_CreateMDNSContextForQueryBlob
Query_CreateNetBiosBlob
Query_DeRefBlobLearningModeTimer
Query_GetCompletedNetBiosMdns
Query_GetPtrDnsAddr
Query_InProcPrepare
Query_IsNetBiosRequired
Query_IsPreferedNetworkQuery
Query_LearningModeTimerCallback
Query_MDNS
Query_MDNSComplete
Query_MDNSCompleteCallback
Query_MDNSCompleteWork
Query_MDNSDualCompleteCallback
Query_MDNSDualTimerCallback
Query_MDNSProcessDualResults
Query_MDNSSerialTimerCallback
Query_MDNSStartSerialDual
Query_MDNSTimerCallback
Query_Main
Query_MatchAndGetlocalMachineRecord
Query_Multicast
Query_NetBios
Query_NextName
Query_PolicyTableDnsServer
Query_PrivateExW
Query_PrivateOld
Query_ProcessParallelQuery
Query_ProcessQuery
Query_ProcessQueryStatus
Query_ProcessResponse
Query_SingleNameDualAddr
Query_SingleNamePrivate
Query_SkipLearningMode
Query_StartLearningMode
Query_Wire
ReadDnsPolicyConfigInformation
ReadDnsPolicyTableConfigInfo
ReadHttpResponseData
ReadRegIpAdapterInfo
Recv_IoCompletionCallback
Recv_IsMsgStateProcessIo
Recv_ProcessTcpMessage
Recv_ProcessUdpResponse
Recv_SecureComplete
Recv_TimerCallback
Recv_Udp
Recv_UdpCallbackCompletion
Recv_UpdateControlInfo
ReferenceDAPolicyConfigNode
ReferenceDnsPolicyConfigNode
ReferenceDnsSecPolicyConfigNode
ReferenceDnsStatusObject
ReferenceGenericPolicyConfigNode
ReferenceIdnPolicyConfigNode
Reg_CreateKey
Reg_GetValueEx2
Reg_OpenSession
Reg_ReadAdapterInfo
Reg_ReadAndValidateQueryTimeouts
Reg_ReadGlobalInfo
Reg_ReadIpAdapterInfoEx
RegisterContext::InvokeCallback
ReleaseAndRebindDnsRpcGlobalBindingHandle
ReleaseAndRebindZtHelperRpcGlobalBindingHandle
ResolveContext::BuildInstance
ResolveContext::CancelQuery
ResolveContext::InvokeAddressCallbackInternal
ResolveContext::InvokeCallbackInternal
ResolveContext::StartDnsQueries
ResolveContext::StartMulticastAddressQueries
ResolveContext::StartMulticastQueries
ResolverGetCachedServerProperties
ResolverGetDohWellKnownServer
ResolverGetDotWellKnownServer
ResolverGetInterfaceProperties
RpcRecalculateDataLength
Rpc_PerformDnsQueryExCallback
Rpc_PerformDnsQueryRawCallback
Rpc_ProcessQueryResult
Rpc_QueryComplete
Rpc_ResolverQuery
Rpc_RetryQuery
SaveDnsRecords
SearchList_AddName
SearchList_BuildFromAdapter
SearchList_BuildFromPDN
SearchList_BuildFromRegistry
SearchList_ContainsName
SearchList_Parse
SendDohQueryToNetinfoServers
SendDotQueryToNetinfoServers
SendSecureQueryToServer
SendTcpMessage
SendUdpMessagePrivate
Send_AndRecv
Send_AndRecvComplete
Send_AndRecvDoh
Send_AndRecvDohAsync
Send_AndRecvDot
Send_AndRecvDotAsync
Send_AndRecvInitialize
Send_AndRecvSecureComplete
Send_AndRecvStart
Send_AndRecvTcp
Send_AndRecvUdpComplete
Send_CancelQuery
Send_FallbackToDotRequired
Send_FallbackToInsecureRequired
Send_GetAvailableDdrContext
Send_GetWorstFailureStatus
Send_OpenTcpConnectionAndSendEx
Send_PrepareDohBlob
Send_PrepareDotBlob
Send_PrepareWinhttpSession
Send_ProcessDohBlobStatus
Send_ProcessDotBlobStatus
Send_QueryToDdrServers
Send_RemoveCancelWait
Send_ResetMessageForFallback
Send_TcpConnectCompleteAsync
SetIgnoreAdapterFlagUsingInterfaceIndex
SetQueryRemoteServerInfo
Soa_RecordRead
Soa_RecordRead_New
Socket_CreateEx
Socket_CreateMessageSocket
Socket_CreateMessageSocketHelper
Socket_PrepareAsyncMessage
Socket_ProcessReturnStatus
Socket_SetInterfaceIndexSocketOption
Socket_SetMulticastInterface
StartDnsServiceOnDemand
StartZtHelperServiceOnDemand
SyncResolverQueryRpc
TcpCallbackConnectCompletion
TcpCallbackRecvCompletion
TcpConnectionConnect
TcpHandleReceivedMessage
ThreadPool_CreateWork
TimeoutDnsServers
TraceCustomServers
TraceRpcException
TraceSvcbData
Trace_ServerResponse
Tsig_RecordRead
Tsig_RecordRead_New
TxtRecordPrint
UpdateDnsConfig
UpdateDnsConfigPolicyTable
UpdateDnsHttpStatisticsFailureCounts
Update_MultiMaster
Update_MustPerformFallback
Update_Private
Update_Send
ValidateCustomServers
ValidateDnsQueryExParameters
ValidateSecureQueryFlags
WnfParams::StaticCallback
WriteNrptRulesToRegistry
WxConnectionDeleteProxyInfo
WxConnectionGetNameList
