# fh_5074.dll-fh_8875.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete](#atlcrbtreeclass_atlcstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short__class_smartptrclass_cconfigdescriptorclass_atlcelementtraitsclass_atlcstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short___class_atlcelementtraitsclass_smartptrclass_cconfigdescriptor__rbdelete) * [Added](#added) * [wil::details::`dynamic_initializer_for_'g_enabledStateManager''](#wildetailsdynamic_initializer_for_g_enabledstatemanager) * [wil::details::`dynamic_initializer_for_'g_featureStateManager''](#wildetailsdynamic_initializer_for_g_featurestatemanager) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultExceptions''](#wildetailsdynamic_initializer_for_g_header_init_initializeresultexceptions) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultHeader''](#wildetailsdynamic_initializer_for_g_header_init_initializeresultheader) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingheaderinternalapi) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingsrumfeaturereporting) * [wil::details::`dynamic_initializer_for_'g_header_init_WilInitialize_ResultMacros_DesktopOrSystem''](#wildetailsdynamic_initializer_for_g_header_init_wilinitialize_resultmacros_desktoporsystem) * [wil::details::`dynamic_initializer_for_'g_processLocalData''](#wildetailsdynamic_initializer_for_g_processlocaldata) * [wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''](#wildetailsdynamic_atexit_destructor_for_g_threadfailurecallbacks) * [`dynamic_initializer_for_'FhWorkerApi_NDR64__table''](#dynamic_initializer_for_fhworkerapi_ndr64__table) * [`dynamic_initializer_for_'FhWorkerApi_table''](#dynamic_initializer_for_fhworkerapi_table) * [operator!=](#operator) * [SmartPtr::SmartPtr](#smartptrclass_cconfigdescriptorsmartptrclass_cconfigdescriptor) * [SmartPtr::Pointer](#smartptrclass_cconfigdescriptorpointer) * [::](#lambda_152aa9d2a3a0648fa2fa7fcef514b376lambda_invoker_cdecl) * [::](#lambda_1ad7ecfab602a777ecf020873216a663lambda_invoker_cdecl) * [::](#lambda_5035b992506f4af81a770c5842624510lambda_invoker_cdecl) * [::](#lambda_d51448ba32f8ef42e59400edd4566183lambda_invoker_cdecl) * [wil::details::ReportFailure_Base<2,0>](#wildetailsreportfailure_base20) * [wil::details::ReportFailure_Base<3,0>](#wildetailsreportfailure_base30) * [wil::details::ReportFailure_GetLastError<3>](#wildetailsreportfailure_getlasterror3) * [wil::details::ReportFailure_GetLastErrorHr<1>](#wildetailsreportfailure_getlasterrorhr1) * [wil::details::ReportFailure_Hr<1>](#wildetailsreportfailure_hr1) * [wil::details::ReportFailure_Hr<2>](#wildetailsreportfailure_hr2) * [wil::details::ReportFailure_Hr<3>](#wildetailsreportfailure_hr3) * [wil::details::ReportFailure_NoReturn<3>](#wildetailsreportfailure_noreturn3) * [wil::details::ReportFailure_Return<1>](#wildetailsreportfailure_return1) * [wil::details::ReportFailure_Return<2>](#wildetailsreportfailure_return2) * [wil::details::WriteResultString](#wildetailswriteresultstringchar_const___ptr64) * [wil::details::WriteResultString](#wildetailswriteresultstringunsigned_short_const___ptr64) * [wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataprocesslocalstoragedataclass_wildetails_abifeaturestatedata) * [wil::details_abi::RawUsageIndex::RawUsageIndex](#wildetails_abirawusageindexrawusageindex) * [wil::ResultException::ResultException](#wilresultexceptionresultexception) * [wil::ResultException::ResultException](#wilresultexceptionresultexception) * [wil::details_abi::UsageIndexes::UsageIndexes](#wildetails_abiusageindexesusageindexes) * [wil::last_error_context::last_error_context](#willast_error_contextlast_error_context) * [wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage](#wildetails_abiprocesslocalstoragestruct_wildetails_abiprocesslocaldataprocesslocalstoragestruct_wildetails_abiprocesslocaldata) * [wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage](#wildetails_abiprocesslocalstorageclass_wildetails_abifeaturestatedataprocesslocalstorageclass_wildetails_abifeaturestatedata) * [wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldataprocesslocalstoragedatastruct_wildetails_abiprocesslocaldata) * [wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataprocesslocalstoragedataclass_wildetails_abifeaturestatedata) * [wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage](#wildetails_abithreadlocalstorageclass_wildetailsthreadfailurecallbackholder___ptr64threadlocalstorageclass_wildetailsthreadfailurecallbackholder___ptr64) * [wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage](#wildetails_abithreadlocalstoragestruct_wildetails_abithreadlocaldatathreadlocalstoragestruct_wildetails_abithreadlocaldata) * [wistd::function::~function](#wistdfunctionbool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intfunctionbool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_int) * [wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailsunsubscribeprocesswideusageflushstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailsunsubscribeprocesswideusageflushstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_) * [wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct_feature_state_change_subscription_____ptr64void___cdeclstruct_feature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64struct_wistdintegral_constantunsigned___int640struct_feature_state_change_subscription_____ptr64struct_feature_state_change_subscription_____ptr640stdnullptr_t_) * [wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__rtl_critical_section___ptr64void___cdeclstruct__rtl_critical_section___ptr64void___cdecl_leavecriticalsectionstruct__rtl_critical_section___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_critical_section___ptr64struct__rtl_critical_section___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__rtl_critical_section___ptr64void___cdeclstruct__rtl_critical_section___ptr64void___cdecl_leavecriticalsectionstruct__rtl_critical_section___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_critical_section___ptr64struct__rtl_critical_section___ptr640stdnullptr_t_) * [wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlocksharedstruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlocksharedstruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsunregisterwilfeatureconfigurationchangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64void___cdecl_wildetailsunregisterwilfeatureconfigurationchangevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsreleasemutexvoid___ptr64struct_wistdintegral_constantunsigned___int642void___ptr64void___ptr640stdnullptr_t_unique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsreleasemutexvoid___ptr64struct_wistdintegral_constantunsigned___int642void___ptr64void___ptr640stdnullptr_t_) * [wil::details::EnabledStateManager::~EnabledStateManager](#wildetailsenabledstatemanagerenabledstatemanager) * [wil::details_abi::FeatureStateData::~FeatureStateData](#wildetails_abifeaturestatedatafeaturestatedata) * [wil::details::FeatureStateManager::~FeatureStateManager](#wildetailsfeaturestatemanagerfeaturestatemanager) * [wil::details_abi::RawUsageIndex::~RawUsageIndex](#wildetails_abirawusageindexrawusageindex) * [wil::ResultException::~ResultException](#wilresultexceptionresultexception) * [wil::details_abi::SemaphoreValue::~SemaphoreValue](#wildetails_abisemaphorevaluesemaphorevalue) * [wil::details_abi::SubscriptionList::~SubscriptionList](#wildetails_abisubscriptionlistsubscriptionlist) * [wil::details_abi::UsageIndexes::~UsageIndexes](#wildetails_abiusageindexesusageindexes) * [wil::last_error_context::~last_error_context](#willast_error_contextlast_error_context) * [wistd::unique_ptr::operator=](#wistdunique_ptrvoidstruct_wilprocess_heap_deleteroperator) * [wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()](#wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intoperator) * [wistd::__function::__base::`scalar_deleting_destructor'](#wistd__function__basebool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_intscalar_deleting_destructor) * [wil::ResultException::`vector_deleting_destructor'](#wilresultexceptionvector_deleting_destructor) * [wil::details_abi::ProcessLocalStorageData::Acquire](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldataacquire) * [wil::details_abi::ProcessLocalStorageData::Acquire](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedataacquire) * [wil::details_abi::ThreadLocalData::Clear](#wildetails_abithreadlocaldataclear) * [wil::details::CloseHandle](#wildetailsclosehandle) * [wil::details_abi::UsageIndexProperty::Compare](#wildetails_abiusageindexpropertycompare) * [wil::details_abi::SemaphoreValue::CreateFromValueInternal](#wildetails_abisemaphorevaluecreatefromvalueinternal) * [wil::details::DestroyThreadPoolTimer::Destroy](#wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroy) * [wil::details_abi::SemaphoreValue::Destroy](#wildetails_abisemaphorevaluedestroy) * [wil::details::EnsureCoalescedTimer_SetTimer](#wildetailsensurecoalescedtimer_settimer) * [wil::details::FeatureStateManager::EnsureStateData](#wildetailsfeaturestatemanagerensurestatedata) * [wil::details::EnsureSubscribedToFeatureConfigurationChanges](#wildetailsensuresubscribedtofeatureconfigurationchanges) * [wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl](#wildetailsenabledstatemanagerensuresubscribedtofeatureconfigurationchangesimpl) * [wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock](#wildetailsfeaturestatemanagerensuresubscribedtoprocesswideusageflushunderlock) * [wil::details::in1diag3::FailFast_Unexpected](#wildetailsin1diag3failfast_unexpected) * [wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement](#wildetails_abirawusageindexfindinsertionpointorincrement) * [wil::details::FeatureStateManager::FlushUsage](#wildetailsfeaturestatemanagerflushusage) * [wil::details::FormatNtStatusMsg](#wildetailsformatntstatusmsg) * [wil::details::FreeProcessHeap](#wildetailsfreeprocessheap) * [wil::details::ResultStatus::FromResult](#wildetailsresultstatusfromresult) * [wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure](#wildetailsthreadfailurecallbackholdergetcontextandnotifyfailure) * [wil::details::GetContextAndNotifyFailure](#wildetailsgetcontextandnotifyfailure) * [wil::details::GetCurrentModuleName](#wildetailsgetcurrentmodulename) * [wil::GetFailureLogString](#wilgetfailurelogstring) * [wil::details::GetLastErrorFail](#wildetailsgetlasterrorfail) * [wil::details::GetLastErrorFailHr](#wildetailsgetlasterrorfailhr) * [wil::details_abi::ThreadLocalStorage::GetLocal](#wildetails_abithreadlocalstorageclass_wildetailsthreadfailurecallbackholder___ptr64getlocal) * [wil::details_abi::ThreadLocalStorage::GetLocal](#wildetails_abithreadlocalstoragestruct_wildetails_abithreadlocaldatagetlocal) * [wil::details::GetModuleInformation](#wildetailsgetmoduleinformation) * [wil::details_abi::ProcessLocalStorage::GetShared](#wildetails_abiprocesslocalstoragestruct_wildetails_abiprocesslocaldatagetshared) * [wil::details_abi::UsageIndexProperty::GetSize](#wildetails_abiusageindexpropertygetsize) * [wil::details::ThreadFailureCallbackHolder::GetThreadContext](#wildetailsthreadfailurecallbackholdergetthreadcontext) * [wil::details_abi::GetThreadLocalDataCache](#wildetails_abigetthreadlocaldatacache) * [wil::details_abi::SemaphoreValue::GetValueFromSemaphore](#wildetails_abisemaphorevaluegetvaluefromsemaphore) * [wil::details::HrToNtStatus](#wildetailshrtontstatus) * [wil::details::IsFeatureConfigured](#wildetailsisfeatureconfigured) * [wil::details_abi::RawUsageIndex::Iterate](#wildetails_abirawusageindexiterate) * [wil::details::LogFailure](#wildetailslogfailure) * [wil::details::LogStringPrintf](#wildetailslogstringprintf) * [wil::details_abi::RawUsageIndex::LowerBound](#wildetails_abirawusageindexlowerbound) * [wil::details_abi::ProcessLocalStorageData::MakeAndInitialize](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldatamakeandinitialize) * [wil::details_abi::ProcessLocalStorageData::MakeAndInitialize](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedatamakeandinitialize) * [wil::details::MicrosoftInternalNotifyFailure](#wildetailsmicrosoftinternalnotifyfailure) * [wil::details::NtStatusToHr](#wildetailsntstatustohr) * [wil::details_abi::SubscriptionList::OnSignaled](#wildetails_abisubscriptionlistonsignaled) * [wil::details::EnabledStateManager::OnStateChange](#wildetailsenabledstatemanageronstatechange) * [wil::details::ProcessHeapAlloc](#wildetailsprocessheapalloc) * [wil::details::EnabledStateManager::ProcessShutdown](#wildetailsenabledstatemanagerprocessshutdown) * [wil::details_abi::FeatureStateData::ProcessShutdown](#wildetails_abifeaturestatedataprocessshutdown) * [wil::ProcessShutdownInProgress](#wilprocessshutdowninprogress) * [wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting](#wildetailsfeaturestatemanagerqueuebackgroundsrumusagereporting) * [wil::details_abi::UsageIndexProperty::Read](#wildetails_abiusageindexpropertyread) * [wil::details_abi::UsageIndexes::Record](#wildetails_abiusageindexesrecord) * [wil::details::EnabledStateManager::RecordCachedUsageUnderLock](#wildetailsenabledstatemanagerrecordcachedusageunderlock) * [wil::details::RecordException](#wildetailsrecordexception) * [wil::details::RecordFailFast](#wildetailsrecordfailfast) * [wil::details_abi::FeatureStateData::RecordFeatureUsage](#wildetails_abifeaturestatedatarecordfeatureusage) * [wil::details::FeatureStateManager::RecordFeatureUsage](#wildetailsfeaturestatemanagerrecordfeatureusage) * [wil::details::RecordLog](#wildetailsrecordlog) * [wil::details::RecordReturn](#wildetailsrecordreturn) * [wil::details_abi::UsageIndex::RecordUsage](#wildetails_abiusageindexenum_wil_details_servicereportingkindunsigned_int2recordusage) * [wil::details_abi::UsageIndex::RecordUsage](#wildetails_abiusageindexenum_wil_details_servicereportingkindunsigned_int0recordusage) * [wil::details_abi::FeatureStateData::RecordUsage](#wildetails_abifeaturestatedatarecordusage) * [wil::details_abi::RawUsageIndex::RecordUsage](#wildetails_abirawusageindexrecordusage) * [wil::details_abi::RawUsageIndex::RecordUsageInternal](#wildetails_abirawusageindexrecordusageinternal) * [wil::details_abi::RecordWnfUsageIndex](#wildetails_abirecordwnfusageindex) * [wil::details_abi::ProcessLocalStorageData::Release](#wildetails_abiprocesslocalstoragedatastruct_wildetails_abiprocesslocaldatarelease) * [wil::details_abi::ProcessLocalStorageData::Release](#wildetails_abiprocesslocalstoragedataclass_wildetails_abifeaturestatedatarelease) * [wil::details::ReleaseMutex](#wildetailsreleasemutex) * [wil::details::ResultStringSize](#wildetailsresultstringsize) * [wil::details::ResultStringSize](#wildetailsresultstringsize) * [wil::details::Rethrow](#wildetailsrethrow) * [wil::details_abi::FeatureStateData::RetrieveUsageUnderLock](#wildetails_abifeaturestatedataretrieveusageunderlock) * [wil::details::in1diag3::Return_GetLastError](#wildetailsin1diag3return_getlasterror) * [wil::details::in1diag3::Return_Hr](#wildetailsin1diag3return_hr) * [wil::details::RtlDllShutdownInProgress](#wildetailsrtldllshutdowninprogress) * [wil::details::RtlNtStatusToDosErrorNoTeb](#wildetailsrtlntstatustodoserrornoteb) * [wil::details_abi::ThreadLocalFailureInfo::Set](#wildetails_abithreadlocalfailureinfoset) * [wil::details_abi::RawUsageIndex::SetBuffer](#wildetails_abirawusageindexsetbuffer) * [wil::StoredFailureInfo::SetFailureInfo](#wilstoredfailureinfosetfailureinfo) * [wil::details_abi::ThreadLocalData::SetLastError](#wildetails_abithreadlocaldatasetlasterror) * [wil::details_abi::RawUsageIndex::SkipValues](#wildetails_abirawusageindexskipvalues) * [StringCchCatW](#stringcchcatw) * [StringCchCopyA](#stringcchcopya) * [StringCchCopyW](#stringcchcopyw) * [StringCopyWorkerW](#stringcopyworkerw) * [StringVPrintfWorkerW](#stringvprintfworkerw) * [StringValidateDestW](#stringvalidatedestw) * [wil::details::FeatureStateManager::SubscribeToEnabledStateChanges](#wildetailsfeaturestatemanagersubscribetoenabledstatechanges) * [wil::details::FeatureStateManager::SubscribeToUsageFlush](#wildetailsfeaturestatemanagersubscribetousageflush) * [wil::details_abi::SubscriptionList::SubscribeUnderLock](#wildetails_abisubscriptionlistsubscribeunderlock) * [wil::details_abi::RawUsageIndex::Swap](#wildetails_abirawusageindexswap) * [wil::details::ThrowResultExceptionInternal](#wildetailsthrowresultexceptioninternal) * [wil::details_abi::SemaphoreValue::TryGetPointer](#wildetails_abisemaphorevaluetrygetpointer) * [wil::details_abi::SemaphoreValue::TryGetValueInternal](#wildetails_abisemaphorevaluetrygetvalueinternal) * [wil::details_abi::SubscriptionList::Unsubscribe](#wildetails_abisubscriptionlistunsubscribe) * [wil::details::UnsubscribeProcessWideUsageFlush](#wildetailsunsubscribeprocesswideusageflush) * [wil::details_abi::UsageIndexProperty::UpdateCount](#wildetails_abiusageindexpropertyupdatecount) * [wil::details::WilApiImpl_GetFeatureEnabledState](#wildetailswilapiimpl_getfeatureenabledstate) * [wil::details::WilApiImpl_RecordFeatureUsage](#wildetailswilapiimpl_recordfeatureusage) * [wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification](#wildetailswilapiimpl_subscribefeaturestatechangenotification) * [wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification](#wildetailswilapiimpl_unsubscribefeaturestatechangenotification) * [wil::details::WilApi_RecordFeatureUsage](#wildetailswilapi_recordfeatureusage) * [wil::details::WilApi_RecordFeatureUsageReports](#wildetailswilapi_recordfeatureusagereports) * [wil::details::WilApi_UnsubscribeFeatureStateChangeNotification](#wildetailswilapi_unsubscribefeaturestatechangenotification) * [wil::details::WilDynamicLoadRaiseFailFastException](#wildetailswildynamicloadraisefailfastexception) * [wil::details::WilFailFast](#wildetailswilfailfast) * [wil::details::WilRaiseFailFastException](#wildetailswilraisefailfastexception) * [wil::details_abi::UsageIndexProperty::Write](#wildetails_abiusageindexpropertywrite) * [wil::details::in1diag3::_FailFast_GetLastError](#wildetailsin1diag3_failfast_getlasterror) * [wil::details::in1diag3::_FailFast_Unexpected](#wildetailsin1diag3_failfast_unexpected) * [wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone](#wistd__function__funcclass_lambda_8db0ce862824541f40dfb767113f1e28bool___cdeclvoid___ptr64unsigned___int64void___ptr64unsigned___int64unsigned_int__clone) * [wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire](#wilmutex_tclass_wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_struct_wilerr_returncode_policyacquire) * [wil::details::shared_buffer::assign](#wildetailsshared_bufferassign) * [wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create](#wilsemaphore_tclass_wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_struct_wilerr_returncode_policycreate) * [wil::details_abi::heap_buffer::ensure](#wildetails_abiheap_bufferensure) * [wil::details_abi::heap_buffer::push_back](#wildetails_abiheap_bufferpush_back) * [wil::details_abi::heap_buffer::reserve](#wildetails_abiheap_bufferreserve) * [wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset](#wildetailsunique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_reset) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsclosehandlevoid___ptr64struct_wistdintegral_constantunsigned___int640void___ptr64void___ptr640stdnullptr_t_reset) * [wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset](#wildetailsunique_storagestruct_wildetailsresource_policyvoid___ptr64void___cdeclvoid___ptr64_noexceptvoid___cdecl_wildetailsreleasemutexvoid___ptr64struct_wistdintegral_constantunsigned___int642void___ptr64void___ptr640stdnullptr_t_reset) * [wil::details::shared_buffer::reset](#wildetailsshared_bufferreset) * [wil::ResultException::what](#wilresultexceptionwhat) * [wil_details_GetKernelBaseProcAddress](#wil_details_getkernelbaseprocaddress) * [wil_details_GetNtDllModuleHandle](#wil_details_getntdllmodulehandle) * [wil_details_GetNtDllProcedureAddress](#wil_details_getntdllprocedureaddress) * [wil_details_WriteSRUMWnfUsageBuffer](#wil_details_writesrumwnfusagebuffer) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_RtlStagingConfig_RecordFeatureUsage](#wil_rtlstagingconfig_recordfeatureusage) * [wil_StagingConfig_LogStagedFeatureUsage](#wil_stagingconfig_logstagedfeatureusage) * [wil_details_NtQueryWnfStateData](#wil_details_ntquerywnfstatedata) * [wil_details_NtUpdateWnfStateData](#wil_details_ntupdatewnfstatedata) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil_details_RtlRegisterFeatureConfigurationChangeNotification](#wil_details_rtlregisterfeatureconfigurationchangenotification) * [::](#lambda_aa194dc0bf891154933407eb98fb868alambda_invoker_cdecl) * [wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush](#wildetailsenabledstatemanagerensuresubscribedtousageflush) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_2475400507getcachedfeatureenabledstate) * [Max Added Section Functions Reached Error](#max-added-section-functions-reached-error) * [Modified](#modified) * [ServiceMain](#servicemain) * [CManagerThread::BlockConfig](#cmanagerthreadblockconfig) * [CConfigDescriptor::CConfigDescriptor](#cconfigdescriptorcconfigdescriptor) * [CManagerThread::EnterMaintenanceMode](#cmanagerthreadentermaintenancemode) * [CManagerThread::ExitMaintenanceMode](#cmanagerthreadexitmaintenancemode) * [StringCchPrintfW](#stringcchprintfw) * [AllocSessionProperties](#allocsessionproperties) * [CFhService::ShutdownService](#cfhserviceshutdownservice) * [CManagerThread::WaitCallback](#cmanagerthreadwaitcallback) * [CManagerThread::CreateWorkerThread](#cmanagerthreadcreateworkerthread) * [CConfigDescriptor::RefreshPoliciesInEngine](#cconfigdescriptorrefreshpoliciesinengine) * [CManagerThread::QueueConfig](#cmanagerthreadqueueconfig) * [CFhService::StartServiceW](#cfhservicestartservicew) * [CManagerThread::StopConfig](#cmanagerthreadstopconfig) * [CManagerThread::Stop](#cmanagerthreadstop) * [CManagerThread::UpdatePowerState](#cmanagerthreadupdatepowerstate) * [CManagerThread::QueueBackupForLoggedOnUser](#cmanagerthreadqueuebackupforloggedonuser) * [CConfigDescriptor::~CConfigDescriptor](#cconfigdescriptorcconfigdescriptor) * [CManagerThread::HandleDeviceEvent](#cmanagerthreadhandledeviceevent) * [WPP_SF_sS](#wpp_sf_ss) * [FhSvcApiOpenPipe](#fhsvcapiopenpipe) * [CFhService::StopServiceCallback](#cfhservicestopservicecallback) * [CWorkerThread::CWorkerThread](#cworkerthreadcworkerthread) * [ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum](#atlcrbtreeclass_atlcstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short__class_smartptrclass_cconfigdescriptorclass_atlcelementtraitsclass_atlcstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short___class_atlcelementtraitsclass_smartptrclass_cconfigdescriptor__minimum) * [ATL::CStringT_>_>::CStringT_>_>](#atlcstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short__cstringtunsigned_shortclass_atlstrtraitatlunsigned_shortclass_atlchtraitscrtunsigned_short__) * [CWorkerThread::Create](#cworkerthreadcreate) * [CManagerThread::PublishProtectionState](#cmanagerthreadpublishprotectionstate) * [WPP_SF_D](#wpp_sf_d) * [Modified (No Code Changes)](#modified-no-code-changes) * [Section Skipped](#section-skipped) # Visual Chart Diff ```mermaid flowchart LR ServiceMain-2-old<--Match 67%-->ServiceMain-2-new CManagerThreadBlockConfig-2-old<--Match 6%-->CManagerThreadBlockConfig-2-new CConfigDescriptorCConfigDescriptor-1-old<--Match 75%-->CConfigDescriptorCConfigDescriptor-1-new CManagerThreadEnterMaintenanceMode-1-old<--Match 88%-->CManagerThreadEnterMaintenanceMode-1-new CManagerThreadExitMaintenanceMode-1-old<--Match 88%-->CManagerThreadExitMaintenanceMode-1-new StringCchPrintfW-3-old<--Match 30%-->StringCchPrintfW-3-new AllocSessionProperties-2-old<--Match 73%-->AllocSessionProperties-2-new CFhServiceShutdownService-1-old<--Match 75%-->CFhServiceShutdownService-1-new CManagerThreadWaitCallback-4-old<--Match 25%-->CManagerThreadWaitCallback-4-new CManagerThreadCreateWorkerThread-3-old<--Match 10%-->CManagerThreadCreateWorkerThread-3-new CConfigDescriptorRefreshPoliciesInEngine-3-old<--Match 97%-->CConfigDescriptorRefreshPoliciesInEngine-3-new CManagerThreadQueueConfig-6-old<--Match 48%-->CManagerThreadQueueConfig-6-new CFhServiceStartServiceW-1-old<--Match 37%-->CFhServiceStartServiceW-1-new CManagerThreadStopConfig-3-old<--Match 10%-->CManagerThreadStopConfig-3-new CManagerThreadStop-1-old<--Match 5%-->CManagerThreadStop-1-new CManagerThreadUpdatePowerState-1-old<--Match 19%-->CManagerThreadUpdatePowerState-1-new CManagerThreadQueueBackupForLoggedOnUser-2-old<--Match 97%-->CManagerThreadQueueBackupForLoggedOnUser-2-new CConfigDescriptorCConfigDescriptor-1-old<--Match 40%-->CConfigDescriptorCConfigDescriptor-1-new CManagerThreadHandleDeviceEvent-3-old<--Match 54%-->CManagerThreadHandleDeviceEvent-3-new WPP_SF_sS-5-old<--Match 97%-->WPP_SF_sS-5-new FhSvcApiOpenPipe-3-old<--Match 99%-->FhSvcApiOpenPipe-3-new CFhServiceStopServiceCallback-2-old<--Match 49%-->CFhServiceStopServiceCallback-2-new CWorkerThreadCWorkerThread-1-old<--Match 62%-->wildetails_abiSubscriptionListSubscriptionList-1-new ATLCRBTreeclass_ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__class_SmartPtrclass_CConfigDescriptorclass_ATLCElementTraitsclass_ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short___class_ATLCElementTraitsclass_SmartPtrclass_CConfigDescriptor__Minimum-2-old<--Match 18%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_2475400507__private_IsEnabled-2-new ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__CStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__-2-old<--Match 62%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_2475400507__private_IsEnabled-2-new CWorkerThreadCreate-6-old<--Match 4%-->CConfigDescriptorUpdateRuntimePolicies-6-new fh_5074.dll<--3ommited-->fh_8875.dll subgraph fh_8875.dll ServiceMain-2-new CManagerThreadBlockConfig-2-new CConfigDescriptorCConfigDescriptor-1-new CManagerThreadEnterMaintenanceMode-1-new CManagerThreadExitMaintenanceMode-1-new StringCchPrintfW-3-new AllocSessionProperties-2-new CFhServiceShutdownService-1-new CManagerThreadWaitCallback-4-new CManagerThreadCreateWorkerThread-3-new CConfigDescriptorRefreshPoliciesInEngine-3-new CManagerThreadQueueConfig-6-new CFhServiceStartServiceW-1-new CManagerThreadStopConfig-3-new CManagerThreadStop-1-new CManagerThreadUpdatePowerState-1-new CManagerThreadQueueBackupForLoggedOnUser-2-new CConfigDescriptorCConfigDescriptor-1-new CManagerThreadHandleDeviceEvent-3-new WPP_SF_sS-5-new FhSvcApiOpenPipe-3-new CFhServiceStopServiceCallback-2-new wildetails_abiSubscriptionListSubscriptionList-1-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_2475400507__private_IsEnabled-2-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_2475400507__private_IsEnabled-2-new CConfigDescriptorUpdateRuntimePolicies-6-new subgraph Added direction LR wil-details-dynamic_initializer_for_g_enabledStateManager wil-details-dynamic_initializer_for_g_featureStateManager wil-details-dynamic_initializer_for_g_header_init_InitializeResultExceptions wil-details-dynamic_initializer_for_g_header_init_InitializeResultHeader wil-details-dynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi wil-details-dynamic_initializer_for_g_header_init_InitializeStagingSRUMFeatureReporting wil-details-dynamic_initializer_for_g_header_init_WilInitialize_ResultMacros_DesktopOrSystem wil-details-dynamic_initializer_for_g_processLocalData wil-details-dynamic_atexit_destructor_for_g_threadFailureCallbacks dynamic_initializer_for_FhWorkerApi_NDR64__table dynamic_initializer_for_FhWorkerApi_table operator SmartPtrclass_CConfigDescriptor-SmartPtrclass_CConfigDescriptor SmartPtrclass_CConfigDescriptor-Pointer lambda_152aa9d2a3a0648fa2fa7fcef514b376-lambda_invoker_cdecl lambda_1ad7ecfab602a777ecf020873216a663-lambda_invoker_cdecl lambda_5035b992506f4af81a770c5842624510-lambda_invoker_cdecl lambda_d51448ba32f8ef42e59400edd4566183-lambda_invoker_cdecl wil-details-ReportFailure_Base20 wil-details-ReportFailure_Base30 wil-details-ReportFailure_GetLastError3 wil-details-ReportFailure_GetLastErrorHr1 wil-details-ReportFailure_Hr1 wil-details-ReportFailure_Hr2 wil-details-ReportFailure_Hr3 wil-details-ReportFailure_NoReturn3 wil-details-ReportFailure_Return1 270_more_added_funcs_omitted end end subgraph fh_5074.dll ServiceMain-2-old CManagerThreadBlockConfig-2-old CConfigDescriptorCConfigDescriptor-1-old CManagerThreadEnterMaintenanceMode-1-old CManagerThreadExitMaintenanceMode-1-old StringCchPrintfW-3-old AllocSessionProperties-2-old CFhServiceShutdownService-1-old CManagerThreadWaitCallback-4-old CManagerThreadCreateWorkerThread-3-old CConfigDescriptorRefreshPoliciesInEngine-3-old CManagerThreadQueueConfig-6-old CFhServiceStartServiceW-1-old CManagerThreadStopConfig-3-old CManagerThreadStop-1-old CManagerThreadUpdatePowerState-1-old CManagerThreadQueueBackupForLoggedOnUser-2-old CConfigDescriptorCConfigDescriptor-1-old CManagerThreadHandleDeviceEvent-3-old WPP_SF_sS-5-old FhSvcApiOpenPipe-3-old CFhServiceStopServiceCallback-2-old CWorkerThreadCWorkerThread-1-old ATLCRBTreeclass_ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__class_SmartPtrclass_CConfigDescriptorclass_ATLCElementTraitsclass_ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short___class_ATLCElementTraitsclass_SmartPtrclass_CConfigDescriptor__Minimum-2-old ATLCStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__CStringTunsigned_shortclass_ATLStrTraitATLunsigned_shortclass_ATLChTraitsCRTunsigned_short__-2-old CWorkerThreadCreate-6-old subgraph Deleted direction LR ATL-CRBTreeclass_ATL-CStringTunsigned_shortclass_ATL-StrTraitATLunsigned_shortclass_ATL-ChTraitsCRTunsigned_short__class_SmartPtrclass_CConfigDescriptorclass_ATL-CElementTraitsclass_ATL-CStringTunsigned_shortclass_ATL-StrTraitATLunsigned_shortclass_ATL-ChTraitsCRTunsigned_short___class_ATL-CElementTraitsclass_SmartPtrclass_CConfigDescriptor__-RBDelete end end ``` ```mermaid pie showData title Function Matches - 77.4562% "unmatched_funcs_len" : 296 "matched_funcs_len" : 1017 ``` ```mermaid pie showData title Matched Function Similarity - 87.4140% "matched_funcs_with_code_changes_len" : 28 "matched_funcs_with_non_code_changes_len" : 100 "matched_funcs_no_changes_len" : 889 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 fh_5074.dll fh_8875.dll ``` #### Verbose Args
``` --old ['fh_5074.dll'] --new [['fh_8875.dll']] --engine VersionTrackingDiff --output-path fh_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/fhsvc.dll/11DADC7E24000/fhsvc.dll -O fhsvc.dll.x64.10.0.26100.5074 wget https://msdl.microsoft.com/download/symbols/fhsvc.dll/6445091D36000/fhsvc.dll -O fhsvc.dll.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- fh_5074.dll Meta +++ fh_8875.dll Meta @@ -1,44 +1,44 @@ -Program Name: fh_5074.dll +Program Name: fh_8875.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 153680 +# of Bytes: 223792 # of Memory Blocks: 9 -# of Instructions: 17748 -# of Defined Data: 1596 -# of Functions: 503 -# of Symbols: 3137 -# of Data Types: 520 -# of Data Type Categories: 45 +# of Instructions: 31673 +# of Defined Data: 2255 +# of Functions: 810 +# of Symbols: 5620 +# of Data Types: 719 +# of Data Type Categories: 52 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Fri Aug 21 21:48:25 SGT 2026 +Date Created: Fri Aug 21 21:48:28 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/fh/fh_5074.dll -Executable MD5: b6efb6040fdda38ca6f692c0e40cf71a -Executable SHA256: e607433d2075c4a3feb4ee2c6637a878de33b3eda5f026c3067469c1ec9fab3b -FSRL: file:///tmp/fh/fh_5074.dll?MD5=b6efb6040fdda38ca6f692c0e40cf71a +Executable Location: /tmp/fh/fh_8875.dll +Executable MD5: 6e33a9a23330187965947b2d739a9a3a +Executable SHA256: 21784a0e6189de885713959ce9878764c84acfc3d97c53b0fec2831d9da7f578 +FSRL: file:///tmp/fh/fh_8875.dll?MD5=6e33a9a23330187965947b2d739a9a3a PDB Age: 1 PDB File: fhsvc.pdb -PDB GUID: 51adceb3-e5a3-d087-5a13-d1e6bcd67389 +PDB GUID: 1cd8e43e-36c5-dc9b-b456-5c2d4b6e401c PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: File History Service -PE Property[FileVersion]: 10.0.26100.5074 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: fhsvc.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: fhsvc.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.5074 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra fh_5074.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fh_5074.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fh_5074.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra fh_8875.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra fh_8875.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra fh_8875.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|295| |deleted_funcs_len|1| |modified_funcs_len|128| |added_symbols_len|155| |deleted_symbols_len|4| |diff_time|16.749001502990723| |deleted_strings_len|0| |added_strings_len|50| |match_types|Counter({'SymbolsHash': 493, 'ExternalsName': 159, 'Implied Match': 5, 'ExactInstructionsFunctionHasher': 1, 'BSIM': 1})| |items_to_process|583| |diff_types|Counter({'address': 128, 'refcount': 111, 'calling': 95, 'called': 36, 'length': 29, 'code': 28, 'name': 7, 'fullname': 7, 'sig': 7, 'parent': 5})| |unmatched_funcs_len|296| |total_funcs_len|1313| |matched_funcs_len|1017| |matched_funcs_with_code_changes_len|28| |matched_funcs_with_non_code_changes_len|100| |matched_funcs_no_changes_len|889| |match_func_similarity_percent|87.4140%| |func_match_overall_percent|77.4562%| |first_matches|Counter({'SymbolsHash': 493, 'Implied Match': 5, 'ExactInstructionsFunctionHasher': 1, 'BSIM': 1, 'ExternalsName': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 493 "ExternalsName" : 159 "ExactInstructionsFunctionHasher" : 1 "BSIM" : 1 "Implied-Match" : 5 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 493 "ExactInstructionsFunctionHasher" : 1 "BSIM" : 1 "Implied-Match" : 5 "ExternalsName" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 295 "deleted_funcs_len" : 1 "modified_funcs_len" : 128 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 155 "deleted_symbols_len" : 4 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 50 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,50 @@ +s +s_Exception +s_FailFast +s_LogHr +s_LogNt +s_LogStagedFeatureUsage +s_NtQueryWnfStateData +s_NtUpdateWnfStateData +s_RaiseFailFastException +s_ReturnHr +s_ReturnNt +s_RtlDisownModuleHeapAllocation +s_RtlDllShutdownInProgress +s_RtlNotifyFeatureUsage +s_RtlNtStatusToDosErrorNoTeb +s_RtlQueryFeatureConfiguration +s_RtlRegisterFeatureConfiguration +s_RtlUnregisterFeatureConfigurati +s_WIL_Exception +s_WilError +s_WilFailureNotifyWatchers +s_WilStaging +s_onecore\internal\sdk\inc\wil/St +s_onecore\internal\sdk\inc\wil\op +s_wil +u +u_%hs!%p: +u_%hs(%d)_tid(%x) +u_%hs(%u)\%hs!%p: +u_(caller:_%p) +u_APPDATA +u_CallContext:[%h +u_FhWorker_%s +u_HOMEDRIVE +u_HOMEPATH +u_LOCALAPPDATA +u_Local\SM0:%lu:% +u_Msg:[%ws] +u_SeBackupPrivile +u_SeRestorePrivil +u_TEMP +u_TMP +u_USERPROFILE +u_[%hs(%hs)] +u_[%hs] +u__p0 +u_fhmanagew.exe_- +u_h +u_kernelbase.dll +u_ntdll.dll ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_wil|3|ReportFailure_Return<1>,ReportFailure_GetLastErrorHr<1>| |u_[%hs(%hs)]_|1|GetFailureLogString| |s_Exception|1|GetFailureLogString| |u_%hs(%d)_tid(%x)|1|GetFailureLogString| |u_SeBackupPrivile|1|CreateWorkerThread| |s_WilFailureNotifyWatchers|1|MicrosoftInternalNotifyFailure| |s_RtlUnregisterFeatureConfigurati|1|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |u_h|2|TryGetValueInternal,CreateFromValueInternal| |s_RtlDllShutdownInProgress|1|RtlDllShutdownInProgress| |u_CallContext:[%h|1|GetFailureLogString| |u_Local\SM0:%lu:%|2|Acquire| |u_SeRestorePrivil|1|CreateWorkerThread| |s_LogHr|1|GetFailureLogString| |u_%hs!%p:_|1|GetFailureLogString| |s_WilStaging_02|306|WriteTraceHeader,Create,RpcUnregisterServer,ReportStatus,CreateMaintenanceModeEvent,DuplicateConfiguration,WaitCallback,FHSVC_PIPE_HANDLE_rundown,ReleaseResources,catch$2,FhWorkerGetUsnRecordForFrn,QueueBackupForAllLoggedOnUsers,FhWorkerInitUsnScan,FhWorkerReportBackupStatus,catch$1,catch$58,FhSvcApiEnterMaintenanceMode,catch$29,LoadUserConfiguration,ServiceControlHandler,UpdatePowerState,ClearProtectionState,WorkCallback,ValidateAndCountRegisteredConfigs,RecordWorkerStatus,MigrationStarting,RefreshPoliciesInEngine,MigrationFinished,StopConfig,SetBackupMoratorium,FhSvcApiMigrationFinished,FhSvcApiClearProtectionState,CachePropertiesInRegistry,SetServiceStartType,catch$28,FhSvcApiExitMaintenanceMode,FHSVC_PIPE_HANDLE_rundown$catch$6,StartServiceW,QueueConfig,ExitMaintenanceMode,BlockConfig,StartTargetVolumeTracking,ShutdownService,GetConfigDescriptor,PublishProtectionState,AddRemoveRegisteredConfig,EnterMaintenanceMode,FhSvcApiBlockUnblockBackup,ReloadPolicies,FhSvcApiStopBackup,catch$5,FhSvcApiMigrationStarting,QueueBackupForLoggedOnUser,FhSvcApiOpenPipe,FhWorkerGetNextUsnBatch,HandleDeviceEvent,Start,FhSvcApiStopBackup$catch$6,catch$27,FhSvcApiStartBackup,FhSvcApiClosePipe,UnblockConfig,FhSvcApiBlockUnblockBackup$catch$7,CreateWorkerThread,WorkerIfInitOnceCallback,catch$3,RpcRegisterServer,StopServiceCallback,UpdateRuntimePolicies,Stop| |s_WilError_03|1|| |u_kernelbase.dll|2|wil_details_GetKernelBaseProcAddress,WilDynamicLoadRaiseFailFastException| |u_TEMP|1|| |u_%hs(%u)\%hs!%p:|1|GetFailureLogString| |s_|1|GetFailureLogString| |u_USERPROFILE|1|| |u_APPDATA|9|CreateSanitizedEnvironmentBlock_MSRC115612| |s_RaiseFailFastException|1|WilDynamicLoadRaiseFailFastException| |u_FhWorker_%s|1|WorkerIfInitOnceCallback| |u_HOMEPATH|1|| |s_WIL_Exception|1|what| |u_Msg:[%ws]_|1|GetFailureLogString| |s_RtlNtStatusToDosErrorNoTeb|1|RtlNtStatusToDosErrorNoTeb| |u_HOMEDRIVE|5|CreateSanitizedEnvironmentBlock_MSRC115612| |s_RtlQueryFeatureConfiguration|1|wil_RtlStagingConfig_QueryFeatureState| |s_RtlNotifyFeatureUsage|1|wil_RtlStagingConfig_RecordFeatureUsage| |s_NtQueryWnfStateData|1|wil_details_NtQueryWnfStateData| |u_LOCALAPPDATA|1|| |u_[%hs]_|1|GetFailureLogString| |u_fhmanagew.exe_-|1|CreateWorkerThread| |s_ReturnHr|1|GetFailureLogString| |u__p0|2|TryGetValueInternal,CreateFromValueInternal| |s_ReturnNt|1|GetFailureLogString| |u_TMP|1|| |s_RtlRegisterFeatureConfiguration|1|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |s_LogStagedFeatureUsage|1|wil_StagingConfig_LogStagedFeatureUsage| |s_onecore\internal\sdk\inc\wil\op|3|ReportFailure_GetLastError<3>,FailFast_Unexpected| |s_LogNt|1|GetFailureLogString| |s_NtUpdateWnfStateData|1|wil_details_NtUpdateWnfStateData| |s_RtlDisownModuleHeapAllocation|1|ProcessHeapAlloc| |u_ntdll.dll|2|wil_details_GetNtDllModuleHandle,ProcessHeapAlloc| |s_onecore\internal\sdk\inc\wil/St|1|_FailFast_Unexpected| |u_____|1|GetFailureLogString| |u_(caller:_%p)_|1|GetFailureLogString| |s_FailFast|2|GetFailureLogString| # Deleted ## ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete ### Function Meta |Key|fh_5074.dll| | :---: | :---: | |name|RBDelete| |fullname|ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete| |refcount|2| |length|252| |called|ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::FreeNode
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDeleteFixup
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
ATL::CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_>::SetNil| |calling|CManagerThread::WaitCallback| |paramcount|2| |address|18000ff60| |sig|bool __thiscall RBDelete(CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> * this, CNode * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete +++ ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete @@ -1,82 +0,0 @@ - -/* private: bool __cdecl ATL::CRBTree > >,class SmartPtr,class ATL::CElementTraits > > >,class - ATL::CElementTraits > >::RBDelete(class - ATL::CRBTree > >,class SmartPtr,class - ATL::CElementTraits > > >,class ATL::CElementTraits > >::CNode * __ptr64) __ptr64 */ - -bool __thiscall -ATL:: -CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> -::RBDelete(CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *this,CNode *param_1) - -{ - longlong lVar1; - bool bVar2; - CNode *pCVar3; - CNode *pCVar4; - CNode *pCVar5; - - if (param_1 == (CNode *)0x0) { - bVar2 = false; - } - else { - pCVar5 = *(CNode **)(this + 0x28); - pCVar3 = param_1; - if ((*(CNode **)(param_1 + 0x18) != pCVar5) && (*(CNode **)(param_1 + 0x20) != pCVar5)) { - pCVar3 = Successor(this,param_1); - } - pCVar4 = *(CNode **)(pCVar3 + 0x18); - if (pCVar4 == pCVar5) { - pCVar4 = *(CNode **)(pCVar3 + 0x20); - } - *(undefined8 *)(pCVar4 + 0x28) = *(undefined8 *)(pCVar3 + 0x28); - lVar1 = *(longlong *)(pCVar3 + 0x28); - if (lVar1 == *(longlong *)(this + 0x28)) { - *(CNode **)this = pCVar4; - } - else if (pCVar3 == *(CNode **)(lVar1 + 0x18)) { - *(CNode **)(lVar1 + 0x18) = pCVar4; - } - else { - *(CNode **)(lVar1 + 0x20) = pCVar4; - } - if (*(int *)(pCVar3 + 0x10) == 1) { - RBDeleteFixup(this,pCVar4); - } - if (pCVar3 != param_1) { - *(undefined8 *)(pCVar3 + 0x28) = *(undefined8 *)(param_1 + 0x28); - lVar1 = *(longlong *)(param_1 + 0x28); - if (*(CNode **)(lVar1 + 0x18) == param_1) { - *(CNode **)(lVar1 + 0x18) = pCVar3; - } - else { - *(CNode **)(lVar1 + 0x20) = pCVar3; - } - lVar1 = *(longlong *)(param_1 + 0x20); - *(longlong *)(pCVar3 + 0x20) = lVar1; - *(undefined8 *)(pCVar3 + 0x18) = *(undefined8 *)(param_1 + 0x18); - *(undefined4 *)(pCVar3 + 0x10) = *(undefined4 *)(param_1 + 0x10); - *(CNode **)(lVar1 + 0x28) = pCVar3; - *(CNode **)(*(longlong *)(pCVar3 + 0x18) + 0x28) = pCVar3; - if (*(CNode **)this == param_1) { - *(CNode **)this = pCVar3; - } - } - if (*(longlong *)this != 0) { - CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - ::SetNil((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - *)this,(CNode **)(*(longlong *)this + 0x28)); - } - FreeNode(this,param_1); - bVar2 = true; - } - return bVar2; -} - ``` # Added ## wil::details::`dynamic_initializer_for_'g_enabledStateManager'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_enabledStateManager''| |fullname|wil::details::`dynamic_initializer_for_'g_enabledStateManager''| |refcount|2| |length|12| |called|atexit| |calling|| |paramcount|0| |address|1800011c0| |sig|undefined __fastcall `dynamic_initializer_for_'g_enabledStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_featureStateManager'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_featureStateManager''| |fullname|wil::details::`dynamic_initializer_for_'g_featureStateManager''| |refcount|3| |length|89| |called|atexit
wil::details_abi::SubscriptionList::SubscriptionList| |calling|| |paramcount|0| |address|1800011e0| |sig|undefined __fastcall `dynamic_initializer_for_'g_featureStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultExceptions'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeResultExceptions''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultExceptions''| |refcount|2| |length|29| |called|| |calling|| |paramcount|0| |address|180001240| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeResultExceptions''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultHeader'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeResultHeader''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeResultHeader''| |refcount|2| |length|43| |called|| |calling|| |paramcount|0| |address|180001270| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeResultHeader''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |refcount|2| |length|85| |called|| |calling|| |paramcount|0| |address|1800012b0| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''| |refcount|2| |length|15| |called|| |calling|| |paramcount|0| |address|180001310| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingSRUMFeatureReporting''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_header_init_WilInitialize_ResultMacros_DesktopOrSystem'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_WilInitialize_ResultMacros_DesktopOrSystem''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_WilInitialize_ResultMacros_DesktopOrSystem''| |refcount|2| |length|99| |called|| |calling|| |paramcount|0| |address|180001330| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_WilInitialize_ResultMacros_DesktopOrSystem''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_initializer_for_'g_processLocalData'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_processLocalData''| |fullname|wil::details::`dynamic_initializer_for_'g_processLocalData''| |refcount|2| |length|12| |called|atexit| |calling|| |paramcount|0| |address|1800013a0| |sig|undefined __fastcall `dynamic_initializer_for_'g_processLocalData''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''| |fullname|wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''| |refcount|2| |length|12| |called|atexit| |calling|| |paramcount|0| |address|1800013c0| |sig|undefined __fastcall `dynamic_atexit_destructor_for_'g_threadFailureCallbacks''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## `dynamic_initializer_for_'FhWorkerApi_NDR64__table'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'FhWorkerApi_NDR64__table''| |fullname|`dynamic_initializer_for_'FhWorkerApi_NDR64__table''| |refcount|2| |length|57| |called|| |calling|| |paramcount|0| |address|1800013e0| |sig|undefined __fastcall `dynamic_initializer_for_'FhWorkerApi_NDR64__table''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## `dynamic_initializer_for_'FhWorkerApi_table'' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`dynamic_initializer_for_'FhWorkerApi_table''| |fullname|`dynamic_initializer_for_'FhWorkerApi_table''| |refcount|2| |length|57| |called|| |calling|| |paramcount|0| |address|180001420| |sig|undefined __fastcall `dynamic_initializer_for_'FhWorkerApi_table''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## operator!= ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|operator!=| |fullname|operator!=| |refcount|3| |length|18| |called|| |calling|CManagerThread::QueueConfig| |paramcount|2| |address|180006d00| |sig|bool __cdecl operator!=(SmartPtr * param_1, __int64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## SmartPtr::SmartPtr ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SmartPtr| |fullname|SmartPtr::SmartPtr| |refcount|1| |length|18| |called|| |calling|CManagerThread::CreateWorkerThread| |paramcount|2| |address|18001089c| |sig|undefined __thiscall SmartPtr(SmartPtr * this, SmartPtr * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## SmartPtr::Pointer ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Pointer| |fullname|SmartPtr::Pointer| |refcount|1| |length|14| |called|| |calling|CManagerThread::CreateWorkerThread| |paramcount|1| |address|1800108b8| |sig|CConfigDescriptor * __thiscall Pointer(SmartPtr * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## :: ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|30| |called|wil::details_abi::SubscriptionList::OnSignaled| |calling|| |paramcount|1| |address|1800116a0| |sig|undefined __cdecl (void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## :: ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|27| |called|wil::details_abi::SubscriptionList::OnSignaled| |calling|| |paramcount|1| |address|1800116d0| |sig|undefined __cdecl (void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## :: ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|102| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil_details_WriteSRUMWnfUsageBuffer| |calling|| |paramcount|3| |address|180011700| |sig|undefined __cdecl (_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_TIMER * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## :: ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|| |fullname|::| |refcount|3| |length|75| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::FeatureStateManager::FlushUsage
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|| |paramcount|3| |address|180011770| |sig|undefined __cdecl (_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_TIMER * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Base<2,0> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Base<2,0>| |fullname|wil::details::ReportFailure_Base<2,0>| |refcount|2| |length|58| |called|wil::details::ReportFailure_Return<2>| |calling|wil::details::ReportFailure_Hr<2>| |paramcount|9| |address|1800117e8| |sig|void __cdecl ReportFailure_Base<2,0>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, ResultStatus * param_7, ushort * param_8, ReportFailureOptions param_9)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Base<3,0> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Base<3,0>| |fullname|wil::details::ReportFailure_Base<3,0>| |refcount|3| |length|36| |called|wil::details::ReportFailure_NoReturn<3>| |calling|wil::details::ReportFailure_GetLastError<3>
wil::details::ReportFailure_Hr<3>| |paramcount|9| |address|18001182c| |sig|void __cdecl ReportFailure_Base<3,0>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, ResultStatus * param_7, ushort * param_8, ReportFailureOptions param_9)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_GetLastError<3> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_GetLastError<3>| |fullname|wil::details::ReportFailure_GetLastError<3>| |refcount|2| |length|119| |called|wil::details::GetLastErrorFail
wil::details::ReportFailure_Base<3,0>
wil::details::ResultStatus::FromResult| |calling|wil::details::in1diag3::_FailFast_GetLastError| |paramcount|6| |address|180011858| |sig|ulong __cdecl ReportFailure_GetLastError<3>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_GetLastErrorHr<1> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_GetLastErrorHr<1>| |fullname|wil::details::ReportFailure_GetLastErrorHr<1>| |refcount|2| |length|133| |called|wil::details::GetLastErrorFail
wil::details::HrToNtStatus
wil::details::ReportFailure_Base<1,0>| |calling|wil::details::in1diag3::Return_GetLastError| |paramcount|6| |address|1800118d8| |sig|long __cdecl ReportFailure_GetLastErrorHr<1>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Hr<1> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Hr<1>| |fullname|wil::details::ReportFailure_Hr<1>| |refcount|2| |length|74| |called|wil::details::HrToNtStatus
wil::details::ReportFailure_Base<1,0>| |calling|wil::details::in1diag3::Return_Hr| |paramcount|7| |address|180011964| |sig|void __cdecl ReportFailure_Hr<1>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, long param_7)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Hr<2> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Hr<2>| |fullname|wil::details::ReportFailure_Hr<2>| |refcount|3| |length|87| |called|wil::details::HrToNtStatus
wil::details::ReportFailure_Base<2,0>| |calling|wil::details::GetLastErrorFail
wil::details::LogFailure| |paramcount|7| |address|1800119b8| |sig|void __cdecl ReportFailure_Hr<2>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, long param_7)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Hr<3> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Hr<3>| |fullname|wil::details::ReportFailure_Hr<3>| |refcount|3| |length|83| |called|wil::details::ReportFailure_Base<3,0>
wil::details::ResultStatus::FromResult| |calling|wil::details::in1diag3::FailFast_Unexpected
wil::details::in1diag3::_FailFast_Unexpected| |paramcount|7| |address|180011a18| |sig|void __cdecl ReportFailure_Hr<3>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, long param_7)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_NoReturn<3> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_NoReturn<3>| |fullname|wil::details::ReportFailure_NoReturn<3>| |refcount|2| |length|628| |called|KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::IsDebuggerPresent
KERNEL32.DLL::OutputDebugStringW
__chkstk
_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::GetFailureLogString
wil::details::HrToNtStatus
wil::details::RecordFailFast
wil::details::WilFailFast| |calling|wil::details::ReportFailure_Base<3,0>| |paramcount|9| |address|180011a74| |sig|void __cdecl ReportFailure_NoReturn<3>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, ResultStatus * param_7, ushort * param_8, ReportFailureOptions param_9)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Return<1> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Return<1>| |fullname|wil::details::ReportFailure_Return<1>| |refcount|2| |length|679| |called|
Expand for full list:
KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::IsDebuggerPresent
KERNEL32.DLL::OutputDebugStringW
__chkstk
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::GetFailureLogString
wil::details::RecordReturn
wil::details::WilFailFast
wistd::__throw_bad_function_call
| |calling|| |paramcount|9| |address|180011cf0| |sig|void __cdecl ReportFailure_Return<1>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, ResultStatus * param_7, ushort * param_8, ReportFailureOptions param_9)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReportFailure_Return<2> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReportFailure_Return<2>| |fullname|wil::details::ReportFailure_Return<2>| |refcount|2| |length|276| |called|__chkstk
__security_check_cookie
memset
wil::details::LogFailure
wil::details::WilFailFast| |calling|wil::details::ReportFailure_Base<2,0>| |paramcount|9| |address|180011fa0| |sig|void __cdecl ReportFailure_Return<2>(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, ResultStatus * param_7, ushort * param_8, ReportFailureOptions param_9)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WriteResultString ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WriteResultString| |fullname|wil::details::WriteResultString| |refcount|10| |length|116| |called|MSVCRT.DLL::memcpy_s
wil::details::ResultStringSize| |calling|wil::StoredFailureInfo::SetFailureInfo
wil::details_abi::ThreadLocalFailureInfo::Set| |paramcount|4| |address|1800120bc| |sig|uchar * __cdecl WriteResultString(uchar * param_1, uchar * param_2, char * param_3, char * * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WriteResultString ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WriteResultString| |fullname|wil::details::WriteResultString| |refcount|5| |length|133| |called|MSVCRT.DLL::memcpy_s
wil::details::ResultStringSize| |calling|wil::StoredFailureInfo::SetFailureInfo
wil::details_abi::ThreadLocalFailureInfo::Set| |paramcount|4| |address|180012138| |sig|uchar * __cdecl WriteResultString(uchar * param_1, uchar * param_2, ushort * param_3, ushort * * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ProcessLocalStorageData| |fullname|wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |refcount|2| |length|102| |called|memset
wil::details_abi::SubscriptionList::SubscriptionList
