# es-pre.dll-es-post.dll Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [IsEmptyOrBSTR](#isemptyorbstr)
	* [ValidatePropertyBag](#validatepropertybag)
* [Modified](#modified)
	* [InMemoryRegRow::PutPropertyBag](#inmemoryregrowputpropertybag)
	* [RegistryRegRow::PutPropertyBag](#registryregrowputpropertybag)
	* [CSubscription2::Store](#csubscription2store)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [Activate](#activate)
	* [API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy](#api-ms-win-core-com-l1-1-1dllpropvariantcopy)
	* [API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree](#api-ms-win-core-heap-l2-1-0dlllocalfree)
	* [GetBaseKey](#getbasekey)
	* [~CallerTokenProperties](#callertokenproperties)
	* [QueryInterface](#queryinterface)
	* [isKeyEqual](#iskeyequal)
	* [LockWrite](#lockwrite)
	* [PutValue](#putvalue)
	* [IsNew](#isnew)
	* [UnlockWrite](#unlockwrite)
	* [API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear](#api-ms-win-core-com-l1-1-1dllpropvariantclear)
	* [NotifyChangedSubscription](#notifychangedsubscription)

# Visual Chart Diff



```mermaid

flowchart LR

InMemoryRegRowPutPropertyBag-4-old<--Match 68%-->InMemoryRegRowPutPropertyBag-4-new
RegistryRegRowPutPropertyBag-4-old<--Match 99%-->RegistryRegRowPutPropertyBag-4-new
CSubscription2Store-11-old<--Match 35%-->CSubscription2Store-11-new

subgraph es-post.dll
    InMemoryRegRowPutPropertyBag-4-new
RegistryRegRowPutPropertyBag-4-new
CSubscription2Store-11-new
    subgraph Added
direction LR
IsEmptyOrBSTR
    ValidatePropertyBag
end
end

subgraph es-pre.dll
    InMemoryRegRowPutPropertyBag-4-old
RegistryRegRowPutPropertyBag-4-old
CSubscription2Store-11-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.9465%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 3738
```



```mermaid
pie showData
    title Matched Function Similarity - 99.5185%
"matched_funcs_with_code_changes_len" : 3
"matched_funcs_with_non_code_changes_len" : 15
"matched_funcs_no_changes_len" : 3720
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ./proj --project-name es-41033 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 es-pre.dll es-post.dll
```


#### Verbose Args


<details>

```
--old ['es-pre.dll'] --new [['es-post.dll']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name es-41033 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/ES.DLL/6280736875000/ES.DLL -O es.dll.x64.10.0.14393.5127
wget https://msdl.microsoft.com/download/symbols/ES.DLL/63368C2275000/ES.DLL -O es.dll.x64.10.0.14393.5427
```


## Binary Metadata Diff


```diff
--- es-pre.dll Meta
+++ es-post.dll Meta
@@ -1,44 +1,44 @@
-Program Name: es-pre.dll
+Program Name: es-post.dll
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 180000000
 Maximum Address: ff0000184f
 # of Bytes: 469168
 # of Memory Blocks: 9
-# of Instructions: 67121
-# of Defined Data: 9109
-# of Functions: 1869
-# of Symbols: 12469
+# of Instructions: 67077
+# of Defined Data: 9107
+# of Functions: 1871
+# of Symbols: 12476
 # of Data Types: 1395
 # of Data Type Categories: 73
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Sun Aug 16 16:46:36 SGT 2026
+Date Created: Sun Aug 16 16:46:40 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/es-41033/es-pre.dll
-Executable MD5: 5e5738ca2d1a3253227821082edf3b22
-Executable SHA256: a8240c2690b6ef5b8792e8f2baec6f282445073efea17d275d16f7a5079daf56
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/es-41033/es-pre.dll?MD5=5e5738ca2d1a3253227821082edf3b22
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/es-41033/es-post.dll
+Executable MD5: d5b0bd83918122d5d3ae6c6a01e0fc43
+Executable SHA256: eb6fbbefd6b16ef0cd80356ce1ae6af87478bbabed8b09bf29356a138782bb5e
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/es-41033/es-post.dll?MD5=d5b0bd83918122d5d3ae6c6a01e0fc43
 PDB Age: 1
 PDB File: ES.pdb
-PDB GUID: 0903ea7a-e84f-4bdb-9f62-81b97df064bc
+PDB GUID: c26b952f-bb36-4e76-9f33-b2dd28deea37
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: COM+
-PE Property[FileVersion]: 2001.12.10941.16384 (rs1_release_inmarket.220514-1756)
+PE Property[FileVersion]: 2001.12.10941.16384 (rs1_release.220929-2054)
 PE Property[InternalName]: ES.DLL
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: ES.DLL
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.14393.5127
+PE Property[ProductVersion]: 10.0.14393.5427
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra es-pre.dll Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra es-pre.dll Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra es-pre.dll Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra es-post.dll Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra es-post.dll Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra es-post.dll Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|18|
|added_symbols_len|0|
|deleted_symbols_len|0|
|diff_time|6.6032538414001465|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 1780, 'ExternalsName': 309, 'ExactInstructionsFunctionHasher': 45, 'StructuralGraphHash': 43, 'BSIM': 15, 'ExactBytesFunctionHasher': 4, 'BulkInstructionHash': 3, 'SigCallingCalledHasher': 1})|
|items_to_process|20|
|diff_types|Counter({'refcount': 16, 'address': 15, 'calling': 12, 'called': 4, 'code': 3, 'length': 3})|
|unmatched_funcs_len|2|
|total_funcs_len|3740|
|matched_funcs_len|3738|
|matched_funcs_with_code_changes_len|3|
|matched_funcs_with_non_code_changes_len|15|
|matched_funcs_no_changes_len|3720|
|match_func_similarity_percent|99.5185%|
|func_match_overall_percent|99.9465%|
|first_matches|Counter({'SymbolsHash': 1780, 'ExactInstructionsFunctionHasher': 45, 'StructuralGraphHash': 43, 'BSIM': 15, 'ExactBytesFunctionHasher': 4, 'BulkInstructionHash': 3, 'SigCallingCalledHasher': 1})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 1780
"ExternalsName" : 309
"ExactBytesFunctionHasher" : 4
"ExactInstructionsFunctionHasher" : 45
"BSIM" : 15
"BulkInstructionHash" : 3
"SigCallingCalledHasher" : 1
"StructuralGraphHash" : 43
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 1780
"ExactBytesFunctionHasher" : 4
"ExactInstructionsFunctionHasher" : 45
"BSIM" : 15
"BulkInstructionHash" : 3
"SigCallingCalledHasher" : 1
"StructuralGraphHash" : 43
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 18
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 0
"deleted_symbols_len" : 0
```

## Strings


*No string differences found*

# Deleted

# Added

## IsEmptyOrBSTR

### Function Meta



|Key|es-post.dll|
| :---: | :---: |
|name|IsEmptyOrBSTR|
|fullname|IsEmptyOrBSTR|
|refcount|3|
|length|12|
|called||
|calling|CSubscription2::Store|
|paramcount|1|
|address|18003d028|
|sig|bool __cdecl IsEmptyOrBSTR(tagPROPVARIANT * param_1)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|


```diff
--- IsEmptyOrBSTR
+++ IsEmptyOrBSTR
@@ -0,0 +1,9 @@
+
+/* bool __cdecl IsEmptyOrBSTR(struct tagPROPVARIANT const & __ptr64) */
+
+bool __cdecl IsEmptyOrBSTR(tagPROPVARIANT *param_1)
+
+{
+  return (*(ushort *)param_1 & 0xfff7) == 0;
+}
+

```


## ValidatePropertyBag

### Function Meta



|Key|es-post.dll|
| :---: | :---: |
|name|ValidatePropertyBag|
|fullname|ValidatePropertyBag|
|refcount|2|
|length|42|
|called||
|calling|InMemoryRegRow::PutPropertyBag<br>RegistryRegRow::PutPropertyBag|
|paramcount|2|
|address|18003e984|
|sig|long __cdecl ValidatePropertyBag(tagPROPVARIANT * param_1, tagPROPVARIANT * param_2)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|


```diff
--- ValidatePropertyBag
+++ ValidatePropertyBag
@@ -0,0 +1,13 @@
+
+/* long __cdecl ValidatePropertyBag(struct tagPROPVARIANT const * __ptr64,struct tagPROPVARIANT
+   const * __ptr64) */
+
+long __cdecl ValidatePropertyBag(tagPROPVARIANT *param_1,tagPROPVARIANT *param_2)
+
+{
+  if ((*(short *)param_1 == 0x101f) && (*(short *)param_2 == 0x100c)) {
+    return -(uint)(*(int *)(param_1 + 8) != *(int *)(param_2 + 8)) & 0x80070057;
+  }
+  return -0x7ff8ffa9;
+}
+

```


# Modified


*Modified functions contain code changes*
## InMemoryRegRow::PutPropertyBag

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|code,refcount,length,address,calling,called|
|ratio|0.25|
|i_ratio|0.47|
|m_ratio|0.97|
|b_ratio|0.68|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|PutPropertyBag|PutPropertyBag|
|fullname|InMemoryRegRow::PutPropertyBag|InMemoryRegRow::PutPropertyBag|
|`refcount`|6|3|
|`length`|421|422|
|`called`|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy<br>InMemoryRegRow::MapPropertyBag::CreatePropertyBag<br>InMemoryRegRow::MapPropertyBag::`scalar_deleting_destructor'<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::add<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::map<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::remove<br>WStringCopy|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy<br>InMemoryRegRow::MapPropertyBag::CreatePropertyBag<br>InMemoryRegRow::MapPropertyBag::`scalar_deleting_destructor'<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::add<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::map<br>Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>::remove<br>ValidatePropertyBag<br>WStringCopy|
|`calling`|CSubscription2::Store||
|paramcount|4|4|
|`address`|18000fe20|18000fbc0|
|sig|long __thiscall PutPropertyBag(InMemoryRegRow * this, ushort * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3)|long __thiscall PutPropertyBag(InMemoryRegRow * this, ushort * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|ANALYSIS|
|external|False|False|