WxConnectionGetProxyInfo
WxConnectionGetProxyList
WxConnectionSetProxyInfo
WxGetFirstConnectedInterfaceFromConnectionsListEx
WxGetFirstConnectedInterfaceFromInterfaceList
WxGetModuleName
WxGetPersistedRegistryLocation
WxGetRegistryDword
WxGetRegistryString
WxIsInterfaceConnected
WxOpenRegistryKey
WxSetRegistryString
ZtServersConfigured
ZtTrustedServersIntersection
_CheckForDuplicateFriendlyName
_NormalizeConnectionName
_OpenProxyRegistryKey
_ProcessUserSIDInitOnceCallback
differentiateBroadcastQueries
getDefaultCredentialsHandle
idnQueryDepunify
idnQueryWireFormat
modifyRecordsInSetPrivate
netinfo_StrikeOutUnreachableDnsServers
privateRegReadStringValueW
privateRegReadValue
replaceRecordSetPrivate
resetServerAfterRecv
svcRegDeregMulticast
up_ReplaceAddressRecordsPrivate
validateDnsNamePrivate
| |paramcount|4|4| |address|1800ddcc8|1800ddcc8| |sig|undefined __fastcall WPP_SF_D(undefined2 param_1, ushort param_2, ULONGLONG param_3, undefined4 param_4)|undefined __fastcall WPP_SF_D(undefined2 param_1, ushort param_2, ULONGLONG param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_D Calling Diff ```diff ``` ## wil_details_IsEnabledFallback ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|21|22| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|
Expand for full list:
Feature_4431_4260__private_IsEnabledDeviceUsageNoInline
Feature_4920_0542__private_IsEnabledDeviceUsageNoInline
Feature_5435_3763__private_IsEnabledDeviceUsageNoInline
Feature_5613_5360__private_IsEnabledDeviceUsageNoInline
Feature_58976313__private_IsEnabledDeviceUsageNoInline
Feature_59369936__private_IsEnabledDeviceUsageNoInline
Feature_5977_1413__private_IsEnabledDeviceUsageNoInline
Feature_60007457__private_IsEnabledDeviceUsageNoInline
Feature_6054_0215__private_IsEnabledDeviceUsageNoInline
Feature_60565085__private_IsEnabledDeviceUsageNoInline
Feature_6070_2536__private_IsEnabledDeviceUsageNoInlineFeature_6070_2693__private_IsEnabledDeviceUsageNoInline
Feature_6071_2647__private_IsEnabledDeviceUsageNoInline
Feature_60742575__private_IsEnabledDeviceUsageNoInline
Feature_6093_9448__private_IsEnabledDeviceUsageNoInline
Feature_61108950__private_IsEnabledDeviceUsageNoInline
Feature_61477584__private_IsEnabledDeviceUsageNoInline
Feature_CLAT_PREF64_FromDNS__private_IsEnabledDeviceUsageNoInline
Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
Feature_WinInetCacheAppBrokerForUWPMediumIL__private_IsEnabledDeviceUsageNoInline
|
Expand for full list:
Feature_2032384314__private_IsEnabledDeviceUsageNoInline
Feature_4431_4260__private_IsEnabledDeviceUsageNoInline
Feature_4920_0542__private_IsEnabledDeviceUsageNoInline
Feature_5435_3763__private_IsEnabledDeviceUsageNoInline
Feature_5613_5360__private_IsEnabledDeviceUsageNoInline
Feature_58976313__private_IsEnabledDeviceUsageNoInline
Feature_59369936__private_IsEnabledDeviceUsageNoInline
Feature_5977_1413__private_IsEnabledDeviceUsageNoInline
Feature_60007457__private_IsEnabledDeviceUsageNoInline
Feature_6054_0215__private_IsEnabledDeviceUsageNoInline
Feature_60565085__private_IsEnabledDeviceUsageNoInlineFeature_6070_2536__private_IsEnabledDeviceUsageNoInline
Feature_6070_2693__private_IsEnabledDeviceUsageNoInline
Feature_6071_2647__private_IsEnabledDeviceUsageNoInline
Feature_60742575__private_IsEnabledDeviceUsageNoInline
Feature_6093_9448__private_IsEnabledDeviceUsageNoInline
Feature_61108950__private_IsEnabledDeviceUsageNoInline
Feature_61477584__private_IsEnabledDeviceUsageNoInline
Feature_CLAT_PREF64_FromDNS__private_IsEnabledDeviceUsageNoInline
Feature_ModernWpp__private_IsEnabledDeviceUsageNoInline
Feature_WinInetCacheAppBrokerForUWPMediumIL__private_IsEnabledDeviceUsageNoInline
| |paramcount|3|3| |`address`|1800abfe4|1800ab890| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -0,0 +1 @@ +Feature_2032384314__private_IsEnabledDeviceUsageNoInline ``` ## memcpy_s ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,length,sig,address,called| |ratio|0.15| |i_ratio|0.0| |m_ratio|0.04| |b_ratio|0.04| |match_types|SymbolsHash| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|memcpy_s|memcpy_s| |fullname|memcpy_s|memcpy_s| |`refcount`|12|13| |`length`|6|149| |`called`||API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno
_invalid_parameter_noinfo
memcpy
memset| |calling|wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details::WriteResultString
wil::details::WriteResultString
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write
wil::details_abi::heap_buffer::push_back
wil::details_abi::heap_buffer::reserve|wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details::WriteResultString
wil::details::WriteResultString
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write
wil::details_abi::heap_buffer::push_back
wil::details_abi::heap_buffer::reserve| |paramcount|0|4| |`address`|180082d04|1800aae4c| |`sig`|undefined memcpy_s(void)|errno_t __cdecl memcpy_s(void * _Dst, rsize_t _DstSize, void * _Src, rsize_t _MaxCount)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### memcpy_s Called Diff ```diff --- memcpy_s called +++ memcpy_s called @@ -0,0 +1,4 @@ +API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__errno +_invalid_parameter_noinfo +memcpy +memset ``` ## StringCchCatW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExactBytesFunctionHasher| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCatW|StringCchCatW| |fullname|StringCchCatW|StringCchCatW| |`refcount`|6|2| |length|205|205| |called||| |`calling`|Dns_ReadDwordEnvar
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal|Dns_ReadDwordEnvar| |paramcount|3|3| |`address`|180050688|1800506d8| |sig|HRESULT __stdcall StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)|HRESULT __stdcall StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### StringCchCatW Calling Diff ```diff --- StringCchCatW calling +++ StringCchCatW calling @@ -2,2 +1,0 @@ -wil::details_abi::SemaphoreValue::CreateFromValueInternal -wil::details_abi::SemaphoreValue::TryGetValueInternal ``` ## StringCchCopyW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExactBytesFunctionHasher| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCopyW|StringCchCopyW| |fullname|StringCchCopyW|StringCchCopyW| |`refcount`|21|19| |length|102|102| |called||| |`calling`|
Expand for full list:
AddDHCPDomainSearchListToAdapter
AddDhcpv6ConfigurationArray
AddDnsConfiguration
BuildServerArrayAndList
CheckDnsPolicyReachableStatus
DhcpSrv_RegisterHostAddr
DnsNbt_ResolveName
DnsSplitServiceName
Dns_AllocateAndInitializeCredentialsW
Dns_AllocateCredentials
Dns_ReadDwordEnvarDotConnectionGetHttpCompatServer
MDns_IncrementName
idnQueryWireFormat
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
|
Expand for full list:
AddDHCPDomainSearchListToAdapter
AddDhcpv6ConfigurationArray
AddDnsConfiguration
BuildServerArrayAndList
CheckDnsPolicyReachableStatus
DhcpSrv_RegisterHostAddr
DnsNbt_ResolveName
DnsSplitServiceName
Dns_AllocateAndInitializeCredentialsW
Dns_AllocateCredentials
Dns_ReadDwordEnvarDotConnectionGetHttpCompatServer
MDns_IncrementName
idnQueryWireFormat
| |paramcount|3|3| |`address`|180036cb0|180036cc0| |sig|HRESULT __stdcall StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)|HRESULT __stdcall StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### StringCchCopyW Calling Diff ```diff --- StringCchCopyW calling +++ StringCchCopyW calling @@ -15,2 +14,0 @@ -wil::details_abi::SemaphoreValue::CreateFromValueInternal -wil::details_abi::SemaphoreValue::TryGetValueInternal ``` ## StringCchCopyA ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.69| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExactInstructionsFunctionHasher| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchCopyA|StringCchCopyA| |fullname|StringCchCopyA|StringCchCopyA| |`refcount`|18|17| |length|49|49| |called|StringCopyWorkerA
StringValidateDestW|StringCopyWorkerA
StringValidateDestW| |`calling`|AtmaRecordCopy
Dns_AllocateAndInitializeCredentialsA