wil::details_abi::UsageIndexes::UsageIndexes| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |paramcount|3| |address|1800121c4| |sig|undefined __thiscall ProcessLocalStorageData(ProcessLocalStorageData * this, unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> * param_1, SemaphoreValue * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::RawUsageIndex ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RawUsageIndex| |fullname|wil::details_abi::RawUsageIndex::RawUsageIndex| |refcount|5| |length|125| |called|wil::details_abi::UsageIndexProperty::GetSize| |calling|wil::details_abi::RecordWnfUsageIndex
wil::details_abi::UsageIndexes::UsageIndexes| |paramcount|6| |address|180012234| |sig|undefined __thiscall RawUsageIndex(RawUsageIndex * this, ushort param_1, ushort param_2, CountSize param_3, ushort param_4, CountSize param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ResultException::ResultException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ResultException| |fullname|wil::ResultException::ResultException| |refcount|2| |length|96| |called|MSVCRT.DLL::exception::exception
wil::StoredFailureInfo::SetFailureInfo| |calling|wil::details::ThrowResultExceptionInternal| |paramcount|2| |address|1800122b8| |sig|undefined __thiscall ResultException(ResultException * this, FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ResultException::ResultException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ResultException| |fullname|wil::ResultException::ResultException| |refcount|1| |length|221| |called|MSVCRT.DLL::exception::exception
wil::details::shared_buffer::assign| |calling|| |paramcount|2| |address|180012320| |sig|undefined __thiscall ResultException(ResultException * this, ResultException * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexes::UsageIndexes ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|UsageIndexes| |fullname|wil::details_abi::UsageIndexes::UsageIndexes| |refcount|4| |length|108| |called|wil::details_abi::RawUsageIndex::RawUsageIndex| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |paramcount|1| |address|180012440| |sig|undefined __thiscall UsageIndexes(UsageIndexes * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::last_error_context::last_error_context ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|last_error_context| |fullname|wil::last_error_context::last_error_context| |refcount|9| |length|36| |called|KERNEL32.DLL::GetLastError| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::reserve| |paramcount|1| |address|1800124b4| |sig|undefined __thiscall last_error_context(last_error_context * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ProcessLocalStorage| |fullname|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |refcount|2| |length|24| |called|wil::details_abi::ProcessLocalStorageData::Release| |calling|wil::details::`dynamic_atexit_destructor_for_'g_processLocalData''| |paramcount|1| |address|1800124e0| |sig|void __thiscall ~ProcessLocalStorage(ProcessLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ProcessLocalStorage| |fullname|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |refcount|3| |length|24| |called|wil::details_abi::ProcessLocalStorageData::Release| |calling|wil::details::FeatureStateManager::~FeatureStateManager
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''| |paramcount|1| |address|180012500| |sig|void __thiscall ~ProcessLocalStorage(ProcessLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ProcessLocalStorageData| |fullname|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |refcount|2| |length|41| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SemaphoreValue::~SemaphoreValue
wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage| |calling|wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|180012520| |sig|void __thiscall ~ProcessLocalStorageData(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ProcessLocalStorageData| |fullname|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |refcount|2| |length|41| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::~FeatureStateData
wil::details_abi::SemaphoreValue::~SemaphoreValue| |calling|wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|180012550| |sig|void __thiscall ~ProcessLocalStorageData(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ThreadLocalStorage| |fullname|wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage| |refcount|2| |length|114| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree| |calling|wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''| |paramcount|1| |address|180012580| |sig|void __thiscall ~ThreadLocalStorage(ThreadLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ThreadLocalStorage| |fullname|wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage| |refcount|2| |length|123| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree
wil::details_abi::ThreadLocalData::Clear| |calling|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |paramcount|1| |address|1800125fc| |sig|void __thiscall ~ThreadLocalStorage(ThreadLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wistd::function::~function ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~function| |fullname|wistd::function::~function| |refcount|4| |length|30| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|`wil::details_abi::RawUsageIndex::Iterate'::__l1::dtor$0
wil::details_abi::RawUsageIndex::Iterate| |paramcount|1| |address|180012680| |sig|void __thiscall ~function(function * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |refcount|2| |length|22| |called|wil::details::UnsubscribeProcessWideUsageFlush| |calling|wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1| |address|1800126a8| |sig|void __thiscall ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>(unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |refcount|3| |length|23| |called|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |calling|wil::details::EnabledStateManager::~EnabledStateManager| |paramcount|1| |address|1800126c8| |sig|void __thiscall ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>(unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>| |refcount|3| |length|29| |called|KERNEL32.DLL::LeaveCriticalSection| |calling|wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe| |paramcount|1| |address|1800126e8| |sig|void __thiscall ~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |refcount|21| |length|29| |called|KERNEL32.DLL::ReleaseSRWLockExclusive| |calling|
Expand for full list:
::
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLockwil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1| |address|18001270c| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |refcount|2| |length|29| |called|KERNEL32.DLL::ReleaseSRWLockShared| |calling|wil::details_abi::SubscriptionList::OnSignaled| |paramcount|1| |address|180012730| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |refcount|5| |length|22| |called|wil::details::DestroyThreadPoolTimer::Destroy| |calling|wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1| |address|180012754| |sig|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |refcount|2| |length|65| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1| |address|180012774| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |refcount|11| |length|22| |called|wil::details::CloseHandle| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue| |paramcount|1| |address|1800127bc| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |refcount|7| |length|22| |called|wil::details::ReleaseMutex| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|1800127dc| |sig|void __thiscall ~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::~EnabledStateManager ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~EnabledStateManager| |fullname|wil::details::EnabledStateManager::~EnabledStateManager| |refcount|2| |length|113| |called|wil::details::EnabledStateManager::ProcessShutdown
wil::details::FreeProcessHeap
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|1800127fc| |sig|void __thiscall ~EnabledStateManager(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::FeatureStateData::~FeatureStateData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~FeatureStateData| |fullname|wil::details_abi::FeatureStateData::~FeatureStateData| |refcount|2| |length|40| |called|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::SubscriptionList::~SubscriptionList
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |paramcount|1| |address|180012874| |sig|void __thiscall ~FeatureStateData(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::~FeatureStateManager ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~FeatureStateManager| |fullname|wil::details::FeatureStateManager::~FeatureStateManager| |refcount|2| |length|155| |called|wil::details::FreeProcessHeap
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage
wil::details_abi::SubscriptionList::~SubscriptionList| |calling|wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''| |paramcount|1| |address|1800128a4| |sig|void __thiscall ~FeatureStateManager(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::~RawUsageIndex ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~RawUsageIndex| |fullname|wil::details_abi::RawUsageIndex::~RawUsageIndex| |refcount|2| |length|31| |called|wil::details::FreeProcessHeap| |calling|`wil::details_abi::RecordWnfUsageIndex'::__l1::dtor$0| |paramcount|1| |address|180012948| |sig|void __thiscall ~RawUsageIndex(RawUsageIndex * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ResultException::~ResultException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~ResultException| |fullname|wil::ResultException::~ResultException| |refcount|2| |length|48| |called|wil::details::shared_buffer::reset| |calling|wil::ResultException::`vector_deleting_destructor'| |paramcount|1| |address|180012970| |sig|void __thiscall ~ResultException(ResultException * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::~SemaphoreValue ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~SemaphoreValue| |fullname|wil::details_abi::SemaphoreValue::~SemaphoreValue| |refcount|7| |length|31| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData| |paramcount|1| |address|1800129ac| |sig|void __thiscall ~SemaphoreValue(SemaphoreValue * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SubscriptionList::~SubscriptionList ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~SubscriptionList| |fullname|wil::details_abi::SubscriptionList::~SubscriptionList| |refcount|4| |length|43| |called|wil::details::FreeProcessHeap| |calling|wil::details::FeatureStateManager::~FeatureStateManager
wil::details_abi::FeatureStateData::~FeatureStateData| |paramcount|1| |address|1800129d4| |sig|void __thiscall ~SubscriptionList(SubscriptionList * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexes::~UsageIndexes ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~UsageIndexes| |fullname|wil::details_abi::UsageIndexes::~UsageIndexes| |refcount|5| |length|78| |called|wil::details::FreeProcessHeap| |calling|`wil::details_abi::FeatureStateData::ProcessShutdown'::__l1::dtor$0
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::FeatureStateData::~FeatureStateData| |paramcount|1| |address|180012a0c| |sig|void __thiscall ~UsageIndexes(UsageIndexes * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::last_error_context::~last_error_context ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|~last_error_context| |fullname|wil::last_error_context::~last_error_context| |refcount|10| |length|29| |called|KERNEL32.DLL::SetLastError| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::reserve| |paramcount|1| |address|180012a64| |sig|void __thiscall ~last_error_context(last_error_context * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wistd::unique_ptr::operator= ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|operator=| |fullname|wistd::unique_ptr::operator=| |refcount|4| |length|41| |called|wil::details::FreeProcessHeap| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RawUsageIndex::Swap| |paramcount|2| |address|180012a88| |sig|unique_ptr * __thiscall operator=(unique_ptr * this, unique_ptr * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator() ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|operator()| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()| |refcount|3| |length|95| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|| |paramcount|6| |address|180012ac0| |sig|bool __thiscall operator()(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, void * * param_1, __uint64 * param_2, void * * param_3, __uint64 * param_4, uint * param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wistd::__function::__base::`scalar_deleting_destructor' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`scalar_deleting_destructor'| |fullname|wistd::__function::__base::`scalar_deleting_destructor'| |refcount|4| |length|45| |called|MSVCRT.DLL::operator_delete| |calling|| |paramcount|2| |address|180012b30| |sig|void * __thiscall `scalar_deleting_destructor'(__base * this, uint param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ResultException::`vector_deleting_destructor' ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|`vector_deleting_destructor'| |fullname|wil::ResultException::`vector_deleting_destructor'| |refcount|3| |length|54| |called|MSVCRT.DLL::operator_delete
wil::ResultException::~ResultException| |calling|| |paramcount|2| |address|180012b70| |sig|void * __thiscall `vector_deleting_destructor'(ResultException * this, uint param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::Acquire ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Acquire| |fullname|wil::details_abi::ProcessLocalStorageData::Acquire| |refcount|2| |length|357| |called|
Expand for full list:
KERNEL32.DLL::CreateMutexExW
KERNEL32.DLL::GetCurrentProcessId
StringCchPrintfW
__security_check_cookie
wil::details::GetLastErrorFailHr
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::TryGetPointerwil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire
| |calling|wil::details_abi::ProcessLocalStorage::GetShared| |paramcount|2| |address|180012bb0| |sig|long __cdecl Acquire(char * param_1, ProcessLocalStorageData * * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::Acquire ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Acquire| |fullname|wil::details_abi::ProcessLocalStorageData::Acquire| |refcount|2| |length|357| |called|
Expand for full list:
KERNEL32.DLL::CreateMutexExW
KERNEL32.DLL::GetCurrentProcessId
StringCchPrintfW
__security_check_cookie
wil::details::GetLastErrorFailHr
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::TryGetPointerwil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire
| |calling|wil::details::FeatureStateManager::EnsureStateData| |paramcount|2| |address|180012d1c| |sig|long __cdecl Acquire(char * param_1, ProcessLocalStorageData * * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalData::Clear ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Clear| |fullname|wil::details_abi::ThreadLocalData::Clear| |refcount|2| |length|185| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree| |calling|wil::details_abi::ThreadLocalStorage::~ThreadLocalStorage| |paramcount|1| |address|180012e88| |sig|void __thiscall Clear(ThreadLocalData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::CloseHandle ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|CloseHandle| |fullname|wil::details::CloseHandle| |refcount|3| |length|41| |called|KERNEL32.DLL::CloseHandle
wil::details::in1diag3::_FailFast_GetLastError| |calling|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|180012f48| |sig|void __cdecl CloseHandle(void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexProperty::Compare ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Compare| |fullname|wil::details_abi::UsageIndexProperty::Compare| |refcount|5| |length|44| |called|memcmp| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|180012f78| |sig|int __thiscall Compare(UsageIndexProperty * this, void * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::CreateFromValueInternal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|CreateFromValueInternal| |fullname|wil::details_abi::SemaphoreValue::CreateFromValueInternal| |refcount|3| |length|260| |called|StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_Hr
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create
wistd::__throw_bad_function_call| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |paramcount|4| |address|180012fac| |sig|long __thiscall CreateFromValueInternal(SemaphoreValue * this, ushort * param_1, bool param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::DestroyThreadPoolTimer::Destroy ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Destroy| |fullname|wil::details::DestroyThreadPoolTimer::Destroy| |refcount|3| |length|64| |called|KERNEL32.DLL::SetThreadpoolTimer
KERNEL32.DLL::WaitForThreadpoolTimerCallbacks| |calling|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|1800130d4| |sig|void __cdecl Destroy(_TP_TIMER * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::Destroy ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Destroy| |fullname|wil::details_abi::SemaphoreValue::Destroy| |refcount|3| |length|32| |called|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |calling|wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|180013120| |sig|void __thiscall Destroy(SemaphoreValue * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnsureCoalescedTimer_SetTimer ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureCoalescedTimer_SetTimer| |fullname|wil::details::EnsureCoalescedTimer_SetTimer| |refcount|4| |length|65| |called|KERNEL32.DLL::SetThreadpoolTimer| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage| |paramcount|3| |address|180013148| |sig|void __cdecl EnsureCoalescedTimer_SetTimer(unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> * param_1, bool * param_2, __int64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::EnsureStateData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureStateData| |fullname|wil::details::FeatureStateManager::EnsureStateData| |refcount|4| |length|193| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|1| |address|180013190| |sig|bool __thiscall EnsureStateData(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnsureSubscribedToFeatureConfigurationChanges ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |refcount|3| |length|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0| |address|180013258| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChangesImpl| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |refcount|2| |length|151| |called|KERNEL32.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |paramcount|1| |address|180013280| |sig|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureSubscribedToProcessWideUsageFlushUnderLock| |fullname|wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock| |refcount|2| |length|115| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock| |calling|wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|1| |address|180013320| |sig|void __thiscall EnsureSubscribedToProcessWideUsageFlushUnderLock(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::in1diag3::FailFast_Unexpected ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FailFast_Unexpected| |fullname|wil::details::in1diag3::FailFast_Unexpected| |refcount|2| |length|32| |called|wil::details::ReportFailure_Hr<3>| |calling|wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |paramcount|3| |address|18001339c| |sig|void __cdecl FailFast_Unexpected(void * param_1, uint param_2, char * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FindInsertionPointOrIncrement| |fullname|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement| |refcount|2| |length|367| |called|wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|6| |address|1800133c4| |sig|uchar * __thiscall FindInsertionPointOrIncrement(RawUsageIndex * this, UsageIndexProperty * param_1, uchar * param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::FlushUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FlushUsage| |fullname|wil::details::FeatureStateManager::FlushUsage| |refcount|3| |length|62| |called|wil::ProcessShutdownInProgress
wil::details::FeatureStateManager::EnsureStateData
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled| |calling|::
wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|1| |address|18001353c| |sig|void __thiscall FlushUsage(FeatureStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FormatNtStatusMsg ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FormatNtStatusMsg| |fullname|wil::details::FormatNtStatusMsg| |refcount|3| |length|88| |called|KERNEL32.DLL::FormatMessageW
wil_details_GetNtDllModuleHandle| |calling|| |paramcount|3| |address|180013590| |sig|void __cdecl FormatNtStatusMsg(long param_1, ushort * param_2, ulong param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FreeProcessHeap ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FreeProcessHeap| |fullname|wil::details::FreeProcessHeap| |refcount|18| |length|41| |called|KERNEL32.DLL::GetProcessHeap| |calling|
Expand for full list:
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RawUsageIndex::SetBuffer
wil::details_abi::RawUsageIndex::Swap
wil::details_abi::RawUsageIndex::~RawUsageIndex
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SubscriptionList::~SubscriptionList
wil::details_abi::UsageIndexes::~UsageIndexeswil::details_abi::heap_buffer::reserve
wistd::unique_ptr::operator=
| |paramcount|1| |address|1800135f0| |sig|void __cdecl FreeProcessHeap(void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ResultStatus::FromResult ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|FromResult| |fullname|wil::details::ResultStatus::FromResult| |refcount|3| |length|33| |called|wil::details::HrToNtStatus| |calling|wil::details::ReportFailure_GetLastError<3>
wil::details::ReportFailure_Hr<3>| |paramcount|1| |address|180013624| |sig|ResultStatus __cdecl FromResult(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetContextAndNotifyFailure| |fullname|wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure| |refcount|2| |length|203| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details_abi::ThreadLocalStorage::GetLocal| |calling|wil::details::GetContextAndNotifyFailure| |paramcount|3| |address|18001364c| |sig|void __cdecl GetContextAndNotifyFailure(FailureInfo * param_1, char * param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::GetContextAndNotifyFailure ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetContextAndNotifyFailure| |fullname|wil::details::GetContextAndNotifyFailure| |refcount|3| |length|106| |called|KERNEL32.DLL::GetCurrentThreadId
wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure
wil::details_abi::GetThreadLocalDataCache
wil::details_abi::ThreadLocalData::SetLastError| |calling|| |paramcount|3| |address|180013720| |sig|void __cdecl GetContextAndNotifyFailure(FailureInfo * param_1, char * param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::GetCurrentModuleName ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetCurrentModuleName| |fullname|wil::details::GetCurrentModuleName| |refcount|3| |length|60| |called|wil::details::GetModuleInformation| |calling|| |paramcount|0| |address|1800137a0| |sig|char * __cdecl GetCurrentModuleName(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::GetFailureLogString ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetFailureLogString| |fullname|wil::GetFailureLogString| |refcount|5| |length|704| |called|KERNEL32.DLL::FormatMessageW
KERNEL32.DLL::GetCurrentThreadId
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::details::LogStringPrintf| |calling|wil::ResultException::what
wil::details::LogFailure
wil::details::ReportFailure_NoReturn<3>
wil::details::ReportFailure_Return<1>| |paramcount|3| |address|1800137e4| |sig|long __cdecl GetFailureLogString(ushort * param_1, __uint64 param_2, FailureInfo * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::GetLastErrorFail ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetLastErrorFail| |fullname|wil::details::GetLastErrorFail| |refcount|4| |length|100| |called|KERNEL32.DLL::GetLastError
wil::details::ReportFailure_Hr<2>| |calling|wil::details::GetLastErrorFailHr
wil::details::ReportFailure_GetLastError<3>
wil::details::ReportFailure_GetLastErrorHr<1>| |paramcount|6| |address|180013aac| |sig|ulong __cdecl GetLastErrorFail(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::GetLastErrorFailHr ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetLastErrorFailHr| |fullname|wil::details::GetLastErrorFailHr| |refcount|4| |length|43| |called|wil::details::GetLastErrorFail| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |paramcount|0| |address|180013b18| |sig|long __cdecl GetLastErrorFailHr(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalStorage::GetLocal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetLocal| |fullname|wil::details_abi::ThreadLocalStorage::GetLocal| |refcount|2| |length|90| |called|KERNEL32.DLL::GetCurrentThreadId| |calling|wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure| |paramcount|2| |address|180013b4c| |sig|ThreadFailureCallbackHolder * * __thiscall GetLocal(ThreadLocalStorage * this, bool param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalStorage::GetLocal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetLocal| |fullname|wil::details_abi::ThreadLocalStorage::GetLocal| |refcount|2| |length|84| |called|KERNEL32.DLL::GetCurrentThreadId| |calling|wil::details_abi::GetThreadLocalDataCache| |paramcount|2| |address|180013bb0| |sig|ThreadLocalData * __thiscall GetLocal(ThreadLocalStorage * this, bool param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::GetModuleInformation ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetModuleInformation| |fullname|wil::details::GetModuleInformation| |refcount|2| |length|236| |called|KERNEL32.DLL::GetModuleFileNameA
KERNEL32.DLL::GetModuleHandleExW
StringCchCopyA
__security_check_cookie| |calling|wil::details::GetCurrentModuleName| |paramcount|4| |address|180013c0c| |sig|bool __cdecl GetModuleInformation(void * param_1, uint * param_2, char * param_3, __uint64 param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorage::GetShared ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetShared| |fullname|wil::details_abi::ProcessLocalStorage::GetShared| |refcount|2| |length|86| |called|wil::details_abi::ProcessLocalStorageData::Acquire| |calling|wil::details_abi::GetThreadLocalDataCache| |paramcount|1| |address|180013d00| |sig|ProcessLocalData * __thiscall GetShared(ProcessLocalStorage * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexProperty::GetSize ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetSize| |fullname|wil::details_abi::UsageIndexProperty::GetSize| |refcount|3| |length|44| |called|| |calling|wil::details_abi::RawUsageIndex::RawUsageIndex
wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|1| |address|180013d60| |sig|__uint64 __thiscall GetSize(UsageIndexProperty * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ThreadFailureCallbackHolder::GetThreadContext ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetThreadContext| |fullname|wil::details::ThreadFailureCallbackHolder::GetThreadContext| |refcount|3| |length|248| |called|MSVCRT.DLL::memcpy_s
wil::details::ThreadFailureCallbackHolder::GetThreadContext| |calling|wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure
wil::details::ThreadFailureCallbackHolder::GetThreadContext| |paramcount|4| |address|180013d94| |sig|bool __cdecl GetThreadContext(FailureInfo * param_1, ThreadFailureCallbackHolder * param_2, char * param_3, __uint64 param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::GetThreadLocalDataCache ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetThreadLocalDataCache| |fullname|wil::details_abi::GetThreadLocalDataCache| |refcount|2| |length|80| |called|wil::details_abi::ProcessLocalStorage::GetShared
wil::details_abi::ThreadLocalStorage::GetLocal| |calling|wil::details::GetContextAndNotifyFailure| |paramcount|1| |address|180013e94| |sig|ThreadLocalData * __cdecl GetThreadLocalDataCache(bool param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::GetValueFromSemaphore ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetValueFromSemaphore| |fullname|wil::details_abi::SemaphoreValue::GetValueFromSemaphore| |refcount|3| |length|369| |called|KERNEL32.DLL::GetLastError
KERNEL32.DLL::ReleaseSemaphore
KERNEL32.DLL::WaitForSingleObject
wil::details::in1diag3::Return_GetLastError
wil::details::in1diag3::Return_Hr| |calling|wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|2| |address|180013eec| |sig|long __cdecl GetValueFromSemaphore(void * param_1, long * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::HrToNtStatus ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|HrToNtStatus| |fullname|wil::details::HrToNtStatus| |refcount|7| |length|457| |called|| |calling|wil::details::LogFailure
wil::details::ReportFailure_GetLastErrorHr<1>
wil::details::ReportFailure_Hr<1>
wil::details::ReportFailure_Hr<2>
wil::details::ReportFailure_NoReturn<3>
wil::details::ResultStatus::FromResult| |paramcount|1| |address|180014064| |sig|long __cdecl HrToNtStatus(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::IsFeatureConfigured ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|IsFeatureConfigured| |fullname|wil::details::IsFeatureConfigured| |refcount|2| |length|308| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back
wil_RtlStagingConfig_QueryFeatureState| |calling|wil::details::WilApiImpl_GetFeatureEnabledState| |paramcount|5| |address|180014234| |sig|bool __cdecl IsFeatureConfigured(wil_FeatureState * param_1, uint param_2, bool param_3, wil_FeatureStore param_4, int * param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::Iterate ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Iterate| |fullname|wil::details_abi::RawUsageIndex::Iterate| |refcount|2| |length|306| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details_abi::UsageIndexProperty::Read
wistd::__throw_bad_function_call
wistd::function::~function| |calling|wil::details_abi::RecordWnfUsageIndex| |paramcount|2| |address|180014370| |sig|bool __thiscall Iterate(RawUsageIndex * this, function param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::LogFailure ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|LogFailure| |fullname|wil::details::LogFailure| |refcount|2| |length|774| |called|
Expand for full list:
KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::IsDebuggerPresent
KERNEL32.DLL::OutputDebugStringW
_guard_dispatch_icall$thunk$10345483385596137414
wil::GetFailureLogString
wil::details::HrToNtStatus
wil::details::RecordException
wil::details::RecordFailFast
wil::details::RecordLog
wil::details::RecordReturn
wil::details::ReportFailure_Hr<2>wistd::__throw_bad_function_call
| |calling|wil::details::ReportFailure_Return<2>| |paramcount|15| |address|1800144ac| |sig|void __cdecl LogFailure(void * param_1, uint param_2, char * param_3, char * param_4, char * param_5, void * param_6, FailureType param_7, ResultStatus * param_8, ushort * param_9, bool param_10, ushort * param_11, __uint64 param_12, char * param_13, __uint64 param_14, FailureInfo * param_15)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::LogStringPrintf ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|LogStringPrintf| |fullname|wil::details::LogStringPrintf| |refcount|11| |length|97| |called|StringVPrintfWorkerW| |calling|wil::GetFailureLogString| |paramcount|3| |address|1800147bc| |sig|ushort * __cdecl LogStringPrintf(ushort * param_1, ushort * param_2, ushort * param_3, ...)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::LowerBound ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|LowerBound| |fullname|wil::details_abi::RawUsageIndex::LowerBound| |refcount|2| |length|197| |called|wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::Read| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement| |paramcount|5| |address|180014824| |sig|uchar * __thiscall LowerBound(RawUsageIndex * this, uchar * param_1, __uint64 param_2, void * param_3, __uint64 param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::MakeAndInitialize ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|MakeAndInitialize| |fullname|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |refcount|2| |length|298| |called|memset
wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::details::in1diag3::Return_Hr
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue
wistd::__throw_bad_function_call| |calling|wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3| |address|1800148f0| |sig|long __cdecl MakeAndInitialize(ushort * param_1, unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> * param_2, ProcessLocalStorageData * * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::MakeAndInitialize ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|MakeAndInitialize| |fullname|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize| |refcount|2| |length|220| |called|wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::details::in1diag3::Return_Hr
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::~SemaphoreValue
wistd::__throw_bad_function_call| |calling|wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3| |address|180014a24| |sig|long __cdecl MakeAndInitialize(ushort * param_1, unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>_> * param_2, ProcessLocalStorageData * * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::MicrosoftInternalNotifyFailure ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|MicrosoftInternalNotifyFailure| |fullname|wil::details::MicrosoftInternalNotifyFailure| |refcount|3| |length|210| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetKernelBaseProcAddress| |calling|| |paramcount|1| |address|180014b10| |sig|void __cdecl MicrosoftInternalNotifyFailure(FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::NtStatusToHr ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|NtStatusToHr| |fullname|wil::details::NtStatusToHr| |refcount|2| |length|85| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details_abi::RecordWnfUsageIndex| |paramcount|1| |address|180014bec| |sig|long __cdecl NtStatusToHr(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SubscriptionList::OnSignaled ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|OnSignaled| |fullname|wil::details_abi::SubscriptionList::OnSignaled| |refcount|4| |length|254| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::AcquireSRWLockShared
KERNEL32.DLL::EnterCriticalSection
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|::
::
wil::details::FeatureStateManager::FlushUsage| |paramcount|2| |address|180014c48| |sig|void __thiscall OnSignaled(SubscriptionList * this, srwlock * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::OnStateChange ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|OnStateChange| |fullname|wil::details::EnabledStateManager::OnStateChange| |refcount|2| |length|133| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|| |paramcount|1| |address|180014d50| |sig|void __thiscall OnStateChange(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ProcessHeapAlloc ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ProcessHeapAlloc| |fullname|wil::details::ProcessHeapAlloc| |refcount|6| |length|182| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ThreadLocalData::SetLastError
wil::details_abi::ThreadLocalFailureInfo::Set
wil::details_abi::heap_buffer::reserve| |paramcount|2| |address|180014ddc| |sig|void * __cdecl ProcessHeapAlloc(ulong param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::ProcessShutdown ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ProcessShutdown| |fullname|wil::details::EnabledStateManager::ProcessShutdown| |refcount|3| |length|108| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|180014e9c| |sig|void __thiscall ProcessShutdown(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::FeatureStateData::ProcessShutdown ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ProcessShutdown| |fullname|wil::details_abi::FeatureStateData::ProcessShutdown| |refcount|3| |length|66| |called|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock
wil::details_abi::UsageIndexes::Record
wil::details_abi::UsageIndexes::UsageIndexes
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details_abi::FeatureStateData::~FeatureStateData
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|1| |address|180014f10| |sig|void __thiscall ProcessShutdown(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ProcessShutdownInProgress ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ProcessShutdownInProgress| |fullname|wil::ProcessShutdownInProgress| |refcount|11| |length|47| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|0| |address|180014f5c| |sig|bool __cdecl ProcessShutdownInProgress(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|QueueBackgroundSRUMUsageReporting| |fullname|wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting| |refcount|2| |length|256| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::CreateThreadpoolTimer
__security_check_cookie
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|4| |address|180014f94| |sig|void __thiscall QueueBackgroundSRUMUsageReporting(FeatureStateManager * this, uint param_1, ushort param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexProperty::Read ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Read| |fullname|wil::details_abi::UsageIndexProperty::Read| |refcount|8| |length|248| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::LowerBound
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues| |paramcount|3| |address|18001509c| |sig|bool __thiscall Read(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexes::Record ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Record| |fullname|wil::details_abi::UsageIndexes::Record| |refcount|3| |length|262| |called|__security_check_cookie
wil::details_abi::RecordWnfUsageIndex| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage| |paramcount|1| |address|18001519c| |sig|void __thiscall Record(UsageIndexes * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::RecordCachedUsageUnderLock ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordCachedUsageUnderLock| |fullname|wil::details::EnabledStateManager::RecordCachedUsageUnderLock| |refcount|3| |length|100| |called|wil::details::WilApi_RecordFeatureUsage
wil_details_RecordCachedUsage| |calling|wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown| |paramcount|2| |address|1800152ac| |sig|void __thiscall RecordCachedUsageUnderLock(EnabledStateManager * this, unique_any_t,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>_> * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RecordException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordException| |fullname|wil::details::RecordException| |refcount|1| |length|22| |called|| |calling|wil::details::LogFailure| |paramcount|1| |address|180015318| |sig|int __cdecl RecordException(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RecordFailFast ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordFailFast| |fullname|wil::details::RecordFailFast| |refcount|4| |length|12| |called|| |calling|wil::details::LogFailure
wil::details::ReportFailure_NoReturn<3>| |paramcount|1| |address|180015340| |sig|int __cdecl RecordFailFast(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::FeatureStateData::RecordFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordFeatureUsage| |fullname|wil::details_abi::FeatureStateData::RecordFeatureUsage| |refcount|2| |length|191| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage| |calling|wil::details::FeatureStateManager::RecordFeatureUsage| |paramcount|4| |address|180015354| |sig|bool __thiscall RecordFeatureUsage(FeatureStateData * this, uint param_1, wil_details_ServiceReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::RecordFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordFeatureUsage| |fullname|wil::details::FeatureStateManager::RecordFeatureUsage| |refcount|2| |length|233| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::FeatureStateManager::EnsureStateData
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|4| |address|18001541c| |sig|void __thiscall RecordFeatureUsage(FeatureStateManager * this, uint param_1, wil_details_ServiceReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RecordLog ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordLog| |fullname|wil::details::RecordLog| |refcount|1| |length|22| |called|| |calling|wil::details::LogFailure| |paramcount|1| |address|18001550c| |sig|int __cdecl RecordLog(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RecordReturn ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordReturn| |fullname|wil::details::RecordReturn| |refcount|2| |length|22| |called|| |calling|wil::details::LogFailure
wil::details::ReportFailure_Return<1>| |paramcount|1| |address|18001552c| |sig|int __cdecl RecordReturn(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndex::RecordUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::UsageIndex::RecordUsage| |refcount|2| |length|46| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|4| |address|180015560| |sig|bool __thiscall RecordUsage(UsageIndex * this, wil_details_ServiceReportingKind param_1, uint param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndex::RecordUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::UsageIndex::RecordUsage| |refcount|2| |length|49| |called|wil::details_abi::RawUsageIndex::RecordUsage| |calling|wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|4| |address|180015598| |sig|bool __thiscall RecordUsage(UsageIndex * this, wil_details_ServiceReportingKind param_1, uint param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::FeatureStateData::RecordUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::FeatureStateData::RecordUsage| |refcount|3| |length|102| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::RetrieveUsageUnderLock
wil::details_abi::UsageIndexes::Record
wil::details_abi::UsageIndexes::UsageIndexes
wil::details_abi::UsageIndexes::~UsageIndexes| |calling|wil::details::FeatureStateManager::FlushUsage
wil::details_abi::FeatureStateData::RecordFeatureUsage| |paramcount|1| |address|1800155d0| |sig|void __thiscall RecordUsage(FeatureStateData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::RecordUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordUsage| |fullname|wil::details_abi::RawUsageIndex::RecordUsage| |refcount|4| |length|252| |called|wil::details::FreeProcessHeap
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SetBuffer
wil::details_abi::heap_buffer::ensure
wistd::unique_ptr::operator=| |calling|wil::details_abi::UsageIndex::RecordUsage
wil::details_abi::UsageIndex::RecordUsage
wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::operator()| |paramcount|6| |address|180015640| |sig|bool __thiscall RecordUsage(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::RecordUsageInternal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordUsageInternal| |fullname|wil::details_abi::RawUsageIndex::RecordUsageInternal| |refcount|3| |length|506| |called|MSVCRT.DLL::memmove_s
wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::SkipValues
wil::details_abi::UsageIndexProperty::Compare
wil::details_abi::UsageIndexProperty::GetSize
wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount
wil::details_abi::UsageIndexProperty::Write| |calling|wil::details_abi::RawUsageIndex::RecordUsage| |paramcount|6| |address|180015744| |sig|bool __thiscall RecordUsageInternal(RawUsageIndex * this, void * param_1, __uint64 param_2, void * param_3, __uint64 param_4, uint param_5)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RecordWnfUsageIndex ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RecordWnfUsageIndex| |fullname|wil::details_abi::RecordWnfUsageIndex| |refcount|4| |length|501| |called|__chkstk
__security_check_cookie
wil::details::FreeProcessHeap
wil::details::NtStatusToHr
wil::details_abi::RawUsageIndex::Iterate
wil::details_abi::RawUsageIndex::RawUsageIndex
wil::details_abi::RawUsageIndex::SetBuffer
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData| |calling|wil::details_abi::UsageIndexes::Record| |paramcount|3| |address|180015948| |sig|void __cdecl RecordWnfUsageIndex(__WIL__WNF_STATE_NAME * param_1, __uint64 param_2, RawUsageIndex * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::Release ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Release| |fullname|wil::details_abi::ProcessLocalStorageData::Release| |refcount|2| |length|131| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree
wil::ProcessShutdownInProgress
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::Destroy
wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |calling|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |paramcount|1| |address|180015b44| |sig|void __thiscall Release(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ProcessLocalStorageData::Release ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Release| |fullname|wil::details_abi::ProcessLocalStorageData::Release| |refcount|2| |length|147| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree
wil::ProcessShutdownInProgress
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::ProcessLocalStorageData::~ProcessLocalStorageData
wil::details_abi::SemaphoreValue::Destroy
wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |calling|wil::details_abi::ProcessLocalStorage::~ProcessLocalStorage| |paramcount|1| |address|180015bd0| |sig|void __thiscall Release(ProcessLocalStorageData * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ReleaseMutex ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ReleaseMutex| |fullname|wil::details::ReleaseMutex| |refcount|3| |length|41| |called|KERNEL32.DLL::ReleaseMutex
wil::details::in1diag3::_FailFast_GetLastError| |calling|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|180015c6c| |sig|void __cdecl ReleaseMutex(void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ResultStringSize ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ResultStringSize| |fullname|wil::details::ResultStringSize| |refcount|10| |length|34| |called|| |calling|wil::StoredFailureInfo::SetFailureInfo
wil::details::WriteResultString
wil::details_abi::ThreadLocalFailureInfo::Set| |paramcount|1| |address|180015c9c| |sig|__uint64 __cdecl ResultStringSize(char * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ResultStringSize ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ResultStringSize| |fullname|wil::details::ResultStringSize| |refcount|5| |length|33| |called|| |calling|wil::StoredFailureInfo::SetFailureInfo
wil::details::WriteResultString
wil::details_abi::ThreadLocalFailureInfo::Set| |paramcount|1| |address|180015cc8| |sig|__uint64 __cdecl ResultStringSize(ushort * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::Rethrow ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Rethrow| |fullname|wil::details::Rethrow| |refcount|3| |length|13| |called|_CxxThrowException| |calling|| |paramcount|0| |address|180015d00| |sig|void __cdecl Rethrow(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::FeatureStateData::RetrieveUsageUnderLock ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RetrieveUsageUnderLock| |fullname|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock| |refcount|3| |length|95| |called|wil::details_abi::RawUsageIndex::Swap| |calling|wil::details_abi::FeatureStateData::ProcessShutdown
wil::details_abi::FeatureStateData::RecordUsage| |paramcount|2| |address|180015d14| |sig|void __thiscall RetrieveUsageUnderLock(FeatureStateData * this, UsageIndexes * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::in1diag3::Return_GetLastError ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Return_GetLastError| |fullname|wil::details::in1diag3::Return_GetLastError| |refcount|4| |length|25| |called|wil::details::ReportFailure_GetLastErrorHr<1>| |calling|wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|3| |address|180015d7c| |sig|long __cdecl Return_GetLastError(void * param_1, uint param_2, char * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::in1diag3::Return_Hr ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Return_Hr| |fullname|wil::details::in1diag3::Return_Hr| |refcount|13| |length|30| |called|wil::details::ReportFailure_Hr<1>| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::MakeAndInitialize
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|4| |address|180015d9c| |sig|void __cdecl Return_Hr(void * param_1, uint param_2, char * param_3, long param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RtlDllShutdownInProgress ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RtlDllShutdownInProgress| |fullname|wil::details::RtlDllShutdownInProgress| |refcount|3| |length|59| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|| |paramcount|0| |address|180015dd0| |sig|uchar __cdecl RtlDllShutdownInProgress(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::RtlNtStatusToDosErrorNoTeb ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|RtlNtStatusToDosErrorNoTeb| |fullname|wil::details::RtlNtStatusToDosErrorNoTeb| |refcount|3| |length|72| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|| |paramcount|1| |address|180015e20| |sig|ulong __cdecl RtlNtStatusToDosErrorNoTeb(long param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalFailureInfo::Set ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Set| |fullname|wil::details_abi::ThreadLocalFailureInfo::Set| |refcount|2| |length|336| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree
memset
wil::details::ProcessHeapAlloc
wil::details::ResultStringSize
wil::details::ResultStringSize
wil::details::WriteResultString
wil::details::WriteResultString| |calling|wil::details_abi::ThreadLocalData::SetLastError| |paramcount|3| |address|180015e70| |sig|void __thiscall Set(ThreadLocalFailureInfo * this, FailureInfo * param_1, uint param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::SetBuffer ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SetBuffer| |fullname|wil::details_abi::RawUsageIndex::SetBuffer| |refcount|3| |length|263| |called|wil::details::FreeProcessHeap
wil::details::in1diag3::_FailFast_Unexpected| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::RecordWnfUsageIndex| |paramcount|4| |address|180015fc8| |sig|void __thiscall SetBuffer(RawUsageIndex * this, void * param_1, __uint64 param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::StoredFailureInfo::SetFailureInfo ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SetFailureInfo| |fullname|wil::StoredFailureInfo::SetFailureInfo| |refcount|2| |length|614| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
memset
wil::details::ResultStringSize
wil::details::ResultStringSize
wil::details::WriteResultString
wil::details::WriteResultString
wil::details::shared_buffer::assign
wil::details::shared_buffer::reset| |calling|wil::ResultException::ResultException| |paramcount|2| |address|1800160d8| |sig|void __thiscall SetFailureInfo(StoredFailureInfo * this, FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::ThreadLocalData::SetLastError ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SetLastError| |fullname|wil::details_abi::ThreadLocalData::SetLastError| |refcount|2| |length|251| |called|wil::details::ProcessHeapAlloc
wil::details_abi::ThreadLocalFailureInfo::Set| |calling|wil::details::GetContextAndNotifyFailure| |paramcount|2| |address|180016348| |sig|void __thiscall SetLastError(ThreadLocalData * this, FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::SkipValues ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SkipValues| |fullname|wil::details_abi::RawUsageIndex::SkipValues| |refcount|2| |length|198| |called|wil::details_abi::UsageIndexProperty::Read
wil::details_abi::UsageIndexProperty::UpdateCount| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|18001644c| |sig|uchar * __thiscall SkipValues(RawUsageIndex * this, UsageIndexProperty * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## StringCchCatW ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringCchCatW| |fullname|StringCchCatW| |refcount|5| |length|99| |called|StringCopyWorkerW| |calling|wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|3| |address|18001651c| |sig|long __cdecl StringCchCatW(ushort * param_1, __uint64 param_2, ushort * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## StringCchCopyA ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringCchCopyA| |fullname|StringCchCopyA| |refcount|1| |length|90| |called|| |calling|wil::details::GetModuleInformation| |paramcount|3| |address|180016588| |sig|long __cdecl StringCchCopyA(char * param_1, __uint64 param_2, char * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## StringCchCopyW ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringCchCopyW| |fullname|StringCchCopyW| |refcount|4| |length|51| |called|StringCopyWorkerW
StringValidateDestW| |calling|AllocSessionProperties
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal| |paramcount|3| |address|1800165ec| |sig|long __cdecl StringCchCopyW(ushort * param_1, __uint64 param_2, ushort * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## StringCopyWorkerW ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringCopyWorkerW| |fullname|StringCopyWorkerW| |refcount|2| |length|82| |called|| |calling|StringCchCatW
StringCchCopyW| |paramcount|5| |address|180016678| |sig|HRESULT __stdcall StringCopyWorkerW(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t * pcchNewDestLength, STRSAFE_PCNZWCH pszSrc, size_t cchToCopy)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## StringVPrintfWorkerW ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringVPrintfWorkerW| |fullname|StringVPrintfWorkerW| |refcount|3| |length|93| |called|MSVCRT.DLL::_vsnwprintf| |calling|StringCchPrintfW
wil::details::LogStringPrintf| |paramcount|5| |address|1800166d4| |sig|HRESULT __stdcall StringVPrintfWorkerW(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t * pcchNewDestLength, STRSAFE_LPCWSTR pszFormat, va_list argList)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## StringValidateDestW ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|StringValidateDestW| |fullname|StringValidateDestW| |refcount|2| |length|22| |called|| |calling|StringCchCopyW
StringCchPrintfW| |paramcount|3| |address|180016738| |sig|HRESULT __stdcall StringValidateDestW(STRSAFE_PCNZWCH pszDest, size_t cchDest, size_t cchMax)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil::details::FeatureStateManager::SubscribeToEnabledStateChanges ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SubscribeToEnabledStateChanges| |fullname|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges| |refcount|2| |length|146| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock
wil_details_RtlRegisterFeatureConfigurationChangeNotification| |calling|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |paramcount|4| |address|180016758| |sig|void __thiscall SubscribeToEnabledStateChanges(FeatureStateManager * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureStateManager::SubscribeToUsageFlush ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SubscribeToUsageFlush| |fullname|wil::details::FeatureStateManager::SubscribeToUsageFlush| |refcount|2| |length|162| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::ProcessShutdownInProgress
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SubscriptionList::SubscribeUnderLock| |calling|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |paramcount|3| |address|1800167f4| |sig|void __thiscall SubscribeToUsageFlush(FeatureStateManager * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SubscriptionList::SubscribeUnderLock ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|SubscribeUnderLock| |fullname|wil::details_abi::SubscriptionList::SubscribeUnderLock| |refcount|4| |length|145| |called|wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush| |paramcount|4| |address|1800168a0| |sig|void __thiscall SubscribeUnderLock(SubscriptionList * this, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::RawUsageIndex::Swap ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Swap| |fullname|wil::details_abi::RawUsageIndex::Swap| |refcount|4| |length|181| |called|wil::details::FreeProcessHeap
wistd::unique_ptr::operator=| |calling|wil::details_abi::FeatureStateData::RetrieveUsageUnderLock| |paramcount|2| |address|180016938| |sig|void __thiscall Swap(RawUsageIndex * this, RawUsageIndex * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::ThrowResultExceptionInternal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ThrowResultExceptionInternal| |fullname|wil::details::ThrowResultExceptionInternal| |refcount|3| |length|37| |called|_CxxThrowException
wil::ResultException::ResultException| |calling|| |paramcount|1| |address|180016a00| |sig|void __cdecl ThrowResultExceptionInternal(FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::TryGetPointer ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|TryGetPointer| |fullname|wil::details_abi::SemaphoreValue::TryGetPointer| |refcount|3| |length|104| |called|wil::details::in1diag3::Return_Hr
wil::details_abi::SemaphoreValue::TryGetValueInternal| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|2| |address|180016a2c| |sig|long __cdecl TryGetPointer(ushort * param_1, void * * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SemaphoreValue::TryGetValueInternal ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|TryGetValueInternal| |fullname|wil::details_abi::SemaphoreValue::TryGetValueInternal| |refcount|2| |length|441| |called|KERNEL32.DLL::GetLastError
KERNEL32.DLL::OpenSemaphoreW
StringCchCatW
StringCchCopyW
__security_check_cookie
wil::details::in1diag3::Return_GetLastError
wil::details::in1diag3::Return_Hr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil::details_abi::SemaphoreValue::GetValueFromSemaphore| |calling|wil::details_abi::SemaphoreValue::TryGetPointer| |paramcount|4| |address|180016a9c| |sig|long __cdecl TryGetValueInternal(ushort * param_1, bool param_2, __uint64 * param_3, bool * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::SubscriptionList::Unsubscribe ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Unsubscribe| |fullname|wil::details_abi::SubscriptionList::Unsubscribe| |refcount|3| |length|141| |called|KERNEL32.DLL::AcquireSRWLockExclusive
KERNEL32.DLL::EnterCriticalSection
wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::UnsubscribeProcessWideUsageFlush
wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification| |paramcount|3| |address|180016c5c| |sig|void __thiscall Unsubscribe(SubscriptionList * this, srwlock * param_1, FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::UnsubscribeProcessWideUsageFlush ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|UnsubscribeProcessWideUsageFlush| |fullname|wil::details::UnsubscribeProcessWideUsageFlush| |refcount|2| |length|41| |called|wil::details_abi::SubscriptionList::Unsubscribe| |calling|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|180016cf0| |sig|void __cdecl UnsubscribeProcessWideUsageFlush(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexProperty::UpdateCount ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|UpdateCount| |fullname|wil::details_abi::UsageIndexProperty::UpdateCount| |refcount|7| |length|80| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::FindInsertionPointOrIncrement
wil::details_abi::RawUsageIndex::RecordUsageInternal
wil::details_abi::RawUsageIndex::SkipValues| |paramcount|2| |address|180016d20| |sig|void __thiscall UpdateCount(UsageIndexProperty * this, uint param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApiImpl_GetFeatureEnabledState ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApiImpl_GetFeatureEnabledState| |fullname|wil::details::WilApiImpl_GetFeatureEnabledState| |refcount|3| |length|101| |called|wil::details::IsFeatureConfigured| |calling|| |paramcount|3| |address|180016d80| |sig|FEATURE_ENABLED_STATE __cdecl WilApiImpl_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApiImpl_RecordFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApiImpl_RecordFeatureUsage| |fullname|wil::details::WilApiImpl_RecordFeatureUsage| |refcount|3| |length|117| |called|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil_RtlStagingConfig_RecordFeatureUsage| |calling|| |paramcount|4| |address|180016df0| |sig|void __cdecl WilApiImpl_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApiImpl_SubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApiImpl_SubscribeFeatureStateChangeNotification| |refcount|2| |length|45| |called|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush| |calling|| |paramcount|3| |address|180016e70| |sig|void __cdecl WilApiImpl_SubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * * param_1, _func_void_void_ptr * param_2, void * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApiImpl_UnsubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApiImpl_UnsubscribeFeatureStateChangeNotification| |refcount|3| |length|78| |called|wil::details_abi::SubscriptionList::Unsubscribe| |calling|| |paramcount|1| |address|180016eb0| |sig|void __cdecl WilApiImpl_UnsubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApi_RecordFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsage| |fullname|wil::details::WilApi_RecordFeatureUsage| |refcount|6| |length|41| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::EnabledStateManager::RecordCachedUsageUnderLock
wil::details::RecordSRUMFeatureUsage
wil::details::ReportUsageToServiceDirect
wil::details::WilApi_RecordFeatureUsageReports| |paramcount|4| |address|180016f08| |sig|void __cdecl WilApi_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApi_RecordFeatureUsageReports ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsageReports| |fullname|wil::details::WilApi_RecordFeatureUsageReports| |refcount|2| |length|59| |called|wil::details::WilApi_RecordFeatureUsage| |calling|wil_details_RecordCachedUsage| |paramcount|2| |address|180016f38| |sig|void __cdecl WilApi_RecordFeatureUsageReports(__WIL_RTL_FEATURE_USAGE_DATA * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilApi_UnsubscribeFeatureStateChangeNotification ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilApi_UnsubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |refcount|2| |length|38| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|180016f7c| |sig|void __cdecl WilApi_UnsubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilDynamicLoadRaiseFailFastException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilDynamicLoadRaiseFailFastException| |fullname|wil::details::WilDynamicLoadRaiseFailFastException| |refcount|3| |length|100| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress
_guard_dispatch_icall$thunk$10345483385596137414| |calling|| |paramcount|3| |address|180016fb0| |sig|void __cdecl WilDynamicLoadRaiseFailFastException(_EXCEPTION_RECORD * param_1, _CONTEXT * param_2, ulong param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilFailFast ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilFailFast| |fullname|wil::details::WilFailFast| |refcount|4| |length|167| |called|_guard_dispatch_icall$thunk$10345483385596137414
memset
wil::details::WilRaiseFailFastException| |calling|wil::details::ReportFailure_NoReturn<3>
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>| |paramcount|1| |address|18001701c| |sig|void __cdecl WilFailFast(FailureInfo * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::WilRaiseFailFastException ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|WilRaiseFailFastException| |fullname|wil::details::WilRaiseFailFastException| |refcount|3| |length|35| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::WilFailFast| |paramcount|3| |address|1800170cc| |sig|void __cdecl WilRaiseFailFastException(_EXCEPTION_RECORD * param_1, _CONTEXT * param_2, ulong param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::UsageIndexProperty::Write ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|Write| |fullname|wil::details_abi::UsageIndexProperty::Write| |refcount|3| |length|264| |called|MSVCRT.DLL::memcpy_s| |calling|wil::details_abi::RawUsageIndex::RecordUsageInternal| |paramcount|3| |address|1800170f8| |sig|bool __thiscall Write(UsageIndexProperty * this, uchar * * param_1, uchar * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::in1diag3::_FailFast_GetLastError ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|_FailFast_GetLastError| |fullname|wil::details::in1diag3::_FailFast_GetLastError| |refcount|3| |length|20| |called|wil::details::ReportFailure_GetLastError<3>| |calling|wil::details::CloseHandle
wil::details::ReleaseMutex| |paramcount|3| |address|180017218| |sig|void __cdecl _FailFast_GetLastError(void * param_1, uint param_2, char * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::in1diag3::_FailFast_Unexpected ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|_FailFast_Unexpected| |fullname|wil::details::in1diag3::_FailFast_Unexpected| |refcount|2| |length|32| |called|wil::details::ReportFailure_Hr<3>| |calling|wil::details_abi::RawUsageIndex::SetBuffer| |paramcount|3| |address|180017234| |sig|void __cdecl _FailFast_Unexpected(void * param_1, uint param_2, char * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|__clone| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::__clone| |refcount|3| |length|29| |called|| |calling|| |paramcount|2| |address|180017260| |sig|void __thiscall __clone(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this, __base * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|acquire| |fullname|wil::mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::acquire| |refcount|5| |length|83| |called|KERNEL32.DLL::WaitForSingleObjectEx
wil::details::in1diag3::FailFast_Unexpected| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|4| |address|180017284| |sig|unique_any_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>_> __thiscall acquire(mutex_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> * this, ulong * param_1, ulong param_2, int param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::shared_buffer::assign ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|assign| |fullname|wil::details::shared_buffer::assign| |refcount|5| |length|60| |called|wil::details::shared_buffer::reset| |calling|wil::ResultException::ResultException
wil::ResultException::what
wil::StoredFailureInfo::SetFailureInfo| |paramcount|3| |address|1800172e0| |sig|void __thiscall assign(shared_buffer * this, long * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|create| |fullname|wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |refcount|3| |length|103| |called|KERNEL32.DLL::CreateSemaphoreExW
KERNEL32.DLL::GetLastError
wil::details::GetLastErrorFailHr
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |calling|wil::details_abi::SemaphoreValue::CreateFromValueInternal| |paramcount|7| |address|180017324| |sig|long __thiscall create(semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy> * this, long param_1, long param_2, ushort * param_3, ulong param_4, _SECURITY_ATTRIBUTES * param_5, bool * param_6)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::heap_buffer::ensure ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|ensure| |fullname|wil::details_abi::heap_buffer::ensure| |refcount|3| |length|41| |called|wil::details_abi::heap_buffer::reserve| |calling|wil::details_abi::RawUsageIndex::RecordUsage
wil::details_abi::heap_buffer::push_back| |paramcount|2| |address|1800173ac| |sig|bool __thiscall ensure(heap_buffer * this, __uint64 param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::heap_buffer::push_back ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|push_back| |fullname|wil::details_abi::heap_buffer::push_back| |refcount|6| |length|97| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure| |calling|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3| |address|1800173dc| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details_abi::heap_buffer::reserve ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|reserve| |fullname|wil::details_abi::heap_buffer::reserve| |refcount|2| |length|190| |called|MSVCRT.DLL::memcpy_s
wil::details::FreeProcessHeap
wil::details::ProcessHeapAlloc
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details_abi::heap_buffer::ensure| |paramcount|2| |address|180017444| |sig|bool __thiscall reserve(heap_buffer * this, __uint64 param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|reset| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset| |refcount|8| |length|76| |called|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|2| |address|18001750c| |sig|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|reset| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |refcount|6| |length|76| |called|wil::details::CloseHandle
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::SemaphoreValue::Destroy
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create| |paramcount|2| |address|180017560| |sig|void __thiscall reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this, void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|reset| |fullname|wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::reset| |refcount|3| |length|76| |called|wil::details::ReleaseMutex
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|2| |address|1800175b4| |sig|void __thiscall reset(unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> * this, void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::shared_buffer::reset ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|reset| |fullname|wil::details::shared_buffer::reset| |refcount|7| |length|88| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapFree| |calling|wil::ResultException::what
wil::ResultException::~ResultException
wil::StoredFailureInfo::SetFailureInfo
wil::details::shared_buffer::assign| |paramcount|1| |address|180017608| |sig|void __thiscall reset(shared_buffer * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::ResultException::what ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|what| |fullname|wil::ResultException::what| |refcount|3| |length|335| |called|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::WideCharToMultiByte
__chkstk
__security_check_cookie
wil::GetFailureLogString
wil::details::shared_buffer::assign
wil::details::shared_buffer::reset| |calling|| |paramcount|1| |address|180017670| |sig|char * __thiscall what(ResultException * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil_details_GetKernelBaseProcAddress ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_GetKernelBaseProcAddress| |fullname|wil_details_GetKernelBaseProcAddress| |refcount|3| |length|93| |called|KERNEL32.DLL::GetModuleHandleW
KERNEL32.DLL::GetProcAddress| |calling|wil::details::MicrosoftInternalNotifyFailure
wil_StagingConfig_LogStagedFeatureUsage| |paramcount|1| |address|1800177c8| |sig|_func___int64 * __cdecl wil_details_GetKernelBaseProcAddress(char * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil_details_GetNtDllModuleHandle ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_GetNtDllModuleHandle| |fullname|wil_details_GetNtDllModuleHandle| |refcount|3| |length|47| |called|KERNEL32.DLL::GetModuleHandleW| |calling|wil::details::FormatNtStatusMsg
wil_details_GetNtDllProcedureAddress| |paramcount|0| |address|18001782c| |sig|HINSTANCE__ * __cdecl wil_details_GetNtDllModuleHandle(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil_details_GetNtDllProcedureAddress ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_GetNtDllProcedureAddress| |fullname|wil_details_GetNtDllProcedureAddress| |refcount|9| |length|32| |called|wil_details_GetNtDllModuleHandle| |calling|wil::details::RtlDllShutdownInProgress
wil::details::RtlNtStatusToDosErrorNoTeb
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData
wil_details_RtlRegisterFeatureConfigurationChangeNotification| |paramcount|1| |address|180017864| |sig|_func___int64 * __cdecl wil_details_GetNtDllProcedureAddress(char * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil_details_WriteSRUMWnfUsageBuffer ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_WriteSRUMWnfUsageBuffer| |fullname|wil_details_WriteSRUMWnfUsageBuffer| |refcount|2| |length|492| |called|__chkstk
__security_check_cookie
memset
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData| |calling|::| |paramcount|1| |address|180017890| |sig|long __cdecl wil_details_WriteSRUMWnfUsageBuffer(heap_vector * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|3| |length|271| |called|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::IsFeatureConfigured| |paramcount|4| |address|180017a84| |sig|undefined4 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, uint param_2, int param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_RtlStagingConfig_RecordFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_RtlStagingConfig_RecordFeatureUsage| |fullname|wil_RtlStagingConfig_RecordFeatureUsage| |refcount|2| |length|87| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::WilApiImpl_RecordFeatureUsage| |paramcount|3| |address|180017b9c| |sig|__int64 __fastcall wil_RtlStagingConfig_RecordFeatureUsage(undefined4 param_1, undefined2 param_2, int param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_StagingConfig_LogStagedFeatureUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_StagingConfig_LogStagedFeatureUsage| |fullname|wil_StagingConfig_LogStagedFeatureUsage| |refcount|3| |length|86| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetKernelBaseProcAddress| |calling|| |paramcount|3| |address|180017c00| |sig|undefined __fastcall wil_StagingConfig_LogStagedFeatureUsage(uint param_1, uint param_2, undefined1 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_details_NtQueryWnfStateData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_NtQueryWnfStateData| |fullname|wil_details_NtQueryWnfStateData| |refcount|3| |length|112| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details_abi::RecordWnfUsageIndex
wil_details_WriteSRUMWnfUsageBuffer| |paramcount|6| |address|180017c60| |sig|__int64 __fastcall wil_details_NtQueryWnfStateData(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, undefined8 param_5, undefined8 param_6)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_details_NtUpdateWnfStateData ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_NtUpdateWnfStateData| |fullname|wil_details_NtUpdateWnfStateData| |refcount|4| |length|131| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details_abi::RecordWnfUsageIndex
wil_details_WriteSRUMWnfUsageBuffer| |paramcount|7| |address|180017cd8| |sig|__int64 __fastcall wil_details_NtUpdateWnfStateData(undefined8 param_1, undefined8 param_2, uint param_3, undefined8 param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_details_RecordCachedUsage ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|2| |length|325| |called|__security_check_cookie
wil::details::WilApi_RecordFeatureUsageReports| |calling|wil::details::EnabledStateManager::RecordCachedUsageUnderLock| |paramcount|2| |address|180017d64| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## wil_details_RtlRegisterFeatureConfigurationChangeNotification ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |fullname|wil_details_RtlRegisterFeatureConfigurationChangeNotification| |refcount|2| |length|100| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil::details::FeatureStateManager::SubscribeToEnabledStateChanges| |paramcount|4| |address|180017eb0| |sig|__int64 __fastcall wil_details_RtlRegisterFeatureConfigurationChangeNotification(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ## :: ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|| |fullname|::| |refcount|2| |length|12| |called|wil::details::EnabledStateManager::OnTimer| |calling|| |paramcount|1| |address|180017f30| |sig|undefined __cdecl (void * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|EnsureSubscribedToUsageFlush| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush| |refcount|2| |length|128| |called|KERNEL32.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::ReportUsageToServiceDirect| |paramcount|2| |address|180017f44| |sig|void __thiscall EnsureSubscribedToUsageFlush(EnabledStateManager * this, _func_void_void_ptr * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|fh_8875.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|302| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|180017fcc| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ## Max Added Section Functions Reached Error 95 Added Functions Ommited... # Modified *Modified functions contain code changes* ## ServiceMain ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.03| |i_ratio|0.0| |m_ratio|0.67| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|ServiceMain|ServiceMain| |fullname|ServiceMain|ServiceMain| |refcount|3|3| |`length`|5|12| |`called`||CFhService::StartServiceW| |calling||| |paramcount|2|2| |`address`|18000d0d0|180018550| |sig|void __cdecl ServiceMain(ulong param_1, ushort * * param_2)|void __cdecl ServiceMain(ulong param_1, ushort * * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### ServiceMain Called Diff ```diff --- ServiceMain called +++ ServiceMain called @@ -0,0 +1 @@ +CFhService::StartServiceW ``` ### ServiceMain Diff ```diff --- ServiceMain +++ ServiceMain @@ -1,267 +1,11 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* void __cdecl ServiceMain(unsigned long,unsigned short * __ptr64 * __ptr64 const) */ void __cdecl ServiceMain(ulong param_1,ushort **param_2) { - DWORD DVar1; - uint uVar2; - int iVar3; - LSTATUS LVar4; - long lVar5; - CManagerThread *this; - CFhService *this_00; - undefined4 in_register_0000000c; - undefined2 uVar6; - ulonglong uVar7; - uint uVar8; - ulong uVar9; - SERVICE_STATUS_HANDLE pSVar10; - undefined *puVar11; - ulonglong uStackX_8; - DWORD aDStackX_10 [2]; - undefined4 auStackX_18 [2]; - HKEY pHStackX_20; - CFhService *apCStack_38 [3]; - - /* 0xd0d0 1 ServiceMain */ - uStackX_8 = CONCAT44(in_register_0000000c,param_1); - uVar7 = 0; - pHStackX_20 = (HKEY)0x0; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),10, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - if (DAT_0 == 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,0x8000ffff); - } - goto LAB_1; - } - } - else { - uRam000000018001b890 = 0; - _DAT_2 = 0; - _DAT_3 = 0; - _DAT_4 = 0x100000030; - _DAT_5 = 2; - uVar9 = 0; - DAT_6 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); - if (DAT_6 == (HANDLE)0x0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xc; -LAB_7: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,DVar1); - } -LAB_8: - if (-1 < (int)DVar1) { -LAB_9: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x16, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - goto LAB_10; - } -LAB_1: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x15, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - } - else { - if (DAT_11 == 0) { - uVar9 = 0x8001b880; - _g_Service = RegisterServiceCtrlHandlerExW - (L"fhsvc",CFhService::ServiceControlHandler,&g_Service); - if (_g_Service == (SERVICE_STATUS_HANDLE)0x0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xd; - goto LAB_7; - } - goto LAB_8; - } - } - uVar2 = CFhService::ReportStatus(&g_Service,2,uVar9,1,10000); - if ((int)uVar2 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar6 = 0xe; - goto LAB_12; - } - goto LAB_1; - } - } - else { - this = (CManagerThread *)&GUID_LOW_POWER_EPOCH; - pSVar10 = _g_Service; - iVar3 = PowerSettingRegisterNotification(&GUID_LOW_POWER_EPOCH,1); - uVar9 = (ulong)pSVar10; - if (iVar3 != 0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar6 = 0xf; - goto LAB_7; - } - goto LAB_8; - } - uVar2 = CManagerThread::Start(this,DAT_6); - if ((int)uVar2 < 0) { - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_13; - if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) goto LAB_1; - uVar6 = 0x10; -LAB_12: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,uVar2); - goto LAB_1; - } - uVar2 = RpcRegisterServer(); - if ((int)uVar2 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar6 = 0x11; - goto LAB_12; - } - goto LAB_1; - } - } - else { - uVar2 = CFhService::ReportStatus(&g_Service,4,uVar9,0,0); - if ((int)uVar2 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar6 = 0x12; - goto LAB_12; - } - goto LAB_1; - } - } - else { - LVar4 = RegOpenKeyExW((HKEY)0xffffffff80000002, - L"System\\CurrentControlSet\\Services\\fhsvc\\Parameters",0, - 0x20019,&pHStackX_20); - if (LVar4 == 0) { - auStackX_18[0] = 0; - aDStackX_10[0] = 4; - LVar4 = RegGetValueW(pHStackX_20,(LPCWSTR)0x0,L"TestFlags",0x10,(LPDWORD)0x0, - auStackX_18,aDStackX_10); - if ((LVar4 == 0) && (aDStackX_10[0] == 4)) { - _DAT_14 = auStackX_18[0]; - } - if (pHStackX_20 != (HKEY)0x0) { - RegCloseKey(pHStackX_20); - pHStackX_20 = (HKEY)0x0; - } - } - apCStack_38[0] = (CFhService *)0x0; - uStackX_8 = uStackX_8 & 0xffffffff00000000; - puVar11 = (undefined *)0x1; - iVar3 = WTSEnumerateSessionsW(0,0,1,apCStack_38,&uStackX_8); - if (iVar3 == 0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - puVar11 = &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x65, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar1); - } - } - else { - uVar2 = (uint)uStackX_8; - if ((uint)uStackX_8 != 0) { - do { - if (*(int *)(apCStack_38[0] + uVar7 * 0x18 + 0x10) == 0) { - CManagerThread::QueueBackupForLoggedOnUser - ((CManagerThread *)(uVar7 * 3), - *(ulong *)(apCStack_38[0] + uVar7 * 0x18)); - uVar2 = (uint)uStackX_8; - } - uVar8 = (int)uVar7 + 1; - uVar7 = (ulonglong)uVar8; - } while (uVar8 < uVar2); - } - } - this_00 = apCStack_38[0]; - if (apCStack_38[0] != (CFhService *)0x0) { - WTSFreeMemory(); - } - uVar7 = (ulonglong)(DAT_15 == 0); - lVar5 = CFhService::SetServiceStartType(this_00,(uint)(DAT_15 == 0)); - if (lVar5 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - WPP_SF_cd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7,puVar11, - DAT_15 != 0); - } - goto LAB_1; - } - } - else { - uVar2 = (**(code **)(DAT_0 + 0xc0)) - (&DAT_16,L"fhsvc",DAT_18001b8b0, - CFhService::StopServiceCallback,&g_Service,8); - if (0 < (int)uVar2) { - uVar2 = uVar2 & 0xffff | 0x80070000; - } - if (-1 < (int)uVar2) { -LAB_17: - LOCK(); - _DAT_5 = _DAT_5 & 0xfffffffd; - UNLOCK(); - goto LAB_9; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) { - if (-1 < (int)uVar2) goto LAB_17; - } - else { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x32, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,uVar2); - } - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar6 = 0x14; - goto LAB_12; - } - goto LAB_1; - } - } - } - } - } - } - } -LAB_13: - CFhService::ShutdownService(&g_Service); -LAB_10: - if (pHStackX_20 != (HKEY)0x0) { - RegCloseKey(pHStackX_20); - } + /* 0x18550 1 ServiceMain */ + CFhService::StartServiceW(&g_Service); return; } ``` ## CManagerThread::BlockConfig ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.13| |i_ratio|0.05| |m_ratio|0.44| |b_ratio|0.06| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|BlockConfig|BlockConfig| |fullname|CManagerThread::BlockConfig|CManagerThread::BlockConfig| |refcount|2|2| |`length`|270|949| |`called`|ATL::CSimpleStringT::~CSimpleStringT
ATL::CStringT_>_>::CStringT_>_>
CManagerThread::GetConfigDescriptor
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
SmartPtr::SmartPtr
SmartPtr::~SmartPtr
WPP_SF_S
WPP_SF_Sd|
Expand for full list:
ATL::CSimpleStringT::~CSimpleStringT
ATL::CStringT_>_>::CStringT_>_>
CManagerThread::GetConfigDescriptor
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::DuplicateHandle
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetCurrentProcess
KERNEL32.DLL::GetLastError
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
KERNEL32.DLL::WaitForSingleObjectSmartPtr::SmartPtr
SmartPtr::~SmartPtr
WPP_SF_L
WPP_SF_S
WPP_SF_SLL
WPP_SF_Sd
wil::details::FeatureImpl::__private_IsEnabled
| |calling|FhSvcApiBlockUnblockBackup|FhSvcApiBlockUnblockBackup| |paramcount|2|2| |`address`|18000eee8|18001b898| |sig|long __thiscall BlockConfig(CManagerThread * this, CStringT_>_> param_1)|long __thiscall BlockConfig(CManagerThread * this, CStringT_>_> param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::BlockConfig Called Diff ```diff --- CManagerThread::BlockConfig called +++ CManagerThread::BlockConfig called @@ -3,0 +4,2 @@ +KERNEL32.DLL::CloseHandle +KERNEL32.DLL::DuplicateHandle @@ -4,0 +7,2 @@ +KERNEL32.DLL::GetCurrentProcess +KERNEL32.DLL::GetLastError @@ -6,0 +11 @@ +KERNEL32.DLL::WaitForSingleObject @@ -8,0 +14 @@ +WPP_SF_L @@ -9,0 +16 @@ +WPP_SF_SLL @@ -10,0 +18 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::BlockConfig Diff ```diff --- CManagerThread::BlockConfig +++ CManagerThread::BlockConfig @@ -1,52 +1,153 @@ /* public: long __cdecl CManagerThread::BlockConfig(class ATL::CStringT > >) __ptr64 */ long __thiscall -CManagerThread::BlockConfig(CManagerThread *this,CSimpleStringT *param_2) +CManagerThread::BlockConfig(undefined8 param_1,CSimpleStringT *param_2) { - long lVar1; - CSimpleStringT *pCVar2; - CManagerThread *local_res8; + HANDLE pvVar1; + bool bVar2; + bool bVar3; + long lVar4; + BOOL BVar5; + DWORD DVar6; + HANDLE hSourceProcessHandle; + CSimpleStringT *pCVar7; + undefined8 uVar8; + longlong *plVar9; + longlong **hTargetProcessHandle; + longlong *local_res18; + HANDLE local_res20; CStringT_>_> - local_res18 [16]; + local_48 [16]; - pCVar2 = param_2; - local_res8 = this; - EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); - SmartPtr::SmartPtr - ((SmartPtr *)&local_res8,(CConfigDescriptor *)pCVar2); - ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_res18, - (CStringT_>_> - *)param_2); - lVar1 = GetConfigDescriptor(); - if (lVar1 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x40, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,*(wchar_t **)param_2); + pCVar7 = param_2; + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar3) { + SmartPtr::SmartPtr + ((SmartPtr *)&local_res18,(CConfigDescriptor *)pCVar7); + local_res20 = (HANDLE)0x0; + bVar3 = false; + EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); + ATL:: + CStringT_>_> + :: + CStringT_>_> + (local_48,(CStringT_>_> + *)param_2); + bVar2 = true; + hTargetProcessHandle = &local_res18; + lVar4 = GetConfigDescriptor(); + if (lVar4 < 0) { + plVar9 = local_res18; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + hTargetProcessHandle = (longlong **)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x42, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2); + plVar9 = local_res18; + } + } + else { + LOCK(); + *(int *)(*local_res18 + 0x2c) = *(int *)(*local_res18 + 0x2c) + 1; + UNLOCK(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + hTargetProcessHandle = (longlong **)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x40, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2); + } + plVar9 = local_res18; + if ((*(longlong *)(*local_res18 + 0x90) != 0) && + (pvVar1 = *(HANDLE *)(*local_res18 + 0x108), pvVar1 != (HANDLE)0x0)) { + SetEvent(pvVar1); + hTargetProcessHandle = GetCurrentProcess(); + pvVar1 = *(HANDLE *)(*local_res18 + 0x90); + hSourceProcessHandle = GetCurrentProcess(); + BVar5 = DuplicateHandle(hSourceProcessHandle,pvVar1,hTargetProcessHandle,&local_res20, + 0x100000,0,0); + bVar3 = bVar2; + if ((BVar5 == 0) && + ((local_res20 = (HANDLE)0x0, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)))) { + DVar6 = GetLastError(); + hTargetProcessHandle = (longlong **)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar6); + } + } + } + SetEvent(DAT_1); + LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); + if (bVar3) { + if (local_res20 == (HANDLE)0x0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x44, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2); + } + } + else { + uVar8 = 30000; + DVar6 = WaitForSingleObject(local_res20,30000); + if (((DVar6 != 0) && + (bVar2 = false, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_SLL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8,hTargetProcessHandle, + *(wchar_t **)param_2); + } + CloseHandle(local_res20); + local_res20 = (HANDLE)0x0; + if (bVar2) goto LAB_2; + } + if ((plVar9 != (longlong *)0x0) && (*plVar9 != 0)) { + LOCK(); + *(int *)(*plVar9 + 0x2c) = *(int *)(*plVar9 + 0x2c) + -1; + UNLOCK(); + SetEvent(DAT_1); + } + lVar4 = -0x7ff8ff56; } } else { - LOCK(); - *(int *)(*(longlong *)local_res8 + 0x2c) = *(int *)(*(longlong *)local_res8 + 0x2c) + 1; - UNLOCK(); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,*(wchar_t **)param_2); + SmartPtr::SmartPtr + ((SmartPtr *)&local_res18,(CConfigDescriptor *)pCVar7); + EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); + ATL:: + CStringT_>_> + :: + CStringT_>_> + (local_48,(CStringT_>_> + *)param_2); + lVar4 = GetConfigDescriptor(); + if (lVar4 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x46, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2); + } } + else { + LOCK(); + *(int *)(*local_res18 + 0x2c) = *(int *)(*local_res18 + 0x2c) + 1; + UNLOCK(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x45, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2); + } + } + SetEvent(DAT_1); + LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); } - SetEvent(DAT_1); +LAB_2: SmartPtr::~SmartPtr - ((SmartPtr *)&local_res8); - LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); + ((SmartPtr *)&local_res18); ATL::CSimpleStringT::~CSimpleStringT(param_2); - return lVar1; + return lVar4; } ``` ## CConfigDescriptor::CConfigDescriptor ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.76| |i_ratio|0.38| |m_ratio|0.8| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|CConfigDescriptor|CConfigDescriptor| |fullname|CConfigDescriptor::CConfigDescriptor|CConfigDescriptor::CConfigDescriptor| |refcount|2|2| |`length`|178|292| |`called`|ATL::CStringT_>_>::CStringT_>_>
KERNEL32.DLL::GetSystemTimeAsFileTime
SmartPtr::SmartPtr|ATL::CStringT_>_>::CStringT_>_>
KERNEL32.DLL::GetSystemTimeAsFileTime
SmartPtr::SmartPtr
memset
wil::details::FeatureImpl::__private_IsEnabled| |calling|CManagerThread::GetConfigDescriptor|CManagerThread::GetConfigDescriptor| |paramcount|1|1| |`address`|18000ec10|18001b448| |sig|undefined __thiscall CConfigDescriptor(CConfigDescriptor * this)|undefined __thiscall CConfigDescriptor(CConfigDescriptor * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CConfigDescriptor::CConfigDescriptor Called Diff ```diff --- CConfigDescriptor::CConfigDescriptor called +++ CConfigDescriptor::CConfigDescriptor called @@ -3,0 +4,2 @@ +memset +wil::details::FeatureImpl::__private_IsEnabled ``` ### CConfigDescriptor::CConfigDescriptor Diff ```diff --- CConfigDescriptor::CConfigDescriptor +++ CConfigDescriptor::CConfigDescriptor @@ -1,42 +1,60 @@ /* public: __cdecl CConfigDescriptor::CConfigDescriptor(void) __ptr64 */ CConfigDescriptor * __thiscall CConfigDescriptor::CConfigDescriptor(CConfigDescriptor *this) { + bool bVar1; CVolumeTrackingDescriptor *in_RDX; _FILETIME local_res10; ATL:: CStringT_>_> :: CStringT_>_> ((CStringT_>_> *)this); *(undefined8 *)(this + 8) = 0; *(undefined8 *)(this + 0x10) = 0; *(undefined4 *)(this + 0x18) = 0; *(undefined8 *)(this + 0x28) = 0; *(undefined8 *)(this + 0x38) = 0xffffffffffffffff; *(undefined8 *)(this + 0x40) = 0xffffffffffffffff; *(undefined8 *)(this + 0x48) = 0xffffffffffffffff; *(undefined8 *)(this + 0x50) = 0; *(undefined8 *)(this + 0x58) = 0; *(undefined4 *)(this + 0x60) = 0; *(undefined8 *)(this + 0x68) = 0xffffffffffffffff; *(undefined8 *)(this + 0x70) = 0xffffffffffffffff; *(undefined8 *)(this + 0x78) = 0xffffffffffffffff; *(undefined8 *)(this + 0x80) = 0xffffffffffffffff; SmartPtr::SmartPtr ((SmartPtr *)(this + 0x88),in_RDX); - *(undefined4 *)(this + 0x90) = 0; + *(undefined8 *)(this + 0x90) = 0; + *(undefined4 *)(this + 0xdc) = 0; + *(undefined8 *)(this + 0xe0) = 0; + *(undefined4 *)(this + 0xe8) = 0; + *(undefined4 *)(this + 0xec) = 0xff; + *(undefined4 *)(this + 0xf8) = 0; + *(undefined8 *)(this + 0x100) = 0; + *(undefined8 *)(this + 0x108) = 0; + *(undefined4 *)(this + 0x110) = 0; + *(undefined8 *)(this + 0x118) = 0; + *(undefined4 *)(this + 0x120) = 0; local_res10.dwLowDateTime = 0; local_res10.dwHighDateTime = 0; GetSystemTimeAsFileTime(&local_res10); *(DWORD *)(this + 0x20) = local_res10.dwLowDateTime; *(DWORD *)(this + 0x24) = local_res10.dwHighDateTime; *(undefined8 *)(this + 0x30) = 0xffffffffffffffff; - *(undefined8 *)(this + 0x94) = 0; + *(undefined8 *)(this + 0x124) = 0; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + *(undefined8 *)(this + 0xf0) = 0; + memset(this + 0x98,0,0x44); + } return this; } ``` ## CManagerThread::EnterMaintenanceMode ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.86| |i_ratio|0.46| |m_ratio|0.88| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|EnterMaintenanceMode|EnterMaintenanceMode| |fullname|CManagerThread::EnterMaintenanceMode|CManagerThread::EnterMaintenanceMode| |refcount|2|2| |`length`|408|522| |`called`|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CWorkerThread::Stop
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::ResetEvent
KERNEL32.DLL::SetEvent
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
WPP_SF_WPP_SF_S
|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CWorkerThread::Stop
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::ResetEvent
KERNEL32.DLL::SetEvent
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
WPP_SF_WPP_SF_S
wil::details::FeatureImpl::__private_IsEnabled
| |calling|FhSvcApiEnterMaintenanceMode|FhSvcApiEnterMaintenanceMode| |paramcount|1|1| |`address`|18000f22c|18001c230| |sig|void __thiscall EnterMaintenanceMode(CManagerThread * this)|void __thiscall EnterMaintenanceMode(CManagerThread * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::EnterMaintenanceMode Called Diff ```diff --- CManagerThread::EnterMaintenanceMode called +++ CManagerThread::EnterMaintenanceMode called @@ -12,0 +13 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::EnterMaintenanceMode Diff ```diff --- CManagerThread::EnterMaintenanceMode +++ CManagerThread::EnterMaintenanceMode @@ -1,71 +1,83 @@ /* public: void __cdecl CManagerThread::EnterMaintenanceMode(void) __ptr64 */ void __thiscall CManagerThread::EnterMaintenanceMode(CManagerThread *this) { undefined8 *puVar1; longlong *plVar2; CNode *pCVar3; CNode *pCVar4; CConfigDescriptor *in_RDX; int iVar5; bool bVar6; longlong *local_res10; LOCK(); iVar5 = DAT_0 + 1; UNLOCK(); bVar6 = DAT_0 == 0; DAT_0 = iVar5; if (bVar6) { EnterCriticalSection((LPCRITICAL_SECTION)&DAT_1); SmartPtr::SmartPtr ((SmartPtr *)&local_res10,in_RDX); iVar5 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x54, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x59, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); } pCVar3 = ATL:: CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> *)&DAT_2,DAT_2); while (pCVar3 != (CNode *)0x0) { pCVar4 = ATL:: CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> *)&DAT_2,pCVar3); SmartPtr::operator= ((SmartPtr *)&local_res10, (SmartPtr *)(pCVar3 + 8)); plVar2 = local_res10; pCVar3 = pCVar4; if (*(int *)(*local_res10 + 0x10) != 0) { *(undefined4 *)(*local_res10 + 0x14) = 1; puVar1 = (undefined8 *)*local_res10; if ((((longlong *)puVar1[0x11] != (longlong *)0x0) && (*(longlong *)puVar1[0x11] != 0)) && (*(int *)(puVar1 + 0xb) == 1)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x55, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar1); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5a, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)*puVar1); } CWorkerThread::Stop((CWorkerThread *)**(undefined8 **)(*plVar2 + 0x88),0); + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar6) && (puVar1 = (undefined8 *)*plVar2, puVar1[0x12] != 0)) && + ((puVar1[0x21] != 0 && (*(int *)(puVar1 + 0xb) == 1)))) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5b, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)*puVar1); + } + SetEvent(*(HANDLE *)(*plVar2 + 0x108)); } iVar5 = iVar5 + 1; } } DAT_3 = iVar5; if (0 < iVar5) { ResetEvent(DAT_4); } SetEvent(DAT_5); SmartPtr::~SmartPtr ((SmartPtr *)&local_res10); LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_1); } return; } ``` ## CManagerThread::ExitMaintenanceMode ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.84| |i_ratio|0.41| |m_ratio|0.88| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|ExitMaintenanceMode|ExitMaintenanceMode| |fullname|CManagerThread::ExitMaintenanceMode|CManagerThread::ExitMaintenanceMode| |refcount|3|3| |`length`|401|513| |`called`|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CWorkerThread::Stop
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
WPP_SF_
WPP_SF_S
|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CWorkerThread::Stop
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
WPP_SF_
WPP_SF_Swil::details::FeatureImpl::__private_IsEnabled
| |calling|FHSVC_PIPE_HANDLE_rundown
FhSvcApiExitMaintenanceMode|FHSVC_PIPE_HANDLE_rundown
FhSvcApiExitMaintenanceMode| |paramcount|1|1| |`address`|18000f3cc|18001c444| |sig|void __thiscall ExitMaintenanceMode(CManagerThread * this)|void __thiscall ExitMaintenanceMode(CManagerThread * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::ExitMaintenanceMode Called Diff ```diff --- CManagerThread::ExitMaintenanceMode called +++ CManagerThread::ExitMaintenanceMode called @@ -11,0 +12 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::ExitMaintenanceMode Diff ```diff --- CManagerThread::ExitMaintenanceMode +++ CManagerThread::ExitMaintenanceMode @@ -1,69 +1,81 @@ /* public: void __cdecl CManagerThread::ExitMaintenanceMode(void) __ptr64 */ void __thiscall CManagerThread::ExitMaintenanceMode(CManagerThread *this) { undefined8 *puVar1; int iVar2; longlong *plVar3; CNode *pCVar4; CNode *pCVar5; CConfigDescriptor *in_RDX; bool bVar6; longlong *local_res10; LOCK(); iVar2 = DAT_0 + -1; UNLOCK(); bVar6 = DAT_0 == 1; DAT_0 = iVar2; if (bVar6) { EnterCriticalSection((LPCRITICAL_SECTION)&DAT_1); SmartPtr::SmartPtr ((SmartPtr *)&local_res10,in_RDX); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x56, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5c, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); } pCVar4 = ATL:: CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> *)&DAT_2,DAT_2); while (pCVar4 != (CNode *)0x0) { pCVar5 = ATL:: CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> *)&DAT_2,pCVar4); SmartPtr::operator= ((SmartPtr *)&local_res10, (SmartPtr *)(pCVar4 + 8)); plVar3 = local_res10; if ((*(int *)(*local_res10 + 0x14) != 0) && (*(int *)(*local_res10 + 0x58) != 2)) { DAT_3 = DAT_3 + -1; } *(undefined4 *)(*local_res10 + 0x14) = 0; puVar1 = (undefined8 *)*local_res10; - pCVar4 = pCVar5; if ((((longlong *)puVar1[0x11] != (longlong *)0x0) && (*(longlong *)puVar1[0x11] != 0)) && (*(int *)(puVar1 + 0xb) == 2)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x57, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar1); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5d, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)*puVar1); } CWorkerThread::Stop((CWorkerThread *)**(undefined8 **)(*plVar3 + 0x88),0); + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + pCVar4 = pCVar5; + if (((bVar6) && (puVar1 = (undefined8 *)*plVar3, puVar1[0x12] != 0)) && + ((puVar1[0x21] != 0 && (*(int *)(puVar1 + 0xb) == 2)))) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5e, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)*puVar1); + } + SetEvent(*(HANDLE *)(*plVar3 + 0x108)); } } if (DAT_3 == 0) { SetEvent(DAT_4); } SetEvent(DAT_5); SmartPtr::~SmartPtr ((SmartPtr *)&local_res10); LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_1); } return; } ``` ## StringCchPrintfW ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.41| |i_ratio|0.13| |m_ratio|0.7| |b_ratio|0.3| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|3|7| |`length`|114|71| |`called`|MSVCRT.DLL::_vsnwprintf|StringVPrintfWorkerW
StringValidateDestW| |`calling`|StartTracingSession|CManagerThread::CreateWorkerThread
StartTracingSession
WorkerIfInitOnceCallback
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire| |paramcount|3|3| |`address`|180012464|180016628| |sig|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchPrintfW Called Diff ```diff --- StringCchPrintfW called +++ StringCchPrintfW called @@ -1 +1,2 @@ -MSVCRT.DLL::_vsnwprintf +StringVPrintfWorkerW +StringValidateDestW ``` ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -0,0 +1 @@ +CManagerThread::CreateWorkerThread @@ -1,0 +3,3 @@ +WorkerIfInitOnceCallback +wil::details_abi::ProcessLocalStorageData::Acquire +wil::details_abi::ProcessLocalStorageData::Acquire ``` ### StringCchPrintfW Diff ```diff --- StringCchPrintfW +++ StringCchPrintfW @@ -1,35 +1,26 @@ /* long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...) */ long __cdecl StringCchPrintfW(ushort *param_1,__uint64 param_2,ushort *param_3,...) { - ulonglong _Count; - int iVar1; - long lVar2; + HRESULT HVar1; undefined8 in_R9; undefined8 local_res20; - if (param_2 - 1 < 0x7fffffff) { - _Count = param_2 - 1; - lVar2 = 0; - local_res20 = in_R9; - iVar1 = _vsnwprintf((wchar_t *)param_1,_Count,(wchar_t *)param_3,(va_list)&local_res20); - if ((iVar1 < 0) || (_Count < (ulonglong)(longlong)iVar1)) { - lVar2 = -0x7ff8ff86; + local_res20 = in_R9; + HVar1 = StringValidateDestW((STRSAFE_PCNZWCH)param_1,param_2,(size_t)param_3); + if (HVar1 < 0) { + if (param_2 != 0) { + *param_1 = L'\0'; } - else if ((longlong)iVar1 != _Count) { - return 0; - } - param_1[_Count] = 0; } else { - lVar2 = -0x7ff8ffa9; - if (param_2 != 0) { - *param_1 = 0; - } + HVar1 = StringVPrintfWorkerW + ((STRSAFE_LPWSTR)param_1,param_2,(size_t *)param_3,(STRSAFE_LPCWSTR)param_3, + (va_list)&local_res20); } - return lVar2; + return HVar1; } ``` ## AllocSessionProperties ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.68| |i_ratio|0.46| |m_ratio|0.88| |b_ratio|0.73| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|AllocSessionProperties|AllocSessionProperties| |fullname|AllocSessionProperties|AllocSessionProperties| |refcount|2|2| |`length`|186|156| |`called`|KERNEL32.DLL::LocalAlloc|KERNEL32.DLL::LocalAlloc
StringCchCopyW| |calling|StartTracingSession|StartTracingSession| |paramcount|2|2| |`address`|180008600|180004ae0| |sig|_EVENT_TRACE_PROPERTIES * __cdecl AllocSessionProperties(ushort * param_1, ulong param_2)|_EVENT_TRACE_PROPERTIES * __cdecl AllocSessionProperties(ushort * param_1, ulong param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### AllocSessionProperties Called Diff ```diff --- AllocSessionProperties called +++ AllocSessionProperties called @@ -1,0 +2 @@ +StringCchCopyW ``` ### AllocSessionProperties Diff ```diff --- AllocSessionProperties +++ AllocSessionProperties @@ -1,44 +1,27 @@ /* struct _EVENT_TRACE_PROPERTIES * __ptr64 __cdecl AllocSessionProperties(unsigned short const * __ptr64,unsigned long) */ _EVENT_TRACE_PROPERTIES * __cdecl AllocSessionProperties(ushort *param_1,ulong param_2) { _EVENT_TRACE_PROPERTIES *p_Var1; - _EVENT_TRACE_PROPERTIES *p_Var2; - _EVENT_TRACE_PROPERTIES *p_Var3; - longlong lVar4; - longlong lVar5; p_Var1 = LocalAlloc(0x40,0x488); if (p_Var1 != (_EVENT_TRACE_PROPERTIES *)0x0) { *(undefined4 *)p_Var1 = 0x488; *(undefined4 *)(p_Var1 + 0x2c) = 0x20000; *(undefined4 *)(p_Var1 + 0x30) = 0x40; *(undefined4 *)(p_Var1 + 0x34) = 4; *(undefined4 *)(p_Var1 + 0x38) = 0x18; *(ulong *)(p_Var1 + 0x3c) = param_2; *(undefined4 *)(p_Var1 + 0x40) = 2; *(undefined4 *)(p_Var1 + 0x74) = 0x78; *(undefined4 *)(p_Var1 + 0x70) = 0x280; if (param_1 != (ushort *)0x0) { - p_Var3 = p_Var1 + 0x280; - lVar5 = 0x104; - lVar4 = (longlong)param_1 - (longlong)p_Var3; - do { - if ((lVar5 == -0x7ffffefa) || (*(short *)(p_Var3 + lVar4) == 0)) break; - *(short *)p_Var3 = *(short *)(p_Var3 + lVar4); - p_Var3 = p_Var3 + 2; - lVar5 = lVar5 + -1; - } while (lVar5 != 0); - p_Var2 = p_Var3 + -2; - if (lVar5 != 0) { - p_Var2 = p_Var3; - } - *(short *)p_Var2 = 0; + StringCchCopyW((ushort *)(p_Var1 + 0x280),0x104,param_1); } } return p_Var1; } ``` ## CFhService::ShutdownService ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.54| |i_ratio|0.35| |m_ratio|0.75| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|ShutdownService|ShutdownService| |fullname|CFhService::ShutdownService|CFhService::ShutdownService| |`refcount`|2|3| |`length`|311|544| |`called`|CFhService::ReportStatus
CManagerThread::ReleaseResources
CManagerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::SetEvent
KERNEL32.DLL::UnregisterWaitEx
POWRPROF.DLL::PowerSettingUnregisterNotification
RpcUnregisterServer
WPP_SF_
WPP_SF_d|
Expand for full list:
CFhService::ReportStatus
CManagerThread::ReleaseResources
CManagerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::SetEvent
KERNEL32.DLL::UnregisterWaitEx
POWRPROF.DLL::PowerSettingUnregisterNotification
RPCRT4.DLL::RpcServerInterfaceGroupClose
RPCRT4.DLL::RpcServerInterfaceGroupDeactivate
RpcUnregisterServer
WPP_SF_WPP_SF_L
wil::details::FeatureImpl::__private_IsEnabled
| |`calling`|CFhService::StartServiceW|CFhService::StartServiceW
CFhService::StopServiceCallback| |paramcount|1|1| |`address`|1800016b0|180006e70| |sig|void __thiscall ShutdownService(CFhService * this)|void __thiscall ShutdownService(CFhService * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CFhService::ShutdownService Called Diff ```diff --- CFhService::ShutdownService called +++ CFhService::ShutdownService called @@ -7,0 +8,2 @@ +RPCRT4.DLL::RpcServerInterfaceGroupClose +RPCRT4.DLL::RpcServerInterfaceGroupDeactivate @@ -10 +12,2 @@ -WPP_SF_d +WPP_SF_L +wil::details::FeatureImpl::__private_IsEnabled ``` ### CFhService::ShutdownService Calling Diff ```diff --- CFhService::ShutdownService calling +++ CFhService::ShutdownService calling @@ -1,0 +2 @@ +CFhService::StopServiceCallback ``` ### CFhService::ShutdownService Diff ```diff --- CFhService::ShutdownService +++ CFhService::ShutdownService @@ -1,52 +1,84 @@ /* public: void __cdecl CFhService::ShutdownService(void) __ptr64 */ void __thiscall CFhService::ShutdownService(CFhService *this) { - long lVar1; + bool bVar1; + long lVar2; + int iVar3; CManagerThread *this_00; ulong in_R8D; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - in_R8D = 0x80016610; - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x18, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); + in_R8D = 0x800254b0; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x19, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids); } this_00 = *(CManagerThread **)(this + 0x28); if (this_00 != (CManagerThread *)0x0) { UnregisterWaitEx(this_00,(HANDLE)0x0); *(undefined8 *)(this + 0x28) = 0; } - lVar1 = RpcUnregisterServer(); - if (((lVar1 < 0) && + lVar2 = RpcUnregisterServer(); + if (((lVar2 < 0) && (this_00 = (CManagerThread *)WPP_GLOBAL_Control, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + in_R8D = 0x800254b0; this_00 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - in_R8D = 0x80016610; - WPP_SF_d(this_00,0x19,&WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,lVar1); + WPP_SF_L(this_00,0x1a,&WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,lVar2); } - lVar1 = CManagerThread::Stop(this_00); - if (((lVar1 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + lVar2 = CManagerThread::Stop(this_00); + if (((lVar2 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - in_R8D = 0x80016610; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,lVar1); + in_R8D = 0x800254b0; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1b, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,lVar2); + } + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + if (DAT_0 != 0) { + iVar3 = RpcServerInterfaceGroupDeactivate(DAT_0,1); + if (((iVar3 != 0) && (iVar3 != 0x6b3)) && + (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)))) { + in_R8D = 0x80025588; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x4f, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,iVar3); + } + iVar3 = RpcServerInterfaceGroupClose(DAT_0); + if (((iVar3 != 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + in_R8D = 0x80025588; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x50, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,iVar3); + } + DAT_0 = 0; + } + DAT_1 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + in_R8D = 0x80025588; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x51, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids); + } } CManagerThread::ReleaseResources(&g_ManagerThread); if (*(HANDLE *)(this + 0x30) != (HANDLE)0x0) { SetEvent(*(HANDLE *)(this + 0x30)); CloseHandle(*(HANDLE *)(this + 0x30)); *(undefined8 *)(this + 0x30) = 0; } if (*(longlong *)(this + 0x48) != 0) { PowerSettingUnregisterNotification(); *(undefined8 *)(this + 0x48) = 0; } ReportStatus(this,1,in_R8D,0,0); *(undefined8 *)this = 0; return; } ``` ## CManagerThread::WaitCallback ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.06| |i_ratio|0.1| |m_ratio|0.79| |b_ratio|0.25| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|WaitCallback|WaitCallback| |fullname|CManagerThread::WaitCallback|CManagerThread::WaitCallback| |refcount|3|3| |`length`|4049|6267| |`called`|
Expand for full list:
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoInitializeEx
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoUninitialize
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
ATL::CStringT_>_>::CStringT_>_>
CConfigDescriptor::CachePropertiesInRegistry
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::ReloadPolicies
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::CreateWorkerThreadCManagerThread::MapHrToProtectionState
CManagerThread::PublishProtectionState
CWorkerThread::CWorkerThread
CWorkerThread::Create
KERNEL32.DLL::CallbackMayRunLong
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::ResetEvent
