# http-8521.sys-http-8655.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_1508879674__private_IsEnabledFallback](#feature_1508879674__private_isenabledfallback) * [Feature_3936850235__private_IsEnabledFallback](#feature_3936850235__private_isenabledfallback) * [Modified](#modified) * [UxQuicErrorCodeFromHttpReceiveFault](#uxquicerrorcodefromhttpreceivefault) * [UxpPktMonFaultToDropStatus](#uxppktmonfaulttodropstatus) * [UxStartEnvironmentModule](#uxstartenvironmentmodule) * [UlpParseNextRequest](#ulpparsenextrequest) * [UxDuoFaultCodeFromHttpReceiveFault](#uxduofaultcodefromhttpreceivefault) * [UxReadHttp11ParserSettings](#uxreadhttp11parsersettings) * [UlParseRequestHeaderPairs](#ulparserequestheaderpairs) * [WPP_SF_qII](#wpp_sf_qii) * [Modified (No Code Changes)](#modified-no-code-changes) * [UxSslConnectionControl](#uxsslconnectioncontrol) * [WPP_SF_qLd](#wpp_sf_qld) * [NTOSKRNL.EXE::ExFreePoolWithTag](#ntoskrnlexeexfreepoolwithtag) * [NTOSKRNL.EXE::EtwWriteTransfer](#ntoskrnlexeetwwritetransfer) * [memmove](#memmove) * [WPP_SF_](#wpp_sf_) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [UxTlConnectionControl](#uxtlconnectioncontrol) * [UxReadBoundedULongSetting](#uxreadboundedulongsetting) * [NTOSKRNL.EXE::ExAllocatePool3](#ntoskrnlexeexallocatepool3) # Visual Chart Diff ```mermaid flowchart LR UxQuicErrorCodeFromHttpReceiveFault-0-old<--Match 80%-->UxQuicErrorCodeFromHttpReceiveFault-0-new UxpPktMonFaultToDropStatus-0-old<--Match 83%-->UxpPktMonFaultToDropStatus-0-new UxStartEnvironmentModule-0-old<--Match 88%-->UxStartEnvironmentModule-0-new UlpParseNextRequest-0-old<--Match 80%-->UlpParseNextRequest-0-new UxDuoFaultCodeFromHttpReceiveFault-0-old<--Match 81%-->UxDuoFaultCodeFromHttpReceiveFault-0-new UxReadHttp11ParserSettings-0-old<--Match 74%-->UxReadHttp11ParserSettings-0-new UlParseRequestHeaderPairs-0-old<--Match 8%-->UlParseRequestHeaderPairs-0-new WPP_SF_qII-0-old<--Match 21%-->UlpReferenceBuffers-0-new subgraph http-8655.sys UxQuicErrorCodeFromHttpReceiveFault-0-new UxpPktMonFaultToDropStatus-0-new UxStartEnvironmentModule-0-new UlpParseNextRequest-0-new UxDuoFaultCodeFromHttpReceiveFault-0-new UxReadHttp11ParserSettings-0-new UlParseRequestHeaderPairs-0-new UlpReferenceBuffers-0-new subgraph Added direction LR Feature_1508879674__private_IsEnabledFallback Feature_3936850235__private_IsEnabledFallback end end subgraph http-8521.sys UxQuicErrorCodeFromHttpReceiveFault-0-old UxpPktMonFaultToDropStatus-0-old UxStartEnvironmentModule-0-old UlpParseNextRequest-0-old UxDuoFaultCodeFromHttpReceiveFault-0-old UxReadHttp11ParserSettings-0-old UlParseRequestHeaderPairs-0-old WPP_SF_qII-0-old end ``` ```mermaid pie showData title Function Matches - 99.9797% "unmatched_funcs_len" : 2 "matched_funcs_len" : 9857 ``` ```mermaid pie showData title Matched Function Similarity - 99.7971% "matched_funcs_with_code_changes_len" : 8 "matched_funcs_with_non_code_changes_len" : 12 "matched_funcs_no_changes_len" : 9837 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name http-47291 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 http-8521.sys http-8655.sys ``` #### Verbose Args

``` --old ['http-8521.sys'] --new [['http-8655.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name http-47291 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/http.sys/9E11B9BB215000/http.sys -O http.sys.x64.10.0.26100.8521 wget https://msdl.microsoft.com/download/symbols/http.sys/AAF4A34E215000/http.sys -O http.sys.x64.10.0.26100.8655 ``` ## Binary Metadata Diff ```diff --- http-8521.sys Meta +++ http-8655.sys Meta @@ -1,44 +1,44 @@ -Program Name: http-8521.sys +Program Name: http-8655.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 2186600 +# of Bytes: 2186616 # of Memory Blocks: 17 -# of Instructions: 384525 -# of Defined Data: 10905 -# of Functions: 4927 -# of Symbols: 38547 +# of Instructions: 384665 +# of Defined Data: 10927 +# of Functions: 4932 +# of Symbols: 38577 # of Data Types: 300 # of Data Type Categories: 31 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 23:29:20 SGT 2026 +Date Created: Sat Aug 15 23:29:25 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/http-47291/http-8521.sys -Executable MD5: c926defc981a7acaa13f435428f452fc -Executable SHA256: 808491dc0a89fb5f7a9bade3d7ba680bd685e184fc3de610e047eba9c366a64f -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/http-47291/http-8521.sys?MD5=c926defc981a7acaa13f435428f452fc +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/http-47291/http-8655.sys +Executable MD5: d677738f8d07546ca9b875968c82d808 +Executable SHA256: 1a34d70a649f461745c782f1f27bcea6f6603aafd59842b3ed412181ac5c2c9a +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/http-47291/http-8655.sys?MD5=d677738f8d07546ca9b875968c82d808 PDB Age: 1 PDB File: http.pdb -PDB GUID: b8e3ea94-def7-c5b7-5afe-1c3c2a0df757 +PDB GUID: ef738c17-ed73-5d2f-3304-bde552c9b6f4 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: HTTP Protocol Stack -PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8655 (WinBuild.160101.0800) PE Property[InternalName]: http.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: http.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8521 +PE Property[ProductVersion]: 10.0.26100.8655 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra http-8521.sys Decompiler Options

Ghidra http-8521.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra http-8521.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|false| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra http-8655.sys Decompiler Options

Ghidra http-8655.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra http-8655.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|20| |added_symbols_len|19| |deleted_symbols_len|11| |diff_time|14.737483978271484| |deleted_strings_len|0| |added_strings_len|2| |match_types|Counter({'SymbolsHash': 4562, 'ExternalsName': 439, 'ExactInstructionsFunctionHasher': 257, 'StructuralGraphHash': 37, 'BSIM': 34, 'BulkInstructionHash': 25, 'ExactBytesFunctionHasher': 8, 'SigCallingCalledHasher': 5, 'Implied Match': 3, 'StrUniqueFuncRefsHasher': 2})| |items_to_process|52| |diff_types|Counter({'refcount': 14, 'address': 12, 'calling': 11, 'code': 8, 'length': 8, 'called': 4, 'name': 1, 'fullname': 1, 'sig': 1})| |unmatched_funcs_len|2| |total_funcs_len|9859| |matched_funcs_len|9857| |matched_funcs_with_code_changes_len|8| |matched_funcs_with_non_code_changes_len|12| |matched_funcs_no_changes_len|9837| |match_func_similarity_percent|99.7971%| |func_match_overall_percent|99.9797%| |first_matches|Counter({'SymbolsHash': 4562, 'ExactInstructionsFunctionHasher': 257, 'StructuralGraphHash': 37, 'BSIM': 34, 'BulkInstructionHash': 25, 'ExactBytesFunctionHasher': 8, 'SigCallingCalledHasher': 5, 'Implied Match': 3, 'StrUniqueFuncRefsHasher': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 4562 "ExternalsName" : 439 "ExactBytesFunctionHasher" : 8 "ExactInstructionsFunctionHasher" : 257 "BSIM" : 34 "BulkInstructionHash" : 25 "SigCallingCalledHasher" : 5 "StrUniqueFuncRefsHasher" : 2 "StructuralGraphHash" : 37 "Implied-Match" : 3 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 4562 "ExactBytesFunctionHasher" : 8 "ExactInstructionsFunctionHasher" : 257 "BSIM" : 34 "BulkInstructionHash" : 25 "SigCallingCalledHasher" : 5 "StrUniqueFuncRefsHasher" : 2 "StructuralGraphHash" : 37 "Implied-Match" : 3 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 20 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 19 "deleted_symbols_len" : 11 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 2 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,2 @@ +s_Timer_ReceiveTimeout +u_MaxHeadersCount ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_Timer_ReceiveTimeout|1|UlSendSimpleStatus| |u_MaxHeadersCount|1|UxReadHttp11ParserSettings| # Deleted # Added ## Feature_1508879674__private_IsEnabledFallback ### Function Meta |Key|http-8655.sys| | :---: | :---: | |name|Feature_1508879674__private_IsEnabledFallback| |fullname|Feature_1508879674__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_1508879674__private_IsEnabledDeviceUsageNoInline| |paramcount|0| |address|1400bb09c| |sig|undefined Feature_1508879674__private_IsEnabledFallback(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1508879674__private_IsEnabledFallback +++ Feature_1508879674__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_1508879674__private_IsEnabledFallback(undefined8 param_1,undefined8 param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_1508879674__private_descriptor); + return; +} + ``` ## Feature_3936850235__private_IsEnabledFallback ### Function Meta |Key|http-8655.sys| | :---: | :---: | |name|Feature_3936850235__private_IsEnabledFallback| |fullname|Feature_3936850235__private_IsEnabledFallback| |refcount|2| |length|21| |called|wil_details_IsEnabledFallback| |calling|Feature_3936850235__private_IsEnabledDeviceUsageNoInline| |paramcount|0| |address|1400bb0f0| |sig|undefined Feature_3936850235__private_IsEnabledFallback(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_3936850235__private_IsEnabledFallback +++ Feature_3936850235__private_IsEnabledFallback @@ -0,0 +1,8 @@ + +void Feature_3936850235__private_IsEnabledFallback(undefined8 param_1,undefined8 param_2) + +{ + wil_details_IsEnabledFallback(param_1,param_2,&Feature_3936850235__private_descriptor); + return; +} + ``` # Modified *Modified functions contain code changes* ## UxQuicErrorCodeFromHttpReceiveFault ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.5| |i_ratio|0.48| |m_ratio|0.95| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxQuicErrorCodeFromHttpReceiveFault|UxQuicErrorCodeFromHttpReceiveFault| |fullname|UxQuicErrorCodeFromHttpReceiveFault|UxQuicErrorCodeFromHttpReceiveFault| |refcount|2|2| |`length`|211|237| |called||| |calling|UxQuicStreamConnectionControl|UxQuicStreamConnectionControl| |paramcount|0|0| |`address`|1400fe03c|1400fe29c| |sig|undefined UxQuicErrorCodeFromHttpReceiveFault(void)|undefined UxQuicErrorCodeFromHttpReceiveFault(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxQuicErrorCodeFromHttpReceiveFault Diff ```diff --- UxQuicErrorCodeFromHttpReceiveFault +++ UxQuicErrorCodeFromHttpReceiveFault @@ -1,68 +1,75 @@ -undefined4 UxQuicErrorCodeFromHttpReceiveFault(int param_1) +int UxQuicErrorCodeFromHttpReceiveFault(int param_1) { - if (param_1 < 10) { - if (param_1 == 9) { - return 0x50; + if (param_1 < 0xb) { + if (param_1 == 10) { + return 0x51; } - if (param_1 == 0) { - return 0; + if (param_1 < 6) { + if (param_1 == 5) { + return 0x4c; + } + if (param_1 == 0) { + return 0; + } + if (param_1 == 1) { + return 0x48; + } + if (param_1 == 2) { + return 0x49; + } + if (param_1 == 3) { + return 0x4a; + } + if (param_1 == 4) { + return 0x4b; + } } - if (param_1 == 1) { - return 0x48; - } - if (param_1 == 2) { - return 0x49; - } - if (param_1 == 3) { - return 0x4a; - } - if (param_1 == 4) { - return 0x4b; - } - if (param_1 == 5) { - return 0x4c; - } - if (param_1 == 6) { - return 0x4d; - } - if (param_1 == 7) { - return 0x4e; - } - if (param_1 == 8) { - return 0x4f; + else { + if (param_1 == 6) { + return 0x4d; + } + if (param_1 == 7) { + return 0x4e; + } + if (param_1 == 8) { + return 0x4f; + } + if (param_1 == 9) { + return 0x50; + } } } else { - if (param_1 == 10) { - return 0x51; - } if (param_1 == 0xb) { return 0x52; } if (param_1 == 0xc) { return 0x53; } if (param_1 == 0xd) { return 0x54; } if (param_1 == 0xe) { return 0x55; } if (param_1 == 0xf) { return 0x56; } if (param_1 == 0x10) { return 0x57; } if (param_1 == 0x11) { return 0x58; } if (param_1 == 0x13) { return 0x59; } + if (param_1 == 0x14) { + return (-(uint)(UxKirMaxHeadersCountLimit != '\0') & 0xffffffdf) + 0x5a; + } } return 0x5a; } ``` ## UxpPktMonFaultToDropStatus ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.5| |i_ratio|0.49| |m_ratio|0.95| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxpPktMonFaultToDropStatus|UxpPktMonFaultToDropStatus| |fullname|UxpPktMonFaultToDropStatus|UxpPktMonFaultToDropStatus| |refcount|2|2| |`length`|213|244| |called||| |calling|UxPktMonTraceDropHttpReceiveWithFault|UxPktMonTraceDropHttpReceiveWithFault| |paramcount|0|0| |`address`|14014c4f8|14014c778| |sig|undefined UxpPktMonFaultToDropStatus(void)|undefined UxpPktMonFaultToDropStatus(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxpPktMonFaultToDropStatus Diff ```diff --- UxpPktMonFaultToDropStatus +++ UxpPktMonFaultToDropStatus @@ -1,68 +1,75 @@ -undefined8 UxpPktMonFaultToDropStatus(int param_1) +uint UxpPktMonFaultToDropStatus(int param_1) { - if (param_1 < 10) { - if (param_1 == 9) { - return 0xd74; + if (param_1 < 0xb) { + if (param_1 == 10) { + return 0xd7f; } - if (param_1 == 0) { - return 0xd48; + if (param_1 < 6) { + if (param_1 == 5) { + return 0xd4e; + } + if (param_1 == 0) { + return 0xd48; + } + if (param_1 == 1) { + return 0xd55; + } + if (param_1 == 2) { + return 0xd72; + } + if (param_1 == 3) { + return 0xd73; + } + if (param_1 == 4) { + return 0xd4c; + } } - if (param_1 == 1) { - return 0xd55; - } - if (param_1 == 2) { - return 0xd72; - } - if (param_1 == 3) { - return 0xd73; - } - if (param_1 == 4) { - return 0xd4c; - } - if (param_1 == 5) { - return 0xd4e; - } - if (param_1 == 6) { - return 0xd50; - } - if (param_1 == 7) { - return 0xd5a; - } - if (param_1 == 8) { - return 0xd52; + else { + if (param_1 == 6) { + return 0xd50; + } + if (param_1 == 7) { + return 0xd5a; + } + if (param_1 == 8) { + return 0xd52; + } + if (param_1 == 9) { + return 0xd74; + } } } else { - if (param_1 == 10) { - return 0xd7f; - } if (param_1 == 0xb) { return 0xd7d; } if (param_1 == 0xc) { return 0xd81; } if (param_1 == 0xd) { return 0xd79; } if (param_1 == 0xe) { return 0xd78; } if (param_1 == 0xf) { return 0xd4d; } if (param_1 == 0x10) { return 0xd6c; } if (param_1 == 0x11) { return 0xd76; } if (param_1 == 0x13) { return 0xd6e; } + if (param_1 == 0x14) { + return -(uint)(UxKirMaxHeadersCountLimit != '\0') & 0xd71; + } } return 0; } ``` ## UxStartEnvironmentModule ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.91| |i_ratio|0.52| |m_ratio|0.97| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxStartEnvironmentModule|UxStartEnvironmentModule| |fullname|UxStartEnvironmentModule|UxStartEnvironmentModule| |refcount|3|3| |`length`|1851|1945| |`called`|

Expand for full list:
Feature_1164959034__private_IsEnabledDeviceUsageNoInline
Feature_1255102777__private_IsEnabledDeviceUsageNoInline
Feature_1282877755__private_IsEnabledDeviceUsageNoInline
Feature_DtHttpIsbLimitHttp2__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix2605__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix26Q1__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix26Q2__private_IsEnabledDeviceUsageNoInline
Feature_HttpQueryTcpTtlRedux__private_IsEnabledDeviceUsageNoInline
Feature_HttpTlsHandshakePerfCounter__private_IsEnabledDeviceUsageNoInline
Feature_HttpsysHKERangeRequestH2StatusCode__private_IsEnabledDeviceUsageNoInline
Feature_MsQuic_2_5__private_IsEnabledDeviceUsageNoInline

Feature_NewUMAHttpSys__private_IsEnabledDeviceUsageNoInline
Feature_RefactorIoctls__private_IsEnabledDeviceUsageNoInline
HAL.DLL::KeQueryPerformanceCounter
HttpCmnInitializeStaticHttpCharsTable
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeQueryHighestNodeNumber
NTOSKRNL.EXE::KeQueryMaximumProcessorCountEx
NTOSKRNL.EXE::RtlGetVersion
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenKey
UlReadGenericParameter
UlReadLongLongParameter
UxGetPhysicalMemorySize
UxOpenNamedEvent
UxReadBooleanSetting
UxReadBoundedULongSetting
UxStopEnvironmentModule
WPP_SF_
__security_check_cookie
memset
wil_InitializeFeatureStaging

Expand for full list:
Feature_1164959034__private_IsEnabledDeviceUsageNoInline
Feature_1255102777__private_IsEnabledDeviceUsageNoInline
Feature_1282877755__private_IsEnabledDeviceUsageNoInline
Feature_1508879674__private_IsEnabledDeviceUsageNoInline
Feature_3936850235__private_IsEnabledDeviceUsageNoInline
Feature_DtHttpIsbLimitHttp2__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix2605__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix26Q1__private_IsEnabledDeviceUsageNoInline
Feature_HttpBugFix26Q2__private_IsEnabledDeviceUsageNoInline
Feature_HttpQueryTcpTtlRedux__private_IsEnabledDeviceUsageNoInline
Feature_HttpTlsHandshakePerfCounter__private_IsEnabledDeviceUsageNoInline

Feature_HttpsysHKERangeRequestH2StatusCode__private_IsEnabledDeviceUsageNoInline
Feature_MsQuic_2_5__private_IsEnabledDeviceUsageNoInline
Feature_NewUMAHttpSys__private_IsEnabledDeviceUsageNoInline
Feature_RefactorIoctls__private_IsEnabledDeviceUsageNoInline
HAL.DLL::KeQueryPerformanceCounter
HttpCmnInitializeStaticHttpCharsTable
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::IoGetCurrentProcess
NTOSKRNL.EXE::KeQueryHighestNodeNumber
NTOSKRNL.EXE::KeQueryMaximumProcessorCountEx
NTOSKRNL.EXE::RtlGetVersion
NTOSKRNL.EXE::ZwClose
NTOSKRNL.EXE::ZwOpenKey
UlReadGenericParameter
UlReadLongLongParameter
UxGetPhysicalMemorySize
UxOpenNamedEvent
UxReadBooleanSetting
UxReadBoundedULongSetting
UxStopEnvironmentModule
WPP_SF_
__security_check_cookie
memset
wil_InitializeFeatureStaging