Dns_KeyRecordFlagToString
HostsFile_OpenRESLIB
UpdateDnsQueryStatisticsFailureCounts
Wks_RecordBuildA
Wks_RecordBuildW
Wks_RecordRead
Wks_RecordRead_New
wil::details::GetModuleInformation|AtmaRecordCopy
Dns_AllocateAndInitializeCredentialsA
Dns_KeyRecordFlagToString
HostsFile_OpenRESLIB
UpdateDnsQueryStatisticsFailureCounts
Wks_RecordBuildA
Wks_RecordBuildW
Wks_RecordRead
Wks_RecordRead_New| |paramcount|3|3| |`address`|18006b534|18006b504| |sig|HRESULT __stdcall StringCchCopyA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPCSTR pszSrc)|HRESULT __stdcall StringCchCopyA(STRSAFE_LPSTR pszDest, size_t cchDest, STRSAFE_LPCSTR pszSrc)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### StringCchCopyA Calling Diff ```diff --- StringCchCopyA calling +++ StringCchCopyA calling @@ -10 +9,0 @@ -wil::details::GetModuleInformation ``` ## StringCchPrintfW ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.96| |m_ratio|1.0| |b_ratio|1.0| |match_types|ExactInstructionsFunctionHasher| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|14|12| |length|142|142| |called|__security_check_cookie
_vsnwprintf_s|__security_check_cookie
_vsnwprintf_s| |`calling`|
Expand for full list:
CreateIpAdaptersInfoList
DnsAddr_WriteIpString_W
DnsBuildDotHostInternal
DnsEtwTraceSendQueryToDnsServer
DnsNbt_Open
Dns_DnsAddrToString_W
MDns_IncrementName
MakeCredKey
Trace_ServerResponse
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
|CreateIpAdaptersInfoList
DnsAddr_WriteIpString_W
DnsBuildDotHostInternal
DnsEtwTraceSendQueryToDnsServer
DnsNbt_Open
Dns_DnsAddrToString_W
MDns_IncrementName
MakeCredKey
Trace_ServerResponse| |paramcount|3|3| |address|18000de5c|18000de5c| |sig|HRESULT __stdcall StringCchPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, ...)|HRESULT __stdcall StringCchPrintfW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, ...)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -10,2 +9,0 @@ -wil::details_abi::ProcessLocalStorageData::Acquire -wil::details_abi::ProcessLocalStorageData::Acquire ``` ## wil_details_GetNtDllProcedureAddress ### Match Info |Key|dns_8328.dll - dns_8457.dll| | :---: | :---: | |diff_type|refcount,length,sig,address,calling,called| |ratio|0.36| |i_ratio|0.5| |m_ratio|0.75| |b_ratio|0.42| |match_types|Implied Match| ### Function Meta Diff |Key|dns_8328.dll|dns_8457.dll| | :---: | :---: | :---: | |name|wil_details_GetNtDllProcedureAddress|wil_details_GetNtDllProcedureAddress| |fullname|wil_details_GetNtDllProcedureAddress|wil_details_GetNtDllProcedureAddress| |`refcount`|3|9| |`length`|65|32| |`called`|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW|wil_details_GetNtDllModuleHandle| |`calling`|wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage|wil::details::RtlDllShutdownInProgress
wil::details::RtlNtStatusToDosErrorNoTeb
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData
wil_details_RtlRegisterFeatureConfigurationChangeNotification| |paramcount|1|1| |`address`|1800abf98|1800aa4b8| |`sig`|undefined __fastcall wil_details_GetNtDllProcedureAddress(LPCSTR param_1)|_func___int64 * __cdecl wil_details_GetNtDllProcedureAddress(char * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### wil_details_GetNtDllProcedureAddress Called Diff ```diff --- wil_details_GetNtDllProcedureAddress called +++ wil_details_GetNtDllProcedureAddress called @@ -1 +1 @@ -API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleW +wil_details_GetNtDllModuleHandle ``` ### wil_details_GetNtDllProcedureAddress Calling Diff ```diff --- wil_details_GetNtDllProcedureAddress calling +++ wil_details_GetNtDllProcedureAddress calling @@ -0,0 +1,3 @@ +wil::details::RtlDllShutdownInProgress +wil::details::RtlNtStatusToDosErrorNoTeb +wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> @@ -2,0 +6,3 @@ +wil_details_NtQueryWnfStateData +wil_details_NtUpdateWnfStateData +wil_details_RtlRegisterFeatureConfigurationChangeNotification ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-22T11:43:01