KERNEL32.DLL::SetEvent
KERNEL32.DLL::SetEventWhenCallbackReturns
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::SubmitThreadpoolWork
KERNEL32.DLL::WaitForSingleObject
McTemplateU0z_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::operator=
SmartPtr::operator=
WPP_SF_
WPP_SF_S
WPP_SF_SS
WPP_SF_Si
WPP_SF_d
WPP_SF_sS
_guard_dispatch_icall$thunk$10345483385596137414
operator_new
|
Expand for full list:
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoInitializeEx
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoUninitialize
ATL::AtlThrowImpl
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDeleteFixup
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
ATL::CSimpleStringT::Empty
CConfigDescriptor::CachePropertiesInRegistry
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::ReloadPolicies
CManagerThread::CreateWorkerThread
CManagerThread::PublishProtectionStateCWorkerThread::Stop
KERNEL32.DLL::CallbackMayRunLong
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::LocalFree
KERNEL32.DLL::ResetEvent
KERNEL32.DLL::SetEvent
KERNEL32.DLL::SetEventWhenCallbackReturns
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::SubmitThreadpoolWork
KERNEL32.DLL::WaitForSingleObject
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
MSVCRT.DLL::operator_delete
McGenEventWrite_EventWriteTransfer
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::operator=
WPP_SF_
WPP_SF_L
WPP_SF_S
WPP_SF_sS
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |calling||| |paramcount|4|4| |`address`|180004230|18000c4c0| |sig|void __cdecl WaitCallback(_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_WAIT * param_3, ulong param_4)|void __cdecl WaitCallback(_TP_CALLBACK_INSTANCE * param_1, void * param_2, _TP_WAIT * param_3, ulong param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::WaitCallback Called Diff ```diff --- CManagerThread::WaitCallback called +++ CManagerThread::WaitCallback called @@ -3,2 +3,2 @@ -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete +ATL::AtlThrowImpl +ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDeleteFixup @@ -6 +6 @@ -ATL::CStringT_>_>::CStringT_>_> +ATL::CSimpleStringT::Empty @@ -10 +9,0 @@ -CManagerThread::AddRemoveRegisteredConfig @@ -12 +10,0 @@ -CManagerThread::MapHrToProtectionState @@ -14,2 +12 @@ -CWorkerThread::CWorkerThread -CWorkerThread::Create +CWorkerThread::Stop @@ -16,0 +14,3 @@ +KERNEL32.DLL::CloseHandle +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::CloseThreadpoolWork @@ -19,0 +20 @@ +KERNEL32.DLL::LocalFree @@ -26,2 +27,3 @@ -McTemplateU0z_EventWriteTransfer -McTemplateU0zq_EventWriteTransfer +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks +MSVCRT.DLL::operator_delete +McGenEventWrite_EventWriteTransfer @@ -31 +32,0 @@ -SmartPtr::operator= @@ -33,0 +35 @@ +WPP_SF_L @@ -35,3 +36,0 @@ -WPP_SF_SS -WPP_SF_Si -WPP_SF_d @@ -38,0 +38 @@ +__security_check_cookie @@ -40 +40 @@ -operator_new +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::WaitCallback Diff ```diff --- CManagerThread::WaitCallback +++ CManagerThread::WaitCallback @@ -1,768 +1,1099 @@ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* private: static void __cdecl CManagerThread::WaitCallback(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_WAIT * __ptr64,unsigned long) */ void __cdecl CManagerThread::WaitCallback (_TP_CALLBACK_INSTANCE *param_1,void *param_2,_TP_WAIT *param_3,ulong param_4) { CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> *this; - int iVar1; - longlong lVar2; - undefined8 *puVar3; - CNode *pCVar4; - int *piVar5; - longlong *plVar6; - int iVar7; - RefCounter *pRVar8; - CNode *pCVar9; - DWORD DVar10; - long lVar11; - DWORD DVar12; - CNode *pCVar13; - longlong lVar14; - _FILETIME _Var15; - _FILETIME _Var16; - CNode *pCVar17; - CWorkerThread *this_00; - CWorkerThread *pCVar18; - CConfigDescriptor *this_01; - SmartPtr *this_02; - CManagerThread *pCVar19; - undefined2 uVar20; - CConfigDescriptor *pCVar21; - wchar_t *pwVar22; - undefined **ppuVar23; - int iVar24; - uint uVar25; - int *piVar26; + int *piVar1; + uint uVar2; + longlong *plVar3; + HLOCAL pvVar4; + longlong *plVar5; + undefined8 *puVar6; + CWorkerThread *pCVar7; + CConfigDescriptor *pCVar8; + longlong lVar9; + CSimpleStringT *this_00; + undefined8 *puVar10; + _TP_WAIT *p_Var11; + bool bVar12; + RefCounter *this_01; + uint uVar13; + int iVar14; + DWORD DVar15; + long lVar16; + longlong lVar17; + CNode *pCVar18; + _FILETIME _Var19; + _FILETIME _Var20; + undefined **ppuVar21; + CNode *pCVar22; + uint uVar23; + CNode *pCVar24; + ulonglong uVar25; + _TP_WAIT *p_Var26; ulonglong uVar27; - int *piVar28; - ulong *puVar29; + RefCounter *pRVar28; _FILETIME *pftTimeout; - char *pcVar30; - wchar_t *pwVar31; - CNode *pCVar32; - CNode *pCVar33; - ulonglong uVar34; - _FILETIME _Var35; - bool bVar36; - bool bVar37; - uint local_res10; + char *pcVar29; + int iVar30; + _FILETIME _Var31; + int iVar32; + LPCRITICAL_SECTION lpCriticalSection; + bool bVar33; + bool bVar34; + undefined1 auStackY_178 [32]; + CNode *local_120; + RefCounter *local_110; + _FILETIME local_108; + HRESULT local_100; + RefCounter *local_f8; + RefCounter *local_f0; + LPCRITICAL_SECTION local_e8; _FILETIME local_e0; - int local_d8; - wchar_t *local_d0; - uint local_c8; - int local_c4; + ulonglong local_d8; + RefCounter *local_d0; + RefCounter *local_c8; RefCounter *local_c0; RefCounter *local_b8; - _FILETIME local_b0; - ulonglong local_a8; - RefCounter *local_a0; + RefCounter *local_b0; + RefCounter *local_a8; + _FILETIME local_a0; RefCounter *local_98; - _FILETIME local_90; - RefCounter *local_88; - RefCounter *local_80; - RefCounter *local_78; - RefCounter *local_70; - _FILETIME local_68; - RefCounter *local_60; - RefCounter *local_58; - RefCounter *local_50; - CStringT_>_> - local_48 [16]; + _TP_WAIT *local_90; + _EVENT_DATA_DESCRIPTOR local_88; + wchar_t *local_78; + int local_70; + undefined4 local_6c; + _EVENT_DATA_DESCRIPTOR local_68; + wchar_t *local_58; + int local_50; + undefined4 local_4c; + ulonglong local_48; - local_c4 = 1; - ppuVar23 = (undefined **)0x0; - DVar10 = CoInitializeEx((LPVOID)0x0,0); - local_e0.dwLowDateTime = DVar10; - if ((DVar10 == 0x80010106) || (DVar10 == 1)) { + local_48 = __security_cookie ^ (ulonglong)auStackY_178; + bVar12 = true; + local_108 = (_FILETIME)param_1; + local_90 = param_3; + local_100 = CoInitializeEx((LPVOID)0x0,0); + ppuVar21 = &WPP_GLOBAL_Control; + if ((local_100 == -0x7ffefefa) || (local_100 == 1)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - ppuVar23 = (undefined **)0x9d; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9d, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar10); + ppuVar21 = (undefined **)0xb1; + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb1, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,local_100); } } - else if ((int)DVar10 < 0) { + else if (local_100 < 0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return; } if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) { return; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9e, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar10); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb2, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,local_100); return; } + lpCriticalSection = (LPCRITICAL_SECTION)((longlong)param_2 + 0x40); + this = (CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)((longlong)param_2 + 0x10); + local_e8 = lpCriticalSection; +LAB_0: do { - iVar24 = 0; - local_res10 = 0; - local_d8 = 0; - bVar37 = false; + iVar32 = 0; + iVar14 = 0; + bVar34 = false; ResetEvent(*(HANDLE *)((longlong)param_2 + 0xf8)); - local_b0.dwLowDateTime = 0; - local_b0.dwHighDateTime = 0; - GetSystemTimeAsFileTime(&local_b0); - _Var35 = local_b0; - local_68 = local_b0; - local_c8 = (**(code **)((longlong)param_2 + 0x1a8))(0); - uVar25 = (uint)(9 < local_c8); - local_d0 = (wchar_t *)CONCAT44(local_d0._4_4_,uVar25); - bVar36 = *(uint *)((longlong)param_2 + 0xdc) != uVar25; - if (bVar36) { - *(uint *)((longlong)param_2 + 0xdc) = uVar25; - } - local_a8 = (ulonglong)bVar36; - iVar1 = *(int *)((longlong)param_2 + 0xd8); - EnterCriticalSection((LPCRITICAL_SECTION)((longlong)param_2 + 0x40)); - uVar27 = local_a8; - pCVar17 = *(CNode **)((longlong)param_2 + 0x10); - if ((pCVar17 == (CNode *)0x0) || (pCVar17 == *(CNode **)((longlong)param_2 + 0x38))) { -LAB_0: + local_e0.dwLowDateTime = 0; + local_e0.dwHighDateTime = 0; + GetSystemTimeAsFileTime(&local_e0); + _Var31 = local_e0; + local_a0 = local_e0; + uVar13 = (**(code **)((longlong)param_2 + 0x1a8))(0); + uVar13 = (uint)(9 < uVar13); + bVar33 = *(uint *)((longlong)param_2 + 0xdc) != uVar13; + if (bVar33) { + *(uint *)((longlong)param_2 + 0xdc) = uVar13; + } + local_d8 = (ulonglong)bVar33; + uVar2 = *(uint *)((longlong)param_2 + 0xd8); + EnterCriticalSection(lpCriticalSection); + pCVar18 = *(CNode **)((longlong)param_2 + 0x10); + iVar30 = iVar32; + if ((pCVar18 == (CNode *)0x0) || (pCVar18 == *(CNode **)((longlong)param_2 + 0x38))) { +LAB_1: + iVar32 = iVar14; if ((*(int *)((longlong)param_2 + 8) != 0) || (*(int *)((longlong)param_2 + 0x108) != 0)) - goto LAB_1; - if (*(int *)((longlong)param_2 + 0xec) != 0) { - if ((ulonglong)_Var35 < (ulonglong)*(_FILETIME *)((longlong)param_2 + 0xf0)) - goto LAB_2; + goto LAB_2; + if (*(int *)((longlong)param_2 + 0xec) == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa0, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,0x1e); - } - SetEventWhenCallbackReturns(param_1,*(HANDLE *)((longlong)param_2 + 0x100)); - LeaveCriticalSection((LPCRITICAL_SECTION)((longlong)param_2 + 0x40)); + ppuVar21 = (undefined **)0xb6; + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb6, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + *(_TP_WAIT **)((longlong)param_2 + 0xf0) = (_TP_WAIT *)((longlong)_Var31 + 300000000); + *(undefined4 *)((longlong)param_2 + 0xec) = 1; + } + else if ((ulonglong)*(_FILETIME *)((longlong)param_2 + 0xf0) <= (ulonglong)_Var31) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb5, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,0x1e); + } + SetEventWhenCallbackReturns + ((PTP_CALLBACK_INSTANCE)local_108,*(HANDLE *)((longlong)param_2 + 0x100)); + LeaveCriticalSection(lpCriticalSection); LAB_3: - if (-1 < (int)DVar10) { + if (-1 < local_100) { CoUninitialize(); } return; } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa1, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); - } - lVar14 = (longlong)_Var35 + 300000000; - *(undefined4 *)((longlong)param_2 + 0xec) = 1; -LAB_4: - *(longlong *)((longlong)param_2 + 0xf0) = lVar14; } else { do { - pCVar13 = pCVar17; - pCVar17 = *(CNode **)(pCVar13 + 0x18); - } while (*(CNode **)(pCVar13 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); - if (pCVar13 == (CNode *)0x0) goto LAB_0; - iVar7 = (int)local_d0; + local_120 = pCVar18; + pCVar18 = *(CNode **)(local_120 + 0x18); + } while (*(CNode **)(local_120 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); + if (local_120 == (CNode *)0x0) goto LAB_1; do { SmartPtr::SmartPtr - ((SmartPtr *)&local_c0,(CConfigDescriptor *)ppuVar23); - if (local_c0 != *(RefCounter **)(pCVar13 + 8)) { + ((SmartPtr *)&local_110,(CConfigDescriptor *)ppuVar21); + if (local_110 != *(RefCounter **)(local_120 + 8)) { + if (local_110 != (RefCounter *)0x0) { + pRVar28 = local_110 + 8; + *(int *)pRVar28 = *(int *)pRVar28 + -1; + if (*(int *)pRVar28 == 0) { + plVar3 = *(longlong **)local_110; + if (plVar3 != (longlong *)0x0) { + if ((HANDLE)plVar3[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[1]); + plVar3[1] = 0; + } + uVar27 = 0; + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar33) { + if ((PTP_WAIT)plVar3[0x20] != (PTP_WAIT)0x0) { + param_3 = (_TP_WAIT *)0x0; + SetThreadpoolWait((PTP_WAIT)plVar3[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar3[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar3[0x20]); + plVar3[0x20] = 0; + } + if ((HANDLE)plVar3[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x12]); + plVar3[0x12] = 0; + } + if ((HANDLE)plVar3[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x21]); + plVar3[0x21] = 0; + } + if (plVar3[0x23] != 0) { + if ((int)plVar3[0x22] != 0) { + do { + pvVar4 = *(HLOCAL *)(plVar3[0x23] + uVar27 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar23 = (int)uVar27 + 1; + uVar27 = (ulonglong)uVar23; + } while (uVar23 < *(uint *)(plVar3 + 0x22)); + } + LocalFree((HLOCAL)plVar3[0x23]); + plVar3[0x23] = 0; + *(undefined4 *)(plVar3 + 0x22) = 0; + } + } + lVar17 = *plVar3; + plVar5 = *(longlong **)(lVar17 + -0x18); + if (*(int *)(lVar17 + -0x10) != 0) { + if (*(int *)(lVar17 + -8) < 0) { + if (*(int *)(lVar17 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar17 + -0x10) = 0; + *(undefined2 *)*plVar3 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar14 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar14 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + lVar17 = (**(code **)(*plVar5 + 0x18))(plVar5); + *plVar3 = lVar17 + 0x18; + } + } + puVar6 = (undefined8 *)plVar3[0x11]; + if (puVar6 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar6 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar7 = (CWorkerThread *)*puVar6; + if (pCVar7 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar7,1); + if (*(PTP_WORK *)(pCVar7 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar7 + 0x28)); + *(undefined8 *)(pCVar7 + 0x28) = 0; + *(undefined4 *)(pCVar7 + 0x30) = 1; + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar7 + 0x10) = 0; + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + iVar14 = (**(code **)(**(longlong **)(pCVar7 + 8) + 0x28))(); + if (((iVar14 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + param_3 = (_TP_WAIT *)&WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar14); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + *(undefined8 *)(pCVar7 + 8) = 0; + } + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + *(undefined8 *)pCVar7 = 0; + } + lVar17 = *(longlong *)(pCVar7 + 0x18); + plVar5 = *(longlong **)(lVar17 + -0x18); + if (*(int *)(lVar17 + -0x10) != 0) { + if (*(int *)(lVar17 + -8) < 0) { + if (*(int *)(lVar17 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar17 + -0x10) = 0; + **(undefined2 **)(pCVar7 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar14 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar14 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + lVar17 = (**(code **)(*plVar5 + 0x18))(plVar5); + *(longlong *)(pCVar7 + 0x18) = lVar17 + 0x18; + } + } + if (*(HANDLE *)(pCVar7 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar7 + 0x20)); + *(undefined8 *)(pCVar7 + 0x20) = 0; + } + lVar17 = *(longlong *)(pCVar7 + 0x18); + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar14 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar14 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + } + operator_delete(pCVar7); + } + operator_delete(puVar6); + } + } + lVar17 = *plVar3; + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar14 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar14 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + operator_delete(plVar3); + } + operator_delete(local_110); + } + } + local_110 = *(RefCounter **)(local_120 + 8); + if (local_110 != (RefCounter *)0x0) { + *(int *)(local_110 + 8) = *(int *)(local_110 + 8) + 1; + } + } + pRVar28 = local_110; + wil::details::FeatureImpl::__private_IsEnabled + (&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((bVar33) && (*(HANDLE *)(*(longlong *)pRVar28 + 0x90) != (HANDLE)0x0)) { + DVar15 = WaitForSingleObject(*(HANDLE *)(*(longlong *)pRVar28 + 0x90),0); + if (DVar15 == 0) { + if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { + local_78 = (wchar_t *)**(longlong **)pRVar28; + if (local_78 == (wchar_t *)0x0) { + local_70 = 10; + local_78 = L"NULL"; + } + else { + lVar17 = -1; + do { + lVar17 = lVar17 + 1; + } while (local_78[lVar17] != L'\0'); + local_70 = (int)lVar17 * 2 + 2; + } + local_6c = 0; + McGenEventWrite_EventWriteTransfer + ((REGHANDLE *)&FH_SERVICE_PROVIDER_GUID_Context, + (PCEVENT_DESCRIPTOR)&BackupCycleStop,param_3,2,&local_88); + } + *(uint *)(*(longlong *)pRVar28 + 0x120) = *(uint *)(*(longlong *)pRVar28 + 0x120) & 0xff + ; + lVar17 = *(longlong *)pRVar28; + if (*(int *)(lVar17 + 0xe8) == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb3, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + *(undefined4 *)(lVar17 + 0x120)); + } + } + else { + *(undefined4 *)(lVar17 + 0x120) = *(undefined4 *)(lVar17 + 0xec); + *(undefined8 *)(*(longlong *)pRVar28 + 0x124) = + *(undefined8 *)(*(longlong *)pRVar28 + 0xf0); + *(undefined4 *)(*(longlong *)pRVar28 + 0x18) = + *(undefined4 *)(*(longlong *)pRVar28 + 0xf8); + } + *(undefined8 *)(*(longlong *)pRVar28 + 0xe0) = 0; + *(undefined4 *)(*(longlong *)pRVar28 + 0xe8) = 0; + *(undefined4 *)(*(longlong *)pRVar28 + 0xf8) = 0; + *(undefined4 *)(*(longlong *)pRVar28 + 0xdc) = 0; + lVar17 = *(longlong *)pRVar28; + *(undefined8 *)(lVar17 + 0x98) = 0; + *(undefined8 *)(lVar17 + 0xa0) = 0; + *(undefined8 *)(lVar17 + 0xa8) = 0; + *(undefined8 *)(lVar17 + 0xb0) = 0; + *(undefined8 *)(lVar17 + 0xb8) = 0; + *(undefined8 *)(lVar17 + 0xc0) = 0; + *(undefined8 *)(lVar17 + 200) = 0; + *(undefined8 *)(lVar17 + 0xd0) = 0; + *(undefined4 *)(lVar17 + 0xd8) = 0; + pCVar8 = *(CConfigDescriptor **)pRVar28; + lVar16 = CConfigDescriptor::ReloadPolicies(pCVar8); + if ((uint)(lVar16 + 0x7ffbf9ff) < 2) { + *(undefined4 *)(pCVar8 + 0x120) = 1; + } + else if (lVar16 == -0x7ffbf9fd) { + *(undefined4 *)(pCVar8 + 0x120) = 2; + } + else if (lVar16 == -0x7ffbf9fc) { + *(undefined4 *)(pCVar8 + 0x120) = 3; + } + *(int *)(pRVar28 + 8) = *(int *)(pRVar28 + 8) + 1; + local_b8 = pRVar28; + PublishProtectionState((CManagerThread *)(lVar16 + 0x7ffbf9ff),&local_b8); + CConfigDescriptor::CachePropertiesInRegistry(*(CConfigDescriptor **)pRVar28); + if (*(PTP_WAIT *)(*(longlong *)pRVar28 + 0x100) != (PTP_WAIT)0x0) { + param_3 = (_TP_WAIT *)0x0; + SetThreadpoolWait(*(PTP_WAIT *)(*(longlong *)pRVar28 + 0x100),(HANDLE)0x0, + (PFILETIME)0x0); + CloseThreadpoolWait(*(PTP_WAIT *)(*(longlong *)pRVar28 + 0x100)); + *(undefined8 *)(*(longlong *)pRVar28 + 0x100) = 0; + } + CloseHandle(*(HANDLE *)(*(longlong *)pRVar28 + 0x90)); + *(undefined8 *)(*(longlong *)pRVar28 + 0x90) = 0; + if (*(HANDLE *)(*(longlong *)pRVar28 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(*(longlong *)pRVar28 + 0x108)); + *(undefined8 *)(*(longlong *)pRVar28 + 0x108) = 0; + } + *(_FILETIME *)(*(longlong *)pRVar28 + 0x20) = _Var31; + if ((*(int *)(*(longlong *)pRVar28 + 0x58) == 2) && + (*(int *)(*(longlong *)pRVar28 + 0x14) == 0)) { + piVar1 = (int *)((longlong)param_2 + 0x6c); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + SetEvent(*(HANDLE *)((longlong)param_2 + 0x70)); + } + } + *(undefined4 *)(*(longlong *)pRVar28 + 0x58) = 0; + } + else { +LAB_4: + iVar32 = iVar32 + 1; + } + } + else { + plVar3 = (longlong *)(*(longlong **)pRVar28)[0x11]; + if ((plVar3 != (longlong *)0x0) && (lVar17 = *plVar3, lVar17 != 0)) { + if (*(int *)(lVar17 + 0x30) == 0) { + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((!bVar33) && (local_d8 != 0)) { + param_3 = (_TP_WAIT *)(ulonglong)uVar2; + CConfigDescriptor::RefreshPoliciesInEngine + (*(CConfigDescriptor **)pRVar28,uVar13,uVar2); + } + goto LAB_4; + } + if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { + local_58 = (wchar_t *)**(longlong **)pRVar28; + if (local_58 == (wchar_t *)0x0) { + local_50 = 10; + local_58 = L"NULL"; + } + else { + lVar17 = -1; + do { + lVar17 = lVar17 + 1; + } while (local_58[lVar17] != L'\0'); + local_50 = (int)lVar17 * 2 + 2; + } + local_4c = 0; + McGenEventWrite_EventWriteTransfer + ((REGHANDLE *)&FH_SERVICE_PROVIDER_GUID_Context, + (PCEVENT_DESCRIPTOR)&BackupCycleStop,param_3,2,&local_68); + } + *(uint *)(*(longlong *)pRVar28 + 0x120) = *(uint *)(*(longlong *)pRVar28 + 0x120) & 0xff + ; + lVar17 = **(longlong **)(*(longlong *)pRVar28 + 0x88); + if (*(int *)(lVar17 + 0x4c) != 0) { + *(undefined4 *)(*(longlong *)pRVar28 + 0x120) = *(undefined4 *)(lVar17 + 0x50); + } + lVar17 = *(longlong *)pRVar28; + lVar9 = **(longlong **)(lVar17 + 0x88); + if (*(int *)(lVar9 + 0x4c) != 0) { + uVar23 = *(uint *)(lVar9 + 0x58); + param_3 = (_TP_WAIT *)(ulonglong)uVar23; + if (((*(uint *)(lVar17 + 0x128) < uVar23) || + ((uVar23 == *(uint *)(lVar17 + 0x128) && + (*(uint *)(lVar17 + 0x124) < *(uint *)(lVar9 + 0x54))))) || + ((uVar23 == 0 && (*(int *)(lVar9 + 0x54) == 0)))) { + *(undefined8 *)(lVar17 + 0x124) = *(undefined8 *)(lVar9 + 0x54); + } + } + pCVar8 = *(CConfigDescriptor **)pRVar28; + lVar16 = CConfigDescriptor::ReloadPolicies(pCVar8); + if ((uint)(lVar16 + 0x7ffbf9ff) < 2) { + *(undefined4 *)(pCVar8 + 0x120) = 1; + } + else if (lVar16 == -0x7ffbf9fd) { + *(undefined4 *)(pCVar8 + 0x120) = 2; + } + else if (lVar16 == -0x7ffbf9fc) { + *(undefined4 *)(pCVar8 + 0x120) = 3; + } + *(int *)(pRVar28 + 8) = *(int *)(pRVar28 + 8) + 1; + local_b0 = pRVar28; + PublishProtectionState((CManagerThread *)(lVar16 + 0x7ffbf9ff),&local_b0); + CConfigDescriptor::CachePropertiesInRegistry(*(CConfigDescriptor **)pRVar28); + *(undefined4 *)(*(longlong *)pRVar28 + 0x18) = + *(undefined4 *)(**(longlong **)(*(longlong *)pRVar28 + 0x88) + 0x5c); + SmartPtr::operator= + ((SmartPtr *)(*(longlong *)pRVar28 + 0x88), + (CWorkerThread *)0x0); + *(_FILETIME *)(*(longlong *)pRVar28 + 0x20) = _Var31; + if ((*(int *)(*(longlong *)pRVar28 + 0x58) == 2) && + (*(int *)(*(longlong *)pRVar28 + 0x14) == 0)) { + piVar1 = (int *)((longlong)param_2 + 0x6c); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + SetEvent(*(HANDLE *)((longlong)param_2 + 0x70)); + } + } + *(undefined4 *)(*(longlong *)pRVar28 + 0x58) = 0; + } + } + iVar30 = iVar30 + 1; + if ((((*(longlong **)(*(longlong *)pRVar28 + 0x88) != (longlong *)0x0) && + (**(longlong **)(*(longlong *)pRVar28 + 0x88) != 0)) || + ((bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl), bVar33 && + (*(longlong *)(*(longlong *)pRVar28 + 0x90) != 0)))) || + ((puVar6 = *(undefined8 **)pRVar28, *(int *)(puVar6 + 5) == 0 || + (*(int *)((longlong)puVar6 + 0x2c) != 0)))) { + pCVar18 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Successor(this,local_120); + SmartPtr::RefCounter::Dec_nRefs(pRVar28); + ppuVar21 = (undefined **)local_120; + local_120 = pCVar18; + } + else { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb4, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)*puVar6); + } + if (8 < *(uint *)(*(longlong *)pRVar28 + 0x120)) { + *(undefined4 *)(*(longlong *)pRVar28 + 0x120) = 1; + } + *(int *)(pRVar28 + 8) = *(int *)(pRVar28 + 8) + 1; + local_f8 = pRVar28; + PublishProtectionState(); + pCVar18 = *(CNode **)((longlong)param_2 + 0x38); + pCVar24 = local_120; + if (((*(CNode **)(local_120 + 0x18) != pCVar18) && + (pCVar22 = *(CNode **)(local_120 + 0x20), pCVar22 != pCVar18)) && + (pCVar24 = (CNode *)0x0, pCVar22 != (CNode *)0x0)) { + do { + pCVar24 = pCVar22; + pCVar22 = *(CNode **)(pCVar24 + 0x18); + } while (pCVar22 != pCVar18); + } + pCVar22 = *(CNode **)(pCVar24 + 0x18); + if (pCVar22 == pCVar18) { + pCVar22 = *(CNode **)(pCVar24 + 0x20); + } + *(undefined8 *)(pCVar22 + 0x28) = *(undefined8 *)(pCVar24 + 0x28); + lVar17 = *(longlong *)(pCVar24 + 0x28); + if (lVar17 == *(longlong *)((longlong)param_2 + 0x38)) { + *(CNode **)this = pCVar22; + } + else if (pCVar24 == *(CNode **)(lVar17 + 0x18)) { + *(CNode **)(lVar17 + 0x18) = pCVar22; + } + else { + *(CNode **)(lVar17 + 0x20) = pCVar22; + } + if (*(int *)(pCVar24 + 0x10) == 1) { + ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::RBDeleteFixup(this,pCVar22); + } + if (pCVar24 != local_120) { + *(undefined8 *)(pCVar24 + 0x28) = *(undefined8 *)(local_120 + 0x28); + lVar17 = *(longlong *)(local_120 + 0x28); + if (*(CNode **)(lVar17 + 0x18) == local_120) { + *(CNode **)(lVar17 + 0x18) = pCVar24; + } + else { + *(CNode **)(lVar17 + 0x20) = pCVar24; + } + lVar17 = *(longlong *)(local_120 + 0x20); + *(longlong *)(pCVar24 + 0x20) = lVar17; + *(undefined8 *)(pCVar24 + 0x18) = *(undefined8 *)(local_120 + 0x18); + *(undefined4 *)(pCVar24 + 0x10) = *(undefined4 *)(local_120 + 0x10); + *(CNode **)(lVar17 + 0x28) = pCVar24; + *(CNode **)(*(longlong *)(pCVar24 + 0x18) + 0x28) = pCVar24; + if (*(CNode **)this == local_120) { + *(CNode **)this = pCVar24; + } + } + if (*(longlong *)this != 0) { + puVar6 = (undefined8 *)(*(longlong *)this + 0x28); + if (puVar6 == (undefined8 *)0x0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7fffbffb); + } + *puVar6 = *(undefined8 *)((longlong)param_2 + 0x38); + } + puVar6 = *(undefined8 **)(local_120 + 8); + if (puVar6 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar6 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + this_00 = (CSimpleStringT *)*puVar6; + if (this_00 != (CSimpleStringT *)0x0) { + if (*(HANDLE *)(this_00 + 8) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 8)); + *(undefined8 *)(this_00 + 8) = 0; + } + uVar27 = 0; + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar33) { + if (*(PTP_WAIT *)(this_00 + 0x100) != (PTP_WAIT)0x0) { + param_3 = (_TP_WAIT *)0x0; + SetThreadpoolWait(*(PTP_WAIT *)(this_00 + 0x100),(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks(*(PTP_WAIT *)(this_00 + 0x100),1); + CloseThreadpoolWait(*(PTP_WAIT *)(this_00 + 0x100)); + *(undefined8 *)(this_00 + 0x100) = 0; + } + if (*(HANDLE *)(this_00 + 0x90) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 0x90)); + *(undefined8 *)(this_00 + 0x90) = 0; + } + if (*(HANDLE *)(this_00 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 0x108)); + *(undefined8 *)(this_00 + 0x108) = 0; + } + if (*(longlong *)(this_00 + 0x118) != 0) { + if (*(int *)(this_00 + 0x110) != 0) { + do { + pvVar4 = *(HLOCAL *)(*(longlong *)(this_00 + 0x118) + uVar27 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar23 = (int)uVar27 + 1; + uVar27 = (ulonglong)uVar23; + } while (uVar23 < *(uint *)(this_00 + 0x110)); + } + LocalFree(*(HLOCAL *)(this_00 + 0x118)); + *(undefined8 *)(this_00 + 0x118) = 0; + *(undefined4 *)(this_00 + 0x110) = 0; + } + } + ATL::CSimpleStringT::Empty(this_00); + puVar10 = *(undefined8 **)(this_00 + 0x88); + if (puVar10 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar10 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar7 = (CWorkerThread *)*puVar10; + if (pCVar7 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar7,1); + if (*(PTP_WORK *)(pCVar7 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar7 + 0x28)); + *(undefined8 *)(pCVar7 + 0x28) = 0; + *(undefined4 *)(pCVar7 + 0x30) = 1; + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar7 + 0x10) = 0; + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + iVar32 = (**(code **)(**(longlong **)(pCVar7 + 8) + 0x28))(); + if (((iVar32 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + param_3 = (_TP_WAIT *)&WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar32); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + *(undefined8 *)(pCVar7 + 8) = 0; + } + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + *(undefined8 *)pCVar7 = 0; + } + ATL::CSimpleStringT::Empty + ((CSimpleStringT *)(pCVar7 + 0x18)); + if (*(HANDLE *)(pCVar7 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar7 + 0x20)); + *(undefined8 *)(pCVar7 + 0x20) = 0; + } + lVar17 = *(longlong *)(pCVar7 + 0x18); + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar32 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar32 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + } + operator_delete(pCVar7); + } + operator_delete(puVar10); + } + } + lVar17 = *(longlong *)this_00; + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar32 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar32 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + operator_delete(this_00); + } + operator_delete(puVar6); + } + } + lVar17 = *(longlong *)local_120; + LOCK(); + piVar1 = (int *)(lVar17 + -8); + iVar32 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar32 < 2) { + (**(code **)(**(longlong **)(lVar17 + -0x18) + 8))(); + } + *(undefined8 *)(local_120 + 0x18) = *(undefined8 *)((longlong)param_2 + 0x20); + *(CNode **)((longlong)param_2 + 0x20) = local_120; + *(longlong *)((longlong)param_2 + 0x18) = *(longlong *)((longlong)param_2 + 0x18) + -1; + ppuVar21 = (undefined **)0x0; + SmartPtr::operator= + ((SmartPtr *)&local_110,(CConfigDescriptor *)0x0); + pCVar18 = *(CNode **)this; + if ((pCVar18 == (CNode *)0x0) || (pCVar18 == *(CNode **)((longlong)param_2 + 0x38))) { + local_120 = (CNode *)0x0; + } + else { + do { + local_120 = pCVar18; + pCVar18 = *(CNode **)(local_120 + 0x18); + } while (*(CNode **)(local_120 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); + } + iVar32 = 0; + iVar30 = 0; + if (local_110 != (RefCounter *)0x0) { + SmartPtr::RefCounter::Dec_nRefs(local_110); + } + } + } while (local_120 != (CNode *)0x0); + iVar14 = iVar32; + if (iVar30 == 0) goto LAB_1; +LAB_2: + if (*(int *)((longlong)param_2 + 0xec) != 0) { + if ((iVar30 == 0) && (*(int *)((longlong)param_2 + 8) == 0)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + ppuVar21 = (undefined **)0xb8; +LAB_5: + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),(short)ppuVar21, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + ppuVar21 = (undefined **)0xb7; + goto LAB_5; + } + *(undefined4 *)((longlong)param_2 + 0xec) = 0; + *(undefined8 *)((longlong)param_2 + 0xf0) = 0; + } + } + if (*(int *)((longlong)param_2 + 0xe8) == 0) { + pCVar18 = *(CNode **)((longlong)param_2 + 0x10); + if ((pCVar18 != (CNode *)0x0) && (pCVar18 != *(CNode **)((longlong)param_2 + 0x38))) { + do { + pCVar24 = pCVar18; + pCVar18 = *(CNode **)(pCVar24 + 0x18); + } while (*(CNode **)(pCVar24 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); + while (pCVar24 != (CNode *)0x0) { + SmartPtr::SmartPtr + ((SmartPtr *)&local_d0,(CConfigDescriptor *)ppuVar21); + ppuVar21 = (undefined **)pCVar24; + pCVar18 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)((longlong)param_2 + 0x10),pCVar24); + if (local_d0 != *(RefCounter **)(pCVar24 + 8)) { + if (local_d0 != (RefCounter *)0x0) { + SmartPtr::RefCounter::Dec_nRefs(local_d0); + } + local_d0 = *(RefCounter **)(pCVar24 + 8); + if (local_d0 != (RefCounter *)0x0) { + *(int *)(local_d0 + 8) = *(int *)(local_d0 + 8) + 1; + } + } + pRVar28 = local_d0; + if ((((*(longlong **)(*(longlong *)local_d0 + 0x88) == (longlong *)0x0) || + (**(longlong **)(*(longlong *)local_d0 + 0x88) == 0)) && + ((bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl), !bVar33 || + (*(longlong *)(*(longlong *)pRVar28 + 0x90) == 0)))) && + (((bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl), !bVar33 || + (*(int *)(*(longlong *)pRVar28 + 0x2c) == 0)) && + (*(int *)(*(undefined8 **)pRVar28 + 3) != 0)))) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb9, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)pRVar28); + } + *(undefined4 *)(*(longlong *)pRVar28 + 0x18) = 0; + *(int *)(pRVar28 + 8) = *(int *)(pRVar28 + 8) + 1; + param_3 = (_TP_WAIT *)0x3; + ppuVar21 = &local_a8; + local_a8 = pRVar28; + lVar16 = CreateWorkerThread(param_2); + if (-1 < lVar16) { + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (!bVar33) { + param_3 = (_TP_WAIT *)(ulonglong)uVar2; + ppuVar21 = (undefined **)(ulonglong)uVar13; + CConfigDescriptor::RefreshPoliciesInEngine + (*(CConfigDescriptor **)pRVar28,uVar13,uVar2); + SubmitThreadpoolWork + (*(PTP_WORK *)(**(longlong **)(*(longlong *)pRVar28 + 0x88) + 0x28)); + } + iVar32 = iVar32 + 1; + } + if (*(int *)(*(longlong *)pRVar28 + 0x28) != 0) { + bVar34 = true; + } + } + SmartPtr::RefCounter::Dec_nRefs(pRVar28); + pCVar24 = pCVar18; + lpCriticalSection = local_e8; + _Var31 = local_a0; + } + } + if ((*(int *)((longlong)param_2 + 0xe8) == 0) && (iVar32 == 0)) { + if ((*(byte *)((longlong)param_2 + 0x198) & 1) == 0) { + _Var19 = *(_FILETIME *)((longlong)param_2 + 0xd0); + do { + LOCK(); + _Var20 = *(_FILETIME *)((longlong)param_2 + 0xd0); + bVar33 = _Var19 == _Var20; + if (bVar33) { + *(_FILETIME *)((longlong)param_2 + 0xd0) = _Var19; + _Var20 = _Var19; + } + UNLOCK(); + _Var19 = _Var20; + } while (!bVar33); + if ((ulonglong)_Var31 < (ulonglong)_Var20) goto LAB_6; + } + SmartPtr::SmartPtr + ((SmartPtr *)&local_f0,(CConfigDescriptor *)ppuVar21); + p_Var26 = (_TP_WAIT *)0xffffffffffffffff; + pCVar18 = *(CNode **)this; + pRVar28 = local_f0; + if ((pCVar18 != (CNode *)0x0) && (pCVar18 != *(CNode **)((longlong)param_2 + 0x38))) { + do { + pCVar24 = pCVar18; + pCVar18 = *(CNode **)(pCVar24 + 0x18); + } while (*(CNode **)(pCVar24 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); + while (pCVar24 != (CNode *)0x0) { + SmartPtr::SmartPtr + ((SmartPtr *)&local_c8,(CConfigDescriptor *)ppuVar21) + ; + pCVar18 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Successor(this,pCVar24); + if (local_c8 != *(RefCounter **)(pCVar24 + 8)) { + if (local_c8 != (RefCounter *)0x0) { + SmartPtr::RefCounter::Dec_nRefs(local_c8); + } + local_c8 = *(RefCounter **)(pCVar24 + 8); + if (local_c8 != (RefCounter *)0x0) { + *(int *)(local_c8 + 8) = *(int *)(local_c8 + 8) + 1; + } + } + this_01 = local_c8; + ppuVar21 = *(undefined ***)local_c8; + if ((((*(int *)((longlong)ppuVar21 + 0x2c) == 0) && + (p_Var11 = *(_TP_WAIT **)((longlong)ppuVar21 + 0x20), param_3 = p_Var11, + p_Var11 < p_Var26)) && + (((*(int *)((longlong)ppuVar21 + 0x10) != 0 && + ((ulonglong)(*(longlong *)((longlong)ppuVar21 + 0x30) + (longlong)p_Var11) < + (ulonglong)_Var31)) || (*(int *)((longlong)ppuVar21 + 0x14) != 0)))) && + (p_Var26 = p_Var11, pRVar28 != local_c8)) { + if (pRVar28 != (RefCounter *)0x0) { + SmartPtr::RefCounter::Dec_nRefs(pRVar28); + } + *(int *)(this_01 + 8) = *(int *)(this_01 + 8) + 1; + pRVar28 = this_01; + } + SmartPtr::RefCounter::Dec_nRefs(this_01); + pCVar24 = pCVar18; + lpCriticalSection = local_e8; + } + } + local_f0 = pRVar28; + pRVar28 = local_f0; + if (local_f0 != (RefCounter *)0x0) { + puVar6 = *(undefined8 **)local_f0; + if (puVar6 != (undefined8 *)0x0) { + iVar14 = *(int *)((longlong)puVar6 + 0x14); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + pcVar29 = "maintenance"; + if (iVar14 == 0) { + pcVar29 = "periodic"; + } + WPP_SF_sS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),"periodic",param_3,pcVar29, + (wchar_t *)*puVar6); + } + *(int *)(pRVar28 + 8) = *(int *)(pRVar28 + 8) + 1; + param_3 = (_TP_WAIT *)(ulonglong)((iVar14 != 0) + 1); + ppuVar21 = &local_98; + local_98 = pRVar28; + lVar16 = CreateWorkerThread(param_2); + *(undefined4 *)(*(longlong *)pRVar28 + 0x14) = 0; + if (lVar16 < 0) { + if (iVar14 != 0) { + piVar1 = (int *)((longlong)param_2 + 0x6c); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + SetEvent(*(HANDLE *)((longlong)param_2 + 0x70)); + } + } + *(undefined4 *)(*(longlong *)pRVar28 + 0x58) = 0; + } + else { + bVar33 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (!bVar33) { + param_3 = (_TP_WAIT *)(ulonglong)uVar2; + ppuVar21 = (undefined **)(ulonglong)uVar13; + CConfigDescriptor::RefreshPoliciesInEngine + (*(CConfigDescriptor **)pRVar28,uVar13,uVar2); + SubmitThreadpoolWork + (*(PTP_WORK *)(**(longlong **)(*(longlong *)pRVar28 + 0x88) + 0x28)); + } + iVar32 = 1; + } + if (*(int *)(*(longlong *)pRVar28 + 0x28) != 0) { + bVar34 = true; + } + } + SmartPtr::RefCounter::Dec_nRefs(pRVar28); + } + } + } +LAB_6: + if (bVar34) { + LeaveCriticalSection(lpCriticalSection); + goto LAB_0; + } + uVar27 = 0x7fffffffffffffff; + pCVar18 = *(CNode **)this; + if ((pCVar18 != (CNode *)0x0) && (pCVar18 != *(CNode **)((longlong)param_2 + 0x38))) { + do { + pCVar24 = pCVar18; + pCVar18 = *(CNode **)(pCVar24 + 0x18); + } while (*(CNode **)(pCVar24 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); + while (pCVar24 != (CNode *)0x0) { + SmartPtr::SmartPtr + ((SmartPtr *)&local_c0,(CConfigDescriptor *)ppuVar21); + uVar25 = 0xffffffffffffffff; + pCVar18 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Successor(this,pCVar24); + if (local_c0 != *(RefCounter **)(pCVar24 + 8)) { if (local_c0 != (RefCounter *)0x0) { SmartPtr::RefCounter::Dec_nRefs(local_c0); } - local_c0 = *(RefCounter **)(pCVar13 + 8); + local_c0 = *(RefCounter **)(pCVar24 + 8); if (local_c0 != (RefCounter *)0x0) { *(int *)(local_c0 + 8) = *(int *)(local_c0 + 8) + 1; } } - pRVar8 = local_c0; - pCVar21 = *(CConfigDescriptor **)local_c0; - if ((*(longlong **)(pCVar21 + 0x88) != (longlong *)0x0) && - (lVar14 = **(longlong **)(pCVar21 + 0x88), lVar14 != 0)) { - if (*(int *)(lVar14 + 0x30) == 0) { - if (uVar27 != 0) { - CConfigDescriptor::RefreshPoliciesInEngine(pCVar21,iVar7,iVar1); - } - local_res10 = local_res10 + 1; - } - else { - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0z_EventWriteTransfer - (pCVar21,(PCEVENT_DESCRIPTOR)&BackupCycleStop,*(wchar_t **)pCVar21); - } - *(uint *)(*(longlong *)pRVar8 + 0x90) = *(uint *)(*(longlong *)pRVar8 + 0x90) & 0xff; - lVar14 = **(longlong **)(*(longlong *)pRVar8 + 0x88); - if (*(int *)(lVar14 + 0x4c) != 0) { - *(undefined4 *)(*(longlong *)pRVar8 + 0x90) = *(undefined4 *)(lVar14 + 0x50); - } - lVar14 = *(longlong *)pRVar8; - lVar2 = **(longlong **)(lVar14 + 0x88); - if (*(int *)(lVar2 + 0x4c) != 0) { - uVar25 = *(uint *)(lVar2 + 0x58); - if (((*(uint *)(lVar14 + 0x98) < uVar25) || - ((uVar25 == *(uint *)(lVar14 + 0x98) && - (*(uint *)(lVar14 + 0x94) < *(uint *)(lVar2 + 0x54))))) || - ((uVar25 == 0 && (*(int *)(lVar2 + 0x54) == 0)))) { - *(undefined8 *)(lVar14 + 0x94) = *(undefined8 *)(lVar2 + 0x54); - } - } - this_01 = *(CConfigDescriptor **)pRVar8; - pCVar21 = this_01 + 0x90; - lVar11 = CConfigDescriptor::ReloadPolicies(this_01); - MapHrToProtectionState((CManagerThread *)this_01,lVar11,(ulong *)pCVar21); - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - local_80 = pRVar8; - PublishProtectionState(); - CConfigDescriptor::CachePropertiesInRegistry(*(CConfigDescriptor **)pRVar8); - *(undefined4 *)(*(longlong *)pRVar8 + 0x18) = - *(undefined4 *)(**(longlong **)(*(longlong *)pRVar8 + 0x88) + 0x5c); - SmartPtr::operator= - ((SmartPtr *)(*(longlong *)pRVar8 + 0x88), - (CWorkerThread *)0x0); - *(_FILETIME *)(*(longlong *)pRVar8 + 0x20) = _Var35; - if ((*(int *)(*(longlong *)pRVar8 + 0x58) == 2) && - (*(int *)(*(longlong *)pRVar8 + 0x14) == 0)) { - piVar28 = (int *)((longlong)param_2 + 0x6c); - *piVar28 = *piVar28 + -1; - if (*piVar28 == 0) { - SetEvent(*(HANDLE *)((longlong)param_2 + 0x70)); - } - } - *(undefined4 *)(*(longlong *)pRVar8 + 0x58) = 0; - iVar24 = local_d8; - } - } - iVar24 = iVar24 + 1; - puVar3 = *(undefined8 **)pRVar8; - local_d8 = iVar24; - if (((((longlong *)puVar3[0x11] == (longlong *)0x0) || (*(longlong *)puVar3[0x11] == 0)) && - (*(int *)(puVar3 + 5) != 0)) && (*(int *)((longlong)puVar3 + 0x2c) == 0)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9f, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar3); - } - if (8 < *(uint *)(*(longlong *)pRVar8 + 0x90)) { - *(undefined4 *)(*(longlong *)pRVar8 + 0x90) = 1; - } - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - local_78 = pRVar8; - PublishProtectionState(); - this = (CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10); - ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::RBDelete(this,pCVar13); - SmartPtr::operator= - ((SmartPtr *)&local_c0,(CConfigDescriptor *)0x0); - ppuVar23 = *(undefined ***)this; - pCVar13 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum(this,(CNode *)ppuVar23); - local_res10 = 0; - iVar24 = 0; - local_d8 = 0; - if (local_c0 != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(local_c0); + lVar17 = *(longlong *)local_c0; + ppuVar21 = *(undefined ***)(lVar17 + 0x88); + if (((CConfigDescriptor *)ppuVar21 == (CConfigDescriptor *)0x0) || + (*ppuVar21 == (undefined *)0x0)) { + if (*(int *)(lVar17 + 0x10) != 0) { + uVar25 = (*(longlong *)(lVar17 + 0x30) + *(longlong *)(lVar17 + 0x20)) - + (longlong)_Var31; } } else { - ppuVar23 = *(undefined ***)(pCVar13 + 0x20); - pCVar17 = *(CNode **)((longlong)param_2 + 0x38); - if ((CNode *)ppuVar23 == pCVar17) { - pCVar4 = *(CNode **)(pCVar13 + 0x28); - while ((pCVar33 = pCVar4, pCVar33 != pCVar17 && (pCVar13 == *(CNode **)(pCVar33 + 0x20)) - )) { - pCVar13 = pCVar33; - pCVar4 = *(CNode **)(pCVar33 + 0x28); - } - pCVar13 = pCVar33; - if (pCVar33 == pCVar17) { - pCVar13 = (CNode *)0x0; - } - } - else { - pCVar13 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10),(CNode *)ppuVar23); - } - SmartPtr::RefCounter::Dec_nRefs(pRVar8); - } - } while (pCVar13 != (CNode *)0x0); - DVar10 = local_e0.dwLowDateTime; - if (iVar24 == 0) goto LAB_0; -LAB_1: - if (*(int *)((longlong)param_2 + 0xec) != 0) { - if ((iVar24 == 0) && (*(int *)((longlong)param_2 + 8) == 0)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar20 = 0xa3; -LAB_5: - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar20, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); - } - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar20 = 0xa2; - goto LAB_5; - } - lVar14 = 0; - *(undefined4 *)((longlong)param_2 + 0xec) = 0; - goto LAB_4; + uVar25 = 20000000; + if (*(int *)(lVar17 + 0x58) != 1) { + uVar25 = 0xffffffffffffffff; + } + } + if (uVar25 < uVar27) { + uVar27 = uVar25; + } + SmartPtr::RefCounter::Dec_nRefs(local_c0); + pCVar24 = pCVar18; + lpCriticalSection = local_e8; } } -LAB_2: - piVar28 = (int *)((longlong)param_2 + 0xe8); - if (*piVar28 == 0) { - pCVar17 = *(CNode **)((longlong)param_2 + 0x10); - pCVar13 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10),pCVar17); - pwVar22 = local_d0; - if (pCVar13 != (CNode *)0x0) { - iVar24 = (int)local_d0; - bVar37 = false; - do { - SmartPtr::SmartPtr - ((SmartPtr *)&local_a0,(CConfigDescriptor *)pCVar17); - pCVar17 = *(CNode **)(pCVar13 + 0x20); - pCVar4 = *(CNode **)((longlong)param_2 + 0x38); - if (pCVar17 == pCVar4) { - pCVar9 = *(CNode **)(pCVar13 + 0x28); - pCVar32 = pCVar13; - while ((pCVar33 = pCVar9, pCVar33 != pCVar4 && (pCVar32 == *(CNode **)(pCVar33 + 0x20))) - ) { - pCVar32 = pCVar33; - pCVar9 = *(CNode **)(pCVar33 + 0x28); - } - if (pCVar33 == pCVar4) { - pCVar33 = (CNode *)0x0; - } - } - else { - pCVar33 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10),pCVar17); - } - if (local_a0 != *(RefCounter **)(pCVar13 + 8)) { - if (local_a0 != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(local_a0); - } - local_a0 = *(RefCounter **)(pCVar13 + 8); - if (local_a0 != (RefCounter *)0x0) { - *(int *)(local_a0 + 8) = *(int *)(local_a0 + 8) + 1; - } - } - pRVar8 = local_a0; - puVar3 = *(undefined8 **)local_a0; - if ((((longlong *)puVar3[0x11] == (longlong *)0x0) || (*(longlong *)puVar3[0x11] == 0)) && - (*(int *)(puVar3 + 3) != 0)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa4, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar3); - } - *(undefined4 *)(*(longlong *)pRVar8 + 0x18) = 0; - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - pCVar17 = (CNode *)&local_70; - local_70 = pRVar8; - lVar11 = CreateWorkerThread(param_2,pCVar17,3); - if (-1 < lVar11) { - pCVar17 = (CNode *)((ulonglong)pwVar22 & 0xffffffff); - CConfigDescriptor::RefreshPoliciesInEngine(*(CConfigDescriptor **)pRVar8,iVar24,iVar1) - ; - SubmitThreadpoolWork - (*(PTP_WORK *)(**(longlong **)(*(longlong *)pRVar8 + 0x88) + 0x28)); - local_res10 = local_res10 + 1; - } - if (*(int *)(*(longlong *)pRVar8 + 0x28) != 0) { - bVar37 = true; - } - } - SmartPtr::RefCounter::Dec_nRefs(pRVar8); - pCVar13 = pCVar33; - } while (pCVar33 != (CNode *)0x0); - piVar28 = (int *)((longlong)param_2 + 0xe8); - _Var35 = local_68; - DVar10 = local_e0.dwLowDateTime; + if ((*(byte *)((longlong)param_2 + 0x198) & 1) == 0) { + _Var19 = *(_FILETIME *)((longlong)param_2 + 0xd0); + do { + LOCK(); + _Var20 = *(_FILETIME *)((longlong)param_2 + 0xd0); + bVar34 = _Var19 == _Var20; + if (bVar34) { + *(_FILETIME *)((longlong)param_2 + 0xd0) = _Var19; + _Var20 = _Var19; + } + UNLOCK(); + _Var19 = _Var20; + } while (!bVar34); + if (((ulonglong)_Var31 < (ulonglong)_Var20) && + ((ulonglong)((longlong)_Var20 - (longlong)_Var31) < uVar27)) { + uVar27 = (longlong)_Var20 - (longlong)_Var31; } - if ((*piVar28 == 0) && (local_res10 == 0)) { - if ((*(byte *)((longlong)param_2 + 0x198) & 1) == 0) { - _Var15 = *(_FILETIME *)((longlong)param_2 + 0xd0); - do { - LOCK(); - _Var16 = *(_FILETIME *)((longlong)param_2 + 0xd0); - bVar36 = _Var15 == _Var16; - if (bVar36) { - *(_FILETIME *)((longlong)param_2 + 0xd0) = _Var15; - _Var16 = _Var15; - } - UNLOCK(); - _Var15 = _Var16; - } while (!bVar36); - if ((ulonglong)_Var35 < (ulonglong)_Var16) goto LAB_6; - } - SmartPtr::SmartPtr - ((SmartPtr *)&local_98,(CConfigDescriptor *)pCVar17); - piVar26 = (int *)0xffffffffffffffff; - pCVar21 = (CConfigDescriptor *)((longlong)param_2 + 0x10); - pCVar17 = *(CNode **)pCVar21; - if ((pCVar17 != (CNode *)0x0) && (pCVar17 != *(CNode **)((longlong)param_2 + 0x38))) { - do { - pCVar13 = pCVar17; - pCVar17 = *(CNode **)(pCVar13 + 0x18); - } while (*(CNode **)(pCVar13 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); - if (pCVar13 != (CNode *)0x0) { - do { - SmartPtr::SmartPtr - ((SmartPtr *)&local_b8,pCVar21); - pCVar17 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10),pCVar13); - SmartPtr::operator= - ((SmartPtr *)&local_b8, - (SmartPtr *)(pCVar13 + 8)); - pRVar8 = local_b8; - pCVar21 = *(CConfigDescriptor **)local_b8; - if (((*(int *)(pCVar21 + 0x2c) == 0) && - (piVar5 = *(int **)(pCVar21 + 0x20), piVar28 = piVar5, piVar5 < piVar26)) && - (((*(int *)(pCVar21 + 0x10) != 0 && - ((ulonglong)(*(longlong *)(pCVar21 + 0x30) + (longlong)piVar5) < - (ulonglong)_Var35)) || (*(int *)(pCVar21 + 0x14) != 0)))) { - pCVar21 = (CConfigDescriptor *)&local_b8; - SmartPtr::operator= - ((SmartPtr *)&local_98, - (SmartPtr *)pCVar21); - piVar26 = piVar5; - } - SmartPtr::RefCounter::Dec_nRefs(pRVar8); - pCVar13 = pCVar17; - } while (pCVar17 != (CNode *)0x0); - DVar10 = local_e0.dwLowDateTime; - } - } - pRVar8 = local_98; - if (local_98 != (RefCounter *)0x0) { - puVar3 = *(undefined8 **)local_98; - if (puVar3 == (undefined8 *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(local_98); - } - else { - iVar24 = *(int *)((longlong)puVar3 + 0x14); - uVar25 = (iVar24 != 0) + 1; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - pcVar30 = "maintenance"; - if (iVar24 == 0) { - pcVar30 = "periodic"; - } - WPP_SF_sS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),"periodic",piVar28,pcVar30, - (wchar_t *)*puVar3); - } - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - pCVar19 = *(CManagerThread **)pRVar8; - if (8 < *(uint *)(pCVar19 + 0x90)) { - *(uint *)(pCVar19 + 0x90) = *(uint *)(pCVar19 + 0x90) | 0x100; - local_60 = pRVar8; - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - PublishProtectionState(pCVar19,&local_60); - } - puVar3 = *(undefined8 **)pRVar8; - *(uint *)(puVar3 + 0xb) = uVar25; - if ((iVar24 != 0) == 0) { - *(undefined8 *)((longlong)puVar3 + 0x5c) = 2; - puVar3[0xd] = 0xffffffffffffffff; - puVar3[0xe] = 0xffffffffffffffff; - puVar3[0xf] = 0xffffffffffffffff; - puVar3[0x10] = 0xffffffffffffffff; - if (*(char *)(puVar3 + 0x12) == -0x10) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - uVar20 = 0x19; -LAB_7: - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar20, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar3); - } - } - else if ((*(int *)(puVar3 + 0x13) == 0) && (*(int *)((longlong)puVar3 + 0x94) == 0)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - uVar20 = 0x1a; - goto LAB_7; - } - } - else { - puVar3[0xe] = puVar3[7]; - puVar3[0xf] = puVar3[8]; - puVar3[0x10] = puVar3[9]; - } - } - else if ((uVar25 == 2) || (uVar25 == 3)) { - *(undefined4 *)((longlong)puVar3 + 0x5c) = 2; - *(undefined4 *)(puVar3 + 0xc) = *(undefined4 *)(puVar3 + 10); - puVar3[0xd] = 0xffffffffffffffff; - puVar3[0xe] = 0xffffffffffffffff; - puVar3[0xf] = 0xffffffffffffffff; - puVar3[0x10] = 0xffffffffffffffff; - } - this_00 = operator_new(0x60); - pCVar18 = (CWorkerThread *)0x0; - if (this_00 != (CWorkerThread *)0x0) { - pCVar18 = (CWorkerThread *)CWorkerThread::CWorkerThread(this_00); - } - this_02 = (SmartPtr *)(*(longlong *)pRVar8 + 0x88); - SmartPtr::operator=(this_02,pCVar18); - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0zq_EventWriteTransfer - (this_02,pCVar18,(wchar_t *)**(undefined8 **)pRVar8,uVar25); - } - lVar14 = *(longlong *)pRVar8; - puVar29 = (ulong *)(ulonglong)uVar25; - lVar11 = CWorkerThread::Create - ((CWorkerThread *)**(undefined8 **)(lVar14 + 0x88), - *(void **)(lVar14 + 8),uVar25,*(ulong *)(lVar14 + 0x54), - (_TP_CALLBACK_ENVIRON_V3 *)((longlong)param_2 + 0x88), - *(void **)((longlong)param_2 + 0xf8)); - pCVar19 = *(CManagerThread **)pRVar8; - *(undefined4 *)(pCVar19 + 0x54) = 0; - if (lVar11 < 0) { - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0z_EventWriteTransfer - (pCVar19,(PCEVENT_DESCRIPTOR)&BackupCycleStop, - (wchar_t *)**(undefined8 **)pRVar8); - } - *(uint *)(*(longlong *)pRVar8 + 0x90) = - *(uint *)(*(longlong *)pRVar8 + 0x90) & 0xfffffeff; - puVar29 = (ulong *)(*(longlong *)pRVar8 + 0x90); - MapHrToProtectionState(pCVar19,lVar11,puVar29); - local_50 = pRVar8; - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - PublishProtectionState(); - if (lVar11 + 0x7ffbf9ffU < 3) { - *(undefined4 *)(*(longlong *)pRVar8 + 0x28) = 1; - ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_48,*(CStringT_>_> - **)pRVar8); - puVar29 = (ulong *)0x0; - AddRemoveRegisteredConfig(param_2); - } - SmartPtr::operator= - ((SmartPtr *)(*(longlong *)pRVar8 + 0x88), - (CWorkerThread *)0x0); - *(undefined4 *)(*(longlong *)pRVar8 + 0x58) = 0; - } - else { - local_90.dwLowDateTime = 0; - local_90.dwHighDateTime = 0; - GetSystemTimeAsFileTime(&local_90); - *(_FILETIME *)(*(longlong *)pRVar8 + 0x20) = local_90; - pCVar19 = *(CManagerThread **)pRVar8; - if (*(uint *)(pCVar19 + 0x90) < 9) { - *(undefined4 *)(pCVar19 + 0x90) = 0x1ff; - local_58 = pRVar8; - *(int *)(pRVar8 + 8) = *(int *)(pRVar8 + 8) + 1; - PublishProtectionState(pCVar19,&local_58); - } - } - SmartPtr::RefCounter::Dec_nRefs(pRVar8); - *(undefined4 *)(*(longlong *)pRVar8 + 0x14) = 0; - if (lVar11 < 0) { - if (iVar24 != 0) { - piVar28 = (int *)((longlong)param_2 + 0x6c); - *piVar28 = *piVar28 + -1; - if (*piVar28 == 0) { - SetEvent(*(HANDLE *)((longlong)param_2 + 0x70)); - } - } - *(undefined4 *)(*(longlong *)pRVar8 + 0x58) = 0; - } - else { - lVar14 = *(longlong *)pRVar8; - if ((*(longlong **)(lVar14 + 0x88) != (longlong *)0x0) && - (lVar2 = **(longlong **)(lVar14 + 0x88), lVar2 != 0)) { - if (local_c8 < 10) { - if (iVar1 == 0) { - local_res10 = 1; - local_d0 = *(wchar_t **)(lVar14 + 0x78); - } - else { - local_res10 = 3; - local_d0 = *(wchar_t **)(lVar14 + 0x80); - } - } - else { - local_res10 = -(uint)(iVar1 != 0) & 2; - if (iVar1 == 0) { - local_d0 = *(wchar_t **)(lVar14 + 0x68); - } - else { - local_d0 = *(wchar_t **)(lVar14 + 0x70); - } - } - if (local_d0 == (wchar_t *)0xffffffffffffffff) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - puVar29 = (ulong *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2d, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - *(wchar_t **)(lVar2 + 0x18)); - } - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - puVar29 = (ulong *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Si(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - *(wchar_t **)(lVar2 + 0x18)); - } - *(uint *)(lVar2 + 0x48) = local_res10; - pwVar22 = local_d0; - (**(code **)(**(longlong **)(lVar2 + 0x10) + 0x30))(); - lVar2 = **(longlong **)(lVar14 + 0x88); - if (local_c8 < 10) { - iVar24 = *(int *)(lVar14 + 0x60); - } - else { - iVar24 = *(int *)(lVar14 + 0x5c); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - if (iVar24 == 2) { - pwVar31 = L"IoPriorityHintNormal"; - } - else { - pwVar31 = L"IoPriorityHintLow"; - pwVar22 = L"IoPriorityHintVeryLow"; - if (iVar24 != 1) { - pwVar31 = L"IoPriorityHintVeryLow"; - } - } - WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pwVar22,puVar29,pwVar31, - *(wchar_t **)(lVar2 + 0x18)); - } - plVar6 = *(longlong **)(lVar2 + 0x10); - (**(code **)(*plVar6 + 0x28))(plVar6,iVar24); - } - SubmitThreadpoolWork - (*(PTP_WORK *)(**(longlong **)(*(longlong *)pRVar8 + 0x88) + 0x28)); - local_res10 = 1; - } - if (*(int *)(*(longlong *)pRVar8 + 0x28) != 0) { - bVar37 = true; - } - SmartPtr::RefCounter::Dec_nRefs(pRVar8); - } - } + } + if (((*(int *)((longlong)param_2 + 0xec) != 0) && + ((ulonglong)_Var31 < (ulonglong)*(_FILETIME *)((longlong)param_2 + 0xf0))) && + (uVar25 = (longlong)*(_FILETIME *)((longlong)param_2 + 0xf0) - (longlong)_Var31, + uVar25 < uVar27)) { + uVar27 = uVar25; + } + LeaveCriticalSection(lpCriticalSection); + if (iVar32 == 0) { + local_108 = (_FILETIME)-uVar27; + pftTimeout = &local_108; + if (uVar27 == 0x7fffffffffffffff) { + pftTimeout = (PFILETIME)0x0; } - } -LAB_6: - ppuVar23 = (undefined **)((longlong)param_2 + 0x10); - if (bVar37) { - LeaveCriticalSection((LPCRITICAL_SECTION)((longlong)param_2 + 0x40)); + SetThreadpoolWait(local_90,*(HANDLE *)((longlong)param_2 + 0xf8),pftTimeout); + goto LAB_3; + } + if ((longlong)uVar27 < 0x270fffffd8f0) { + uVar27 = (longlong)uVar27 / 10000; } else { - uVar27 = 0x7fffffffffffffff; - pCVar17 = (CNode *)*ppuVar23; - if ((pCVar17 != (CNode *)0x0) && (pCVar17 != *(CNode **)((longlong)param_2 + 0x38))) { - do { - pCVar13 = pCVar17; - pCVar17 = *(CNode **)(pCVar13 + 0x18); - } while (*(CNode **)(pCVar13 + 0x18) != *(CNode **)((longlong)param_2 + 0x38)); - if (pCVar13 != (CNode *)0x0) { - do { - SmartPtr::SmartPtr - ((SmartPtr *)&local_88,(CConfigDescriptor *)ppuVar23) - ; - uVar34 = 0xffffffffffffffff; - pCVar17 = pCVar13; - pCVar13 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)((longlong)param_2 + 0x10),pCVar13); - SmartPtr::operator= - ((SmartPtr *)&local_88, - (SmartPtr *)(pCVar17 + 8)); - lVar14 = *(longlong *)local_88; - ppuVar23 = *(undefined ***)(lVar14 + 0x88); - if (((CConfigDescriptor *)ppuVar23 == (CConfigDescriptor *)0x0) || - (*ppuVar23 == (undefined *)0x0)) { - if (*(int *)(lVar14 + 0x10) != 0) { - uVar34 = (*(longlong *)(lVar14 + 0x30) + *(longlong *)(lVar14 + 0x20)) - - (longlong)_Var35; - } - } - else { - uVar34 = 20000000; - if (*(int *)(lVar14 + 0x58) != 1) { - uVar34 = 0xffffffffffffffff; - } - } - if (uVar34 < uVar27) { - uVar27 = uVar34; - } - SmartPtr::RefCounter::Dec_nRefs(local_88); - } while (pCVar13 != (CNode *)0x0); - DVar10 = local_e0.dwLowDateTime; - } - } - if ((*(byte *)((longlong)param_2 + 0x198) & 1) == 0) { - _Var15 = *(_FILETIME *)((longlong)param_2 + 0xd0); - do { - LOCK(); - _Var16 = *(_FILETIME *)((longlong)param_2 + 0xd0); - bVar37 = _Var15 == _Var16; - if (bVar37) { - *(_FILETIME *)((longlong)param_2 + 0xd0) = _Var15; - _Var16 = _Var15; - } - UNLOCK(); - _Var15 = _Var16; - } while (!bVar37); - if (((ulonglong)_Var35 < (ulonglong)_Var16) && - ((ulonglong)((longlong)_Var16 - (longlong)_Var35) < uVar27)) { - uVar27 = (longlong)_Var16 - (longlong)_Var35; - } - } - if (((*(int *)((longlong)param_2 + 0xec) != 0) && - ((ulonglong)_Var35 < (ulonglong)*(_FILETIME *)((longlong)param_2 + 0xf0))) && - (uVar34 = (longlong)*(_FILETIME *)((longlong)param_2 + 0xf0) - (longlong)_Var35, - uVar34 < uVar27)) { - uVar27 = uVar34; - } - LeaveCriticalSection((LPCRITICAL_SECTION)((longlong)param_2 + 0x40)); - if (local_res10 == 0) { - local_e0 = (_FILETIME)-uVar27; - pftTimeout = &local_e0; - if (uVar27 == 0x7fffffffffffffff) { - pftTimeout = (PFILETIME)0x0; - } - SetThreadpoolWait(param_3,*(HANDLE *)((longlong)param_2 + 0xf8),pftTimeout); - goto LAB_3; - } - if ((longlong)uVar27 < 0x270fffffd8f0) { - uVar27 = (longlong)uVar27 / 10000; - } - else { - uVar27 = 0xffffffff; - } - if (local_c4 != 0) { - CallbackMayRunLong(param_1); - local_c4 = 0; - } - ppuVar23 = (undefined **)(uVar27 & 0xffffffff); - DVar12 = WaitForSingleObject(*(HANDLE *)((longlong)param_2 + 0xf8),(DWORD)uVar27); - if (((DVar12 != 0) && (DVar12 != 0x102)) && - ((ppuVar23 = &WPP_GLOBAL_Control, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control - && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)))) { - ppuVar23 = (undefined **)0xa8; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa8, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar12); - } + uVar27 = 0xffffffff; + } + if (bVar12) { + CallbackMayRunLong((PTP_CALLBACK_INSTANCE)local_108); + bVar12 = false; + } + ppuVar21 = (undefined **)(uVar27 & 0xffffffff); + DVar15 = WaitForSingleObject(*(HANDLE *)((longlong)param_2 + 0xf8),(DWORD)uVar27); + if (((DVar15 != 0) && (DVar15 != 0x102)) && + ((ppuVar21 = &WPP_GLOBAL_Control, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)))) { + ppuVar21 = (undefined **)0xbd; + param_3 = (_TP_WAIT *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xbd, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar15); } } while( true ); } ``` ## CManagerThread::CreateWorkerThread ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.03| |i_ratio|0.03| |m_ratio|0.2| |b_ratio|0.1| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|CreateWorkerThread|CreateWorkerThread| |fullname|CManagerThread::CreateWorkerThread|CManagerThread::CreateWorkerThread| |`refcount`|2|3| |`length`|785|7520| |`called`|