| |calling||| |paramcount|0|0| |`address`|1400bc5e0|1400bc7e0| |sig|undefined UxStartEnvironmentModule(void)|undefined UxStartEnvironmentModule(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxStartEnvironmentModule Called Diff ```diff --- UxStartEnvironmentModule called +++ UxStartEnvironmentModule called @@ -3,0 +4,2 @@ +Feature_1508879674__private_IsEnabledDeviceUsageNoInline +Feature_3936850235__private_IsEnabledDeviceUsageNoInline ``` ### UxStartEnvironmentModule Diff ```diff --- UxStartEnvironmentModule +++ UxStartEnvironmentModule @@ -1,207 +1,217 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Type propagation algorithm not settling */ int UxStartEnvironmentModule(void) { byte bVar1; short sVar2; int iVar3; longlong lVar4; longlong lVar5; undefined1 auStack_1e8 [32]; undefined4 local_1c8; undefined4 local_1c0; uint *local_1b8; char local_1a8 [8]; longlong local_1a0; uint local_198 [2]; longlong local_190 [2]; wchar_t *local_180; undefined8 local_178; undefined8 uStack_170; longlong *local_168; undefined8 uStack_160; undefined8 local_158; undefined8 uStack_150; undefined4 local_148 [70]; char local_2e; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStack_1e8; memset(local_148,0,0x11c); local_190[1] = 0x880086; local_1a0 = 0; local_198[0] = 0; local_180 = L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Http\\Parameters"; lVar4 = 0; local_190[0] = 0; local_158 = 0; uStack_150 = (ulonglong)uStack_150._4_4_ << 0x20; local_178 = 0; uStack_170 = 0; local_1a8[0] = '\0'; local_168 = (longlong *)0x0; uStack_160 = 0; iVar3 = wil_InitializeFeatureStaging(); lVar5 = 0; if (-1 < iVar3) { UxFeatureStagingInitialized = 1; iVar3 = Feature_HttpQueryTcpTtlRedux__private_IsEnabledDeviceUsageNoInline(); UxKirBrHttpQuerySocketTtl = iVar3 != 0; iVar3 = Feature_DtHttpIsbLimitHttp2__private_IsEnabledDeviceUsageNoInline(); UxKirDtHttp2IsbLimit = iVar3 != 0; iVar3 = Feature_RefactorIoctls__private_IsEnabledDeviceUsageNoInline(); UxKirRefactorIoctls = iVar3 != 0; iVar3 = Feature_MsQuic_2_5__private_IsEnabledDeviceUsageNoInline(); UxKirMsQuic_2_5 = iVar3 != 0; iVar3 = Feature_HttpBugFix26Q1__private_IsEnabledDeviceUsageNoInline(); UxKirHttpBugFix26Q1 = iVar3 != 0; iVar3 = Feature_HttpsysHKERangeRequestH2StatusCode__private_IsEnabledDeviceUsageNoInline(); UxKirHKERangeRequestH2StatusCode = iVar3 != 0; iVar3 = Feature_1255102777__private_IsEnabledDeviceUsageNoInline(); UxKirWritingAndReadingUm = iVar3 != 0; iVar3 = Feature_1282877755__private_IsEnabledDeviceUsageNoInline(); UxKirWritingAndReadingUmCertList = iVar3 != 0; iVar3 = Feature_HttpTlsHandshakePerfCounter__private_IsEnabledDeviceUsageNoInline(); UxKirHttpTlsHandshakePerfCounter = iVar3 != 0; iVar3 = Feature_NewUMAHttpSys__private_IsEnabledDeviceUsageNoInline(); UxKirNewUma = iVar3 != 0; iVar3 = Feature_HttpBugFix26Q2__private_IsEnabledDeviceUsageNoInline(); UxKirHttpBugFix26Q2 = iVar3 != 0; iVar3 = Feature_1164959034__private_IsEnabledDeviceUsageNoInline(); UxKirQuicParseLengthCheck = iVar3 != 0; iVar3 = Feature_HttpBugFix2605__private_IsEnabledDeviceUsageNoInline(); UxKirHttpBugFix2605 = iVar3 != 0; + iVar3 = Feature_1508879674__private_IsEnabledDeviceUsageNoInline(); + UxKirRefBufferOverflowCheck = iVar3 != 0; + iVar3 = Feature_3936850235__private_IsEnabledDeviceUsageNoInline(); + UxKirMaxHeadersCountLimit = iVar3 != 0; if ((UxKirDtHttp2IsbLimit != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,10,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,10,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirBrHttpQuerySocketTtl != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0xb,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0xb,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirRefactorIoctls != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0xc,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0xc,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirMsQuic_2_5 != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0xd,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0xd,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirHKERangeRequestH2StatusCode != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0xe,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0xe,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirHttpBugFix26Q1 != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0xf,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0xf,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirWritingAndReadingUm != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x10,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x10,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirWritingAndReadingUmCertList != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x11,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x11,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirHttpTlsHandshakePerfCounter != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x12,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x12,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirNewUma != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x13,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x13,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirHttpBugFix26Q2 != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x14,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x14,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirQuicParseLengthCheck != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x15,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x15,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } if ((UxKirHttpBugFix2605 != '\0') && ((DAT_0 & 2) != 0)) { - WPP_SF_(0x419,0x16,&WPP_405880696d1532e338378168465d292f_Traceguids); + WPP_SF_(0x419,0x16,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); + } + if ((UxKirRefBufferOverflowCheck != '\0') && ((DAT_0 & 2) != 0)) { + WPP_SF_(0x419,0x17,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); + } + if ((UxKirMaxHeadersCountLimit != '\0') && ((DAT_0 & 2) != 0)) { + WPP_SF_(0x419,0x18,&WPP_4651bd5260cd3dbeaf1c860d7aeb4448_Traceguids); } UxNumberOfProcessors = 0; UxMaximumNumberOfProcessors = KeQueryMaximumProcessorCountEx(0xffff); sVar2 = KeQueryHighestNodeNumber(); UxNumberOfNodes = sVar2 + 1; iVar3 = UxGetPhysicalMemorySize(&UxTotalPhysicalMemMB); lVar5 = lVar4; if ((((-1 < iVar3) && (iVar3 = UxOpenNamedEvent(L"\\KernelObjects\\LowNonPagedPoolCondition", &UxLowNonPagedPoolEvent), -1 < iVar3)) && (iVar3 = UxOpenNamedEvent(L"\\KernelObjects\\HighNonPagedPoolCondition", &UxHighNonPagedPoolEvent), -1 < iVar3)) && (iVar3 = UxOpenNamedEvent(L"\\KernelObjects\\LowMemoryCondition",&UxLowMemoryEvent), -1 < iVar3)) { local_148[0] = 0x11c; iVar3 = RtlGetVersion(local_148); if (-1 < iVar3) { UxServerSystem = (byte)(local_2e - 2U) < 2; UxSystemProcess = IoGetCurrentProcess(); HttpCmnInitializeStaticHttpCharsTable(); local_168 = local_190 + 1; local_178 = CONCAT44(local_178._4_4_,0x30); uStack_170 = 0; uStack_160 = CONCAT44(uStack_160._4_4_,0x240); local_158 = 0; uStack_150 = 0; iVar3 = ZwOpenKey(&local_1a0,0x20019,&local_178); if (iVar3 < 0) { local_1a0 = 0; iVar3 = 0; } UxReadBooleanSetting(local_1a0,L"CompactMode",0,&UxCompactMode); UxReadBooleanSetting(local_1a0,L"EnableIrqlEnforcement",0,&UxEnableIrqlEnforcement); UxReadBooleanSetting(local_1a0,L"SendEndpointInfoToAsc",0,&UxSendEndpointInfoToASC); UxReadBooleanSetting(local_1a0,L"TlsUseStaticServerHello",0,&UxTlsUseStaticServerHello); local_1b8 = &UxAscThrottleLimit; local_1c0 = 0; local_1c8 = 0x7fffffff; UxReadBoundedULongSetting(local_1a0,L"AscThrottleLimit",0,0); UxReadBooleanSetting(local_1a0,L"EnableSslLargeBuffer",1,&UxSslLargeBufferEnabled); local_1b8 = &UxRssEnabledCheckControl; local_1c0 = 0; local_1c8 = 2; UxReadBoundedULongSetting(local_1a0,L"RssStatusCheckControl",1,0); UxReadBooleanSetting(local_1a0,L"EnableHttp3",0,&UxHttp3ServerEnabled); UxReadBooleanSetting(local_1a0,L"EnableHttp3Push",0,&UxHttp3PushEnabled); UxReadBooleanSetting(local_1a0,L"EnableExtendedEvents",0,&UxExtendedEventsEnabled); local_1b8 = local_198; local_1c0 = 0; local_1c8 = 0x7fffffff; UxReadBoundedULongSetting(local_1a0,L"ExtendedEventsFrequency",0xe10,0xf); UxExtendedEventsFrequency = (ulonglong)local_198[0] * 10000000; UxReadBooleanSetting(local_1a0,L"EnableAltSvc",0,&UxAltSvcEnabled); if (UxTelAssertInitialized == '\0') { UxTelAssertsEnabled = 0; } else { UxReadBooleanSetting(local_1a0,L"EnableTelAsserts",0,&UxTelAssertsEnabled); } UlReadGenericParameter(local_1a0,L"Http3Alpn",local_190); lVar5 = local_190[0]; if ((local_190[0] != 0) && (*(int *)(local_190[0] + 4) == 7)) { UxHttp3AlpnRegValue = local_190[0]; lVar5 = 0; } UxReadBooleanSetting (local_1a0,L"AllowNonprivilegedCaptureCred",0,&UxAllowNonprivilegedCaptureCred); bVar1 = UlReadLongLongParameter(local_1a0,L"DebugFlags",0); local_190[0] = 0; UxDebugCheckRefcount = bVar1 & 1; UxDebugDisableLookaside = bVar1 >> 1 & 1; KeQueryPerformanceCounter(local_190); UxPerformanceCounterPeriod = local_190[0]; UxReadBooleanSetting(local_1a0,L"DisableMultipleLanes",0,local_1a8); if (local_1a8[0] != '\0') { UxNumberOfNodes = 1; } } } } if (local_1a0 != 0) { ZwClose(); local_1a0 = 0; } if (lVar5 != 0) { ExFreePoolWithTag(lVar5,0); } if (iVar3 < 0) { UxStopEnvironmentModule(); } return iVar3; } ``` ## UlpParseNextRequest ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,refcount,length,called| |ratio|0.61| |i_ratio|0.66| |m_ratio|0.96| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UlpParseNextRequest|UlpParseNextRequest| |fullname|UlpParseNextRequest|UlpParseNextRequest| |`refcount`|5|7| |`length`|4118|3826| |`called`|

Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
McTemplateK0pqz_EtwWriteTransfer
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeGetCurrentNodeNumber
NTOSKRNL.EXE::KeQuerySystemTimePrecise
NTOSKRNL.EXE::KeReleaseSpinLock
UlBugCheckEx
UlCheckProtocolCompliance

UlCleanupHttpConnection
UlConsumeBytesFromConnection
UlDeliverEntityBody
UlEtwEvaluateFilterForRequestConnection
UlParseHttp
UlReleaseRequestBuffer
UlSetBundleTimerEx
UlSetErrorCode
UlpAdjustBuffers
UlpCloseDisconnectedConnection
UlpCreateHttpRequest
UlpDeliverHttpRequest
UxPktMonTraceDropHttpReceiveWithError
UxpPktMonTraceHttpSuccessInternal
WPP_SF_
WPP_SF_D
WPP_SF_I
WPP_SF_qI
WPP_SF_qII
WPP_SF_qL
WPP_SF_qLLL
WPP_SF_qLLLd
WPP_SF_qLS
WPP_SF_qLd
WPP_SF_qLdIId
WPP_SF_qqIL
WPP_SF_qqLI
WPP_SF_qqLq
WPP_SF_qqqI
WPP_SF_qqs
__security_check_cookie
memmove

Expand for full list:
HAL.DLL::KeQueryPerformanceCounter
McTemplateK0pqz_EtwWriteTransfer
NTOSKRNL.EXE::EtwWriteTransfer
NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc
NTOSKRNL.EXE::KeGetCurrentNodeNumber
NTOSKRNL.EXE::KeQuerySystemTimePrecise
NTOSKRNL.EXE::KeReleaseSpinLock
UlCheckProtocolCompliance
UlCleanupHttpConnection
UlConsumeBytesFromConnection
UlDeliverEntityBody

UlEtwEvaluateFilterForRequestConnection
UlParseHttp
UlReleaseRequestBuffer
UlSetBundleTimerEx
UlSetErrorCode
UlpAdjustBuffers
UlpCloseDisconnectedConnection
UlpCreateHttpRequest
UlpDeliverHttpRequest
UlpReferenceBuffers
UxPktMonTraceDropHttpReceiveWithError
UxpPktMonTraceHttpSuccessInternal
WPP_SF_
WPP_SF_D
WPP_SF_I
WPP_SF_qI
WPP_SF_qL
WPP_SF_qLLL
WPP_SF_qLLLd
WPP_SF_qLS
WPP_SF_qLd
WPP_SF_qLdIId
WPP_SF_qqIL
WPP_SF_qqLI
WPP_SF_qqLq
WPP_SF_qqqI
WPP_SF_qqs
__security_check_cookie

| |calling|UlBeginOpaqueMode
UlResumeParsing
UlpAuthenticateRequestCompletion
UlpHandleRequest|UlBeginOpaqueMode
UlResumeParsing
UlpAuthenticateRequestCompletion
UlpHandleRequest| |paramcount|0|0| |address|140029c20|140029c20| |sig|undefined UlpParseNextRequest(void)|undefined UlpParseNextRequest(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlpParseNextRequest Called Diff ```diff --- UlpParseNextRequest called +++ UlpParseNextRequest called @@ -4,2 +3,0 @@ -NTOSKRNL.EXE::ExAllocatePool3 -NTOSKRNL.EXE::ExFreePoolWithTag @@ -10 +7,0 @@ -UlBugCheckEx @@ -23,0 +21 @@ +UlpReferenceBuffers @@ -30 +27,0 @@ -WPP_SF_qII @@ -43 +39,0 @@ -memmove ``` ### UlpParseNextRequest Diff ```diff --- UlpParseNextRequest +++ UlpParseNextRequest @@ -1,611 +1,557 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ int * UlpParseNextRequest(int *param_1,byte param_2,undefined *param_3) { - undefined **ppuVar1; - undefined **ppuVar2; + longlong *plVar1; + longlong *plVar2; undefined1 uVar3; char cVar4; ushort uVar5; uint uVar6; - uint uVar7; - int iVar8; - void *_Dst; + int iVar7; + uint uVar8; undefined8 uVar9; ulonglong uVar10; longlong lVar11; longlong lVar12; int iVar13; ulonglong uVar14; int *piVar15; int *piVar16; int *piVar17; - longlong *plVar18; - int *piVar19; + int *piVar18; undefined4 extraout_XMM0_Da; undefined4 extraout_XMM0_Da_00; - undefined4 uVar20; + undefined4 uVar19; undefined1 auStack_108 [32]; undefined8 local_e8; undefined8 local_e0; undefined *local_d8; undefined8 local_d0; int local_c8; char local_b8; uint local_b4; - uint local_b0; - byte local_ac; + byte local_b0; + uint local_ac; int local_a8 [2]; longlong local_a0; - undefined4 local_98 [2]; - undefined *local_90; - undefined8 local_88; + undefined4 local_98 [4]; + undefined *local_88; undefined8 local_80; - undefined4 local_78; - undefined4 uStack_74; - undefined4 uStack_70; + undefined8 local_78; + undefined4 local_70; undefined4 uStack_6c; - undefined *local_68; - undefined8 local_60; - undefined4 *local_58; - undefined8 local_50; - ulonglong local_48; + undefined4 uStack_68; + undefined4 uStack_64; + undefined *local_60; + undefined8 local_58; + undefined4 *local_50; + undefined8 local_48; + ulonglong local_40; - local_48 = __security_cookie ^ (ulonglong)auStack_108; + local_40 = __security_cookie ^ (ulonglong)auStack_108; local_a0 = *(longlong *)(param_1 + 0x112); - piVar19 = (int *)0x0; - cVar4 = '\0'; + piVar18 = (int *)0x0; local_b8 = '\0'; - local_b0 = 0; + local_b4 = 0; local_a8[0] = 0; - local_ac = param_2; - local_90 = param_3; + local_b0 = param_2; + local_88 = param_3; if ((DAT_0 & 0x40) != 0) { local_e0 = (char *)CONCAT44(local_e0._4_4_,(uint)param_2); local_e8 = *(int **)(param_1 + 0xc); local_d8 = param_3; - WPP_SF_qqLq(0x40e,0x65,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,param_1); + WPP_SF_qqLq(0x40e,0x66,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1); } if ((DAT_1 & 1) != 0) { - WPP_SF_I(0x508,0x66,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,param_1); + WPP_SF_I(0x508,0x67,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1); } - lVar11 = *(longlong *)(param_1 + 0x8e); - if (((lVar11 == 0) || ((param_1[0x9e] & 4U) == 0)) || - (iVar8 = *(int *)(lVar11 + 0x1f0), iVar8 - 8U < 2)) { + plVar2 = (longlong *)(param_1 + 0x8e); + if (((*plVar2 == 0) || ((param_1[0x9e] & 4U) == 0)) || + (iVar7 = *(int *)(*plVar2 + 0x1f0), iVar7 - 8U < 2)) { uVar6 = UlpAdjustBuffers(param_1); - piVar17 = piVar19; + piVar17 = piVar18; + cVar4 = '\0'; while (piVar15 = piVar17, -1 < (int)uVar6) { - plVar18 = (longlong *)(param_1 + 0x8e); - uVar6 = *(int *)(*(longlong *)(param_1 + 0x96) + 0x80) - - *(int *)(*(longlong *)(param_1 + 0x96) + 0x88); - local_b4 = uVar6; - if (*plVar18 == 0) { - uVar7 = UlpCreateHttpRequest(param_1,plVar18); + local_ac = *(int *)(*(longlong *)(param_1 + 0x96) + 0x80) - + *(int *)(*(longlong *)(param_1 + 0x96) + 0x88); + if (*plVar2 == 0) { + uVar6 = UlpCreateHttpRequest(param_1,plVar2); cVar4 = DAT_2; - piVar16 = (int *)(ulonglong)uVar7; - if ((int)uVar7 < 0) goto LAB_3; + piVar16 = (int *)(ulonglong)uVar6; + if ((int)uVar6 < 0) goto LAB_3; if ((char)DAT_4 < '\0') { - WPP_SF_D(0x417,0x26,&WPP_8ae041072d853f88e11e59270b140751_Traceguids,DAT_2); + WPP_SF_D(0x417,0x26,&WPP_c6301bacd5d235d972b6a97d23dddc30_Traceguids,DAT_2); } if (cVar4 != '\0') { - iVar8 = 0; + iVar7 = 0; if (DAT_5 != '\0') { - lVar11 = *(longlong *)(*plVar18 + 0x18); + lVar11 = *(longlong *)(*plVar2 + 0x18); local_e0 = (char *)CONCAT71(local_e0._1_7_,1); local_e8 = (int *)CONCAT71(local_e8._1_7_,1); - iVar8 = UxpPktMonTraceHttpSuccessInternal - (*plVar18,lVar11 + 0x180,lVar11 + 0x19c, - *(undefined1 *)(lVar11 + 0x1e0)); + iVar7 = UxpPktMonTraceHttpSuccessInternal + (*plVar2,lVar11 + 0x180,lVar11 + 0x19c,*(undefined1 *)(lVar11 + 0x1e0) + ); } if ((DAT_6 & 2) != 0) { - WPP_SF_D(0x419,0x27,&WPP_8ae041072d853f88e11e59270b140751_Traceguids,iVar8); + WPP_SF_D(0x419,0x27,&WPP_c6301bacd5d235d972b6a97d23dddc30_Traceguids,iVar7); } } if ((DAT_0 & 1) != 0) { local_e8 = param_1; - WPP_SF_qI(0x408,0x67,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,*plVar18); - } - KeQuerySystemTimePrecise(*plVar18 + 0x890); + WPP_SF_qI(0x408,0x68,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,*plVar2); + } + KeQuerySystemTimePrecise(*plVar2 + 0x890); uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xa0); piVar15 = param_1 + 0xa2; if (((char)param_1[0xbb] != '\0') && ((param_1[0xba] & 1U) != 0)) { if ((DAT_4 & 8) != 0) { local_e0 = (char *)((ulonglong)local_e0 & 0xffffffff00000000); local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar15); WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar15); } param_1[0xad] = 0; } UlSetBundleTimerEx(piVar15,1,0,1); param_1[0x116] = param_1[0x116] + 1; param_1[0x55] = param_1[0x55] + 1; KeReleaseSpinLock(param_1 + 0xa0,uVar3); } - plVar18 = (longlong *)(param_1 + 0x8e); - iVar8 = ((int *)*plVar18)[0x7c]; + uVar6 = local_ac; + iVar7 = ((int *)*plVar2)[0x7c]; if ((DAT_0 & 0x40) != 0) { local_d8 = *(undefined **)(*(longlong *)(param_1 + 0x96) + 0x90); - local_e0 = (char *)CONCAT44(local_e0._4_4_,iVar8); - local_e8 = (int *)*plVar18; + local_e0 = (char *)CONCAT44(local_e0._4_4_,iVar7); + local_e8 = (int *)*plVar2; WPP_SF_qqLI(); } - piVar15 = (int *)*plVar18; + piVar15 = (int *)*plVar2; iVar13 = piVar15[0x7c]; if (10 < iVar13 - 1U) { -switchD_140029fd4_caseD_5: +switchD_140029fe1_caseD_5: piVar15 = piVar17; piVar16 = (int *)0xc0000184; goto LAB_3; } switch(iVar13) { default: local_e8 = local_a8; - uVar7 = UlParseHttp(piVar15,(ulonglong)*(uint *)(*(longlong *)(param_1 + 0x96) + 0x88) + + uVar8 = UlParseHttp(piVar15,(ulonglong)*(uint *)(*(longlong *)(param_1 + 0x96) + 0x88) + *(longlong *)(*(longlong *)(param_1 + 0x96) + 0xa0),uVar6, - &local_b0); - piVar16 = (int *)(ulonglong)uVar7; + &local_b4); + piVar16 = (int *)(ulonglong)uVar8; if ((DAT_1 & 0x40) != 0) { - local_d0 = CONCAT44(local_d0._4_4_,uVar7); - local_d8 = (undefined *)CONCAT44(local_d8._4_4_,local_b0); - local_e0 = (char *)CONCAT44(local_e0._4_4_,*(undefined4 *)(*plVar18 + 0x1f0)); - local_e8 = (int *)CONCAT44(local_e8._4_4_,iVar8); - WPP_SF_qLLLd(0x50e,0x69,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); - } - if (uVar6 < local_b0) { + local_d0 = CONCAT44(local_d0._4_4_,uVar8); + local_d8 = (undefined *)CONCAT44(local_d8._4_4_,local_b4); + local_e0 = (char *)CONCAT44(local_e0._4_4_,*(undefined4 *)(*plVar2 + 0x1f0)); + local_e8 = (int *)CONCAT44(local_e8._4_4_,iVar7); + WPP_SF_qLLLd(0x50e,0x6a,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); + } + if (uVar6 < local_b4) { LAB_7: piVar16 = (int *)0xc0000095; goto LAB_3; } *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) = - *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) + local_b0; - *(ulonglong *)(piVar15 + 0x222) = *(longlong *)(piVar15 + 0x222) + (ulonglong)local_b0; - local_b4 = uVar6 - local_b0; + *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) + local_b4; + *(ulonglong *)(piVar15 + 0x222) = *(longlong *)(piVar15 + 0x222) + (ulonglong)local_b4; + iVar7 = uVar6 - local_b4; lVar11 = local_a0; - if (local_b0 != 0) { + if (local_b4 != 0) { if (*(longlong *)(piVar15 + 0x22e) == 0) { *(undefined8 *)(piVar15 + 0x22e) = *(undefined8 *)(param_1 + 0x96); } - cVar4 = '\0'; *(undefined8 *)(piVar15 + 0x230) = *(undefined8 *)(param_1 + 0x96); - ppuVar2 = *(undefined ***)(param_1 + 0x96); - if ((DAT_0 & 1) != 0) { - local_e8 = *(int **)(piVar15 + 0x10); - local_e0 = (char *)ppuVar2; - WPP_SF_qII(0x408,0x10b,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); - } - if (*(ushort *)((longlong)piVar15 + 0x642) < *(ushort *)(piVar15 + 400)) { -LAB_8: - ppuVar1 = ppuVar2 + 4; - *(undefined ***) - (*(longlong *)(piVar15 + 0x192) + (ulonglong)*(ushort *)((longlong)piVar15 + 0x642) * 8 - ) = ppuVar2; - *(short *)((longlong)piVar15 + 0x642) = *(short *)((longlong)piVar15 + 0x642) + 1; - LOCK(); - iVar8 = *(int *)ppuVar1; - *(int *)ppuVar1 = *(int *)ppuVar1 + 1; - UNLOCK(); - if ((UxDebugCheckRefcount != '\0') && (iVar8 + 1 < 0)) { - /* WARNING: Subroutine does not return */ - UlBugCheckEx(3,ppuVar1,10,(longlong)(iVar8 + 1)); - } - cVar4 = '\x01'; - } - else { - local_e8 = (int *)CONCAT44(local_e8._4_4_,1); - _Dst = (void *)ExAllocatePool3(0x42,(ulonglong)*(ushort *)(piVar15 + 400) * 8 + 0x28, - 0x52526c55,&UxLowPriorityPool); - if (_Dst != (void *)0x0) { - memmove(_Dst,*(void **)(piVar15 + 0x192), - (ulonglong)*(ushort *)((longlong)piVar15 + 0x642) << 3); - if (1 < *(ushort *)(piVar15 + 400)) { - ExFreePoolWithTag(*(undefined8 *)(piVar15 + 0x192),0); - } - *(short *)(piVar15 + 400) = (short)piVar15[400] + 5; - *(void **)(piVar15 + 0x192) = _Dst; - goto LAB_8; - } - } - if ((DAT_0 & 1) != 0) { - WPP_SF_D(0x408,0x10c,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,cVar4); - } + cVar4 = UlpReferenceBuffers(piVar15,*(undefined8 *)(param_1 + 0x96)); lVar11 = local_a0; if (cVar4 == '\0') { piVar16 = (int *)0xc0000017; goto LAB_3; } if (((*(char *)(local_a0 + 0x4f) != '\0') && (Microsoft_Windows_Networking_CorrelationEnabled != 0)) && (*(longlong *)(piVar15 + 0x10) != 0)) { - local_88 = *(undefined8 *)(param_1 + 0x96); - local_80 = 0; + local_80 = *(undefined8 *)(param_1 + 0x96); + local_78 = 0; if (Microsoft_Windows_Networking_CorrelationEnabled != 0) { local_98[0] = 7; - local_78 = 0x1000ea63; - uStack_74 = 0x901; - uStack_70 = 1; - uStack_6c = 0x80000000; + local_70 = 0x1000ea63; + uStack_6c = 0x901; + uStack_68 = 1; + uStack_64 = 0x80000000; if (Microsoft_Windows_Networking_CorrelationTraceActivityPayload == 0) { local_e0 = (char *)0x0; local_e8 = (int *)((ulonglong)local_e8._4_4_ << 0x20); + EtwWriteTransfer(Microsoft_Windows_Networking_CorrelationHandle,&local_70, + piVar15 + 0x12,&local_80); } else { - local_60 = 0x10; - local_68 = &Microsoft_Windows_Networking_ProviderId; - local_58 = local_98; - local_e0 = (char *)&local_68; + local_58 = 0x10; + local_60 = &Microsoft_Windows_Networking_ProviderId; + local_50 = local_98; + local_e0 = (char *)&local_60; local_e8 = (int *)CONCAT44(local_e8._4_4_,2); - local_50 = 4; + local_48 = 4; + EtwWriteTransfer(); } - EtwWriteTransfer(Microsoft_Windows_Networking_CorrelationHandle,&local_78, - piVar15 + 0x12,&local_88); - } - } - } - uVar6 = local_b4; - UlConsumeBytesFromConnection(param_1,local_b0); - if ((int)uVar7 < 0) { - if (uVar7 != 0xc0000016) goto LAB_3; - if (*(uint *)(lVar11 + 0x111c) <= piVar15[0x222] + uVar6) { + } + } + } + UlConsumeBytesFromConnection(param_1,local_b4); + if ((int)uVar8 < 0) { + if (uVar8 != 0xc0000016) goto LAB_3; + if (*(uint *)(lVar11 + 0x111c) <= (uint)(piVar15[0x222] + iVar7)) { if (piVar15[0x7c] == 2) { - if ((DAT_9 & 0x40) != 0) { - WPP_SF_I(0x30e,0x6a,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); + if ((DAT_8 & 0x40) != 0) { + WPP_SF_I(0x30e,0x6b,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); } uVar9 = 0xf; } else { - if ((DAT_9 & 0x40) != 0) { - WPP_SF_I(0x30e,0x6b,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); + if ((DAT_8 & 0x40) != 0) { + WPP_SF_I(0x30e,0x6c,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); } uVar9 = 8; } UlSetErrorCode(piVar15,uVar9,0); piVar16 = (int *)0xc0000040; goto LAB_3; } param_1[0x9e] = param_1[0x9e] | 1; } - cVar4 = local_b8; if (7 < piVar15[0x7c]) { piVar15[0x1d2] = param_1[0x58]; param_1[0x58] = param_1[0x58] + 1; if ((DAT_0 & 1) != 0) { local_e8 = piVar15; - WPP_SF_qI(0x408,0x6c,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,param_1); + WPP_SF_qI(0x408,0x6d,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1); } uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xa0); if (((char)param_1[0xbb] != '\0') && ((param_1[0xba] & 2U) != 0)) { if ((DAT_4 & 8) != 0) { local_e0 = (char *)CONCAT44(local_e0._4_4_,1); local_e8 = (int *)CONCAT44(local_e8._4_4_,param_1[0xa2]); WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,param_1 + 0xa2) ; } param_1[0xae] = 0; } KeReleaseSpinLock(param_1 + 0xa0,uVar3); uVar6 = UlCheckProtocolCompliance(piVar15); piVar16 = (int *)(ulonglong)uVar6; if ((int)uVar6 < 0) goto LAB_3; - uVar20 = extraout_XMM0_Da; + uVar19 = extraout_XMM0_Da; if (((*(longlong *)(piVar15 + 6) != 0) && (lVar11 = *(longlong *)(*(longlong *)(piVar15 + 6) + 0x448), (*(byte *)(lVar11 + 0x6e0) & 2) != 0)) && ((*(longlong *)(lVar11 + 0x6f0) == 0 || (cVar4 = UlEtwEvaluateFilterForRequestConnection(piVar15), - uVar20 = extraout_XMM0_Da_00, cVar4 != '\0')))) { + uVar19 = extraout_XMM0_Da_00, cVar4 != '\0')))) { local_e0 = *(char **)(piVar15 + 0x1fc); local_e8 = (int *)CONCAT44(local_e8._4_4_,piVar15[0x1f0]); - uVar20 = McTemplateK0pqz_EtwWriteTransfer + uVar19 = McTemplateK0pqz_EtwWriteTransfer (*(longlong *)(*(longlong *)(piVar15 + 6) + 0x448) + 0x698); } if ((DAT_0 & 0x40) != 0) { local_e0 = *(char **)(piVar15 + 0x1fc); local_e8 = (int *)CONCAT44(local_e8._4_4_,piVar15[0x1f0]); - WPP_SF_qLS(uVar20,0x6d); - } - cVar4 = '\x01'; + WPP_SF_qLS(uVar19,0x6e); + } local_b8 = '\x01'; piVar15[0x19b] = piVar15[0x19b] + *(int *)(*(longlong *)(piVar15 + 0x22e) + 0x84); uVar9 = KeQueryPerformanceCounter(0); if (*(longlong *)(piVar15 + 0x2ee) == 0) { *(undefined8 *)(piVar15 + 0x2ee) = uVar9; } - if (piVar15[0x7c] == 10) goto LAB_10; + if (piVar15[0x7c] == 10) goto LAB_9; } break; case 5: case 6: case 10: - goto switchD_140029fd4_caseD_5; + goto switchD_140029fe1_caseD_5; case 8: case 9: if ((DAT_1 & 0x40) != 0) { local_e0 = *(char **)(piVar15 + 0x216); local_d8 = (undefined *)CONCAT44(local_d8._4_4_,iVar13); local_e8 = param_1; WPP_SF_qqIL(IMAGE_DOS_HEADER_140000000.e_magic + - (&switchD_140029fd4::switchdataD_14018d1f8)[(int)(iVar13 - 1U)],piVar15,iVar13 + (&switchD_140029fe1::switchdataD_14018d1f8)[(int)(iVar13 - 1U)],piVar15,iVar13 ,piVar15); } if ((*(longlong *)(piVar15 + 0x216) != 0) || ((piVar15[0x226] & 0x40U) != 0)) { *(undefined1 *)(piVar15 + 0x227) = 1; uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xa0); piVar17 = param_1 + 0xa2; uVar6 = param_1[0xc4] - 5; if ((char)param_1[0x9f] == '\0') { uVar6 = param_1[0xc4]; } iVar13 = uVar6 - param_1[0xc3]; if (uVar6 <= (uint)param_1[0xc3]) { iVar13 = 0; } if (iVar13 == 0) { if (((char)param_1[0xbb] != '\0') && ((param_1[0xba] & 8U) != 0)) { if ((DAT_4 & 8) != 0) { local_e0 = (char *)CONCAT44(local_e0._4_4_,3); local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar17); WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar17); } param_1[0xb0] = 