# hpm_8521.dll-hpm_8655.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_1648861496getcachedfeatureenabledstate) * [wil::details::FeatureImpl::__private_IsEnabled](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_1648861496__private_isenabled) * [std::filesystem::path::filename](#stdfilesystempathfilename) * [Modified](#modified) * [autologgerProcessor::AutologgerProcessEventCallback](#autologgerprocessorautologgerprocesseventcallback) * [TraceUtil::ProcessEventCallback](#traceutilprocesseventcallback) * [HotpatchMonitor::ReportSvcStatus](#hotpatchmonitorreportsvcstatus) * [std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>](#stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_) * [std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>](#std_hashclass_std_uset_traitsclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_class_std_uhash_compareclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_struct_stdhashclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__struct_stdequal_toclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short___class_stdallocatorclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__0_emplaceclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64) * [std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64>](#stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__reallocate_forclass_lambda_05cef1f6fdf474c9f3ed207deba0f73bunsigned_short_const___ptr64) * [autologgerProcessor::initialize](#autologgerprocessorinitialize) * [`dynamic_initializer_for_'EventHandler::infoEventsToEmit''](#dynamic_initializer_for_eventhandlerinfoeventstoemit) * [HotpatchMonitor::Initialize](#hotpatchmonitorinitialize) * [std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>](#stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_) * [std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64>](#std_list_node_emplace_op2class_stdallocatorstruct_std_list_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64___list_node_emplace_op2class_stdallocatorstruct_std_list_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64__class_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [SubscribeFeatureStateCacheToConfigurationChanges](#subscribefeaturestatecachetoconfigurationchanges) * [Write,struct__tlgWrapperByVal<4>_>](#writestruct__tlgwrapszcharstruct__tlgwrapperbyval4_) * [__GSHandlerCheck_EH4](#__gshandlercheck_eh4) * [Write_>](#writestruct__tlgwrapszchar_) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) * [~basic_string,class_std::allocator_>](#basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_) * [ReportUsageToService](#reportusagetoservice) * [API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free](#api-ms-win-crt-private-l1-1-0dll_o_free) # Visual Chart Diff ```mermaid flowchart LR autologgerProcessorAutologgerProcessEventCallback-1-old<--Match 63%-->autologgerProcessorAutologgerProcessEventCallback-1-new TraceUtilProcessEventCallback-1-old<--Match 61%-->TraceUtilProcessEventCallback-1-new HotpatchMonitorReportSvcStatus-4-old<--Match 79%-->HotpatchMonitorReportSvcStatus-4-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-old<--Match 83%-->stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-new std_Hashclass_std_Uset_traitsclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_class_std_Uhash_compareclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_struct_stdhashclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__struct_stdequal_toclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short___class_stdallocatorclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__0_emplaceclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-2-old<--Match 93%-->std_Hashclass_std_Uset_traitsclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_class_std_Uhash_compareclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_struct_stdhashclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__struct_stdequal_toclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short___class_stdallocatorclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__0_emplaceclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-2-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Reallocate_forclass_lambda_05cef1f6fdf474c9f3ed207deba0f73bunsigned_short_const___ptr64-4-old<--Match 99%-->stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Reallocate_forclass_lambda_05cef1f6fdf474c9f3ed207deba0f73bunsigned_short_const___ptr64-4-new autologgerProcessorinitialize-1-old<--Match 65%-->autologgerProcessorinitialize-1-new dynamic_initializer_for_EventHandlerinfoEventsToEmit-0-old<--Match 76%-->dynamic_initializer_for_EventHandlerinfoEventsToEmit-0-new HotpatchMonitorInitialize-3-old<--Match 96%-->HotpatchMonitorInitialize-3-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-old<--Match 80%-->stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Construct1unsigned_short_const___ptr64-2-new std_List_node_emplace_op2class_stdallocatorstruct_std_List_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64___List_node_emplace_op2class_stdallocatorstruct_std_List_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64__class_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-3-old<--Match 93%-->stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-3-new subgraph hpm_8655.dll autologgerProcessorAutologgerProcessEventCallback-1-new TraceUtilProcessEventCallback-1-new HotpatchMonitorReportSvcStatus-4-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-new std_Hashclass_std_Uset_traitsclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_class_std_Uhash_compareclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_struct_stdhashclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__struct_stdequal_toclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short___class_stdallocatorclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__0_emplaceclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-2-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Reallocate_forclass_lambda_05cef1f6fdf474c9f3ed207deba0f73bunsigned_short_const___ptr64-4-new autologgerProcessorinitialize-1-new dynamic_initializer_for_EventHandlerinfoEventsToEmit-0-new HotpatchMonitorInitialize-3-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Construct1unsigned_short_const___ptr64-2-new stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-3-new subgraph Added direction LR wil-details-FeatureImplstruct___WilFeatureTraits_Feature_1648861496-GetCachedFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_1648861496-__private_IsEnabled std-filesystem-path-filename end end subgraph hpm_8521.dll autologgerProcessorAutologgerProcessEventCallback-1-old TraceUtilProcessEventCallback-1-old HotpatchMonitorReportSvcStatus-4-old stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-old std_Hashclass_std_Uset_traitsclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_class_std_Uhash_compareclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_struct_stdhashclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__struct_stdequal_toclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short___class_stdallocatorclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__0_emplaceclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-2-old stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__Reallocate_forclass_lambda_05cef1f6fdf474c9f3ed207deba0f73bunsigned_short_const___ptr64-4-old autologgerProcessorinitialize-1-old dynamic_initializer_for_EventHandlerinfoEventsToEmit-0-old HotpatchMonitorInitialize-3-old stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_basic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_-2-old std_List_node_emplace_op2class_stdallocatorstruct_std_List_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64___List_node_emplace_op2class_stdallocatorstruct_std_List_nodeclass_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short_void___ptr64__class_stdbasic_stringunsigned_shortstruct_stdchar_traitsunsigned_shortclass_stdallocatorunsigned_short__const___ptr64-3-old end ``` ```mermaid pie showData title Function Matches - 99.7324% "unmatched_funcs_len" : 3 "matched_funcs_len" : 1118 ``` ```mermaid pie showData title Matched Function Similarity - 97.9428% "matched_funcs_with_code_changes_len" : 11 "matched_funcs_with_non_code_changes_len" : 12 "matched_funcs_no_changes_len" : 1095 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 hpm_8521.dll hpm_8655.dll ``` #### Verbose Args
``` --old ['hpm_8521.dll'] --new [['hpm_8655.dll']] --engine VersionTrackingDiff --output-path hpm_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/hpatchmon.dll/F46B423427000/hpatchmon.dll -O hpatchmon.dll.x64.10.0.26100.8521 wget https://msdl.microsoft.com/download/symbols/hpatchmon.dll/93DCC60127000/hpatchmon.dll -O hpatchmon.dll.x64.10.0.26100.8655 ``` ## Binary Metadata Diff ```diff --- hpm_8521.dll Meta +++ hpm_8655.dll Meta @@ -1,44 +1,44 @@ -Program Name: hpm_8521.dll +Program Name: hpm_8655.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 163184 +# of Bytes: 163216 # of Memory Blocks: 9 -# of Instructions: 18878 -# of Defined Data: 1896 -# of Functions: 558 -# of Symbols: 4252 +# of Instructions: 19366 +# of Defined Data: 1906 +# of Functions: 563 +# of Symbols: 4307 # of Data Types: 544 -# of Data Type Categories: 40 +# of Data Type Categories: 41 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 22 11:21:39 SGT 2026 +Date Created: Sat Aug 22 11:21:42 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/hpm/hpm_8521.dll -Executable MD5: 5be466a6acb0b4e76a810ac56d63e13c -Executable SHA256: ed153cdb035b2a12773dfc079e9e4d609da116fbd1898b0ee9cd8949f16cfcee -FSRL: file:///tmp/hpm/hpm_8521.dll?MD5=5be466a6acb0b4e76a810ac56d63e13c +Executable Location: /tmp/hpm/hpm_8655.dll +Executable MD5: bfae7e2ef7998b3b328a7340c61ffdd2 +Executable SHA256: 501b504c570e6f1c5192559255d10bd57a19fefee73eb8b9f08ffb089213a869 +FSRL: file:///tmp/hpm/hpm_8655.dll?MD5=bfae7e2ef7998b3b328a7340c61ffdd2 PDB Age: 1 PDB File: hpatchmon.pdb -PDB GUID: e3afb9c4-ab20-2848-f636-74555b00da23 +PDB GUID: 1624d3e5-b7d1-aacd-6c7d-df3019ddffce PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Hotpatch Monitoring Service -PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8655 (WinBuild.160101.0800) PE Property[InternalName]: hpatchmon.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: hpatchmon.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8521 +PE Property[ProductVersion]: 10.0.26100.8655 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra hpm_8521.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra hpm_8521.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra hpm_8521.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra hpm_8655.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra hpm_8655.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra hpm_8655.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|3| |deleted_funcs_len|0| |modified_funcs_len|23| |added_symbols_len|2| |deleted_symbols_len|0| |diff_time|4.321869373321533| |deleted_strings_len|0| |added_strings_len|2| |match_types|Counter({'SymbolsHash': 540, 'ExternalsName': 138, 'SigCallingCalledHasher': 4, 'BulkBasicBlockMnemonicHash': 2, 'Implied Match': 2})| |items_to_process|28| |diff_types|Counter({'address': 18, 'refcount': 15, 'code': 11, 'length': 11, 'calling': 9, 'called': 7, 'sig': 3, 'name': 2, 'fullname': 2, 'parent': 1})| |unmatched_funcs_len|3| |total_funcs_len|1121| |matched_funcs_len|1118| |matched_funcs_with_code_changes_len|11| |matched_funcs_with_non_code_changes_len|12| |matched_funcs_no_changes_len|1095| |match_func_similarity_percent|97.9428%| |func_match_overall_percent|99.7324%| |first_matches|Counter({'SymbolsHash': 540, 'SigCallingCalledHasher': 4, 'BulkBasicBlockMnemonicHash': 2, 'Implied Match': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 540 "ExternalsName" : 138 "SigCallingCalledHasher" : 4 "BulkBasicBlockMnemonicHash" : 2 "Implied-Match" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 540 "SigCallingCalledHasher" : 4 "BulkBasicBlockMnemonicHash" : 2 "Implied-Match" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 3 "deleted_funcs_len" : 0 "modified_funcs_len" : 23 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 2 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 2 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,2 @@ +s_Autologger:_Encountered_event_w +s_Realtime:_Encountered_event_wit ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_Autologger:_Encountered_event_w|2|AutologgerProcessEventCallback| |s_Realtime:_Encountered_event_wit|2|ProcessEventCallback| # Deleted # Added ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|hpm_8655.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|424| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|1800061c8| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,103 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + code *pcVar3; + uint uVar4; + uint *in_RDX; + uint uVar5; + uint uVar6; + bool bVar7; + int local_res10 [2]; + + in_RDX[0] = 0; + uVar1 = Feature_1648861496__private_cppFeatureState; + in_RDX[1] = 0; + *in_RDX = Feature_1648861496__private_cppFeatureState; + if (((byte)uVar1 & 6) == 6) { + return; + } + uVar1 = EnsureSubscribedToFeatureConfigurationChanges(); + local_res10[0] = 0; + pcVar3 = g_wil_details_internalGetFeatureEnabledState; + if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && + (pcVar3 = g_wil_details_apiGetFeatureEnabledState, + g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { + uVar2 = 0; + } + else { + uVar2 = (*pcVar3)(0x3b4cf46,3,local_res10); + } + uVar5 = (((uVar2 & 3) << 2 | uVar2 & 0x40) << 2 | uVar2 & 0x80) * 8; + if ((uVar2 & 0xffffff3f) == 0) { + uVar5 = uVar5 | 0x40; + } + else { + uVar4 = 0; + if ((uVar2 & 0xffffff3f) == 2) { + uVar4 = 0x40; + } + uVar5 = uVar5 | uVar4; + } + bVar7 = false; + if ((uVar5 & 0xc00) == 0xc00) { + bVar7 = true; +LAB_180006295: + if (((uVar5 & 0x40) == 0) || (!bVar7)) { + uVar2 = 0; + goto LAB_1800062a7; + } + } + else if ((uVar5 & 0x40) == 0) goto LAB_180006295; + uVar2 = 1; +LAB_1800062a7: + uVar5 = uVar5 | uVar2; + uVar2 = *in_RDX; + do { + uVar6 = uVar2; + uVar4 = uVar6 | 0x40000; + *in_RDX = uVar4; + if ((local_res10[0] != 0) && ((uVar6 & 2) == 0)) { + uVar4 = (uVar4 ^ uVar5) & 0x180 ^ uVar4; + uVar4 = (uVar4 ^ uVar5) & 0x40 ^ uVar4; + uVar4 = (uVar4 ^ uVar5) & 1 ^ uVar4; + uVar4 = (uVar4 ^ uVar5) & 0x800 ^ uVar4 | 2; + *in_RDX = uVar4; + } + if ((uVar6 & 4) == 0) { + uVar4 = uVar4 ^ (uVar5 ^ uVar4) & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + bVar7 = uVar6 != Feature_1648861496__private_cppFeatureState; + uVar2 = uVar6; + if (bVar7) { + uVar2 = Feature_1648861496__private_cppFeatureState; + uVar4 = Feature_1648861496__private_cppFeatureState; + } + Feature_1648861496__private_cppFeatureState = uVar4; + UNLOCK(); + } while (bVar7); + if ((uVar6 & 4) == 0) { + SubscribeFeatureStateCacheToConfigurationChanges + ((wil_details_FeatureStateCache *)&Feature_1648861496__private_cppFeatureState,3,uVar1 + ); + } + if ((*in_RDX & 2) == 0) { + uVar1 = (uVar5 ^ *in_RDX) & 0x180 ^ *in_RDX; + uVar1 = (uVar5 ^ uVar1) & 0x40 ^ uVar1; + uVar1 = (uVar1 ^ uVar5) & 1 ^ uVar1; + *in_RDX = (uVar1 ^ uVar5) & 0x800 ^ uVar1; + } + return; +} + ``` ## wil::details::FeatureImpl::__private_IsEnabled ### Function Meta |Key|hpm_8655.dll| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl::__private_IsEnabled| |refcount|10| |length|151| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|HotpatchMonitor::Initialize
HotpatchMonitor::ReportSvcStatus
TraceUtil::ProcessEventCallback
autologgerProcessor::AutologgerProcessEventCallback