Expand for full list:
ATL::CStringT_>_>::CStringT_>_>
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::MapHrToProtectionState
CManagerThread::PublishProtectionState
CWorkerThread::CWorkerThread
CWorkerThread::Create
KERNEL32.DLL::GetSystemTimeAsFileTime
McTemplateU0z_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::operator=WPP_SF_S
operator_new
|
Expand for full list:
ADVAPI32.DLL::AdjustTokenPrivileges
ADVAPI32.DLL::CopySid
ADVAPI32.DLL::CreateProcessAsUserW
ADVAPI32.DLL::DuplicateTokenEx
ADVAPI32.DLL::GetLengthSid
ADVAPI32.DLL::GetTokenInformation
ADVAPI32.DLL::IsValidSid
ADVAPI32.DLL::LookupPrivilegeValueW
ADVAPI32.DLL::SystemFunction036
ATL::AtlComPtrAssign
ATL::AtlThrowImplATL::CSimpleStringT::CloneData
ATL::CSimpleStringT::Empty
ATL::CStringData::Release
CConfigDescriptor::UpdateRuntimePolicies
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::MapHrToProtectionState
CManagerThread::PublishProtectionState
CWorkerThread::Create
CWorkerThread::Stop
CreateSanitizedEnvironmentBlock_MSRC115612
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::CreateEventW
KERNEL32.DLL::CreatePipe
KERNEL32.DLL::CreateThreadpoolWait
KERNEL32.DLL::DuplicateHandle
KERNEL32.DLL::GetCurrentProcess
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::HeapFree
KERNEL32.DLL::InitOnceExecuteOnce
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetHandleInformation
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
KERNEL32.DLL::WriteFile
MSVCRT.DLL::operator_delete
McTemplateU0z_EventWriteTransfer
McTemplateU0zq_EventWriteTransfer
PopulateVolumeListForWorker_MSRC115612
SmartPtr::Pointer
SmartPtr::SmartPtr
SmartPtr::operator=
StringCchPrintfW
USERENV.DLL::DestroyEnvironmentBlock
WPP_SF_
WPP_SF_L
WPP_SF_Sd
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
operator_new
wil::details::FeatureImpl::__private_IsEnabled
| |calling|CManagerThread::WaitCallback|CManagerThread::WaitCallback| |paramcount|3|3| |`address`|180009e20|180007d20| |sig|long __thiscall CreateWorkerThread(CManagerThread * this, SmartPtr param_1, FhBackupType param_2)|long __thiscall CreateWorkerThread(CManagerThread * this, SmartPtr param_1, FhBackupType param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::CreateWorkerThread Called Diff ```diff --- CManagerThread::CreateWorkerThread called +++ CManagerThread::CreateWorkerThread called @@ -1 +1,15 @@ -ATL::CStringT_>_>::CStringT_>_> +ADVAPI32.DLL::AdjustTokenPrivileges +ADVAPI32.DLL::CopySid +ADVAPI32.DLL::CreateProcessAsUserW +ADVAPI32.DLL::DuplicateTokenEx +ADVAPI32.DLL::GetLengthSid +ADVAPI32.DLL::GetTokenInformation +ADVAPI32.DLL::IsValidSid +ADVAPI32.DLL::LookupPrivilegeValueW +ADVAPI32.DLL::SystemFunction036 +ATL::AtlComPtrAssign +ATL::AtlThrowImpl +ATL::CSimpleStringT::CloneData +ATL::CSimpleStringT::Empty +ATL::CStringData::Release +CConfigDescriptor::UpdateRuntimePolicies @@ -5 +18,0 @@ -CWorkerThread::CWorkerThread @@ -6,0 +20,12 @@ +CWorkerThread::Stop +CreateSanitizedEnvironmentBlock_MSRC115612 +KERNEL32.DLL::CloseHandle +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::CloseThreadpoolWork +KERNEL32.DLL::CreateEventW +KERNEL32.DLL::CreatePipe +KERNEL32.DLL::CreateThreadpoolWait +KERNEL32.DLL::DuplicateHandle +KERNEL32.DLL::GetCurrentProcess +KERNEL32.DLL::GetLastError +KERNEL32.DLL::GetProcessHeap @@ -7,0 +33,9 @@ +KERNEL32.DLL::HeapAlloc +KERNEL32.DLL::HeapFree +KERNEL32.DLL::InitOnceExecuteOnce +KERNEL32.DLL::LocalFree +KERNEL32.DLL::SetHandleInformation +KERNEL32.DLL::SetThreadpoolWait +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks +KERNEL32.DLL::WriteFile +MSVCRT.DLL::operator_delete @@ -10 +44,3 @@ -SmartPtr::RefCounter::Dec_nRefs +PopulateVolumeListForWorker_MSRC115612 +SmartPtr::Pointer +SmartPtr::SmartPtr @@ -12 +48,7 @@ -WPP_SF_S +StringCchPrintfW +USERENV.DLL::DestroyEnvironmentBlock +WPP_SF_ +WPP_SF_L +WPP_SF_Sd +__security_check_cookie +_guard_dispatch_icall$thunk$10345483385596137414 @@ -13,0 +56 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::CreateWorkerThread Diff ```diff --- CManagerThread::CreateWorkerThread +++ CManagerThread::CreateWorkerThread @@ -1,139 +1,1248 @@ +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: long __cdecl CManagerThread::CreateWorkerThread(class SmartPtr,enum FhBackupType) __ptr64 */ long __thiscall -CManagerThread::CreateWorkerThread(CManagerThread *this,_FILETIME *param_2,ulong param_3) +CManagerThread::CreateWorkerThread(CManagerThread *this,_FILETIME *param_2,FhBackupType param_3) { - CManagerThread *pCVar1; - uint uVar2; - undefined8 *puVar3; - longlong lVar4; - _FILETIME _Var5; + int *piVar1; + CManagerThread *pCVar2; + short sVar3; + HLOCAL pvVar4; + longlong *plVar5; CManagerThread *this_00; - long lVar6; - CWorkerThread *this_01; - CWorkerThread *pCVar7; - undefined8 uVar8; + CSimpleStringT *this_01; + bool bVar6; + BOOL BVar7; + DWORD DVar8; + DWORD DVar9; + int iVar10; + PHANDLE ******hReadPipe; + HANDLE pvVar11; + HANDLE pvVar12; + HANDLE pvVar13; + undefined8 *TokenInformation; + CConfigDescriptor *pCVar14; + short *psVar15; + undefined2 *lpEnvironment; + PTP_WAIT p_Var16; + undefined8 uVar17; + CStringData *pCVar18; + CWorkerThread *pCVar19; + short *psVar20; + PHANDLE ******hObject; + undefined **ppuVar21; SmartPtr *this_02; - undefined2 uVar9; - _FILETIME local_res8; - _FILETIME local_res10; + longlong lVar22; + CWorkerThread *pCVar23; + longlong lVar24; + longlong *plVar25; + CWorkerThread *pCVar26; + undefined8 *puVar27; + DWORD DVar28; + undefined4 *puVar29; + _FILETIME _Var30; + uint uVar31; + CManagerThread *pCVar32; + undefined1 auStackY_608 [32]; + PHANDLE *****local_5a8; + _FILETIME local_5a0; + PHANDLE *****local_598; + PHANDLE *****local_590; + DWORD local_588; + DWORD local_584; + _LUID local_580; + longlong *local_578; + PHANDLE *****local_570; + DWORD local_568 [2]; + HANDLE local_560; + _FILETIME local_558; + _FILETIME local_550; + longlong local_548; + HANDLE local_540; + _LUID local_538; + _SECURITY_ATTRIBUTES local_530; + _PROCESS_INFORMATION local_518; + _STARTUPINFOW local_4f8; + undefined4 local_488; + short local_484 [64]; + longlong local_404; + _TOKEN_PRIVILEGES local_3f8; + _LUID local_3e8; + undefined4 local_3e0; + short local_3d8 [64]; + WCHAR local_358 [392]; + ulonglong local_48; - uVar2 = *(uint *)(*(longlong *)*param_2 + 0x90); - if (8 < uVar2) { - *(uint *)(*(longlong *)*param_2 + 0x90) = uVar2 | 0x100; - local_res8 = *param_2; - if (local_res8 != (_FILETIME)0x0) { - *(int *)((longlong)local_res8 + 8) = *(int *)((longlong)local_res8 + 8) + 1; - } - PublishProtectionState(this,&local_res8); + local_48 = __security_cookie ^ (ulonglong)auStackY_608; + local_578 = (longlong *)CONCAT44(local_578._4_4_,param_3); + local_5a0 = (_FILETIME)this; + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + lVar22 = *(longlong *)*param_2; + uVar31 = *(uint *)(lVar22 + 0x120); + if (!bVar6) { + if (8 < uVar31) { + /* WARNING: Store size is inaccurate */ + *(CManagerThread **)(lVar22 + 0x120) = (CManagerThread *)(uVar31 | 0x100); + local_550 = *param_2; + if (local_550 != (_FILETIME)0x0) { + *(int *)((longlong)local_550 + 8) = *(int *)((longlong)local_550 + 8) + 1; + } + PublishProtectionState((CManagerThread *)(uVar31 | 0x100),&local_550); + } + CConfigDescriptor::UpdateRuntimePolicies(*(CConfigDescriptor **)*param_2,param_3); + pCVar19 = operator_new(0x60); + pCVar26 = (CWorkerThread *)0x0; + pCVar23 = pCVar26; + if (pCVar19 != (CWorkerThread *)0x0) { + *(undefined8 *)pCVar19 = 0; + *(undefined8 *)(pCVar19 + 8) = 0; + *(undefined8 *)(pCVar19 + 0x10) = 0; + lVar22 = (**(code **)(ATL::g_strmgr + 0x18))(&ATL::g_strmgr); + *(longlong *)(pCVar19 + 0x18) = lVar22 + 0x18; + *(undefined8 *)(pCVar19 + 0x20) = 0; + *(undefined8 *)(pCVar19 + 0x28) = 0; + *(undefined4 *)(pCVar19 + 0x30) = 1; + *(undefined8 *)(pCVar19 + 0x38) = 0; + *(undefined4 *)(pCVar19 + 0x40) = 0; + *(undefined8 *)(pCVar19 + 0x48) = 0; + *(undefined4 *)(pCVar19 + 0x50) = 0xff; + *(undefined4 *)(pCVar19 + 0x5c) = 0; + *(undefined8 *)(pCVar19 + 0x54) = 0; + pCVar23 = pCVar19; + } + this_02 = (SmartPtr *)(*(longlong *)*param_2 + 0x88); + SmartPtr::operator=(this_02,pCVar23); + if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { + McTemplateU0zq_EventWriteTransfer + (this_02,pCVar23,(wchar_t *)**(undefined8 **)*param_2,param_3); + } + lVar22 = *(longlong *)*param_2; + DVar28 = CWorkerThread::Create + ((CWorkerThread *)**(undefined8 **)(lVar22 + 0x88),*(void **)(lVar22 + 8), + param_3,*(ulong *)(lVar22 + 0x54),(_TP_CALLBACK_ENVIRON_V3 *)(this + 0x88), + *(void **)(this + 0xf8)); + _Var30 = *param_2; + *(undefined4 *)(*(longlong *)_Var30 + 0x54) = 0; + local_584 = DVar28; + if ((int)DVar28 < 0) { + if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { + McTemplateU0z_EventWriteTransfer + (_Var30,(PCEVENT_DESCRIPTOR)&BackupCycleStop,(wchar_t *)**(undefined8 **)*param_2) + ; + } + this_00 = *(CManagerThread **)*param_2; + pCVar2 = this_00 + 0x120; + *(uint *)pCVar2 = *(uint *)pCVar2 & 0xfffffeff; + MapHrToProtectionState(this_00,DVar28,(ulong *)(*(longlong *)*param_2 + 0x120)); + local_558 = *param_2; + if (local_558 != (_FILETIME)0x0) { + *(int *)((longlong)local_558 + 8) = *(int *)((longlong)local_558 + 8) + 1; + } + PublishProtectionState(); + if (DVar28 + 0x7ffbf9ff < 3) { + *(undefined4 *)(*(longlong *)*param_2 + 0x28) = 1; + pCVar18 = ATL::CSimpleStringT::CloneData + ((CStringData *)(**(longlong **)*param_2 + -0x18)); + local_580 = (_LUID)((longlong)pCVar18 + 0x18); + AddRemoveRegisteredConfig(this,&local_580,0); + } + SmartPtr::operator= + ((SmartPtr *)(*(longlong *)*param_2 + 0x88), + (CWorkerThread *)0x0); + *(undefined4 *)(*(longlong *)*param_2 + 0x58) = 0; + } + else { + local_580.LowPart = 0; + local_580.HighPart = 0; + GetSystemTimeAsFileTime((LPFILETIME)&local_580); + *(_LUID *)(*(longlong *)*param_2 + 0x20) = local_580; + _Var30 = *param_2; + lVar22 = *(longlong *)_Var30; + if (*(uint *)(lVar22 + 0x120) < 9) { + *(undefined4 *)(lVar22 + 0x120) = 0x1ff; + local_558 = *param_2; + if (local_558 != (_FILETIME)0x0) { + *(int *)((longlong)local_558 + 8) = *(int *)((longlong)local_558 + 8) + 1; + } + PublishProtectionState((CManagerThread *)_Var30,&local_558); + } + } + _Var30 = *param_2; + if (_Var30 == (_FILETIME)0x0) { + return DVar28; + } + piVar1 = (int *)((longlong)_Var30 + 8); + *piVar1 = *piVar1 + -1; + if (*piVar1 != 0) { + return DVar28; + } + this_01 = *(CSimpleStringT **)_Var30; + if (this_01 != (CSimpleStringT *)0x0) { + if (*(HANDLE *)(this_01 + 8) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_01 + 8)); + *(undefined8 *)(this_01 + 8) = 0; + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + if (*(PTP_WAIT *)(this_01 + 0x100) != (PTP_WAIT)0x0) { + SetThreadpoolWait(*(PTP_WAIT *)(this_01 + 0x100),(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks(*(PTP_WAIT *)(this_01 + 0x100),1); + CloseThreadpoolWait(*(PTP_WAIT *)(this_01 + 0x100)); + *(undefined8 *)(this_01 + 0x100) = 0; + } + if (*(HANDLE *)(this_01 + 0x90) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_01 + 0x90)); + *(undefined8 *)(this_01 + 0x90) = 0; + } + if (*(HANDLE *)(this_01 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_01 + 0x108)); + *(undefined8 *)(this_01 + 0x108) = 0; + } + if (*(longlong *)(this_01 + 0x118) != 0) { + if (*(int *)(this_01 + 0x110) != 0) { + do { + pvVar4 = *(HLOCAL *)(*(longlong *)(this_01 + 0x118) + (longlong)pCVar26 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar31 = (int)pCVar26 + 1; + pCVar26 = (CWorkerThread *)(ulonglong)uVar31; + } while (uVar31 < *(uint *)(this_01 + 0x110)); + } + LocalFree(*(HLOCAL *)(this_01 + 0x118)); + *(undefined8 *)(this_01 + 0x118) = 0; + *(undefined4 *)(this_01 + 0x110) = 0; + } + } + ATL::CSimpleStringT::Empty(this_01); + puVar27 = *(undefined8 **)(this_01 + 0x88); + if (puVar27 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar27 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar23 = (CWorkerThread *)*puVar27; + if (pCVar23 != (CWorkerThread *)0x0) { + ppuVar21 = (undefined **)0x1; + CWorkerThread::Stop(pCVar23,1); + if (*(PTP_WORK *)(pCVar23 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar23 + 0x28)); + *(undefined8 *)(pCVar23 + 0x28) = 0; + *(undefined4 *)(pCVar23 + 0x30) = 1; + } + if (*(longlong *)(pCVar23 + 0x10) != 0) { + ATL::AtlComPtrAssign((IUnknown **)(pCVar23 + 0x10),(IUnknown *)ppuVar21); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar23 + 8) + 0x28))(); + if (((iVar10 < 0) && + (ppuVar21 = &WPP_GLOBAL_Control, + (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + ppuVar21 = (undefined **)0x41; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong *)(pCVar23 + 8) != 0) { + ATL::AtlComPtrAssign((IUnknown **)(pCVar23 + 8),(IUnknown *)ppuVar21); + } + } + if (*(longlong *)pCVar23 != 0) { + ATL::AtlComPtrAssign((IUnknown **)pCVar23,(IUnknown *)ppuVar21); + } + ATL::CSimpleStringT::Empty + ((CSimpleStringT *)(pCVar23 + 0x18)); + if (*(HANDLE *)(pCVar23 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar23 + 0x20)); + *(undefined8 *)(pCVar23 + 0x20) = 0; + } + lVar22 = *(longlong *)(pCVar23 + 0x18); + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar23 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 8) + 0x10))(); + } + if (*(longlong **)pCVar23 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar23 + 0x10))(); + } + operator_delete(pCVar23); + } + operator_delete(puVar27); + } + } + lVar22 = *(longlong *)this_01; + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + operator_delete(this_01); + DVar28 = local_584; + } + operator_delete((void *)_Var30); + return DVar28; } - puVar3 = *(undefined8 **)*param_2; - *(ulong *)(puVar3 + 0xb) = param_3; - pCVar7 = (CWorkerThread *)0x0; - if (param_3 != 1) { - if ((param_3 == 2) || (param_3 == 3)) { - *(undefined4 *)((longlong)puVar3 + 0x5c) = 2; - *(undefined4 *)(puVar3 + 0xc) = *(undefined4 *)(puVar3 + 10); - puVar3[0xd] = 0xffffffffffffffff; - puVar3[0xe] = 0xffffffffffffffff; - puVar3[0xf] = 0xffffffffffffffff; - puVar3[0x10] = 0xffffffffffffffff; - } - goto LAB_0; + if (8 < uVar31) { + /* WARNING: Store size is inaccurate */ + *(CManagerThread **)(lVar22 + 0x120) = (CManagerThread *)(uVar31 | 0x100); + local_558 = *param_2; + if (local_558 != (_FILETIME)0x0) { + *(int *)((longlong)local_558 + 8) = *(int *)((longlong)local_558 + 8) + 1; + } + PublishProtectionState((CManagerThread *)(uVar31 | 0x100),&local_558); } - *(undefined8 *)((longlong)puVar3 + 0x5c) = 2; - puVar3[0xd] = 0xffffffffffffffff; - puVar3[0xe] = 0xffffffffffffffff; - puVar3[0xf] = 0xffffffffffffffff; - puVar3[0x10] = 0xffffffffffffffff; - if (*(char *)(puVar3 + 0x12) == -0x10) { - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 2) == 0)) goto LAB_0; - uVar9 = 0x19; - } - else { - if ((*(int *)(puVar3 + 0x13) != 0) || (*(int *)((longlong)puVar3 + 0x94) != 0)) { - puVar3[0xe] = puVar3[7]; - puVar3[0xf] = puVar3[8]; - puVar3[0x10] = puVar3[9]; - goto LAB_0; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 2) == 0)) goto LAB_0; - uVar9 = 0x1a; - } - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar9, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)*puVar3); + local_4f8.lpReserved = (LPWSTR)0x0; + local_4f8.lpDesktop = (LPWSTR)0x0; + local_4f8.lpTitle = (LPWSTR)0x0; + local_4f8.dwX = 0; + local_4f8.dwY = 0; + local_4f8.dwXSize = 0; + local_4f8.dwYSize = 0; + local_4f8.dwXCountChars = 0; + local_4f8.dwYCountChars = 0; + local_4f8.wShowWindow = 0; + local_4f8.cbReserved2 = 0; + local_4f8._68_4_ = 0; + local_4f8.lpReserved2 = (LPBYTE)0x0; + local_4f8.hStdInput = (HANDLE)0x0; + local_4f8.hStdOutput = (HANDLE)0x0; + local_4f8.hStdError = (HANDLE)0x0; + local_518.hProcess = (HANDLE)0x0; + local_518.hThread = (HANDLE)0x0; + local_518.dwProcessId = 0; + local_518.dwThreadId = 0; + puVar27 = (undefined8 *)0x0; + local_598 = (PHANDLE ******)0x0; + local_570 = (PHANDLE ******)0x0; + local_3d8[1] = 0; + local_3d8[2] = 0; + local_3d8[3] = 0; + local_3d8[4] = 0; + local_3d8[5] = 0; + local_3d8[6] = 0; + local_3d8[7] = 0; + local_3d8[8] = 0; + local_3d8[9] = 0; + local_3d8[10] = 0; + local_3d8[0xb] = 0; + local_3d8[0xc] = 0; + local_3d8[0xd] = 0; + local_3d8[0xe] = 0; + local_3d8[0xf] = 0; + local_3d8[0x10] = 0; + local_3d8[0x11] = 0; + local_3d8[0x12] = 0; + local_3d8[0x13] = 0; + local_3d8[0x14] = 0; + local_3d8[0x15] = 0; + local_3d8[0x16] = 0; + local_3d8[0x17] = 0; + local_3d8[0x18] = 0; + local_3d8[0x19] = 0; + local_3d8[0x1a] = 0; + local_3d8[0x1b] = 0; + local_3d8[0x1c] = 0; + local_3d8[0x1d] = 0; + local_3d8[0x1e] = 0; + local_3d8[0x1f] = 0; + local_3d8[0x20] = 0; + local_3d8[0x21] = 0; + local_3d8[0x22] = 0; + local_3d8[0x23] = 0; + local_3d8[0x24] = 0; + local_3d8[0x25] = 0; + local_3d8[0x26] = 0; + local_3d8[0x27] = 0; + local_3d8[0x28] = 0; + local_3d8[0x29] = 0; + local_3d8[0x2a] = 0; + local_3d8[0x2b] = 0; + local_3d8[0x2c] = 0; + local_3d8[0x2d] = 0; + local_3d8[0x2e] = 0; + local_3d8[0x2f] = 0; + local_3d8[0x30] = 0; + local_3d8[0x31] = 0; + local_3d8[0x32] = 0; + local_3d8[0x33] = 0; + local_3d8[0x34] = 0; + local_3d8[0x35] = 0; + local_3d8[0x36] = 0; + local_3d8[0x37] = 0; + local_3d8[0x38] = 0; + local_3d8[0x39] = 0; + local_3d8[0x3a] = 0; + local_3d8[0x3b] = 0; + local_3d8[0x3c] = 0; + local_3d8[0x3d] = 0; + local_3d8[0x3e] = 0; + local_3d8[0x3f] = 0; + local_5a8 = (PHANDLE ******)0x0; + local_590 = (PHANDLE ******)0x0; + local_530.lpSecurityDescriptor = (LPVOID)0x0; + local_4f8.cb = 0x68; + local_4f8._4_4_ = 0; + local_4f8.dwFillAttribute = 0; + local_4f8.dwFlags = 0x80; + local_530.nLength = 0x18; + local_530._4_4_ = 0; + local_530.bInheritHandle = 1; + local_530._20_4_ = 0; + hReadPipe = &local_5a8; + BVar7 = CreatePipe(hReadPipe,&local_590,(LPSECURITY_ATTRIBUTES)0x0,0); + DVar28 = 0; + if (BVar7 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } LAB_0: - this_01 = operator_new(0x60); - if (this_01 != (CWorkerThread *)0x0) { - pCVar7 = (CWorkerThread *)CWorkerThread::CWorkerThread(this_01); - } - this_02 = (SmartPtr *)(*(longlong *)*param_2 + 0x88); - SmartPtr::operator=(this_02,pCVar7); - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0zq_EventWriteTransfer(this_02,pCVar7,(wchar_t *)**(undefined8 **)*param_2,param_3); - } - lVar4 = *(longlong *)*param_2; - lVar6 = CWorkerThread::Create - ((CWorkerThread *)**(undefined8 **)(lVar4 + 0x88),*(void **)(lVar4 + 8),param_3, - *(ulong *)(lVar4 + 0x54),(_TP_CALLBACK_ENVIRON_V3 *)(this + 0x88), - *(void **)(this + 0xf8)); - _Var5 = *param_2; - *(undefined4 *)(*(longlong *)_Var5 + 0x54) = 0; - if (lVar6 < 0) { if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { McTemplateU0z_EventWriteTransfer - (_Var5,(PCEVENT_DESCRIPTOR)&BackupCycleStop,(wchar_t *)**(undefined8 **)*param_2); - } - this_00 = *(CManagerThread **)*param_2; - pCVar1 = this_00 + 0x90; - *(uint *)pCVar1 = *(uint *)pCVar1 & 0xfffffeff; - MapHrToProtectionState(this_00,lVar6,(ulong *)(*(longlong *)*param_2 + 0x90)); - local_res8 = *param_2; - if (local_res8 != (_FILETIME)0x0) { - *(int *)((longlong)local_res8 + 8) = *(int *)((longlong)local_res8 + 8) + 1; + (hReadPipe,(PCEVENT_DESCRIPTOR)&BackupCycleStop,(wchar_t *)**(undefined8 **)*param_2 + ); + } + *(uint *)(*(longlong *)*param_2 + 0x120) = *(uint *)(*(longlong *)*param_2 + 0x120) & 0xfffffeff + ; + lVar22 = *(longlong *)*param_2; + if (DVar8 + 0x7ffbf9ff < 2) { + *(undefined4 *)(lVar22 + 0x120) = 1; + } + else if (DVar8 == 0x80040603) { + *(undefined4 *)(lVar22 + 0x120) = 2; + } + else if (DVar8 == 0x80040604) { + *(undefined4 *)(lVar22 + 0x120) = 3; + } + local_5a0 = *param_2; + if (local_5a0 != (_FILETIME)0x0) { + *(int *)((longlong)local_5a0 + 8) = *(int *)((longlong)local_5a0 + 8) + 1; } PublishProtectionState(); - if (lVar6 + 0x7ffbf9ffU < 3) { + if (DVar8 + 0x7ffbf9ff < 3) { *(undefined4 *)(*(longlong *)*param_2 + 0x28) = 1; - uVar8 = ATL:: - CStringT_>_> - :: - CStringT_>_> - ((CStringT_>_> - *)&local_res8, - *(CStringT_>_> - **)*param_2); - AddRemoveRegisteredConfig(this,uVar8,0); + pCVar18 = ATL::CSimpleStringT::CloneData + ((CStringData *)(**(longlong **)*param_2 + -0x18)); + local_550 = (_FILETIME)((longlong)pCVar18 + 0x18); + AddRemoveRegisteredConfig(this,&local_550,0); } SmartPtr::operator= ((SmartPtr *)(*(longlong *)*param_2 + 0x88),(CWorkerThread *)0x0) ; + *(undefined8 *)(*(longlong *)*param_2 + 0x90) = 0; *(undefined4 *)(*(longlong *)*param_2 + 0x58) = 0; + *(undefined8 *)(*(longlong *)*param_2 + 0xe0) = 0; + *(undefined4 *)(*(longlong *)*param_2 + 0xe8) = 0; + *(undefined4 *)(*(longlong *)*param_2 + 0xf8) = 0; + if (*(HANDLE *)(*(longlong *)*param_2 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(*(longlong *)*param_2 + 0x108)); + *(undefined8 *)(*(longlong *)*param_2 + 0x108) = 0; + } + *(undefined4 *)(*(longlong *)*param_2 + 0xdc) = 0; + lVar22 = *(longlong *)*param_2; + *(undefined8 *)(lVar22 + 0x98) = 0; + *(undefined8 *)(lVar22 + 0xa0) = 0; + *(undefined8 *)(lVar22 + 0xa8) = 0; + *(undefined8 *)(lVar22 + 0xb0) = 0; + *(undefined8 *)(lVar22 + 0xb8) = 0; + *(undefined8 *)(lVar22 + 0xc0) = 0; + *(undefined8 *)(lVar22 + 200) = 0; + *(undefined8 *)(lVar22 + 0xd0) = 0; + *(undefined4 *)(lVar22 + 0xd8) = 0; + _Var30 = *param_2; + if (_Var30 == (_FILETIME)0x0) { + return DVar8; + } + piVar1 = (int *)((longlong)_Var30 + 8); + *piVar1 = *piVar1 + -1; + if (*piVar1 != 0) { + return DVar8; + } + plVar25 = *(longlong **)_Var30; + if (plVar25 == (longlong *)0x0) goto LAB_1; + if ((HANDLE)plVar25[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[1]); + plVar25[1] = 0; + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + if ((PTP_WAIT)plVar25[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar25[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar25[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar25[0x20]); + plVar25[0x20] = 0; + } + if ((HANDLE)plVar25[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[0x12]); + plVar25[0x12] = 0; + } + if ((HANDLE)plVar25[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[0x21]); + plVar25[0x21] = 0; + } + if (plVar25[0x23] != 0) { + if ((int)plVar25[0x22] != 0) { + do { + pvVar4 = *(HLOCAL *)(plVar25[0x23] + (longlong)puVar27 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar31 = (int)puVar27 + 1; + puVar27 = (undefined8 *)(ulonglong)uVar31; + } while (uVar31 < *(uint *)(plVar25 + 0x22)); + } + LocalFree((HLOCAL)plVar25[0x23]); + plVar25[0x23] = 0; + *(undefined4 *)(plVar25 + 0x22) = 0; + } + } + lVar22 = *plVar25; + plVar5 = *(longlong **)(lVar22 + -0x18); + if (*(int *)(lVar22 + -0x10) != 0) { + if (*(int *)(lVar22 + -8) < 0) { + if (*(int *)(lVar22 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar22 + -0x10) = 0; + *(undefined2 *)*plVar25 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + lVar22 = (**(code **)(*plVar5 + 0x18))(plVar5); + *plVar25 = lVar22 + 0x18; + } + } + puVar27 = (undefined8 *)plVar25[0x11]; + if (puVar27 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar27 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar23 = (CWorkerThread *)*puVar27; + if (pCVar23 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar23,1); + if (*(PTP_WORK *)(pCVar23 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar23 + 0x28)); + *(undefined8 *)(pCVar23 + 0x28) = 0; + *(undefined4 *)(pCVar23 + 0x30) = 1; + } + if (*(longlong **)(pCVar23 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar23 + 0x10) = 0; + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar23 + 8) + 0x28))(); + if (((iVar10 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 8) + 0x10))(); + *(undefined8 *)(pCVar23 + 8) = 0; + } + } + if (*(longlong **)pCVar23 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar23 + 0x10))(); + *(undefined8 *)pCVar23 = 0; + } + lVar22 = *(longlong *)(pCVar23 + 0x18); + local_578 = *(longlong **)(lVar22 + -0x18); + if (*(int *)(lVar22 + -0x10) != 0) { + if (*(int *)(lVar22 + -8) < 0) { + if (*(int *)(lVar22 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar22 + -0x10) = 0; + **(undefined2 **)(pCVar23 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + lVar22 = (**(code **)(*local_578 + 0x18))(); + *(longlong *)(pCVar23 + 0x18) = lVar22 + 0x18; + } + } + if (*(HANDLE *)(pCVar23 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar23 + 0x20)); + *(undefined8 *)(pCVar23 + 0x20) = 0; + } + lVar22 = *(longlong *)(pCVar23 + 0x18); + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar23 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 8) + 0x10))(); + } + if (*(longlong **)pCVar23 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar23 + 0x10))(); + } + operator_delete(pCVar23); + } + operator_delete(puVar27); + } + } + lVar22 = *plVar25; + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } } else { - local_res8.dwLowDateTime = 0; - local_res8.dwHighDateTime = 0; - GetSystemTimeAsFileTime(&local_res8); - *(_FILETIME *)(*(longlong *)*param_2 + 0x20) = local_res8; - _Var5 = *param_2; - lVar4 = *(longlong *)_Var5; - if (*(uint *)(lVar4 + 0x90) < 9) { - *(undefined4 *)(lVar4 + 0x90) = 0x1ff; - local_res10 = *param_2; - if (local_res10 != (_FILETIME)0x0) { - *(int *)((longlong)local_res10 + 8) = *(int *)((longlong)local_res10 + 8) + 1; - } - PublishProtectionState((CManagerThread *)_Var5,&local_res10); + BVar7 = SetHandleInformation(local_5a8,1,1); + if ((BVar7 == 0) || + (hReadPipe = CreateEventW(&local_530,1,0,(LPCWSTR)0x0), hReadPipe == (PHANDLE ******)0x0)) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + CloseHandle(local_5a8); + hReadPipe = local_590; + CloseHandle(local_590); + goto LAB_0; + } + pvVar11 = GetCurrentProcess(); + pvVar12 = GetCurrentProcess(); + pvVar13 = GetCurrentProcess(); + BVar7 = DuplicateHandle(pvVar13,pvVar12,pvVar11,&local_598,0x100000,1,0); + if (BVar7 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + CloseHandle(local_5a8); + CloseHandle(local_590); + CloseHandle(hReadPipe); + goto LAB_0; + } + local_588 = 0; + GetTokenInformation(*(HANDLE *)(*(longlong *)*param_2 + 8),TokenUser,(LPVOID)0x0,0,&local_588); + DVar8 = local_588; + TokenInformation = puVar27; + if (local_588 == 0) { +LAB_2: + DVar8 = 0x80004005; + CloseHandle(local_5a8); + CloseHandle(local_590); + CloseHandle(hReadPipe); + hReadPipe = local_598; + CloseHandle(local_598); + this = (CManagerThread *)local_5a0; + DVar28 = 0x80004005; + if (TokenInformation != (undefined8 *)0x0) { +LAB_3: + DVar8 = DVar28; + hReadPipe = GetProcessHeap(); + HeapFree(hReadPipe,0,TokenInformation); + this = (CManagerThread *)local_5a0; + } + goto LAB_0; + } + pvVar11 = GetProcessHeap(); + TokenInformation = HeapAlloc(pvVar11,0,(ulonglong)DVar8); + if (TokenInformation == (undefined8 *)0x0) goto LAB_2; + GetTokenInformation(*(HANDLE *)(*(longlong *)*param_2 + 8),TokenUser,TokenInformation,local_588, + &local_588); + BVar7 = IsValidSid((PSID)*TokenInformation); + if (BVar7 == 0) goto LAB_2; + DVar8 = GetLengthSid((PSID)*TokenInformation); + if ((0x43 < DVar8 - 1) || + (BVar7 = CopySid(0x44,(PSID)(*(longlong *)*param_2 + 0x98),(PSID)*TokenInformation), + BVar7 == 0)) { + DVar28 = GetLastError(); + if (DVar28 == 0) { + DVar28 = 0x7a; +LAB_4: + DVar28 = DVar28 & 0xffff | 0x80070000; + } + else { + DVar28 = GetLastError(); + if (0 < (int)DVar28) goto LAB_4; + } + *(undefined4 *)(*(longlong *)*param_2 + 0xdc) = 0; + CloseHandle(local_5a8); + CloseHandle(local_590); + CloseHandle(hReadPipe); + CloseHandle(local_598); + goto LAB_3; + } + *(DWORD *)(*(longlong *)*param_2 + 0xdc) = DVar8; + pvVar11 = GetProcessHeap(); + HeapFree(pvVar11,0,TokenInformation); + BVar7 = InitOnceExecuteOnce((PINIT_ONCE)&DAT_5,WorkerIfInitOnceCallback,(PVOID)0x0, + (LPVOID *)0x0); + DVar8 = DAT_6; + if ((BVar7 == 0) && (DVar8 = GetLastError(), 0 < (int)DVar8)) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + if ((int)DVar8 < 0) { +LAB_7: + *(undefined4 *)(*(longlong *)*param_2 + 0xdc) = 0; + CloseHandle(local_5a8); + hObject = local_590; +LAB_8: + CloseHandle(hObject); +LAB_9: + CloseHandle(hReadPipe); + hReadPipe = local_598; + CloseHandle(local_598); + this = (CManagerThread *)local_5a0; + goto LAB_0; + } + local_3d8[0] = 0; + if (((int)DAT_6 < 0) || (DAT_18002bf50 == 0)) { + DVar8 = 0x8007139f; + goto LAB_7; + } + lVar24 = 0x40; + lVar22 = 0x40; + psVar20 = local_3d8; + do { + if ((lVar22 == -0x7fffffbe) || + (sVar3 = *(short *)((longlong)psVar20 + ((longlong)&DAT_10 - (longlong)local_3d8)), + sVar3 == 0)) break; + *psVar20 = sVar3; + psVar20 = psVar20 + 1; + lVar22 = lVar22 + -1; + } while (lVar22 != 0); + psVar15 = psVar20 + -1; + if (lVar22 != 0) { + psVar15 = psVar20; + } + *psVar15 = 0; + DVar8 = 0x8007007a; + if (lVar22 == 0) goto LAB_7; + local_548 = 0; + do { + SystemFunction036(&local_548,8); + } while (local_548 == 0); + *(longlong *)(*(longlong *)*param_2 + 0xe0) = local_548; + *(undefined4 *)(*(longlong *)*param_2 + 0xe8) = 0; + *(undefined4 *)(*(longlong *)*param_2 + 0xec) = 0xff; + *(undefined8 *)(*(longlong *)*param_2 + 0xf0) = 0; + pCVar14 = SmartPtr::Pointer + ((SmartPtr *)param_2); + DVar8 = PopulateVolumeListForWorker_MSRC115612((longlong)pCVar14); + if ((((int)DVar8 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa5, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar8); + } + local_484[0] = 0; + local_484[1] = 0; + local_484[2] = 0; + local_484[3] = 0; + local_484[4] = 0; + local_484[5] = 0; + local_484[6] = 0; + local_484[7] = 0; + local_484[8] = 0; + local_484[9] = 0; + local_484[10] = 0; + local_484[0xb] = 0; + local_484[0xc] = 0; + local_484[0xd] = 0; + local_484[0xe] = 0; + local_484[0xf] = 0; + local_484[0x10] = 0; + local_484[0x11] = 0; + local_484[0x12] = 0; + local_484[0x13] = 0; + local_484[0x14] = 0; + local_484[0x15] = 0; + local_484[0x16] = 0; + local_484[0x17] = 0; + local_484[0x18] = 0; + local_484[0x19] = 0; + local_484[0x1a] = 0; + local_484[0x1b] = 0; + local_484[0x1c] = 0; + local_484[0x1d] = 0; + local_484[0x1e] = 0; + local_484[0x1f] = 0; + local_484[0x20] = 0; + local_484[0x21] = 0; + local_484[0x22] = 0; + local_484[0x23] = 0; + local_484[0x24] = 0; + local_484[0x25] = 0; + local_484[0x26] = 0; + local_484[0x27] = 0; + local_484[0x28] = 0; + local_484[0x29] = 0; + local_484[0x2a] = 0; + local_484[0x2b] = 0; + local_484[0x2c] = 0; + local_484[0x2d] = 0; + local_484[0x2e] = 0; + local_484[0x2f] = 0; + local_484[0x30] = 0; + local_484[0x31] = 0; + local_484[0x32] = 0; + local_484[0x33] = 0; + local_484[0x34] = 0; + local_484[0x35] = 0; + local_484[0x36] = 0; + local_484[0x37] = 0; + local_484[0x38] = 0; + local_484[0x39] = 0; + local_484[0x3a] = 0; + local_484[0x3b] = 0; + local_484[0x3c] = 0; + local_484[0x3d] = 0; + local_484[0x3e] = 0; + local_484[0x3f] = 0; + local_488 = 0x8c; + psVar20 = local_484; + do { + if ((lVar24 == -0x7fffffbe) || (psVar20[0x56] == 0)) break; + *psVar20 = psVar20[0x56]; + psVar20 = psVar20 + 1; + lVar24 = lVar24 + -1; + } while (lVar24 != 0); + psVar15 = psVar20 + -1; + if (lVar24 != 0) { + psVar15 = psVar20; + } + *psVar15 = 0; + local_404 = local_548; + local_568[0] = 0; + BVar7 = WriteFile(local_590,&local_488,0x8c,local_568,(LPOVERLAPPED)0x0); + puVar29 = &local_488; + for (lVar22 = 0x8c; lVar22 != 0; lVar22 = lVar22 + -1) { + *(undefined1 *)puVar29 = 0; + puVar29 = (undefined4 *)((longlong)puVar29 + 1); + } + if ((BVar7 == 0) || (local_568[0] != 0x8c)) { + DVar28 = GetLastError(); + if (DVar28 == 0) { + DVar8 = 0x1d; +LAB_11: + DVar8 = DVar8 & 0xffff | 0x80070000; + } + else { + DVar8 = GetLastError(); + if (0 < (int)DVar8) goto LAB_11; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa6, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar8); + } + CloseHandle(local_5a8); + hObject = local_590; + goto LAB_8; + } + CloseHandle(local_590); + local_590 = (PHANDLE ******)0x0; + pvVar11 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); + if (pvVar11 == (HANDLE)0x0) { + DVar8 = GetLastError(); + hObject = local_5a8; + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + goto LAB_8; + } + pvVar12 = GetCurrentProcess(); + pvVar13 = GetCurrentProcess(); + BVar7 = DuplicateHandle(pvVar13,pvVar11,pvVar12,&local_570,0,1,2); + if (BVar7 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + CloseHandle(pvVar11); + hObject = local_5a8; + goto LAB_8; + } + if (*(HANDLE *)(*(longlong *)*param_2 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(*(longlong *)*param_2 + 0x108)); + *(undefined8 *)(*(longlong *)*param_2 + 0x108) = 0; + } + *(HANDLE *)(*(longlong *)*param_2 + 0x108) = pvVar11; + CConfigDescriptor::UpdateRuntimePolicies + (*(CConfigDescriptor **)*param_2,(FhBackupType)local_578); + DVar8 = StringCchPrintfW((ushort *)local_358,0x184, + (ushort *)L"fhmanagew.exe -backupworker %u %u %Iu %Iu %Iu %Iu", + (ulonglong)local_578 & 0xffffffff); + *(undefined4 *)(*(longlong *)*param_2 + 0x54) = 0; + if ((int)DVar8 < 0) { + CloseHandle(local_5a8); + CloseHandle(hReadPipe); + CloseHandle(local_598); + hReadPipe = local_570; + CloseHandle(local_570); + local_570 = (PHANDLE ******)0x0; + this = (CManagerThread *)local_5a0; + goto LAB_0; + } + pvVar11 = *(HANDLE *)(*(longlong *)*param_2 + 8); + pvVar12 = (HANDLE)0x0; + local_540 = (HANDLE)0x0; + local_584 = 0; + BVar7 = GetTokenInformation(pvVar11,TokenLinkedToken,&local_540,8,&local_584); + if ((BVar7 == 0) || (local_540 == (HANDLE)0x0)) { + DVar9 = GetLastError(); + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa8, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar9); + } + } + else { + pvVar12 = local_540; + pvVar11 = local_540; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa7, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + } + local_560 = (HANDLE)0x0; + BVar7 = DuplicateTokenEx(pvVar11,0xf01ff,(LPSECURITY_ATTRIBUTES)0x0,SecurityImpersonation, + TokenPrimary,&local_560); + if (BVar7 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa9, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar8); + } + hObject = local_5a8; + if (pvVar12 != (HANDLE)0x0) { + CloseHandle(pvVar12); + hObject = local_5a8; + } + goto LAB_8; + } + if (pvVar12 != (HANDLE)0x0) { + CloseHandle(pvVar12); + } + local_538.LowPart = 0; + local_538.HighPart = 0; + local_580.LowPart = 0; + local_580.HighPart = 0; + BVar7 = LookupPrivilegeValueW((LPCWSTR)0x0,L"SeBackupPrivilege",&local_538); + if ((BVar7 != 0) && + (BVar7 = LookupPrivilegeValueW((LPCWSTR)0x0,L"SeRestorePrivilege",&local_580), BVar7 != 0)) { + local_3f8.PrivilegeCount = 2; + local_3f8.Privileges[0].Luid.LowPart = local_538.LowPart; + local_3f8.Privileges[0].Luid.HighPart = local_538.HighPart; + local_3f8.Privileges[0].Attributes = 2; + local_3e8 = local_580; + local_3e0 = 2; + BVar7 = AdjustTokenPrivileges(local_560,0,&local_3f8,0x1c,(PTOKEN_PRIVILEGES)0x0,(PDWORD)0x0); + if (BVar7 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + DVar9 = GetLastError(); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xaa, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar9); + } + } + else { + DVar9 = GetLastError(); + if (((DVar9 == 0x514) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xab, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + } + } + lpEnvironment = CreateSanitizedEnvironmentBlock_MSRC115612(local_560); + if (((lpEnvironment == (undefined2 *)0x0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + DVar9 = GetLastError(); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xac, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar9); + } + BVar7 = CreateProcessAsUserW + (local_560,(LPCWSTR)0x0,local_358,(LPSECURITY_ATTRIBUTES)0x0, + (LPSECURITY_ATTRIBUTES)0x0,1,0x8000400,lpEnvironment,(LPCWSTR)0x0,&local_4f8, + &local_518); + if (BVar7 == 0) { + DVar28 = GetLastError(); + } + CloseHandle(local_560); + CloseHandle(local_5a8); + local_5a8 = (PHANDLE ******)0x0; + if (lpEnvironment != (undefined2 *)0x0) { + DestroyEnvironmentBlock(lpEnvironment); + } + if (local_570 != (PHANDLE ******)0x0) { + CloseHandle(local_570); + local_570 = (PHANDLE ******)0x0; + } + if (BVar7 == 0) { + if (0 < (int)DVar28) { + DVar28 = DVar28 & 0xffff | 0x80070000; + } + DVar8 = DVar28; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xad, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,local_358); + } + goto LAB_9; + } + CloseHandle(local_518.hThread); + *(HANDLE *)(*(longlong *)*param_2 + 0x90) = local_518.hProcess; + CloseHandle(hReadPipe); + CloseHandle(local_598); + p_Var16 = CreateThreadpoolWait + (WorkerProcessExitCallback,*(PVOID *)((longlong)local_5a0 + 0xf8), + (PTP_CALLBACK_ENVIRON)0x0); + *(PTP_WAIT *)(*(longlong *)*param_2 + 0x100) = p_Var16; + pvVar11 = *(HANDLE *)*param_2; + ppuVar21 = *(undefined ***)((longlong)pvVar11 + 0x100); + if ((PTP_WAIT)ppuVar21 == (PTP_WAIT)0x0) { + ppuVar21 = &WPP_GLOBAL_Control; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + DVar28 = GetLastError(); + if (0 < (int)DVar28) { + DVar28 = DVar28 & 0xffff | 0x80070000; + } + pvVar11 = (HANDLE)0xae; + ppuVar21 = *(undefined ***)(WPP_GLOBAL_Control + 0x10); + WPP_SF_L(ppuVar21,0xae,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar28); + } + } + else { + pvVar11 = *(HANDLE *)((longlong)pvVar11 + 0x90); + SetThreadpoolWait((PTP_WAIT)ppuVar21,pvVar11,(PFILETIME)0x0); + } + if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { + McTemplateU0zq_EventWriteTransfer + (ppuVar21,pvVar11,(wchar_t *)**(undefined8 **)*param_2,(FhBackupType)local_578); + } + local_5a0.dwLowDateTime = 0; + local_5a0.dwHighDateTime = 0; + GetSystemTimeAsFileTime(&local_5a0); + *(_FILETIME *)(*(longlong *)*param_2 + 0x20) = local_5a0; + if (*(uint *)(*(longlong *)*param_2 + 0x120) < 9) { + *(undefined4 *)(*(longlong *)*param_2 + 0x120) = 0x1ff; + uVar17 = SmartPtr::SmartPtr + ((SmartPtr *)&local_550, + (SmartPtr *)param_2); + PublishProtectionState(pCVar32._0_4_,uVar17); + } + _Var30 = *param_2; + if (_Var30 == (_FILETIME)0x0) { + return DVar8; + } + piVar1 = (int *)((longlong)_Var30 + 8); + *piVar1 = *piVar1 + -1; + if (*piVar1 != 0) { + return DVar8; + } + plVar25 = *(longlong **)_Var30; + if (plVar25 == (longlong *)0x0) goto LAB_1; + if ((HANDLE)plVar25[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[1]); + plVar25[1] = 0; + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + if ((PTP_WAIT)plVar25[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar25[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar25[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar25[0x20]); + plVar25[0x20] = 0; + } + if ((HANDLE)plVar25[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[0x12]); + plVar25[0x12] = 0; + } + if ((HANDLE)plVar25[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar25[0x21]); + plVar25[0x21] = 0; + } + if (plVar25[0x23] != 0) { + if ((int)plVar25[0x22] != 0) { + do { + pvVar4 = *(HLOCAL *)(plVar25[0x23] + (longlong)puVar27 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar31 = (int)puVar27 + 1; + puVar27 = (undefined8 *)(ulonglong)uVar31; + } while (uVar31 < *(uint *)(plVar25 + 0x22)); + } + LocalFree((HLOCAL)plVar25[0x23]); + plVar25[0x23] = 0; + *(undefined4 *)(plVar25 + 0x22) = 0; + } + } + lVar22 = *plVar25; + plVar5 = *(longlong **)(lVar22 + -0x18); + if (*(int *)(lVar22 + -0x10) != 0) { + if (*(int *)(lVar22 + -8) < 0) { + if (*(int *)(lVar22 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar22 + -0x10) = 0; + *(undefined2 *)*plVar25 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + lVar22 = (**(code **)(*plVar5 + 0x18))(plVar5); + *plVar25 = lVar22 + 0x18; + } + } + puVar27 = (undefined8 *)plVar25[0x11]; + if (puVar27 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar27 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar23 = (CWorkerThread *)*puVar27; + if (pCVar23 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar23,1); + if (*(PTP_WORK *)(pCVar23 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar23 + 0x28)); + *(undefined8 *)(pCVar23 + 0x28) = 0; + *(undefined4 *)(pCVar23 + 0x30) = 1; + } + if (*(longlong **)(pCVar23 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar23 + 0x10) = 0; + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar23 + 8) + 0x28))(); + if (((iVar10 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 8) + 0x10))(); + *(undefined8 *)(pCVar23 + 8) = 0; + } + } + if (*(longlong **)pCVar23 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar23 + 0x10))(); + *(undefined8 *)pCVar23 = 0; + } + lVar22 = *(longlong *)(pCVar23 + 0x18); + local_578 = *(longlong **)(lVar22 + -0x18); + if (*(int *)(lVar22 + -0x10) != 0) { + if (*(int *)(lVar22 + -8) < 0) { + if (*(int *)(lVar22 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar22 + -0x10) = 0; + **(undefined2 **)(pCVar23 + 0x18) = 0; + } + else { + ATL::CStringData::Release((CStringData *)(lVar22 + -0x18)); + lVar22 = (**(code **)(*local_578 + 0x18))(); + *(longlong *)(pCVar23 + 0x18) = lVar22 + 0x18; + } + } + if (*(HANDLE *)(pCVar23 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar23 + 0x20)); + *(undefined8 *)(pCVar23 + 0x20) = 0; + } + lVar22 = *(longlong *)(pCVar23 + 0x18); + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar23 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar23 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar23 + 8) + 0x10))(); + } + if (*(longlong **)pCVar23 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar23 + 0x10))(); + } + operator_delete(pCVar23); + } + operator_delete(puVar27); + } + } + lVar22 = *plVar25; + LOCK(); + piVar1 = (int *)(lVar22 + -8); + iVar10 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar22 + -0x18) + 8))(); } } - if (*param_2 != (_FILETIME)0x0) { - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)*param_2); - } - return lVar6; + operator_delete(plVar25); +LAB_1: + operator_delete((void *)_Var30); + return DVar8; } ``` ## CConfigDescriptor::RefreshPoliciesInEngine ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.59| |i_ratio|0.5| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|RefreshPoliciesInEngine|RefreshPoliciesInEngine| |fullname|CConfigDescriptor::RefreshPoliciesInEngine|CConfigDescriptor::RefreshPoliciesInEngine| |`refcount`|5|6| |`length`|403|424| |`called`|WPP_SF_S
WPP_SF_SS
WPP_SF_Si
_guard_dispatch_icall$thunk$10345483385596137414|WPP_SF_S
WPP_SF_SS
WPP_SF_Si
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled| |calling|CManagerThread::QueueConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback|CManagerThread::QueueConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback| |paramcount|3|3| |`address`|180007db0|18000aa80| |sig|void __thiscall RefreshPoliciesInEngine(CConfigDescriptor * this, int param_1, int param_2)|void __thiscall RefreshPoliciesInEngine(CConfigDescriptor * this, int param_1, int param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CConfigDescriptor::RefreshPoliciesInEngine Called Diff ```diff --- CConfigDescriptor::RefreshPoliciesInEngine called +++ CConfigDescriptor::RefreshPoliciesInEngine called @@ -4,0 +5 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CConfigDescriptor::RefreshPoliciesInEngine Diff ```diff --- CConfigDescriptor::RefreshPoliciesInEngine +++ CConfigDescriptor::RefreshPoliciesInEngine @@ -1,84 +1,88 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: void __cdecl CConfigDescriptor::RefreshPoliciesInEngine(int,int) __ptr64 */ void __thiscall CConfigDescriptor::RefreshPoliciesInEngine(CConfigDescriptor *this,int param_1,int param_2) { longlong lVar1; longlong *plVar2; - wchar_t *pwVar3; - int iVar4; - uint uVar5; + bool bVar3; + wchar_t *pwVar4; + int iVar5; + uint uVar6; undefined4 in_register_00000084; - undefined *puVar6; - wchar_t *pwVar7; + undefined *puVar7; + wchar_t *pwVar8; - puVar6 = (undefined *)CONCAT44(in_register_00000084,param_2); - if ((*(longlong **)(this + 0x88) != (longlong *)0x0) && + puVar7 = (undefined *)CONCAT44(in_register_00000084,param_2); + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((!bVar3) && (*(longlong **)(this + 0x88) != (longlong *)0x0)) && (lVar1 = **(longlong **)(this + 0x88), lVar1 != 0)) { if (param_1 == 0) { if (param_2 == 0) { - uVar5 = 1; - pwVar3 = *(wchar_t **)(this + 0x78); + uVar6 = 1; + pwVar4 = *(wchar_t **)(this + 0x78); } else { - uVar5 = 3; - pwVar3 = *(wchar_t **)(this + 0x80); + uVar6 = 3; + pwVar4 = *(wchar_t **)(this + 0x80); } } else { - uVar5 = -(uint)(param_2 != 0) & 2; + uVar6 = -(uint)(param_2 != 0) & 2; if (param_2 == 0) { - pwVar3 = *(wchar_t **)(this + 0x68); + pwVar4 = *(wchar_t **)(this + 0x68); } else { - pwVar3 = *(wchar_t **)(this + 0x70); + pwVar4 = *(wchar_t **)(this + 0x70); } } - if (pwVar3 == (wchar_t *)0xffffffffffffffff) { + if (pwVar4 == (wchar_t *)0xffffffffffffffff) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - puVar6 = &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; + puVar7 = &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids; WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2d, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(lVar1 + 0x18)); + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,*(wchar_t **)(lVar1 + 0x18)); } } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - puVar6 = &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; + puVar7 = &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids; WPP_SF_Si(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(lVar1 + 0x18)); + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,*(wchar_t **)(lVar1 + 0x18)); } - *(uint *)(lVar1 + 0x48) = uVar5; + *(uint *)(lVar1 + 0x48) = uVar6; (**(code **)(**(longlong **)(lVar1 + 0x10) + 0x30))(); lVar1 = **(longlong **)(this + 0x88); if (param_1 == 0) { - iVar4 = *(int *)(this + 0x60); + iVar5 = *(int *)(this + 0x60); } else { - iVar4 = *(int *)(this + 0x5c); + iVar5 = *(int *)(this + 0x5c); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - if (iVar4 == 2) { - pwVar7 = L"IoPriorityHintNormal"; + if (iVar5 == 2) { + pwVar8 = L"IoPriorityHintNormal"; } else { - pwVar7 = L"IoPriorityHintLow"; - pwVar3 = L"IoPriorityHintVeryLow"; - if (iVar4 != 1) { - pwVar7 = L"IoPriorityHintVeryLow"; + pwVar8 = L"IoPriorityHintLow"; + pwVar4 = L"IoPriorityHintVeryLow"; + if (iVar5 != 1) { + pwVar8 = L"IoPriorityHintVeryLow"; } } - WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pwVar3,puVar6,pwVar7, + WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pwVar4,puVar7,pwVar8, *(wchar_t **)(lVar1 + 0x18)); } plVar2 = *(longlong **)(lVar1 + 0x10); - (**(code **)(*plVar2 + 0x28))(plVar2,iVar4); + (**(code **)(*plVar2 + 0x28))(plVar2,iVar5); } return; } ``` ## CManagerThread::QueueConfig ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.19| |i_ratio|0.18| |m_ratio|0.65| |b_ratio|0.48| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|QueueConfig|QueueConfig| |fullname|CManagerThread::QueueConfig|CManagerThread::QueueConfig| |refcount|3|3| |`length`|1994|4058| |`called`|
Expand for full list:
ADVAPI32.DLL::RegGetValueW
ADVAPI32.DLL::SetThreadToken
ATL::CSimpleStringT::CloneData
ATL::CSimpleStringT::~CSimpleStringT
ATL::CStringT_>_>::CStringT_>_>
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::ReloadPolicies
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::GetConfigDescriptor
CManagerThread::MapHrToProtectionState
CManagerThread::PublishProtectionStateCWorkerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::DuplicateHandle
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetCurrentProcess
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
WPP_SF_
WPP_SF_S
WPP_SF_Sd
WPP_SF_d
WPP_SF_dS
WPP_SF_dd
WPP_SF_i
WPP_SF_s
_guard_dispatch_icall$thunk$10345483385596137414
|
Expand for full list:
ADVAPI32.DLL::RegGetValueW
ADVAPI32.DLL::SetThreadToken
ATL::AtlThrowImpl
ATL::CSimpleStringT::CloneData
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::ReloadPolicies
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::GetConfigDescriptor
CManagerThread::MapHrToProtectionState
CManagerThread::PublishProtectionState
CWorkerThread::StopKERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::DuplicateHandle
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetCurrentProcess
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetEvent
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
MSVCRT.DLL::operator_delete
SmartPtr::SmartPtr
WPP_SF_
WPP_SF_L
WPP_SF_S
WPP_SF_Sd
WPP_SF_dS
WPP_SF_dd
WPP_SF_i
WPP_SF_s
_guard_dispatch_icall$thunk$10345483385596137414
operator!=
wil::details::FeatureImpl::__private_IsEnabled
| |calling|CManagerThread::QueueBackupForLoggedOnUser
FhSvcApiStartBackup|CManagerThread::QueueBackupForLoggedOnUser