### InMemoryRegRow::PutPropertyBag Called Diff


```diff
--- InMemoryRegRow::PutPropertyBag called
+++ InMemoryRegRow::PutPropertyBag called
@@ -6,0 +7 @@
+ValidatePropertyBag
```


### InMemoryRegRow::PutPropertyBag Calling Diff


```diff
--- InMemoryRegRow::PutPropertyBag calling
+++ InMemoryRegRow::PutPropertyBag calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


### InMemoryRegRow::PutPropertyBag Diff


```diff
--- InMemoryRegRow::PutPropertyBag
+++ InMemoryRegRow::PutPropertyBag
@@ -1,103 +1,112 @@
 
 /* public: virtual long __cdecl InMemoryRegRow::PutPropertyBag(unsigned short const * __ptr64,struct
    tagPROPVARIANT * __ptr64,struct tagPROPVARIANT * __ptr64) __ptr64 */
 
 long __thiscall
 InMemoryRegRow::PutPropertyBag
           (InMemoryRegRow *this,ushort *param_1,tagPROPVARIANT *param_2,tagPROPVARIANT *param_3)
 
 {
   Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
   *this_00;
-  int iVar1;
+  long lVar1;
+  int iVar2;
   MapPropertyBag *this_01;
-  ushort *puVar2;
+  ushort *puVar3;
   PROPVARIANT *pvarSrc;
-  ushort **ppuVar3;
-  MapPropertyBag **ppMVar4;
-  uint uVar5;
+  ushort **ppuVar4;
+  MapPropertyBag **ppMVar5;
   ulonglong uVar6;
+  tagPROPVARIANT *ptVar7;
+  uint uVar8;
   MapPropertyBag *local_res10;
   MapPropertyBag *local_38;
   ushort *local_30;
   
+  uVar6 = 0;
   local_res10 = (MapPropertyBag *)0x0;
   if (param_1 == (ushort *)0x0) {
-    iVar1 = -0x7ff8ffa9;
+    lVar1 = -0x7ff8ffa9;
   }
   else if (((param_2 == (tagPROPVARIANT *)0x0) || (param_3 == (tagPROPVARIANT *)0x0)) ||
-          (*(ulong *)(param_2 + 8) == 0)) {
-    iVar1 = 1;
+          (*(int *)(param_2 + 8) == 0)) {
+    lVar1 = 1;
   }
   else {
-    pvarSrc = (PROPVARIANT *)param_1;
-    this_01 = MapPropertyBag::CreatePropertyBag(*(ulong *)(param_2 + 8));
-    if (this_01 == (MapPropertyBag *)0x0) {
-      iVar1 = -0x7ff8fff2;
-    }
-    else {
-      uVar6 = 0;
-      local_38 = this_01;
-      if (*(int *)(this_01 + 0x10) != 0) {
-        do {
-          uVar5 = (uint)pvarSrc;
-          puVar2 = *(ushort **)(*(longlong *)(param_2 + 0x10) + uVar6 * 8);
-          if (puVar2 == (ushort *)0x0) {
-            iVar1 = -0x7ff8ffa9;
-            goto LAB_0;
-          }
-          puVar2 = WStringCopy(puVar2);
-          *(ushort **)(*(longlong *)this_01 + uVar6 * 8) = puVar2;
-          if (*(longlong *)(*(longlong *)this_01 + uVar6 * 8) == 0) goto LAB_1;
-          pvarSrc = (PROPVARIANT *)(*(longlong *)(param_3 + 0x10) + uVar6 * 0x18);
-          iVar1 = PropVariantCopy((PROPVARIANT *)(*(longlong *)(this_01 + 8) + uVar6 * 0x18),pvarSrc
-                                 );
-          uVar5 = (uint)pvarSrc;
-          if (iVar1 != 0) goto LAB_2;
-          uVar5 = (int)uVar6 + 1;
-          uVar6 = (ulonglong)uVar5;
-        } while (uVar5 < *(uint *)(this_01 + 0x10));
-      }
-      this_00 = (Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
-                 *)(this + 0x50);
-      ppuVar3 = &local_30;
-      local_30 = param_1;
-      iVar1 = Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
-              ::map(this_00,ppuVar3,&local_res10);
-      uVar5 = (uint)ppuVar3;
-      if (iVar1 != 0) {
-        ppuVar3 = &local_30;
-        local_30 = param_1;
-        Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
-        ::remove(this_00,ppuVar3);
-        uVar5 = (uint)ppuVar3;
-        if (local_res10 != (MapPropertyBag *)0x0) {
-          MapPropertyBag::_scalar_deleting_destructor_(local_res10,uVar5);
-        }
-      }
-      local_res10 = (MapPropertyBag *)WStringCopy(param_1);
-      if (local_res10 == (MapPropertyBag *)0x0) {
-LAB_1:
-        iVar1 = -0x7ff8fff2;
+    pvarSrc = param_3;
+    ptVar7 = param_2;
+    lVar1 = ValidatePropertyBag(param_2,param_3);
+    if (-1 < lVar1) {
+      this_01 = MapPropertyBag::CreatePropertyBag(*(ulong *)(ptVar7 + 8));
+      if (this_01 == (MapPropertyBag *)0x0) {
+        lVar1 = -0x7ff8fff2;
       }
       else {
-        *(MapPropertyBag **)(this_01 + 0x18) = local_res10;
-        ppMVar4 = &local_res10;
-        iVar1 = Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
-                ::add(this_00,(ushort **)ppMVar4,&local_38);
-        uVar5 = (uint)ppMVar4;
-        this_01 = local_38;
+        local_38 = this_01;
+        if (*(int *)(this_01 + 0x10) != 0) {
+          do {
+            uVar8 = (uint)pvarSrc;
+            puVar3 = *(ushort **)(*(longlong *)(param_2 + 0x10) + uVar6 * 8);
+            if (puVar3 == (ushort *)0x0) {
+LAB_0:
+              uVar8 = (uint)pvarSrc;
+              lVar1 = -0x7ff8ffa9;
+              goto LAB_1;
+            }
+            puVar3 = WStringCopy(puVar3);
+            *(ushort **)(*(longlong *)this_01 + uVar6 * 8) = puVar3;
+            if (*(longlong *)(*(longlong *)this_01 + uVar6 * 8) == 0) goto LAB_2;
+            pvarSrc = (PROPVARIANT *)(*(longlong *)(param_3 + 0x10) + uVar6 * 0x18);
+            if ((*(ushort *)pvarSrc & 0x4000) != 0) goto LAB_0;
+            lVar1 = PropVariantCopy((PROPVARIANT *)(*(longlong *)(this_01 + 8) + uVar6 * 0x18),
+                                    pvarSrc);
+            uVar8 = (uint)pvarSrc;
+            if (lVar1 != 0) goto LAB_3;
+            uVar8 = (int)uVar6 + 1;
+            uVar6 = (ulonglong)uVar8;
+          } while (uVar8 < *(uint *)(this_01 + 0x10));
+        }
+        this_00 = (Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
+                   *)(this + 0x50);
+        ppuVar4 = &local_30;
+        local_30 = param_1;
+        iVar2 = Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
+                ::map(this_00,ppuVar4,&local_res10);
+        uVar8 = (uint)ppuVar4;
+        if (iVar2 != 0) {
+          ppuVar4 = &local_30;
+          local_30 = param_1;
+          Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
+          ::remove(this_00,ppuVar4);
+          uVar8 = (uint)ppuVar4;
+          if (local_res10 != (MapPropertyBag *)0x0) {
+            MapPropertyBag::_scalar_deleting_destructor_(local_res10,uVar8);
+          }
+        }
+        local_res10 = (MapPropertyBag *)WStringCopy(param_1);
+        if (local_res10 == (MapPropertyBag *)0x0) {
 LAB_2:
-        if (-1 < iVar1) {
-          return iVar1;
+          lVar1 = -0x7ff8fff2;
         }
-      }
-LAB_0:
-      if (this_01 != (MapPropertyBag *)0x0) {
-        MapPropertyBag::_scalar_deleting_destructor_(this_01,uVar5);
+        else {
+          *(MapPropertyBag **)(this_01 + 0x18) = local_res10;
+          ppMVar5 = &local_res10;
+          lVar1 = Map<unsigned_short*___ptr64,struct_InMemoryRegRow::MapPropertyBag*___ptr64,class_InMemoryRegRow::HashCaseInsentitiveWSTR,class_InMemoryRegRow::CNonFailFastingAllocator>
+                  ::add(this_00,(ushort **)ppMVar5,&local_38);
+          uVar8 = (uint)ppMVar5;
+          this_01 = local_38;
+LAB_3:
+          if (-1 < lVar1) {
+            return lVar1;
+          }
+        }
+LAB_1:
+        if (this_01 != (MapPropertyBag *)0x0) {
+          MapPropertyBag::_scalar_deleting_destructor_(this_01,uVar8);
+        }
       }
     }
   }
-  return iVar1;
+  return lVar1;
 }
 

```


## RegistryRegRow::PutPropertyBag

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.8|
|i_ratio|0.72|
|m_ratio|0.99|
|b_ratio|0.99|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|PutPropertyBag|PutPropertyBag|
|fullname|RegistryRegRow::PutPropertyBag|RegistryRegRow::PutPropertyBag|
|refcount|3|3|
|`length`|682|701|
|`called`|<details><summary>Expand for full list:<br>?StringCchPrintfW@@YAJPEAG_KPEBGZZ<br>API-MS-WIN-CORE-ERRORHANDLING-L1-1-1.DLL::GetLastError<br>API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree<br>API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegCloseKey<br>API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegCreateKeyExW<br>API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0.DLL::lstrlenW<br>API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL::ConvertStringSecurityDescriptorToSecurityDescriptorW<br>VerifyStackAvailable<br>WriteRawVariant<br>__chkstk<br>__security_check_cookie</summary>_guard_dispatch_icall</details>|<details><summary>Expand for full list:<br>?StringCchPrintfW@@YAJPEAG_KPEBGZZ<br>API-MS-WIN-CORE-ERRORHANDLING-L1-1-1.DLL::GetLastError<br>API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree<br>API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegCloseKey<br>API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegCreateKeyExW<br>API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0.DLL::lstrlenW<br>API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL::ConvertStringSecurityDescriptorToSecurityDescriptorW<br>ValidatePropertyBag<br>VerifyStackAvailable<br>WriteRawVariant<br>__chkstk</summary>__security_check_cookie<br>_guard_dispatch_icall</details>|
|calling|||
|paramcount|4|4|
|`address`|18003e380|18003e260|
|sig|long __thiscall PutPropertyBag(RegistryRegRow * this, ushort * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3)|long __thiscall PutPropertyBag(RegistryRegRow * this, ushort * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### RegistryRegRow::PutPropertyBag Called Diff