0; } } else { UlSetBundleTimerEx(piVar17,3,0,CONCAT71((uint7)(uint3)(uVar6 >> 8),1)); } KeReleaseSpinLock(param_1 + 0xa0,uVar3); } uVar14 = *(ulonglong *)(piVar15 + 0x216); - uVar6 = local_b4; + uVar6 = local_ac; if (uVar14 != 0) { if (*(longlong *)(piVar15 + 0x232) == 0) { *(undefined8 *)(piVar15 + 0x232) = *(undefined8 *)(param_1 + 0x96); *(ulonglong *)(piVar15 + 0x234) = (ulonglong)*(uint *)(*(longlong *)(param_1 + 0x96) + 0x88) + *(longlong *)(*(longlong *)(param_1 + 0x96) + 0xa0); } uVar10 = uVar14 & 0xffffffff; - if (local_b4 < uVar14) { - uVar10 = (ulonglong)local_b4; - } - uVar6 = local_b4 - (int)uVar10; + if (local_ac < uVar14) { + uVar10 = (ulonglong)local_ac; + } + uVar6 = local_ac - (int)uVar10; *(ulonglong *)(piVar15 + 0x218) = *(longlong *)(piVar15 + 0x218) + uVar10; *(ulonglong *)(piVar15 + 0x216) = uVar14 - uVar10; *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) = *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) + (int)uVar10; *(ulonglong *)(piVar15 + 0x222) = *(longlong *)(piVar15 + 0x222) + uVar10; uVar5 = KeGetCurrentNodeNumber(); piVar17 = (int *)(*(longlong *)(piVar15 + 0x15a) + 0x198); if (*(longlong *)(piVar15 + 0x15a) == 0) { - piVar17 = piVar19; + piVar17 = piVar18; } if (piVar17 != (int *)0x0) { LOCK(); - plVar18 = (longlong *) - (*(longlong *)(*(longlong *)(piVar17 + 4) + 8 + (ulonglong)uVar5 * 8) + 8); - *plVar18 = *plVar18 + uVar10; + plVar1 = (longlong *) + (*(longlong *)(*(longlong *)(piVar17 + 4) + 8 + (ulonglong)uVar5 * 8) + 8); + *plVar1 = *plVar1 + uVar10; UNLOCK(); } lVar11 = *(longlong *)(piVar15 + 0x162) + 0x18; if (*(longlong *)(piVar15 + 0x162) == 0) { lVar11 = 0; } if (lVar11 != 0) { LOCK(); - plVar18 = (longlong *) - (*(longlong *)(*(longlong *)(lVar11 + 0x10) + 8 + (ulonglong)uVar5 * 8) + 8); - *plVar18 = *plVar18 + uVar10; + plVar1 = (longlong *) + (*(longlong *)(*(longlong *)(lVar11 + 0x10) + 8 + (ulonglong)uVar5 * 8) + 8); + *plVar1 = *plVar1 + uVar10; UNLOCK(); } } if ((DAT_1 & 0x40) != 0) { local_e0 = "not "; - if (local_ac == 0) { + if (local_b0 == 0) { local_e0 = ""; } local_e8 = param_1; WPP_SF_qqs(); } - if (local_ac == 0) { + if (local_b0 == 0) { UlDeliverEntityBody(piVar15); } if ((DAT_1 & 0x40) != 0) { local_e0 = *(char **)(param_1 + 0x96); local_d8 = *(undefined **)((longlong)local_e0 + 0x90); local_e8 = param_1; WPP_SF_qqqI(); } local_e8 = local_a8; - uVar7 = UlParseHttp(piVar15,(ulonglong)*(uint *)(*(longlong *)(param_1 + 0x96) + 0x88) + + uVar8 = UlParseHttp(piVar15,(ulonglong)*(uint *)(*(longlong *)(param_1 + 0x96) + 0x88) + *(longlong *)(*(longlong *)(param_1 + 0x96) + 0xa0),uVar6, - &local_b0); - piVar16 = (int *)(ulonglong)uVar7; + &local_b4); + piVar16 = (int *)(ulonglong)uVar8; if ((DAT_1 & 0x40) != 0) { - local_d8 = (undefined *)CONCAT44(local_d8._4_4_,local_b0); - local_e0 = (char *)CONCAT44(local_e0._4_4_, - *(undefined4 *)(*(longlong *)(param_1 + 0x8e) + 0x1f0)); - local_e8 = (int *)CONCAT44(local_e8._4_4_,iVar8); - WPP_SF_qLLL(0x50e,0x71,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); - } - if (uVar6 < local_b0) goto LAB_7; + local_d8 = (undefined *)CONCAT44(local_d8._4_4_,local_b4); + local_e0 = (char *)CONCAT44(local_e0._4_4_,*(undefined4 *)(*plVar2 + 0x1f0)); + local_e8 = (int *)CONCAT44(local_e8._4_4_,iVar7); + WPP_SF_qLLL(0x50e,0x72,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); + } + if (uVar6 < local_b4) goto LAB_7; *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) = - *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) + local_b0; - local_b4 = uVar6 - local_b0; + *(int *)(*(longlong *)(param_1 + 0x96) + 0x88) + local_b4; + iVar7 = uVar6 - local_b4; piVar15[0x21e] = piVar15[0x21e] + local_a8[0]; - *(ulonglong *)(piVar15 + 0x222) = *(longlong *)(piVar15 + 0x222) + (ulonglong)local_b0; - uVar10 = (ulonglong)local_b0; + *(ulonglong *)(piVar15 + 0x222) = *(longlong *)(piVar15 + 0x222) + (ulonglong)local_b4; + uVar10 = (ulonglong)local_b4; uVar5 = KeGetCurrentNodeNumber(); - uVar6 = local_b4; uVar14 = (ulonglong)uVar5; piVar17 = (int *)(*(longlong *)(piVar15 + 0x15a) + 0x198); if (*(longlong *)(piVar15 + 0x15a) == 0) { - piVar17 = piVar19; + piVar17 = piVar18; } if (piVar17 != (int *)0x0) { LOCK(); - plVar18 = (longlong *)(*(longlong *)(*(longlong *)(piVar17 + 4) + 8 + uVar14 * 8) + 8); - *plVar18 = *plVar18 + uVar10; + plVar1 = (longlong *)(*(longlong *)(*(longlong *)(piVar17 + 4) + 8 + uVar14 * 8) + 8); + *plVar1 = *plVar1 + uVar10; UNLOCK(); } lVar11 = *(longlong *)(piVar15 + 0x162) + 0x18; if (*(longlong *)(piVar15 + 0x162) == 0) { lVar11 = 0; } lVar12 = 0; if (lVar11 != 0) { lVar12 = *(longlong *)(*(longlong *)(lVar11 + 0x10) + 8 + uVar14 * 8); LOCK(); *(longlong *)(lVar12 + 8) = *(longlong *)(lVar12 + 8) + uVar10; UNLOCK(); } - if ((int)uVar7 < 0) { - if (uVar7 != 0xc0000016) goto LAB_3; + if ((int)uVar8 < 0) { + if (uVar8 != 0xc0000016) goto LAB_3; if ((DAT_1 & 0x40) != 0) { local_c8 = piVar15[0x21e]; local_d0 = *(undefined8 *)(piVar15 + 0x218); local_d8 = *(undefined **)(piVar15 + 0x21c); - local_e0 = (char *)CONCAT44(local_e0._4_4_,local_b4); + local_e0 = (char *)CONCAT44(local_e0._4_4_,iVar7); local_e8 = (int *)CONCAT44(local_e8._4_4_,piVar15[0x7c]); WPP_SF_qLdIId(lVar12,uVar14,0,piVar15); } if ((piVar15[0x7c] == 9) && (*(longlong *)(piVar15 + 0x21c) == *(longlong *)(piVar15 + 0x218))) { - uVar7 = piVar15[0x21e] + uVar6; - if (*(uint *)(local_a0 + 0x111c) <= uVar7) { - if ((DAT_9 & 0x40) != 0) { - local_d8 = (undefined *)CONCAT44(local_d8._4_4_,uVar7); - local_e0 = (char *)CONCAT44(local_e0._4_4_,uVar6); + uVar6 = piVar15[0x21e] + iVar7; + if (*(uint *)(local_a0 + 0x111c) <= uVar6) { + if ((DAT_8 & 0x40) != 0) { + local_d8 = (undefined *)CONCAT44(local_d8._4_4_,uVar6); + local_e0 = (char *)CONCAT44(local_e0._4_4_,iVar7); local_e8 = (int *)CONCAT44(local_e8._4_4_,piVar15[0x21e]); - WPP_SF_qLLL(0x30e,0x5f,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); + WPP_SF_qLLL(0x30e,0x5f,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); } piVar16 = (int *)0xc0000040; UlSetErrorCode(piVar15,8); goto LAB_3; } } param_1[0x9e] = param_1[0x9e] | 1; - cVar4 = local_b8; - } - else { - cVar4 = local_b8; - if (piVar15[0x7c] == 10) { - if ((DAT_1 & 0x40) != 0) { - WPP_SF_I(0x50e,0x72,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); - } - UlDeliverEntityBody(piVar15); - uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xa0); - piVar17 = param_1 + 0xa2; - if (((char)param_1[0xbb] != '\0') && ((param_1[0xba] & 8U) != 0)) { - if ((DAT_4 & 8) != 0) { - local_e0 = (char *)CONCAT44(local_e0._4_4_,3); - local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar17); - WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar17); - } - param_1[0xb0] = 0; - } - if (((*(char *)((longlong)piVar15 + 0x89d) != '\0') && ((char)param_1[0xbb] != '\0')) && - ((param_1[0xba] & 0x10U) != 0)) { - if ((DAT_4 & 8) != 0) { - local_e0 = (char *)CONCAT44(local_e0._4_4_,4); - local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar17); - WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar17); - } - param_1[0xb1] = 0; - } - KeReleaseSpinLock(param_1 + 0xa0,uVar3); - if (*(char *)((longlong)piVar15 + 0x89d) == '\0') goto LAB_3; - piVar15[0x226] = piVar15[0x226] | 0x1000; - UlCleanupHttpConnection(param_1); - cVar4 = local_b8; - } + } + else if (piVar15[0x7c] == 10) { + if ((DAT_1 & 0x40) != 0) { + WPP_SF_I(0x50e,0x73,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); + } + UlDeliverEntityBody(piVar15); + uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0xa0); + piVar17 = param_1 + 0xa2; + if (((char)param_1[0xbb] != '\0') && ((param_1[0xba] & 8U) != 0)) { + if ((DAT_4 & 8) != 0) { + local_e0 = (char *)CONCAT44(local_e0._4_4_,3); + local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar17); + WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar17); + } + param_1[0xb0] = 0; + } + if (((*(char *)((longlong)piVar15 + 0x89d) != '\0') && ((char)param_1[0xbb] != '\0')) && + ((param_1[0xba] & 0x10U) != 0)) { + if ((DAT_4 & 8) != 0) { + local_e0 = (char *)CONCAT44(local_e0._4_4_,4); + local_e8 = (int *)CONCAT44(local_e8._4_4_,*piVar17); + WPP_SF_qLd(0x413,0x10,&WPP_d526626bd6b332fa01ad149e5cd18b6b_Traceguids,piVar17); + } + param_1[0xb1] = 0; + } + KeReleaseSpinLock(param_1 + 0xa0,uVar3); + if (*(char *)((longlong)piVar15 + 0x89d) == '\0') goto LAB_3; + piVar15[0x226] = piVar15[0x226] | 0x1000; + UlCleanupHttpConnection(param_1); } break; case 0xb: piVar15 = piVar17; - piVar16 = piVar19; + piVar16 = piVar18; goto LAB_3; } uVar6 = UlpAdjustBuffers(param_1); piVar17 = piVar15; + cVar4 = local_b8; } piVar16 = (int *)(ulonglong)uVar6; if (uVar6 == 0xc0000016) { - if (cVar4 == '\0') goto LAB_11; -LAB_10: - uVar6 = UlpDeliverHttpRequest(param_1,local_90); + if (cVar4 == '\0') goto LAB_10; +LAB_9: + uVar6 = UlpDeliverHttpRequest(param_1,local_88); piVar16 = (int *)(ulonglong)uVar6; if ((char)piVar15[0x262] != '\0') { piVar16 = (int *)0x0; - goto LAB_12; - } -LAB_13: - if (-1 < (int)piVar16) goto LAB_12; + goto LAB_11; + } +LAB_12: + if (-1 < (int)piVar16) goto LAB_11; } else { LAB_3: - if (local_b8 == '\0') goto LAB_13; - if (-1 < (int)piVar16) goto LAB_10; + if (local_b8 == '\0') goto LAB_12; + if (-1 < (int)piVar16) goto LAB_9; } if ((*(longlong *)(param_1 + 0x8e) != 0) && (*(int *)(*(longlong *)(param_1 + 0x8e) + 0x74c) == 0)) { - if ((DAT_9 & 0x40) != 0) { + if ((DAT_8 & 0x40) != 0) { local_e8 = (int *)CONCAT44(local_e8._4_4_,(int)piVar16); - WPP_SF_qL(0x30e,0x73,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); + WPP_SF_qL(0x30e,0x74,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); } UlSetErrorCode(*(undefined8 *)(param_1 + 0x8e),1); } cVar4 = DAT_2; if (*(longlong *)(param_1 + 0x8e) != 0) { if ((char)DAT_4 < '\0') { - WPP_SF_D(0x417,0x26,&WPP_8ae041072d853f88e11e59270b140751_Traceguids,DAT_2); + WPP_SF_D(0x417,0x26,&WPP_c6301bacd5d235d972b6a97d23dddc30_Traceguids,DAT_2); } if (cVar4 != '\0') { UxPktMonTraceDropHttpReceiveWithError(*(undefined8 *)(param_1 + 0x8e),0xe0005004,piVar16); } } } else { - piVar15 = piVar19; - if (iVar8 == 0xb) { + piVar15 = piVar18; + if (iVar7 == 0xb) { if ((DAT_0 & 1) != 0) { local_e8 = *(int **)(param_1 + 0xc); - WPP_SF_qI(0x408,0x76,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,param_1); - } - piVar17 = piVar19; + WPP_SF_qI(0x408,0x77,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1); + } + piVar17 = piVar18; while (*(longlong **)(param_1 + 0x92) != (longlong *)(param_1 + 0x92)) { lVar11 = *(longlong *)(param_1 + 0x94); if ((lVar11 + -0x30 == *(longlong *)(param_1 + 0x96)) || - ((lVar12 = *(longlong *)(param_1 + 0x8e), lVar12 != 0 && - (*(longlong *)(lVar12 + 0x8c0) == lVar11 + -0x30)))) break; + ((*plVar2 != 0 && (*(longlong *)(*plVar2 + 0x8c0) == lVar11 + -0x30)))) break; piVar17 = (int *)(ulonglong) (uint)((int)piVar17 + (*(int *)(lVar11 + 0x50) - *(int *)(lVar11 + 0x58))); UlReleaseRequestBuffer(param_1); } if ((int)piVar17 != 0) { UlConsumeBytesFromConnection(param_1,piVar17); } piVar15 = (int *)0x0; if ((DAT_0 & 1) != 0) { - WPP_SF_(0x408,0x77,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids); - } - } -LAB_11: - piVar16 = piVar19; + WPP_SF_(0x408,0x78,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids); + } + } +LAB_10: + piVar16 = piVar18; if ((*(longlong *)(param_1 + 0x5e) != 0) && (piVar16 = (int *)0x0, *(longlong *)(param_1 + 0x5c) == *(longlong *)(param_1 + 0x5e))) { UlpCloseDisconnectedConnection(param_1); } } -LAB_12: +LAB_11: if ((DAT_1 & 0x40) != 0) { local_e0 = (char *)(CONCAT44(local_e0._4_4_,param_1[0x9e]) & 0xffffffff00000001); local_e8 = (int *)CONCAT44(local_e8._4_4_,(int)piVar16); - WPP_SF_qLd(0x50e,0x74,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar15); + WPP_SF_qLd(0x50e,0x75,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar15); } if ((DAT_0 & 0x40) != 0) { - WPP_SF_D(0x40e,0x75,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,piVar16); + WPP_SF_D(0x40e,0x76,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,piVar16); } return piVar16; } ``` ## UxDuoFaultCodeFromHttpReceiveFault ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.67| |i_ratio|0.46| |m_ratio|0.95| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxDuoFaultCodeFromHttpReceiveFault|UxDuoFaultCodeFromHttpReceiveFault| |fullname|UxDuoFaultCodeFromHttpReceiveFault|UxDuoFaultCodeFromHttpReceiveFault| |refcount|2|2| |`length`|203|224| |called||| |calling|UxDuoConnectionControl|UxDuoConnectionControl| |paramcount|0|0| |`address`|1400b9bb8|1400b9ca8| |sig|undefined UxDuoFaultCodeFromHttpReceiveFault(void)|undefined UxDuoFaultCodeFromHttpReceiveFault(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxDuoFaultCodeFromHttpReceiveFault Diff ```diff --- UxDuoFaultCodeFromHttpReceiveFault +++ UxDuoFaultCodeFromHttpReceiveFault @@ -1,67 +1,74 @@ -undefined4 UxDuoFaultCodeFromHttpReceiveFault(int param_1) +byte UxDuoFaultCodeFromHttpReceiveFault(int param_1) { - if (param_1 < 10) { - if (param_1 == 9) { - return 0x2c; + if (param_1 < 0xb) { + if (param_1 == 10) { + return 0x37; } - if (param_1 != 0) { - if (param_1 == 1) { - return 0xd; - } - if (param_1 == 2) { - return 0x2a; - } - if (param_1 == 3) { - return 0x2b; - } - if (param_1 == 4) { - return 4; - } + if (param_1 < 6) { if (param_1 == 5) { return 6; } + if (param_1 != 0) { + if (param_1 == 1) { + return 0xd; + } + if (param_1 == 2) { + return 0x2a; + } + if (param_1 == 3) { + return 0x2b; + } + if (param_1 == 4) { + return 4; + } + } + } + else { if (param_1 == 6) { return 8; } if (param_1 == 7) { return 0x12; } if (param_1 == 8) { return 10; } + if (param_1 == 9) { + return 0x2c; + } } } else { - if (param_1 == 10) { - return 0x37; - } if (param_1 == 0xb) { return 0x35; } if (param_1 == 0xc) { return 0x39; } if (param_1 == 0xd) { return 0x31; } if (param_1 == 0xe) { return 0x30; } if (param_1 == 0xf) { return 5; } if (param_1 == 0x10) { return 0x24; } if (param_1 == 0x11) { return 0x2e; } if (param_1 == 0x13) { return 0x26; } + if (param_1 == 0x14) { + return -(UxKirMaxHeadersCountLimit != '\0') & 0x29; + } } return 0; } ``` ## UxReadHttp11ParserSettings ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address| |ratio|0.55| |i_ratio|0.44| |m_ratio|0.96| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxReadHttp11ParserSettings|UxReadHttp11ParserSettings| |fullname|UxReadHttp11ParserSettings|UxReadHttp11ParserSettings| |refcount|2|2| |`length`|787|867| |called|HttpInitializeDefaultUrlC14nConfigEncoding
UxGetActiveCodePage
UxReadBooleanSetting
UxReadBoundedULongSetting|HttpInitializeDefaultUrlC14nConfigEncoding
UxGetActiveCodePage
UxReadBooleanSetting
UxReadBoundedULongSetting| |calling|UxStartEnvironmentFacet|UxStartEnvironmentFacet| |paramcount|0|0| |`address`|1400bb8b0|1400bba58| |sig|undefined UxReadHttp11ParserSettings(void)|undefined UxReadHttp11ParserSettings(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxReadHttp11ParserSettings Diff ```diff --- UxReadHttp11ParserSettings +++ UxReadHttp11ParserSettings @@ -1,78 +1,89 @@ int UxReadHttp11ParserSettings(longlong param_1,undefined8 param_2) { uint *puVar1; - int iVar2; - uint uVar3; - int iVar4; - undefined1 uVar5; + uint uVar2; + int iVar3; + uint uVar4; + int iVar5; undefined1 uVar6; + undefined1 uVar7; + bool bVar8; char local_res8 [16]; undefined1 local_res18 [8]; int local_res20 [2]; int local_48 [4]; + local_res20[0] = 0; puVar1 = (uint *)(param_1 + 0x111c); - local_res20[0] = 0; + local_48[0] = 0; local_res18[0] = 0; local_res8[0] = '\0'; - local_48[0] = 0; - uVar5 = 0; + uVar7 = 0; UxReadBoundedULongSetting(param_2,L"MaxRequestBytes",0x4000,0x100,0x1000000,3,puVar1); - uVar3 = 0xfffe; + uVar4 = 0xfffe; if (*puVar1 < 0xfffe) { - uVar3 = *puVar1; + uVar4 = *puVar1; } - UxReadBoundedULongSetting(param_2,L"MaxFieldLength",0x4000,0x40,uVar3,3,local_res20); - *(undefined2 *)(param_1 + 0x1128) = (undefined2)local_res20[0]; - uVar3 = *puVar1; - if (uVar3 < 0x4000) { - uVar3 = 0x4000; + UxReadBoundedULongSetting(param_2,L"MaxFieldLength",0x4000,0x40,uVar4,3,local_res20); + uVar4 = *puVar1; + *(undefined2 *)(param_1 + 0x112c) = (undefined2)local_res20[0]; + uVar2 = uVar4; + if (uVar4 < 0x4000) { + uVar2 = 0x4000; } - *(uint *)(param_1 + 0x1118) = uVar3; - iVar2 = UxGetActiveCodePage(local_48); - if (-1 < iVar2) { + bVar8 = UxKirMaxHeadersCountLimit != '\0'; + *(uint *)(param_1 + 0x1118) = uVar2; + if (bVar8) { + uVar2 = uVar4 >> 9; + if (uVar4 >> 9 < 200) { + uVar2 = 200; + } + UxReadBoundedULongSetting(param_2,L"MaxHeadersCount",uVar2,0x32,0xffff,3,param_1 + 0x1128); + } + iVar3 = UxGetActiveCodePage(local_48); + if (-1 < iVar3) { UxReadBooleanSetting(param_2,L"EnableNonUTF8",1,local_res8); - iVar4 = local_48[0]; + iVar5 = local_48[0]; uVar6 = 0; if (local_res8[0] != '\0') { - uVar5 = 0; + uVar7 = 0; if ((local_48[0] - 0x3a4U < 0x13) && ((0x60011U >> (local_48[0] - 0x3a4U & 0x1f) & 1) != 0)) { - uVar5 = 1; + uVar7 = 1; } UxReadBooleanSetting(param_2,L"FavorUTF8",1,local_res18); uVar6 = local_res18[0]; } - HttpInitializeDefaultUrlC14nConfigEncoding(param_1 + 0x112c,local_res8[0],uVar6,uVar5); - *(int *)(param_1 + 0x113c) = iVar4; - UxReadBooleanSetting(param_2,L"PercentUAllowed",0,param_1 + 0x1137); - UxReadBooleanSetting(param_2,L"AllowRestrictedChars",0,param_1 + 0x1138); - UxReadBooleanSetting(param_2,L"AllowUnescapedRestrictedChars",0,param_1 + 0x1139); + HttpInitializeDefaultUrlC14nConfigEncoding(param_1 + 0x1130,local_res8[0],uVar6,uVar7); + *(int *)(param_1 + 