autologgerProcessor::initialize| |paramcount|1| |address|18000cee4| |sig|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::__private_IsEnabled +++ wil::details::FeatureImpl::__private_IsEnabled @@ -0,0 +1,36 @@ + +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) + +{ + undefined8 *puVar1; + uint uVar2; + FeatureImpl *this_00; + bool bVar3; + undefined4 local_res8; + undefined2 local_resc; + undefined8 local_res10; + __uint64 in_stack_fffffffffffffff0; + + this_00 = this; + GetCachedFeatureEnabledState(this); + bVar3 = (bool)((byte)local_res10 & 1); + uVar2 = Feature_1648861496__private_cppFeatureState; + if ((Feature_1648861496__private_cppFeatureState & 4) == 0) { + puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this_00); + local_res10 = *puVar1; + uVar2 = (uint)local_res10; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x3b4cf46,uVar2 >> 10 & 1, + uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3,3, + in_stack_fffffffffffffff0); + return bVar3; +} + ``` ## std::filesystem::path::filename ### Function Meta |Key|hpm_8655.dll| | :---: | :---: | |name|filename| |fullname|std::filesystem::path::filename| |refcount|2| |length|354| |called|std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>| |calling|autologgerProcessor::initialize| |paramcount|1| |address|18000fc60| |sig|path __thiscall filename(path * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- std::filesystem::path::filename +++ std::filesystem::path::filename @@ -0,0 +1,61 @@ + +/* public: class std::filesystem::path __cdecl std::filesystem::path::filename(void)const __ptr64 */ + +void __thiscall std::filesystem::path::filename(path *this) + +{ + path *ppVar1; + path *ppVar2; + longlong lVar3; + path *ppVar4; + basic_string,class_std::allocator_> + *in_RDX; + path *ppVar5; + + ppVar5 = this; + if (7 < *(ulonglong *)(this + 0x18)) { + ppVar5 = *(path **)this; + } + lVar3 = *(longlong *)(this + 0x10); + ppVar2 = ppVar5 + lVar3 * 2; + if (1 < lVar3) { + if ((*(uint *)ppVar5 & 0xffffffdf) - 0x3a0041 < 0x1a) { + ppVar5 = ppVar5 + 4; + } + else if ((*(short *)ppVar5 == 0x5c) || (*(short *)ppVar5 == 0x2f)) { + if ((((lVar3 < 4) || ((*(short *)(ppVar5 + 6) != 0x5c && (*(short *)(ppVar5 + 6) != 0x2f)))) + || ((lVar3 != 4 && ((*(short *)(ppVar5 + 8) == 0x5c || (*(short *)(ppVar5 + 8) == 0x2f)))) + )) || ((((*(short *)(ppVar5 + 2) != 0x5c && (*(short *)(ppVar5 + 2) != 0x2f)) || + ((*(short *)(ppVar5 + 4) != 0x3f && (*(short *)(ppVar5 + 4) != 0x2e)))) && + ((*(short *)(ppVar5 + 2) != 0x3f || (*(short *)(ppVar5 + 4) != 0x3f)))))) { + if ((5 < (longlong)((longlong)ppVar2 - (longlong)ppVar5 & 0xfffffffffffffffeU)) && + ((((*(short *)(ppVar5 + 2) == 0x5c || (*(short *)(ppVar5 + 2) == 0x2f)) && + (*(short *)(ppVar5 + 4) != 0x5c)) && (*(short *)(ppVar5 + 4) != 0x2f)))) { + for (ppVar5 = ppVar5 + 6; + ((ppVar5 != ppVar2 && (*(short *)ppVar5 != 0x5c)) && (*(short *)ppVar5 != 0x2f)); + ppVar5 = ppVar5 + 2) { + } + } + } + else { + ppVar5 = ppVar5 + 6; + } + } + } + for (; (ppVar1 = ppVar2, ppVar5 != ppVar2 && + ((*(short *)ppVar5 == 0x5c || (*(short *)ppVar5 == 0x2f)))); ppVar5 = ppVar5 + 2) { + } + do { + ppVar4 = ppVar1; + if ((ppVar5 == ppVar4) || (ppVar1 = ppVar4 + -2, *(short *)ppVar1 == 0x5c)) break; + } while (*(short *)ppVar1 != 0x2f); + *(undefined8 *)in_RDX = 0; + *(undefined8 *)(in_RDX + 8) = 0; + *(undefined8 *)(in_RDX + 0x10) = 0; + *(undefined8 *)(in_RDX + 0x18) = 0; + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + (in_RDX,(ushort *)ppVar4,(longlong)ppVar2 - (longlong)ppVar4 >> 1); + return; +} + ``` # Modified *Modified functions contain code changes* ## autologgerProcessor::AutologgerProcessEventCallback ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.19| |i_ratio|0.39| |m_ratio|0.95| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|AutologgerProcessEventCallback|AutologgerProcessEventCallback| |fullname|autologgerProcessor::AutologgerProcessEventCallback|autologgerProcessor::AutologgerProcessEventCallback| |refcount|4|4| |`length`|2490|2716| |`called`|
Expand for full list:
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::FileTimeToSystemTime
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::SystemTimeToTzSpecificLocalTime
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcstoul
API-MS-WIN-EVENTING-TDH-L1-1-0.DLL::TdhFormatProperty
EventHandler::isAcceptableError
EventHandler::isEmitInformationalEvent
MSVCP_WIN.DLL::std::basic_ios_>::clear
McGenEventWrite_EventWriteTransfer
RegUtil::SetHotpatchError
StringCchPrintfExWTraceUtil::GetEventInformation
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write_>
_tlgWriteTemplate::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary>
_tlgWriteTransfer_EventWriteTransfer
std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>
std::basic_stringstream,class_std::allocator_>::str
std::basic_stringstream,class_std::allocator_>::str
std::operator<<_>
|
Expand for full list:
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::FileTimeToSystemTime
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::SystemTimeToTzSpecificLocalTime
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcstoul
API-MS-WIN-EVENTING-TDH-L1-1-0.DLL::TdhFormatProperty
EventHandler::isAcceptableError
EventHandler::isEmitInformationalEvent
MSVCP_WIN.DLL::std::basic_ios_>::clear
McGenEventWrite_EventWriteTransfer
RegUtil::SetHotpatchError
StringCchPrintfExWTraceUtil::GetEventInformation
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write_>
_tlgWriteTemplate::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary>
_tlgWriteTransfer_EventWriteTransfer
std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>
std::basic_stringstream,class_std::allocator_>::str
std::basic_stringstream,class_std::allocator_>::str
std::operator<<_>
wil::details::FeatureImpl::__private_IsEnabled
| |calling||| |paramcount|1|1| |`address`|18000e8f0|18000edd0| |sig|void __cdecl AutologgerProcessEventCallback(_EVENT_RECORD * param_1)|void __cdecl AutologgerProcessEventCallback(_EVENT_RECORD * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### autologgerProcessor::AutologgerProcessEventCallback Called Diff ```diff --- autologgerProcessor::AutologgerProcessEventCallback called +++ autologgerProcessor::AutologgerProcessEventCallback called @@ -19 +19 @@ -std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> @@ -23,0 +24 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### autologgerProcessor::AutologgerProcessEventCallback Diff ```diff --- autologgerProcessor::AutologgerProcessEventCallback +++ autologgerProcessor::AutologgerProcessEventCallback @@ -1,498 +1,540 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* private: static void __cdecl autologgerProcessor::AutologgerProcessEventCallback(struct _EVENT_RECORD * __ptr64) */ void __cdecl autologgerProcessor::AutologgerProcessEventCallback(_EVENT_RECORD *param_1) { - bool bVar1; - _TRACE_EVENT_INFO *p_Var2; - long lVar3; - bool bVar4; - int iVar5; - long lVar6; - _tlgProvider_t *p_Var7; - ulonglong uVar8; - longlong lVar9; - undefined8 uVar10; - _EVENT_RECORD *p_Var11; + _TRACE_EVENT_INFO *p_Var1; + long lVar2; + bool bVar3; + int iVar4; + long lVar5; + uint uVar6; + basic_ostream_> *pbVar7; + longlong lVar8; + FeatureImpl *pFVar9; basic_stringstream,class_std::allocator_> - *pbVar12; - undefined *puVar13; - short sVar14; - _TRACE_EVENT_INFO *p_Var15; - longlong lVar16; - longlong lVar17; - _GUID *p_Var18; + *pbVar10; + undefined *puVar11; + ushort uVar12; + short sVar13; + ulonglong uVar14; + longlong lVar15; + ulonglong uVar16; ushort **lpLocalTime; + _GUID *p_Var17; _GUID *in_R9; - _tlgProvider_t *p_Var19; - ushort uVar20; - short sVar21; - longlong lVar22; - _tlgProvider_t *p_Var23; + uint uVar18; + _TRACE_EVENT_INFO *p_Var19; + _tlgProvider_t *p_Var20; + longlong lVar21; + _tlgProvider_t *p_Var22; undefined1 auStackY_188 [32]; - char *local_120; + char *local_128; + char local_120; _TRACE_EVENT_INFO *local_118; - char *local_110; - ushort local_108; - ulong local_104; - undefined4 local_100; - _tlgProvider_t *local_f8; - short local_f0; - FILETIME local_e8; - wchar_t *local_e0; - short local_d8; - wchar_t *local_d0; - short local_c8; - _SYSTEMTIME local_b0; - _SYSTEMTIME local_a0; + byte local_110; + char *local_108; + ulong local_100; + ushort local_fc; + undefined4 local_f8; + _tlgProvider_t *local_f0; + short local_e8; + FILETIME local_e0; + wchar_t *local_d8; + short local_d0; + wchar_t *local_c8; + undefined8 uStack_c0; + undefined8 local_b8; + undefined8 uStack_b0; + _SYSTEMTIME local_a8; + _SYSTEMTIME local_98; _EVENT_DATA_DESCRIPTOR local_88; _TRACE_EVENT_INFO **local_78; undefined8 local_70; _tlgProvider_t *local_68; ulonglong local_60; char **local_58; undefined8 local_50; undefined8 *local_48; int local_40; undefined4 local_3c; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_188; - lVar6 = 0; - local_120 = (char *)((ulonglong)local_120 & 0xffffffff00000000); + lVar5 = 0; + local_128 = (char *)((ulonglong)local_128 & 0xffffffff00000000); local_118 = (_TRACE_EVENT_INFO *)0x0; - local_b0.wYear = 0; - local_b0.wMonth = 0; - local_b0.wDayOfWeek = 0; - local_b0.wDay = 0; - local_b0.wHour = 0; - local_b0.wMinute = 0; - local_b0.wSecond = 0; - local_b0.wMilliseconds = 0; - local_a0.wYear = 0; - local_a0.wMonth = 0; - local_a0.wDayOfWeek = 0; - local_a0.wDay = 0; - local_a0.wHour = 0; - local_a0.wMinute = 0; - local_a0.wSecond = 0; - local_a0.wMilliseconds = 0; - local_e8.dwLowDateTime = 0; - local_e8.dwHighDateTime = 0; - local_100 = 0; - local_108 = 0; - bVar4 = false; + local_a8.wYear = 0; + local_a8.wMonth = 0; + local_a8.wDayOfWeek = 0; + local_a8.wDay = 0; + local_a8.wHour = 0; + local_a8.wMinute = 0; + local_a8.wSecond = 0; + local_a8.wMilliseconds = 0; + local_98.wYear = 0; + local_98.wMonth = 0; + local_98.wDayOfWeek = 0; + local_98.wDay = 0; + local_98.wHour = 0; + local_98.wMinute = 0; + local_98.wSecond = 0; + local_98.wMilliseconds = 0; + local_e0.dwLowDateTime = 0; + local_e0.dwHighDateTime = 0; + local_f8 = 0; + local_fc = 0; + local_120 = '\0'; + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; std:: basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> ((basic_string,class_std::allocator_> - *)&local_d0,(ushort *)L""); + *)&local_c8,(ushort *)L"",0); std:: basic_stringstream,class_std::allocator_> ::str(&messageBuilder, (basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std::basic_ios_>::clear ((basic_ios_> *) (&messageBuilder + *(int *)(_messageBuilder + 4)),0,false); + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; std:: basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> ((basic_string,class_std::allocator_> - *)&local_d0,(ushort *)L""); + *)&local_c8,(ushort *)L"",0); std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder, (basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); - p_Var18 = (_GUID *)0x0; + *)&local_c8); + lpLocalTime = (ushort **)0x0; std::basic_ios_>::clear ((basic_ios_> *) (&propertyPairBuilder + *(int *)(_propertyPairBuilder + 4)),0,false); - p_Var19 = *(_tlgProvider_t **)(param_1 + 0x18); - if (((p_Var19 != (_tlgProvider_t *)0x5d73406c7e9e8b9c) || + p_Var20 = *(_tlgProvider_t **)(param_1 + 0x18); + if (((p_Var20 != (_tlgProvider_t *)0x5d73406c7e9e8b9c) || (*(longlong *)(param_1 + 0x20) != 0x3ede3aea500f66e5)) || (*(longlong *)(param_1 + 0x30) != 0x20)) { - if (p_Var19 != (_tlgProvider_t *)0x44f55620a99b2eb4) { + if (p_Var20 != (_tlgProvider_t *)0x44f55620a99b2eb4) { return; } if (*(longlong *)(param_1 + 0x20) != -0x69d140112d06fd65) { return; } if (*(longlong *)(param_1 + 0x30) != 1) { return; } } if (((byte)param_1[4] & 0xc) != 0) { return; } if (((byte)param_1[4] & 0x40) == 0) { if (DAT_0 < 6) { return; } - local_120 = "Encountered hot patch event w/o 64 bit header"; + local_128 = "Encountered hot patch event w/o 64 bit header"; _tlgWriteTemplate ::Write_> - (p_Var19,&DAT_1,p_Var18,in_R9,(_tlgWrapSz *)&local_120); + (p_Var20,&DAT_1,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_128); return; } - p_Var11 = param_1; - local_104 = TraceUtil::GetEventInformation(param_1,&local_118); - p_Var2 = local_118; - if (local_104 == 0) { + pFVar9 = (FeatureImpl *)param_1; + local_100 = TraceUtil::GetEventInformation(param_1,&local_118); + p_Var1 = local_118; + if (local_100 == 0) { if (*(int *)(local_118 + 0x30) != 3) goto LAB_2; - if (*(int *)(local_118 + 0x44) != 0) { - p_Var23 = (_tlgProvider_t *)(local_118 + *(uint *)(local_118 + 0x44)); - local_e8 = *(FILETIME *)(param_1 + 0x10); - FileTimeToSystemTime(&local_e8,&local_b0); - lpLocalTime = (ushort **)&local_a0; + if (*(int *)(local_118 + 0x44) == 0) { + if (DAT_0 < 6) { + return; + } + local_128 = "Encountered event w/o a name."; + puVar11 = &DAT_3; + } + else { + p_Var22 = (_tlgProvider_t *)(local_118 + *(uint *)(local_118 + 0x44)); + local_e0 = *(FILETIME *)(param_1 + 0x10); + FileTimeToSystemTime(&local_e0,&local_a8); + lpLocalTime = (ushort **)&local_98; SystemTimeToTzSpecificLocalTime - ((TIME_ZONE_INFORMATION *)0x0,&local_b0,(LPSYSTEMTIME)lpLocalTime); - p_Var19 = *(_tlgProvider_t **)(param_1 + 0x60); - p_Var15 = (_TRACE_EVENT_INFO *)(p_Var19 + *(ushort *)(param_1 + 0x56)); - local_118 = p_Var15; - p_Var7 = (_tlgProvider_t *) - std::operator<<_> - ((basic_ostream_> *) - &DAT_3,(ushort *)L"[Autologger]"); - std::operator<<_> - ((basic_ostream_> *)p_Var7, - (ushort *)p_Var23); - uVar20 = 0; - lVar3 = 0; - if (*(int *)(p_Var2 + 0x68) != 0) { + ((TIME_ZONE_INFORMATION *)0x0,&local_a8,(LPSYSTEMTIME)lpLocalTime); + p_Var20 = *(_tlgProvider_t **)(param_1 + 0x60); + pFVar9 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((!bVar3) || (p_Var20 != (_tlgProvider_t *)0x0)) { + p_Var19 = (_TRACE_EVENT_INFO *) + ((ulonglong)*(ushort *)(param_1 + 0x56) + *(longlong *)(param_1 + 0x60)); + local_118 = p_Var19; + pbVar7 = std::operator<<_> + ((basic_ostream_> + *)&DAT_4,(ushort *)L"[Autologger]"); + std::operator<<_> + (pbVar7,(ushort *)p_Var22); + pFVar9 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + local_110 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + uVar12 = 0; + lVar2 = 0; + if (*(int *)(p_Var1 + 0x68) != 0) { + do { + lVar5 = lVar2; + lpLocalTime = &propertyValue; + uVar14 = (ulonglong)uVar12; + in_R9 = (_GUID *)(uVar14 * 3); + if (p_Var19 < p_Var20) { + if (5 < DAT_0) { + local_108 = "event data overflow!"; + _tlgWriteTemplate + ::Write_> + ((_tlgProvider_t *)pFVar9,&DAT_5,(_GUID *)&propertyValue,in_R9, + (_tlgWrapSz *)&local_108); + } + break; + } + uVar18 = *(uint *)(p_Var1 + uVar14 * 0x18 + 0x74); + if (uVar18 == 0) { + if (5 < DAT_0) { + local_108 = "event property w/o name!"; + _tlgWriteTemplate + ::Write_> + ((_tlgProvider_t *)0x0,&DAT_6,(_GUID *)&propertyValue,in_R9, + (_tlgWrapSz *)&local_108); + } + break; + } + uVar6 = *(uint *)(p_Var1 + uVar14 * 0x18 + 0x70); + if ((uVar6 & 0x8d) != 0) { + if (5 < DAT_0) { + local_108 = "unexpected event property flags"; + puVar11 = &DAT_7; +LAB_8: + local_118 = (_TRACE_EVENT_INFO *)CONCAT44(local_118._4_4_,uVar6); + _tlgWriteTemplate + ::Write,struct__tlgWrapperByVal<4>_> + ((_tlgProvider_t *)(ulonglong)uVar18,puVar11,(_GUID *)&propertyValue,in_R9 + ,(_tlgWrapSz *)&local_108,(_tlgWrapperByVal<4> *)&local_118); + } + break; + } + if (*(ushort *)(p_Var1 + uVar14 * 0x18 + 0x80) != 1) { + if (5 < DAT_0) { + uVar6 = (uint)*(ushort *)(p_Var1 + uVar14 * 0x18 + 0x80); + local_108 = "unexpected event property count"; + puVar11 = &DAT_9; + goto LAB_8; + } + break; + } + local_f8 = 0x1000; + in_R9 = (_GUID *)(ulonglong)*(ushort *)(p_Var1 + uVar14 * 0x18 + 0x78); + lpLocalTime = (ushort **)0x8; + p_Var19 = p_Var1; + local_100 = TdhFormatProperty(); + if (local_100 != 0) { + if (5 < DAT_0) { + local_118 = (_TRACE_EVENT_INFO *)CONCAT44(local_118._4_4_,local_100); + local_108 = "could not format event property "; + _tlgWriteTemplate + ::Write,struct__tlgWrapperByVal<4>_> + ((_tlgProvider_t *)p_Var19,&DAT_10,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapSz *)&local_108,(_tlgWrapperByVal<4> *)&local_118); + } + break; + } + p_Var20 = p_Var20 + local_fc; + in_R9 = (_GUID *)0x0; + StringCchPrintfExW((ushort *)&propertyPair,(((ulonglong)local_110 ^ 1) + 1) * 0x800, + (ushort **)0x0,(__uint64 *)0x0,0,(ushort *)L", %s: %s"); + std::operator<<_> + ((basic_ostream_> *) + &DAT_4,(ushort *)&propertyPair); + std::operator<<_> + ((basic_ostream_> *) + &DAT_11,(ushort *)&propertyPair); + iVar4 = _o__wcsicmp((_tlgProvider_t *)(p_Var1 + (longlong)(ulonglong)uVar18),L"Status"); + if ((iVar4 == 0) && (iVar4 = _o__wcsicmp(&propertyValue,L"0x0"), iVar4 != 0)) { + local_120 = '\x01'; + lVar5 = _o_wcstoul(&propertyValue,0,0x10); + } + uVar12 = uVar12 + 1; + pFVar9 = (FeatureImpl *)(ulonglong)uVar12; + lpLocalTime = &propertyValue; + p_Var19 = local_118; + lVar2 = lVar5; + } while ((uint)uVar12 < *(uint *)(p_Var1 + 0x68)); + } + lVar8 = std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + uVar14 = *(longlong *)(lVar8 + 0x10) + 1; + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_c8); + lVar21 = -1; + lVar8 = -1; do { - lVar6 = lVar3; - lpLocalTime = &propertyValue; - uVar8 = (ulonglong)uVar20; - in_R9 = (_GUID *)(uVar8 * 3); - if (p_Var15 < p_Var19) { - if (5 < DAT_0) { - local_110 = "event data overflow!"; - puVar13 = &DAT_4; -LAB_5: - _tlgWriteTemplate - ::Write_> - (p_Var7,puVar13,(_GUID *)&propertyValue,in_R9,(_tlgWrapSz *)&local_110 - ); - } - break; + lVar15 = lVar8; + lVar8 = lVar15 + 1; + } while (*(short *)(p_Var22 + lVar8 * 2) != 0); + uVar16 = lVar15 + 2; + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar3) { + if (0xfffe < uVar14) { + uVar14 = 0xffff; } - p_Var15 = (_TRACE_EVENT_INFO *)(ulonglong)*(uint *)(p_Var2 + uVar8 * 0x18 + 0x74); - if (*(uint *)(p_Var2 + uVar8 * 0x18 + 0x74) == 0) { - if (5 < DAT_0) { - local_110 = "event property w/o name!"; - puVar13 = &DAT_6; - p_Var7 = (_tlgProvider_t *)0x0; - goto LAB_5; - } - break; - } - if ((*(uint *)(p_Var2 + uVar8 * 0x18 + 0x70) & 0x8d) != 0) { - if (5 < DAT_0) { - local_118 = (_TRACE_EVENT_INFO *) - CONCAT44(local_118._4_4_,*(uint *)(p_Var2 + uVar8 * 0x18 + 0x70)); - local_110 = "unexpected event property flags"; - puVar13 = &DAT_7; -LAB_8: - _tlgWriteTemplate - ::Write,struct__tlgWrapperByVal<4>_> - ((_tlgProvider_t *)p_Var15,puVar13,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapSz *)&local_110,(_tlgWrapperByVal<4> *)&local_118); - } - break; - } - if (*(ushort *)(p_Var2 + uVar8 * 0x18 + 0x80) != 1) { - if (5 < DAT_0) { - local_118 = (_TRACE_EVENT_INFO *) - CONCAT44(local_118._4_4_,(uint)*(ushort *)(p_Var2 + uVar8 * 0x18 + 0x80)); - local_110 = "unexpected event property count"; - puVar13 = &DAT_9; - goto LAB_8; - } - break; - } - p_Var7 = (_tlgProvider_t *)(p_Var2 + (longlong)p_Var15); - local_100 = 0x1000; - in_R9 = (_GUID *)(ulonglong)*(ushort *)(p_Var2 + uVar8 * 0x18 + 0x78); - lpLocalTime = (ushort **)0x8; - p_Var15 = p_Var2; - local_104 = TdhFormatProperty(); - if (local_104 != 0) { - if (5 < DAT_0) { - local_118 = (_TRACE_EVENT_INFO *)CONCAT44(local_118._4_4_,local_104); - local_110 = "could not format event property "; - puVar13 = &DAT_10; - goto LAB_8; - } - break; - } - p_Var19 = p_Var19 + local_108; - in_R9 = (_GUID *)0x0; - StringCchPrintfExW((ushort *)&propertyPair,0x1000,(ushort **)0x0,(__uint64 *)0x0,0, - (ushort *)L", %s: %s"); - std::operator<<_> - ((basic_ostream_> *) - &DAT_3,(ushort *)&propertyPair); - std::operator<<_> - ((basic_ostream_> *) - &DAT_11,(ushort *)&propertyPair); - iVar5 = _o__wcsicmp(p_Var7,L"Status"); - if ((iVar5 == 0) && (iVar5 = _o__wcsicmp(&propertyValue,L"0x0"), iVar5 != 0)) { - bVar4 = true; - lVar6 = _o_wcstoul(&propertyValue,0,0x10); - } - uVar20 = uVar20 + 1; - p_Var7 = (_tlgProvider_t *)(ulonglong)uVar20; - lpLocalTime = &propertyValue; - p_Var15 = local_118; - lVar3 = lVar6; - } while ((uint)uVar20 < *(uint *)(p_Var2 + 0x68)); - } - lVar9 = std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - lVar22 = *(longlong *)(lVar9 + 0x10) + 1; - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_d0); - lVar17 = -1; - bVar1 = false; - lVar9 = -1; - do { - lVar16 = lVar9; - lVar9 = lVar16 + 1; - } while (*(short *)(p_Var23 + lVar9 * 2) != 0); - lVar16 = lVar16 + 2; - sVar21 = (short)lVar22; - sVar14 = (short)lVar16; - if (bVar4) { - bVar4 = EventHandler::isAcceptableError(lVar6); - if (!bVar4) { - if ((Microsoft_Windows_Hotpatch_MonitorEnableBits & 2) != 0) { - local_48 = (undefined8 *) - std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - bVar1 = true; - if (7 < (ulonglong)local_48[3]) { - local_48 = (undefined8 *)*local_48; - } - local_40 = (int)lVar22; - local_120 = (char *)CONCAT44(local_120._4_4_,local_40); - iVar5 = (int)lVar16; - local_118 = (_TRACE_EVENT_INFO *)CONCAT44(local_118._4_4_,iVar5); - local_78 = &local_118; - local_70 = 4; - local_60 = (ulonglong)(uint)(iVar5 * 2); - local_58 = &local_120; - local_50 = 4; - local_40 = local_40 * 2; - local_3c = 0; - local_68 = p_Var23; - McGenEventWrite_EventWriteTransfer - (local_48,(PCEVENT_DESCRIPTOR)&AutoLoggerEventError,lpLocalTime,in_R9, - &local_88); - } - if (bVar1) { - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_d0); - } - if (((5 < DAT_12) && ((_DAT_18001e090 & 0x800000000000) != 0)) && - ((DAT_13 & 0x800000000000) == DAT_13)) { - pbVar12 = &propertyPairBuilder; - local_e0 = (wchar_t *) - std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_e0 + 0xc)) { - local_e0 = *(wchar_t **)local_e0; - } - local_d8 = sVar21 * 2; - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - local_f0 = sVar14 * 2; - local_d0 = L"Autologger"; - local_c8 = 0x14; - local_110 = (char *)0x1000000; - local_118 = (_TRACE_EVENT_INFO *)0x80000000; - local_f8 = p_Var23; - _tlgWriteTemplate - :: - Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar12,&DAT_14,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<8> *)&local_118,(_tlgWrapperByVal<8> *)&local_110, - (_tlgWrapperBinary *)&local_d0,(_tlgWrapperBinary *)&local_f8, - (_tlgWrapperByVal<4> *)&local_120,(_tlgWrapperBinary *)&local_e0); - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88); - } - if (5 < DAT_0) { - pbVar12 = &propertyPairBuilder; - local_d0 = (wchar_t *) - std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar21 * 2; - do { - lVar17 = lVar17 + 1; - } while (*(short *)(p_Var23 + lVar17 * 2) != 0); - local_f0 = (short)lVar17 * 2; - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - local_f8 = p_Var23; - _tlgWriteTemplate - ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar12,&DAT_15,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<4> *)&local_120,(_tlgWrapperBinary *)&local_f8, - (_tlgWrapperBinary *)&local_d0); - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88); - } - if (AutoRemediate != 0) { - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - lVar6 = RegUtil::SetHotpatchError((ulong *)&local_120); - if ((lVar6 < 0) && (5 < DAT_0)) { - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - local_68 = (_tlgProvider_t *)&local_120; - local_60 = 4; - _tlgWriteTransfer_EventWriteTransfer - (0x18001e048,&DAT_16,(LPCGUID)0x0,(LPCGUID)0x0,3,&local_88); - } + if (0xfffe < uVar16) { + uVar16 = 0xffff; } } - } - else { - uVar10 = std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88,(ushort *)p_Var23); - bVar4 = EventHandler::isEmitInformationalEvent(uVar10); - if (bVar4) { - if (((5 < DAT_12) && ((_DAT_18001e090 & 0x400000000000) != 0)) && - ((DAT_13 & 0x400000000000) == DAT_13)) { - pbVar12 = &propertyPairBuilder; - local_d0 = (wchar_t *) - std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar21 * 2; - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - local_f0 = sVar14 * 2; - local_e0 = L"Autologger"; - local_d8 = 0x14; - local_110 = (char *)0x1000000; - local_118 = (_TRACE_EVENT_INFO *)0x80000000; - local_f8 = p_Var23; - _tlgWriteTemplate - :: - Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar12,&DAT_17,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<8> *)&local_118,(_tlgWrapperByVal<8> *)&local_110, - (_tlgWrapperBinary *)&local_e0,(_tlgWrapperBinary *)&local_f8, - (_tlgWrapperByVal<4> *)&local_120,(_tlgWrapperBinary *)&local_d0); - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88); - } - if (5 < DAT_0) { - pbVar12 = &propertyPairBuilder; - local_d0 = (wchar_t *) - std:: - basic_stringstream,class_std::allocator_> - ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar21 * 2; - do { - lVar17 = lVar17 + 1; - } while (*(short *)(p_Var23 + lVar17 * 2) != 0); - local_f0 = (short)lVar17 * 2; - local_120 = (char *)CONCAT44(local_120._4_4_,lVar6); - local_f8 = p_Var23; - _tlgWriteTemplate - ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar12,&DAT_15,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<4> *)&local_120,(_tlgWrapperBinary *)&local_f8, - (_tlgWrapperBinary *)&local_d0); - std:: - basic_string,class_std::allocator_> - :: - ~basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88); + sVar13 = (short)uVar14; + if (local_120 == '\0') { + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; + p_Var17 = (_GUID *)0xffffffffffffffff; + do { + p_Var17 = (_GUID *)((longlong)&p_Var17->Data1 + 1); + } while (*(short *)(p_Var22 + (longlong)p_Var17 * 2) != 0); + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_c8,(ushort *)p_Var22,(__uint64)p_Var17); + bVar3 = EventHandler::isEmitInformationalEvent(&local_c8); + if (bVar3) { + if (((5 < DAT_12) && ((_DAT_18001e090 & 0x400000000000) != 0)) && + ((DAT_13 & 0x400000000000) == DAT_13)) { + pbVar10 = &propertyPairBuilder; + local_c8 = (wchar_t *) + std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar13 * 2); + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + local_e8 = (short)uVar16 * 2; + local_d8 = L"Autologger"; + local_d0 = 0x14; + local_108 = (char *)0x1000000; + local_118 = (_TRACE_EVENT_INFO *)0x80000000; + local_f0 = p_Var22; + _tlgWriteTemplate + :: + Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> + ((_tlgProvider_t *)pbVar10,&DAT_14,p_Var17,in_R9, + (_tlgWrapperByVal<8> *)&local_118,(_tlgWrapperByVal<8> *)&local_108, + (_tlgWrapperBinary *)&local_d8,(_tlgWrapperBinary *)&local_f0, + (_tlgWrapperByVal<4> *)&local_128,(_tlgWrapperBinary *)&local_c8); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_88); + } + if (5 < DAT_0) { + pbVar10 = &propertyPairBuilder; + local_c8 = (wchar_t *) + std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar13 * 2); + do { + lVar21 = lVar21 + 1; + } while (*(short *)(p_Var22 + lVar21 * 2) != 0); + local_e8 = (short)lVar21 * 2; + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + local_f0 = p_Var22; + _tlgWriteTemplate + ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> + ((_tlgProvider_t *)pbVar10,&DAT_15,p_Var17,in_R9, + (_tlgWrapperByVal<4> *)&local_128,(_tlgWrapperBinary *)&local_f0, + (_tlgWrapperBinary *)&local_c8); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_88); + } } } + else { + bVar3 = EventHandler::isAcceptableError(lVar5); + if (!bVar3) { + if ((Microsoft_Windows_Hotpatch_MonitorEnableBits & 2) == 0) { + uVar18 = (uint)local_128; + } + else { + local_48 = (undefined8 *) + std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + if (7 < (ulonglong)local_48[3]) { + local_48 = (undefined8 *)*local_48; + } + local_128 = (char *)CONCAT44(local_128._4_4_,(int)uVar14); + local_118 = (_TRACE_EVENT_INFO *)CONCAT44(local_118._4_4_,(int)uVar16); + local_78 = &local_118; + local_70 = 4; + local_60 = (ulonglong)(uint)((int)uVar16 * 2); + local_58 = &local_128; + local_50 = 4; + local_40 = (int)uVar14 * 2; + local_3c = 0; + local_68 = p_Var22; + McGenEventWrite_EventWriteTransfer + (local_48,(PCEVENT_DESCRIPTOR)&AutoLoggerEventError,lpLocalTime,in_R9, + &local_88); + uVar18 = 1; + } + if ((uVar18 & 1) != 0) { + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_c8); + } + if (((5 < DAT_12) && ((_DAT_18001e090 & 0x800000000000) != 0)) && + ((DAT_13 & 0x800000000000) == DAT_13)) { + pbVar10 = &propertyPairBuilder; + local_d8 = (wchar_t *) + std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + if (7 < *(ulonglong *)(local_d8 + 0xc)) { + local_d8 = *(wchar_t **)local_d8; + } + local_d0 = sVar13 * 2; + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + local_e8 = (short)uVar16 * 2; + local_c8 = L"Autologger"; + uStack_c0 = CONCAT62(uStack_c0._2_6_,0x14); + local_108 = (char *)0x1000000; + local_118 = (_TRACE_EVENT_INFO *)0x80000000; + local_f0 = p_Var22; + _tlgWriteTemplate + :: + Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> + ((_tlgProvider_t *)pbVar10,&DAT_16,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<8> *)&local_118,(_tlgWrapperByVal<8> *)&local_108, + (_tlgWrapperBinary *)&local_c8,(_tlgWrapperBinary *)&local_f0, + (_tlgWrapperByVal<4> *)&local_128,(_tlgWrapperBinary *)&local_d8); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_88); + } + if (5 < DAT_0) { + pbVar10 = &propertyPairBuilder; + local_c8 = (wchar_t *) + std:: + basic_stringstream,class_std::allocator_> + ::str(&propertyPairBuilder); + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar13 * 2); + do { + lVar21 = lVar21 + 1; + } while (*(short *)(p_Var22 + lVar21 * 2) != 0); + local_e8 = (short)lVar21 * 2; + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + local_f0 = p_Var22; + _tlgWriteTemplate + ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> + ((_tlgProvider_t *)pbVar10,&DAT_15,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<4> *)&local_128,(_tlgWrapperBinary *)&local_f0, + (_tlgWrapperBinary *)&local_c8); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)&local_88); + } + if (AutoRemediate != 0) { + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + lVar5 = RegUtil::SetHotpatchError((ulong *)&local_128); + if ((lVar5 < 0) && (5 < DAT_0)) { + local_128 = (char *)CONCAT44(local_128._4_4_,lVar5); + local_68 = (_tlgProvider_t *)&local_128; + local_60 = 4; + _tlgWriteTransfer_EventWriteTransfer + (0x18001e048,&DAT_17,(LPCGUID)0x0,(LPCGUID)0x0,3,&local_88); + } + } + } + } + goto LAB_2; } - goto LAB_2; - } - if (DAT_0 < 6) { - return; - } - local_120 = "Encountered event w/o a name."; - puVar13 = &DAT_18; + if (DAT_0 < 6) goto LAB_18000f7f8; + local_128 = "Autologger: Encountered event with NULL user data!"; + puVar11 = &DAT_18; + } } else { if (DAT_0 < 6) { return; } - local_120 = "TraceUtil::GetEventInformation failed with"; - puVar13 = &DAT_19; + local_128 = "TraceUtil::GetEventInformation failed with"; + puVar11 = &DAT_19; } _tlgWriteTemplate ::Write_> - ((_tlgProvider_t *)p_Var11,puVar13,p_Var18,in_R9,(_tlgWrapSz *)&local_120); + ((_tlgProvider_t *)pFVar9,puVar11,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapSz *)&local_128); LAB_2: if (5 < DAT_0) { - local_120 = (char *)CONCAT44(local_120._4_4_,local_104); - local_68 = (_tlgProvider_t *)&local_120; + local_128 = (char *)CONCAT44(local_128._4_4_,local_100); + local_68 = (_tlgProvider_t *)&local_128; local_60 = 4; _tlgWriteTransfer_EventWriteTransfer (0x18001e048,&DAT_20,(LPCGUID)0x0,(LPCGUID)0x0,3,&local_88); } return; } ``` ## TraceUtil::ProcessEventCallback ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.5| |i_ratio|0.4| |m_ratio|0.96| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|ProcessEventCallback|ProcessEventCallback| |fullname|TraceUtil::ProcessEventCallback|TraceUtil::ProcessEventCallback| |refcount|4|4| |`length`|2825|3003| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObject
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::FileTimeToSystemTime
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::SystemTimeToTzSpecificLocalTime
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcstoul
API-MS-WIN-EVENTING-CONSUMER-L1-1-0.DLL::CloseTrace
API-MS-WIN-EVENTING-TDH-L1-1-0.DLL::TdhFormatProperty
EventHandler::isAcceptableError
EventHandler::isEmitInformationalEventMSVCP_WIN.DLL::std::basic_ios_>::clear
McGenEventWrite_EventWriteTransfer
RegUtil::SetHotpatchError
StringCchPrintfExW
TraceUtil::GetEventInformation
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write_>
_tlgWriteTemplate::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary>
_tlgWriteTransfer_EventWriteTransfer
std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>
std::basic_stringstream,class_std::allocator_>::str
std::basic_stringstream,class_std::allocator_>::str
std::chrono::steady_clock::now
std::operator<<_>
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForSingleObject
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::FileTimeToSystemTime
API-MS-WIN-CORE-TIMEZONE-L1-1-0.DLL::SystemTimeToTzSpecificLocalTime
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcstoul
API-MS-WIN-EVENTING-CONSUMER-L1-1-0.DLL::CloseTrace
API-MS-WIN-EVENTING-TDH-L1-1-0.DLL::TdhFormatProperty
EventHandler::isAcceptableError
EventHandler::isEmitInformationalEventMSVCP_WIN.DLL::std::basic_ios_>::clear
McGenEventWrite_EventWriteTransfer
RegUtil::SetHotpatchError
StringCchPrintfExW
TraceUtil::GetEventInformation
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>
_tlgWriteTemplate::Write_>
_tlgWriteTemplate::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary>
_tlgWriteTransfer_EventWriteTransfer
std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>
std::basic_stringstream,class_std::allocator_>::str
std::basic_stringstream,class_std::allocator_>::str
std::chrono::steady_clock::now
std::operator<<_>
wil::details::FeatureImpl::__private_IsEnabled
| |calling||| |paramcount|1|1| |`address`|180011090|180011850| |sig|void __cdecl ProcessEventCallback(_EVENT_RECORD * param_1)|void __cdecl ProcessEventCallback(_EVENT_RECORD * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### TraceUtil::ProcessEventCallback Called Diff ```diff --- TraceUtil::ProcessEventCallback called +++ TraceUtil::ProcessEventCallback called @@ -23 +23 @@ -std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> @@ -28,0 +29 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### TraceUtil::ProcessEventCallback Diff ```diff --- TraceUtil::ProcessEventCallback +++ TraceUtil::ProcessEventCallback @@ -1,546 +1,594 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* public: static void __cdecl TraceUtil::ProcessEventCallback(struct _EVENT_RECORD * __ptr64) */ void __cdecl TraceUtil::ProcessEventCallback(_EVENT_RECORD *param_1) { - _TRACE_EVENT_INFO *p_Var1; + ushort uVar1; _TRACE_EVENT_INFO *p_Var2; bool bVar3; ulong uVar4; int iVar5; uint uVar6; long lVar7; DWORD DVar8; _TRACE_EVENT_INFO *p_Var9; - _tlgProvider_t *p_Var10; - ulonglong uVar11; - longlong lVar12; - undefined8 uVar13; - longlong *plVar14; - longlong *plVar15; - _EVENT_RECORD *p_Var16; + basic_ostream_> *pbVar10; + longlong lVar11; + longlong *plVar12; + longlong *plVar13; + _EVENT_RECORD *p_Var14; + FeatureImpl *pFVar15; + _tlgProvider_t *p_Var16; basic_stringstream,class_std::allocator_> *pbVar17; undefined *puVar18; - ushort uVar19; - short sVar20; - longlong lVar21; - longlong lVar22; + short sVar19; + _TRACE_EVENT_INFO *p_Var20; + ulonglong uVar21; + ushort uVar22; + longlong lVar23; + ulonglong uVar24; + LPSYSTEMTIME p_Var25; LPSYSTEMTIME lpLocalTime; _GUID *in_R9; - short sVar23; - int iVar24; - _TRACE_EVENT_INFO *p_Var25; _TRACE_EVENT_INFO *p_Var26; longlong lVar27; undefined1 auStackY_198 [32]; char *local_138; char local_130; - char *local_128; - _TRACE_EVENT_INFO *local_120; - ushort local_118; - ulonglong local_110; - undefined4 local_108; - ulong local_104; - _TRACE_EVENT_INFO *local_100; - short local_f8; - FILETIME local_f0; - longlong *local_e8; - wchar_t *local_e0; - short local_d8; - wchar_t *local_d0; - short local_c8; - _SYSTEMTIME local_b0; - _SYSTEMTIME local_a0; + _TRACE_EVENT_INFO *local_128; + byte local_120; + char *local_118; + ushort local_110; + ulonglong local_108; + undefined4 local_100; + ulong local_fc; + _TRACE_EVENT_INFO *local_f8; + short local_f0; + FILETIME local_e8; + longlong *local_e0; + wchar_t *local_d8; + short local_d0; + wchar_t *local_c8; + undefined8 uStack_c0; + undefined8 local_b8; + undefined8 uStack_b0; + _SYSTEMTIME local_a8; + _SYSTEMTIME local_98; _EVENT_DATA_DESCRIPTOR local_88; char **local_78; undefined8 local_70; _TRACE_EVENT_INFO *local_68; ulonglong local_60; char **local_58; undefined8 local_50; char **local_48; ulonglong local_40; ulonglong local_38; + lpLocalTime = &local_98; local_38 = __security_cookie ^ (ulonglong)auStackY_198; p_Var9 = (_TRACE_EVENT_INFO *)0x0; lVar7 = 0; - local_110 = local_110 & 0xffffffff00000000; - plVar15 = *(longlong **)(param_1 + 0x68); - local_120 = (_TRACE_EVENT_INFO *)0x0; - p_Var25 = (_TRACE_EVENT_INFO *)0x0; - local_b0.wYear = 0; - local_b0.wMonth = 0; - local_b0.wDayOfWeek = 0; - local_b0.wDay = 0; - local_b0.wHour = 0; - local_b0.wMinute = 0; - local_b0.wSecond = 0; - local_b0.wMilliseconds = 0; - local_a0.wYear = 0; - local_a0.wMonth = 0; - local_a0.wDayOfWeek = 0; - local_a0.wDay = 0; - local_a0.wHour = 0; - local_a0.wMinute = 0; - local_a0.wSecond = 0; - local_a0.wMilliseconds = 0; - local_f0.dwLowDateTime = 0; - local_f0.dwHighDateTime = 0; - local_108 = 0; - local_118 = 0; + local_108 = local_108 & 0xffffffff00000000; + plVar13 = *(longlong **)(param_1 + 0x68); + local_128 = (_TRACE_EVENT_INFO *)0x0; + p_Var20 = (_TRACE_EVENT_INFO *)0x0; + local_a8.wYear = 0; + local_a8.wMonth = 0; + local_a8.wDayOfWeek = 0; + local_a8.wDay = 0; + local_a8.wHour = 0; + local_a8.wMinute = 0; + local_a8.wSecond = 0; + local_a8.wMilliseconds = 0; + local_98.wYear = 0; + local_98.wMonth = 0; + local_98.wDayOfWeek = 0; + local_98.wDay = 0; + local_98.wHour = 0; + local_98.wMinute = 0; + local_98.wSecond = 0; + local_98.wMilliseconds = 0; + local_e8.dwLowDateTime = 0; + local_e8.dwHighDateTime = 0; + local_100 = 0; + local_110 = 0; local_130 = '\0'; - local_e8 = plVar15; + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; + local_e0 = plVar13; std:: basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> ((basic_string,class_std::allocator_> - *)&local_d0,(ushort *)L""); + *)&local_c8,(ushort *)L"",0); std:: basic_stringstream,class_std::allocator_> ::str(&messageBuilder, (basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std::basic_ios_>::clear ((basic_ios_> *) (&messageBuilder + *(int *)(_messageBuilder + 4)),0,false); + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; std:: basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> ((basic_string,class_std::allocator_> - *)&local_d0,(ushort *)L""); + *)&local_c8,(ushort *)L"",0); std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder, (basic_string,class_std::allocator_> - *)&local_d0); + *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); - lpLocalTime = (LPSYSTEMTIME)0x0; + *)&local_c8); + p_Var25 = (LPSYSTEMTIME)0x0; std::basic_ios_>::clear ((basic_ios_> *) (&propertyPairBuilder + *(int *)(_propertyPairBuilder + 4)),0,false); - p_Var10 = *(_tlgProvider_t **)(param_1 + 0x18); - if (((p_Var10 != (_tlgProvider_t *)0x5d73406c7e9e8b9c) || + p_Var16 = *(_tlgProvider_t **)(param_1 + 0x18); + if (((p_Var16 != (_tlgProvider_t *)0x5d73406c7e9e8b9c) || (*(longlong *)(param_1 + 0x20) != 0x3ede3aea500f66e5)) || (*(longlong *)(param_1 + 0x30) != 0x20)) { - if (p_Var10 != (_tlgProvider_t *)0x44f55620a99b2eb4) { + if (p_Var16 != (_tlgProvider_t *)0x44f55620a99b2eb4) { return; } if (*(longlong *)(param_1 + 0x20) != -0x69d140112d06fd65) { return; } if (*(longlong *)(param_1 + 0x30) != 1) { return; } } if (((byte)param_1[4] & 0xc) != 0) { return; } if (((byte)param_1[4] & 0x40) == 0) { if (DAT_0 < 6) { return; } - local_120 = (_TRACE_EVENT_INFO *)0x180017498; + local_128 = (_TRACE_EVENT_INFO *)0x180017498; _tlgWriteTemplate ::Write_> - (p_Var10,&DAT_1,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_120); + (p_Var16,&DAT_1,(_GUID *)p_Var25,in_R9,(_tlgWrapSz *)&local_128); return; } - p_Var16 = param_1; - uVar4 = GetEventInformation(param_1,&local_120); - p_Var2 = local_120; - p_Var26 = p_Var25; - local_104 = uVar4; + p_Var14 = param_1; + uVar4 = GetEventInformation(param_1,&local_128); + p_Var2 = local_128; + p_Var26 = p_Var20; + local_fc = uVar4; if (uVar4 == 0) { - if (*(int *)(local_120 + 0x30) != 3) goto LAB_2; - if (*(int *)(local_120 + 0x44) != 0) { - p_Var25 = local_120 + *(uint *)(local_120 + 0x44); - local_f0 = *(FILETIME *)(param_1 + 0x10); - FileTimeToSystemTime(&local_f0,&local_b0); - lpLocalTime = &local_a0; - SystemTimeToTzSpecificLocalTime((TIME_ZONE_INFORMATION *)0x0,&local_b0,lpLocalTime); - local_120 = *(_TRACE_EVENT_INFO **)(param_1 + 0x60); - p_Var26 = local_120 + *(ushort *)(param_1 + 0x56); - p_Var10 = (_tlgProvider_t *) - std::operator<<_> + if (*(int *)(local_128 + 0x30) != 3) goto LAB_2; + if (*(int *)(local_128 + 0x44) != 0) { + p_Var26 = local_128 + *(uint *)(local_128 + 0x44); + local_e8 = *(FILETIME *)(param_1 + 0x10); + FileTimeToSystemTime(&local_e8,&local_a8); + SystemTimeToTzSpecificLocalTime((TIME_ZONE_INFORMATION *)0x0,&local_a8,lpLocalTime); + p_Var20 = *(_TRACE_EVENT_INFO **)(param_1 + 0x60); + pFVar15 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + local_128 = p_Var20; + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if ((bVar3) && (p_Var20 == (_TRACE_EVENT_INFO *)0x0)) { + if (5 < DAT_0) { + local_128 = (_TRACE_EVENT_INFO *)0x1800176d0; + _tlgWriteTemplate + ::Write_> + ((_tlgProvider_t *)pFVar15,&DAT_3,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapSz *)&local_128); + } + _o_free(p_Var2); + return; + } + uVar1 = *(ushort *)(param_1 + 0x56); + lVar11 = *(longlong *)(param_1 + 0x60); + pbVar10 = std::operator<<_> ((basic_ostream_> * - )&DAT_3,(ushort *)L"[Realtime]"); + )&DAT_4,(ushort *)L"[Realtime]"); std::operator<<_> - ((basic_ostream_> *)p_Var10, - (ushort *)p_Var25); - uVar19 = 0; + (pbVar10,(ushort *)p_Var26); + pFVar15 = &`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl; + local_120 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + uVar22 = 0; if (*(int *)(p_Var2 + 0x68) != 0) { do { lVar7 = (long)p_Var9; - uVar11 = (ulonglong)uVar19; - in_R9 = (_GUID *)(uVar11 * 3); - if (p_Var26 < local_120) { + uVar21 = (ulonglong)uVar22; + in_R9 = (_GUID *)(uVar21 * 3); + if ((_TRACE_EVENT_INFO *)((ulonglong)uVar1 + lVar11) < p_Var20) { if (5 < DAT_0) { local_138 = "event data overflow!"; - puVar18 = &DAT_4; -LAB_5: + puVar18 = &DAT_5; +LAB_6: _tlgWriteTemplate ::Write_> - (p_Var10,puVar18,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_138); + ((_tlgProvider_t *)pFVar15,puVar18,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapSz *)&local_138); } break; } - p_Var10 = (_tlgProvider_t *)(ulonglong)*(uint *)(p_Var2 + uVar11 * 0x18 + 0x74); - if (*(uint *)(p_Var2 + uVar11 * 0x18 + 0x74) == 0) { + p_Var16 = (_tlgProvider_t *)(ulonglong)*(uint *)(p_Var2 + uVar21 * 0x18 + 0x74); + if (*(uint *)(p_Var2 + uVar21 * 0x18 + 0x74) == 0) { if (5 < DAT_0) { local_138 = "event property w/o name!"; - puVar18 = &DAT_6; - p_Var10 = (_tlgProvider_t *)0x0; - goto LAB_5; + puVar18 = &DAT_7; + pFVar15 = (FeatureImpl *)0x0; + goto LAB_6; } break; } - if ((*(uint *)(p_Var2 + uVar11 * 0x18 + 0x70) & 0x8d) != 0) { + if ((*(uint *)(p_Var2 + uVar21 * 0x18 + 0x70) & 0x8d) != 0) { if (5 < DAT_0) { - local_128 = (char *)CONCAT44(local_128._4_4_,*(uint *)(p_Var2 + uVar11 * 0x18 + 0x70)) + local_118 = (char *)CONCAT44(local_118._4_4_,*(uint *)(p_Var2 + uVar21 * 0x18 + 0x70)) ; local_138 = "unexpected event property flags"; - puVar18 = &DAT_7; -LAB_8: + puVar18 = &DAT_8; +LAB_9: _tlgWriteTemplate ::Write,struct__tlgWrapperByVal<4>_> - (p_Var10,puVar18,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_138, - (_tlgWrapperByVal<4> *)&local_128); + (p_Var16,puVar18,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_138, + (_tlgWrapperByVal<4> *)&local_118); } break; } - lpLocalTime = (LPSYSTEMTIME)0x1; - if (*(ushort *)(p_Var2 + uVar11 * 0x18 + 0x80) != 1) { + if (*(ushort *)(p_Var2 + uVar21 * 0x18 + 0x80) != 1) { if (5 < DAT_0) { - local_128 = (char *)CONCAT44(local_128._4_4_, - (uint)*(ushort *)(p_Var2 + uVar11 * 0x18 + 0x80)); + local_118 = (char *)CONCAT44(local_118._4_4_, + (uint)*(ushort *)(p_Var2 + uVar21 * 0x18 + 0x80)); local_138 = "unexpected event property count"; - puVar18 = &DAT_9; - goto LAB_8; + puVar18 = &DAT_10; + goto LAB_9; } break; } - p_Var1 = p_Var2 + (longlong)p_Var10; - local_108 = 0x1000; - in_R9 = (_GUID *)(ulonglong)*(ushort *)(p_Var2 + uVar11 * 0x18 + 0x78); + p_Var20 = p_Var2 + (longlong)p_Var16; + local_100 = 0x1000; + in_R9 = (_GUID *)(ulonglong)*(ushort *)(p_Var2 + uVar21 * 0x18 + 0x78); lpLocalTime = (LPSYSTEMTIME)0x8; - local_104 = TdhFormatProperty(); - p_Var10 = (_tlgProvider_t *)0x0; - if (local_104 != 0) { + local_fc = TdhFormatProperty(); + p_Var16 = (_tlgProvider_t *)0x0; + if (local_fc != 0) { if (5 < DAT_0) { - local_128 = (char *)CONCAT44(local_128._4_4_,local_104); + local_118 = (char *)CONCAT44(local_118._4_4_,local_fc); local_138 = "could not format event property "; - puVar18 = &DAT_10; - goto LAB_8; + puVar18 = &DAT_11; + goto LAB_9; } break; } - local_120 = local_120 + local_118; + local_128 = local_128 + local_110; in_R9 = (_GUID *)0x0; lpLocalTime = (LPSYSTEMTIME)0x0; - StringCchPrintfExW((ushort *)&propertyPair,0x1000,(ushort **)0x0,(__uint64 *)0x0,0, - (ushort *)L", %s: %s"); + StringCchPrintfExW((ushort *)&propertyPair,(((ulonglong)local_120 ^ 1) + 1) * 0x800, + (ushort **)0x0,(__uint64 *)0x0,0,(ushort *)L", %s: %s"); std::operator<<_> ((basic_ostream_> *) - &DAT_3,(ushort *)&propertyPair); + &DAT_4,(ushort *)&propertyPair); std::operator<<_> ((basic_ostream_> *) - &DAT_11,(ushort *)&propertyPair); - iVar5 = _o__wcsicmp(p_Var1,L"Status"); + &DAT_12,(ushort *)&propertyPair); + iVar5 = _o__wcsicmp(p_Var20,L"Status"); if ((iVar5 == 0) && (iVar5 = _o__wcsicmp(&propertyValue), iVar5 != 0)) { local_130 = '\x01'; lpLocalTime = (LPSYSTEMTIME)0x10; uVar6 = _o_wcstoul(&propertyValue); p_Var9 = (_TRACE_EVENT_INFO *)(ulonglong)uVar6; } lVar7 = (long)p_Var9; - uVar19 = uVar19 + 1; - p_Var10 = (_tlgProvider_t *)(ulonglong)uVar19; - } while ((uint)uVar19 < *(uint *)(p_Var2 + 0x68)); + uVar22 = uVar22 + 1; + pFVar15 = (FeatureImpl *)(ulonglong)uVar22; + p_Var20 = local_128; + } while ((uint)uVar22 < *(uint *)(p_Var2 + 0x68)); } - lVar12 = std:: + lVar11 = std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - lVar27 = *(longlong *)(lVar12 + 0x10) + 1; + uVar21 = *(longlong *)(lVar11 + 0x10) + 1; std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); - lVar22 = -1; - lVar12 = -1; + *)&local_c8); + lVar27 = -1; + lVar11 = -1; do { - lVar21 = lVar12; - lVar12 = lVar21 + 1; - } while (*(short *)(p_Var25 + lVar12 * 2) != 0); - lVar21 = lVar21 + 2; - sVar23 = (short)lVar27; - sVar20 = (short)lVar21; + lVar23 = lVar11; + lVar11 = lVar23 + 1; + } while (*(short *)(p_Var26 + lVar11 * 2) != 0); + uVar24 = lVar23 + 2; + bVar3 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar3) { + if (0xfffe < uVar21) { + uVar21 = 0xffff; + } + if (0xfffe < uVar24) { + uVar24 = 0xffff; + } + } + sVar19 = (short)uVar21; if (local_130 == '\0') { - uVar13 = std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - ((basic_string,class_std::allocator_> - *)&local_88,(ushort *)p_Var25); - bVar3 = EventHandler::isEmitInformationalEvent(uVar13); + local_c8 = (wchar_t *)0x0; + uStack_c0 = 0; + local_b8 = 0; + uStack_b0 = 0; + lpLocalTime = (LPSYSTEMTIME)0xffffffffffffffff; + do { + lpLocalTime = (LPSYSTEMTIME)((longlong)&lpLocalTime->wYear + 1); + } while (*(short *)(p_Var26 + (longlong)lpLocalTime * 2) != 0); + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_c8,(ushort *)p_Var26,(__uint64)lpLocalTime); + bVar3 = EventHandler::isEmitInformationalEvent(&local_c8); if (bVar3) { - if (((5 < DAT_12) && ((_DAT_18001e090 & 0x400000000000) != 0)) && - ((DAT_13 & 0x400000000000) == DAT_13)) { + if (((5 < DAT_13) && ((_DAT_18001e090 & 0x400000000000) != 0)) && + ((DAT_14 & 0x400000000000) == DAT_14)) { pbVar17 = &propertyPairBuilder; - local_d0 = (wchar_t *) + local_c8 = (wchar_t *) std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar23 * 2; + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar19 * 2); local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); - local_f8 = sVar20 * 2; - local_e0 = L"Realtime"; - local_d8 = 0x10; - local_128 = (char *)0x1000000; - local_110 = 0x80000000; - local_100 = p_Var25; + local_f0 = (short)uVar24 * 2; + local_d8 = L"Realtime"; + local_d0 = 0x10; + local_118 = (char *)0x1000000; + local_108 = 0x80000000; + local_f8 = p_Var26; _tlgWriteTemplate :: Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar17,&DAT_14,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<8> *)&local_110,(_tlgWrapperByVal<8> *)&local_128, - (_tlgWrapperBinary *)&local_e0,(_tlgWrapperBinary *)&local_100, - (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_d0); + ((_tlgProvider_t *)pbVar17,&DAT_15,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<8> *)&local_108,(_tlgWrapperByVal<8> *)&local_118, + (_tlgWrapperBinary *)&local_d8,(_tlgWrapperBinary *)&local_f8, + (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> *)&local_88); } if (5 < DAT_0) { pbVar17 = &propertyPairBuilder; - local_d0 = (wchar_t *) + local_c8 = (wchar_t *) std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar23 * 2; + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar19 * 2); do { - lVar22 = lVar22 + 1; - } while (*(short *)(p_Var25 + lVar22 * 2) != 0); - local_f8 = (short)lVar22 * 2; + lVar27 = lVar27 + 1; + } while (*(short *)(p_Var26 + lVar27 * 2) != 0); + local_f0 = (short)lVar27 * 2; local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); - local_100 = p_Var25; + local_f8 = p_Var26; _tlgWriteTemplate ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar17,&DAT_15,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_100, - (_tlgWrapperBinary *)&local_d0); + ((_tlgProvider_t *)pbVar17,&DAT_16,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_f8, + (_tlgWrapperBinary *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> *)&local_88); } } } else { bVar3 = EventHandler::isAcceptableError(lVar7); if (!bVar3) { if ((Microsoft_Windows_Hotpatch_MonitorEnableBits & 2) != 0) { local_48 = (char **)std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - local_110 = CONCAT44(local_110._4_4_,1); + local_108 = CONCAT44(local_108._4_4_,1); if ((char *)0x7 < local_48[3]) { local_48 = (char **)*local_48; } - iVar24 = (int)lVar27; - local_138 = (char *)CONCAT44(local_138._4_4_,iVar24); - iVar5 = (int)lVar21; - local_128 = (char *)CONCAT44(local_128._4_4_,iVar5); - local_78 = &local_128; + local_138 = (char *)CONCAT44(local_138._4_4_,(int)uVar21); + local_118 = (char *)CONCAT44(local_118._4_4_,(int)uVar24); + local_78 = &local_118; local_70 = 4; - local_60 = (ulonglong)(uint)(iVar5 * 2); + local_60 = (ulonglong)(uint)((int)uVar24 * 2); local_58 = &local_138; local_50 = 4; - local_40 = (ulonglong)(uint)(iVar24 * 2); - local_68 = p_Var25; + local_40 = (ulonglong)(uint)((int)uVar21 * 2); + local_68 = p_Var26; McGenEventWrite_EventWriteTransfer (local_48,(PCEVENT_DESCRIPTOR)&RealTimeEventError,lpLocalTime,in_R9,&local_88) ; } - if ((local_110 & 1) != 0) { + if ((local_108 & 1) != 0) { std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> - *)&local_d0); - } - if (((5 < DAT_12) && ((_DAT_18001e090 & 0x800000000000) != 0)) && - ((DAT_13 & 0x800000000000) == DAT_13)) { + *)&local_c8); + } + if (((5 < DAT_13) && ((_DAT_18001e090 & 0x800000000000) != 0)) && + ((DAT_14 & 0x800000000000) == DAT_14)) { pbVar17 = &propertyPairBuilder; - local_e0 = (wchar_t *) + local_d8 = (wchar_t *) std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_e0 + 0xc)) { - local_e0 = *(wchar_t **)local_e0; - } - local_d8 = sVar23 * 2; + if (7 < *(ulonglong *)(local_d8 + 0xc)) { + local_d8 = *(wchar_t **)local_d8; + } + local_d0 = sVar19 * 2; local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); - local_f8 = sVar20 * 2; - local_d0 = L"Realtime"; - local_c8 = 0x10; - local_128 = (char *)0x1000000; - local_110 = 0x80000000; - local_100 = p_Var25; + local_f0 = (short)uVar24 * 2; + local_c8 = L"Realtime"; + uStack_c0 = CONCAT62(uStack_c0._2_6_,0x10); + local_118 = (char *)0x1000000; + local_108 = 0x80000000; + local_f8 = p_Var26; _tlgWriteTemplate :: Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar17,&DAT_16,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<8> *)&local_110,(_tlgWrapperByVal<8> *)&local_128, - (_tlgWrapperBinary *)&local_d0,(_tlgWrapperBinary *)&local_100, - (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_e0); + ((_tlgProvider_t *)pbVar17,&DAT_17,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<8> *)&local_108,(_tlgWrapperByVal<8> *)&local_118, + (_tlgWrapperBinary *)&local_c8,(_tlgWrapperBinary *)&local_f8, + (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_d8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> *)&local_88); } if (5 < DAT_0) { pbVar17 = &propertyPairBuilder; - local_d0 = (wchar_t *) + local_c8 = (wchar_t *) std:: basic_stringstream,class_std::allocator_> ::str(&propertyPairBuilder); - if (7 < *(ulonglong *)(local_d0 + 0xc)) { - local_d0 = *(wchar_t **)local_d0; - } - local_c8 = sVar23 * 2; + if (7 < *(ulonglong *)(local_c8 + 0xc)) { + local_c8 = *(wchar_t **)local_c8; + } + uStack_c0 = CONCAT62(uStack_c0._2_6_,sVar19 * 2); do { - lVar22 = lVar22 + 1; - } while (*(short *)(p_Var25 + lVar22 * 2) != 0); - local_f8 = (short)lVar22 * 2; + lVar27 = lVar27 + 1; + } while (*(short *)(p_Var26 + lVar27 * 2) != 0); + local_f0 = (short)lVar27 * 2; local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); - local_100 = p_Var25; + local_f8 = p_Var26; _tlgWriteTemplate ::Write,struct__tlgWrapperBinary,struct__tlgWrapperBinary> - ((_tlgProvider_t *)pbVar17,&DAT_15,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_100, - (_tlgWrapperBinary *)&local_d0); + ((_tlgProvider_t *)pbVar17,&DAT_16,(_GUID *)lpLocalTime,in_R9, + (_tlgWrapperByVal<4> *)&local_138,(_tlgWrapperBinary *)&local_f8, + (_tlgWrapperBinary *)&local_c8); std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ((basic_string,class_std::allocator_> *)&local_88); } if (AutoRemediate != 0) { local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); lVar7 = RegUtil::SetHotpatchError((ulong *)&local_138); if ((lVar7 < 0) && (5 < DAT_0)) { local_138 = (char *)CONCAT44(local_138._4_4_,lVar7); local_68 = (_TRACE_EVENT_INFO *)&local_138; local_60 = 4; in_R9 = (_GUID *)0x0; lpLocalTime = (LPSYSTEMTIME)0x0; _tlgWriteTransfer_EventWriteTransfer - (0x18001e048,&DAT_17,(LPCGUID)0x0,(LPCGUID)0x0,3,&local_88); + (0x18001e048,&DAT_18,(LPCGUID)0x0,(LPCGUID)0x0,3,&local_88); } } } } - plVar14 = (longlong *)std::chrono::steady_clock::now(); - plVar15 = local_e8; - p_Var26 = local_120; - uVar4 = local_104; - if (7 < (int)((*plVar14 - _lastHeartbeat) / 3600000000000)) { - plVar15 = (longlong *)std::chrono::steady_clock::now(); - _lastHeartbeat = *plVar15; - plVar15 = local_e8; - p_Var26 = local_120; - uVar4 = local_104; - if (((5 < DAT_12) && ((_DAT_18001e090 & 0x800000000000) != 0)) && - ((DAT_13 & 