```diff
--- RegistryRegRow::PutPropertyBag called
+++ RegistryRegRow::PutPropertyBag called
@@ -7,0 +8 @@
+ValidatePropertyBag
```


### RegistryRegRow::PutPropertyBag Diff


```diff
--- RegistryRegRow::PutPropertyBag
+++ RegistryRegRow::PutPropertyBag
@@ -1,175 +1,178 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* WARNING: Function: __chkstk replaced with injection: alloca_probe */
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 /* public: virtual long __cdecl RegistryRegRow::PutPropertyBag(unsigned short const * __ptr64,struct
    tagPROPVARIANT * __ptr64,struct tagPROPVARIANT * __ptr64) __ptr64 */
 
 long __thiscall
 RegistryRegRow::PutPropertyBag
           (RegistryRegRow *this,ushort *param_1,tagPROPVARIANT *param_2,tagPROPVARIANT *param_3)
 
 {
   HKEY hKey;
   longlong lVar1;
   ushort *puVar2;
   HLOCAL hMem;
   HKEY__ *pHVar3;
-  int iVar4;
-  uint uVar5;
+  uint uVar4;
+  int iVar5;
   uint uVar6;
   undefined8 uVar7;
   ulonglong uVar8;
   LPCWSTR pszDest;
   ulonglong uVar9;
   undefined1 *puVar10;
   undefined1 *puVar11;
   uint uVar12;
   longlong lVar13;
   undefined1 auStack_b8 [80];
   HLOCAL local_68;
   HKEY__ *local_60;
   undefined1 local_58 [8];
   undefined4 local_50;
   undefined4 uStack_4c;
   HLOCAL local_48;
   undefined8 local_40;
   ulonglong local_38;
   
   puVar11 = auStack_b8;
   local_38 = __security_cookie ^ (ulonglong)&local_68;
   if (param_1 == (ushort *)0x0) {
-    uVar5 = 0x80070057;
+    uVar4 = 0x80070057;
     puVar11 = auStack_b8;
     goto LAB_0;
   }
   if (((param_2 == (tagPROPVARIANT *)0x0) || (param_3 == (tagPROPVARIANT *)0x0)) ||
      (*(int *)(param_2 + 8) == 0)) {
-    uVar5 = 1;
+    uVar4 = 1;
     goto LAB_0;
   }
+  uVar4 = ValidatePropertyBag(param_2,param_3);
+  puVar11 = auStack_b8;
+  if ((int)uVar4 < 0) goto LAB_0;
   local_60 = (HKEY__ *)0x0;
-  iVar4 = lstrlenW((LPCWSTR)param_1);
-  uVar5 = iVar4 + *(int *)(this + 0x74) + 2;
-  uVar8 = (ulonglong)uVar5 * 2;
+  iVar5 = lstrlenW((LPCWSTR)param_1);
+  uVar4 = iVar5 + *(int *)(this + 0x74) + 2;
+  uVar8 = (ulonglong)uVar4 * 2;
   if (0xffffffff < uVar8) {
-    uVar5 = 0x80070216;
+    uVar4 = 0x80070216;
     puVar11 = auStack_b8;
     goto LAB_0;
   }
   pszDest = (LPCWSTR)0x0;
   uVar6 = (uint)uVar8;
   puVar10 = auStack_b8;
   if (((uVar6 == 0) ||
       (uVar8 = uVar8 & 0xffffffff, puVar10 = auStack_b8, g_ulMaxStackAllocSize < uVar8)) ||
      ((uVar9 = g_ulAdditionalProbeSize + 8 + uVar8, puVar10 = auStack_b8, uVar9 < uVar8 ||
       (uVar7 = VerifyStackAvailable(uVar9), puVar10 = auStack_b8, pszDest = (LPCWSTR)0x0,
       (int)uVar7 == 0)))) {
 LAB_1:
     puVar11 = puVar10;
     if (uVar6 + 8 < uVar6) {
 LAB_2:
       if (pszDest != (LPCWSTR)0x0) goto LAB_3;
     }
     else {
-      *(undefined8 *)(puVar10 + -8) = 0x18003e49a;
+      *(undefined8 *)(puVar10 + -8) = 0x18003e38d;
       pszDest = (LPCWSTR)(*g_pfnAllocate)(uVar6 + 8);
       if (pszDest != (LPCWSTR)0x0) {
         pszDest[0] = L'效';
         pszDest[1] = L'灡';
         pszDest = pszDest + 4;
         goto LAB_2;
       }
     }
-    uVar5 = 0x8007000e;
+    uVar4 = 0x8007000e;
   }
   else {
     uVar8 = (ulonglong)(uVar6 + 8) + 0xf;
     if (uVar8 <= uVar6 + 8) {
       uVar8 = 0xffffffffffffff0;
     }
     lVar13 = -(uVar8 & 0xfffffffffffffff0);
     pszDest = (LPCWSTR)0x0;
     puVar10 = auStack_b8 + lVar13;
     if ((undefined4 *)((longlong)&local_68 + lVar13) == (undefined4 *)0x0) goto LAB_1;
     *(undefined4 *)((longlong)&local_68 + lVar13) = 0x6b637453;
     pszDest = (LPCWSTR)(local_58 + lVar13 + -8);
     puVar10 = auStack_b8 + lVar13;
     puVar11 = auStack_b8 + lVar13;
     if (pszDest == (LPCWSTR)0x0) goto LAB_1;
 LAB_3:
     *(ushort **)(puVar11 + 0x20) = param_1;
-    *(undefined8 *)(puVar11 + -8) = 0x18003e4d6;
-    uVar5 = _StringCchPrintfW__YAJPEAG_KPEBGZZ(pszDest,(ulonglong)uVar5,L"%s\\%s");
-    if (-1 < (int)uVar5) {
+    *(undefined8 *)(puVar11 + -8) = 0x18003e3c9;
+    uVar4 = _StringCchPrintfW__YAJPEAG_KPEBGZZ(pszDest,(ulonglong)uVar4,L"%s\\%s");
+    if (-1 < (int)uVar4) {
       uVar7 = *(undefined8 *)(this + 0x58);
       local_68 = (HLOCAL)0x0;
-      *(undefined8 *)(puVar11 + -8) = 0x18003e4fa;
-      iVar4 = ConvertStringSecurityDescriptorToSecurityDescriptorW(uVar7,1);
-      if (iVar4 == 0) {
-        *(undefined8 *)(puVar11 + -8) = 0x18003e504;
-        uVar5 = GetLastError();
-        if (0 < (int)uVar5) {
-          uVar5 = uVar5 & 0xffff | 0x80070000;
+      *(undefined8 *)(puVar11 + -8) = 0x18003e3ed;
+      iVar5 = ConvertStringSecurityDescriptorToSecurityDescriptorW(uVar7,1);
+      if (iVar5 == 0) {
+        *(undefined8 *)(puVar11 + -8) = 0x18003e3f7;
+        uVar4 = GetLastError();
+        if (0 < (int)uVar4) {
+          uVar4 = uVar4 & 0xffff | 0x80070000;
         }
       }
       else {
         hKey = *(HKEY *)(this + 0x68);
         uStack_4c = 0;
         local_40 = 0;
         local_48 = local_68;
         *(undefined1 **)(puVar11 + 0x40) = local_58;
         *(HKEY__ ***)(puVar11 + 0x38) = &local_60;
         *(undefined4 **)(puVar11 + 0x30) = &local_50;
         *(undefined4 *)(puVar11 + 0x28) = 0x20006;
         *(undefined4 *)(puVar11 + 0x20) = 0;
         _local_50 = CONCAT44(uStack_4c,0x18);
-        *(undefined8 *)(puVar11 + -8) = 0x18003e570;
+        *(undefined8 *)(puVar11 + -8) = 0x18003e463;
         uVar6 = RegCreateKeyExW(hKey,pszDest,0,(LPWSTR)0x0,*(DWORD *)(puVar11 + 0x20),
                                 *(REGSAM *)(puVar11 + 0x28),
                                 *(LPSECURITY_ATTRIBUTES *)(puVar11 + 0x30),
                                 *(PHKEY *)(puVar11 + 0x38),*(LPDWORD *)(puVar11 + 0x40));
         if (uVar6 == 0) {
           uVar6 = *(uint *)(param_2 + 8);
           uVar8 = 0;
           if (uVar6 != 0) {
             lVar13 = 0;
             do {
               pHVar3 = local_60;
               lVar1 = *(longlong *)(param_3 + 0x10);
               puVar2 = *(ushort **)(lVar13 + *(longlong *)(param_2 + 0x10));
-              *(undefined8 *)(puVar11 + -8) = 0x18003e5b0;
-              uVar5 = WriteRawVariant(pHVar3,puVar2,(tagPROPVARIANT *)(lVar1 + uVar8 * 0x18));
-              if ((int)uVar5 < 0) break;
+              *(undefined8 *)(puVar11 + -8) = 0x18003e4a3;
+              uVar4 = WriteRawVariant(pHVar3,puVar2,(tagPROPVARIANT *)(lVar1 + uVar8 * 0x18));
+              if ((int)uVar4 < 0) break;
               uVar12 = (int)uVar8 + 1;
               uVar8 = (ulonglong)uVar12;
               lVar13 = lVar13 + 8;
             } while (uVar12 < uVar6);
           }
         }
         else {
-          uVar5 = uVar6;
+          uVar4 = uVar6;
           if (0 < (int)uVar6) {
-            uVar5 = uVar6 & 0xffff | 0x80070000;
+            uVar4 = uVar6 & 0xffff | 0x80070000;
           }
         }
         hMem = local_68;
-        *(undefined8 *)(puVar11 + -8) = 0x18003e5cb;
+        *(undefined8 *)(puVar11 + -8) = 0x18003e4be;
         LocalFree(hMem);
       }
     }
   }
   pHVar3 = local_60;
   if (local_60 != (HKEY)0x0) {
-    *(undefined8 *)(puVar11 + -8) = 0x18003e5da;
+    *(undefined8 *)(puVar11 + -8) = 0x18003e4cd;
     RegCloseKey(pHVar3);
   }
   if ((pszDest != (LPCWSTR)0x0) && (*(int *)(pszDest + -4) == 0x70616548)) {
-    *(undefined8 *)(puVar11 + -8) = 0x18003e5f8;
+    *(undefined8 *)(puVar11 + -8) = 0x18003e4eb;
     (*g_pfnFree)();
   }
 LAB_0:
-  *(undefined8 *)(puVar11 + -8) = 0x18003e60d;
-  return uVar5;
+  *(undefined8 *)(puVar11 + -8) = 0x18003e500;
+  return uVar4;
 }
 

```


## CSubscription2::Store

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.09|
|i_ratio|0.38|
|m_ratio|0.93|
|b_ratio|0.35|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|Store|Store|
|fullname|CSubscription2::Store|CSubscription2::Store|
|refcount|3|3|
|`length`|2248|1975|
|`called`|<details><summary>Expand for full list:<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::CoRevertToSelf<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy<br>API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree<br>CEventSystem2::NotifyChangedSubscription<br>CEventSystem2::QueryInterface<br>CEventSystem2::StoreTransientSubscriber<br>CallerTokenProperties::GetSid<br>CallerTokenProperties::IsAdministrator<br>CallerTokenProperties::~CallerTokenProperties<br>CheckCallerAccessToEventObject</summary>CheckInterfaceIsProcessLocal<br>CheckPerUserMonikerSubscription<br>ConcatenateECID_PARTID_APPID<br>GetTerminalServicesSessionId<br>ImpersonateClientIfNecessary<br>InMemoryRegRow::PutPropertyBag<br>LogMessage_HR<br>MSVCRT.DLL::wcsncmp<br>OLEAUT32.DLL::Ordinal_7<br>RegRow::Activate<br>RegRow::IsNew<br>RegRow::LockWrite<br>RegRow::UnlockWrite<br>UnmarshalIUnknownFromBlob<br>__security_check_cookie<br>_guard_dispatch_icall</details>|<details><summary>Expand for full list:<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::CoRevertToSelf<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear<br>CallerTokenProperties::GetSid<br>CallerTokenProperties::IsAdministrator<br>CallerTokenProperties::~CallerTokenProperties<br>CheckCallerAccessToEventObject<br>CheckInterfaceIsProcessLocal<br>CheckPerUserMonikerSubscription<br>ConcatenateECID_PARTID_APPID<br>GetTerminalServicesSessionId<br>ImpersonateClientIfNecessary</summary>IsEmptyOrBSTR<br>LogMessage_HR<br>MSVCRT.DLL::wcsncmp<br>OLEAUT32.DLL::Ordinal_7<br>UnmarshalIUnknownFromBlob<br>__security_check_cookie<br>_guard_dispatch_icall</details>|
|calling|||
|paramcount|11|11|
|`address`|18001f960|18000f0c0|
|sig|long __thiscall Store(CSubscription2 * this, IEventSystemTier2 * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3, tagPROPVARIANT * param_4, tagPROPVARIANT * param_5, tagPROPVARIANT * param_6, tagBLOB * param_7, int param_8, int param_9, int param_10)|long __thiscall Store(CSubscription2 * this, IEventSystemTier2 * param_1, tagPROPVARIANT * param_2, tagPROPVARIANT * param_3, tagPROPVARIANT * param_4, tagPROPVARIANT * param_5, tagPROPVARIANT * param_6, tagBLOB * param_7, int param_8, int param_9, int param_10)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### CSubscription2::Store Called Diff