FhSvcApiStartBackup| |paramcount|6|6| |`address`|180006cf0|180009a90| |sig|long __thiscall QueueConfig(CManagerThread * this, CStringT_>_> param_1, void * param_2, FhBackupType param_3, ulong param_4, int param_5)|long __thiscall QueueConfig(CManagerThread * this, CStringT_>_> param_1, void * param_2, FhBackupType param_3, ulong param_4, int param_5)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::QueueConfig Called Diff ```diff --- CManagerThread::QueueConfig called +++ CManagerThread::QueueConfig called @@ -2,0 +3 @@ +ATL::AtlThrowImpl @@ -4,2 +4,0 @@ -ATL::CSimpleStringT::~CSimpleStringT -ATL::CStringT_>_>::CStringT_>_> @@ -13,0 +13,2 @@ +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::CloseThreadpoolWork @@ -19,0 +21 @@ +KERNEL32.DLL::LocalFree @@ -21 +23,3 @@ -SmartPtr::RefCounter::Dec_nRefs +KERNEL32.DLL::SetThreadpoolWait +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks +MSVCRT.DLL::operator_delete @@ -23,0 +28 @@ +WPP_SF_L @@ -26 +30,0 @@ -WPP_SF_d @@ -31,0 +36,2 @@ +operator!= +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::QueueConfig Diff ```diff --- CManagerThread::QueueConfig +++ CManagerThread::QueueConfig @@ -1,329 +1,690 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CManagerThread::QueueConfig(class ATL::CStringT > >,void * __ptr64,enum FhBackupType,unsigned long,int) __ptr64 */ long __thiscall CManagerThread::QueueConfig - (CManagerThread *this,CSimpleStringT *param_2,HANDLE param_3,int param_4 - ,undefined4 param_5,int param_6) + (CManagerThread *this,CConfigDescriptor *param_2,HANDLE param_3,int param_4, + undefined4 param_5,int param_6) { int *piVar1; - longlong *plVar2; - longlong lVar3; - CWorkerThread *this_00; - DWORD DVar4; - BOOL BVar5; - LSTATUS LVar6; - int iVar7; - HANDLE pvVar8; + HLOCAL pvVar2; + longlong *plVar3; + undefined8 *puVar4; + CWorkerThread *pCVar5; + uint uVar6; + bool bVar7; + DWORD DVar8; + BOOL BVar9; + undefined4 uVar10; + LSTATUS LVar11; + int iVar12; + longlong lVar13; + HANDLE pvVar14; HANDLE hSourceProcessHandle; - undefined8 uVar9; - CManagerThread *pCVar10; - undefined2 uVar11; - CSimpleStringT *pCVar12; - RefCounter *this_01; - uint uVar13; - undefined4 uVar14; + CManagerThread *pCVar15; + undefined2 uVar16; + CConfigDescriptor *pCVar17; + ulonglong uVar18; + longlong *plVar19; + uint uVar20; + wchar_t *pwVar21; + longlong lVar22; CManagerThread *local_res8; - RefCounter *local_res18 [2]; + CConfigDescriptor *local_res10; + longlong *local_res18; longlong local_68; _FILETIME local_60; CStringData *local_58; - CStringT_>_> - local_48 [8]; - CStringT_>_> - local_40 [8]; + CStringData *local_50; + CStringData *local_48 [2]; - pCVar12 = param_2; - pvVar8 = param_3; + pCVar17 = param_2; + pvVar14 = param_3; local_res8 = this; + local_res10 = param_2; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); SmartPtr::SmartPtr - ((SmartPtr *)local_res18,(CConfigDescriptor *)pCVar12); + ((SmartPtr *)&local_res18,pCVar17); + uVar20 = 0; local_60.dwLowDateTime = 0; local_60.dwHighDateTime = 0; - uVar13 = 0; - local_res8 = (CManagerThread *)((ulonglong)local_res8 & 0xffffffff00000000); if (param_3 == (HANDLE)0x0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,"ImpersonationToken"); - } - if (local_res18[0] != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(local_res18[0]); + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,"ImpersonationToken"); + } + if (local_res18 != (longlong *)0x0) { + plVar19 = local_res18 + 1; + *(int *)plVar19 = (int)*plVar19 + -1; + if ((int)*plVar19 == 0) { + plVar19 = (longlong *)*local_res18; + if (plVar19 != (longlong *)0x0) { + if ((HANDLE)plVar19[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar19[1]); + plVar19[1] = 0; + } + uVar18 = 0; + bVar7 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + if ((PTP_WAIT)plVar19[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar19[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar19[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar19[0x20]); + plVar19[0x20] = 0; + } + if ((HANDLE)plVar19[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar19[0x12]); + plVar19[0x12] = 0; + } + if ((HANDLE)plVar19[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar19[0x21]); + plVar19[0x21] = 0; + } + if (plVar19[0x23] != 0) { + if ((int)plVar19[0x22] != 0) { + do { + pvVar2 = *(HLOCAL *)(plVar19[0x23] + uVar18 * 8); + if (pvVar2 != (HLOCAL)0x0) { + LocalFree(pvVar2); + } + uVar20 = (int)uVar18 + 1; + uVar18 = (ulonglong)uVar20; + } while (uVar20 < *(uint *)(plVar19 + 0x22)); + } + LocalFree((HLOCAL)plVar19[0x23]); + plVar19[0x23] = 0; + *(undefined4 *)(plVar19 + 0x22) = 0; + } + } + lVar13 = *plVar19; + plVar3 = *(longlong **)(lVar13 + -0x18); + if (*(int *)(lVar13 + -0x10) != 0) { + if (*(int *)(lVar13 + -8) < 0) { + if (*(int *)(lVar13 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar13 + -0x10) = 0; + *(undefined2 *)*plVar19 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + lVar13 = (**(code **)(*plVar3 + 0x18))(plVar3); + *plVar19 = lVar13 + 0x18; + } + } + puVar4 = (undefined8 *)plVar19[0x11]; + if (puVar4 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar4 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar5 = (CWorkerThread *)*puVar4; + if (pCVar5 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar5,1); + if (*(PTP_WORK *)(pCVar5 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar5 + 0x28)); + *(undefined8 *)(pCVar5 + 0x28) = 0; + *(undefined4 *)(pCVar5 + 0x30) = 1; + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar5 + 0x10) = 0; + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + iVar12 = (**(code **)(**(longlong **)(pCVar5 + 8) + 0x28))(); + if (((iVar12 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar12); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + *(undefined8 *)(pCVar5 + 8) = 0; + } + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + *(undefined8 *)pCVar5 = 0; + } + lVar13 = *(longlong *)(pCVar5 + 0x18); + plVar3 = *(longlong **)(lVar13 + -0x18); + if (*(int *)(lVar13 + -0x10) != 0) { + if (*(int *)(lVar13 + -8) < 0) { + if (*(int *)(lVar13 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar13 + -0x10) = 0; + **(undefined2 **)(pCVar5 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + lVar13 = (**(code **)(*plVar3 + 0x18))(plVar3); + *(longlong *)(pCVar5 + 0x18) = lVar13 + 0x18; + } + } + if (*(HANDLE *)(pCVar5 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar5 + 0x20)); + *(undefined8 *)(pCVar5 + 0x20) = 0; + } + lVar13 = *(longlong *)(pCVar5 + 0x18); + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + } + operator_delete(pCVar5); + } + operator_delete(puVar4); + } + } + lVar13 = *plVar19; + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + operator_delete(plVar19); + param_2 = local_res10; + } + operator_delete(local_res18); + } } LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); - ATL::CSimpleStringT::~CSimpleStringT(param_2); + lVar13 = *(longlong *)param_2; + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } return -0x7ff8ffa9; } if ((param_4 - 1U & 0xfffffffd) == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_dS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2e,pvVar8,param_4,*(wchar_t **)param_2) - ; + WPP_SF_dS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2e,pvVar14,param_4,*(wchar_t **)param_2 + ); } GetSystemTimeAsFileTime(&local_60); local_58 = ATL::CSimpleStringT::CloneData ((CStringData *)(*(longlong *)param_2 + -0x18)); local_58 = local_58 + 0x18; - DVar4 = GetConfigDescriptor(); - if ((int)DVar4 < 0) { - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; + DVar8 = GetConfigDescriptor(); + plVar19 = local_res18; + if ((int)DVar8 < 0) { + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_Sd(pCVar10,0x2f,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,*(wchar_t **)param_2 + pCVar15 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_Sd(pCVar15,0x2f,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)param_2 ); + plVar19 = local_res18; + uVar20 = 0; } goto LAB_1; } - if (*(HANDLE *)(*(longlong *)local_res18[0] + 8) != (HANDLE)0x0) { - CloseHandle(*(HANDLE *)(*(longlong *)local_res18[0] + 8)); - *(undefined8 *)(*(longlong *)local_res18[0] + 8) = 0; - } - lVar3 = *(longlong *)local_res18[0]; - pvVar8 = GetCurrentProcess(); + if (*(HANDLE *)(*local_res18 + 8) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(*local_res18 + 8)); + *(undefined8 *)(*plVar19 + 8) = 0; + } + lVar13 = *plVar19; + pvVar14 = GetCurrentProcess(); hSourceProcessHandle = GetCurrentProcess(); - BVar5 = DuplicateHandle(hSourceProcessHandle,param_3,pvVar8,(LPHANDLE)(lVar3 + 8),0,0,2); - if (BVar5 == 0) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; + BVar9 = DuplicateHandle(hSourceProcessHandle,param_3,pvVar14,(LPHANDLE)(lVar13 + 8),0,0,2); + if (BVar9 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; + uVar6 = uVar20; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (uVar6 = 0, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar16 = 0x30; + goto LAB_2; + } + goto LAB_3; + } + DVar8 = CConfigDescriptor::ReloadPolicies((CConfigDescriptor *)*plVar19); + uVar20 = DVar8 >> 0x1f; + if (DVar8 + 0x7ffbf9ff < 3) { + *(undefined4 *)(*plVar19 + 0x28) = 1; + local_50 = ATL::CSimpleStringT::CloneData + ((CStringData *)(*(longlong *)*plVar19 + -0x18)); + local_50 = local_50 + 0x18; + AddRemoveRegisteredConfig(&g_ManagerThread,&local_50,0); + } + pCVar17 = local_res10; + if ((int)DVar8 < 0) { + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_d(pCVar10,0x30,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar4); - } - uVar13 = (uint)local_res8; -LAB_2: - this_01 = local_res18[0]; - if (-1 < (int)DVar4) goto LAB_3; + uVar16 = 0x31; + pwVar21 = *(wchar_t **)local_res10; +LAB_4: + pCVar15 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_Sd(pCVar15,uVar16,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,pwVar21); + } goto LAB_1; } - DVar4 = CConfigDescriptor::ReloadPolicies(*(CConfigDescriptor **)local_res18[0]); - uVar13 = DVar4 >> 0x1f; - if (DVar4 + 0x7ffbf9ff < 3) { - *(undefined4 *)(*(longlong *)local_res18[0] + 0x28) = 1; - uVar9 = ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_48,*(CStringT_>_> - **)local_res18[0]); - AddRemoveRegisteredConfig(&g_ManagerThread,uVar9,0); - } - if ((int)DVar4 < 0) { - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; + *(undefined4 *)(*plVar19 + 0x28) = 0; + local_48[0] = ATL::CSimpleStringT::CloneData + ((CStringData *)(*(longlong *)local_res10 + -0x18)); + local_48[0] = local_48[0] + 0x18; + pCVar15 = &g_ManagerThread; + DVar8 = AddRemoveRegisteredConfig(&g_ManagerThread,local_48,1); + if ((int)DVar8 < 0) { + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar11 = 0x31; -LAB_4: - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_Sd(pCVar10,uVar11,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - *(wchar_t **)param_2); + uVar16 = 0x32; + pwVar21 = *(wchar_t **)pCVar17; + goto LAB_4; } goto LAB_1; } - uVar14 = 0; - *(undefined4 *)(*(longlong *)local_res18[0] + 0x28) = 0; - uVar9 = ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_40,(CStringT_>_> - *)param_2); - pCVar10 = &g_ManagerThread; - DVar4 = AddRemoveRegisteredConfig(&g_ManagerThread,uVar9,1); - if ((int)DVar4 < 0) { - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar11 = 0x32; - goto LAB_4; - } - goto LAB_1; - } + uVar10 = 0; if (param_4 != 1) { if (param_4 == 3) { - *(undefined4 *)(*(longlong *)local_res18[0] + 0x10) = 1; - lVar3 = *(longlong *)local_res18[0]; - if (*(int *)(lVar3 + 0x2c) == 0) { - if ((*(int *)(lVar3 + 0x18) == 0) && - (((*(longlong **)(lVar3 + 0x88) == (longlong *)0x0 || - (**(longlong **)(lVar3 + 0x88) == 0)) || (*(int *)(lVar3 + 0x58) != 3)))) { - *(undefined4 *)(lVar3 + 0x18) = 1; - if (param_6 == 0) { - uVar14 = 2; - } - *(undefined4 *)(*(longlong *)local_res18[0] + 0x50) = uVar14; - *(undefined4 *)(*(longlong *)local_res18[0] + 0x54) = param_5; - plVar2 = *(longlong **)(*(longlong *)local_res18[0] + 0x88); - if (((plVar2 != (longlong *)0x0) && (*plVar2 != 0)) && - (iVar7 = *(int *)(*(longlong *)local_res18[0] + 0x58), iVar7 - 1U < 2)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x37, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,iVar7); - } - uVar13 = 1; - } - } - else { + *(undefined4 *)(*plVar19 + 0x10) = 1; + lVar13 = *plVar19; + if (*(int *)(lVar13 + 0x2c) == 0) { + if ((*(int *)(lVar13 + 0x18) != 0) || + ((bVar7 = operator!=((SmartPtr *)(lVar13 + 0x88),lVar13), bVar7 && + (*(int *)(lVar13 + 0x58) == 3)))) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x34, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); } if (param_6 == 0) { - if (*(int *)(*(longlong *)local_res18[0] + 0x18) != 0) { + if (*(int *)(*plVar19 + 0x18) != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x35, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); - } - *(undefined4 *)(*(longlong *)local_res18[0] + 0x50) = 2; - } - plVar2 = *(longlong **)(*(longlong *)local_res18[0] + 0x88); - if (((plVar2 != (longlong *)0x0) && (*plVar2 != 0)) && - (*(int *)(*(longlong *)local_res18[0] + 0x58) == 3)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x36, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); - } - *(undefined4 *)(*(longlong *)local_res18[0] + 0x5c) = 2; - *(undefined4 *)(*(longlong *)local_res18[0] + 0x60) = 2; - CConfigDescriptor::RefreshPoliciesInEngine - (*(CConfigDescriptor **)local_res18[0],DAT_5,DAT_18001b9b8); - } + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + *(undefined4 *)(*plVar19 + 0x50) = 2; + } + bVar7 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (!bVar7) { + lVar13 = *plVar19; + bVar7 = operator!=((SmartPtr *)(lVar13 + 0x88),lVar13); + if ((bVar7) && (*(int *)(lVar13 + 0x58) == 3)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x36, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); + } + *(undefined4 *)(*plVar19 + 0x5c) = 2; + *(undefined4 *)(*plVar19 + 0x60) = 2; + CConfigDescriptor::RefreshPoliciesInEngine + ((CConfigDescriptor *)*plVar19,DAT_5,DAT_18002bdf8); + } + } + } + } + else { + *(undefined4 *)(lVar13 + 0x18) = 1; + if (param_6 == 0) { + uVar10 = 2; + } + *(undefined4 *)(*plVar19 + 0x50) = uVar10; + *(undefined4 *)(*plVar19 + 0x54) = param_5; + lVar22 = *plVar19; + bVar7 = operator!=((SmartPtr *)(lVar22 + 0x88),lVar13); + if ((bVar7) && (*(int *)(lVar22 + 0x58) - 1U < 2)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x37, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(int *)(lVar22 + 0x58)); + } + uVar20 = 1; } } goto LAB_6; } - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_S(pCVar10,0x33,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - *(wchar_t **)param_2); - } - DVar4 = 0x80040600; + pCVar15 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_S(pCVar15,0x33,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + *(wchar_t **)pCVar17); + } + DVar8 = 0x80040600; } else { - DVar4 = 0x80070057; - pCVar10 = pCVar10; + DVar8 = 0x80070057; + pCVar15 = pCVar15; } goto LAB_1; } - *(undefined4 *)(*(longlong *)local_res18[0] + 0x10) = 1; + *(undefined4 *)(*plVar19 + 0x10) = 1; LAB_6: - lVar3 = *(longlong *)local_res18[0]; - if ((*(int *)(lVar3 + 0x94) == 0) && (*(int *)(lVar3 + 0x98) == 0)) { + lVar13 = *plVar19; + if ((*(int *)(lVar13 + 0x124) == 0) && (*(int *)(lVar13 + 0x128) == 0)) { local_68 = 0; local_res8 = (CManagerThread *)CONCAT44(local_res8._4_4_,8); - BVar5 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)(lVar3 + 8)); - if (BVar5 == 0) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_2; - uVar11 = 0x38; + BVar9 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)(lVar13 + 8)); + uVar6 = uVar20; + if (BVar9 == 0) { + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar16 = 0x38; +LAB_2: + pCVar15 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_L(pCVar15,uVar16,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar8); + uVar6 = uVar20; + } } else { - LVar6 = RegGetValueW((HKEY)0xffffffff80000001, - L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\FileHistory", - L"ProtectedUpToTime",0x20000040,(LPDWORD)0x0,&local_68, - (LPDWORD)&local_res8); - if (LVar6 == 0) { - if ((uint)local_res8 != 8) { -LAB_7: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x39, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - "(ret == ERROR_SUCCESS && dataSize == sizeof(data)) || (ret == ERROR_FILE_NOT_FOUND)" - ); - } - } - } - else if (LVar6 != 2) goto LAB_7; + LVar11 = RegGetValueW((HKEY)0xffffffff80000001, + L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\FileHistory", + L"ProtectedUpToTime",0x20000040,(LPDWORD)0x0,&local_68, + (LPDWORD)&local_res8); + if (LVar11 == 0) { + bVar7 = (int)local_res8 == 8; + } + else { + bVar7 = LVar11 == 2; + } + if (((!bVar7) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x39, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + "(ret == ERROR_SUCCESS && dataSize == sizeof(data)) || (ret == ERROR_FILE_NOT_FOUND)" + ); + } if (local_68 != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_i(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3a,local_68,local_68); } - *(int *)(*(longlong *)local_res18[0] + 0x94) = (int)local_68; - *(int *)(*(longlong *)local_res18[0] + 0x98) = (int)((ulonglong)local_68 >> 0x20); - } - BVar5 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); - if (BVar5 != 0) goto LAB_8; - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_2; - uVar11 = 0x3b; - } - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_d(pCVar10,uVar11,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar4); - goto LAB_2; - } -LAB_8: - if (*(uint *)(*(longlong *)local_res18[0] + 0x90) < 9) { - *(undefined4 *)(*(longlong *)local_res18[0] + 0x90) = 0xff; + *(int *)(*plVar19 + 0x124) = (int)local_68; + *(int *)(*plVar19 + 0x128) = (int)((ulonglong)local_68 >> 0x20); + } + BVar9 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); + if (BVar9 != 0) goto LAB_7; + DVar8 = GetLastError(); + if (0 < (int)DVar8) { + DVar8 = DVar8 & 0xffff | 0x80070000; + } + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar16 = 0x3b; + goto LAB_2; + } + } +LAB_3: + uVar20 = uVar6; + if (-1 < (int)DVar8) goto LAB_8; + goto LAB_1; + } +LAB_7: + if (*(uint *)(*plVar19 + 0x120) < 9) { + *(undefined4 *)(*plVar19 + 0x120) = 0xff; } } else { - DVar4 = 0x80070057; - pCVar10 = (CManagerThread *)WPP_GLOBAL_Control; + DVar8 = 0x80070057; + pCVar15 = (CManagerThread *)WPP_GLOBAL_Control; + plVar19 = local_res18; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pCVar10 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_dd(pCVar10,0x2d,pvVar8,param_4); + pCVar15 = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_dd(pCVar15,0x2d,pvVar14,param_4); + plVar19 = local_res18; } LAB_1: - this_01 = local_res18[0]; - if ((((local_res18[0] == (RefCounter *)0x0) || (lVar3 = *(longlong *)local_res18[0], lVar3 == 0) - ) || ((*(longlong **)(lVar3 + 0x88) != (longlong *)0x0 && - (**(longlong **)(lVar3 + 0x88) != 0)))) || - (iVar7 = MapHrToProtectionState(pCVar10,DVar4,(ulong *)(lVar3 + 0x90)), iVar7 == 0)) - goto LAB_3; + if ((((plVar19 == (longlong *)0x0) || (lVar13 = *plVar19, lVar13 == 0)) || + ((*(longlong **)(lVar13 + 0x88) != (longlong *)0x0 && (**(longlong **)(lVar13 + 0x88) != 0)) + )) || (iVar12 = MapHrToProtectionState(pCVar15,DVar8,(ulong *)(lVar13 + 0x120)), iVar12 == 0 + )) goto LAB_8; } - *(int *)(local_res18[0] + 8) = *(int *)(local_res18[0] + 8) + 1; + *(int *)(plVar19 + 1) = (int)plVar19[1] + 1; PublishProtectionState(); - this_01 = local_res18[0]; -LAB_3: - if (((uVar13 != 0) && (*(undefined8 **)(*(longlong *)this_01 + 0x88) != (undefined8 *)0x0)) && - (this_00 = (CWorkerThread *)**(undefined8 **)(*(longlong *)this_01 + 0x88), - this_00 != (CWorkerThread *)0x0)) { - CWorkerThread::Stop(this_00,0); +LAB_8: + if (((uVar20 != 0) && (*(undefined8 **)(*plVar19 + 0x88) != (undefined8 *)0x0)) && + (pCVar5 = (CWorkerThread *)**(undefined8 **)(*plVar19 + 0x88), pCVar5 != (CWorkerThread *)0x0)) + { + CWorkerThread::Stop(pCVar5,0); + } + bVar7 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar7) && (uVar20 != 0)) && + (((plVar19 != (longlong *)0x0 && + ((lVar13 = *plVar19, lVar13 != 0 && (*(longlong *)(lVar13 + 0x90) != 0)))) && + (*(HANDLE *)(lVar13 + 0x108) != (HANDLE)0x0)))) { + SetEvent(*(HANDLE *)(lVar13 + 0x108)); } SetEvent(DAT_9); - if (this_01 != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(this_01); + if (plVar19 != (longlong *)0x0) { + plVar3 = plVar19 + 1; + *(int *)plVar3 = (int)*plVar3 + -1; + if ((int)*plVar3 == 0) { + plVar3 = (longlong *)*plVar19; + if (plVar3 != (longlong *)0x0) { + if ((HANDLE)plVar3[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[1]); + plVar3[1] = 0; + } + uVar18 = 0; + bVar7 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar7) { + if ((PTP_WAIT)plVar3[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar3[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar3[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar3[0x20]); + plVar3[0x20] = 0; + } + if ((HANDLE)plVar3[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x12]); + plVar3[0x12] = 0; + } + if ((HANDLE)plVar3[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x21]); + plVar3[0x21] = 0; + } + if (plVar3[0x23] != 0) { + if ((int)plVar3[0x22] != 0) { + do { + pvVar2 = *(HLOCAL *)(plVar3[0x23] + uVar18 * 8); + if (pvVar2 != (HLOCAL)0x0) { + LocalFree(pvVar2); + } + uVar20 = (int)uVar18 + 1; + uVar18 = (ulonglong)uVar20; + } while (uVar20 < *(uint *)(plVar3 + 0x22)); + } + LocalFree((HLOCAL)plVar3[0x23]); + plVar3[0x23] = 0; + *(undefined4 *)(plVar3 + 0x22) = 0; + } + } + lVar13 = *plVar3; + plVar19 = *(longlong **)(lVar13 + -0x18); + if (*(int *)(lVar13 + -0x10) != 0) { + if (*(int *)(lVar13 + -8) < 0) { + if (*(int *)(lVar13 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar13 + -0x10) = 0; + *(undefined2 *)*plVar3 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + lVar13 = (**(code **)(*plVar19 + 0x18))(plVar19); + *plVar3 = lVar13 + 0x18; + } + } + puVar4 = (undefined8 *)plVar3[0x11]; + if (puVar4 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar4 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar5 = (CWorkerThread *)*puVar4; + if (pCVar5 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar5,1); + if (*(PTP_WORK *)(pCVar5 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar5 + 0x28)); + *(undefined8 *)(pCVar5 + 0x28) = 0; + *(undefined4 *)(pCVar5 + 0x30) = 1; + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar5 + 0x10) = 0; + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + iVar12 = (**(code **)(**(longlong **)(pCVar5 + 8) + 0x28))(); + if (((iVar12 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar12); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + *(undefined8 *)(pCVar5 + 8) = 0; + } + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + *(undefined8 *)pCVar5 = 0; + } + lVar13 = *(longlong *)(pCVar5 + 0x18); + plVar19 = *(longlong **)(lVar13 + -0x18); + if (*(int *)(lVar13 + -0x10) != 0) { + if (*(int *)(lVar13 + -8) < 0) { + if (*(int *)(lVar13 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar13 + -0x10) = 0; + **(undefined2 **)(pCVar5 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + lVar13 = (**(code **)(*plVar19 + 0x18))(plVar19); + *(longlong *)(pCVar5 + 0x18) = lVar13 + 0x18; + } + } + if (*(HANDLE *)(pCVar5 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar5 + 0x20)); + *(undefined8 *)(pCVar5 + 0x20) = 0; + } + lVar13 = *(longlong *)(pCVar5 + 0x18); + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + } + operator_delete(pCVar5); + } + operator_delete(puVar4); + } + } + lVar13 = *plVar3; + LOCK(); + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); + } + operator_delete(plVar3); + plVar19 = local_res18; + } + operator_delete(plVar19); + } } LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); - lVar3 = *(longlong *)param_2; + lVar13 = *(longlong *)local_res10; LOCK(); - piVar1 = (int *)(lVar3 + -8); - iVar7 = *piVar1; + piVar1 = (int *)(lVar13 + -8); + iVar12 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); - if (iVar7 < 2) { - (**(code **)(**(longlong **)(lVar3 + -0x18) + 8))(); + if (iVar12 < 2) { + (**(code **)(**(longlong **)(lVar13 + -0x18) + 8))(); } - return DVar4; + return DVar8; } ``` ## CFhService::StartServiceW ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,calling,called| |ratio|0.11| |i_ratio|0.19| |m_ratio|0.92| |b_ratio|0.37| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|StartServiceW|StartServiceW| |fullname|CFhService::StartServiceW|CFhService::StartServiceW| |refcount|2|2| |`length`|1583|1908| |`called`|
Expand for full list:
ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegGetValueW
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegisterServiceCtrlHandlerExW
CFhService::ReportStatus
CFhService::SetServiceStartType
CFhService::ShutdownService
CManagerThread::QueueBackupForLoggedOnUser
CManagerThread::Start
KERNEL32.DLL::CreateEventW
KERNEL32.DLL::GetLastErrorPOWRPROF.DLL::PowerSettingRegisterNotification
RpcRegisterServer
WPP_SF_
WPP_SF_cd
WPP_SF_d
WTSAPI32.DLL::WTSEnumerateSessionsW
WTSAPI32.DLL::WTSFreeMemory
_guard_dispatch_icall$thunk$10345483385596137414
|
Expand for full list:
ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegGetValueW
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegisterServiceCtrlHandlerExW
ADVAPI32.DLL::SetServiceStatus
CFhService::SetServiceStartType
CFhService::ShutdownService
CManagerThread::QueueBackupForAllLoggedOnUsers
CManagerThread::Start
KERNEL32.DLL::CreateEventW
KERNEL32.DLL::GetLastErrorKERNEL32.DLL::InitOnceInitialize
POWRPROF.DLL::PowerSettingRegisterNotification
RpcRegisterServer
WPP_SF_
WPP_SF_L
WPP_SF_Sddd
WPP_SF_cd
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |`calling`||ServiceMain| |paramcount|1|1| |`address`|1800017f0|1800070a0| |sig|long __thiscall StartServiceW(CFhService * this)|long __thiscall StartServiceW(CFhService * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CFhService::StartServiceW Called Diff ```diff --- CFhService::StartServiceW called +++ CFhService::StartServiceW called @@ -5 +5 @@ -CFhService::ReportStatus +ADVAPI32.DLL::SetServiceStatus @@ -8 +8 @@ -CManagerThread::QueueBackupForLoggedOnUser +CManagerThread::QueueBackupForAllLoggedOnUsers @@ -11,0 +12 @@ +KERNEL32.DLL::InitOnceInitialize @@ -14,0 +16,2 @@ +WPP_SF_L +WPP_SF_Sddd @@ -16,3 +18,0 @@ -WPP_SF_d -WTSAPI32.DLL::WTSEnumerateSessionsW -WTSAPI32.DLL::WTSFreeMemory @@ -19,0 +20 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CFhService::StartServiceW Calling Diff ```diff --- CFhService::StartServiceW calling +++ CFhService::StartServiceW calling @@ -0,0 +1 @@ +ServiceMain ``` ### CFhService::StartServiceW Diff ```diff --- CFhService::StartServiceW +++ CFhService::StartServiceW @@ -1,266 +1,318 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* public: long __cdecl CFhService::StartServiceW(void) __ptr64 */ long __thiscall CFhService::StartServiceW(CFhService *this) { - DWORD DVar1; - int iVar2; - LSTATUS LVar3; - CManagerThread *this_00; - CFhService *this_01; - undefined2 uVar4; - uint uVar5; - ulonglong uVar6; - uint uVar7; - ulong uVar8; - SERVICE_STATUS_HANDLE pSVar9; - undefined *puVar10; + bool bVar1; + DWORD DVar2; + BOOL BVar3; + int iVar4; + LSTATUS LVar5; + FeatureImpl *this_00; + CManagerThread *this_01; + undefined2 uVar6; + code *pcVar7; + void *pvVar8; + ulonglong uVar9; + CFhService *pCVar10; + SERVICE_STATUS_HANDLE pSVar11; + wchar_t *pwVar12; CFhService *local_res8; - DWORD local_res10 [2]; - undefined4 local_res18 [2]; - HKEY local_res20; - CFhService *local_38 [3]; + undefined4 local_res10 [2]; + CManagerThread *local_res18 [2]; - uVar6 = 0; - local_res20 = (HKEY)0x0; + local_res18[0] = (CManagerThread *)0x0; local_res8 = this; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),10, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids); } if (DAT_0 == 0) { - DVar1 = 0x8000ffff; + DVar2 = 0x8000ffff; if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - DVar1 = 0x8000ffff; + DVar2 = 0x8000ffff; if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,0x8000ffff); - DVar1 = 0x8000ffff; - } - goto LAB_1; + uVar6 = 0xb; + DVar2 = 0x8000ffff; + goto LAB_1; + } + goto LAB_2; + } + goto LAB_3; + } + _DAT_4 = 0; + _DAT_5 = 0; + _DAT_6 = 0; + _DAT_7 = 0; + _DAT_8 = 0x30; + _DAT_9 = 0; + _DAT_10 = 1; + _DAT_11 = 2; + pCVar10 = (CFhService *)0x0; + pcVar7 = (code *)0x1; + DAT_12 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); + if (DAT_12 == (HANDLE)0x0) { + DVar2 = GetLastError(); + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = 0xc; +LAB_13: + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,DVar2); + } +LAB_14: + if (-1 < (int)DVar2) { +LAB_15: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x17, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids); + } + goto LAB_16; + } +LAB_2: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x16, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids); } } else { - uRam000000018001b890 = 0; - _DAT_2 = 0; - _DAT_3 = 0; - _DAT_4 = 0x100000030; - _DAT_5 = 2; - uVar8 = 0; - DAT_6 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); - if (DAT_6 == (HANDLE)0x0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } + if (DAT_17 == 0) { + pCVar10 = &g_Service; + pcVar7 = ServiceControlHandler; + _g_Service = RegisterServiceCtrlHandlerExW(L"fhsvc",ServiceControlHandler,&g_Service); + if (_g_Service == (SERVICE_STATUS_HANDLE)0x0) { + DVar2 = GetLastError(); + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = 0xd; + goto LAB_13; + } + goto LAB_14; + } + } + DVar2 = 0; + if (DAT_17 == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar4 = 0xc; -LAB_7: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar4, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,DVar1); - } -LAB_8: - if (-1 < (int)DVar1) { -LAB_9: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x16, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - goto LAB_10; - } -LAB_1: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x15, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - } - else { - if (DAT_11 == 0) { - uVar8 = 0x8001b880; - _g_Service = RegisterServiceCtrlHandlerExW(L"fhsvc",ServiceControlHandler,&g_Service); - if (_g_Service == (SERVICE_STATUS_HANDLE)0x0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_Sddd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pcVar7,pCVar10, + L"SERVICE_START_PENDING"); + } + if (_g_Service != (SERVICE_STATUS_HANDLE)0x0) { + _DAT_8 = 0x20; + _DAT_5 = 0; + _DAT_6 = 0; + _DAT_10 = 2; + _DAT_4 = 0; + _DAT_7 = 1; + _DAT_9 = 10000; + BVar3 = SetServiceStatus(_g_Service,(LPSERVICE_STATUS)&DAT_8); + DVar2 = 0; + if (BVar3 == 0) { + DVar2 = GetLastError(); + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar4 = 0xd; - goto LAB_7; - } - goto LAB_8; - } - } - DVar1 = ReportStatus(&g_Service,2,uVar8,1,10000); - if ((int)DVar1 < 0) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x31, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,DVar2); + } + } + goto LAB_18; + } + DVar2 = 0x8000ffff; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_3; + DVar2 = 0x8000ffff; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2f, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,0x8000ffff); + } +LAB_19: + if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + uVar6 = 0xe; +LAB_1: + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,DVar2); + } + goto LAB_2; + } + } + else { +LAB_18: + if ((int)DVar2 < 0) goto LAB_19; + pSVar11 = _g_Service; + iVar4 = PowerSettingRegisterNotification(&GUID_LOW_POWER_EPOCH,1,_g_Service,&DAT_20); + if (iVar4 != 0) { + DVar2 = GetLastError(); + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = 0xf; + goto LAB_13; + } + goto LAB_14; + } + this_00 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + this_00 = (FeatureImpl *)&DAT_21; + InitOnceInitialize((PINIT_ONCE)&DAT_21); + DAT_22 = 0x8007139f; + DAT_23 = 0; + } + pvVar8 = DAT_12; + DVar2 = CManagerThread::Start((CManagerThread *)this_00,DAT_12); + if ((int)DVar2 < 0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_3; + if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) goto LAB_2; + uVar6 = 0x11; + goto LAB_1; + } + DVar2 = RpcRegisterServer(); + if ((int)DVar2 < 0) { if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar4 = 0xe; - goto LAB_12; - } - goto LAB_1; + uVar6 = 0x12; + goto LAB_1; + } + goto LAB_2; + } + goto LAB_3; + } + DVar2 = 0; + if (DAT_17 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_Sddd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pvVar8,pSVar11,L"SERVICE_RUNNING"); + } + if (_g_Service != (SERVICE_STATUS_HANDLE)0x0) { + _DAT_8 = 0x20; + _DAT_5 = 0; + _DAT_6 = 0; + _DAT_10 = 4; + _DAT_7 = 0; + _DAT_9 = 0; + _DAT_4 = 0x4c5; + BVar3 = SetServiceStatus(_g_Service,(LPSERVICE_STATUS)&DAT_8); + DVar2 = 0; + if (BVar3 == 0) { + DVar2 = GetLastError(); + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x31, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,DVar2); + } + } + goto LAB_24; + } + DVar2 = 0x8000ffff; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_3; + DVar2 = 0x8000ffff; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2f, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,0x8000ffff); } } else { - this_00 = (CManagerThread *)&GUID_LOW_POWER_EPOCH; - pSVar9 = _g_Service; - iVar2 = PowerSettingRegisterNotification(&GUID_LOW_POWER_EPOCH,1); - uVar8 = (ulong)pSVar9; - if (iVar2 != 0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar4 = 0xf; - goto LAB_7; - } - goto LAB_8; - } - DVar1 = CManagerThread::Start(this_00,DAT_6); - if ((int)DVar1 < 0) { - if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) goto LAB_13; - if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) goto LAB_1; - uVar4 = 0x10; -LAB_12: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar4, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,DVar1); - goto LAB_1; - } - DVar1 = RpcRegisterServer(); - if ((int)DVar1 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar4 = 0x11; - goto LAB_12; - } - goto LAB_1; - } - } - else { - DVar1 = ReportStatus(&g_Service,4,uVar8,0,0); - if ((int)DVar1 < 0) { +LAB_24: + if (-1 < (int)DVar2) { + pwVar12 = (wchar_t *)0x0; + this_01 = (CManagerThread *)0xffffffff80000002; + LVar5 = RegOpenKeyExW((HKEY)0xffffffff80000002, + L"System\\CurrentControlSet\\Services\\fhsvc\\Parameters",0,0x20019, + (PHKEY)local_res18); + if (LVar5 == 0) { + local_res10[0] = 0; + local_res8 = (CFhService *)CONCAT44(local_res8._4_4_,4); + pwVar12 = L"TestFlags"; + LVar5 = RegGetValueW((HKEY)local_res18[0],(LPCWSTR)0x0,L"TestFlags",0x10,(LPDWORD)0x0, + local_res10,(LPDWORD)&local_res8); + if ((LVar5 == 0) && ((int)local_res8 == 4)) { + _DAT_25 = local_res10[0]; + } + this_01 = local_res18[0]; + if (local_res18[0] != (CManagerThread *)0x0) { + RegCloseKey((HKEY)local_res18[0]); + local_res18[0] = (CManagerThread *)0x0; + } + } + CManagerThread::QueueBackupForAllLoggedOnUsers(this_01); + uVar9 = (ulonglong)(DAT_26 == 0); + DVar2 = SetServiceStartType((CFhService *)this_01,(uint)(DAT_26 == 0)); + if ((int)DVar2 < 0) { if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar4 = 0x12; - goto LAB_12; + WPP_SF_cd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar9,pwVar12, + DAT_26 != 0); } - goto LAB_1; - } + goto LAB_2; + } + goto LAB_3; + } + DVar2 = (**(code **)(DAT_0 + 0xc0)) + (&DAT_27,L"fhsvc",DAT_18002bcf0,StopServiceCallback,&g_Service,8) + ; + if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if (-1 < (int)DVar2) { +LAB_28: + LOCK(); + _DAT_11 = _DAT_11 & 0xfffffffd; + UNLOCK(); + goto LAB_15; + } + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) { + if (-1 < (int)DVar2) goto LAB_28; } else { - LVar3 = RegOpenKeyExW((HKEY)0xffffffff80000002, - L"System\\CurrentControlSet\\Services\\fhsvc\\Parameters",0, - 0x20019,&local_res20); - if (LVar3 == 0) { - local_res18[0] = 0; - local_res10[0] = 4; - LVar3 = RegGetValueW(local_res20,(LPCWSTR)0x0,L"TestFlags",0x10,(LPDWORD)0x0, - local_res18,local_res10); - if ((LVar3 == 0) && (local_res10[0] == 4)) { - _DAT_14 = local_res18[0]; - } - if (local_res20 != (HKEY)0x0) { - RegCloseKey(local_res20); - local_res20 = (HKEY)0x0; - } - } - local_38[0] = (CFhService *)0x0; - local_res8 = (CFhService *)((ulonglong)local_res8 & 0xffffffff00000000); - puVar10 = (undefined *)0x1; - iVar2 = WTSEnumerateSessionsW(0,0,1,local_38,&local_res8); - if (iVar2 == 0) { - DVar1 = GetLastError(); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - puVar10 = &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x65, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar1); - } - } - else { - uVar5 = (uint)local_res8; - if ((uint)local_res8 != 0) { - do { - if (*(int *)(local_38[0] + uVar6 * 0x18 + 0x10) == 0) { - CManagerThread::QueueBackupForLoggedOnUser - ((CManagerThread *)(uVar6 * 3),*(ulong *)(local_38[0] + uVar6 * 0x18)) - ; - uVar5 = (uint)local_res8; - } - uVar7 = (int)uVar6 + 1; - uVar6 = (ulonglong)uVar7; - } while (uVar7 < uVar5); - } - } - this_01 = local_38[0]; - if (local_38[0] != (CFhService *)0x0) { - WTSFreeMemory(); - } - uVar6 = (ulonglong)(DAT_15 == 0); - DVar1 = SetServiceStartType(this_01,(uint)(DAT_15 == 0)); - if ((int)DVar1 < 0) { - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - WPP_SF_cd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6,puVar10, - DAT_15 != 0); - } - goto LAB_1; - } - } - else { - DVar1 = (**(code **)(DAT_0 + 0xc0)) - (&DAT_16,L"fhsvc",DAT_18001b8b0,StopServiceCallback, - &g_Service,8); - if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if (-1 < (int)DVar1) { -LAB_17: - LOCK(); - _DAT_5 = _DAT_5 & 0xfffffffd; - UNLOCK(); - goto LAB_9; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) { - if (-1 < (int)DVar1) goto LAB_17; - } - else { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x32, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,DVar1); - } - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - uVar4 = 0x14; - goto LAB_12; - } - goto LAB_1; - } - } - } - } - } - } - } -LAB_13: + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x33, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids,DVar2); + } + if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { + if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) goto LAB_2; + uVar6 = 0x15; + goto LAB_1; + } + goto LAB_3; + } + } + if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { + if ((WPP_GLOBAL_Control[0x1c] & 1) == 0) goto LAB_2; + uVar6 = 0x13; + goto LAB_1; + } + } + } +LAB_3: ShutdownService(&g_Service); -LAB_10: - if (local_res20 != (HKEY)0x0) { - RegCloseKey(local_res20); - } - return DVar1; +LAB_16: + if (local_res18[0] != (CManagerThread *)0x0) { + RegCloseKey((HKEY)local_res18[0]); + } + return DVar2; } ``` ## CManagerThread::StopConfig ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.12| |i_ratio|0.06| |m_ratio|0.37| |b_ratio|0.1| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|StopConfig|StopConfig| |fullname|CManagerThread::StopConfig|CManagerThread::StopConfig| |refcount|3|3| |`length`|818|3742| |`called`|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CStringT_>_>::CStringT_>_>
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::GetConfigDescriptor
CWorkerThread::Stop
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
OLEAUT32.DLL::Ordinal_6
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtrWPP_SF_Sd
WPP_SF_d
_guard_dispatch_icall$thunk$10345483385596137414
|
Expand for full list:
ATL::AtlComPtrAssign
ATL::AtlThrowImpl
ATL::CSimpleStringT::CloneData
ATL::CSimpleStringT::Empty
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::GetConfigDescriptor
CWorkerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::EnterCriticalSectionKERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetEvent
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
MSVCRT.DLL::operator_delete
OLEAUT32.DLL::Ordinal_6
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
WPP_SF_L
WPP_SF_Sd
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |calling|CManagerThread::SetBackupMoratorium
FhSvcApiStopBackup|CManagerThread::SetBackupMoratorium
FhSvcApiStopBackup| |paramcount|3|3| |`address`|1800069b0|18000b610| |sig|long __thiscall StopConfig(CManagerThread * this, CStringT_>_> param_1, int param_2)|long __thiscall StopConfig(CManagerThread * this, CStringT_>_> param_1, int param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::StopConfig Called Diff ```diff --- CManagerThread::StopConfig called +++ CManagerThread::StopConfig called @@ -1,2 +1,4 @@ -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum -ATL::CStringT_>_>::CStringT_>_> +ATL::AtlComPtrAssign +ATL::AtlThrowImpl +ATL::CSimpleStringT::CloneData +ATL::CSimpleStringT::Empty @@ -5,0 +8,3 @@ +KERNEL32.DLL::CloseHandle +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::CloseThreadpoolWork @@ -7,0 +13 @@ +KERNEL32.DLL::LocalFree @@ -8,0 +15,3 @@ +KERNEL32.DLL::SetThreadpoolWait +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks +MSVCRT.DLL::operator_delete @@ -11,0 +21 @@ +WPP_SF_L @@ -13 +22,0 @@ -WPP_SF_d @@ -14,0 +24 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::StopConfig Diff ```diff --- CManagerThread::StopConfig +++ CManagerThread::StopConfig @@ -1,177 +1,642 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: long __cdecl CManagerThread::StopConfig(class ATL::CStringT > >,int) __ptr64 */ long __thiscall -CManagerThread::StopConfig - (CManagerThread *this, - CStringT_>_> - *param_2,int param_3) +CManagerThread::StopConfig(CManagerThread *this,CConfigDescriptor *param_2,int param_3) { - int *piVar1; - int iVar2; - CWorkerThread *this_00; - longlong lVar3; - CManagerThread *this_01; - CNode *pCVar4; - uint uVar5; - CNode *pCVar6; - CNode *pCVar7; - undefined2 uVar8; - CConfigDescriptor *pCVar9; - CNode *pCVar10; - CNode *pCVar11; - CNode *pCVar12; - CNode *pCVar13; + CConfigDescriptor *pCVar1; + int *piVar2; + RefCounter *pRVar3; + longlong *plVar4; + HLOCAL pvVar5; + longlong *plVar6; + undefined8 *puVar7; + CWorkerThread *pCVar8; + HANDLE hEvent; + CSimpleStringT *this_00; + bool bVar9; + int iVar10; + long lVar11; + longlong lVar12; + CConfigDescriptor *pCVar13; + IUnknown *pIVar14; + uint uVar15; + CManagerThread *pCVar17; + CConfigDescriptor *pCVar18; + CConfigDescriptor *pCVar19; + CConfigDescriptor *pCVar20; CManagerThread *local_res8; - CStringT_>_> - local_res10 [16]; - CStringT_>_> - local_res20 [8]; + CConfigDescriptor *local_res10; + int local_res18; + CStringData *local_res20; + CStringData *local_58 [3]; + ulonglong uVar16; - pCVar9 = (CConfigDescriptor *)param_2; + pCVar13 = param_2; local_res8 = this; + local_res10 = param_2; + local_res18 = param_3; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); - pCVar12 = (CNode *)0x0; - if ((DAT_1 != (CNode *)0x0) && (pCVar13 = DAT_1, DAT_1 != DAT_18001b918)) - { + if ((DAT_1 != (CConfigDescriptor *)0x0) && + (pCVar20 = DAT_1, DAT_1 != DAT_18002bd58)) { do { - pCVar10 = pCVar13; - pCVar13 = *(CNode **)(pCVar10 + 0x18); - } while (*(CNode **)(pCVar10 + 0x18) != DAT_2); - pCVar13 = pCVar12; - if (pCVar10 != (CNode *)0x0) { - while( true ) { + pCVar18 = pCVar20; + pCVar20 = *(CConfigDescriptor **)(pCVar18 + 0x18); + } while (*(CConfigDescriptor **)(pCVar18 + 0x18) != DAT_2); + if (pCVar18 != (CConfigDescriptor *)0x0) { + lVar11 = 0; + do { + uVar16 = 0; SmartPtr::SmartPtr - ((SmartPtr *)&local_res8,pCVar9); + ((SmartPtr *)&local_res8,pCVar13); if (*(int *)(*(longlong *)param_2 + -0x10) == 0) { - pCVar6 = pCVar12; - if (pCVar10 != (CNode *)0x0) { - if (*(CNode **)(pCVar10 + 0x20) == DAT_2) { - pCVar4 = *(CNode **)(pCVar10 + 0x28); - pCVar11 = pCVar10; - while ((pCVar7 = pCVar4, pCVar7 != DAT_2 && - (pCVar11 == *(CNode **)(pCVar7 + 0x20)))) { - pCVar11 = pCVar7; - pCVar4 = *(CNode **)(pCVar7 + 0x28); + if (pCVar18 == (CConfigDescriptor *)0x0) { +LAB_3: + pCVar13 = (CConfigDescriptor *)0x0; + pCVar20 = pCVar13; + } + else { + pCVar19 = *(CConfigDescriptor **)(pCVar18 + 0x20); + if (pCVar19 == DAT_2) { + pCVar13 = *(CConfigDescriptor **)(pCVar18 + 0x28); + pCVar20 = pCVar18; + while ((pCVar19 = pCVar13, pCVar19 != DAT_2 && + (pCVar20 == *(CConfigDescriptor **)(pCVar19 + 0x20)))) { + pCVar20 = pCVar19; + pCVar13 = *(CConfigDescriptor **)(pCVar19 + 0x28); } - if (pCVar7 != DAT_2) { - pCVar6 = pCVar7; + pCVar13 = (CConfigDescriptor *)0x0; + pCVar20 = pCVar13; + if (pCVar19 != DAT_2) { + pCVar20 = pCVar19; } } else { - pCVar6 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_1,*(CNode **)(pCVar10 + 0x20)); + if (pCVar19 == (CConfigDescriptor *)0x0) goto LAB_3; + do { + pCVar1 = pCVar19 + 0x18; + pCVar13 = DAT_2; + pCVar20 = pCVar19; + pCVar19 = *(CConfigDescriptor **)pCVar1; + } while (*(CConfigDescriptor **)pCVar1 != DAT_2); } } - if (local_res8 != (CManagerThread *)*(RefCounter **)(pCVar10 + 8)) { + if (local_res8 != *(CManagerThread **)(pCVar18 + 8)) { if (local_res8 != (CManagerThread *)0x0) { - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)local_res8); - } - local_res8 = *(CManagerThread **)(pCVar10 + 8); + pCVar17 = local_res8 + 8; + *(int *)pCVar17 = *(int *)pCVar17 + -1; + if (*(int *)pCVar17 == 0) { + plVar4 = *(longlong **)local_res8; + if (plVar4 != (longlong *)0x0) { + if ((HANDLE)plVar4[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[1]); + plVar4[1] = 0; + } + uVar16 = 0; + bVar9 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar9) { + if ((PTP_WAIT)plVar4[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar4[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar4[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar4[0x20]); + plVar4[0x20] = 0; + } + if ((HANDLE)plVar4[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[0x12]); + plVar4[0x12] = 0; + } + if ((HANDLE)plVar4[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[0x21]); + plVar4[0x21] = 0; + } + if (plVar4[0x23] != 0) { + if ((int)plVar4[0x22] != 0) { + do { + pvVar5 = *(HLOCAL *)(plVar4[0x23] + uVar16 * 8); + if (pvVar5 != (HLOCAL)0x0) { + LocalFree(pvVar5); + } + uVar15 = (int)uVar16 + 1; + uVar16 = (ulonglong)uVar15; + } while (uVar15 < *(uint *)(plVar4 + 0x22)); + } + LocalFree((HLOCAL)plVar4[0x23]); + plVar4[0x23] = 0; + *(undefined4 *)(plVar4 + 0x22) = 0; + } + } + lVar12 = *plVar4; + plVar6 = *(longlong **)(lVar12 + -0x18); + if (*(int *)(lVar12 + -0x10) != 0) { + if (*(int *)(lVar12 + -8) < 0) { + if (*(int *)(lVar12 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar12 + -0x10) = 0; + *(undefined2 *)*plVar4 = 0; + } + else { + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + lVar12 = (**(code **)(*plVar6 + 0x18))(plVar6); + *plVar4 = lVar12 + 0x18; + } + } + puVar7 = (undefined8 *)plVar4[0x11]; + if (puVar7 != (undefined8 *)0x0) { + piVar2 = (int *)(puVar7 + 1); + *piVar2 = *piVar2 + -1; + if (*piVar2 == 0) { + pCVar8 = (CWorkerThread *)*puVar7; + if (pCVar8 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar8,1); + if (*(PTP_WORK *)(pCVar8 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar8 + 0x28)); + *(undefined8 *)(pCVar8 + 0x28) = 0; + *(undefined4 *)(pCVar8 + 0x30) = 1; + } + if (*(longlong **)(pCVar8 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar8 + 0x10) = 0; + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar8 + 8) + 0x28))(); + if (((iVar10 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 8) + 0x10))(); + *(undefined8 *)(pCVar8 + 8) = 0; + } + } + if (*(longlong **)pCVar8 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar8 + 0x10))(); + *(undefined8 *)pCVar8 = 0; + } + lVar12 = *(longlong *)(pCVar8 + 0x18); + plVar6 = *(longlong **)(lVar12 + -0x18); + if (*(int *)(lVar12 + -0x10) != 0) { + if (*(int *)(lVar12 + -8) < 0) { + if (*(int *)(lVar12 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar12 + -0x10) = 0; + **(undefined2 **)(pCVar8 + 0x18) = 0; + } + else { + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + lVar12 = (**(code **)(*plVar6 + 0x18))(plVar6); + *(longlong *)(pCVar8 + 0x18) = lVar12 + 0x18; + } + } + if (*(HANDLE *)(pCVar8 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar8 + 0x20)); + *(undefined8 *)(pCVar8 + 0x20) = 0; + } + lVar12 = *(longlong *)(pCVar8 + 0x18); + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar8 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 8) + 0x10))(); + } + if (*(longlong **)pCVar8 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar8 + 0x10))(); + } + operator_delete(pCVar8); + } + operator_delete(puVar7); + } + } + pCVar13 = (CConfigDescriptor *)(*plVar4 + -0x18); + LOCK(); + piVar2 = (int *)(*plVar4 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)pCVar13 + 8))(); + } + operator_delete(plVar4); + param_2 = local_res10; + } + operator_delete(local_res8); + param_3 = local_res18; + } + } + local_res8 = *(CManagerThread **)(pCVar18 + 8); if (local_res8 != (CManagerThread *)0x0) { *(int *)(local_res8 + 8) = *(int *)(local_res8 + 8) + 1; } } } else { - ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_res10,param_2); - uVar5 = GetConfigDescriptor(); - pCVar13 = (CNode *)(ulonglong)uVar5; - pCVar6 = pCVar10; - if ((int)uVar5 < 0) { + local_res20 = ATL::CSimpleStringT::CloneData + ((CStringData *)(*(longlong *)param_2 + -0x18)); + local_res20 = local_res20 + 0x18; + pCVar13 = (CConfigDescriptor *)&local_res20; + lVar11 = GetConfigDescriptor(); + pCVar20 = pCVar18; + if (lVar11 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3d, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,(wchar_t *)0x0); + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,(wchar_t *)0x0); } Ordinal_6(0); if (local_res8 != (CManagerThread *)0x0) { - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)local_res8); - } - goto LAB_3; + pCVar17 = local_res8 + 8; + *(int *)pCVar17 = *(int *)pCVar17 + -1; + if (*(int *)pCVar17 == 0) { + plVar4 = *(longlong **)local_res8; + if (plVar4 != (longlong *)0x0) { + if ((HANDLE)plVar4[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[1]); + plVar4[1] = 0; + } + bVar9 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar9) { + if ((PTP_WAIT)plVar4[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar4[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar4[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar4[0x20]); + plVar4[0x20] = 0; + } + if ((HANDLE)plVar4[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[0x12]); + plVar4[0x12] = 0; + } + if ((HANDLE)plVar4[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar4[0x21]); + plVar4[0x21] = 0; + } + if (plVar4[0x23] != 0) { + if ((int)plVar4[0x22] != 0) { + do { + pvVar5 = *(HLOCAL *)(plVar4[0x23] + uVar16 * 8); + if (pvVar5 != (HLOCAL)0x0) { + LocalFree(pvVar5); + } + uVar15 = (int)uVar16 + 1; + uVar16 = (ulonglong)uVar15; + } while (uVar15 < *(uint *)(plVar4 + 0x22)); + } + LocalFree((HLOCAL)plVar4[0x23]); + plVar4[0x23] = 0; + *(undefined4 *)(plVar4 + 0x22) = 0; + } + } + lVar12 = *plVar4; + plVar6 = *(longlong **)(lVar12 + -0x18); + if (*(int *)(lVar12 + -0x10) != 0) { + if (*(int *)(lVar12 + -8) < 0) { + if (*(int *)(lVar12 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar12 + -0x10) = 0; + *(undefined2 *)*plVar4 = 0; + } + else { + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + lVar12 = (**(code **)(*plVar6 + 0x18))(plVar6); + *plVar4 = lVar12 + 0x18; + } + } + puVar7 = (undefined8 *)plVar4[0x11]; + if (puVar7 != (undefined8 *)0x0) { + piVar2 = (int *)(puVar7 + 1); + *piVar2 = *piVar2 + -1; + if (*piVar2 == 0) { + pCVar8 = (CWorkerThread *)*puVar7; + if (pCVar8 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar8,1); + if (*(PTP_WORK *)(pCVar8 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar8 + 0x28)); + *(undefined8 *)(pCVar8 + 0x28) = 0; + *(undefined4 *)(pCVar8 + 0x30) = 1; + } + if (*(longlong **)(pCVar8 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar8 + 0x10) = 0; + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar8 + 8) + 0x28))(); + if (((iVar10 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 8) + 0x10))(); + *(undefined8 *)(pCVar8 + 8) = 0; + } + } + if (*(longlong **)pCVar8 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar8 + 0x10))(); + *(undefined8 *)pCVar8 = 0; + } + lVar12 = *(longlong *)(pCVar8 + 0x18); + plVar6 = *(longlong **)(lVar12 + -0x18); + if (*(int *)(lVar12 + -0x10) != 0) { + if (*(int *)(lVar12 + -8) < 0) { + if (*(int *)(lVar12 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar12 + -0x10) = 0; + **(undefined2 **)(pCVar8 + 0x18) = 0; + } + else { + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + lVar12 = (**(code **)(*plVar6 + 0x18))(plVar6); + *(longlong *)(pCVar8 + 0x18) = lVar12 + 0x18; + } + } + if (*(HANDLE *)(pCVar8 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar8 + 0x20)); + *(undefined8 *)(pCVar8 + 0x20) = 0; + } + lVar12 = *(longlong *)(pCVar8 + 0x18); + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar8 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 8) + 0x10))(); + } + if (*(longlong **)pCVar8 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar8 + 0x10))(); + } + operator_delete(pCVar8); + } + operator_delete(puVar7); + } + } + lVar12 = *plVar4; + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + operator_delete(plVar4); + } + operator_delete(local_res8); + } + } + goto LAB_4; } } - this_01 = local_res8; + pCVar17 = local_res8; *(undefined4 *)(*(longlong *)local_res8 + 0x14) = 0; *(undefined4 *)(*(longlong *)local_res8 + 0x18) = 0; - pCVar9 = *(CConfigDescriptor **)(*(longlong *)local_res8 + 0x88); - if (((pCVar9 != (CConfigDescriptor *)0x0) && - (this_00 = *(CWorkerThread **)pCVar9, this_00 != (CWorkerThread *)0x0)) && - (*(int *)(this_00 + 0x30) == 0)) break; -LAB_4: - if (param_3 != 0) { - *(undefined4 *)(*(longlong *)this_01 + 0x28) = 1; - pCVar9 = (CConfigDescriptor *) - ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_res20, - *(CStringT_>_> - **)this_01); - uVar5 = AddRemoveRegisteredConfig(&g_ManagerThread,pCVar9,0); - pCVar13 = (CNode *)(ulonglong)uVar5; - if ((int)uVar5 < 0) { + if (((*(undefined8 **)(*(longlong *)local_res8 + 0x88) != (undefined8 *)0x0) && + (pCVar8 = (CWorkerThread *)**(undefined8 **)(*(longlong *)local_res8 + 0x88), + pCVar8 != (CWorkerThread *)0x0)) && (*(int *)(pCVar8 + 0x30) == 0)) { + pCVar13 = (CConfigDescriptor *)0x1; + lVar11 = CWorkerThread::Stop(pCVar8,1); + if (lVar11 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar8 = 0x3f; - goto LAB_5; - } - goto LAB_6; + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3e, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)pCVar17); + } + Ordinal_6(0); + pRVar3 = (RefCounter *)(pCVar17 + 8); + *(int *)pRVar3 = *(int *)pRVar3 + -1; + if (*(int *)pRVar3 == 0) { + this_00 = *(CSimpleStringT **)pCVar17; + if (this_00 != (CSimpleStringT *)0x0) { + if (*(HANDLE *)(this_00 + 8) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 8)); + *(undefined8 *)(this_00 + 8) = 0; + } + bVar9 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar9) { + if (*(PTP_WAIT *)(this_00 + 0x100) != (PTP_WAIT)0x0) { + SetThreadpoolWait(*(PTP_WAIT *)(this_00 + 0x100),(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks(*(PTP_WAIT *)(this_00 + 0x100),1); + CloseThreadpoolWait(*(PTP_WAIT *)(this_00 + 0x100)); + *(undefined8 *)(this_00 + 0x100) = 0; + } + if (*(HANDLE *)(this_00 + 0x90) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 0x90)); + *(undefined8 *)(this_00 + 0x90) = 0; + } + if (*(HANDLE *)(this_00 + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this_00 + 0x108)); + *(undefined8 *)(this_00 + 0x108) = 0; + } + if (*(longlong *)(this_00 + 0x118) != 0) { + uVar16 = 0; + if (*(int *)(this_00 + 0x110) != 0) { + do { + pvVar5 = *(HLOCAL *)(*(longlong *)(this_00 + 0x118) + uVar16 * 8); + if (pvVar5 != (HLOCAL)0x0) { + LocalFree(pvVar5); + } + uVar15 = (int)uVar16 + 1; + uVar16 = (ulonglong)uVar15; + } while (uVar15 < *(uint *)(this_00 + 0x110)); + } + LocalFree(*(HLOCAL *)(this_00 + 0x118)); + *(undefined8 *)(this_00 + 0x118) = 0; + *(undefined4 *)(this_00 + 0x110) = 0; + } + } + ATL::CSimpleStringT::Empty(this_00); + puVar7 = *(undefined8 **)(this_00 + 0x88); + if (puVar7 != (undefined8 *)0x0) { + piVar2 = (int *)(puVar7 + 1); + *piVar2 = *piVar2 + -1; + if (*piVar2 == 0) { + pCVar8 = (CWorkerThread *)*puVar7; + if (pCVar8 != (CWorkerThread *)0x0) { + pIVar14 = (IUnknown *)0x1; + CWorkerThread::Stop(pCVar8,1); + if (*(PTP_WORK *)(pCVar8 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar8 + 0x28)); + *(undefined8 *)(pCVar8 + 0x28) = 0; + *(undefined4 *)(pCVar8 + 0x30) = 1; + } + if (*(longlong *)(pCVar8 + 0x10) != 0) { + ATL::AtlComPtrAssign((IUnknown **)(pCVar8 + 0x10),pIVar14); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + iVar10 = (**(code **)(**(longlong **)(pCVar8 + 8) + 0x28))(); + if (((iVar10 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + pIVar14 = (IUnknown *)0x41; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar10); + } + if (*(longlong *)(pCVar8 + 8) != 0) { + ATL::AtlComPtrAssign((IUnknown **)(pCVar8 + 8),pIVar14); + } + } + if (*(longlong *)pCVar8 != 0) { + ATL::AtlComPtrAssign((IUnknown **)pCVar8,pIVar14); + } + ATL::CSimpleStringT::Empty + ((CSimpleStringT *)(pCVar8 + 0x18)); + if (*(HANDLE *)(pCVar8 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar8 + 0x20)); + *(undefined8 *)(pCVar8 + 0x20) = 0; + } + lVar12 = *(longlong *)(pCVar8 + 0x18); + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar8 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar8 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar8 + 8) + 0x10))(); + } + if (*(longlong **)pCVar8 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar8 + 0x10))(); + } + operator_delete(pCVar8); + } + operator_delete(puVar7); + } + } + lVar12 = *(longlong *)this_00; + LOCK(); + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; + UNLOCK(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); + } + operator_delete(this_00); + pCVar17 = local_res8; + } + operator_delete(pCVar17); + } + goto LAB_4; } } - uVar5 = (uint)pCVar13; + bVar9 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar9) && (*(longlong *)(*(longlong *)pCVar17 + 0x90) != 0)) && + (hEvent = *(HANDLE *)(*(longlong *)pCVar17 + 0x108), hEvent != (HANDLE)0x0)) { + SetEvent(hEvent); + } + if (param_3 != 0) { + *(undefined4 *)(*(longlong *)pCVar17 + 0x28) = 1; + local_58[0] = ATL::CSimpleStringT::CloneData + ((CStringData *)(**(longlong **)pCVar17 + -0x18)); + local_58[0] = local_58[0] + 0x18; + pCVar13 = (CConfigDescriptor *)local_58; + lVar11 = AddRemoveRegisteredConfig(&g_ManagerThread); + if (lVar11 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3f, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)pCVar17); + } + Ordinal_6(0); + SmartPtr::RefCounter::Dec_nRefs((RefCounter *)pCVar17); + goto LAB_4; + } + } Ordinal_6(0); - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)this_01); + SmartPtr::RefCounter::Dec_nRefs((RefCounter *)pCVar17); if ((*(int *)(*(longlong *)param_2 + -0x10) != 0) || - (pCVar10 = pCVar6, pCVar6 == (CNode *)0x0)) goto LAB_3; - } - pCVar9 = (CConfigDescriptor *)0x1; - uVar5 = CWorkerThread::Stop(this_00,1); - pCVar13 = (CNode *)(ulonglong)uVar5; - if (-1 < (int)uVar5) goto LAB_4; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - uVar8 = 0x3e; -LAB_5: - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)this_01); - } -LAB_6: - Ordinal_6(0); - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)this_01); - goto LAB_3; + (pCVar18 = pCVar20, pCVar20 == (CConfigDescriptor *)0x0)) goto LAB_4; + } while( true ); } } - uVar5 = 0x80070490; + lVar11 = -0x7ff8fb70; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3c, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,0x80070490); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x3c, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,0x80070490); } -LAB_3: - SetEvent(DAT_7); +LAB_4: + SetEvent(DAT_5); LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); - lVar3 = *(longlong *)param_2; + lVar12 = *(longlong *)local_res10; LOCK(); - piVar1 = (int *)(lVar3 + -8); - iVar2 = *piVar1; - *piVar1 = *piVar1 + -1; + piVar2 = (int *)(lVar12 + -8); + iVar10 = *piVar2; + *piVar2 = *piVar2 + -1; UNLOCK(); - if (iVar2 < 2) { - (**(code **)(**(longlong **)(lVar3 + -0x18) + 8))(); + if (iVar10 < 2) { + (**(code **)(**(longlong **)(lVar12 + -0x18) + 8))(); } - return uVar5; + return lVar11; } ``` ## CManagerThread::Stop ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.12| |i_ratio|0.07| |m_ratio|0.24| |b_ratio|0.05| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|Stop|Stop| |fullname|CManagerThread::Stop|CManagerThread::Stop| |`refcount`|3|2| |`length`|366|2504| |`called`|ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CWorkerThread::Stop