0x800000000000) == DAT_13)) { + plVar12 = (longlong *)std::chrono::steady_clock::now(); + p_Var26 = local_128; + p_Var25 = lpLocalTime; + plVar13 = local_e0; + uVar4 = local_fc; + if (7 < (int)((*plVar12 - _lastHeartbeat) / 3600000000000)) { + plVar13 = (longlong *)std::chrono::steady_clock::now(); + _lastHeartbeat = *plVar13; + p_Var26 = local_128; + p_Var25 = lpLocalTime; + plVar13 = local_e0; + uVar4 = local_fc; + if (((5 < DAT_13) && ((_DAT_18001e090 & 0x800000000000) != 0)) && + ((DAT_14 & 0x800000000000) == DAT_14)) { local_138 = (char *)CONCAT44(local_138._4_4_,AutoRemediate); - local_128 = (char *)0x1000000; - local_110 = 0x80000000; + local_118 = (char *)0x1000000; + local_108 = 0x80000000; local_48 = &local_138; local_40 = 4; - local_58 = &local_128; + local_58 = &local_118; local_50 = 8; - local_68 = (_TRACE_EVENT_INFO *)&local_110; + local_68 = (_TRACE_EVENT_INFO *)&local_108; local_60 = 8; in_R9 = (_GUID *)0x0; - lpLocalTime = (LPSYSTEMTIME)0x0; + p_Var25 = (LPSYSTEMTIME)0x0; _tlgWriteTransfer_EventWriteTransfer - (0x18001e080,&DAT_18,(LPCGUID)0x0,(LPCGUID)0x0,5,&local_88); - plVar15 = local_e8; - p_Var26 = local_120; - uVar4 = local_104; + (0x18001e080,&DAT_19,(LPCGUID)0x0,(LPCGUID)0x0,5,&local_88); + p_Var26 = local_128; + plVar13 = local_e0; + uVar4 = local_fc; } } goto LAB_2; } - if (DAT_0 < 6) goto LAB_180011ad9; - local_120 = (_TRACE_EVENT_INFO *)0x1800174f8; - puVar18 = &DAT_19; + if (DAT_0 < 6) goto LAB_18001234a; + local_128 = (_TRACE_EVENT_INFO *)0x1800174f8; + puVar18 = &DAT_20; } else { p_Var26 = p_Var9; - if (DAT_0 < 6) goto LAB_180011ad9; - local_120 = (_TRACE_EVENT_INFO *)0x1800174c8; - puVar18 = &DAT_20; + if (DAT_0 < 6) goto LAB_18001234a; + local_128 = (_TRACE_EVENT_INFO *)0x1800174c8; + puVar18 = &DAT_21; } _tlgWriteTemplate ::Write_> - ((_tlgProvider_t *)p_Var16,puVar18,(_GUID *)lpLocalTime,in_R9, - (_tlgWrapSz *)&local_120); - p_Var26 = p_Var25; + ((_tlgProvider_t *)p_Var14,puVar18,(_GUID *)p_Var25,in_R9,(_tlgWrapSz *)&local_128 + ); + p_Var26 = p_Var20; LAB_2: if (p_Var2 != (_TRACE_EVENT_INFO *)0x0) { _o_free(p_Var2); } if ((uVar4 == 0) && (p_Var26 != (_TRACE_EVENT_INFO *)0x0)) { - p_Var10 = *(_tlgProvider_t **)*plVar15; - DVar8 = WaitForSingleObject(p_Var10,0); + p_Var16 = *(_tlgProvider_t **)*plVar13; + DVar8 = WaitForSingleObject(p_Var16,0); if (DVar8 == 0x102) { return; } if ((DVar8 != 0) && (DVar8 = GetLastError(), 5 < DAT_0)) { local_138 = (char *)CONCAT44(local_138._4_4_,DVar8); - local_e8 = (longlong *)0x1800176b0; + local_e0 = (longlong *)0x180017730; _tlgWriteTemplate ::Write,struct__tlgWrapperByVal<4>_> - (p_Var10,&DAT_21,(_GUID *)lpLocalTime,in_R9,(_tlgWrapSz *)&local_e8, + (p_Var16,&DAT_22,(_GUID *)p_Var25,in_R9,(_tlgWrapSz *)&local_e0, (_tlgWrapperByVal<4> *)&local_138); } } - CloseTrace(*(undefined8 *)(*plVar15 + 0x10)); + CloseTrace(*(undefined8 *)(*plVar13 + 0x10)); return; } ``` ## HotpatchMonitor::ReportSvcStatus ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.74| |i_ratio|0.4| |m_ratio|0.84| |b_ratio|0.79| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|ReportSvcStatus|ReportSvcStatus| |fullname|HotpatchMonitor::ReportSvcStatus|HotpatchMonitor::ReportSvcStatus| |refcount|3|3| |`length`|151|225| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-SERVICE-CORE-L1-1-0.DLL::SetServiceStatus|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-SERVICE-CORE-L1-1-0.DLL::SetServiceStatus
wil::details::FeatureImpl::__private_IsEnabled| |calling||| |paramcount|4|4| |`address`|180009a60|180009d10| |sig|long __thiscall ReportSvcStatus(HotpatchMonitor * this, ulong param_1, ulong param_2, ulong param_3)|long __thiscall ReportSvcStatus(HotpatchMonitor * this, ulong param_1, ulong param_2, ulong param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### HotpatchMonitor::ReportSvcStatus Called Diff ```diff --- HotpatchMonitor::ReportSvcStatus called +++ HotpatchMonitor::ReportSvcStatus called @@ -2,0 +3 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### HotpatchMonitor::ReportSvcStatus Diff ```diff --- HotpatchMonitor::ReportSvcStatus +++ HotpatchMonitor::ReportSvcStatus @@ -1,42 +1,45 @@ /* protected: virtual long __cdecl HotpatchMonitor::ReportSvcStatus(unsigned long,unsigned long,unsigned long) __ptr64 */ long __thiscall HotpatchMonitor::ReportSvcStatus(HotpatchMonitor *this,ulong param_1,ulong param_2,ulong param_3) { - int iVar1; + bool bVar1; BOOL BVar2; DWORD DVar3; - int iVar4; DVar3 = 0; - iVar1 = 0; if (param_1 == 1) { *(undefined4 *)(this + 0x18) = 1; - iVar4 = 0; + *(undefined4 *)(this + 0x24) = 0; + DAT_0 = 0; } else { if ((param_1 == 2) || (param_1 == 3)) { *(undefined4 *)(this + 0x18) = 0; } else if (param_1 == 4) { *(undefined4 *)(this + 0x18) = 0x405; + *(undefined4 *)(this + 0x24) = 0; DAT_0 = 0; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) goto LAB_1; } - iVar4 = DAT_0 + 1; - iVar1 = DAT_0; + *(int *)(this + 0x24) = DAT_0; + DAT_0 = DAT_0 + 1; } - DAT_0 = iVar4; - *(int *)(this + 0x24) = iVar1; +LAB_1: *(ulong *)(this + 0x14) = param_1; *(ulong *)(this + 0x1c) = param_2; *(ulong *)(this + 0x28) = param_3; BVar2 = SetServiceStatus(*(SERVICE_STATUS_HANDLE *)(this + 8),(LPSERVICE_STATUS)(this + 0x10)); if ((BVar2 == 0) && (DVar3 = GetLastError(), 0 < (int)DVar3)) { DVar3 = DVar3 & 0xffff | 0x80070000; } return DVar3; } ``` ## std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,calling| |ratio|0.43| |i_ratio|0.35| |m_ratio|0.96| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|basic_string,class_std::allocator_>|basic_string,class_std::allocator_>| |fullname|std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>|std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>| |`refcount`|19|3| |`length`|336|317| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string| |`calling`|TraceUtil::ProcessEventCallback
`dynamic_initializer_for_'EventHandler::infoEventsToEmit''
autologgerProcessor::AutologgerProcessEventCallback|autologgerProcessor::initialize
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>| |paramcount|2|2| |`address`|18000e2bc|18000e798| |`sig`|undefined __thiscall basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this, ushort * param_1)|undefined __thiscall basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this, basic_string,class_std::allocator_> * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> Calling Diff ```diff --- std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> calling +++ std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> calling @@ -1,3 +1,2 @@ -TraceUtil::ProcessEventCallback -`dynamic_initializer_for_'EventHandler::infoEventsToEmit'' -autologgerProcessor::AutologgerProcessEventCallback +autologgerProcessor::initialize +std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> ``` ### std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> Diff ```diff --- std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +++ std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> @@ -1,89 +1,91 @@ /* public: __cdecl std::basic_string,class std::allocator >::basic_string,class std::allocator >(unsigned short const * __ptr64 const) __ptr64 */ + short>,class std::allocator >(class std::basic_string,class std::allocator > const & __ptr64) __ptr64 + */ basic_string,class_std::allocator_> * __thiscall std:: basic_string,class_std::allocator_> :: basic_string,class_std::allocator_> (basic_string,class_std::allocator_> - *this,ushort *param_1) + *this,basic_string,class_std::allocator_> + *param_1) { - code *pcVar1; - ulonglong uVar2; - void *pvVar3; + ulonglong uVar1; + code *pcVar2; + undefined8 uVar3; + ulonglong uVar4; + void *pvVar5; basic_string,class_std::allocator_> - *pbVar4; - ulonglong uVar5; - ulonglong uVar6; + *pbVar6; + ulonglong uVar7; void *_Dst; _Dst = (void *)0x0; *(undefined8 *)this = 0; *(undefined8 *)(this + 8) = 0; *(undefined8 *)(this + 0x10) = 0; *(undefined8 *)(this + 0x18) = 0; - uVar6 = 0xffffffffffffffff; - do { - uVar6 = uVar6 + 1; - } while (param_1[uVar6] != 0); - if (0x7ffffffffffffffe < uVar6) { + uVar1 = *(ulonglong *)(param_1 + 0x10); + if (7 < *(ulonglong *)(param_1 + 0x18)) { + param_1 = *(basic_string,class_std::allocator_> + **)param_1; + } + if (0x7ffffffffffffffe < uVar1) { + /* WARNING: Subroutine does not return */ _Xlen_string(); - pcVar1 = (code *)swi(3); - pbVar4 = (basic_string,class_std::allocator_> - *)(*pcVar1)(); - return pbVar4; } *(undefined8 *)(this + 0x18) = 7; - if (uVar6 < 8) { - *(ulonglong *)(this + 0x10) = uVar6; - memcpy(this,param_1,uVar6 * 2); - *(undefined2 *)(this + uVar6 * 2) = 0; + if (uVar1 < 8) { + *(ulonglong *)(this + 0x10) = uVar1; + uVar3 = *(undefined8 *)(param_1 + 8); + *(undefined8 *)this = *(undefined8 *)param_1; + *(undefined8 *)(this + 8) = uVar3; return this; } - uVar2 = uVar6 | 7; - if (uVar2 < 0x7fffffffffffffff) { - if (uVar2 < 10) { - uVar2 = 10; + uVar4 = uVar1 | 7; + if (uVar4 < 0x7fffffffffffffff) { + if (uVar4 < 10) { + uVar4 = 10; } - if (0x7fffffffffffffff < uVar2 + 1) goto LAB_0; - uVar5 = (uVar2 + 1) * 2; - if (uVar5 < 0x1000) { - if (uVar5 != 0) { - _Dst = operator_new(uVar5); + if (0x7fffffffffffffff < uVar4 + 1) goto LAB_0; + uVar7 = (uVar4 + 1) * 2; + if (uVar7 < 0x1000) { + if (uVar7 != 0) { + _Dst = operator_new(uVar7); } goto LAB_1; } } else { - uVar5 = 0xfffffffffffffffe; - uVar2 = 0x7ffffffffffffffe; + uVar7 = 0xfffffffffffffffe; + uVar4 = 0x7ffffffffffffffe; } - if (uVar5 < uVar5 + 0x27) { - pvVar3 = operator_new(uVar5 + 0x27); - if (pvVar3 == (void *)0x0) { + if (uVar7 < uVar7 + 0x27) { + pvVar5 = operator_new(uVar7 + 0x27); + if (pvVar5 == (void *)0x0) { _o__invalid_parameter_noinfo_noreturn(); - pcVar1 = (code *)swi(3); - pbVar4 = (basic_string,class_std::allocator_> - *)(*pcVar1)(); - return pbVar4; + pcVar2 = (code *)swi(3); + pbVar6 = (basic_string,class_std::allocator_> + *)(*pcVar2)(); + return pbVar6; } - _Dst = (void *)((longlong)pvVar3 + 0x27U & 0xffffffffffffffe0); - *(void **)((longlong)_Dst - 8) = pvVar3; + _Dst = (void *)((longlong)pvVar5 + 0x27U & 0xffffffffffffffe0); + *(void **)((longlong)_Dst - 8) = pvVar5; LAB_1: - *(ulonglong *)(this + 0x10) = uVar6; *(void **)this = _Dst; - *(ulonglong *)(this + 0x18) = uVar2; - memcpy(_Dst,param_1,uVar6 * 2); - *(undefined2 *)(uVar6 * 2 + (longlong)_Dst) = 0; + *(ulonglong *)(this + 0x10) = uVar1; + *(ulonglong *)(this + 0x18) = uVar4; + memcpy(_Dst,param_1,uVar1 * 2 + 2); return this; } LAB_0: /* WARNING: Subroutine does not return */ __scrt_throw_std_bad_array_new_length(); } ``` ## std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.45| |m_ratio|0.98| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|emplace,class_std::allocator_>_const&___ptr64>|emplace,class_std::allocator_>_const&___ptr64>| |fullname|std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>|std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>| |refcount|2|2| |`length`|610|591| |`called`|MSVCP_WIN.DLL::std::_Xlength_error
_o_ceilf
operator_delete[]
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Find_last,class_std::allocator_>_>
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Forced_rehash
std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>|MSVCP_WIN.DLL::std::_Xlength_error
_o_ceilf
operator_new
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Find_last,class_std::allocator_>_>
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Forced_rehash
std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>| |calling|`dynamic_initializer_for_'EventHandler::infoEventsToEmit''|`dynamic_initializer_for_'EventHandler::infoEventsToEmit''| |paramcount|2|2| |`address`|180012654|180012d60| |sig|pair,class_std::allocator_>_>_>_>,bool> __thiscall emplace,class_std::allocator_>_const&___ptr64>(_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> * this, basic_string,class_std::allocator_> * param_1)|pair,class_std::allocator_>_>_>_>,bool> __thiscall emplace,class_std::allocator_>_const&___ptr64>(_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> * this, basic_string,class_std::allocator_> * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> Called Diff ```diff --- std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> called +++ std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> called @@ -3 +3 @@ -operator_delete[] +operator_new @@ -6,2 +6 @@ -std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> -std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_> +std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> ``` ### std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> Diff ```diff --- std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> +++ std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> @@ -1,151 +1,154 @@ -/* WARNING: Removing unreachable block (ram,0x000180012886) */ -/* WARNING: Removing unreachable block (ram,0x000180012899) */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* public: struct std::pair,class std::allocator > > > >,bool> __cdecl std::_Hash,class std::allocator >,class std::_Uhash_compare,class std::allocator >,struct std::hash,class std::allocator > >,struct std::equal_to,class std::allocator > > >,class std::allocator,class std::allocator > >,0> >::emplace,class std::allocator > const & __ptr64>(class std::basic_string,class std::allocator > const & __ptr64) __ptr64 */ basic_string,class_std::allocator_> * __thiscall std:: _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> :: emplace,class_std::allocator_>_const&___ptr64> (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *this,basic_string,class_std::allocator_> *param_1) { - code *pcVar1; - longlong lVar2; + undefined8 *puVar1; + code *pcVar2; + longlong lVar3; basic_string,class_std::allocator_> - *pbVar3; - longlong *plVar4; + *pbVar4; + longlong *plVar5; + longlong *plVar6; _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *p_Var5; - longlong lVar6; + *p_Var7; + longlong lVar8; _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *this_00; _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *p_Var7; - ulonglong uVar8; + *p_Var9; + ulonglong uVar10; basic_string,class_std::allocator_> *in_R8; - float fVar9; - _List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> - local_28 [8]; - longlong *local_20; - longlong local_18; - longlong lStack_10; + float fVar11; + longlong local_28; + longlong lStack_20; + undefined8 *local_18; + longlong *local_10; - pbVar3 = in_R8; + pbVar4 = in_R8; if (7 < *(ulonglong *)(in_R8 + 0x18)) { - pbVar3 = *(basic_string,class_std::allocator_> + pbVar4 = *(basic_string,class_std::allocator_> **)in_R8; } - uVar8 = 0xcbf29ce484222325; - p_Var5 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> + uVar10 = 0xcbf29ce484222325; + p_Var7 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)0x0; if ((_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)(*(longlong *)(in_R8 + 0x10) * 2) != (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)0x0) { do { - uVar8 = (uVar8 ^ (byte)p_Var5[(longlong)pbVar3]) * 0x100000001b3; - p_Var5 = p_Var5 + 1; - } while (p_Var5 < (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> + uVar10 = (uVar10 ^ (byte)p_Var7[(longlong)pbVar4]) * 0x100000001b3; + p_Var7 = p_Var7 + 1; + } while (p_Var7 < (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)(*(longlong *)(in_R8 + 0x10) * 2)); } _Find_last,class_std::allocator_>_> - (p_Var5,(basic_string,class_std::allocator_> - *)&local_18,(__uint64)in_R8); - if (lStack_10 != 0) { - *(longlong *)param_1 = lStack_10; + (p_Var7,(basic_string,class_std::allocator_> + *)&local_28,(__uint64)in_R8); + if (lStack_20 != 0) { + *(longlong *)param_1 = lStack_20; param_1[8] = (basic_string,class_std::allocator_> )0x0; return param_1; } if (DAT_0 == 0x555555555555555) { std::_Xlength_error("unordered_map/set too long"); - pcVar1 = (code *)swi(3); - pbVar3 = (basic_string,class_std::allocator_> - *)(*pcVar1)(); - return pbVar3; + pcVar2 = (code *)swi(3); + pbVar4 = (basic_string,class_std::allocator_> + *)(*pcVar2)(); + return pbVar4; } - _List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> + local_18 = &DAT_1; + local_10 = (longlong *)0x0; + plVar5 = operator_new(0x30); + local_10 = plVar5; + basic_string,class_std::allocator_> :: - _List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> - (local_28,(allocator,class_std::allocator_>,void*___ptr64>_> - *)&DAT_1,in_R8); - p_Var5 = DAT_2; - if (_infoEventsToEmit < (float)(DAT_0 + 1) / (float)DAT_180023428) { - fVar9 = (float)_o_ceilf((float)(DAT_0 + 1) / _infoEventsToEmit); - lVar6 = 0; - if ((9.223372e+18 <= fVar9) && (fVar9 = fVar9 - 9.223372e+18, fVar9 < 9.223372e+18)) { - lVar6 = -0x8000000000000000; + basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)(plVar5 + 2),in_R8); + p_Var7 = DAT_2; + if (_infoEventsToEmit < (float)(DAT_0 + 1) / (float)DAT_180023438) { + fVar11 = (float)_o_ceilf((float)(DAT_0 + 1) / _infoEventsToEmit); + lVar8 = 0; + if ((9.223372e+18 <= fVar11) && (fVar11 = fVar11 - 9.223372e+18, fVar11 < 9.223372e+18)) { + lVar8 = -0x8000000000000000; } this_00 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)0x8; if ((_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)0x8 < (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *)((longlong)fVar9 + lVar6)) { + *)((longlong)fVar11 + lVar8)) { this_00 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *)((longlong)fVar9 + lVar6); + *)((longlong)fVar11 + lVar8); } - p_Var7 = p_Var5; - if ((p_Var5 < this_00) && + p_Var9 = p_Var7; + if ((p_Var7 < this_00) && (((_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *)0x1ff < p_Var5 || - (p_Var7 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *)((longlong)p_Var5 << 3), + *)0x1ff < p_Var7 || + (p_Var9 = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> + *)((longlong)p_Var7 << 3), (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> - *)((longlong)p_Var5 << 3) < this_00)))) { - p_Var7 = this_00; + *)((longlong)p_Var7 << 3) < this_00)))) { + p_Var9 = this_00; } - _Forced_rehash(this_00,(__uint64)p_Var7); - plVar4 = (longlong *) + _Forced_rehash(this_00,(__uint64)p_Var9); + plVar6 = (longlong *) _Find_last,class_std::allocator_>_> (this_00,(basic_string,class_std::allocator_> - *)&local_18,(__uint64)(local_20 + 2)); - local_18 = *plVar4; + *)&local_18,(__uint64)(plVar5 + 2)); + local_28 = *plVar6; } - plVar4 = *(longlong **)(local_18 + 8); + puVar1 = *(undefined8 **)(local_28 + 8); DAT_0 = DAT_0 + 1; - *local_20 = local_18; - local_20[1] = (longlong)plVar4; - *plVar4 = (longlong)local_20; - *(longlong **)(local_18 + 8) = local_20; - lVar2 = DAT_3; - uVar8 = DAT_4 & uVar8; - lVar6 = *(longlong *)(DAT_3 + uVar8 * 0x10); - if (lVar6 == DAT_1) { - *(longlong **)(DAT_3 + uVar8 * 0x10) = local_20; + *plVar5 = local_28; + plVar5[1] = (longlong)puVar1; + *puVar1 = plVar5; + *(longlong **)(local_28 + 8) = plVar5; + lVar3 = DAT_3; + uVar10 = DAT_4 & uVar10; + lVar8 = *(longlong *)(DAT_3 + uVar10 * 0x10); + if (lVar8 == DAT_1) { + *(longlong **)(DAT_3 + uVar10 * 0x10) = plVar5; } else { - if (lVar6 == local_18) { - *(longlong **)(DAT_3 + uVar8 * 0x10) = local_20; + if (lVar8 == local_28) { + *(longlong **)(DAT_3 + uVar10 * 0x10) = plVar5; goto LAB_5; } - if (*(longlong **)(DAT_3 + 8 + uVar8 * 0x10) != plVar4) goto LAB_180012875; + if (*(undefined8 **)(DAT_3 + 8 + uVar10 * 0x10) != puVar1) goto LAB_180012f90; } - *(longlong **)(lVar2 + 8 + uVar8 * 0x10) = local_20; + *(longlong **)(lVar3 + 8 + uVar10 * 0x10) = plVar5; LAB_5: - *(longlong **)param_1 = local_20; + *(longlong **)param_1 = plVar5; param_1[8] = (basic_string,class_std::allocator_> )0x1; return param_1; } ``` ## std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.96| |i_ratio|0.78| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|_Reallocate_for,unsigned_short_const*___ptr64>|_Reallocate_for,unsigned_short_const*___ptr64>| |fullname|std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64>|std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64>| |refcount|2|2| |`length`|363|362| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_delete[]