```diff
--- CSubscription2::Store called
+++ CSubscription2::Store called
@@ -3,5 +2,0 @@
-API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy
-API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
-CEventSystem2::NotifyChangedSubscription
-CEventSystem2::QueryInterface
-CEventSystem2::StoreTransientSubscriber
@@ -17 +12 @@
-InMemoryRegRow::PutPropertyBag
+IsEmptyOrBSTR
@@ -21,4 +15,0 @@
-RegRow::Activate
-RegRow::IsNew
-RegRow::LockWrite
-RegRow::UnlockWrite
```


### CSubscription2::Store Diff


```diff
--- CSubscription2::Store
+++ CSubscription2::Store
@@ -1,352 +1,304 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 /* WARNING: Exceeded maximum restarts with more pending */
 /* public: virtual long __cdecl CSubscription2::Store(struct IEventSystemTier2 * __ptr64,struct
    tagPROPVARIANT * __ptr64 const,struct tagPROPVARIANT * __ptr64,struct tagPROPVARIANT *
    __ptr64,struct tagPROPVARIANT * __ptr64,struct tagPROPVARIANT * __ptr64,struct tagBLOB *
    __ptr64,int,int,int) __ptr64 */
 
 long __thiscall
 CSubscription2::Store
           (CSubscription2 *this,IEventSystemTier2 *param_1,tagPROPVARIANT *param_2,
           tagPROPVARIANT *param_3,tagPROPVARIANT *param_4,tagPROPVARIANT *param_5,
           tagPROPVARIANT *param_6,tagBLOB *param_7,int param_8,int param_9,int param_10)
 
 {
-  PROPVARIANT *pvarSrc;
   short sVar1;
   short sVar2;
-  code *pcVar3;
-  longlong *plVar4;
-  bool bVar5;
-  bool bVar6;
-  bool bVar7;
-  long lVar8;
-  int iVar9;
-  uint uVar10;
-  tagPROPVARIANT *ptVar11;
-  char cVar12;
-  ulonglong uVar14;
-  ulong uVar15;
-  long lVar16;
-  undefined1 auStackY_248 [32];
-  long local_208;
-  bool local_204;
-  bool local_203 [3];
-  uint local_200;
-  char local_1fc;
-  CEventSystem2 *local_1f8;
-  IUnknown *local_1f0;
-  undefined4 local_1e8 [2];
-  HLOCAL local_1e0;
-  tagPROPVARIANT *local_1d8;
-  tagPROPVARIANT *local_1d0;
-  uint local_1c8;
+  bool bVar3;
+  long lVar4;
+  int iVar5;
+  uint uVar6;
+  code *pcVar7;
+  tagPROPVARIANT *ptVar8;
+  char cVar9;
+  ulong uVar10;
+  undefined1 auStack_238 [32];
+  undefined1 *local_218;
+  undefined8 local_210;
+  long local_1f8;
+  bool local_1f4;
+  bool local_1f3;
+  char local_1f2;
+  uint local_1f0;
+  char local_1ec;
+  IUnknown *local_1e8;
+  longlong *local_1e0;
+  undefined4 local_1d8 [2];
+  undefined8 local_1d0;
+  tagPROPVARIANT *local_1c8;
   tagPROPVARIANT *local_1c0;
-  undefined8 local_1b8;
-  undefined8 uStack_1b0;
+  int local_1b8;
+  tagPROPVARIANT *local_1b0;
   undefined8 local_1a8;
+  undefined8 uStack_1a0;
   undefined8 local_198;
-  ushort *puStack_190;
   undefined8 local_188;
-  wchar_t *local_178;
-  tagPROPVARIANT *local_170;
-  CSubscription2 *local_168;
+  ushort *puStack_180;
+  undefined8 local_178;
+  wchar_t *local_168;
+  CSubscription2 *local_160;
   undefined4 local_158;
   undefined4 uStack_154;
   undefined4 uStack_150;
   undefined4 uStack_14c;
   undefined8 local_148;
-  ushort local_138 [120];
+  undefined1 local_138 [240];
   ulonglong local_48;
-  ulonglong uVar13;
   