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
SmartPtr::operator=
WPP_SF_|
Expand for full list:
ATL::AtlThrowImpl
CWorkerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetEvent
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacksMSVCRT.DLL::operator_delete
SmartPtr::SmartPtr
WPP_SF_
WPP_SF_L
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |`calling`|CFhService::ShutdownService
CFhService::StopServiceCallback|CFhService::ShutdownService| |paramcount|1|1| |`address`|180002d30|18000ac30| |sig|long __thiscall Stop(CManagerThread * this)|long __thiscall Stop(CManagerThread * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::Stop Called Diff ```diff --- CManagerThread::Stop called +++ CManagerThread::Stop called @@ -1 +1 @@ -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor +ATL::AtlThrowImpl @@ -2,0 +3 @@ +KERNEL32.DLL::CloseHandle @@ -3,0 +5 @@ +KERNEL32.DLL::CloseThreadpoolWork @@ -5,0 +8,3 @@ +KERNEL32.DLL::LocalFree +KERNEL32.DLL::SetEvent +KERNEL32.DLL::SetThreadpoolWait @@ -7 +12 @@ -SmartPtr::RefCounter::Dec_nRefs +MSVCRT.DLL::operator_delete @@ -9 +13,0 @@ -SmartPtr::operator= @@ -10,0 +15,3 @@ +WPP_SF_L +_guard_dispatch_icall$thunk$10345483385596137414 +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::Stop Calling Diff ```diff --- CManagerThread::Stop calling +++ CManagerThread::Stop calling @@ -2 +1,0 @@ -CFhService::StopServiceCallback ``` ### CManagerThread::Stop Diff ```diff --- CManagerThread::Stop +++ CManagerThread::Stop @@ -1,63 +1,442 @@ +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* public: long __cdecl CManagerThread::Stop(void) __ptr64 */ long __thiscall CManagerThread::Stop(CManagerThread *this) { - CWorkerThread *this_00; - CManagerThread *this_01; - CNode *pCVar1; - SmartPtr *in_RDX; - CNode *pCVar2; + int *piVar1; + CManagerThread *pCVar2; + longlong *plVar3; + HLOCAL pvVar4; + longlong *plVar5; + undefined8 *puVar6; + CWorkerThread *pCVar7; + HANDLE hEvent; + bool bVar8; + int iVar9; + longlong lVar10; + CConfigDescriptor *pCVar11; + CConfigDescriptor *in_RDX; + uint uVar12; + CManagerThread *pCVar14; + CConfigDescriptor *pCVar15; + CConfigDescriptor *pCVar16; + CConfigDescriptor *pCVar17; + CConfigDescriptor *pCVar18; CManagerThread *local_res8; + CConfigDescriptor *pCVar13; local_res8 = this; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - in_RDX = (SmartPtr *)0x28; + in_RDX = (CConfigDescriptor *)0x28; WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); } _DAT_0 = 1; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_1); - if ((DAT_2 != (CNode *)0x0) && (pCVar1 = DAT_2, DAT_2 != DAT_18001b918)) { + pCVar18 = (CConfigDescriptor *)0x0; + if ((DAT_2 != (CConfigDescriptor *)0x0) && + (pCVar13 = DAT_2, DAT_2 != DAT_18002bd58)) { do { - pCVar2 = pCVar1; - pCVar1 = *(CNode **)(pCVar2 + 0x18); - } while (*(CNode **)(pCVar2 + 0x18) != DAT_3); - while (pCVar2 != (CNode *)0x0) { + pCVar15 = pCVar13; + pCVar13 = *(CConfigDescriptor **)(pCVar15 + 0x18); + } while (pCVar13 != DAT_3); + while (pCVar15 != (CConfigDescriptor *)0x0) { SmartPtr::SmartPtr - ((SmartPtr *)&local_res8,(CConfigDescriptor *)in_RDX); - pCVar1 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_2,pCVar2); - in_RDX = (SmartPtr *)(pCVar2 + 8); - SmartPtr::operator= ((SmartPtr *)&local_res8,in_RDX); - this_01 = local_res8; + in_RDX = DAT_3; + pCVar13 = *(CConfigDescriptor **)(pCVar15 + 0x20); + pCVar17 = pCVar18; + if (pCVar13 == DAT_3) { + pCVar13 = *(CConfigDescriptor **)(pCVar15 + 0x28); + pCVar16 = pCVar15; + while ((pCVar11 = pCVar13, pCVar11 != DAT_3 && + (pCVar16 == *(CConfigDescriptor **)(pCVar11 + 0x20)))) { + pCVar16 = pCVar11; + pCVar13 = *(CConfigDescriptor **)(pCVar11 + 0x28); + } + if (pCVar11 != DAT_3) { + pCVar17 = pCVar11; + } + } + else if (pCVar13 != (CConfigDescriptor *)0x0) { + do { + pCVar16 = pCVar13 + 0x18; + pCVar17 = pCVar13; + pCVar13 = *(CConfigDescriptor **)pCVar16; + } while (*(CConfigDescriptor **)pCVar16 != DAT_3); + } + if (local_res8 != *(CManagerThread **)(pCVar15 + 8)) { + if (local_res8 != (CManagerThread *)0x0) { + pCVar14 = local_res8 + 8; + *(int *)pCVar14 = *(int *)pCVar14 + -1; + if (*(int *)pCVar14 == 0) { + plVar3 = *(longlong **)local_res8; + if (plVar3 != (longlong *)0x0) { + if ((HANDLE)plVar3[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[1]); + plVar3[1] = 0; + } + bVar8 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar8) { + if ((PTP_WAIT)plVar3[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar3[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar3[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar3[0x20]); + plVar3[0x20] = 0; + } + if ((HANDLE)plVar3[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x12]); + plVar3[0x12] = 0; + } + if ((HANDLE)plVar3[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x21]); + plVar3[0x21] = 0; + } + if (plVar3[0x23] != 0) { + pCVar13 = pCVar18; + if ((int)plVar3[0x22] != 0) { + do { + pvVar4 = *(HLOCAL *)(plVar3[0x23] + (longlong)pCVar13 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar12 = (int)pCVar13 + 1; + pCVar13 = (CConfigDescriptor *)(ulonglong)uVar12; + } while (uVar12 < *(uint *)(plVar3 + 0x22)); + } + LocalFree((HLOCAL)plVar3[0x23]); + plVar3[0x23] = 0; + *(undefined4 *)(plVar3 + 0x22) = 0; + } + } + lVar10 = *plVar3; + plVar5 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + *(undefined2 *)*plVar3 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar5 + 0x18))(plVar5); + *plVar3 = lVar10 + 0x18; + } + } + puVar6 = (undefined8 *)plVar3[0x11]; + if (puVar6 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar6 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar7 = (CWorkerThread *)*puVar6; + if (pCVar7 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar7,1); + if (*(PTP_WORK *)(pCVar7 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar7 + 0x28)); + *(undefined8 *)(pCVar7 + 0x28) = 0; + *(undefined4 *)(pCVar7 + 0x30) = 1; + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar7 + 0x10) = 0; + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + iVar9 = (**(code **)(**(longlong **)(pCVar7 + 8) + 0x28))(); + if (((iVar9 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) + && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar9); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + *(undefined8 *)(pCVar7 + 8) = 0; + } + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + *(undefined8 *)pCVar7 = 0; + } + lVar10 = *(longlong *)(pCVar7 + 0x18); + plVar5 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + **(undefined2 **)(pCVar7 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar5 + 0x18))(plVar5); + *(longlong *)(pCVar7 + 0x18) = lVar10 + 0x18; + } + } + if (*(HANDLE *)(pCVar7 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar7 + 0x20)); + *(undefined8 *)(pCVar7 + 0x20) = 0; + } + lVar10 = *(longlong *)(pCVar7 + 0x18); + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + } + operator_delete(pCVar7); + } + operator_delete(puVar6); + } + } + in_RDX = (CConfigDescriptor *)(*plVar3 + -0x18); + LOCK(); + piVar1 = (int *)(*plVar3 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)in_RDX + 8))(); + } + operator_delete(plVar3); + } + operator_delete(local_res8); + } + } + local_res8 = *(CManagerThread **)(pCVar15 + 8); + if (local_res8 != (CManagerThread *)0x0) { + *(int *)(local_res8 + 8) = *(int *)(local_res8 + 8) + 1; + } + } + pCVar14 = local_res8; if ((*(undefined8 **)(*(longlong *)local_res8 + 0x88) != (undefined8 *)0x0) && - (this_00 = (CWorkerThread *)**(undefined8 **)(*(longlong *)local_res8 + 0x88), - this_00 != (CWorkerThread *)0x0)) { - in_RDX = (SmartPtr *)0x0; - CWorkerThread::Stop(this_00,0); - } - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)this_01); - pCVar2 = pCVar1; + (pCVar7 = (CWorkerThread *)**(undefined8 **)(*(longlong *)local_res8 + 0x88), + pCVar7 != (CWorkerThread *)0x0)) { + in_RDX = (CConfigDescriptor *)0x0; + CWorkerThread::Stop(pCVar7,0); + } + bVar8 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((bVar8) && (*(longlong *)(*(longlong *)pCVar14 + 0x90) != 0)) && + (hEvent = *(HANDLE *)(*(longlong *)pCVar14 + 0x108), hEvent != (HANDLE)0x0)) { + SetEvent(hEvent); + } + pCVar2 = pCVar14 + 8; + *(int *)pCVar2 = *(int *)pCVar2 + -1; + pCVar15 = pCVar17; + if (*(int *)pCVar2 == 0) { + plVar3 = *(longlong **)pCVar14; + if (plVar3 != (longlong *)0x0) { + if ((HANDLE)plVar3[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[1]); + plVar3[1] = 0; + } + bVar8 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar8) { + if ((PTP_WAIT)plVar3[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar3[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar3[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar3[0x20]); + plVar3[0x20] = 0; + } + if ((HANDLE)plVar3[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x12]); + plVar3[0x12] = 0; + } + if ((HANDLE)plVar3[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar3[0x21]); + plVar3[0x21] = 0; + } + if (plVar3[0x23] != 0) { + pCVar13 = pCVar18; + if ((int)plVar3[0x22] != 0) { + do { + pvVar4 = *(HLOCAL *)(plVar3[0x23] + (longlong)pCVar13 * 8); + if (pvVar4 != (HLOCAL)0x0) { + LocalFree(pvVar4); + } + uVar12 = (int)pCVar13 + 1; + pCVar13 = (CConfigDescriptor *)(ulonglong)uVar12; + } while (uVar12 < *(uint *)(plVar3 + 0x22)); + } + LocalFree((HLOCAL)plVar3[0x23]); + plVar3[0x23] = 0; + *(undefined4 *)(plVar3 + 0x22) = 0; + } + } + lVar10 = *plVar3; + plVar5 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + *(undefined2 *)*plVar3 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar5 + 0x18))(plVar5); + *plVar3 = lVar10 + 0x18; + } + } + puVar6 = (undefined8 *)plVar3[0x11]; + if (puVar6 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar6 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar7 = (CWorkerThread *)*puVar6; + if (pCVar7 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar7,1); + if (*(PTP_WORK *)(pCVar7 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar7 + 0x28)); + *(undefined8 *)(pCVar7 + 0x28) = 0; + *(undefined4 *)(pCVar7 + 0x30) = 1; + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar7 + 0x10) = 0; + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + iVar9 = (**(code **)(**(longlong **)(pCVar7 + 8) + 0x28))(); + if (((iVar9 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar9); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + *(undefined8 *)(pCVar7 + 8) = 0; + } + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + *(undefined8 *)pCVar7 = 0; + } + lVar10 = *(longlong *)(pCVar7 + 0x18); + plVar5 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + **(undefined2 **)(pCVar7 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar5 + 0x18))(plVar5); + *(longlong *)(pCVar7 + 0x18) = lVar10 + 0x18; + } + } + if (*(HANDLE *)(pCVar7 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar7 + 0x20)); + *(undefined8 *)(pCVar7 + 0x20) = 0; + } + lVar10 = *(longlong *)(pCVar7 + 0x18); + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar7 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar7 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar7 + 8) + 0x10))(); + } + if (*(longlong **)pCVar7 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar7 + 0x10))(); + } + operator_delete(pCVar7); + } + operator_delete(puVar6); + } + } + in_RDX = (CConfigDescriptor *)(*plVar3 + -0x18); + LOCK(); + piVar1 = (int *)(*plVar3 + -8); + iVar9 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar9 < 2) { + (**(code **)(**(longlong **)in_RDX + 8))(); + } + operator_delete(plVar3); + pCVar14 = local_res8; + } + operator_delete(pCVar14); + } } } LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_1); if (DAT_4 != (PTP_WAIT)0x0) { WaitForThreadpoolWaitCallbacks(DAT_4,1); CloseThreadpoolWait(DAT_4); DAT_4 = (PTP_WAIT)0x0; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x29, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids); + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids); } return 0; } ``` ## CManagerThread::UpdatePowerState ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.09| |i_ratio|0.07| |m_ratio|0.34| |b_ratio|0.19| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|UpdatePowerState|UpdatePowerState| |fullname|CManagerThread::UpdatePowerState|CManagerThread::UpdatePowerState| |refcount|3|3| |`length`|564|2614| |`called`|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
CConfigDescriptor::RefreshPoliciesInEngine
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetSystemPowerStatus
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::SetEvent
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
WPP_SF_d
WPP_SF_s__security_check_cookie
|
Expand for full list:
ATL::AtlThrowImpl
CConfigDescriptor::RefreshPoliciesInEngine
CWorkerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::CloseThreadpoolWork
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetSystemPowerStatus
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::LocalFreeKERNEL32.DLL::SetEvent
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
MSVCRT.DLL::operator_delete
SmartPtr::SmartPtr
WPP_SF_L
WPP_SF_s
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |calling|CFhService::ServiceControlHandler
CManagerThread::Start|CFhService::ServiceControlHandler
CManagerThread::Start| |paramcount|1|1| |`address`|1800033f0|180002a20| |sig|void __thiscall UpdatePowerState(CManagerThread * this)|void __thiscall UpdatePowerState(CManagerThread * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::UpdatePowerState Called Diff ```diff --- CManagerThread::UpdatePowerState called +++ CManagerThread::UpdatePowerState called @@ -1 +1 @@ -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum +ATL::AtlThrowImpl @@ -2,0 +3,4 @@ +CWorkerThread::Stop +KERNEL32.DLL::CloseHandle +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::CloseThreadpoolWork @@ -6,0 +11 @@ +KERNEL32.DLL::LocalFree @@ -8 +13,3 @@ -SmartPtr::RefCounter::Dec_nRefs +KERNEL32.DLL::SetThreadpoolWait +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks +MSVCRT.DLL::operator_delete @@ -10 +17 @@ -WPP_SF_d +WPP_SF_L @@ -12,0 +20,2 @@ +_guard_dispatch_icall$thunk$10345483385596137414 +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::UpdatePowerState Diff ```diff --- CManagerThread::UpdatePowerState +++ CManagerThread::UpdatePowerState @@ -1,111 +1,467 @@ +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: void __cdecl CManagerThread::UpdatePowerState(void) __ptr64 */ void __thiscall CManagerThread::UpdatePowerState(CManagerThread *this) { - longlong *plVar1; - uint uVar2; - RefCounter *this_00; - BOOL BVar3; - DWORD DVar4; - CNode *pCVar5; - CNode *pCVar6; - CNode *pCVar7; - CNode *pCVar8; - uint uVar9; - CNode *pCVar10; - char *pcVar11; - undefined1 auStack_48 [32]; - RefCounter *local_28; - _SYSTEM_POWER_STATUS local_20; - ulonglong local_10; + int *piVar1; + longlong *plVar2; + HLOCAL pvVar3; + longlong *plVar4; + CWorkerThread *pCVar5; + bool bVar6; + BOOL BVar7; + int iVar8; + DWORD DVar9; + longlong lVar10; + CConfigDescriptor *pCVar11; + CConfigDescriptor *in_RDX; + uint uVar12; + ulonglong uVar14; + undefined8 *puVar15; + CConfigDescriptor *pCVar16; + CConfigDescriptor *pCVar17; + CConfigDescriptor *pCVar18; + CConfigDescriptor *pCVar19; + char *pcVar20; + uint uVar21; + undefined1 auStack_78 [32]; + uint local_58; + undefined8 *local_50; + _SYSTEM_POWER_STATUS local_48; + ulonglong local_38; + CConfigDescriptor *pCVar13; - local_10 = __security_cookie ^ (ulonglong)auStack_48; - local_20.ACLineStatus = '\0'; - local_20.BatteryFlag = '\0'; - local_20.BatteryLifePercent = '\0'; - local_20.Reserved1 = '\0'; - local_20.BatteryLifeTime = 0; - local_20.BatteryFullLifeTime = 0; - BVar3 = GetSystemPowerStatus(&local_20); - if (BVar3 == 0) { + local_38 = __security_cookie ^ (ulonglong)auStack_78; + local_48.ACLineStatus = '\0'; + local_48.BatteryFlag = '\0'; + local_48.BatteryLifePercent = '\0'; + local_48.Reserved1 = '\0'; + local_48.BatteryLifeTime = 0; + local_48.BatteryFullLifeTime = 0; + BVar7 = GetSystemPowerStatus(&local_48); + if (BVar7 == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; + DVar9 = GetLastError(); + if (0 < (int)DVar9) { + DVar9 = DVar9 & 0xffff | 0x80070000; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x59, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar4); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x60, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar9); } } else { - uVar9 = (uint)(local_20.ACLineStatus == '\0'); - if (DAT_0 != uVar9) { + uVar21 = (uint)(local_48.ACLineStatus == '\0'); + if (DAT_0 != uVar21) { EnterCriticalSection((LPCRITICAL_SECTION)&DAT_1); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - pcVar11 = "DC"; - if (uVar9 == 0) { - pcVar11 = "AC"; + pcVar20 = "DC"; + if (uVar21 == 0) { + pcVar20 = "AC"; } - WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x58, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,pcVar11); + in_RDX = (CConfigDescriptor *)0x5f; + WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5f, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,pcVar20); } - uVar2 = DAT_2; - pCVar8 = DAT_3; - DAT_0 = uVar9; - pCVar5 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_3,DAT_3); - while (pCVar5 != (CNode *)0x0) { - SmartPtr::SmartPtr - ((SmartPtr *)&local_28,(CConfigDescriptor *)pCVar8); - pCVar8 = *(CNode **)(pCVar5 + 0x20); - if (pCVar8 == DAT_4) { - pCVar6 = *(CNode **)(pCVar5 + 0x28); - pCVar10 = pCVar5; - while ((pCVar7 = pCVar6, pCVar7 != DAT_4 && - (pCVar10 == *(CNode **)(pCVar7 + 0x20)))) { - pCVar10 = pCVar7; - pCVar6 = *(CNode **)(pCVar7 + 0x28); + uVar12 = DAT_2; + local_58 = DAT_2; + DAT_0 = uVar21; + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (((!bVar6) && (DAT_3 != (CConfigDescriptor *)0x0)) && + (pCVar18 = DAT_3, DAT_3 != DAT_18002bd58)) { + do { + pCVar16 = pCVar18; + pCVar18 = *(CConfigDescriptor **)(pCVar16 + 0x18); + } while (pCVar18 != DAT_4); + while (pCVar16 != (CConfigDescriptor *)0x0) { + pCVar13 = (CConfigDescriptor *)0x0; + SmartPtr::SmartPtr + ((SmartPtr *)&local_50,in_RDX); + in_RDX = DAT_4; + pCVar18 = *(CConfigDescriptor **)(pCVar16 + 0x20); + pCVar19 = pCVar13; + if (pCVar18 == DAT_4) { + pCVar18 = *(CConfigDescriptor **)(pCVar16 + 0x28); + pCVar17 = pCVar16; + while ((pCVar11 = pCVar18, pCVar11 != DAT_4 && + (pCVar17 == *(CConfigDescriptor **)(pCVar11 + 0x20)))) { + pCVar17 = pCVar11; + pCVar18 = *(CConfigDescriptor **)(pCVar11 + 0x28); + } + if (pCVar11 != DAT_4) { + pCVar19 = pCVar11; + } } - pCVar6 = (CNode *)0x0; - if (pCVar7 != DAT_4) { - pCVar6 = pCVar7; + else if (pCVar18 != (CConfigDescriptor *)0x0) { + do { + pCVar17 = pCVar18 + 0x18; + pCVar19 = pCVar18; + pCVar18 = *(CConfigDescriptor **)pCVar17; + } while (*(CConfigDescriptor **)pCVar17 != DAT_4); + } + if (local_50 != *(undefined8 **)(pCVar16 + 8)) { + if (local_50 != (undefined8 *)0x0) { + piVar1 = (int *)(local_50 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + plVar2 = (longlong *)*local_50; + if (plVar2 != (longlong *)0x0) { + if ((HANDLE)plVar2[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[1]); + plVar2[1] = 0; + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + if ((PTP_WAIT)plVar2[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar2[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar2[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar2[0x20]); + plVar2[0x20] = 0; + } + if ((HANDLE)plVar2[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[0x12]); + plVar2[0x12] = 0; + } + if ((HANDLE)plVar2[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[0x21]); + plVar2[0x21] = 0; + } + if (plVar2[0x23] != 0) { + if ((int)plVar2[0x22] != 0) { + do { + pvVar3 = *(HLOCAL *)(plVar2[0x23] + (longlong)pCVar13 * 8); + if (pvVar3 != (HLOCAL)0x0) { + LocalFree(pvVar3); + } + uVar12 = (int)pCVar13 + 1; + pCVar13 = (CConfigDescriptor *)(ulonglong)uVar12; + } while (uVar12 < *(uint *)(plVar2 + 0x22)); + } + LocalFree((HLOCAL)plVar2[0x23]); + plVar2[0x23] = 0; + *(undefined4 *)(plVar2 + 0x22) = 0; + } + } + lVar10 = *plVar2; + plVar4 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + *(undefined2 *)*plVar2 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar4 + 0x18))(plVar4); + *plVar2 = lVar10 + 0x18; + } + } + puVar15 = (undefined8 *)plVar2[0x11]; + if (puVar15 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar15 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar5 = (CWorkerThread *)*puVar15; + if (pCVar5 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar5,1); + if (*(PTP_WORK *)(pCVar5 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar5 + 0x28)); + *(undefined8 *)(pCVar5 + 0x28) = 0; + *(undefined4 *)(pCVar5 + 0x30) = 1; + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar5 + 0x10) = 0; + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + iVar8 = (**(code **)(**(longlong **)(pCVar5 + 8) + 0x28))(); + if (((iVar8 < 0) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar8); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + *(undefined8 *)(pCVar5 + 8) = 0; + } + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + *(undefined8 *)pCVar5 = 0; + } + lVar10 = *(longlong *)(pCVar5 + 0x18); + plVar4 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + **(undefined2 **)(pCVar5 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar4 + 0x18))(plVar4); + *(longlong *)(pCVar5 + 0x18) = lVar10 + 0x18; + } + } + if (*(HANDLE *)(pCVar5 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar5 + 0x20)); + *(undefined8 *)(pCVar5 + 0x20) = 0; + } + lVar10 = *(longlong *)(pCVar5 + 0x18); + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + } + operator_delete(pCVar5); + } + operator_delete(puVar15); + } + } + in_RDX = (CConfigDescriptor *)(*plVar2 + -0x18); + LOCK(); + piVar1 = (int *)(*plVar2 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)in_RDX + 8))(); + } + operator_delete(plVar2); + } + operator_delete(local_50); + uVar12 = local_58; + } + } + local_50 = *(undefined8 **)(pCVar16 + 8); + if (local_50 != (undefined8 *)0x0) { + *(int *)(local_50 + 1) = *(int *)(local_50 + 1) + 1; + } + } + puVar15 = local_50; + uVar14 = 0; + plVar2 = *(longlong **)((CConfigDescriptor *)*local_50 + 0x88); + if ((plVar2 != (longlong *)0x0) && (*plVar2 != 0)) { + in_RDX = (CConfigDescriptor *)(ulonglong)uVar12; + CConfigDescriptor::RefreshPoliciesInEngine((CConfigDescriptor *)*local_50,uVar12,uVar21) + ; + } + piVar1 = (int *)(puVar15 + 1); + *piVar1 = *piVar1 + -1; + pCVar16 = pCVar19; + uVar12 = local_58; + if (*piVar1 == 0) { + plVar2 = (longlong *)*puVar15; + if (plVar2 != (longlong *)0x0) { + if ((HANDLE)plVar2[1] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[1]); + plVar2[1] = 0; + } + bVar6 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar6) { + if ((PTP_WAIT)plVar2[0x20] != (PTP_WAIT)0x0) { + SetThreadpoolWait((PTP_WAIT)plVar2[0x20],(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks((PTP_WAIT)plVar2[0x20],1); + CloseThreadpoolWait((PTP_WAIT)plVar2[0x20]); + plVar2[0x20] = 0; + } + if ((HANDLE)plVar2[0x12] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[0x12]); + plVar2[0x12] = 0; + } + if ((HANDLE)plVar2[0x21] != (HANDLE)0x0) { + CloseHandle((HANDLE)plVar2[0x21]); + plVar2[0x21] = 0; + } + if (plVar2[0x23] != 0) { + if ((int)plVar2[0x22] != 0) { + do { + pvVar3 = *(HLOCAL *)(plVar2[0x23] + uVar14 * 8); + if (pvVar3 != (HLOCAL)0x0) { + LocalFree(pvVar3); + } + uVar12 = (int)uVar14 + 1; + uVar14 = (ulonglong)uVar12; + } while (uVar12 < *(uint *)(plVar2 + 0x22)); + } + LocalFree((HLOCAL)plVar2[0x23]); + plVar2[0x23] = 0; + *(undefined4 *)(plVar2 + 0x22) = 0; + } + } + lVar10 = *plVar2; + plVar4 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + *(undefined2 *)*plVar2 = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar4 + 0x18))(plVar4); + *plVar2 = lVar10 + 0x18; + } + } + puVar15 = (undefined8 *)plVar2[0x11]; + if (puVar15 != (undefined8 *)0x0) { + piVar1 = (int *)(puVar15 + 1); + *piVar1 = *piVar1 + -1; + if (*piVar1 == 0) { + pCVar5 = (CWorkerThread *)*puVar15; + if (pCVar5 != (CWorkerThread *)0x0) { + CWorkerThread::Stop(pCVar5,1); + if (*(PTP_WORK *)(pCVar5 + 0x28) != (PTP_WORK)0x0) { + CloseThreadpoolWork(*(PTP_WORK *)(pCVar5 + 0x28)); + *(undefined8 *)(pCVar5 + 0x28) = 0; + *(undefined4 *)(pCVar5 + 0x30) = 1; + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + *(undefined8 *)(pCVar5 + 0x10) = 0; + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + iVar8 = (**(code **)(**(longlong **)(pCVar5 + 8) + 0x28))(); + if (((iVar8 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) + && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x41, + &WPP_0df1ac896ac0375d62bd2c425f318ae8_Traceguids,iVar8); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + *(undefined8 *)(pCVar5 + 8) = 0; + } + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + *(undefined8 *)pCVar5 = 0; + } + lVar10 = *(longlong *)(pCVar5 + 0x18); + plVar4 = *(longlong **)(lVar10 + -0x18); + if (*(int *)(lVar10 + -0x10) != 0) { + if (*(int *)(lVar10 + -8) < 0) { + if (*(int *)(lVar10 + -0xc) < 0) { + /* WARNING: Subroutine does not return */ + ATL::AtlThrowImpl(-0x7ff8ffa9); + } + *(undefined4 *)(lVar10 + -0x10) = 0; + **(undefined2 **)(pCVar5 + 0x18) = 0; + } + else { + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + lVar10 = (**(code **)(*plVar4 + 0x18))(plVar4); + *(longlong *)(pCVar5 + 0x18) = lVar10 + 0x18; + } + } + if (*(HANDLE *)(pCVar5 + 0x20) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(pCVar5 + 0x20)); + *(undefined8 *)(pCVar5 + 0x20) = 0; + } + lVar10 = *(longlong *)(pCVar5 + 0x18); + LOCK(); + piVar1 = (int *)(lVar10 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)(lVar10 + -0x18) + 8))(); + } + if (*(longlong **)(pCVar5 + 0x10) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 0x10) + 0x10))(); + } + if (*(longlong **)(pCVar5 + 8) != (longlong *)0x0) { + (**(code **)(**(longlong **)(pCVar5 + 8) + 0x10))(); + } + if (*(longlong **)pCVar5 != (longlong *)0x0) { + (**(code **)(**(longlong **)pCVar5 + 0x10))(); + } + operator_delete(pCVar5); + } + operator_delete(puVar15); + } + } + in_RDX = (CConfigDescriptor *)(*plVar2 + -0x18); + LOCK(); + piVar1 = (int *)(*plVar2 + -8); + iVar8 = *piVar1; + *piVar1 = *piVar1 + -1; + UNLOCK(); + if (iVar8 < 2) { + (**(code **)(**(longlong **)in_RDX + 8))(); + } + operator_delete(plVar2); + puVar15 = local_50; + } + operator_delete(puVar15); + uVar12 = local_58; } } - else { - pCVar6 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_3,pCVar8); - } - if (local_28 != *(RefCounter **)(pCVar5 + 8)) { - if (local_28 != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs(local_28); - } - local_28 = *(RefCounter **)(pCVar5 + 8); - if (local_28 != (RefCounter *)0x0) { - *(int *)(local_28 + 8) = *(int *)(local_28 + 8) + 1; - } - } - this_00 = local_28; - plVar1 = *(longlong **)(*(CConfigDescriptor **)local_28 + 0x88); - if ((plVar1 != (longlong *)0x0) && (*plVar1 != 0)) { - pCVar8 = (CNode *)(ulonglong)uVar2; - CConfigDescriptor::RefreshPoliciesInEngine(*(CConfigDescriptor **)local_28,uVar2,uVar9); - } - SmartPtr::RefCounter::Dec_nRefs(this_00); - pCVar5 = pCVar6; } SetEvent(DAT_5); LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_1); } } return; } ``` ## CManagerThread::QueueBackupForLoggedOnUser ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,refcount,length,address,calling,called| |ratio|0.66| |i_ratio|0.42| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|QueueBackupForLoggedOnUser|QueueBackupForLoggedOnUser| |fullname|CManagerThread::QueueBackupForLoggedOnUser|CManagerThread::QueueBackupForLoggedOnUser| |`refcount`|4|3| |`length`|1033|1054| |`called`|
Expand for full list:
ADVAPI32.DLL::ImpersonateLoggedOnUser
ADVAPI32.DLL::OpenThreadToken
ADVAPI32.DLL::SetThreadToken
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoCreateInstance
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoInitializeEx
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoUninitialize
ATL::CSimpleStringT::CloneData
CManagerThread::QueueConfig
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::GetCurrentThread
KERNEL32.DLL::GetLastErrorLoadUserConfiguration
WPP_SF_d
WPP_SF_dd
WTSAPI32.DLL::WTSQueryUserToken
_guard_dispatch_icall$thunk$10345483385596137414
|
Expand for full list:
ADVAPI32.DLL::ImpersonateLoggedOnUser
ADVAPI32.DLL::OpenThreadToken
ADVAPI32.DLL::SetThreadToken
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoCreateInstance
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoInitializeEx
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoUninitialize
ATL::CSimpleStringT::CloneData
CManagerThread::QueueConfig
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::GetCurrentThread
KERNEL32.DLL::GetLastErrorLoadUserConfiguration
WPP_SF_L
WPP_SF_dd
WTSAPI32.DLL::WTSQueryUserToken
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled
| |`calling`|CFhService::ServiceControlHandler
CFhService::StartServiceW
CManagerThread::QueueBackupForAllLoggedOnUsers|CFhService::ServiceControlHandler
CManagerThread::QueueBackupForAllLoggedOnUsers| |paramcount|2|2| |`address`|1800012a0|180004560| |sig|void __thiscall QueueBackupForLoggedOnUser(CManagerThread * this, ulong param_1)|void __thiscall QueueBackupForLoggedOnUser(CManagerThread * this, ulong param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::QueueBackupForLoggedOnUser Called Diff ```diff --- CManagerThread::QueueBackupForLoggedOnUser called +++ CManagerThread::QueueBackupForLoggedOnUser called @@ -13 +13 @@ -WPP_SF_d +WPP_SF_L @@ -16,0 +17 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::QueueBackupForLoggedOnUser Calling Diff ```diff --- CManagerThread::QueueBackupForLoggedOnUser calling +++ CManagerThread::QueueBackupForLoggedOnUser calling @@ -2 +1,0 @@ -CFhService::StartServiceW ``` ### CManagerThread::QueueBackupForLoggedOnUser Diff ```diff --- CManagerThread::QueueBackupForLoggedOnUser +++ CManagerThread::QueueBackupForLoggedOnUser @@ -1,150 +1,154 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: void __cdecl CManagerThread::QueueBackupForLoggedOnUser(unsigned long) __ptr64 */ void __thiscall CManagerThread::QueueBackupForLoggedOnUser(CManagerThread *this,ulong param_1) { int *piVar1; - DWORD DVar2; - int iVar3; - long lVar4; - BOOL BVar5; - DWORD DVar6; + bool bVar2; + DWORD DVar3; + int iVar4; + long lVar5; + BOOL BVar6; + DWORD DVar7; HANDLE ThreadHandle; - undefined2 uVar7; + undefined2 uVar8; CManagerThread *in_R8; CManagerThread *local_res8 [2]; longlong *local_res18; HANDLE local_res20; longlong **ppv; longlong local_38; CStringData *local_30; local_res18 = (longlong *)0x0; local_res8[0] = this; local_38 = (**(code **)(ATL::g_strmgr + 0x18))(&ATL::g_strmgr); local_38 = local_38 + 0x18; local_res20 = (HANDLE)0x0; local_res8[0] = (CManagerThread *)0x0; - DVar2 = CoInitializeEx((LPVOID)0x0,0); - if ((DVar2 == 0x80010106) || (DVar2 == 1)) { + DVar3 = CoInitializeEx((LPVOID)0x0,0); + if ((DVar3 == 0x80010106) || (DVar3 == 1)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - in_R8 = (CManagerThread *)&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5c, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar2); + in_R8 = (CManagerThread *)&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),99, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar3); } LAB_0: - iVar3 = WTSQueryUserToken(param_1,&local_res20); - if (iVar3 == 0) { + iVar4 = WTSQueryUserToken(param_1,&local_res20); + if (iVar4 == 0) { GetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x5e; + uVar8 = 0x65; LAB_2: - WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7,in_R8,param_1); + WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8,in_R8,param_1); goto LAB_1; } - BVar5 = ImpersonateLoggedOnUser(local_res20); - if (BVar5 == 0) { - DVar6 = GetLastError(); - if (0 < (int)DVar6) { - DVar6 = DVar6 & 0xffff | 0x80070000; + BVar6 = ImpersonateLoggedOnUser(local_res20); + if (BVar6 == 0) { + DVar7 = GetLastError(); + if (0 < (int)DVar7) { + DVar7 = DVar7 & 0xffff | 0x80070000; } if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x5f; + uVar8 = 0x66; } else { + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); ThreadHandle = GetCurrentThread(); in_R8 = (CManagerThread *)0x1; - BVar5 = OpenThreadToken(ThreadHandle,0xc,1,local_res8); - if (BVar5 == 0) { + BVar6 = OpenThreadToken(ThreadHandle,(uint)bVar2 * 2 + 0xc,1,local_res8); + if (BVar6 == 0) { GetLastError(); if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x60; + uVar8 = 0x67; goto LAB_2; } ppv = &local_res18; - DVar6 = CoCreateInstance((IID *)&CLSID_FhConfigMgr,(LPUNKNOWN)0x0,0x17, + DVar7 = CoCreateInstance((IID *)&CLSID_FhConfigMgr,(LPUNKNOWN)0x0,0x17, (IID *)&_GUID_e388cb3e_d90b_4e2a_a025_42c7f1e655a4,ppv); - if ((int)DVar6 < 0) { + if ((int)DVar7 < 0) { if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x61; + uVar8 = 0x68; } else { - DVar6 = LoadUserConfiguration + DVar7 = LoadUserConfiguration (local_res8[0],(CComPtr *)&local_res18, (CStringT_>_> *)&local_38,(int *)0x0); in_R8 = local_res8[0]; - if (-1 < (int)DVar6) { + if (-1 < (int)DVar7) { local_30 = ATL::CSimpleStringT::CloneData ((CStringData *)(local_38 + -0x18)); local_30 = local_30 + 0x18; - lVar4 = QueueConfig(&g_ManagerThread,&local_30,in_R8,1,(ulonglong)ppv & 0xffffffff00000000 + lVar5 = QueueConfig(&g_ManagerThread,&local_30,in_R8,1,(ulonglong)ppv & 0xffffffff00000000 ,1); - if (((-1 < lVar4) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || + if (((-1 < lVar5) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 99; + uVar8 = 0x6a; goto LAB_2; } if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x62; + uVar8 = 0x69; } } } else { - if (-1 < (int)DVar2) goto LAB_0; + if (-1 < (int)DVar3) goto LAB_0; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - uVar7 = 0x5d; - DVar6 = DVar2; + uVar8 = 100; + DVar7 = DVar3; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar6); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar7); LAB_1: - BVar5 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); - if (((BVar5 == 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + BVar6 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); + if (((BVar6 == 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - DVar6 = GetLastError(); - if (0 < (int)DVar6) { - DVar6 = DVar6 & 0xffff | 0x80070000; + DVar7 = GetLastError(); + if (0 < (int)DVar7) { + DVar7 = DVar7 & 0xffff | 0x80070000; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),100, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar6); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6b, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,DVar7); } if (local_res8[0] != (CManagerThread *)0x0) { CloseHandle(local_res8[0]); local_res8[0] = (CManagerThread *)0x0; } if (local_res20 != (HANDLE)0x0) { CloseHandle(local_res20); local_res20 = (HANDLE)0x0; } if (local_res18 != (longlong *)0x0) { (**(code **)(*local_res18 + 0x10))(); local_res18 = (longlong *)0x0; } - if (-1 < (int)DVar2) { + if (-1 < (int)DVar3) { CoUninitialize(); } LOCK(); piVar1 = (int *)(local_38 + -8); - iVar3 = *piVar1; + iVar4 = *piVar1; *piVar1 = *piVar1 + -1; UNLOCK(); - if (iVar3 < 2) { + if (iVar4 < 2) { (**(code **)(**(longlong **)(local_38 + -0x18) + 8))(); } if (local_res18 != (longlong *)0x0) { (**(code **)(*local_res18 + 0x10))(); } return; } ``` ## CConfigDescriptor::~CConfigDescriptor ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.39| |i_ratio|0.23| |m_ratio|0.4| |b_ratio|0.4| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|~CConfigDescriptor|~CConfigDescriptor| |fullname|CConfigDescriptor::~CConfigDescriptor|CConfigDescriptor::~CConfigDescriptor| |refcount|2|2| |`length`|68|333| |`called`|ATL::CSimpleStringT::Empty
ATL::CSimpleStringT::~CSimpleStringT
KERNEL32.DLL::CloseHandle
SmartPtr::~SmartPtr|ATL::CSimpleStringT::Empty
ATL::CSimpleStringT::~CSimpleStringT
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::CloseThreadpoolWait
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetThreadpoolWait
KERNEL32.DLL::WaitForThreadpoolWaitCallbacks
SmartPtr::~SmartPtr
wil::details::FeatureImpl::__private_IsEnabled| |calling|CConfigDescriptor::`scalar_deleting_destructor'|CConfigDescriptor::`scalar_deleting_destructor'| |paramcount|1|1| |`address`|18000ed48|18001b5f0| |sig|void __thiscall ~CConfigDescriptor(CConfigDescriptor * this)|void __thiscall ~CConfigDescriptor(CConfigDescriptor * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CConfigDescriptor::~CConfigDescriptor Called Diff ```diff --- CConfigDescriptor::~CConfigDescriptor called +++ CConfigDescriptor::~CConfigDescriptor called @@ -3,0 +4,4 @@ +KERNEL32.DLL::CloseThreadpoolWait +KERNEL32.DLL::LocalFree +KERNEL32.DLL::SetThreadpoolWait +KERNEL32.DLL::WaitForThreadpoolWaitCallbacks @@ -4,0 +9 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CConfigDescriptor::~CConfigDescriptor Diff ```diff --- CConfigDescriptor::~CConfigDescriptor +++ CConfigDescriptor::~CConfigDescriptor @@ -1,18 +1,58 @@ /* public: __cdecl CConfigDescriptor::~CConfigDescriptor(void) __ptr64 */ void __thiscall CConfigDescriptor::~CConfigDescriptor(CConfigDescriptor *this) { + HLOCAL hMem; + bool bVar1; + uint uVar2; + ulonglong uVar3; + if (*(HANDLE *)(this + 8) != (HANDLE)0x0) { CloseHandle(*(HANDLE *)(this + 8)); *(undefined8 *)(this + 8) = 0; + } + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + if (*(PTP_WAIT *)(this + 0x100) != (PTP_WAIT)0x0) { + SetThreadpoolWait(*(PTP_WAIT *)(this + 0x100),(HANDLE)0x0,(PFILETIME)0x0); + WaitForThreadpoolWaitCallbacks(*(PTP_WAIT *)(this + 0x100),1); + CloseThreadpoolWait(*(PTP_WAIT *)(this + 0x100)); + *(undefined8 *)(this + 0x100) = 0; + } + if (*(HANDLE *)(this + 0x90) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this + 0x90)); + *(undefined8 *)(this + 0x90) = 0; + } + if (*(HANDLE *)(this + 0x108) != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)(this + 0x108)); + *(undefined8 *)(this + 0x108) = 0; + } + if (*(longlong *)(this + 0x118) != 0) { + uVar3 = 0; + if (*(int *)(this + 0x110) != 0) { + do { + hMem = *(HLOCAL *)(*(longlong *)(this + 0x118) + uVar3 * 8); + if (hMem != (HLOCAL)0x0) { + LocalFree(hMem); + } + uVar2 = (int)uVar3 + 1; + uVar3 = (ulonglong)uVar2; + } while (uVar2 < *(uint *)(this + 0x110)); + } + LocalFree(*(HLOCAL *)(this + 0x118)); + *(undefined8 *)(this + 0x118) = 0; + *(undefined4 *)(this + 0x110) = 0; + } } ATL::CSimpleStringT::Empty((CSimpleStringT *)this); SmartPtr::~SmartPtr ((SmartPtr *)(this + 0x88)); ATL::CSimpleStringT::~CSimpleStringT ((CSimpleStringT *)this); return; } ``` ## CManagerThread::HandleDeviceEvent ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.12| |i_ratio|0.26| |m_ratio|0.99| |b_ratio|0.54| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|HandleDeviceEvent|HandleDeviceEvent| |fullname|CManagerThread::HandleDeviceEvent|CManagerThread::HandleDeviceEvent| |refcount|2|2| |`length`|1457|1440| |`called`|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::GetValueAt
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Find
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete
ATL::CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_>::Find
ATL::CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_>::RBDelete
ATL::CStringT_>_>::CStringT_>_>
CWorkerThread::ReportVolumeUnavailability
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSectionSmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
SmartPtr::RefCounter::Dec_nRefs
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::operator=
WPP_SF_S
WPP_SF_S_guid_
WPP_SF_Si
WPP_SF_id
WPP_SF_q_guid_
|
Expand for full list:
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::GetValueAt
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Find
ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::RBDelete
ATL::CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_>::Find
ATL::CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_>::RBDelete
ATL::CStringT_>_>::CStringT_>_>
CWorkerThread::ReportVolumeUnavailability
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSectionSmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::~SmartPtr
SmartPtr::SmartPtr
SmartPtr::operator=
SmartPtr::operator=
SmartPtr::~SmartPtr
WPP_SF_S
WPP_SF_S_guid_
WPP_SF_Si
WPP_SF_id
WPP_SF_q_guid_
wil::details::FeatureImpl::__private_IsEnabled
| |calling|CFhService::ServiceControlHandler|CFhService::ServiceControlHandler| |paramcount|3|3| |`address`|18000b2ac|18001cb18| |sig|void __thiscall HandleDeviceEvent(CManagerThread * this, __uint64 param_1, void * param_2)|void __thiscall HandleDeviceEvent(CManagerThread * this, __uint64 param_1, void * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::HandleDeviceEvent Called Diff ```diff --- CManagerThread::HandleDeviceEvent called +++ CManagerThread::HandleDeviceEvent called @@ -15 +14,0 @@ -SmartPtr::RefCounter::Dec_nRefs @@ -18,0 +18 @@ +SmartPtr::~SmartPtr @@ -23,0 +24 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CManagerThread::HandleDeviceEvent Diff ```diff --- CManagerThread::HandleDeviceEvent +++ CManagerThread::HandleDeviceEvent @@ -1,263 +1,249 @@ /* public: void __cdecl CManagerThread::HandleDeviceEvent(unsigned __int64,void * __ptr64) __ptr64 */ void __thiscall CManagerThread::HandleDeviceEvent(CManagerThread *this,__uint64 param_1,void *param_2) { longlong *plVar1; CWorkerThread *pCVar2; bool bVar3; CNode *pCVar4; - longlong lVar5; + CNode *pCVar5; CNode *pCVar6; - CNode *pCVar7; - SmartPtr *pSVar8; - undefined8 uVar9; - undefined2 uVar10; - void *pvVar11; - CConfigDescriptor *pCVar12; - __POSITION *p_Var13; - CManagerThread *this_00; + SmartPtr *pSVar7; + undefined8 uVar8; + LPCRITICAL_SECTION lpCriticalSection; + undefined2 uVar9; + void *pvVar10; + CConfigDescriptor *pCVar11; + __POSITION *p_Var12; + CManagerThread *pCVar13; void *pvVar14; CManagerThread *local_res8; + longlong *local_res18; CStringT_>_> - local_res18 [16]; + local_res20 [8]; pvVar14 = param_2; local_res8 = this; SmartPtr::SmartPtr ((SmartPtr *)&local_res8, (CVolumeTrackingDescriptor *)param_1); bVar3 = false; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); if (*(uint *)((longlong)param_2 + 4) == 6) { - pvVar11 = *(void **)((longlong)param_2 + 0x18); + pvVar10 = *(void **)((longlong)param_2 + 0x18); pCVar4 = ATL:: CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> ::Find((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - *)&DAT_1,pvVar11); - if (pCVar4 != (CNode *)0x0) { + *)&DAT_1,pvVar10); + if (pCVar4 == (CNode *)0x0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { + WPP_SF_q_guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pvVar10,pvVar14, + *(undefined8 *)((longlong)param_2 + 0x18),(longlong)param_2 + 0x20); + } + goto LAB_2; + } + SmartPtr::operator= + ((SmartPtr *)&local_res8, + (SmartPtr *)(pCVar4 + 8)); + pCVar13 = local_res8; + if (param_1 == 0x8006) { + plVar1 = (longlong *)((longlong)param_2 + 0x20); + if ((*plVar1 == 0x11d1c9af50708874) && + (*(longlong *)((longlong)param_2 + 0x28) == 0x326da0c9a000ef8f)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x94, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + *(undefined4 *)(*(longlong *)pCVar13 + 0x10) = 1; + bVar3 = true; + } + else { + if ((*plVar1 == 0x11d20ba8ae2eed10) && + (*(longlong *)((longlong)param_2 + 0x28) == 0x326da0c9a000fb8f)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + uVar9 = 0x95; +LAB_3: + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar9, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + } + else { + if ((*plVar1 != 0x11d1d0cb9a8c3d68) || + (*(longlong *)((longlong)param_2 + 0x28) != 0x326da0c9a000ef8f)) { + if ((*plVar1 == 0x11d21059d16a55e8) && + (*(longlong *)((longlong)param_2 + 0x28) == 0x326da0c9a000fd8f)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x97, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + bVar3 = true; + *(undefined4 *)(*(longlong *)pCVar13 + 0x14) = 1; + } + else { + if ((*plVar1 == 0x11d2105de3c5b178) && + (*(longlong *)((longlong)param_2 + 0x28) == 0x326da0c9a000fd8f)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + uVar9 = 0x98; +LAB_4: + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar9, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + } + else { + if ((*plVar1 != 0x11d21a96b5804878) || + (*(longlong *)((longlong)param_2 + 0x28) != 0x326da0c9a000fd8f)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_S_guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),WPP_GLOBAL_Control, + pvVar14,(wchar_t *)**(undefined8 **)local_res8,plVar1); + } + goto LAB_5; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + uVar9 = 0x99; + goto LAB_4; + } + } + *(undefined4 *)(*(longlong *)pCVar13 + 0x14) = 0; + } + goto LAB_5; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + uVar9 = 0x96; + goto LAB_3; + } + } + *(undefined4 *)(*(longlong *)pCVar13 + 0x10) = 0; + bVar3 = false; + } + } + else if (param_1 == 0x8001) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9b, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + bVar3 = true; + *(undefined4 *)(*(longlong *)pCVar13 + 0x18) = 1; + } + else if (param_1 == 0x8002) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9c, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + *(undefined4 *)(*(longlong *)pCVar13 + 0x18) = 0; + } + else if (param_1 == 0x8004) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9d, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } + pCVar5 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Find((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)&DAT_6,(ushort *)**(undefined8 **)pCVar13); + if (pCVar5 != (CNode *)0x0) { + ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::RBDelete((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)&DAT_6,pCVar5); + } + pCVar4 = ATL:: + CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> + ::Find((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> + *)&DAT_1,*(void **)(*(longlong *)pCVar13 + 8)); + if (pCVar4 != (CNode *)0x0) { + ATL:: + CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> + ::RBDelete((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> + *)&DAT_1,pCVar4); + } SmartPtr::operator= ((SmartPtr *)&local_res8, - (SmartPtr *)(pCVar4 + 8)); - this_00 = local_res8; - if (param_1 == 0x8006) { - plVar1 = (longlong *)((longlong)param_2 + 0x20); - lVar5 = *plVar1 + -0x11d1c9af50708874; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000ef8f; - } - if (lVar5 == 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8a, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - *(undefined4 *)(*(longlong *)this_00 + 0x10) = 1; - bVar3 = true; - } - else { - lVar5 = *plVar1 + -0x11d20ba8ae2eed10; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000fb8f; - } - if (lVar5 == 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar10 = 0x8b; -LAB_2: - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar10, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - } - else { - lVar5 = *plVar1 + -0x11d1d0cb9a8c3d68; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000ef8f; - } - if (lVar5 != 0) { - lVar5 = *plVar1 + -0x11d21059d16a55e8; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000fd8f; - } - if (lVar5 == 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8d, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - bVar3 = true; - *(undefined4 *)(*(longlong *)this_00 + 0x14) = 1; - } - else { - lVar5 = *plVar1 + -0x11d2105de3c5b178; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000fd8f; - } - if (lVar5 == 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar10 = 0x8e; -LAB_3: - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar10, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - } - else { - lVar5 = *plVar1 + -0x11d21a96b5804878; - if (lVar5 == 0) { - lVar5 = *(longlong *)((longlong)param_2 + 0x28) + -0x326da0c9a000fd8f; - } - if (lVar5 != 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - WPP_SF_S_guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),WPP_GLOBAL_Control, - pvVar14,(wchar_t *)**(undefined8 **)local_res8,plVar1); - } - goto LAB_4; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar10 = 0x8f; - goto LAB_3; - } - } - *(undefined4 *)(*(longlong *)this_00 + 0x14) = 0; - } - goto LAB_4; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - uVar10 = 0x8c; - goto LAB_2; - } - } - *(undefined4 *)(*(longlong *)this_00 + 0x10) = 0; - bVar3 = false; - } - } - else if (param_1 == 0x8001) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x91, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - bVar3 = true; - *(undefined4 *)(*(longlong *)this_00 + 0x18) = 1; - } - else if (param_1 == 0x8002) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x92, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - *(undefined4 *)(*(longlong *)this_00 + 0x18) = 0; - } - else if (param_1 == 0x8004) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x93, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } - pCVar6 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Find((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_5,(ushort *)**(undefined8 **)this_00); - if (pCVar6 != (CNode *)0x0) { - ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::RBDelete((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_5,pCVar6); - } - pCVar4 = ATL:: - CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - ::Find((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - *)&DAT_1,*(void **)(*(longlong *)this_00 + 8)); - if (pCVar4 != (CNode *)0x0) { - ATL:: - CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - ::RBDelete((CRBTree,class_ATL::CElementTraits,class_ATL::CElementTraits_>_> - *)&DAT_1,pCVar4); - } - SmartPtr::operator= - ((SmartPtr *)&local_res8, - (CVolumeTrackingDescriptor *)0x0); - this_00 = local_res8; - } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { - WPP_SF_Si(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x94, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids, - (wchar_t *)**(undefined8 **)local_res8); - } -LAB_4: - LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); - if (bVar3) { - EnterCriticalSection((LPCRITICAL_SECTION)&DAT_6); - pCVar12 = (CConfigDescriptor *)DAT_7; - pCVar7 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_7,DAT_7); - while (p_Var13 = (__POSITION *)pCVar7, p_Var13 != (__POSITION *)0x0) { - pSVar8 = (SmartPtr *)&local_res8; - SmartPtr::SmartPtr(pSVar8,pCVar12); - pSVar8 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::GetValueAt((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)pSVar8,p_Var13); - SmartPtr::operator= - ((SmartPtr *)&local_res8,pSVar8); - plVar1 = *(longlong **)(*(longlong *)local_res8 + 0x88); - if (((plVar1 != (longlong *)0x0) && (*plVar1 != 0)) && - (pCVar2 = (CWorkerThread *)*plVar1, *(int *)(pCVar2 + 0x30) == 0)) { - uVar9 = ATL:: - CStringT_>_> - :: - CStringT_>_> - (local_res18, - *(CStringT_>_> - **)this_00); - CWorkerThread::ReportVolumeUnavailability(pCVar2,uVar9); - } - pCVar7 = ATL:: - CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *)&DAT_7,(CNode *)p_Var13); - SmartPtr::~SmartPtr - ((SmartPtr *)&local_res8); - pCVar12 = (CConfigDescriptor *)p_Var13; - } - LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_6); - } - goto LAB_8; - } + (CVolumeTrackingDescriptor *)0x0); + pCVar13 = local_res8; + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 0x10) != 0)) { + WPP_SF_Si(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9e, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids, + (wchar_t *)**(undefined8 **)local_res8); + } +LAB_5: + LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); + if (!bVar3) goto LAB_7; + EnterCriticalSection((LPCRITICAL_SECTION)&DAT_8); + pCVar11 = (CConfigDescriptor *)DAT_9; + pCVar6 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Minimum((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)&DAT_9,DAT_9); + while (p_Var12 = (__POSITION *)pCVar6, p_Var12 != (__POSITION *)0x0) { + pSVar7 = (SmartPtr *)&local_res18; + SmartPtr::SmartPtr(pSVar7,pCVar11); + pSVar7 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::GetValueAt((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)pSVar7,p_Var12); + SmartPtr::operator= + ((SmartPtr *)&local_res18,pSVar7); + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((((!bVar3) && (plVar1 = *(longlong **)(*local_res18 + 0x88), plVar1 != (longlong *)0x0)) + && (*plVar1 != 0)) && (pCVar2 = (CWorkerThread *)*plVar1, *(int *)(pCVar2 + 0x30) == 0)) { + uVar8 = ATL:: + CStringT_>_> + :: + CStringT_>_> + (local_res20, + *(CStringT_>_> + **)pCVar13); + CWorkerThread::ReportVolumeUnavailability(pCVar2,uVar8); + } + pCVar6 = ATL:: + CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + ::Successor((CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> + *)&DAT_9,(CNode *)p_Var12); + SmartPtr::~SmartPtr + ((SmartPtr *)&local_res18); + pCVar11 = (CConfigDescriptor *)p_Var12; + } + lpCriticalSection = (LPCRITICAL_SECTION)&DAT_8; + } + else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - WPP_SF_q_guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),pvVar11,pvVar14, - *(undefined8 *)((longlong)param_2 + 0x18),(longlong)param_2 + 0x20); - } + WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10), + (ulonglong)*(uint *)((longlong)param_2 + 4),pvVar14,param_1); + } +LAB_2: + lpCriticalSection = (LPCRITICAL_SECTION)&DAT_0; } - else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) { - WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),(ulonglong)*(uint *)((longlong)param_2 + 4) - ,pvVar14,param_1); - } - LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); - this_00 = local_res8; -LAB_8: - if (this_00 != (CManagerThread *)0x0) { - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)this_00); - } + LeaveCriticalSection(lpCriticalSection); +LAB_7: + SmartPtr::~SmartPtr + ((SmartPtr *)&local_res8); return; } ``` ## WPP_SF_sS ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.97| |i_ratio|0.7| |m_ratio|1.0| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|WPP_SF_sS|WPP_SF_sS| |fullname|WPP_SF_sS|WPP_SF_sS| |refcount|2|2| |`length`|166|167| |called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |calling|CManagerThread::WaitCallback|CManagerThread::WaitCallback| |paramcount|5|5| |`address`|180010ffc|18001ee8c| |sig|undefined __fastcall WPP_SF_sS(undefined8 param_1, undefined8 param_2, undefined8 param_3, char * param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_sS(undefined8 param_1, undefined8 param_2, undefined8 param_3, char * param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_sS Diff ```diff --- WPP_SF_sS +++ WPP_SF_sS @@ -1,41 +1,41 @@ void WPP_SF_sS(undefined8 param_1,undefined8 param_2,undefined8 param_3,char *param_4, wchar_t *param_5) { longlong lVar1; longlong lVar2; longlong lVar3; if (param_5 == (wchar_t *)0x0) { lVar3 = 10; } else { lVar3 = -1; do { lVar3 = lVar3 + 1; } while (param_5[lVar3] != L'\0'); lVar3 = lVar3 * 2 + 2; } if (param_5 == (wchar_t *)0x0) { param_5 = L"NULL"; } lVar1 = -1; if (param_4 == (char *)0x0) { lVar2 = 5; } else { do { lVar2 = lVar1; lVar1 = lVar2 + 1; } while (param_4[lVar1] != '\0'); lVar2 = lVar2 + 2; } if (param_4 == (char *)0x0) { param_4 = "NULL"; } - TraceMessage(param_1,0x2b,&WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,0xa5,param_4,lVar2, + TraceMessage(param_1,0x2b,&WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,0xba,param_4,lVar2, param_5,lVar3,0); return; } ``` ## FhSvcApiOpenPipe ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.57| |i_ratio|0.37| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|FhSvcApiOpenPipe|FhSvcApiOpenPipe| |fullname|FhSvcApiOpenPipe|FhSvcApiOpenPipe| |refcount|3|3| |`length`|671|692| |`called`|