operator_new
std::_Xlen_string|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_delete[]
operator_new
std::_Xlen_string| |calling|std::basic_stringstream,class_std::allocator_>::str|std::basic_stringstream,class_std::allocator_>::str| |paramcount|4|4| |`address`|18000e148|18000e624| |sig|basic_string,class_std::allocator_> * __thiscall _Reallocate_for,unsigned_short_const*___ptr64>(basic_string,class_std::allocator_> * this, __uint64 param_1, param_2, ushort * param_3)|basic_string,class_std::allocator_> * __thiscall _Reallocate_for,unsigned_short_const*___ptr64>(basic_string,class_std::allocator_> * this, __uint64 param_1, param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64> Diff ```diff --- std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64> +++ std::basic_string,class_std::allocator_>::_Reallocate_for,unsigned_short_const*___ptr64> @@ -1,85 +1,82 @@ /* private: class std::basic_string,class std::allocator > & __ptr64 __cdecl std::basic_string,class std::allocator >::_Reallocate_for,unsigned short const * __ptr64>(unsigned __int64,class ,unsigned short const * __ptr64) __ptr64 */ basic_string,class_std::allocator_> * __thiscall std:: basic_string,class_std::allocator_> ::_Reallocate_for,unsigned_short_const*___ptr64> (basic_string,class_std::allocator_> *this,ulonglong param_1,undefined8 param_3,void *param_4) { ulonglong uVar1; code *pcVar2; void *pvVar3; basic_string,class_std::allocator_> *pbVar4; void *pvVar5; ulonglong uVar6; ulonglong uVar7; void *_Dst; uVar7 = 0x7ffffffffffffffe; if (0x7ffffffffffffffe < param_1) { + /* WARNING: Subroutine does not return */ _Xlen_string(); - pcVar2 = (code *)swi(3); - pbVar4 = (basic_string,class_std::allocator_> - *)(*pcVar2)(); - return pbVar4; } uVar1 = *(ulonglong *)(this + 0x18); uVar6 = param_1 | 7; if ((uVar6 < 0x7fffffffffffffff) && (uVar1 <= 0x7ffffffffffffffe - (uVar1 >> 1))) { uVar7 = (uVar1 >> 1) + uVar1; if (uVar7 <= uVar6) { uVar7 = uVar6; } if (0x7fffffffffffffff < uVar7 + 1) goto LAB_0; uVar6 = (uVar7 + 1) * 2; if (0xfff < uVar6) goto LAB_1; _Dst = (void *)0x0; if (uVar6 != 0) { _Dst = operator_new(uVar6); } } else { uVar6 = 0xfffffffffffffffe; LAB_1: if (uVar6 + 0x27 <= uVar6) { LAB_0: /* WARNING: Subroutine does not return */ __scrt_throw_std_bad_array_new_length(); } pvVar3 = operator_new(uVar6 + 0x27); if (pvVar3 == (void *)0x0) goto LAB_2; _Dst = (void *)((longlong)pvVar3 + 0x27U & 0xffffffffffffffe0); *(void **)((longlong)_Dst - 8) = pvVar3; } *(ulonglong *)(this + 0x18) = uVar7; *(ulonglong *)(this + 0x10) = param_1; memcpy(_Dst,param_4,param_1 * 2); *(undefined2 *)(param_1 * 2 + (longlong)_Dst) = 0; if (7 < uVar1) { pvVar3 = *(void **)this; pvVar5 = pvVar3; if ((0xfff < uVar1 * 2 + 2) && (pvVar5 = *(void **)((longlong)pvVar3 + -8), 0x1f < (ulonglong)((longlong)pvVar3 + (-8 - (longlong)pvVar5)))) { LAB_2: _o__invalid_parameter_noinfo_noreturn(); pcVar2 = (code *)swi(3); pbVar4 = (basic_string,class_std::allocator_> *)(*pcVar2)(); return pbVar4; } operator_delete__(pvVar5); } *(void **)this = _Dst; return this; } ``` ## autologgerProcessor::initialize ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.28| |i_ratio|0.35| |m_ratio|0.93| |b_ratio|0.65| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|initialize|initialize| |fullname|autologgerProcessor::initialize|autologgerProcessor::initialize| |refcount|2|2| |`length`|1192|1332| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL::ExpandEnvironmentStringsW
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_malloc
RegUtil::GetHotpatchAutoRemediationSettings
RegUtil::ReadStringValue
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapSz,struct__tlgWrapperByVal<4>_>
_tlgWriteTransfer_EventWriteTransfer
memset|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0.DLL::ExpandEnvironmentStringsW
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_malloc
RegUtil::GetHotpatchAutoRemediationSettings
RegUtil::ReadStringValue
__security_check_cookie
_tlgWriteTemplate::Write,struct__tlgWrapSz_>
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapSz,struct__tlgWrapperByVal<4>_>
_tlgWriteTransfer_EventWriteTransfer
memset
std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>
std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>
std::filesystem::path::filename
wil::details::FeatureImpl::__private_IsEnabled
| |calling|HotpatchMonitor::ServiceMain|HotpatchMonitor::ServiceMain| |paramcount|1|1| |`address`|18000f6a0|18000fdcc| |sig|long __thiscall initialize(autologgerProcessor * this)|long __thiscall initialize(autologgerProcessor * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### autologgerProcessor::initialize Called Diff ```diff --- autologgerProcessor::initialize called +++ autologgerProcessor::initialize called @@ -10,0 +11,5 @@ +std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> +std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_> +std::filesystem::path::filename +wil::details::FeatureImpl::__private_IsEnabled ``` ### autologgerProcessor::initialize Diff ```diff --- autologgerProcessor::initialize +++ autologgerProcessor::initialize @@ -1,216 +1,269 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* public: long __cdecl autologgerProcessor::initialize(void) __ptr64 */ long __thiscall autologgerProcessor::initialize(autologgerProcessor *this) { + autologgerProcessor *lpDst; longlong lVar1; undefined4 uVar2; undefined4 uVar3; undefined4 uVar4; - ulong uVar5; + bool bVar5; DWORD DVar6; - void *pvVar7; + basic_string,class_std::allocator_> + *pbVar7; + void *pvVar8; undefined **lpSrc; - undefined *puVar8; + _GUID *p_Var9; + undefined *puVar10; + uint uVar11; _GUID *_Size; - _GUID *p_Var9; - undefined1 auStackY_718 [32]; - _tlgWrapSz *p_Var10; - _GUID local_6c8; - undefined1 local_6b8 [16]; - wchar_t *local_6a8; - undefined2 local_6a0; + _GUID *p_Var12; + undefined1 auStackY_748 [32]; + _tlgWrapSz *p_Var13; + undefined1 local_6f8 [16]; + wchar_t *local_6e8; + _GUID local_6e0; + undefined8 uStack_6d0; + undefined8 local_6c8; + undefined8 local_6c0; + basic_string,class_std::allocator_> + local_6b8 [16]; + int local_6a8; _EVENT_DATA_DESCRIPTOR local_698 [2]; _GUID *local_678; - undefined4 local_670; - undefined4 local_66c; - _GUID *local_668; - undefined4 local_660; - undefined4 local_65c; + undefined8 local_670; + undefined1 *local_668; + undefined8 local_660; _GUID local_658 [33]; _GUID local_448 [33]; _GUID local_238 [33]; ulonglong local_28; - local_28 = __security_cookie ^ (ulonglong)auStackY_718; - local_6b8._8_8_ = local_6b8._8_8_ & 0xffffffff00000000; - local_6c8.Data4 = (uchar [8])0x180017400; + local_28 = __security_cookie ^ (ulonglong)auStackY_748; + p_Var9 = (_GUID *)0x0; + local_6e0._0_8_ = local_6e0._0_8_ & 0xffffffff00000000; + local_6f8._0_4_ = 0x104; + local_6e8 = L"AutologgerSessionKey"; + p_Var12 = (_GUID *)local_6f8; + _Size = local_658; lpSrc = &RegUtil::SERVICE_KEY; - p_Var9 = &local_6c8; - local_6c8.Data1 = 0x104; - _Size = local_658; - uVar5 = RegUtil::ReadStringValue - ((ushort **)&RegUtil::SERVICE_KEY,(ushort **)local_6c8.Data4,(ushort *)_Size, - &p_Var9->Data1); - if (uVar5 == 0) { - local_6c8.Data1 = 0x104; - p_Var9 = &local_6c8; - local_6c8.Data4 = (uchar [8])0x1800173d0; + DVar6 = RegUtil::ReadStringValue + ((ushort **)&RegUtil::SERVICE_KEY,(ushort **)&local_6e8,(ushort *)_Size, + (ulong *)p_Var12); + if (DVar6 == 0) { + local_6f8._0_4_ = 0x104; + local_6e8 = L"AutologgerSessionName"; + p_Var12 = (_GUID *)local_6f8; _Size = local_238; lpSrc = &RegUtil::SERVICE_KEY; - uVar5 = RegUtil::ReadStringValue - ((ushort **)&RegUtil::SERVICE_KEY,(ushort **)local_6c8.Data4,(ushort *)_Size, - &p_Var9->Data1); - if (uVar5 != 0) { - if (DAT_1 < 6) goto LAB_18000fa6a; - puVar8 = &DAT_2; + DVar6 = RegUtil::ReadStringValue + ((ushort **)&RegUtil::SERVICE_KEY,(ushort **)&local_6e8,(ushort *)_Size, + (ulong *)p_Var12); + if (DVar6 != 0) { + if (DAT_1 < 6) goto LAB_18001021e; + puVar10 = &DAT_2; goto LAB_3; } - local_6b8._0_8_ = local_658; - local_6c8.Data1 = 0x104; - p_Var9 = &local_6c8; + local_6f8._8_8_ = local_658; + local_6f8._0_4_ = 0x104; + local_6e8 = L"FileName"; + p_Var12 = (_GUID *)local_6f8; _Size = local_448; - local_6c8.Data4 = (uchar [8])0x1800173b8; - lpSrc = (undefined **)local_6b8; - uVar5 = RegUtil::ReadStringValue - ((ushort **)lpSrc,(ushort **)local_6c8.Data4,(ushort *)_Size,&p_Var9->Data1); - if (uVar5 != 0) { - if (DAT_1 < 6) goto LAB_18000fa6a; - puVar8 = &DAT_4; - p_Var10 = (_tlgWrapSz *)local_6b8; - local_6b8._0_8_ = "Initialize"; - local_6c8.Data1 = uVar5; - goto LAB_5; - } + lpSrc = (undefined **)(local_6f8 + 8); + DVar6 = RegUtil::ReadStringValue + ((ushort **)lpSrc,(ushort **)&local_6e8,(ushort *)_Size,(ulong *)p_Var12); + if (DVar6 != 0) { + if (DAT_1 < 6) goto LAB_18001021e; + local_6f8._8_8_ = "Initialize"; + p_Var13 = (_tlgWrapSz *)(local_6f8 + 8); + puVar10 = &DAT_4; + p_Var9 = (_GUID *)lpSrc; + local_6f8._0_4_ = DVar6; + goto LAB_5; + } + lpDst = this + 0x20; _Size = (_GUID *)0x104; lpSrc = (undefined **)local_448; - DVar6 = ExpandEnvironmentStringsW((LPCWSTR)lpSrc,(LPWSTR)(this + 0x20),0x104); + DVar6 = ExpandEnvironmentStringsW((LPCWSTR)lpSrc,(LPWSTR)lpDst,0x104); if (DVar6 == 0) { - uVar5 = GetLastError(); - if (0 < (int)uVar5) { - uVar5 = uVar5 & 0xffff | 0x80070000; + DVar6 = GetLastError(); + if (0 < (int)DVar6) { + DVar6 = DVar6 & 0xffff | 0x80070000; } - if (DAT_1 < 6) goto LAB_18000fa6a; - p_Var10 = (_tlgWrapSz *)local_6b8; - local_6b8._0_8_ = "Initialize"; - puVar8 = &DAT_6; - local_6c8.Data1 = uVar5; - goto LAB_5; - } - lpSrc = (undefined **)0x2a0; - *(undefined4 *)(this + 0x10) = 0x2a0; - pvVar7 = (void *)_o_malloc(); - *(void **)(this + 8) = pvVar7; - if (pvVar7 == (void *)0x0) { - uVar5 = 0x80070008; - if (DAT_1 < 6) goto LAB_18000fa6a; - p_Var10 = (_tlgWrapSz *)local_6b8; - local_6b8._0_8_ = "Initialize"; - puVar8 = &DAT_7; - local_6c8.Data1 = 0x80070008; + if (DAT_1 < 6) goto LAB_18001021e; + local_6f8._8_8_ = "Initialize"; + p_Var13 = (_tlgWrapSz *)(local_6f8 + 8); + puVar10 = &DAT_6; + p_Var9 = (_GUID *)lpSrc; + local_6f8._0_4_ = DVar6; + goto LAB_5; + } + bVar5 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar5) { + _Size = (_GUID *)0xffffffffffffffff; + do { + _Size = (_GUID *)((longlong)&_Size->Data1 + 1); + } while (*(short *)(lpDst + (longlong)_Size * 2) != 0); + local_6e0.Data4[0] = '\0'; + local_6e0.Data4[1] = '\0'; + local_6e0.Data4[2] = '\0'; + local_6e0.Data4[3] = '\0'; + local_6e0.Data4[4] = '\0'; + local_6e0.Data4[5] = '\0'; + local_6e0.Data4[6] = '\0'; + local_6e0.Data4[7] = '\0'; + uStack_6d0 = 0; + local_6c8 = 0; + local_6c0 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)local_6e0.Data4,(ushort *)lpDst,(__uint64)_Size); + pbVar7 = (basic_string,class_std::allocator_> + *)std::filesystem::path::filename((path *)local_6e0.Data4); + std:: + basic_string,class_std::allocator_> + :: + basic_string,class_std::allocator_> + (local_6b8,pbVar7); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + (local_6b8); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)local_698); + std:: + basic_string,class_std::allocator_> + :: + ~basic_string,class_std::allocator_> + ((basic_string,class_std::allocator_> + *)local_6e0.Data4); + uVar11 = local_6a8 * 2 + 0x282; + } + else { + uVar11 = 0x2a0; + } + *(uint *)(this + 0x10) = uVar11; + lpSrc = (undefined **)(ulonglong)uVar11; + pvVar8 = (void *)_o_malloc(); + *(void **)(this + 8) = pvVar8; + if (pvVar8 == (void *)0x0) { + DVar6 = 0x80070008; + if (DAT_1 < 6) goto LAB_18001021e; + local_6f8._8_8_ = "Initialize"; + local_6f8._0_4_ = 0x80070008; + p_Var13 = (_tlgWrapSz *)(local_6f8 + 8); + puVar10 = &DAT_7; + p_Var9 = (_GUID *)lpSrc; goto LAB_5; } _Size = (_GUID *)(ulonglong)*(uint *)(this + 0x10); - memset(pvVar7,0,(size_t)_Size); + memset(pvVar8,0,(size_t)_Size); **(undefined4 **)(this + 8) = *(undefined4 *)(this + 0x10); - lpSrc = (undefined **)0x1c0; lVar1 = *(longlong *)(this + 8); uVar2 = *(undefined4 *)(this + 0x22c); uVar3 = *(undefined4 *)(this + 0x230); uVar4 = *(undefined4 *)(this + 0x234); *(undefined4 *)(lVar1 + 0x18) = *(undefined4 *)(this + 0x228); *(undefined4 *)(lVar1 + 0x1c) = uVar2; *(undefined4 *)(lVar1 + 0x20) = uVar3; *(undefined4 *)(lVar1 + 0x24) = uVar4; *(undefined4 *)(*(longlong *)(this + 8) + 0x74) = 0x78; *(undefined4 *)(*(longlong *)(this + 8) + 0x70) = 0; - pvVar7 = (void *)_o_malloc(); - *(void **)(this + 0x18) = pvVar7; - if (pvVar7 == (void *)0x0) { - uVar5 = 0x80070008; - if (DAT_1 < 6) goto LAB_18000fa6a; - p_Var10 = (_tlgWrapSz *)local_6b8; - local_6b8._0_8_ = "Initialize"; - puVar8 = &DAT_7; - local_6c8.Data1 = 0x80070008; + lpSrc = (undefined **)0x1c0; + pvVar8 = (void *)_o_malloc(); + *(void **)(this + 0x18) = pvVar8; + if (pvVar8 == (void *)0x0) { + DVar6 = 0x80070008; + if (DAT_1 < 6) goto LAB_18001021e; + local_6f8._8_8_ = "Initialize"; + local_6f8._0_4_ = 0x80070008; + p_Var13 = (_tlgWrapSz *)(local_6f8 + 8); + puVar10 = &DAT_7; + p_Var9 = (_GUID *)lpSrc; goto LAB_5; } _Size = (_GUID *)0x1c0; - memset(pvVar7,0,0x1c0); - **(undefined8 **)(this + 0x18) = this + 0x20; + memset(pvVar8,0,0x1c0); + **(undefined8 **)(this + 0x18) = lpDst; *(undefined4 *)(*(longlong *)(this + 0x18) + 0x1c) = 0x10000000; *(code **)(*(longlong *)(this + 0x18) + 0x1a8) = AutologgerProcessEventCallback; - local_6c8.Data1 = RegUtil::GetHotpatchAutoRemediationSettings((ulong *)(local_6b8 + 8)); - lpSrc = (undefined **)0x0; - if (-1 < (int)local_6c8.Data1) { - lpSrc = (undefined **)(local_6b8._8_8_ & 0xffffffff); - } - AutoRemediate = (ulong)lpSrc; + local_6f8._0_4_ = RegUtil::GetHotpatchAutoRemediationSettings(&local_6e0.Data1); + if (-1 < (int)local_6f8._0_4_) { + p_Var9 = (_GUID *)(local_6e0._0_8_ & 0xffffffff); + } + AutoRemediate = (ulong)p_Var9; + DVar6 = 0; if (5 < DAT_1) { - local_65c = 0; - local_66c = 0; - p_Var9 = (_GUID *)0x0; + local_6e0.Data1 = AutoRemediate; + local_668 = local_6f8; + local_660 = 4; + local_678 = &local_6e0; + local_670 = 4; + p_Var12 = (_GUID *)0x0; _Size = (_GUID *)0x0; - local_668 = &local_6c8; - local_6b8._8_4_ = AutoRemediate; - lpSrc = (undefined **)&DAT_1; - local_678 = (_GUID *)(local_6b8 + 8); - local_660 = 4; - local_670 = 4; + p_Var9 = (_GUID *)&DAT_1; _tlgWriteTransfer_EventWriteTransfer (0x18001e048,&DAT_8,(LPCGUID)0x0,(LPCGUID)0x0,4,local_698); } - uVar5 = 0; } else { - if (DAT_1 < 6) goto LAB_18000fa6a; - puVar8 = &DAT_9; + if (DAT_1 < 6) goto LAB_18001021e; + puVar10 = &DAT_9; LAB_3: - p_Var10 = (_tlgWrapSz *)local_6c8.Data4; - local_6c8.Data4 = (uchar [8])0x180017488; - local_6c8.Data1 = uVar5; + p_Var13 = (_tlgWrapSz *)&local_6e8; + local_6e8 = L"Initialize"; + p_Var9 = (_GUID *)lpSrc; + local_6f8._0_4_ = DVar6; LAB_5: - uVar5 = local_6c8.Data1; + DVar6 = local_6f8._0_4_; _tlgWriteTemplate ::Write,struct__tlgWrapSz_> - ((_tlgProvider_t *)lpSrc,puVar8,_Size,p_Var9,(_tlgWrapperByVal<4> *)&local_6c8,p_Var10 - ); - } + ((_tlgProvider_t *)p_Var9,puVar10,_Size,p_Var12,(_tlgWrapperByVal<4> *)local_6f8, + p_Var13); + } + lpSrc = (undefined **)p_Var9; if (5 < DAT_1) { - local_66c = 0; - local_678 = &local_6c8; + local_678 = (_GUID *)local_6f8; + local_670 = 4; + p_Var12 = (_GUID *)0x0; + _Size = (_GUID *)0x0; lpSrc = (undefined **)&DAT_1; - p_Var9 = (_GUID *)0x0; - _Size = (_GUID *)0x0; - local_670 = 4; - local_6c8.Data1 = uVar5; + local_6f8._0_4_ = DVar6; _tlgWriteTransfer_EventWriteTransfer (0x18001e048,&DAT_10,(LPCGUID)0x0,(LPCGUID)0x0,3,local_698); } LAB_0: - if (((((int)uVar5 < 0) && (5 < DAT_11)) && ((_DAT_18001e090 & 0x800000000000) != 0)) && + if (((((int)DVar6 < 0) && (5 < DAT_11)) && ((_DAT_18001e090 & 0x800000000000) != 0)) && ((DAT_12 & 0x800000000000) == DAT_12)) { - local_6a8 = L"Autologger"; - local_6b8._0_8_ = "Initialize"; - local_6a0 = 0x14; - local_6b8[8] = '\0'; - local_6b8[9] = '\0'; - local_6b8[10] = '\0'; - local_6b8[0xb] = 0x80; - local_6b8[0xc] = '\0'; - local_6b8[0xd] = '\0'; - local_6b8[0xe] = '\0'; - local_6b8[0xf] = '\0'; - local_6c8.Data4[0] = '\0'; - local_6c8.Data4[1] = '\0'; - local_6c8.Data4[2] = '\0'; - local_6c8.Data4[3] = '\x01'; - local_6c8.Data4[4] = '\0'; - local_6c8.Data4[5] = '\0'; - local_6c8.Data4[6] = '\0'; - local_6c8.Data4[7] = '\0'; - local_6c8.Data1 = uVar5; + local_6f8._8_8_ = "Initialize"; + local_6e0.Data4 = (uchar [8])0x180017668; + uStack_6d0 = CONCAT62(uStack_6d0._2_6_,0x14); + local_6e8 = (wchar_t *)0x1000000; + local_6e0.Data1 = 0x80000000; + local_6e0.Data2 = 0; + local_6e0.Data3 = 0; + local_6f8._0_4_ = DVar6; _tlgWriteTemplate :: Write,struct__tlgWrapperByVal<8>,struct__tlgWrapperBinary,struct__tlgWrapSz,struct__tlgWrapperByVal<4>_> - ((_tlgProvider_t *)lpSrc,&DAT_13,_Size,p_Var9, - (_tlgWrapperByVal<8> *)(local_6b8 + 8),(_tlgWrapperByVal<8> *)local_6c8.Data4, - (_tlgWrapperBinary *)&local_6a8,(_tlgWrapSz *)local_6b8, - (_tlgWrapperByVal<4> *)&local_6c8); - } - return uVar5; + ((_tlgProvider_t *)lpSrc,&DAT_13,_Size,p_Var12, + (_tlgWrapperByVal<8> *)&local_6e0,(_tlgWrapperByVal<8> *)&local_6e8, + (_tlgWrapperBinary *)local_6e0.Data4,(_tlgWrapSz *)(local_6f8 + 8), + (_tlgWrapperByVal<4> *)local_6f8); + } + return DVar6; } ``` ## `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,called| |ratio|0.25| |i_ratio|0.42| |m_ratio|0.76| |b_ratio|0.76| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|infoEventsToEmit''|infoEventsToEmit''| |fullname|`dynamic_initializer_for_'EventHandler::infoEventsToEmit''|`dynamic_initializer_for_'EventHandler::infoEventsToEmit''| |refcount|3|3| |`length`|466|713| |`called`|__security_check_cookie