-  local_48 = __security_cookie ^ (ulonglong)auStackY_248;
+  local_48 = __security_cookie ^ (ulonglong)auStack_238;
   local_1c0 = param_4;
-  local_1d8 = param_5;
-  local_170 = param_6;
-  uVar14 = 0;
-  local_1f8 = (CEventSystem2 *)0x0;
-  lVar16 = 0;
-  local_1e8[0] = 0;
-  local_1e0 = (HLOCAL)0x0;
-  local_200 = 0;
-  bVar6 = false;
-  bVar7 = false;
-  local_1d0 = param_3;
-  local_168 = this;
+  local_1b0 = param_5;
+  local_1c8 = param_6;
+  local_1e0 = (longlong *)0x0;
+  local_1d8[0] = 0;
+  local_1d0 = 0;
+  local_1f0 = 0;
+  local_1f2 = '\0';
+  local_160 = this;
   if (param_1 == (IEventSystemTier2 *)0x0) {
-    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1e8);
+    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1d8);
     return -0x7fffbffd;
   }
-  local_198 = *(undefined8 *)(param_2 + 0x198);
-  puStack_190 = *(ushort **)(param_2 + 0x1a0);
-  local_188 = *(undefined8 *)(param_2 + 0x1a8);
-  local_1b8 = *(undefined8 *)(param_2 + 0x180);
-  uStack_1b0 = *(undefined8 *)(param_2 + 0x188);
-  local_1a8 = *(undefined8 *)(param_2 + 400);
-  local_158 = *(undefined4 *)param_2;
-  uStack_154 = *(undefined4 *)(param_2 + 4);
-  uStack_150 = *(undefined4 *)(param_2 + 8);
-  uStack_14c = *(undefined4 *)(param_2 + 0xc);
-  local_148 = *(undefined8 *)(param_2 + 0x10);
-  lVar8 = ConcatenateECID_PARTID_APPID(&local_158,&local_1b8,&local_198);
-  if ((lVar8 < 0) || (lVar8 = CheckInterfaceIsProcessLocal((IUnknown *)param_1), lVar8 < 0)) {
+  ptVar8 = param_2;
+  bVar3 = IsEmptyOrBSTR(param_2 + 0x60);
+  if (((!bVar3) || (bVar3 = IsEmptyOrBSTR(ptVar8 + 0x48), !bVar3)) ||
+     (bVar3 = IsEmptyOrBSTR(ptVar8 + 0x150), !bVar3)) {
+    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1d8);
+    return -0x7ff8ffa9;
+  }
+  local_188 = *(undefined8 *)(ptVar8 + 0x198);
+  puStack_180 = *(ushort **)(ptVar8 + 0x1a0);
+  local_178 = *(undefined8 *)(ptVar8 + 0x1a8);
+  local_1a8 = *(undefined8 *)(ptVar8 + 0x180);
+  uStack_1a0 = *(undefined8 *)(ptVar8 + 0x188);
+  local_198 = *(undefined8 *)(ptVar8 + 400);
+  local_158 = *(undefined4 *)ptVar8;
+  uStack_154 = *(undefined4 *)(ptVar8 + 4);
+  uStack_150 = *(undefined4 *)(ptVar8 + 8);
+  uStack_14c = *(undefined4 *)(ptVar8 + 0xc);
+  local_148 = *(undefined8 *)(ptVar8 + 0x10);
+  local_218 = local_138;
+  lVar4 = ConcatenateECID_PARTID_APPID(&local_158,&local_1a8,&local_188);
+  if (((lVar4 < 0) || (lVar4 = CheckInterfaceIsProcessLocal((IUnknown *)param_1), lVar4 < 0)) ||
+     (lVar4 = (*(code *)**(undefined8 **)param_1)
+                        (param_1,&_GUID_dc7c5ccc_34e1_4531_941d_035e29ff8257,&local_1e0), lVar4 < 0)
+     ) {
+    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1d8);
+    return lVar4;
+  }
+  if (((*(short *)(param_2 + 0x98) == -1) && (param_7 == (tagBLOB *)0x0)) &&
+     ((*(short *)(param_2 + 0x138) == 8 &&
+      ((iVar5 = Ordinal_7(*(undefined8 *)(param_2 + 0x140)), iVar5 != 0 &&
+       (lVar4 = CheckPerUserMonikerSubscription(param_1,param_2), lVar4 < 0)))))) {
 LAB_0:
-    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1e8);
-    return lVar8;
-  }
-  if ((code *)**(undefined8 **)param_1 == CEventSystem2::QueryInterface) {
-    lVar8 = CEventSystem2::QueryInterface
-                      ((CEventSystem2 *)param_1,(_GUID *)&_GUID_dc7c5ccc_34e1_4531_941d_035e29ff8257
-                       ,&local_1f8);
+    pcVar7 = *(code **)(*local_1e0 + 0x10);
   }
   else {
-    lVar8 = (*(code *)**(undefined8 **)param_1)();
-  }
-  if (lVar8 < 0) goto LAB_0;
-  if ((((*(short *)(param_2 + 0x98) == -1) && (param_7 == (tagBLOB *)0x0)) &&
-      (*(short *)(param_2 + 0x138) == 8)) &&
-     ((iVar9 = Ordinal_7(*(undefined8 *)(param_2 + 0x140)), iVar9 != 0 &&
-      (lVar8 = CheckPerUserMonikerSubscription(param_1,param_2), lVar8 < 0)))) {
+    local_1f3 = false;
+    lVar4 = ImpersonateClientIfNecessary(&local_1f3);
+    if (lVar4 < 0) goto LAB_0;
+    lVar4 = CallerTokenProperties::IsAdministrator((CallerTokenProperties *)local_1d8,&local_1f4);
+    local_1f8 = lVar4;
+    if (-1 < lVar4) {
+      if (local_1f4 == false) {
+        if ((*(short *)(param_2 + 0x90) == 0xb) && (*(short *)(param_2 + 0x98) == -1)) {
+          if ((*(short *)(param_2 + 0xa8) == 8) &&
+             (iVar5 = Ordinal_7(*(undefined8 *)(param_2 + 0xb0)), iVar5 != 0)) {
+            local_168 = (wchar_t *)0x0;
+            lVar4 = CallerTokenProperties::GetSid
+                              ((CallerTokenProperties *)local_1d8,(ushort **)&local_168);
+            local_1f8 = lVar4;
+            if (-1 < lVar4) {
+              uVar6 = Ordinal_7(*(undefined8 *)(param_2 + 0xb0));
+              iVar5 = wcsncmp(local_168,*(wchar_t **)(param_2 + 0xb0),(ulonglong)uVar6);
+              if (iVar5 == 0) goto LAB_1;
+              goto LAB_2;
+            }
+          }
+          else {
+            lVar4 = -0x7ff8ffa9;
+            local_1f8 = lVar4;
+          }
+        }
+        else {
+LAB_2:
+          lVar4 = -0x7ff8fffb;
+          local_1f8 = lVar4;
+        }
+      }
+      else {
 LAB_1:
-    (**(code **)(*(longlong *)local_1f8 + 0x10))();
-    CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1e8);
-    return lVar8;
-  }
-  local_203[0] = false;
-  lVar8 = ImpersonateClientIfNecessary(local_203);
-  if (lVar8 < 0) goto LAB_1;
-  local_208 = CallerTokenProperties::IsAdministrator((CallerTokenProperties *)local_1e8,&local_204);
-  bVar5 = bVar6;
-  if (local_208 < 0) goto LAB_2;
-  bVar5 = bVar7;
-  if (local_204 == false) {
-    if ((*(short *)(param_2 + 0x90) == 0xb) && (*(short *)(param_2 + 0x98) == -1)) {
-      if ((*(short *)(param_2 + 0xa8) != 8) ||
-         (iVar9 = Ordinal_7(*(undefined8 *)(param_2 + 0xb0)), iVar9 == 0)) {
-        local_208 = -0x7ff8ffa9;
-        goto LAB_2;
+        local_1e8 = (IUnknown *)0x0;
+        if ((param_7 == (tagBLOB *)0x0) ||
+           (lVar4 = UnmarshalIUnknownFromBlob(param_7,&local_1e8), local_1f8 = lVar4, -1 < lVar4)) {
+          cVar9 = '\0';
+          (**(code **)(**(longlong **)(this + 0x18) + 0x70))();
+          local_1a8 = 0;
+          uStack_1a0 = 0;
+          local_198 = 0;
+          local_188 = 0;
+          puStack_180 = (ushort *)0x0;
+          local_178 = 0;
+          iVar5 = (**(code **)(**(longlong **)(this + 0x18) + 0x88))();
+          local_1f0 = (uint)(iVar5 == 0);
+          if (local_1f0 == 0) {
+            local_1f8 = (**(code **)(**(longlong **)(this + 0x18) + 0x18))
+                                  (*(longlong **)(this + 0x18),6,&local_1a8);
+            if (local_1f8 == 0) {
+              cVar9 = '\x01';
+              if ((short)uStack_1a0 != -1) goto LAB_3;
+            }
+            else {
+LAB_3:
+              cVar9 = '\0';
+            }
+            local_1ec = cVar9;
+            PropVariantClear((PROPVARIANT *)&local_1a8);
+            uVar10 = (ulong)&local_188;
+            lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x18))
+                              (*(longlong **)(this + 0x18),7);
+            local_1f8 = lVar4;
+            if (lVar4 != 0) goto LAB_4;
+            local_1f4 = false;
+            lVar4 = CheckCallerAccessToEventObject
+                              (puStack_180,(CallerTokenProperties *)local_1d8,uVar10,&local_1f4);
+            local_1f8 = lVar4;
+            if (-1 < lVar4) {
+              if (local_1f4 != false) goto LAB_4;
+              local_1f8 = -0x7ff8fffb;
+              lVar4 = -0x7ff8fffb;
+            }
+          }
+          else {
+LAB_4:
+            if ((((*(short *)(param_2 + 0x98) == -1) || (cVar9 != '\0')) &&
+                (local_1e8 == (IUnknown *)0x0)) &&
+               (lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x90))
+                                  (*(longlong **)(this + 0x18),*(undefined8 *)(param_2 + 0xb0),
+                                   &local_1f0), local_1f8 = lVar4, lVar4 < 0)) {
+              if (lVar4 == -0x7ff8fffe) {
+                local_1f8 = -0x7ffbfdf9;
+                lVar4 = -0x7ffbfdf9;
+              }
+              else {
+                local_1f2 = '\x01';
+              }
+            }
+            else if ((local_1f0 != 0) ||
+                    (lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x80))
+                                       (*(longlong **)(this + 0x18),param_10 == 0),
+                    local_1f8 = lVar4, -1 < lVar4)) {
+              local_1b8 = 0;
+              while (iVar5 = local_1b8, local_1b8 < 0x12) {
+                if ((*(short *)(param_2 + (longlong)local_1b8 * 0x18) != 0) &&
+                   (lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x20))
+                                      (*(longlong **)(this + 0x18),local_1b8), local_1f8 = lVar4,
+                   lVar4 < 0)) goto LAB_5;
+                local_1b8 = iVar5 + 1;
+              }
+              if ((param_3 != (tagPROPVARIANT *)0x0) && (local_1c0 != (tagPROPVARIANT *)0x0)) {
+                lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x30))
+                                  (*(longlong **)(this + 0x18),L"PublisherProperties",param_3);
+                local_1f8 = lVar4;
+              }
+              if (-1 < lVar4) {
+                if ((local_1b0 != (tagPROPVARIANT *)0x0) && (local_1c8 != (tagPROPVARIANT *)0x0)) {
+                  lVar4 = (**(code **)(**(longlong **)(this + 0x18) + 0x30))
+                                    (*(longlong **)(this + 0x18),L"SubscriberProperties");
+                  local_1f8 = lVar4;
+                }
+                if (-1 < lVar4) {
+                  if ((*(short *)(param_2 + 0x98) != -1) || (local_1e8 != (IUnknown *)0x0))
+                  goto LAB_6;
+                  local_1c0 = (tagPROPVARIANT *)0x0;
+                  local_1f8 = CallerTokenProperties::GetSid
+                                        ((CallerTokenProperties *)local_1d8,(ushort **)&local_1c0);
+                  lVar4 = local_1f8;
+                  if (local_1f8 < 0) goto LAB_5;
+                  ptVar8 = local_1c0;
+                  do {
+                    sVar1 = *(short *)ptVar8;
+                    sVar2 = *(short *)(ptVar8 + ((longlong)*(ushort **)(param_2 + 0xb0) -
+                                                (longlong)local_1c0));
+                    if (sVar1 != sVar2) break;
+                    ptVar8 = ptVar8 + 2;
+                  } while (sVar2 != 0);
+                  if (sVar1 == sVar2) {
+LAB_6:
+                    local_1f8 = (**(code **)(**(longlong **)(this + 0x18) + 0x48))
+                                          (*(longlong **)(this + 0x18),1);
+                  }
+                  else {
+                    local_1c8 = (tagPROPVARIANT *)((ulonglong)local_1c8 & 0xffffffff00000000);
+                    local_1b0 = (tagPROPVARIANT *)CONCAT44(local_1b0._4_4_,0xffffffff);
+                    lVar4 = GetTerminalServicesSessionId
+                                      (*(ushort **)(param_2 + 0xb0),true,(int *)&local_1c8,
+                                       (ulong *)&local_1b0);
+                    if (lVar4 == -0x7ffbfdf0) {
+                      local_1f8 = 0;
+                    }
+                    else {
+                      local_1f8 = lVar4;
+                      if (lVar4 < 0) goto LAB_5;
+                    }
+                    if ((int)local_1c8 != 0) goto LAB_6;
+                  }
+                  lVar4 = local_1f8;
+                  if ((-1 < local_1f8) && (local_1e8 != (IUnknown *)0x0)) {
+                    lVar4 = (**(code **)(*local_1e0 + 0x28))(local_1e0,local_138,local_1e8,param_8);
+                    local_1f8 = lVar4;
+                  }
+                }
+              }
+            }
+          }
+LAB_5:
+          (**(code **)(**(longlong **)(this + 0x18) + 0x78))();
+          if (lVar4 < 0) {
+            (**(code **)(**(longlong **)(this + 0x18) + 0x58))();
+          }
+          if (local_1e8 != (IUnknown *)0x0) {
+            (*local_1e8->lpVtbl->Release)();
+          }
+          PropVariantClear((PROPVARIANT *)&local_1a8);
+          PropVariantClear((PROPVARIANT *)&local_188);
+        }
       }
-      local_178 = (wchar_t *)0x0;
-      local_208 = CallerTokenProperties::GetSid
-                            ((CallerTokenProperties *)local_1e8,(ushort **)&local_178);
-      if (local_208 < 0) goto LAB_2;
-      uVar10 = Ordinal_7(*(undefined8 *)(param_2 + 0xb0));
-      iVar9 = wcsncmp(local_178,*(wchar_t **)(param_2 + 0xb0),(ulonglong)uVar10);
-      if (iVar9 == 0) goto LAB_3;
     }
-    local_208 = -0x7ff8fffb;
-    goto LAB_2;
-  }
-LAB_3:
-  local_1f0 = (IUnknown *)0x0;
-  if ((param_7 != (tagBLOB *)0x0) &&
-     (local_208 = UnmarshalIUnknownFromBlob(param_7,&local_1f0), local_208 < 0)) goto LAB_2;
-  cVar12 = '\0';
-  pcVar3 = *(code **)(*(longlong *)*(RegRow **)(this + 0x18) + 0x70);
-  if (pcVar3 == RegRow::LockWrite) {
-    RegRow::LockWrite(*(RegRow **)(this + 0x18));
-  }
-  else {
-    (*pcVar3)();
-  }
-  local_1b8 = 0;
-  uStack_1b0 = 0;
-  local_1a8 = 0;
-  local_198 = 0;
-  puStack_190 = (ushort *)0x0;
-  local_188 = 0;
-  pcVar3 = *(code **)(*(longlong *)*(RegRow **)(this + 0x18) + 0x88);
-  if (pcVar3 == RegRow::IsNew) {
-    iVar9 = RegRow::IsNew(*(RegRow **)(this + 0x18));
-  }
-  else {
-    iVar9 = (*pcVar3)();
-  }
-  local_200 = (uint)(iVar9 == 0);
-  if (local_200 == 0) {
-    iVar9 = (**(code **)(**(longlong **)(this + 0x18) + 0x18))
-                      (*(longlong **)(this + 0x18),6,&local_1b8);
-    if (iVar9 == 0) {
-      uVar13 = 1;
-      if ((short)uStack_1b0 != -1) goto LAB_4;
+    if (local_1f3 != false) {
+      CoRevertToSelf();
+    }
+    if (lVar4 < 0) {
+      if (local_1f2 != '\0') {
+        local_210 = *(undefined8 *)(param_2 + 0xb0);
+        local_218 = local_138;
+        LogMessage_HR(0x10,0xc000120b,lVar4,2);
+      }
     }
     else {
-LAB_4:
-      uVar13 = uVar14;
+      local_210 = *(undefined8 *)(param_2 + 0x158);
+      local_218 = *(undefined1 **)(param_2 + 0x50);
+      lVar4 = (**(code **)(*local_1e0 + 0x20))
+                        (local_1e0,local_1f0 == 0,local_138,*(undefined8 *)(param_2 + 0x68));
     }
-    cVar12 = (char)uVar13;
-    local_1fc = cVar12;
-    PropVariantClear((PROPVARIANT *)&local_1b8);
-    uVar15 = (ulong)&local_198;
-    local_208 = (**(code **)(**(longlong **)(this + 0x18) + 0x18))(*(longlong **)(this + 0x18),7);
-    if (local_208 != 0) goto LAB_5;
-    local_204 = false;
-    local_208 = CheckCallerAccessToEventObject
-                          (puStack_190,(CallerTokenProperties *)local_1e8,uVar15,&local_204);
-    if (-1 < local_208) {
-      if (local_204 != false) goto LAB_5;
-      local_208 = -0x7ff8fffb;
-    }
-  }
-  else {
-LAB_5:
-    if ((((*(short *)(param_2 + 0x98) == -1) || (cVar12 != '\0')) && (local_1f0 == (IUnknown *)0x0))
-       && (local_208 = (**(code **)(**(longlong **)(this + 0x18) + 0x90))
-                                 (*(longlong **)(this + 0x18),*(undefined8 *)(param_2 + 0xb0),
-                                  &local_200), local_208 < 0)) {
-      if (local_208 == -0x7ff8fffe) {
-        local_208 = -0x7ffbfdf9;
-      }
-      else {
-        bVar6 = true;
-      }
-    }
-    else if ((local_200 != 0) ||
-            (local_208 = (**(code **)(**(longlong **)(this + 0x18) + 0x80))
-                                   (*(longlong **)(this + 0x18),param_10 == 0), -1 < local_208)) {
-      local_1c8 = 0;
-      while (uVar10 = (uint)uVar14, (int)uVar10 < 0x12) {
-        pvarSrc = param_2 + (longlong)(int)uVar10 * 0x18;
-        if (*(ushort *)pvarSrc != 0) {
-          plVar4 = *(longlong **)(this + 0x18);
-          if (*(code **)(*plVar4 + 0x20) == InMemoryRegRow::PutValue) {
-            if (pvarSrc == (PROPVARIANT *)0x0) {
-              local_208 = -0x7fffbffd;
-            }
-            else if (uVar10 < *(uint *)(plVar4 + 8)) {
-              if ((*(ushort *)pvarSrc & 0x4000) == 0) {
-                PropVariantClear((PROPVARIANT *)(plVar4[9] + uVar14 * 0x18));
-                local_208 = PropVariantCopy((PROPVARIANT *)(plVar4[9] + uVar14 * 0x18),pvarSrc);
-              }
-              else {
-                local_208 = -0x7ff8ffa9;
-              }
-            }
-            else {
-              local_208 = -0x7ff8ffa9;
-            }
-          }
-          else {
-            local_208 = (**(code **)(*plVar4 + 0x20))(plVar4,uVar14,pvarSrc);
-          }
-          if (local_208 < 0) goto LAB_6;
-        }
-        local_1c8 = uVar10 + 1;
-        uVar14 = (ulonglong)local_1c8;
-      }
-      if ((local_1d0 != (tagPROPVARIANT *)0x0) && (local_1c0 != (tagPROPVARIANT *)0x0)) {
-        local_208 = (**(code **)(**(longlong **)(this + 0x18) + 0x30))
-                              (*(longlong **)(this + 0x18),L"PublisherProperties");
-      }
-      if (-1 < local_208) {
-        if ((local_1d8 != (tagPROPVARIANT *)0x0) && (local_170 != (tagPROPVARIANT *)0x0)) {
-          pcVar3 = *(code **)(*(longlong *)*(InMemoryRegRow **)(this + 0x18) + 0x30);
-          if (pcVar3 == InMemoryRegRow::PutPropertyBag) {
-            local_208 = InMemoryRegRow::PutPropertyBag
-                                  (*(InMemoryRegRow **)(this + 0x18),
-                                   (ushort *)L"SubscriberProperties",local_1d8,local_170);
-          }
-          else {
-            local_208 = (*pcVar3)();
-          }
-        }
-        if (-1 < local_208) {
-          if ((*(short *)(param_2 + 0x98) == -1) && (local_1f0 == (IUnknown *)0x0)) {
-            local_1d0 = (tagPROPVARIANT *)0x0;
-            local_208 = CallerTokenProperties::GetSid
-                                  ((CallerTokenProperties *)local_1e8,(ushort **)&local_1d0);
-            if (local_208 < 0) goto LAB_6;
-            ptVar11 = local_1d0;
-            do {
-              sVar1 = *(short *)ptVar11;
-              sVar2 = *(short *)(ptVar11 +
-                                ((longlong)*(ushort **)(param_2 + 0xb0) - (longlong)local_1d0));
-              if (sVar1 != sVar2) break;
-              ptVar11 = ptVar11 + 2;
-            } while (sVar2 != 0);
-            if (sVar1 != sVar2) {
-              local_1d8 = (tagPROPVARIANT *)((ulonglong)local_1d8 & 0xffffffff00000000);
-              local_1c0 = (tagPROPVARIANT *)CONCAT44(local_1c0._4_4_,0xffffffff);
-              local_208 = GetTerminalServicesSessionId
-                                    (*(ushort **)(param_2 + 0xb0),true,(int *)&local_1d8,
-                                     (ulong *)&local_1c0);
-              if ((local_208 != -0x7ffbfdf0) && (lVar16 = local_208, local_208 < 0))
-              goto LAB_6;
-              local_208 = lVar16;
-              if ((int)local_1d8 == 0) goto LAB_7;
-            }
-            local_208 = (**(code **)(**(longlong **)(this + 0x18) + 0x48))
-                                  (*(longlong **)(this + 0x18),1);
-          }
-          else {
-            pcVar3 = *(code **)(*(longlong *)*(RegRow **)(this + 0x18) + 0x48);
-            if (pcVar3 == RegRow::Activate) {
-              local_208 = RegRow::Activate(*(RegRow **)(this + 0x18),1);
-            }
-            else {
-              local_208 = (*pcVar3)();
-            }
-          }
+    if (local_1e0 == (longlong *)0x0) goto LAB_7;
+    pcVar7 = *(code **)(*local_1e0 + 0x10);
+  }
+  (*pcVar7)();
 LAB_7:
-          if ((-1 < local_208) && (local_1f0 != (IUnknown *)0x0)) {
-            if (*(code **)(*(longlong *)local_1f8 + 0x28) == CEventSystem2::StoreTransientSubscriber
-               ) {
-              local_208 = CEventSystem2::StoreTransientSubscriber
-                                    (local_1f8,local_138,local_1f0,param_8);
-            }
-            else {
-              local_208 = (**(code **)(*(longlong *)local_1f8 + 0x28))();
-            }
-          }
-        }
-      }
-LAB_6:
-      bVar6 = false;
-    }
-  }
-  pcVar3 = *(code **)(*(longlong *)*(RegRow **)(this + 0x18) + 0x78);
-  if (pcVar3 == RegRow::UnlockWrite) {
-    RegRow::UnlockWrite(*(RegRow **)(this + 0x18));
-  }
-  else {
-    (*pcVar3)();
-  }
-  if (local_208 < 0) {
-    (**(code **)(**(longlong **)(this + 0x18) + 0x58))();
-  }
-  if (local_1f0 != (IUnknown *)0x0) {
-    (*local_1f0->lpVtbl->Release)();
-  }
-  PropVariantClear((PROPVARIANT *)&local_1b8);
-  PropVariantClear((PROPVARIANT *)&local_198);
-  bVar5 = bVar6;
-LAB_2:
-  if (local_203[0] != false) {
-    CoRevertToSelf();
-  }
-  if (local_208 < 0) {
-    if (bVar5) {
-      LogMessage_HR(0x10,0xc000120b,local_208,2);
-    }
-  }
-  else if (*(code **)(*(longlong *)local_1f8 + 0x20) == CEventSystem2::NotifyChangedSubscription) {
-    local_208 = CEventSystem2::NotifyChangedSubscription
-                          (local_1f8,(uint)(local_200 == 0),local_138,*(ushort **)(param_2 + 0x68),
-                           *(ushort **)(param_2 + 0x50),*(ushort **)(param_2 + 0x158));
-  }
-  else {
-    local_208 = (**(code **)(*(longlong *)local_1f8 + 0x20))();
-  }
-  if (local_1f8 != (CEventSystem2 *)0x0) {
-    (**(code **)(*(longlong *)local_1f8 + 0x10))();
-  }
-  if (local_1e0 == (HLOCAL)0x0) {
-    return local_208;
-  }
-  LocalFree(local_1e0);
-  return local_208;
+  CallerTokenProperties::~CallerTokenProperties((CallerTokenProperties *)local_1d8);
+  return lVar4;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## Activate