Expand for full list:
ADVAPI32.DLL::OpenThreadToken
FHSVC_PIPE_HANDLE_rundown
KERNEL32.DLL::GetCurrentThread
KERNEL32.DLL::GetLastError
RPCRT4.DLL::RpcBindingToStringBindingW
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
RPCRT4.DLL::RpcStringFreeW
WPP_SF_d
WPP_SF_qS
WPP_SF_soperator_new
|
Expand for full list:
ADVAPI32.DLL::OpenThreadToken
FHSVC_PIPE_HANDLE_rundown
KERNEL32.DLL::GetCurrentThread
KERNEL32.DLL::GetLastError
RPCRT4.DLL::RpcBindingToStringBindingW
RPCRT4.DLL::RpcImpersonateClient
RPCRT4.DLL::RpcRevertToSelf
RPCRT4.DLL::RpcStringFreeW
WPP_SF_L
WPP_SF_qS
WPP_SF_soperator_new
wil::details::FeatureImpl::__private_IsEnabled
| |calling||| |paramcount|3|3| |`address`|18000e4d0|18001a1c0| |sig|uint __fastcall FhSvcApiOpenPipe(RPC_BINDING_HANDLE param_1, undefined8 * param_2, undefined * param_3)|uint __fastcall FhSvcApiOpenPipe(RPC_BINDING_HANDLE param_1, undefined8 * param_2, undefined * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### FhSvcApiOpenPipe Called Diff ```diff --- FhSvcApiOpenPipe called +++ FhSvcApiOpenPipe called @@ -9 +9 @@ -WPP_SF_d +WPP_SF_L @@ -12,0 +13 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### FhSvcApiOpenPipe Diff ```diff --- FhSvcApiOpenPipe +++ FhSvcApiOpenPipe @@ -1,114 +1,119 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ uint FhSvcApiOpenPipe(RPC_BINDING_HANDLE param_1,undefined8 *param_2,undefined *param_3) { - uint uVar1; + bool bVar1; uint uVar2; - BOOL BVar3; + uint uVar3; + BOOL BVar4; PHANDLE TokenHandle; HANDLE ThreadHandle; - nothrow_t *pnVar4; + nothrow_t *pnVar5; wchar_t *local_res10; local_res10 = (wchar_t *)0x0; - uVar1 = RpcBindingToStringBindingW(param_1,(RPC_WSTR *)&local_res10); - if (uVar1 == 0) { + uVar2 = RpcBindingToStringBindingW(param_1,(RPC_WSTR *)&local_res10); + if (uVar2 == 0) { LAB_0: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { WPP_SF_qS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1b,param_3,param_1,local_res10); } } else if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - if (0 < (int)uVar1) { - uVar1 = uVar1 & 0xffff | 0x80070000; + if (0 < (int)uVar2) { + uVar2 = uVar2 & 0xffff | 0x80070000; } - param_3 = &WPP_efece49b8938379c060169b7945fb4b7_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, - &WPP_efece49b8938379c060169b7945fb4b7_Traceguids,uVar1); + param_3 = &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,uVar2); } goto LAB_0; } *param_2 = 0; - pnVar4 = &std::nothrow; + pnVar5 = &std::nothrow; TokenHandle = operator_new(0x20,&std::nothrow); if (TokenHandle == (PHANDLE)0x0) { - uVar1 = 0x8007000e; + uVar2 = 0x8007000e; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pnVar4 = (nothrow_t *)0x1c; + pnVar5 = (nothrow_t *)0x1c; WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1c, - &WPP_efece49b8938379c060169b7945fb4b7_Traceguids,"pipeContext"); + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,"pipeContext"); } goto LAB_1; } *TokenHandle = (HANDLE)0x0; TokenHandle[1] = (HANDLE)0x0; TokenHandle[2] = (HANDLE)0x0; TokenHandle[3] = (HANDLE)0x0; *param_2 = TokenHandle; LOCK(); _DAT_2 = _DAT_2 + 1; UNLOCK(); - uVar2 = RpcImpersonateClient(param_1); - if (uVar2 == 0) { + uVar3 = RpcImpersonateClient(param_1); + if (uVar3 == 0) { + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + uVar2 = (uint)bVar1 * 2 + 0xc; ThreadHandle = GetCurrentThread(); - pnVar4 = (nothrow_t *)0xc; - BVar3 = OpenThreadToken(ThreadHandle,0xc,1,TokenHandle); - if (BVar3 == 0) { - uVar1 = GetLastError(); - if (0 < (int)uVar1) { - uVar1 = uVar1 & 0xffff | 0x80070000; + pnVar5 = (nothrow_t *)(ulonglong)uVar2; + BVar4 = OpenThreadToken(ThreadHandle,uVar2,1,TokenHandle); + if (BVar4 == 0) { + uVar2 = GetLastError(); + if (0 < (int)uVar2) { + uVar2 = uVar2 & 0xffff | 0x80070000; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pnVar4 = (nothrow_t *)0x1e; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1e, - &WPP_efece49b8938379c060169b7945fb4b7_Traceguids,uVar1); + pnVar5 = (nothrow_t *)0x1e; + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1e, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,uVar2); } - uVar2 = RpcRevertToSelf(); - if (((uVar2 == 0) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || + uVar3 = RpcRevertToSelf(); + if (((uVar3 == 0) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - if (0 < (int)uVar2) { - uVar2 = uVar2 & 0xffff | 0x80070000; + if (0 < (int)uVar3) { + uVar3 = uVar3 & 0xffff | 0x80070000; } - pnVar4 = (nothrow_t *)0x20; + pnVar5 = (nothrow_t *)0x20; } else { - uVar2 = RpcRevertToSelf(); - uVar1 = 0; - if (uVar2 == 0) goto LAB_1; - if (0 < (int)uVar2) { - uVar2 = uVar2 & 0xffff | 0x80070000; + uVar3 = RpcRevertToSelf(); + uVar2 = 0; + if (uVar3 == 0) goto LAB_1; + if (0 < (int)uVar3) { + uVar3 = uVar3 & 0xffff | 0x80070000; } - uVar1 = uVar2; + uVar2 = uVar3; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - pnVar4 = (nothrow_t *)0x1f; + pnVar5 = (nothrow_t *)0x1f; } } else { - if (0 < (int)uVar2) { - uVar2 = uVar2 & 0xffff | 0x80070000; + if (0 < (int)uVar3) { + uVar3 = uVar3 & 0xffff | 0x80070000; } - uVar1 = uVar2; + uVar2 = uVar3; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_1; - pnVar4 = (nothrow_t *)0x1d; + pnVar5 = (nothrow_t *)0x1d; } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),(short)pnVar4, - &WPP_efece49b8938379c060169b7945fb4b7_Traceguids,uVar2); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),(short)pnVar5, + &WPP_c81e3c2de962374901fcc33eb5e5118f_Traceguids,uVar3); LAB_1: if (local_res10 != (wchar_t *)0x0) { RpcStringFreeW((RPC_WSTR *)&local_res10); } - if (((int)uVar1 < 0) && ((longlong *)*param_2 != (longlong *)0x0)) { - FHSVC_PIPE_HANDLE_rundown((longlong *)*param_2,(undefined **)pnVar4); + if (((int)uVar2 < 0) && ((longlong *)*param_2 != (longlong *)0x0)) { + FHSVC_PIPE_HANDLE_rundown((longlong *)*param_2,(undefined **)pnVar5); *param_2 = 0; } - return uVar1; + return uVar2; } ``` ## CFhService::StopServiceCallback ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.49| |i_ratio|0.24| |m_ratio|0.5| |b_ratio|0.49| |match_types|SymbolsHash| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |name|StopServiceCallback|StopServiceCallback| |fullname|CFhService::StopServiceCallback|CFhService::StopServiceCallback| |refcount|3|3| |`length`|407|118| |`called`|CFhService::ReportStatus
CManagerThread::ReleaseResources
CManagerThread::Stop
KERNEL32.DLL::CloseHandle
KERNEL32.DLL::SetEvent
KERNEL32.DLL::UnregisterWaitEx
POWRPROF.DLL::PowerSettingUnregisterNotification
RpcUnregisterServer
WPP_SF_
WPP_SF_d|CFhService::ShutdownService
WPP_SF_| |calling||| |paramcount|2|2| |`address`|1800029f0|180005b30| |sig|void __cdecl StopServiceCallback(void * param_1, uchar param_2)|void __cdecl StopServiceCallback(void * param_1, uchar param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CFhService::StopServiceCallback Called Diff ```diff --- CFhService::StopServiceCallback called +++ CFhService::StopServiceCallback called @@ -1,8 +1 @@ -CFhService::ReportStatus -CManagerThread::ReleaseResources -CManagerThread::Stop -KERNEL32.DLL::CloseHandle -KERNEL32.DLL::SetEvent -KERNEL32.DLL::UnregisterWaitEx -POWRPROF.DLL::PowerSettingUnregisterNotification -RpcUnregisterServer +CFhService::ShutdownService @@ -10 +2,0 @@ -WPP_SF_d ``` ### CFhService::StopServiceCallback Diff ```diff --- CFhService::StopServiceCallback +++ CFhService::StopServiceCallback @@ -1,87 +1,45 @@ /* private: static void __cdecl CFhService::StopServiceCallback(void * __ptr64,unsigned char) */ void __cdecl CFhService::StopServiceCallback(void *param_1,uchar param_2) { uint uVar1; uint uVar2; - long lVar3; - CManagerThread *this; - ulong in_R8D; - bool bVar4; + bool bVar3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - in_R8D = 0x80016610; - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x17, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x18, + &WPP_d4e099ce39e43835819009ba4d29d903_Traceguids); } uVar2 = *(uint *)((longlong)param_1 + 0x38); do { LOCK(); uVar1 = *(uint *)((longlong)param_1 + 0x38); - bVar4 = uVar2 == uVar1; - if (bVar4) { + bVar3 = uVar2 == uVar1; + if (bVar3) { *(uint *)((longlong)param_1 + 0x38) = uVar2 | 2; uVar1 = uVar2; } uVar2 = uVar1; UNLOCK(); - } while (!bVar4); + } while (!bVar3); while ((uVar2 & 1) != 0) { uVar2 = *(uint *)((longlong)param_1 + 0x38); do { LOCK(); uVar1 = *(uint *)((longlong)param_1 + 0x38); - bVar4 = uVar2 == uVar1; - if (bVar4) { + bVar3 = uVar2 == uVar1; + if (bVar3) { *(uint *)((longlong)param_1 + 0x38) = uVar2 | 2; uVar1 = uVar2; } uVar2 = uVar1; UNLOCK(); - } while (!bVar4); + } while (!bVar3); } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 8) != 0)) { - in_R8D = 0x80016610; - WPP_SF_(*(undefined **)((longlong)WPP_GLOBAL_Control + 0x10),0x18, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids); - } - this = *(CManagerThread **)((longlong)param_1 + 0x28); - if (this != (CManagerThread *)0x0) { - UnregisterWaitEx(this,(HANDLE)0x0); - *(undefined8 *)((longlong)param_1 + 0x28) = 0; - } - lVar3 = RpcUnregisterServer(); - if (((lVar3 < 0) && - (this = (CManagerThread *)WPP_GLOBAL_Control, - (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - this = *(CManagerThread **)(WPP_GLOBAL_Control + 0x10); - in_R8D = 0x80016610; - WPP_SF_d(this,0x19,&WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,lVar3); - } - lVar3 = CManagerThread::Stop(this); - if (((lVar3 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - in_R8D = 0x80016610; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, - &WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,lVar3); - } - CManagerThread::ReleaseResources(&g_ManagerThread); - if (*(HANDLE *)((longlong)param_1 + 0x30) != (HANDLE)0x0) { - SetEvent(*(HANDLE *)((longlong)param_1 + 0x30)); - CloseHandle(*(HANDLE *)((longlong)param_1 + 0x30)); - *(undefined8 *)((longlong)param_1 + 0x30) = 0; - } - if (*(longlong *)((longlong)param_1 + 0x48) != 0) { - PowerSettingUnregisterNotification(); - *(undefined8 *)((longlong)param_1 + 0x48) = 0; - } - ReportStatus(param_1,1,in_R8D,0,0); - *(undefined8 *)param_1 = 0; + ShutdownService(param_1); return; } ``` ## CWorkerThread::CWorkerThread ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.38| |i_ratio|0.41| |m_ratio|0.82| |b_ratio|0.62| |match_types|BSIM| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|CWorkerThread|SubscriptionList| |`fullname`|CWorkerThread::CWorkerThread|wil::details_abi::SubscriptionList::SubscriptionList| |`refcount`|3|4| |`length`|92|53| |`called`|ATL::CStringT_>_>::CStringT_>_>|KERNEL32.DLL::InitializeCriticalSectionEx| |`calling`|CManagerThread::CreateWorkerThread
CManagerThread::WaitCallback|wil::details::`dynamic_initializer_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData| |paramcount|1|1| |`address`|18000c0f0|180012404| |`sig`|undefined __thiscall CWorkerThread(CWorkerThread * this)|undefined __thiscall SubscriptionList(SubscriptionList * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CWorkerThread::CWorkerThread Called Diff ```diff --- CWorkerThread::CWorkerThread called +++ wil::details_abi::SubscriptionList::SubscriptionList called @@ -1 +1 @@ -ATL::CStringT_>_>::CStringT_>_> +KERNEL32.DLL::InitializeCriticalSectionEx ``` ### CWorkerThread::CWorkerThread Calling Diff ```diff --- CWorkerThread::CWorkerThread calling +++ wil::details_abi::SubscriptionList::SubscriptionList calling @@ -1,2 +1,2 @@ -CManagerThread::CreateWorkerThread -CManagerThread::WaitCallback +wil::details::`dynamic_initializer_for_'g_featureStateManager'' +wil::details_abi::ProcessLocalStorageData::ProcessLocalStorageData ``` ### CWorkerThread::CWorkerThread Diff ```diff --- CWorkerThread::CWorkerThread +++ wil::details_abi::SubscriptionList::SubscriptionList @@ -1,28 +1,15 @@ -/* public: __cdecl CWorkerThread::CWorkerThread(void) __ptr64 */ +/* public: __cdecl wil::details_abi::SubscriptionList::SubscriptionList(void) __ptr64 */ -CWorkerThread * __thiscall CWorkerThread::CWorkerThread(CWorkerThread *this) +SubscriptionList * __thiscall +wil::details_abi::SubscriptionList::SubscriptionList(SubscriptionList *this) { - *(undefined8 *)this = 0; - *(undefined8 *)(this + 8) = 0; - *(undefined8 *)(this + 0x10) = 0; - ATL:: - CStringT_>_> - :: - CStringT_>_> - ((CStringT_>_> - *)(this + 0x18)); - *(undefined8 *)(this + 0x20) = 0; + InitializeCriticalSectionEx((LPCRITICAL_SECTION)this,0,0); *(undefined8 *)(this + 0x28) = 0; + *(undefined8 *)(this + 0x30) = 0; *(undefined8 *)(this + 0x38) = 0; - *(undefined4 *)(this + 0x40) = 0; - *(undefined4 *)(this + 0x48) = 0; - *(undefined4 *)(this + 0x4c) = 0; - *(undefined4 *)(this + 0x5c) = 0; - *(undefined4 *)(this + 0x30) = 1; - *(undefined4 *)(this + 0x50) = 0xff; - *(undefined8 *)(this + 0x54) = 0; + *(undefined8 *)(this + 0x40) = 0; return this; } ``` ## ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.33| |i_ratio|0.06| |m_ratio|0.82| |b_ratio|0.18| |match_types|Implied Match| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|Minimum|__private_IsEnabled| |`fullname`|ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum|wil::details::FeatureImpl::__private_IsEnabled| |`refcount`|11|40| |`length`|35|78| |`called`||KERNEL32.DLL::GetTickCount
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |`calling`|ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor
CManagerThread::EnterMaintenanceMode
CManagerThread::ExitMaintenanceMode
CManagerThread::HandleDeviceEvent
CManagerThread::StopConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback|
Expand for full list:
CConfigDescriptor::CConfigDescriptor
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::~CConfigDescriptor
CFhService::ShutdownService
CFhService::StartServiceW
CManagerThread::BlockConfig
CManagerThread::CreateWorkerThread
CManagerThread::EnterMaintenanceMode
CManagerThread::ExitMaintenanceMode
CManagerThread::HandleDeviceEvent
CManagerThread::QueueBackupForLoggedOnUserCManagerThread::QueueConfig
CManagerThread::Stop
CManagerThread::StopConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback
FhSvcApiOpenPipe
| |paramcount|2|1| |`address`|1800085d0|180018564| |`sig`|CNode * __thiscall Minimum(CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> * this, CNode * param_1)|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum Called Diff ```diff --- ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum called +++ wil::details::FeatureImpl::__private_IsEnabled called @@ -0,0 +1,3 @@ +KERNEL32.DLL::GetTickCount +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureImpl::ReportUsage ``` ### ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum Calling Diff ```diff --- ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum calling +++ wil::details::FeatureImpl::__private_IsEnabled calling @@ -1 +1,7 @@ -ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Successor +CConfigDescriptor::CConfigDescriptor +CConfigDescriptor::RefreshPoliciesInEngine +CConfigDescriptor::~CConfigDescriptor +CFhService::ShutdownService +CFhService::StartServiceW +CManagerThread::BlockConfig +CManagerThread::CreateWorkerThread @@ -4,0 +11,3 @@ +CManagerThread::QueueBackupForLoggedOnUser +CManagerThread::QueueConfig +CManagerThread::Stop @@ -7,0 +17 @@ +FhSvcApiOpenPipe ``` ### ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum Diff ```diff --- ATL::CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_>::Minimum +++ wil::details::FeatureImpl::__private_IsEnabled @@ -1,35 +1,19 @@ -/* protected: class ATL::CRBTree > >,class SmartPtr,class - ATL::CElementTraits > > >,class ATL::CElementTraits > >::CNode * __ptr64 __cdecl ATL::CRBTree > >,class - SmartPtr,class ATL::CElementTraits > > >,class - ATL::CElementTraits > >::Minimum(class ATL::CRBTree > >,class SmartPtr,class - ATL::CElementTraits > > >,class ATL::CElementTraits > >::CNode * __ptr64)const __ptr64 */ +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ -CNode * __thiscall -ATL:: -CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> -::Minimum(CRBTree_>_>,class_SmartPtr,class_ATL::CElementTraits_>_>_>,class_ATL::CElementTraits_>_> - *this,CNode *param_1) +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) { - CNode *pCVar1; + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; - if ((param_1 != (CNode *)0x0) && (param_1 != *(CNode **)(this + 0x28))) { - do { - pCVar1 = param_1; - param_1 = *(CNode **)(pCVar1 + 0x18); - } while (param_1 != *(CNode **)(this + 0x28)); - return pCVar1; - } - return (CNode *)0x0; + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_2475400507__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); } ``` ## ATL::CStringT_>_>::CStringT_>_> ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.4| |i_ratio|0.25| |m_ratio|0.75| |b_ratio|0.62| |match_types|Implied Match| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|CStringT_>_>|__private_IsEnabled| |`fullname`|ATL::CStringT_>_>::CStringT_>_>|wil::details::FeatureImpl::__private_IsEnabled| |`refcount`|22|40| |`length`|37|78| |`called`|ATL::CSimpleStringT::CloneData|KERNEL32.DLL::GetTickCount
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |`calling`|
Expand for full list:
ATL::CSimpleArray_>_>,class_ATL::CSimpleArrayEqualHelper_>_>_>_>::Add
CManagerThread::BlockConfig
CManagerThread::ClearProtectionState
CManagerThread::CreateWorkerThread
CManagerThread::HandleDeviceEvent
CManagerThread::MigrationFinished
CManagerThread::MigrationStarting
CManagerThread::QueueConfig
CManagerThread::StopConfig
CManagerThread::UnblockConfig
CManagerThread::WaitCallbackFHSVC_PIPE_HANDLE_rundown
FhSvcApiBlockUnblockBackup
FhSvcApiClearProtectionState
FhSvcApiMigrationFinished
FhSvcApiMigrationStarting
FhSvcApiStartBackup
FhSvcApiStopBackup
|
Expand for full list:
CConfigDescriptor::CConfigDescriptor
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::~CConfigDescriptor
CFhService::ShutdownService
CFhService::StartServiceW
CManagerThread::BlockConfig
CManagerThread::CreateWorkerThread
CManagerThread::EnterMaintenanceMode
CManagerThread::ExitMaintenanceMode
CManagerThread::HandleDeviceEvent
CManagerThread::QueueBackupForLoggedOnUserCManagerThread::QueueConfig
CManagerThread::Stop
CManagerThread::StopConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback
FhSvcApiOpenPipe
| |paramcount|2|1| |`address`|18000c020|180018564| |`sig`|undefined __thiscall CStringT_>_>(CStringT_>_> * this, CStringT_>_> * param_1)|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ATL::CStringT_>_>::CStringT_>_> Called Diff ```diff --- ATL::CStringT_>_>::CStringT_>_> called +++ wil::details::FeatureImpl::__private_IsEnabled called @@ -1 +1,3 @@ -ATL::CSimpleStringT::CloneData +KERNEL32.DLL::GetTickCount +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureImpl::ReportUsage ``` ### ATL::CStringT_>_>::CStringT_>_> Calling Diff ```diff --- ATL::CStringT_>_>::CStringT_>_> calling +++ wil::details::FeatureImpl::__private_IsEnabled calling @@ -1 +1,5 @@ -ATL::CSimpleArray_>_>,class_ATL::CSimpleArrayEqualHelper_>_>_>_>::Add +CConfigDescriptor::CConfigDescriptor +CConfigDescriptor::RefreshPoliciesInEngine +CConfigDescriptor::~CConfigDescriptor +CFhService::ShutdownService +CFhService::StartServiceW @@ -3 +6,0 @@ -CManagerThread::ClearProtectionState @@ -4,0 +8,2 @@ +CManagerThread::EnterMaintenanceMode +CManagerThread::ExitMaintenanceMode @@ -6,2 +11 @@ -CManagerThread::MigrationFinished -CManagerThread::MigrationStarting +CManagerThread::QueueBackupForLoggedOnUser @@ -8,0 +13 @@ +CManagerThread::Stop @@ -10 +15 @@ -CManagerThread::UnblockConfig +CManagerThread::UpdatePowerState @@ -12,7 +17 @@ -FHSVC_PIPE_HANDLE_rundown -FhSvcApiBlockUnblockBackup -FhSvcApiClearProtectionState -FhSvcApiMigrationFinished -FhSvcApiMigrationStarting -FhSvcApiStartBackup -FhSvcApiStopBackup +FhSvcApiOpenPipe ``` ### ATL::CStringT_>_>::CStringT_>_> Diff ```diff --- ATL::CStringT_>_>::CStringT_>_> +++ wil::details::FeatureImpl::__private_IsEnabled @@ -1,26 +1,19 @@ -/* public: __cdecl ATL::CStringT > >::CStringT > >(class ATL::CStringT > > const & __ptr64) - __ptr64 */ +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ -CStringT_>_> -* __thiscall -ATL:: -CStringT_>_> -:: -CStringT_>_> - (CStringT_>_> - *this,CStringT_>_> - *param_1) +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) { - CStringData *pCVar1; + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; - pCVar1 = CSimpleStringT::CloneData - ((CStringData *)(*(longlong *)param_1 + -0x18)); - *(CStringData **)this = pCVar1 + 0x18; - return this; + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_2475400507__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); } ``` ## CWorkerThread::Create ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.03| |i_ratio|0.01| |m_ratio|0.08| |b_ratio|0.04| |match_types|Implied Match| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|Create|UpdateRuntimePolicies| |`fullname`|CWorkerThread::Create|CConfigDescriptor::UpdateRuntimePolicies| |`refcount`|3|2| |`length`|5909|225| |`called`|
Expand for full list:
ADVAPI32.DLL::SetThreadToken
API-MS-WIN-CORE-COM-L1-1-0.DLL::CoCreateInstance
ATL::CStringT_>_>::CStringT_>_>
CManagerThread::StartTargetVolumeTracking
KERNEL32.DLL::CreateThreadpoolWork
KERNEL32.DLL::DuplicateHandle
KERNEL32.DLL::GetCurrentProcess
KERNEL32.DLL::GetLastError
LoadUserConfiguration
McGenEventWrite_EventWriteTransfer
McTemplateU0dz_EventWriteTransferMcTemplateU0dzz_EventWriteTransfer
McTemplateU0z_EventWriteTransfer
McTemplateU0zz_EventWriteTransfer
OLEAUT32.DLL::Ordinal_6
WPP_SF_
WPP_SF_SSd
WPP_SF_Sd
WPP_SF_d
WPP_SF_s
WPP_SF_ss
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
|WPP_SF_S| |`calling`|CManagerThread::CreateWorkerThread
CManagerThread::WaitCallback|CManagerThread::CreateWorkerThread| |paramcount|6|2| |`address`|180005270|180010730| |`sig`|long __thiscall Create(CWorkerThread * this, void * param_1, ulong param_2, ulong param_3, _TP_CALLBACK_ENVIRON_V3 * param_4, void * param_5)|void __thiscall UpdateRuntimePolicies(CConfigDescriptor * this, FhBackupType param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CWorkerThread::Create Called Diff ```diff --- CWorkerThread::Create called +++ CConfigDescriptor::UpdateRuntimePolicies called @@ -1,23 +1 @@ -ADVAPI32.DLL::SetThreadToken -API-MS-WIN-CORE-COM-L1-1-0.DLL::CoCreateInstance -ATL::CStringT_>_>::CStringT_>_> -CManagerThread::StartTargetVolumeTracking -KERNEL32.DLL::CreateThreadpoolWork -KERNEL32.DLL::DuplicateHandle -KERNEL32.DLL::GetCurrentProcess -KERNEL32.DLL::GetLastError -LoadUserConfiguration -McGenEventWrite_EventWriteTransfer -McTemplateU0dz_EventWriteTransfer -McTemplateU0dzz_EventWriteTransfer -McTemplateU0z_EventWriteTransfer -McTemplateU0zz_EventWriteTransfer -OLEAUT32.DLL::Ordinal_6 -WPP_SF_ -WPP_SF_SSd -WPP_SF_Sd -WPP_SF_d -WPP_SF_s -WPP_SF_ss -__security_check_cookie -_guard_dispatch_icall$thunk$10345483385596137414 +WPP_SF_S ``` ### CWorkerThread::Create Calling Diff ```diff --- CWorkerThread::Create calling +++ CConfigDescriptor::UpdateRuntimePolicies calling @@ -2 +1,0 @@ -CManagerThread::WaitCallback ``` ### CWorkerThread::Create Diff ```diff --- CWorkerThread::Create +++ CConfigDescriptor::UpdateRuntimePolicies @@ -1,787 +1,59 @@ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* public: long __cdecl CWorkerThread::Create(void * __ptr64,unsigned long,unsigned long,struct - _TP_CALLBACK_ENVIRON_V3 * __ptr64,void * __ptr64) __ptr64 */ +/* public: void __cdecl CConfigDescriptor::UpdateRuntimePolicies(enum FhBackupType) __ptr64 */ -long __thiscall -CWorkerThread::Create - (CWorkerThread *this,void *param_1,ulong param_2,ulong param_3, - _TP_CALLBACK_ENVIRON_V3 *param_4,void *param_5) +void __thiscall +CConfigDescriptor::UpdateRuntimePolicies(CConfigDescriptor *this,FhBackupType param_1) { - CWorkerThread *pCVar1; - CComPtr *ppv; - BOOL BVar2; - DWORD DVar3; - uint uVar4; - int iVar5; - DWORD DVar6; - _TP_CALLBACK_ENVIRON_V3 *p_Var7; - HANDLE hSourceProcessHandle; - longlong lVar8; - PTP_WORK p_Var9; - undefined *puVar10; - longlong *plVar11; - CWorkerThread *pCVar12; - undefined8 uVar13; - PTP_POOL p_Var14; - CWorkerThread *pCVar15; - undefined1 auStackY_118 [32]; - _TP_CALLBACK_ENVIRON_V3 *local_d8; - PTP_POOL local_d0; - PTP_POOL local_c8; - PTP_CLEANUP_GROUP local_c0; - DWORD local_b8; - DWORD local_b0 [2]; - CWorkerThread *local_a8; - CWorkerThread *local_a0; - _EVENT_DATA_DESCRIPTOR local_90; - _EVENT_DATA_DESCRIPTOR local_78; - _EVENT_DATA_DESCRIPTOR *local_68; - undefined8 local_60; - wchar_t *local_58; - ulonglong local_50; - wchar_t *local_48; - int local_40; - undefined4 local_3c; - ulonglong local_38; + undefined8 uVar1; + undefined2 uVar2; - local_38 = __security_cookie ^ (ulonglong)auStackY_118; - uVar4 = 0x80004005; - local_b8 = 0x80004005; - local_a8 = this; - local_a0 = this; - if (param_1 == (void *)0x0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),10, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,"ImpersonationToken"); + *(FhBackupType *)(this + 0x58) = param_1; + if (param_1 != 1) { + if ((param_1 != 2) && (param_1 != 3)) { + return; } - return -0x7ff8ffa9; + *(undefined4 *)(this + 0x60) = *(undefined4 *)(this + 0x50); + uVar1 = 0xffffffffffffffff; + *(undefined8 *)(this + 0x68) = 0xffffffffffffffff; + *(undefined8 *)(this + 0x70) = 0xffffffffffffffff; + *(undefined8 *)(this + 0x78) = 0xffffffffffffffff; + *(undefined4 *)(this + 0x5c) = 2; +LAB_0: + *(undefined8 *)(this + 0x80) = uVar1; + return; } - local_b0[0] = 0; - local_c8 = (PTP_POOL)0x0; - local_d0 = (PTP_POOL)0x0; - local_d8 = (_TP_CALLBACK_ENVIRON_V3 *)0x0; - local_c0 = (PTP_CLEANUP_GROUP)0x0; - *(ulong *)(this + 0x44) = param_2; - *(ulong *)(this + 0x40) = param_3; - *(void **)(this + 0x38) = param_5; - p_Var7 = GetCurrentProcess(); - hSourceProcessHandle = GetCurrentProcess(); - pCVar1 = this + 0x20; - BVar2 = DuplicateHandle(hSourceProcessHandle,param_1,p_Var7,(LPHANDLE)pCVar1,0,0,2); - if (BVar2 == 0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; + *(undefined8 *)(this + 0x5c) = 2; + *(undefined8 *)(this + 0x68) = 0xffffffffffffffff; + *(undefined8 *)(this + 0x70) = 0xffffffffffffffff; + *(undefined8 *)(this + 0x78) = 0xffffffffffffffff; + *(undefined8 *)(this + 0x80) = 0xffffffffffffffff; + if (this[0x120] == (CConfigDescriptor)0xf0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return; } - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); + if ((WPP_GLOBAL_Control[0x1c] & 2) == 0) { + return; } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = this; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } + uVar2 = 0x19; } else { - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McGenEventWrite_EventWriteTransfer - ((REGHANDLE *)&FH_SERVICE_PROVIDER_GUID_Context, - (PCEVENT_DESCRIPTOR)&ConfigurationLoadStart,p_Var7,1,&local_90); + if ((*(int *)(this + 0x128) != 0) || (*(int *)(this + 0x124) != 0)) { + *(undefined8 *)(this + 0x70) = *(undefined8 *)(this + 0x38); + *(undefined8 *)(this + 0x78) = *(undefined8 *)(this + 0x40); + uVar1 = *(undefined8 *)(this + 0x48); + goto LAB_0; } - pCVar15 = local_a8; - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)(this + 0x18); - puVar10 = *(undefined **)pCVar1; - pCVar12 = local_a8; - uVar4 = LoadUserConfiguration - (puVar10,(CComPtr *)local_a8, - (CStringT_>_> - *)p_Var7,(int *)0x0); - local_b8 = uVar4; - if (((int)uVar4 < 0) && ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0)) { - local_68 = &local_90; - local_60 = 4; - lVar8 = -1; - do { - lVar8 = lVar8 + 1; - } while (L""[lVar8] != L'\0'); - local_58 = L""; - local_50 = (ulonglong)((int)lVar8 * 2 + 2); - pCVar12 = (CWorkerThread *)&ConfigurationLoadStop; - puVar10 = &FH_SERVICE_PROVIDER_GUID_Context; - local_90.Ptr._0_4_ = uVar4; - McGenEventWrite_EventWriteTransfer - ((REGHANDLE *)&FH_SERVICE_PROVIDER_GUID_Context, - (PCEVENT_DESCRIPTOR)&ConfigurationLoadStop,p_Var7,3,&local_78); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return; } - if (uVar4 == 0x80040301) { - DVar3 = 0x80040601; - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,0x80040601); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } + if ((WPP_GLOBAL_Control[0x1c] & 2) == 0) { + return; } - else if (uVar4 == 0x80040300) { - DVar3 = 0x80040604; - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,0x80040604); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else if ((int)uVar4 < 0) { - param_4 = p_Var7; - if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { - if ((WPP_GLOBAL_Control[0x1c] & 4) != 0) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_ss(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,"SUCCEEDED(hr)", - "Unexpected Configuration Manager error encountered"); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,uVar4); - } - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - DVar3 = uVar4; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - local_b8 = 0x80004005; - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)(ulonglong)uVar4; - McTemplateU0dz_EventWriteTransfer(puVar10,pCVar12,p_Var7,*(wchar_t **)(this + 0x18)); - } - uVar4 = (**(code **)(**(longlong **)pCVar15 + 0x50))(*(longlong **)pCVar15,local_b0); - local_b8 = uVar4; - if ((int)uVar4 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(this + 0x18)); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - DVar3 = uVar4; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else if (local_b0[0] == 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(this + 0x18)); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - DVar3 = 0x80040602; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else if (local_b0[0] == 1) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x12, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(this + 0x18)); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - DVar3 = 0x80040603; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else if (local_b0[0] == 3) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x13, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,*(wchar_t **)(this + 0x18)); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - DVar3 = 0x80040605; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - uVar4 = 0x80004005; - local_b8 = 0x80004005; - BVar2 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)pCVar1); - if (BVar2 == 0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; - } - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x14, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - plVar11 = *(longlong **)pCVar15; - DVar3 = (**(code **)(*plVar11 + 0xa0))(); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x15, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - p_Var7 = *(_TP_CALLBACK_ENVIRON_V3 **)(this + 0x18); - McTemplateU0z_EventWriteTransfer - (plVar11,(PCEVENT_DESCRIPTOR)&ConfigurationSaveStart,(wchar_t *)p_Var7); - } - plVar11 = *(longlong **)pCVar15; - DVar3 = (**(code **)(*plVar11 + 0x28))(); - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - p_Var7 = *(_TP_CALLBACK_ENVIRON_V3 **)(this + 0x18); - McTemplateU0z_EventWriteTransfer - (plVar11,(PCEVENT_DESCRIPTOR)&ConfigurationSaveStop,(wchar_t *)p_Var7); - } - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x16, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - *(wchar_t **)(this + 0x18)); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - BVar2 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)pCVar1); - if (BVar2 == 0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; - } - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x17, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)&local_d0; - DVar3 = (**(code **)(**(longlong **)pCVar15 + 0xc0))(*(longlong **)pCVar15,0); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x18, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)&local_d8; - DVar3 = (**(code **)(**(longlong **)pCVar15 + 0xc0))(); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x19, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - ppv = (CComPtr *)(pCVar15 + 8); - uVar13 = 0; - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)0x17; - puVar10 = &CLSID_FhCatalog; - DVar3 = CoCreateInstance((IID *)&CLSID_FhCatalog,(LPUNKNOWN)0x0,0x17, - (IID *)&_GUID_fa1e716f_0897_47d0_bb3c_51012844df49, - (LPVOID *)ppv); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0zz_EventWriteTransfer - (puVar10,uVar13,(wchar_t *)local_d0,(wchar_t *)local_d8); - } - plVar11 = *(longlong **)ppv; - p_Var14 = local_d0; - p_Var7 = local_d8; - uVar4 = (**(code **)(*plVar11 + 0x20))(); - local_b8 = uVar4; - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)(ulonglong)uVar4; - McTemplateU0dzz_EventWriteTransfer - (plVar11,p_Var14,uVar4,(wchar_t *)local_d0,(wchar_t *)local_d8); - } - if (uVar4 == 0x8004050e) { - plVar11 = *(longlong **)ppv; - p_Var14 = local_d0; - p_Var7 = local_d8; - DVar3 = (**(code **)(*plVar11 + 0x40))(); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1b, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - goto LAB_0; - } - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - McTemplateU0zz_EventWriteTransfer - (plVar11,p_Var14,(wchar_t *)local_d0,(wchar_t *)local_d8); - } - plVar11 = *(longlong **)ppv; - p_Var14 = local_d0; - p_Var7 = local_d8; - uVar4 = (**(code **)(*plVar11 + 0x20))(); - local_b8 = uVar4; - if ((Microsoft_Windows_FileHistory_ServiceEnableBits & 1) != 0) { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)(ulonglong)uVar4; - McTemplateU0dzz_EventWriteTransfer - (plVar11,p_Var14,uVar4,(wchar_t *)local_d0,(wchar_t *)local_d8); - } - } - if (((uVar4 + 0x7ffbfafb < 10) && - ((0x395U >> (uVar4 + 0x7ffbfafb & 0x1f) & 1) != 0)) || - (uVar4 == 0x800405ff)) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1c, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - (wchar_t *)local_d0,(wchar_t *)local_d8); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - DVar3 = 0x80040604; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else if ((int)uVar4 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1d, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - (wchar_t *)local_d0,(wchar_t *)local_d8); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - DVar3 = uVar4; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - uVar4 = 0x80004005; - local_b8 = 0x80004005; - Ordinal_6(local_d0); - local_d0 = (PTP_POOL)0x0; - Ordinal_6(local_d8); - local_d8 = (_TP_CALLBACK_ENVIRON_V3 *)0x0; - BVar2 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); - if (BVar2 == 0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; - } - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1e, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - DVar3 = (**(code **)(**(longlong **)pCVar15 + 0x60)) - (*(longlong **)pCVar15,&local_c8); - if ((int)DVar3 < 0) { - if (DVar3 != 0x80070490) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1f, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - goto LAB_0; - } - } - else { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)&local_c0; - DVar3 = (**(code **)(*(longlong *)local_c8 + 0x18))(local_c8,1); - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - goto LAB_0; - } - ATL:: - CStringT_>_> - :: - CStringT_>_> - ((CStringT_>_> - *)&local_90,(ushort *)local_c0); - iVar5 = CManagerThread::StartTargetVolumeTracking(); - if (iVar5 == 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 8) != 0)) { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x21, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids); - } - *(uint *)(pCVar15 + 0x40) = *(uint *)(pCVar15 + 0x40) | 1; - } - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - local_c8 = (PTP_POOL)0x0; - } - } - BVar2 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)pCVar1); - if (BVar2 == 0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; - } - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x22, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - p_Var7 = (_TP_CALLBACK_ENVIRON_V3 *)0x17; - DVar3 = CoCreateInstance((IID *)&CLSID_FhEngineBackup,(LPUNKNOWN)0x0, - 0x17,(IID *)& - _GUID_e49f7e50_c070_11df_ac23_18a90531a85a, - (LPVOID *)(pCVar15 + 0x10)); - pCVar1 = local_a8; - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x23, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - pCVar15 = local_a8; - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - pCVar15 = local_a8; - } - } - else { - plVar11 = *(longlong **)(pCVar15 + 0x10); - p_Var7 = *(_TP_CALLBACK_ENVIRON_V3 **)ppv; - DVar3 = (**(code **)(*plVar11 + 0x18)) - (plVar11,*(undefined8 *)local_a8); - pCVar15 = pCVar1; - if ((int)DVar3 < 0) { - param_4 = p_Var7; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x24, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3); - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - p_Var9 = CreateThreadpoolWork(WorkCallback,pCVar1,param_4); - *(PTP_WORK *)(pCVar1 + 0x28) = p_Var9; - if (p_Var9 == (PTP_WORK)0x0) { - DVar3 = GetLastError(); - if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - param_4 = (_TP_CALLBACK_ENVIRON_V3 *) - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x25, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar3) - ; - } - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - else { - *(undefined4 *)(pCVar1 + 0x30) = 0; - Ordinal_6(local_c0); - Ordinal_6(local_d8); - Ordinal_6(local_d0); - if (local_c8 != (PTP_POOL)0x0) { - (**(code **)(*(longlong *)local_c8 + 0x10))(); - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } - } + uVar2 = 0x1a; } -LAB_0: - lVar8 = -1; - BVar2 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); - if (((BVar2 == 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - DVar6 = GetLastError(); - if (0 < (int)DVar6) { - DVar6 = DVar6 & 0xffff | 0x80070000; - } - param_4 = (_TP_CALLBACK_ENVIRON_V3 *)&WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids; - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids,DVar6); - } - if (-1 < (int)DVar3) { - return DVar3; - } - if (DVar3 != 0x80040600) { - if (DVar3 + 0x7ffbf9ff < 3) { - return DVar3; - } - if ((Microsoft_Windows_FileHistory_CoreEnableBits & 2) != 0) { - local_48 = *(wchar_t **)(pCVar15 + 0x18); - local_b0[0] = DVar3; - if (uVar4 != 0x80004005) { - local_b0[0] = uVar4; - } - local_68 = &local_90; - local_60 = 4; - local_58 = (wchar_t *)local_b0; - local_50 = 4; - if (local_48 == (wchar_t *)0x0) { - local_40 = 10; - local_48 = L"NULL"; - } - else { - do { - lVar8 = lVar8 + 1; - } while (local_48[lVar8] != L'\0'); - local_40 = (int)lVar8 * 2 + 2; - } - local_3c = 0; - local_90.Ptr._0_4_ = DVar3; - McGenEventWrite_EventWriteTransfer - ((REGHANDLE *)&FH_CORE_PROVIDER_GUID_Context, - (PCEVENT_DESCRIPTOR)&CycleFailure_Initialization,param_4,4,&local_78); - } - if (DVar3 + 0x7ffbf9ff < 4) { - return DVar3; - } - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, - &WPP_35d9bebdd7d63c9467c96b30e14d7688_Traceguids, - "SUCCEEDED(hr) || (hr >= FHSVC_E_NOT_CONFIGURED && hr <= FHSVC_E_FATAL_CONFIG_ERROR)"); - } - return DVar3; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar2, + &WPP_72f5cb67e6063f82a87b5f5d2d288c2b_Traceguids,*(wchar_t **)this); + return; } ``` ## CManagerThread::PublishProtectionState ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.04| |i_ratio|0.03| |m_ratio|0.11| |b_ratio|0.07| |match_types|Implied Match| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|PublishProtectionState|__private_IsEnabled| |`fullname`|CManagerThread::PublishProtectionState|wil::details::FeatureImpl::__private_IsEnabled| |`refcount`|13|40| |`length`|1380|78| |`called`|
Expand for full list:
ADVAPI32.DLL::SetThreadToken
ATL::CSimpleStringT::PrepareWrite2
ATL::CSimpleStringT::SetLength
ATL::CSimpleStringT::StringLength
ATL::CStringData::Release
KERNEL32.DLL::FileTimeToSystemTime
KERNEL32.DLL::GetDateFormatEx
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetTimeFormatEx
KERNEL32.DLL::SystemTimeToTzSpecificLocalTime
McTemplateU0qz_EventWriteTransferSmartPtr::RefCounter::Dec_nRefs
WPP_SF_d
WPP_SF_s
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
|KERNEL32.DLL::GetTickCount
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |`calling`|CManagerThread::ClearProtectionState
CManagerThread::CreateWorkerThread
CManagerThread::MigrationFinished
CManagerThread::MigrationStarting
CManagerThread::QueueConfig
CManagerThread::WaitCallback|
Expand for full list:
CConfigDescriptor::CConfigDescriptor
CConfigDescriptor::RefreshPoliciesInEngine
CConfigDescriptor::~CConfigDescriptor
CFhService::ShutdownService
CFhService::StartServiceW
CManagerThread::BlockConfig
CManagerThread::CreateWorkerThread
CManagerThread::EnterMaintenanceMode
CManagerThread::ExitMaintenanceMode
CManagerThread::HandleDeviceEvent
CManagerThread::QueueBackupForLoggedOnUserCManagerThread::QueueConfig
CManagerThread::Stop
CManagerThread::StopConfig
CManagerThread::UpdatePowerState
CManagerThread::WaitCallback
FhSvcApiOpenPipe
| |paramcount|2|1| |`address`|1800086d0|180018564| |`sig`|void __thiscall PublishProtectionState(CManagerThread * this, SmartPtr param_1)|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CManagerThread::PublishProtectionState Called Diff ```diff --- CManagerThread::PublishProtectionState called +++ wil::details::FeatureImpl::__private_IsEnabled called @@ -1,16 +1,3 @@ -ADVAPI32.DLL::SetThreadToken -ATL::CSimpleStringT::PrepareWrite2 -ATL::CSimpleStringT::SetLength -ATL::CSimpleStringT::StringLength -ATL::CStringData::Release -KERNEL32.DLL::FileTimeToSystemTime -KERNEL32.DLL::GetDateFormatEx -KERNEL32.DLL::GetLastError -KERNEL32.DLL::GetTimeFormatEx -KERNEL32.DLL::SystemTimeToTzSpecificLocalTime -McTemplateU0qz_EventWriteTransfer -SmartPtr::RefCounter::Dec_nRefs -WPP_SF_d -WPP_SF_s -__security_check_cookie -_guard_dispatch_icall$thunk$10345483385596137414 +KERNEL32.DLL::GetTickCount +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureImpl::ReportUsage ``` ### CManagerThread::PublishProtectionState Calling Diff ```diff --- CManagerThread::PublishProtectionState calling +++ wil::details::FeatureImpl::__private_IsEnabled calling @@ -1 +1,6 @@ -CManagerThread::ClearProtectionState +CConfigDescriptor::CConfigDescriptor +CConfigDescriptor::RefreshPoliciesInEngine +CConfigDescriptor::~CConfigDescriptor +CFhService::ShutdownService +CFhService::StartServiceW +CManagerThread::BlockConfig @@ -3,2 +8,4 @@ -CManagerThread::MigrationFinished -CManagerThread::MigrationStarting +CManagerThread::EnterMaintenanceMode +CManagerThread::ExitMaintenanceMode +CManagerThread::HandleDeviceEvent +CManagerThread::QueueBackupForLoggedOnUser @@ -5,0 +13,3 @@ +CManagerThread::Stop +CManagerThread::StopConfig +CManagerThread::UpdatePowerState @@ -6,0 +17 @@ +FhSvcApiOpenPipe ``` ### CManagerThread::PublishProtectionState Diff ```diff --- CManagerThread::PublishProtectionState +++ wil::details::FeatureImpl::__private_IsEnabled @@ -1,225 +1,19 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* private: void __cdecl CManagerThread::PublishProtectionState(class SmartPtr) __ptr64 */ +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ -void __thiscall CManagerThread::PublishProtectionState(undefined8 param_1,undefined8 *param_2) +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) { - longlong *plVar1; - uint uVar2; - BOOL BVar3; - DWORD DVar4; - int iVar5; - int cchTime; - int iVar6; - DWORD DVar7; - CStringData *pCVar8; - longlong lVar9; - FILETIME *lpFileTime; - undefined2 uVar10; - FILETIME lpDateStr; - uint uVar11; - int iVar12; - undefined1 auStackY_b8 [32]; - FILETIME local_78; - uint local_6c; - undefined8 *local_68; - _SYSTEMTIME local_58; - _SYSTEMTIME local_48; - ulonglong local_38; + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; - local_38 = __security_cookie ^ (ulonglong)auStackY_b8; - local_68 = param_2; - pCVar8 = (CStringData *)(**(code **)(ATL::g_strmgr + 0x18))(&ATL::g_strmgr); - lpDateStr = (FILETIME)((longlong)pCVar8 + 0x18); - DVar4 = 0; - plVar1 = *(longlong **)pCVar8; - local_78 = lpDateStr; - if (*(int *)(pCVar8 + 8) != 0) { - if (*(int *)(pCVar8 + 0x10) < 0) { - ATL::CSimpleStringT::SetLength - ((CSimpleStringT *)&local_78,0); - } - else { - ATL::CStringData::Release(pCVar8); - lVar9 = (**(code **)(*plVar1 + 0x18))(); - lpDateStr = (FILETIME)(lVar9 + 0x18); - local_78 = lpDateStr; - } - } - lpFileTime = (FILETIME *)0x0; - BVar3 = SetThreadToken((PHANDLE)0x0,*(HANDLE *)(*(longlong *)*param_2 + 8)); - if (BVar3 == 0) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar10 = 0x7e; -LAB_1: - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar10, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar4); - } - else { - lVar9 = *(longlong *)*param_2; - uVar11 = *(uint *)(lVar9 + 0x90); - if (8 < uVar11) { - local_48.wYear = 0; - local_48.wMonth = 0; - local_48.wDayOfWeek = 0; - local_48.wDay = 0; - local_48.wHour = 0; - local_48.wMinute = 0; - local_48.wSecond = 0; - local_48.wMilliseconds = 0; - local_58.wYear = 0; - local_58.wMonth = 0; - local_58.wDayOfWeek = 0; - local_58.wDay = 0; - local_58.wHour = 0; - local_58.wMinute = 0; - local_58.wSecond = 0; - local_58.wMilliseconds = 0; - uVar2 = uVar11 | 0xff; - if ((char)uVar11 != -0x10) { - uVar2 = uVar11; - } - uVar11 = uVar2; - lpFileTime = (FILETIME *)(lVar9 + 0x94); - local_6c = uVar11; - if ((*(int *)(lVar9 + 0x98) != 0) || (lpFileTime->dwLowDateTime != 0)) { - BVar3 = FileTimeToSystemTime(lpFileTime,&local_48); - if (BVar3 == 0) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar10 = 0x7f; - } - else { - BVar3 = SystemTimeToTzSpecificLocalTime((TIME_ZONE_INFORMATION *)0x0,&local_48,&local_58); - if (BVar3 == 0) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar10 = 0x80; - } - else { - iVar5 = GetDateFormatEx((LPCWSTR)0x0,0x41,&local_58,(LPCWSTR)0x0,(LPWSTR)0x0,0, - (LPCWSTR)0x0); - if (iVar5 < 1) { - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar10 = 0x81; - } - else { - cchTime = GetTimeFormatEx((LPCWSTR)0x0,2,&local_58,(LPCWSTR)0x0,(LPWSTR)0x0,0); - if (0 < cchTime) { - iVar12 = iVar5 + cchTime; - if ((int)(*(int *)((longlong)lpDateStr + -0xc) - iVar12 | - 1U - *(int *)((longlong)lpDateStr + -8)) < 0) { - ATL::CSimpleStringT::PrepareWrite2 - ((CSimpleStringT *)&local_78,iVar12); - lpDateStr = local_78; - } - iVar6 = GetDateFormatEx((LPCWSTR)0x0,0x41,&local_58,(LPCWSTR)0x0,(LPWSTR)lpDateStr, - iVar5,(LPCWSTR)0x0); - if (iVar6 != iVar5) { - DVar4 = 0x80004005; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x83, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,0x80004005); - } - goto LAB_0; - } - *(undefined2 *)((CStringData *)((longlong)lpDateStr + -2) + (longlong)iVar5 * 2) = - 0x20; - iVar5 = GetTimeFormatEx((LPCWSTR)0x0,2,&local_58,(LPCWSTR)0x0, - (LPWSTR)((longlong)lpDateStr + (longlong)iVar5 * 2),cchTime) - ; - if (iVar5 != cchTime) { - DVar4 = 0x80004005; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x84, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,0x80004005); - } - goto LAB_0; - } - if (iVar12 == -1) { - iVar12 = ATL::CSimpleStringT::StringLength((ushort *)lpDateStr); - } - lpFileTime = &local_78; - ATL::CSimpleStringT::SetLength - ((CSimpleStringT *)lpFileTime,iVar12); - uVar11 = uVar11 | 0x200; - goto LAB_2; - } - DVar4 = GetLastError(); - if (0 < (int)DVar4) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar10 = 0x82; - } - } - } - goto LAB_1; - } - } -LAB_2: - if ((Microsoft_Windows_FileHistory_CoreEnableBits & 1) != 0) { - McTemplateU0qz_EventWriteTransfer - (lpFileTime,(PCEVENT_DESCRIPTOR)&FhStateChanged,uVar11,(wchar_t *)lpDateStr); - } - } -LAB_0: - BVar3 = SetThreadToken((PHANDLE)0x0,(HANDLE)0x0); - if (BVar3 == 0) { - if ((-1 < (int)DVar4) && (DVar4 = GetLastError(), 0 < (int)DVar4)) { - DVar4 = DVar4 & 0xffff | 0x80070000; - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - DVar7 = GetLastError(); - if (0 < (int)DVar7) { - DVar7 = DVar7 & 0xffff | 0x80070000; - } - WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x86, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,DVar7); - } - } - if ((((int)DVar4 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x87, - &WPP_a36920fbec7731c49b02dea361b0ee02_Traceguids,"SUCCEEDED(hr)"); - } - LOCK(); - pCVar8 = (CStringData *)((longlong)lpDateStr + -8); - iVar5 = *(int *)pCVar8; - *(int *)pCVar8 = *(int *)pCVar8 + -1; - UNLOCK(); - if (iVar5 < 2) { - (**(code **)(**(longlong **)((longlong)lpDateStr + -0x18) + 8))(); - } - if ((RefCounter *)*param_2 != (RefCounter *)0x0) { - SmartPtr::RefCounter::Dec_nRefs((RefCounter *)*param_2); - } - return; + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_2475400507__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); } ``` ## WPP_SF_D ### Match Info |Key|fh_5074.dll - fh_8875.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling| |ratio|0.82| |i_ratio|0.81| |m_ratio|0.96| |b_ratio|0.96| |match_types|Implied Match| ### Function Meta Diff |Key|fh_5074.dll|fh_8875.dll| | :---: | :---: | :---: | |`name`|WPP_SF_D|WPP_SF_L| |`fullname`|WPP_SF_D|WPP_SF_L| |`refcount`|3|146| |`length`|65|58| |called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |`calling`|CFhService::ServiceControlHandler|
Expand for full list:
CConfigDescriptor::CachePropertiesInRegistry
CConfigDescriptor::ReloadPolicies
CFhService::ReportStatus
CFhService::ServiceControlHandler
CFhService::SetServiceStartType
CFhService::ShutdownService
CFhService::StartServiceW
CManagerThread::AddRemoveRegisteredConfig
CManagerThread::BlockConfig
CManagerThread::CreateMaintenanceModeEvent
CManagerThread::CreateWorkerThreadCManagerThread::PublishProtectionState
CManagerThread::QueueBackupForAllLoggedOnUsers
CManagerThread::QueueBackupForLoggedOnUser
CManagerThread::QueueConfig
CManagerThread::SetBackupMoratorium
CManagerThread::Start
CManagerThread::Stop
CManagerThread::StopConfig
CManagerThread::UpdatePowerState
CManagerThread::ValidateAndCountRegisteredConfigs
CManagerThread::WaitCallback
CWorkerThread::Create
CWorkerThread::DuplicateConfiguration
CWorkerThread::ReleaseResources
CWorkerThread::Stop
CWorkerThread::WorkCallback
FHSVC_PIPE_HANDLE_rundown
FHSVC_PIPE_HANDLE_rundown$catch$6
FhSvcApiBlockUnblockBackup
FhSvcApiBlockUnblockBackup$catch$7
FhSvcApiClearProtectionState
FhSvcApiClosePipe
FhSvcApiEnterMaintenanceMode
FhSvcApiExitMaintenanceMode
FhSvcApiMigrationFinished
FhSvcApiMigrationStarting
FhSvcApiOpenPipe
FhSvcApiStartBackup
FhSvcApiStopBackup
FhSvcApiStopBackup$catch$6
FhWorkerGetNextUsnBatch
FhWorkerGetUsnRecordForFrn
LoadUserConfiguration
RpcRegisterServer
RpcUnregisterServer
WriteTraceHeader
`CManagerThread::GetConfigDescriptor'::__l1::catch$3
`CManagerThread::PublishProtectionState'::__l1::catch$5
`CManagerThread::SetBackupMoratorium'::__l1::catch$1
`CManagerThread::StartTargetVolumeTracking'::__l1::catch$28
`CManagerThread::StartTargetVolumeTracking'::__l1::catch$29
`CWorkerThread::Create'::__l1::catch$58
`CWorkerThread::ReportVolumeUnavailability'::__l1::catch$3
`LoadUserConfiguration'::__l1::catch$2
| |paramcount|4|4| |`address`|18000d278|180018758| |`sig`|undefined __fastcall WPP_SF_D(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_L(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_D Calling Diff ```diff --- WPP_SF_D calling +++ WPP_SF_L calling @@ -0,0 +1,3 @@ +CConfigDescriptor::CachePropertiesInRegistry +CConfigDescriptor::ReloadPolicies +CFhService::ReportStatus @@ -1,0 +5,51 @@ +CFhService::SetServiceStartType +CFhService::ShutdownService +CFhService::StartServiceW +CManagerThread::AddRemoveRegisteredConfig +CManagerThread::BlockConfig +CManagerThread::CreateMaintenanceModeEvent +CManagerThread::CreateWorkerThread +CManagerThread::PublishProtectionState +CManagerThread::QueueBackupForAllLoggedOnUsers +CManagerThread::QueueBackupForLoggedOnUser +CManagerThread::QueueConfig +CManagerThread::SetBackupMoratorium +CManagerThread::Start +CManagerThread::Stop +CManagerThread::StopConfig +CManagerThread::UpdatePowerState +CManagerThread::ValidateAndCountRegisteredConfigs +CManagerThread::WaitCallback +CWorkerThread::Create +CWorkerThread::DuplicateConfiguration +CWorkerThread::ReleaseResources +CWorkerThread::Stop +CWorkerThread::WorkCallback +FHSVC_PIPE_HANDLE_rundown +FHSVC_PIPE_HANDLE_rundown$catch$6 +FhSvcApiBlockUnblockBackup +FhSvcApiBlockUnblockBackup$catch$7 +FhSvcApiClearProtectionState +FhSvcApiClosePipe +FhSvcApiEnterMaintenanceMode +FhSvcApiExitMaintenanceMode +FhSvcApiMigrationFinished +FhSvcApiMigrationStarting +FhSvcApiOpenPipe +FhSvcApiStartBackup +FhSvcApiStopBackup +FhSvcApiStopBackup$catch$6 +FhWorkerGetNextUsnBatch +FhWorkerGetUsnRecordForFrn +LoadUserConfiguration +RpcRegisterServer +RpcUnregisterServer +WriteTraceHeader +`CManagerThread::GetConfigDescriptor'::__l1::catch$3 +`CManagerThread::PublishProtectionState'::__l1::catch$5 +`CManagerThread::SetBackupMoratorium'::__l1::catch$1 +`CManagerThread::StartTargetVolumeTracking'::__l1::catch$28 +`CManagerThread::StartTargetVolumeTracking'::__l1::catch$29 +`CWorkerThread::Create'::__l1::catch$58 +`CWorkerThread::ReportVolumeUnavailability'::__l1::catch$3 +`LoadUserConfiguration'::__l1::catch$2 ``` ### WPP_SF_D Diff ```diff --- WPP_SF_D +++ WPP_SF_L @@ -1,12 +1,11 @@ -void WPP_SF_D(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined4 param_4) +void WPP_SF_L(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined4 param_4) { undefined4 local_res20 [2]; local_res20[0] = param_4; - TraceMessage(param_1,0x2b,&WPP_305fb7554e703b1695bfea0e3f3a03b2_Traceguids,param_2,local_res20,4,0 - ); + TraceMessage(param_1,0x2b,param_3,param_2,local_res20,4,0); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## Section Skipped **This section was skipped because markdown was too big. Adjust max_section_funcs: 200 to a higher number.** Generated with `ghidriff` version: 1.0.0 on 2026-08-21T21:49:09