`eh_vector_destructor_iterator'
atexit
operator_new
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>
std::_Hash_vec_>,struct_std::_Iterator_base0>_>_>::_Assign_grow
std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>|__security_check_cookie
`eh_vector_destructor_iterator'
atexit
operator_new
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>
std::_Hash_vec_>,struct_std::_Iterator_base0>_>_>::_Assign_grow
std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>| |calling||| |paramcount|0|0| |address|180001cc0|180001cc0| |sig|undefined __fastcall infoEventsToEmit''(void)|undefined __fastcall infoEventsToEmit''(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' Called Diff ```diff --- `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' called +++ `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' called @@ -7 +7 @@ -std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> ``` ### `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' Diff ```diff --- `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' +++ `dynamic_initializer_for_'EventHandler::infoEventsToEmit'' @@ -1,140 +1,207 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void `dynamic_initializer_for_'EventHandler::infoEventsToEmit__(void) { _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *this; - basic_string,class_std::allocator_> - *pbVar1; + ulonglong *puVar1; undefined1 auStack_1c8 [32]; basic_string,class_std::allocator_> local_1a8 [16]; - basic_string,class_std::allocator_> - local_198 [32]; - basic_string,class_std::allocator_> - local_178 [32]; - basic_string,class_std::allocator_> - local_158 [32]; - basic_string,class_std::allocator_> - local_138 [32]; - basic_string,class_std::allocator_> - local_118 [32]; - basic_string,class_std::allocator_> - local_f8 [32]; - basic_string,class_std::allocator_> - local_d8 [32]; - basic_string,class_std::allocator_> - local_b8 [32]; - basic_string,class_std::allocator_> - local_98 [32]; - basic_string,class_std::allocator_> - local_78 [32]; - basic_string,class_std::allocator_> - local_58 [32]; - basic_string,class_std::allocator_> - local_38 [32]; + ulonglong local_198 [4]; + undefined8 local_178; + undefined8 uStack_170; + undefined8 local_168; + undefined8 uStack_160; + undefined8 local_158; + undefined8 uStack_150; + undefined8 local_148; + undefined8 uStack_140; + undefined8 local_138; + undefined8 uStack_130; + undefined8 local_128; + undefined8 uStack_120; + undefined8 local_118; + undefined8 uStack_110; + undefined8 local_108; + undefined8 uStack_100; + undefined8 local_f8; + undefined8 uStack_f0; + undefined8 local_e8; + undefined8 uStack_e0; + undefined8 local_d8; + undefined8 uStack_d0; + undefined8 local_c8; + undefined8 uStack_c0; + undefined8 local_b8; + undefined8 uStack_b0; + undefined8 local_a8; + undefined8 uStack_a0; + undefined8 local_98; + undefined8 uStack_90; + undefined8 local_88; + undefined8 uStack_80; + undefined8 local_78; + undefined8 uStack_70; + undefined8 local_68; + undefined8 uStack_60; + undefined8 local_58; + undefined8 uStack_50; + undefined8 local_48; + undefined8 uStack_40; + undefined8 local_38; + undefined8 uStack_30; + undefined8 local_28; + undefined8 uStack_20; ulonglong local_18 [2]; local_18[0] = __security_cookie ^ (ulonglong)auStack_1c8; - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_198,(ushort *)L"ActiveUserPatchRundown"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_178,(ushort *)L"ActiveSecureUserPatchRundown"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_158,(ushort *)L"ActiveKernelPatchRundown"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_138,(ushort *)L"ActiveSecureKernelPatchRundown"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_118,(ushort *)L"ImageHotPatchOperation"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_f8,(ushort *)L"ImageHotPatchOperationStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_d8,(ushort *)L"ImageHotPatchThreadOperationStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_b8,(ushort *)L"ImageHotPatchSectionCreateOperationStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_98,(ushort *)L"KernelHotPatchOperationStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_78,(ushort *)L"SecureKernelHotPatchOperationStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_58,(ushort *)L"SessionHotPatchLoadStatus"); - std:: - basic_string,class_std::allocator_> - :: - basic_string,class_std::allocator_> - (local_38,(ushort *)L"ImageHotPatchOperationReverseOnly"); + local_198[0] = 0; + local_198[1] = 0; + local_198[2] = 0; + local_198[3] = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)local_198,(ushort *)L"ActiveUserPatchRundown",0x16); + local_178 = 0; + uStack_170 = 0; + local_168 = 0; + uStack_160 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_178,(ushort *)L"ActiveSecureUserPatchRundown",0x1c); + local_158 = 0; + uStack_150 = 0; + local_148 = 0; + uStack_140 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_158,(ushort *)L"ActiveKernelPatchRundown",0x18); + local_138 = 0; + uStack_130 = 0; + local_128 = 0; + uStack_120 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_138,(ushort *)L"ActiveSecureKernelPatchRundown",0x1e); + local_118 = 0; + uStack_110 = 0; + local_108 = 0; + uStack_100 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_118,(ushort *)L"ImageHotPatchOperation",0x16); + local_f8 = 0; + uStack_f0 = 0; + local_e8 = 0; + uStack_e0 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_f8,(ushort *)L"ImageHotPatchOperationStatus",0x1c); + local_d8 = 0; + uStack_d0 = 0; + local_c8 = 0; + uStack_c0 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_d8,(ushort *)L"ImageHotPatchThreadOperationStatus",0x22); + local_b8 = 0; + uStack_b0 = 0; + local_a8 = 0; + uStack_a0 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_b8,(ushort *)L"ImageHotPatchSectionCreateOperationStatus",0x29); + local_98 = 0; + uStack_90 = 0; + local_88 = 0; + uStack_80 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_98,(ushort *)L"KernelHotPatchOperationStatus",0x1d); + local_78 = 0; + uStack_70 = 0; + local_68 = 0; + uStack_60 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_78,(ushort *)L"SecureKernelHotPatchOperationStatus",0x23); + local_58 = 0; + uStack_50 = 0; + local_48 = 0; + uStack_40 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_58,(ushort *)L"SessionHotPatchLoadStatus",0x19); + local_38 = 0; + uStack_30 = 0; + local_28 = 0; + uStack_20 = 0; + std:: + basic_string,class_std::allocator_> + ::_Construct<1,unsigned_short_const*___ptr64> + ((basic_string,class_std::allocator_> + *)&local_38,(ushort *)L"ImageHotPatchOperationReverseOnly",0x21); _infoEventsToEmit = 0; DAT_0 = (void *)0x0; DAT_1 = 0; DAT_0 = operator_new(0x30); *(void **)DAT_0 = DAT_0; *(void **)((longlong)DAT_0 + 8) = DAT_0; DAT_2 = 0; _DAT_3 = 0; - uRam0000000180023418 = 0; + uRam0000000180023428 = 0; DAT_4 = 7; DAT_5 = 8; _infoEventsToEmit = 0x3f800000; this = (_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> *)&DAT_2; std:: _Hash_vec_>,struct_std::_Iterator_base0>_>_> ::_Assign_grow((_Hash_vec_>,struct_std::_Iterator_base0>_>_> - *)&DAT_2,0x10,DAT_1800233f8); - pbVar1 = local_198; + *)&DAT_2,0x10,DAT_180023408); + puVar1 = local_198; do { std:: _Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_> :: emplace,class_std::allocator_>_const&___ptr64> (this,local_1a8); - pbVar1 = pbVar1 + 0x20; - } while (pbVar1 != (basic_string,class_std::allocator_> - *)local_18); + puVar1 = puVar1 + 4; + } while (puVar1 != local_18); _eh_vector_destructor_iterator_ (local_198,0x20,0xc, std:: basic_string,class_std::allocator_> :: ~basic_string,class_std::allocator_> ); atexit(`dynamic_atexit_destructor_for_'EventHandler::infoEventsToEmit__); return; } ``` ## HotpatchMonitor::Initialize ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.61| |i_ratio|0.82| |m_ratio|0.97| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|Initialize|Initialize| |fullname|HotpatchMonitor::Initialize|HotpatchMonitor::Initialize| |refcount|4|4| |`length`|416|439| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
McGenEventRegister_EventRegister
RegUtil::GetHotpatchAutoRemediationSettings
__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer
etwConsumer::initialize|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
McGenEventRegister_EventRegister
RegUtil::GetHotpatchAutoRemediationSettings
__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer
etwConsumer::initialize
wil::details::FeatureImpl::__private_IsEnabled| |calling|ServiceMain|ServiceMain| |paramcount|3|3| |`address`|180007680|180007920| |sig|long __thiscall Initialize(HotpatchMonitor * this, ulong param_1, ushort * * param_2)|long __thiscall Initialize(HotpatchMonitor * this, ulong param_1, ushort * * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### HotpatchMonitor::Initialize Called Diff ```diff --- HotpatchMonitor::Initialize called +++ HotpatchMonitor::Initialize called @@ -7,0 +8 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### HotpatchMonitor::Initialize Diff ```diff --- HotpatchMonitor::Initialize +++ HotpatchMonitor::Initialize @@ -1,84 +1,95 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: virtual long __cdecl HotpatchMonitor::Initialize(unsigned long,unsigned short * __ptr64 * __ptr64 const) __ptr64 */ long __thiscall HotpatchMonitor::Initialize(HotpatchMonitor *this,ulong param_1,ushort **param_2) { - uint uVar1; - DWORD DVar2; - ulong uVar3; - long lVar4; - HANDLE pvVar5; - ulong uVar6; + longlong lVar1; + bool bVar2; + uint uVar3; + DWORD DVar4; + ulong uVar5; + long lVar6; + HANDLE pvVar7; + ulong uVar8; undefined1 auStackY_98 [32]; ulong local_68; ulong local_64 [3]; _EVENT_DATA_DESCRIPTOR local_58 [2]; ulong *local_38; undefined4 local_30; undefined4 local_2c; ulong *local_28; undefined4 local_20; undefined4 local_1c; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStackY_98; *(undefined8 *)(this + 0x60) = 0xffffffffffffffff; local_68 = 0; *(undefined8 *)(this + 0x40) = 0; *(undefined8 *)(this + 0x48) = 0; *(undefined8 *)(this + 0x50) = 0; *(undefined8 *)(this + 0x58) = 0; - uVar1 = McGenEventRegister_EventRegister(); - if (uVar1 == 0) { - pvVar5 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); - *(HANDLE *)(this + 0x48) = pvVar5; - if (pvVar5 != (HANDLE)0x0) { - pvVar5 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); - *(HANDLE *)(this + 0x40) = pvVar5; - if (*(longlong *)(this + 0x48) != 0) { - uVar3 = RegUtil::GetHotpatchAutoRemediationSettings(&local_68); - if ((int)uVar3 < 0) { + uVar3 = McGenEventRegister_EventRegister(); + if (uVar3 == 0) { + pvVar7 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); + *(HANDLE *)(this + 0x48) = pvVar7; + if (pvVar7 != (HANDLE)0x0) { + pvVar7 = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); + *(HANDLE *)(this + 0x40) = pvVar7; + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar2) { + lVar1 = *(longlong *)(this + 0x40); + } + else { + lVar1 = *(longlong *)(this + 0x48); + } + if (lVar1 != 0) { + uVar5 = RegUtil::GetHotpatchAutoRemediationSettings(&local_68); + if ((int)uVar5 < 0) { *(undefined4 *)(this + 0x38) = 0; - uVar6 = 0; + uVar8 = 0; } else { *(ulong *)(this + 0x38) = local_68; - uVar6 = local_68; + uVar8 = local_68; } if (5 < DAT_0) { local_1c = 0; local_2c = 0; local_38 = local_64; local_28 = &local_68; local_20 = 4; local_30 = 4; - local_68 = uVar3; - local_64[0] = uVar6; + local_68 = uVar5; + local_64[0] = uVar8; _tlgWriteTransfer_EventWriteTransfer (0x18001e048,&DAT_1,(LPCGUID)0x0,(LPCGUID)0x0,4,local_58); } *(undefined4 *)(this + 0x5c) = *(undefined4 *)(this + 0x38); - lVar4 = etwConsumer::initialize((etwConsumer *)(this + 0x68)); - return lVar4; + lVar6 = etwConsumer::initialize((etwConsumer *)(this + 0x68)); + return lVar6; } } - DVar2 = GetLastError(); - uVar1 = DVar2 | 0x10000000; + DVar4 = GetLastError(); + uVar3 = DVar4 | 0x10000000; } else { - uVar1 = uVar1 | 0x10000000; + uVar3 = uVar3 | 0x10000000; if (5 < DAT_0) { local_2c = 0; local_38 = &local_68; local_30 = 4; - local_68 = uVar1; + local_68 = uVar3; _tlgWriteTransfer_EventWriteTransfer (0x18001e048,&DAT_2,(LPCGUID)0x0,(LPCGUID)0x0,3,local_58); } } - return uVar1; + return uVar3; } ``` ## std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling| |ratio|0.55| |i_ratio|0.49| |m_ratio|0.96| |b_ratio|0.8| |match_types|Implied Match| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |`name`|basic_string,class_std::allocator_>|_Construct<1,unsigned_short_const*___ptr64>| |`fullname`|std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>|std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64>| |`refcount`|19|21| |`length`|336|305| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string| |`calling`|TraceUtil::ProcessEventCallback
`dynamic_initializer_for_'EventHandler::infoEventsToEmit''
autologgerProcessor::AutologgerProcessEventCallback|TraceUtil::ProcessEventCallback
`dynamic_initializer_for_'EventHandler::infoEventsToEmit''
autologgerProcessor::AutologgerProcessEventCallback
autologgerProcessor::initialize
std::filesystem::path::filename| |paramcount|2|3| |`address`|18000e2bc|18000e4e8| |`sig`|undefined __thiscall basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this, ushort * param_1)|void __thiscall _Construct<1,unsigned_short_const*___ptr64>(basic_string,class_std::allocator_> * this, ushort * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> Calling Diff ```diff --- std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> calling +++ std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> calling @@ -3,0 +4,2 @@ +autologgerProcessor::initialize +std::filesystem::path::filename ``` ### std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> Diff ```diff --- std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> +++ std::basic_string,class_std::allocator_>::_Construct<1,unsigned_short_const*___ptr64> @@ -1,89 +1,72 @@ -/* public: __cdecl std::basic_string,class - std::allocator >::basic_string,class std::allocator >(unsigned short const * __ptr64 const) __ptr64 */ +/* private: void __cdecl std::basic_string,class std::allocator >::_Construct<1,unsigned short const * + __ptr64>(unsigned short const * __ptr64 const,unsigned __int64) __ptr64 */ -basic_string,class_std::allocator_> -* __thiscall +void __thiscall std:: basic_string,class_std::allocator_> -:: -basic_string,class_std::allocator_> +::_Construct<1,unsigned_short_const*___ptr64> (basic_string,class_std::allocator_> - *this,ushort *param_1) + *this,ushort *param_1,__uint64 param_2) { code *pcVar1; ulonglong uVar2; void *pvVar3; - basic_string,class_std::allocator_> - *pbVar4; - ulonglong uVar5; - ulonglong uVar6; + ulonglong uVar4; void *_Dst; - _Dst = (void *)0x0; - *(undefined8 *)this = 0; - *(undefined8 *)(this + 8) = 0; - *(undefined8 *)(this + 0x10) = 0; - *(undefined8 *)(this + 0x18) = 0; - uVar6 = 0xffffffffffffffff; - do { - uVar6 = uVar6 + 1; - } while (param_1[uVar6] != 0); - if (0x7ffffffffffffffe < uVar6) { + if (0x7ffffffffffffffe < param_2) { + /* WARNING: Subroutine does not return */ _Xlen_string(); - pcVar1 = (code *)swi(3); - pbVar4 = (basic_string,class_std::allocator_> - *)(*pcVar1)(); - return pbVar4; } *(undefined8 *)(this + 0x18) = 7; - if (uVar6 < 8) { - *(ulonglong *)(this + 0x10) = uVar6; - memcpy(this,param_1,uVar6 * 2); - *(undefined2 *)(this + uVar6 * 2) = 0; - return this; + if (param_2 < 8) { + *(__uint64 *)(this + 0x10) = param_2; + memcpy(this,param_1,param_2 * 2); + *(undefined2 *)(this + param_2 * 2) = 0; + return; } - uVar2 = uVar6 | 7; + uVar2 = param_2 | 7; if (uVar2 < 0x7fffffffffffffff) { if (uVar2 < 10) { uVar2 = 10; } if (0x7fffffffffffffff < uVar2 + 1) goto LAB_0; - uVar5 = (uVar2 + 1) * 2; - if (uVar5 < 0x1000) { - if (uVar5 != 0) { - _Dst = operator_new(uVar5); + uVar4 = (uVar2 + 1) * 2; + if (uVar4 < 0x1000) { + _Dst = (void *)0x0; + if (uVar4 != 0) { + _Dst = operator_new(uVar4); } goto LAB_1; } } else { - uVar5 = 0xfffffffffffffffe; + uVar4 = 0xfffffffffffffffe; uVar2 = 0x7ffffffffffffffe; } - if (uVar5 < uVar5 + 0x27) { - pvVar3 = operator_new(uVar5 + 0x27); + if (uVar4 < uVar4 + 0x27) { + pvVar3 = operator_new(uVar4 + 0x27); if (pvVar3 == (void *)0x0) { _o__invalid_parameter_noinfo_noreturn(); pcVar1 = (code *)swi(3); - pbVar4 = (basic_string,class_std::allocator_> - *)(*pcVar1)(); - return pbVar4; + (*pcVar1)(); + return; } _Dst = (void *)((longlong)pvVar3 + 0x27U & 0xffffffffffffffe0); *(void **)((longlong)_Dst - 8) = pvVar3; LAB_1: - *(ulonglong *)(this + 0x10) = uVar6; + *(__uint64 *)(this + 0x10) = param_2; *(void **)this = _Dst; *(ulonglong *)(this + 0x18) = uVar2; - memcpy(_Dst,param_1,uVar6 * 2); - *(undefined2 *)(uVar6 * 2 + (longlong)_Dst) = 0; - return this; + memcpy(_Dst,param_1,param_2 * 2); + *(undefined2 *)(param_2 * 2 + (longlong)_Dst) = 0; + return; } LAB_0: /* WARNING: Subroutine does not return */ __scrt_throw_std_bad_array_new_length(); } ``` ## std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,parent| |ratio|0.26| |i_ratio|0.38| |m_ratio|0.94| |b_ratio|0.93| |match_types|Implied Match| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |`name`|_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64>|basic_string,class_std::allocator_>| |`fullname`|std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64>|std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_>| |`refcount`|2|3| |`length`|345|317| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