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|Activate|Activate|
|fullname|RegRow::Activate|RegRow::Activate|
|`refcount`|5|3|
|length|9|9|
|called|||
|`calling`|CSubscription2::Store||
|paramcount|2|2|
|`address`|18001bfe0|18001bde0|
|sig|long __thiscall Activate(RegRow * this, int param_1)|long __thiscall Activate(RegRow * this, int param_1)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### Activate Calling Diff


```diff
--- RegRow::Activate calling
+++ RegRow::Activate calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


## API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|PropVariantCopy|PropVariantCopy|
|fullname|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy|
|`refcount`|14|13|
|length|0|0|
|called|||
|`calling`|CEventClass2::Load<br>CSubscription2::Load<br>CSubscription2::Store<br>InMemoryRegRow::GetPropertyBag<br>InMemoryRegRow::PutPropertyBag<br>InMemoryRegRow::PutValue<br>RegRow::TestConditions<br>RegistryRegRow::GetValue|CEventClass2::Load<br>CSubscription2::Load<br>InMemoryRegRow::GetPropertyBag<br>InMemoryRegRow::PutPropertyBag<br>InMemoryRegRow::PutValue<br>RegRow::TestConditions<br>RegistryRegRow::GetValue|
|paramcount|2|2|
|address|EXTERNAL:0000010f|EXTERNAL:0000010f|
|sig|HRESULT __stdcall PropVariantCopy(PROPVARIANT * pvarDest, PROPVARIANT * pvarSrc)|HRESULT __stdcall PropVariantCopy(PROPVARIANT * pvarDest, PROPVARIANT * pvarSrc)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy Calling Diff


```diff
--- API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy calling
+++ API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy calling
@@ -3 +2,0 @@
-CSubscription2::Store
```


## API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|LocalFree|LocalFree|
|fullname|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree|
|`refcount`|23|22|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>CSubscription2::Store<br>CallerTokenProperties::~CallerTokenProperties<br>CheckPerUserMonikerSubscription<br>CreateDefaultOwnerSIDProperty<br>CreateEventSystemKey<br>CreateKeyIfNeccessary<br>ExceptionFilter<br>FiringControl::SharedFireSubscription<br>FreeResourceStrings<br>HandleLogonNotification<br>InitSecurity</summary>InitServiceSid<br>NetpEventlogClose<br>RegistryRegRow::AssociateWithPerUser<br>RegistryRegRow::PutPropertyBag<br>UnInitSecurity<br>`CreateDefaultOwnerSIDProperty'::__l1::fin$0<br>accessAllowed</details>|<details><summary>Expand for full list:<br>CallerTokenProperties::~CallerTokenProperties<br>CheckPerUserMonikerSubscription<br>CreateDefaultOwnerSIDProperty<br>CreateEventSystemKey<br>CreateKeyIfNeccessary<br>ExceptionFilter<br>FiringControl::SharedFireSubscription<br>FreeResourceStrings<br>HandleLogonNotification<br>InitSecurity<br>InitServiceSid</summary>NetpEventlogClose<br>RegistryRegRow::AssociateWithPerUser<br>RegistryRegRow::PutPropertyBag<br>UnInitSecurity<br>`CreateDefaultOwnerSIDProperty'::__l1::fin$0<br>accessAllowed</details>|
|paramcount|1|1|
|address|EXTERNAL:00000064|EXTERNAL:00000064|
|sig|HLOCAL __stdcall LocalFree(HLOCAL hMem)|HLOCAL __stdcall LocalFree(HLOCAL hMem)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree Calling Diff


```diff
--- API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree calling
+++ API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


## GetBaseKey

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|GetBaseKey|GetBaseKey|
|fullname|RegistryRegRow::GetBaseKey|RegistryRegRow::GetBaseKey|
|`refcount`|6|2|
|length|5|5|
|called|||
|calling|||
|paramcount|1|1|
|`address`|180027db0|180027d10|
|sig|HKEY__ * __thiscall GetBaseKey(RegistryRegRow * this)|HKEY__ * __thiscall GetBaseKey(RegistryRegRow * this)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

## ~CallerTokenProperties

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.86|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|~CallerTokenProperties|~CallerTokenProperties|
|fullname|CallerTokenProperties::~CallerTokenProperties|CallerTokenProperties::~CallerTokenProperties|
|`refcount`|7|8|
|length|24|24|
|called|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree|
|calling|CEventClass2::Store<br>CSubscription2::Store|CEventClass2::Store<br>CSubscription2::Store|
|paramcount|1|1|
|`address`|1800327e8|18000c480|
|sig|void __thiscall ~CallerTokenProperties(CallerTokenProperties * this)|void __thiscall ~CallerTokenProperties(CallerTokenProperties * this)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

## QueryInterface

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.54|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|QueryInterface|QueryInterface|
|fullname|CEventSystem2::QueryInterface|CEventSystem2::QueryInterface|
|`refcount`|13|11|
|length|175|175|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|`calling`|CEventSysTier2Factory::CreateInstanceForDomain<br>CEventSystem2::QueryInterface`adjustor{8}'<br>CSubscription2::Load<br>CSubscription2::Store<br>CheckInterfaceIsProcessLocal|CEventSysTier2Factory::CreateInstanceForDomain<br>CEventSystem2::QueryInterface`adjustor{8}'<br>CSubscription2::Load<br>CheckInterfaceIsProcessLocal|
|paramcount|3|3|
|`address`|180012480|180012280|
|sig|long __thiscall QueryInterface(CEventSystem2 * this, _GUID * param_1, void * * param_2)|long __thiscall QueryInterface(CEventSystem2 * this, _GUID * param_1, void * * param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### QueryInterface Calling Diff


```diff
--- CEventSystem2::QueryInterface calling
+++ CEventSystem2::QueryInterface calling
@@ -4 +3,0 @@
-CSubscription2::Store
```