__scrt_throw_std_bad_array_new_length
memcpy
operator_new
std::_Xlen_string| |`calling`|std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>|autologgerProcessor::initialize
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>| |paramcount|3|2| |`address`|180012200|18000e798| |`sig`|undefined __thiscall _List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64>(_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> * this, allocator,class_std::allocator_>,void*___ptr64>_> * param_1, basic_string,class_std::allocator_> * param_2)|undefined __thiscall basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this, basic_string,class_std::allocator_> * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> Calling Diff ```diff --- std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> calling +++ std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> calling @@ -0,0 +1 @@ +autologgerProcessor::initialize ``` ### std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> Diff ```diff --- std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> +++ std::basic_string,class_std::allocator_>::basic_string,class_std::allocator_> @@ -1,106 +1,91 @@ -/* public: __cdecl std::_List_node_emplace_op2,class - std::allocator >,void * __ptr64> > >::_List_node_emplace_op2,class std::allocator >,void * __ptr64> > >,class - std::allocator > const & __ptr64>(class std::allocator,class std::allocator >,void * __ptr64> > & __ptr64,class - std::basic_string,class - std::allocator > const & __ptr64) __ptr64 */ +/* public: __cdecl std::basic_string,class + std::allocator >::basic_string,class std::allocator >(class std::basic_string,class std::allocator > const & __ptr64) __ptr64 + */ -_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> +basic_string,class_std::allocator_> * __thiscall std:: -_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> +basic_string,class_std::allocator_> :: -_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>,class_std::allocator_>_const&___ptr64> - (_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> - *this,allocator,class_std::allocator_>,void*___ptr64>_> - *param_1, - basic_string,class_std::allocator_> - *param_2) +basic_string,class_std::allocator_> + (basic_string,class_std::allocator_> + *this,basic_string,class_std::allocator_> + *param_1) { ulonglong uVar1; code *pcVar2; undefined8 uVar3; - void *pvVar4; - ulonglong uVar5; - void *pvVar6; - _List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> - *p_Var7; - ulonglong uVar8; + ulonglong uVar4; + void *pvVar5; + basic_string,class_std::allocator_> + *pbVar6; + ulonglong uVar7; void *_Dst; - *(allocator,class_std::allocator_>,void*___ptr64>_> - **)this = param_1; _Dst = (void *)0x0; + *(undefined8 *)this = 0; *(undefined8 *)(this + 8) = 0; - pvVar4 = operator_new(0x30); - *(void **)(this + 8) = pvVar4; - *(undefined8 *)((longlong)pvVar4 + 0x10) = 0; - *(undefined8 *)((longlong)pvVar4 + 0x18) = 0; - *(undefined8 *)((longlong)pvVar4 + 0x20) = 0; - *(undefined8 *)((longlong)pvVar4 + 0x28) = 0; - uVar1 = *(ulonglong *)(param_2 + 0x10); - if (7 < *(ulonglong *)(param_2 + 0x18)) { - param_2 = *(basic_string,class_std::allocator_> - **)param_2; + *(undefined8 *)(this + 0x10) = 0; + *(undefined8 *)(this + 0x18) = 0; + uVar1 = *(ulonglong *)(param_1 + 0x10); + if (7 < *(ulonglong *)(param_1 + 0x18)) { + param_1 = *(basic_string,class_std::allocator_> + **)param_1; } - if (uVar1 < 0x7fffffffffffffff) { - *(undefined8 *)((longlong)pvVar4 + 0x28) = 7; - if (uVar1 < 8) { - *(ulonglong *)((longlong)pvVar4 + 0x20) = uVar1; - uVar3 = *(undefined8 *)(param_2 + 8); - *(undefined8 *)((longlong)pvVar4 + 0x10) = *(undefined8 *)param_2; - *(undefined8 *)((longlong)pvVar4 + 0x18) = uVar3; - return this; + if (0x7ffffffffffffffe < uVar1) { + /* WARNING: Subroutine does not return */ + _Xlen_string(); + } + *(undefined8 *)(this + 0x18) = 7; + if (uVar1 < 8) { + *(ulonglong *)(this + 0x10) = uVar1; + uVar3 = *(undefined8 *)(param_1 + 8); + *(undefined8 *)this = *(undefined8 *)param_1; + *(undefined8 *)(this + 8) = uVar3; + return this; + } + uVar4 = uVar1 | 7; + if (uVar4 < 0x7fffffffffffffff) { + if (uVar4 < 10) { + uVar4 = 10; } - uVar5 = uVar1 | 7; - if (uVar5 < 0x7fffffffffffffff) { - if (uVar5 < 10) { - uVar5 = 10; + if (0x7fffffffffffffff < uVar4 + 1) goto LAB_0; + uVar7 = (uVar4 + 1) * 2; + if (uVar7 < 0x1000) { + if (uVar7 != 0) { + _Dst = operator_new(uVar7); } - if (0x7fffffffffffffff < uVar5 + 1) goto LAB_0; - uVar8 = (uVar5 + 1) * 2; - if (uVar8 < 0x1000) { - if (uVar8 != 0) { - _Dst = operator_new(uVar8); - } - goto LAB_1; - } - } - else { - uVar8 = 0xfffffffffffffffe; - uVar5 = 0x7ffffffffffffffe; - } - if (uVar8 < uVar8 + 0x27) { - pvVar6 = operator_new(uVar8 + 0x27); - if (pvVar6 == (void *)0x0) { - _o__invalid_parameter_noinfo_noreturn(); - pcVar2 = (code *)swi(3); - p_Var7 = (_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_> - *)(*pcVar2)(); - return p_Var7; - } - _Dst = (void *)((longlong)pvVar6 + 0x27U & 0xffffffffffffffe0); - *(void **)((longlong)_Dst - 8) = pvVar6; -LAB_1: - *(void **)((longlong)pvVar4 + 0x10) = _Dst; - *(ulonglong *)((longlong)pvVar4 + 0x20) = uVar1; - *(ulonglong *)((longlong)pvVar4 + 0x28) = uVar5; - memcpy(_Dst,param_2,uVar1 * 2 + 2); - return this; + goto LAB_1; } } else { - _Xlen_string(); + uVar7 = 0xfffffffffffffffe; + uVar4 = 0x7ffffffffffffffe; + } + if (uVar7 < uVar7 + 0x27) { + pvVar5 = operator_new(uVar7 + 0x27); + if (pvVar5 == (void *)0x0) { + _o__invalid_parameter_noinfo_noreturn(); + pcVar2 = (code *)swi(3); + pbVar6 = (basic_string,class_std::allocator_> + *)(*pcVar2)(); + return pbVar6; + } + _Dst = (void *)((longlong)pvVar5 + 0x27U & 0xffffffffffffffe0); + *(void **)((longlong)_Dst - 8) = pvVar5; +LAB_1: + *(void **)this = _Dst; + *(ulonglong *)(this + 0x10) = uVar1; + *(ulonglong *)(this + 0x18) = uVar4; + memcpy(_Dst,param_1,uVar1 * 2 + 2); + return this; } LAB_0: /* WARNING: Subroutine does not return */ __scrt_throw_std_bad_array_new_length(); } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|30|29| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180013b58|180014250| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## SubscribeFeatureStateCacheToConfigurationChanges ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::SubscribeFeatureStateCacheToConfigurationChanges|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |`refcount`|8|9| |length|159|159| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|3|3| |`address`|18000bcac|18000bfac| |sig|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SubscribeFeatureStateCacheToConfigurationChanges Calling Diff ```diff --- wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling +++ wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## Write,struct__tlgWrapperByVal<4>_> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|Write,struct__tlgWrapperByVal<4>_>|Write,struct__tlgWrapperByVal<4>_>| |fullname|_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>|_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>_>| |`refcount`|11|12| |length|159|159| |called|__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer|__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer| |calling|TraceUtil::AutologgerProcessorThread
TraceUtil::EtwConsumerThread
TraceUtil::ProcessEventCallback
autologgerProcessor::AutologgerProcessEventCallback|TraceUtil::AutologgerProcessorThread
TraceUtil::EtwConsumerThread
TraceUtil::ProcessEventCallback
autologgerProcessor::AutologgerProcessEventCallback| |paramcount|6|6| |address|1800014f0|1800014f0| |sig|long __cdecl Write,struct__tlgWrapperByVal<4>_>(_tlgProvider_t * param_1, void * param_2, _GUID * param_3, _GUID * param_4, _tlgWrapSz * param_5, _tlgWrapperByVal<4> * param_6)|long __cdecl Write,struct__tlgWrapperByVal<4>_>(_tlgProvider_t * param_1, void * param_2, _GUID * param_3, _GUID * param_4, _tlgWrapSz * param_5, _tlgWrapperByVal<4> * param_6)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## __GSHandlerCheck_EH4 ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck_EH4|__GSHandlerCheck_EH4| |fullname|__GSHandlerCheck_EH4|__GSHandlerCheck_EH4| |`refcount`|10|11| |length|127|127| |called|__CxxFrameHandler4
__GSHandlerCheckCommon|__CxxFrameHandler4
__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180013be0|1800142d8| |sig|undefined __fastcall __GSHandlerCheck_EH4(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined __fastcall __GSHandlerCheck_EH4(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## Write_> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|0.97| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|Write_>|Write_>| |fullname|_tlgWriteTemplate::Write_>|_tlgWriteTemplate::Write_>| |`refcount`|18|20| |length|132|132| |called|__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer|__security_check_cookie
_tlgWriteTransfer_EventWriteTransfer| |calling|
Expand for full list:
DllMain
HotpatchMonitor::Cleanup
HotpatchMonitor::ConfigureServiceStartType
HotpatchMonitor::ServiceMain
HotpatchMonitor::SetServiceToAutoStart
HotpatchMonitor::StopService
ServiceMain
TraceUtil::AutologgerProcessorThread
TraceUtil::ProcessEventCallback
autologgerProcessor::AutologgerProcessEventCallback
etwConsumer::startSessionetwConsumer::stopSession
|
Expand for full list:
DllMain
HotpatchMonitor::Cleanup
HotpatchMonitor::ConfigureServiceStartType
HotpatchMonitor::ServiceMain
HotpatchMonitor::SetServiceToAutoStart
HotpatchMonitor::StopService
ServiceMain
TraceUtil::AutologgerProcessorThread
TraceUtil::ProcessEventCallback
autologgerProcessor::AutologgerProcessEventCallback
etwConsumer::startSessionetwConsumer::stopSession
| |paramcount|5|5| |address|180001008|180001008| |sig|long __cdecl Write_>(_tlgProvider_t * param_1, void * param_2, _GUID * param_3, _GUID * param_4, _tlgWrapSz * param_5)|long __cdecl Write_>(_tlgProvider_t * param_1, void * param_2, _GUID * param_3, _GUID * param_4, _tlgWrapSz * param_5)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|8|9| |length|203|203| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |`address`|180005ba4|180005c94| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## ~basic_string,class_std::allocator_> ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|~basic_string,class_std::allocator_>|~basic_string,class_std::allocator_>| |fullname|std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>|std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_>| |`refcount`|41|43| |length|104|104| |called|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
operator_delete[]|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__invalid_parameter_noinfo_noreturn
operator_delete[]| |`calling`|
Expand for full list:
EventHandler::isEmitInformationalEvent
TraceUtil::ProcessEventCallback
`TraceUtil::ProcessEventCallback'::__l1::dtor$0
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$0
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$1
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$10
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$2
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$3
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$4
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$5
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$6``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$7
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$8
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$9
`autologgerProcessor::AutologgerProcessEventCallback'::__l1::dtor$0
`std::basic_stringstream,std::allocator_>::str'::__l1::dtor$1
autologgerProcessor::AutologgerProcessEventCallback
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Clear_guard::~_Clear_guard
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Unchecked_erase
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64>
std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::~_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>
std::list,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::~list,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>
|
Expand for full list:
EventHandler::isEmitInformationalEvent
TraceUtil::ProcessEventCallback
`TraceUtil::ProcessEventCallback'::__l1::dtor$0
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$0
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$1
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$10
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$2
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$3
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$4
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$6
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$7``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$8
``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$9
`autologgerProcessor::AutologgerProcessEventCallback'::__l1::dtor$0
`std::basic_stringstream,std::allocator_>::str'::__l1::dtor$1
autologgerProcessor::AutologgerProcessEventCallback
autologgerProcessor::initialize
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Clear_guard::~_Clear_guard
std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::_Unchecked_erase
std::_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>::~_List_node_emplace_op2,class_std::allocator_>,void*___ptr64>_>_>
std::filesystem::path::~path
std::list,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>::~list,class_std::allocator_>,class_std::allocator,class_std::allocator_>_>_>
| |paramcount|1|1| |`address`|18000e640|18000eb10| |sig|void __thiscall ~basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this)|void __thiscall ~basic_string,class_std::allocator_>(basic_string,class_std::allocator_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~basic_string,class_std::allocator_> Calling Diff ```diff --- std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_> calling +++ std::basic_string,class_std::allocator_>::~basic_string,class_std::allocator_> calling @@ -10 +9,0 @@ -``dynamic_initializer_for_'EventHandler::infoEventsToEmit'''::__l1::dtor$5 @@ -17,0 +17 @@ +autologgerProcessor::initialize @@ -20 +19,0 @@ -std::_Hash,class_std::allocator_>,class_std::_Uhash_compare,class_std::allocator_>,struct_std::hash,class_std::allocator_>_>,struct_std::equal_to,class_std::allocator_>_>_>,class_std::allocator,class_std::allocator_>_>,0>_>::emplace,class_std::allocator_>_const&___ptr64> @@ -21,0 +21 @@ +std::filesystem::path::~path ``` ## ReportUsageToService ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|7|8| |length|322|322| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect| |`calling`|wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled|wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|8|8| |`address`|180009b00|180009df8| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ## API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free ### Match Info |Key|hpm_8521.dll - hpm_8655.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|hpm_8521.dll|hpm_8655.dll| | :---: | :---: | :---: | |name|_o_free|_o_free| |fullname|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free|API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_free| |`refcount`|7|8| |length|0|0| |called||| |calling|TraceUtil::ProcessEventCallback
autologgerProcessor::cleanup
etwConsumer::cleanup|TraceUtil::ProcessEventCallback
autologgerProcessor::cleanup
etwConsumer::cleanup| |paramcount|0|0| |address|EXTERNAL:00000015|EXTERNAL:00000015| |sig|undefined _o_free(void)|undefined _o_free(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| Generated with `ghidriff` version: 1.0.0 on 2026-08-22T11:22:16