## isKeyEqual

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|isKeyEqual|isKeyEqual|
|fullname|ExprNode::isKeyEqual|ExprNode::isKeyEqual|
|`refcount`|3|7|
|length|3|3|
|called|||
|calling|||
|paramcount|2|2|
|`address`|180027df0|180027d60|
|sig|bool __thiscall isKeyEqual(ExprNode * this, ExprConstant * param_1)|bool __thiscall isKeyEqual(ExprNode * this, ExprConstant * param_1)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

## LockWrite

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.83|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|LockWrite|LockWrite|
|fullname|RegRow::LockWrite|RegRow::LockWrite|
|`refcount`|9|7|
|length|20|20|
|called|UTSemReadWriteES::LockWrite|UTSemReadWriteES::LockWrite|
|`calling`|CSubscription2::Store<br>InMemoryRegRow::Delete|InMemoryRegRow::Delete|
|paramcount|1|1|
|`address`|18001c340|18001c140|
|sig|long __thiscall LockWrite(RegRow * this)|long __thiscall LockWrite(RegRow * this)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### LockWrite Calling Diff


```diff
--- RegRow::LockWrite calling
+++ RegRow::LockWrite calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


## PutValue

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.84|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|PutValue|PutValue|
|fullname|InMemoryRegRow::PutValue|InMemoryRegRow::PutValue|
|`refcount`|5|3|
|length|109|109|
|called|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear<br>API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantCopy|
|calling|||
|paramcount|3|3|
|`address`|180010100|18000ff00|
|sig|long __thiscall PutValue(InMemoryRegRow * this, uint param_1, tagPROPVARIANT * param_2)|long __thiscall PutValue(InMemoryRegRow * this, uint param_1, tagPROPVARIANT * param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

## IsNew

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|IsNew|IsNew|
|fullname|RegRow::IsNew|RegRow::IsNew|
|`refcount`|7|5|
|length|9|9|
|called|||
|`calling`|CSubscription2::Store||
|paramcount|1|1|
|`address`|18001bfc0|18001bdc0|
|sig|long __thiscall IsNew(RegRow * this)|long __thiscall IsNew(RegRow * this)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### IsNew Calling Diff


```diff
--- RegRow::IsNew calling
+++ RegRow::IsNew calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


## UnlockWrite

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.83|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|UnlockWrite|UnlockWrite|
|fullname|RegRow::UnlockWrite|RegRow::UnlockWrite|
|`refcount`|9|7|
|length|20|20|
|called|UTSemReadWriteES::UnlockWrite|UTSemReadWriteES::UnlockWrite|
|`calling`|CSubscription2::Store<br>InMemoryRegRow::Delete|InMemoryRegRow::Delete|
|paramcount|1|1|
|`address`|18001c320|18001c120|
|sig|long __thiscall UnlockWrite(RegRow * this)|long __thiscall UnlockWrite(RegRow * this)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### UnlockWrite Calling Diff


```diff
--- RegRow::UnlockWrite calling
+++ RegRow::UnlockWrite calling
@@ -1 +0,0 @@
-CSubscription2::Store
```


## API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|PropVariantClear|PropVariantClear|
|fullname|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear|API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear|
|`refcount`|99|98|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>CEventClass2::Load<br>CEventClass2::Store<br>CEventClass::put_AllowInprocActivation<br>CEventClass::put_Description<br>CEventClass::put_EventClassID<br>CEventClass::put_EventClassName<br>CEventClass::put_EventClassPartitionID<br>CEventClass::put_FireInParallel<br>CEventClass::put_FiringInterfaceID<br>CEventClass::put_MultiInterfacePublisherFilterCLSID<br>CEventClass::put_OwnerSID</summary>CEventClass::put_ParallelFiringTimeout<br>CEventClass::put_PublisherID<br>CEventClass::put_TypeLib<br>CEventSystem2::NotifyLogonUser<br>CEventSystem2::RemoveInternal<br>CSubscription2::Load<br>CSubscription2::Store<br>CSubscription::CreateFromTier2<br>CSubscription::CreateFromTier2CheckConfig<br>CSubscription::StoreInternal<br>CSubscription::put_Description<br>CSubscription::put_Enabled<br>CSubscription::put_EventClassID<br>CSubscription::put_EventClassPartitionID<br>CSubscription::put_FilterCriteria<br>CSubscription::put_InterfaceID<br>CSubscription::put_MachineName<br>CSubscription::put_MethodName<br>CSubscription::put_OwnerSID<br>CSubscription::put_PerUser<br>CSubscription::put_PublisherID<br>CSubscription::put_SubscriberApplicationID<br>CSubscription::put_SubscriberCLSID<br>CSubscription::put_SubscriberMoniker<br>CSubscription::put_SubscriberPartitionID<br>CSubscription::put_SubscriptionID<br>CSubscription::put_SubscriptionName<br>FUN_180029ce8<br>FUN_18002d2e2<br>InMemoryRegRow::Clear<br>InMemoryRegRow::GetPropertyBag<br>InMemoryRegRow::MapPropertyBag::`scalar_deleting_destructor'<br>InMemoryRegRow::PutValue<br>ObjectChangeFilter::FilterAndFire<br>RegRow::TestConditions<br>RegistryRegRow::ClearMaps<br>`CEventClass2::Store'::__l1::fin$0<br>`CEventSystem2::NotifyLogonUser'::__l1::fin$0<br>`CEventSystem2::RemoveInternal'::__l1::fin$2<br>`CSubscription2::Load'::__l1::fin$0<br>`CSubscription2::Store'::__l1::fin$0<br>`ObjectChangeFilter::FilterAndFire'::__l1::fin$1</details>|<details><summary>Expand for full list:<br>CEventClass2::Load<br>CEventClass2::Store<br>CEventClass::put_AllowInprocActivation<br>CEventClass::put_Description<br>CEventClass::put_EventClassID<br>CEventClass::put_EventClassName<br>CEventClass::put_EventClassPartitionID<br>CEventClass::put_FireInParallel<br>CEventClass::put_FiringInterfaceID<br>CEventClass::put_MultiInterfacePublisherFilterCLSID<br>CEventClass::put_OwnerSID</summary>CEventClass::put_ParallelFiringTimeout<br>CEventClass::put_PublisherID<br>CEventClass::put_TypeLib<br>CEventSystem2::NotifyLogonUser<br>CEventSystem2::RemoveInternal<br>CSubscription2::Load<br>CSubscription2::Store<br>CSubscription::CreateFromTier2<br>CSubscription::CreateFromTier2CheckConfig<br>CSubscription::StoreInternal<br>CSubscription::put_Description<br>CSubscription::put_Enabled<br>CSubscription::put_EventClassID<br>CSubscription::put_EventClassPartitionID<br>CSubscription::put_FilterCriteria<br>CSubscription::put_InterfaceID<br>CSubscription::put_MachineName<br>CSubscription::put_MethodName<br>CSubscription::put_OwnerSID<br>CSubscription::put_PerUser<br>CSubscription::put_PublisherID<br>CSubscription::put_SubscriberApplicationID<br>CSubscription::put_SubscriberCLSID<br>CSubscription::put_SubscriberMoniker<br>CSubscription::put_SubscriberPartitionID<br>CSubscription::put_SubscriptionID<br>CSubscription::put_SubscriptionName<br>FUN_180029a18<br>FUN_18003185c<br>InMemoryRegRow::Clear<br>InMemoryRegRow::GetPropertyBag<br>InMemoryRegRow::MapPropertyBag::`scalar_deleting_destructor'<br>InMemoryRegRow::PutValue<br>ObjectChangeFilter::FilterAndFire<br>RegRow::TestConditions<br>RegistryRegRow::ClearMaps<br>`CEventClass2::Store'::__l1::fin$0<br>`CEventSystem2::NotifyLogonUser'::__l1::fin$0<br>`CEventSystem2::RemoveInternal'::__l1::fin$2<br>`CSubscription2::Load'::__l1::fin$0<br>`CSubscription2::Store'::__l1::fin$0<br>`ObjectChangeFilter::FilterAndFire'::__l1::fin$1</details>|
|paramcount|1|1|
|address|EXTERNAL:00000117|EXTERNAL:00000117|
|sig|HRESULT __stdcall PropVariantClear(PROPVARIANT * pvar)|HRESULT __stdcall PropVariantClear(PROPVARIANT * pvar)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear Calling Diff


```diff
--- API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear calling
+++ API-MS-WIN-CORE-COM-L1-1-1.DLL::PropVariantClear calling
@@ -39,2 +39,2 @@
-FUN_180029ce8
-FUN_18002d2e2
+FUN_180029a18
+FUN_18003185c
```


## NotifyChangedSubscription

### Match Info



|Key|es-pre.dll - es-post.dll|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.86|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|es-pre.dll|es-post.dll|
| :---: | :---: | :---: |
|name|NotifyChangedSubscription|NotifyChangedSubscription|
|fullname|CEventSystem2::NotifyChangedSubscription|CEventSystem2::NotifyChangedSubscription|
|`refcount`|8|6|
|length|138|138|
|called|Notifier::NotifyAllCaches<br>Notifier::NotifyThread::FireNotification|Notifier::NotifyAllCaches<br>Notifier::NotifyThread::FireNotification|
|`calling`|CEventSystem2::RemoveInternal<br>CSubscription2::Store|CEventSystem2::RemoveInternal|
|paramcount|6|6|
|`address`|180012530|180012330|
|sig|long __thiscall NotifyChangedSubscription(CEventSystem2 * this, __MIDL_IEventObjectChange_0001 param_1, ushort * param_2, ushort * param_3, ushort * param_4, ushort * param_5)|long __thiscall NotifyChangedSubscription(CEventSystem2 * this, __MIDL_IEventObjectChange_0001 param_1, ushort * param_2, ushort * param_3, ushort * param_4, ushort * param_5)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### NotifyChangedSubscription Calling Diff


```diff
--- CEventSystem2::NotifyChangedSubscription calling
+++ CEventSystem2::NotifyChangedSubscription calling
@@ -2 +1,0 @@
-CSubscription2::Store
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-16T16:47:37</sub>