0x1140) = iVar5; + UxReadBooleanSetting(param_2,L"PercentUAllowed",0,param_1 + 0x113b); + UxReadBooleanSetting(param_2,L"AllowRestrictedChars",0,param_1 + 0x113c); + UxReadBooleanSetting(param_2,L"AllowUnescapedRestrictedChars",0,param_1 + 0x113d); UxReadBoundedULongSetting(param_2,L"UrlSegmentMaxLength",0x104,0,0xffffffff,0,local_res20); if (local_res20[0] == 0) { local_res20[0] = -3; } else if (0x7ffc < local_res20[0] - 2U) { local_res20[0] = 0x104; } - *(int *)(param_1 + 0x1144) = local_res20[0]; + *(int *)(param_1 + 0x1148) = local_res20[0]; UxReadBoundedULongSetting(param_2,L"UrlSegmentMaxCount",0xff,0,0xffffffff,0,local_res20); - iVar4 = -3; - if ((local_res20[0] != 0) && (iVar4 = local_res20[0], 0x3ffd < local_res20[0] - 2U)) { - iVar4 = 0xff; + iVar5 = -3; + if ((local_res20[0] != 0) && (iVar5 = local_res20[0], 0x3ffd < local_res20[0] - 2U)) { + iVar5 = 0xff; } - *(int *)(param_1 + 0x1148) = iVar4; + *(int *)(param_1 + 0x114c) = iVar5; UxReadBooleanSetting(param_2,L"AllowCaseInsensitiveVerbs",0,param_1 + 0x110c); UxReadBooleanSetting(param_2,L"AllowWeakHeaderNameSyntax",0,param_1 + 0x110e); UxReadBooleanSetting(param_2,L"AllowWeakHeaderValueSyntax",0,param_1 + 0x110f); UxReadBooleanSetting(param_2,L"AllowMultipleUseragentHeaders",0,param_1 + 0x110d); UxReadBoundedULongSetting (param_2,L"MaxRequestRangesAllowed",0xffffffff,0,0xffffffff,0,param_1 + 0x1bc0); UxReadBooleanSetting(param_2,L"DisableRequestSmuggling",0,param_1 + 0x1111); UxReadBooleanSetting(param_2,L"NormalizeIpv4MappedIpv6Hostname",1,param_1 + 0x1112); UxReadBooleanSetting(param_2,L"AllowLenientChunkExtParsing",0,param_1 + 0x1113); } - return iVar2; + return iVar3; } ``` ## UlParseRequestHeaderPairs ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.05| |i_ratio|0.35| |m_ratio|1.0| |b_ratio|0.08| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UlParseRequestHeaderPairs|UlParseRequestHeaderPairs| |fullname|UlParseRequestHeaderPairs|UlParseRequestHeaderPairs| |refcount|2|2| |`length`|2699|2714| |`called`|

Expand for full list:
HashCountedStringNoCaseA
NTOSKRNL.EXE::_strnicmp
NTOSKRNL.EXE::strncmp
UlpInvokeHeaderHandlers
UlpMergeCookiePairs
UlpParseAuthenticationHeader
UlpParseTransferEncodingPairs
UlpValidatePsuedoHeaders
UxDuoConnectionControl
UxSslConnectionControl
UxTlConnectionControl

WPP_SF_D
WPP_SF_dD
WPP_SF_qLqqqq
WPP_SF_qi_CTDSTR_
WPP_SF_qqqLq
_guard_dispatch_icall

WPP_SF_qLqqqq
WPP_SF_qi_CTDSTR_
WPP_SF_qqqLq
_guard_dispatch_icall

| |calling|UlHttpReceiveHeadersEvent|UlHttpReceiveHeadersEvent| |paramcount|0|0| |`address`|1400c7bd0|1400c7e20| |sig|undefined UlParseRequestHeaderPairs(void)|undefined UlParseRequestHeaderPairs(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UlParseRequestHeaderPairs Called Diff ```diff --- UlParseRequestHeaderPairs called +++ UlParseRequestHeaderPairs called @@ -9,3 +8,0 @@ -UxDuoConnectionControl -UxSslConnectionControl -UxTlConnectionControl @@ -13,0 +11 @@ +WPP_SF_qLd ``` ### UlParseRequestHeaderPairs Diff ```diff --- UlParseRequestHeaderPairs +++ UlParseRequestHeaderPairs @@ -1,486 +1,470 @@ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ int UlParseRequestHeaderPairs (longlong param_1,longlong *param_2,uint param_3,undefined1 *param_4,int *param_5) { - longlong lVar1; + uint uVar1; undefined8 *puVar2; - longlong *plVar3; char *_Str2; - undefined8 uVar4; - code *pcVar5; - undefined8 uVar6; - bool bVar7; - bool bVar8; - longlong *plVar9; - longlong *plVar10; - longlong *plVar11; - longlong *plVar12; - int iVar13; - int iVar14; + undefined8 uVar3; + byte *pbVar4; + bool bVar5; + longlong *plVar6; + longlong *plVar7; + longlong *plVar8; + undefined4 uVar9; + int iVar10; + int iVar11; + ulonglong uVar12; + uint uVar13; + longlong *plVar14; int iVar15; - undefined4 uVar16; + int iVar16; int iVar17; - ulonglong uVar18; - byte *pbVar19; - ulonglong uVar20; - int iVar21; - ulonglong uVar22; - uint uVar23; - uint uVar24; - uint uVar25; + uint uVar18; byte *_Str2_00; - byte *pbVar26; - longlong lVar27; - undefined1 uVar28; - longlong *plVar29; - undefined8 uVar30; - undefined8 uVar31; - int local_c8; - int local_c4; - uint local_c0; - uint local_bc; - undefined1 local_b8; - longlong local_b0; - uint local_a8; - int local_a4; + uint uVar19; + longlong lVar20; + byte *pbVar21; + longlong *plVar22; + undefined1 uVar23; + bool bVar24; + longlong *plVar25; + int local_b8; + int local_b4; + uint local_b0; + uint local_ac; + char local_a8; + undefined1 local_a7; longlong *local_a0; longlong *local_98; - longlong *local_90; - longlong *local_88; + longlong local_90; + uint local_88; + int local_84; longlong *local_80; longlong *local_78; - undefined4 local_68; - undefined4 uStack_64; - undefined8 uStack_60; + longlong *local_70; + longlong *local_68; undefined4 local_58; undefined4 uStack_54; - undefined4 uStack_50; - undefined4 uStack_4c; + undefined8 uStack_50; + undefined4 local_48; + undefined4 uStack_44; + undefined4 uStack_40; + undefined4 uStack_3c; - local_b0 = *(longlong *)(param_1 + 0x18); + local_b8 = 0; + local_90 = *(longlong *)(param_1 + 0x18); + local_a0 = (longlong *)0x0; + local_98 = (longlong *)0x0; + local_80 = (longlong *)0x0; + local_78 = (longlong *)0x0; + local_68 = (longlong *)0x0; + local_70 = (longlong *)0x0; + bVar5 = false; + local_a8 = '\0'; + local_ac = 0; + local_84 = 0; + local_b4 = 0; + local_a7 = 0; + local_b0 = 0; + if ((DAT_0 & 0x40) != 0) { + WPP_SF_qqqLq(0x40e,0x60,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1, + *(undefined8 *)(param_1 + 0x40),param_2,param_3,param_4); + } + bVar24 = UxKirMaxHeadersCountLimit != '\0'; + *param_5 = 0; + if (bVar24) { + iVar11 = *(int *)(*(longlong *)(local_90 + 0x448) + 0x1128); + if (iVar11 + 4U < *(uint *)(param_2 + 1)) { + if ((DAT_1 & 1) != 0) { + WPP_SF_qLd(0x308,0x61,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1, + *(uint *)(param_2 + 1),iVar11); + } + local_b4 = 0x14; + local_b8 = -0x3fffffc0; + lVar20 = local_90; + iVar11 = local_b8; + goto LAB_2; + } + } + uVar23 = 1; + uVar12 = 0; + local_88 = 0; + plVar14 = (longlong *)0x0; + plVar22 = (longlong *)0x0; uVar18 = 0; - local_c8 = 0; - local_98 = (longlong *)0x0; - local_a0 = (longlong *)0x0; - local_90 = (longlong *)0x0; - local_88 = (longlong *)0x0; - local_78 = (longlong *)0x0; - local_80 = (longlong *)0x0; - bVar7 = false; - bVar8 = false; - local_bc = 0; - local_a4 = 0; - local_c4 = 0; - local_b8 = 0; - local_c0 = 0; + uVar19 = 0; + if ((int)param_2[1] != 0) { +LAB_3: + plVar14 = (longlong *)(*param_2 + uVar12 * 0x18); + _Str2_00 = (byte *)*plVar14; + pbVar21 = (byte *)plVar14[1]; + uVar19 = *(uint *)((longlong)plVar14 + 0x14); + for (uVar18 = *(uint *)(plVar14 + 2); uVar18 != 0; uVar18 = uVar18 - 1) { + if (((&HttpChars)[*_Str2_00] & 0x20) == 0) goto LAB_4; + _Str2_00 = _Str2_00 + 1; + } + goto joined_r0x0001400c80d8; + } +LAB_5: + plVar25 = plVar22; + local_b8 = UlpValidatePsuedoHeaders(param_1,local_78,local_80,plVar14,plVar22,&local_b4); + uVar9 = (undefined4)((ulonglong)plVar25 >> 0x20); + lVar20 = local_90; + iVar11 = local_b8; + if (-1 < local_b8) { + if ((bVar5) && + (local_b8 = UlpParseTransferEncodingPairs(param_1,param_2,&local_84), local_b8 < 0)) { + local_b4 = 0x10; + lVar20 = local_90; + iVar11 = local_b8; + } + else if ((uVar18 < 2) || (local_b8 = UlpMergeCookiePairs(param_1,param_2), -1 < local_b8)) { + local_a7 = 1; + if ((((param_3 & 0x1000) != 0) || (local_84 != 0)) || (local_a8 != '\0')) { + uVar23 = 0; + } + local_b8 = UlpInvokeHeaderHandlers + (param_1,param_2,local_a0,local_68,CONCAT44(uVar9,uVar19),plVar22,uVar23) + ; + lVar20 = local_90; + iVar11 = local_b8; + if ((-1 < local_b8) && (*(int *)(param_1 + 0x844) == 2)) { + uVar3 = *(undefined8 *)(param_1 + 0x7f8); + puVar2 = (undefined8 *)(local_90 + 0x1f0); + if ((DAT_6 & 2) != 0) { + WPP_SF_qLqqqq(0x419,10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,puVar2,0x41,uVar3, + param_1 + 0x818,0,0); + } + iVar11 = (**(code **)(*(longlong *)(lVar20 + 0x1f8) + 0x88)) + (*puVar2,0x41,uVar3,param_1 + 0x818,0,0); + if ((DAT_6 & 2) != 0) { + WPP_SF_D(0x419,0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar11); + } + } + } + else { + local_b4 = 0x11; + lVar20 = local_90; + iVar11 = local_b8; + } + } +LAB_2: + local_b8 = iVar11; + *param_4 = local_a7; + if (local_b4 != 0) { + if ((DAT_6 & 2) != 0) { + WPP_SF_qLqqqq(0x419,10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, + (undefined8 *)(lVar20 + 0x1f0),0x49,&local_b4,&local_b8,0,0); + } + uVar9 = (**(code **)(*(longlong *)(lVar20 + 0x1f8) + 0x88)) + (*(undefined8 *)(lVar20 + 0x1f0),0x49,&local_b4,&local_b8,0,0); + if ((DAT_6 & 2) != 0) { + WPP_SF_D(0x419,0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar9); + } + } + *(undefined1 *)((ulonglong)*(uint *)(param_1 + 0x848) + 0x220 + param_1) = 0x29; + *param_5 = local_b4; if ((DAT_0 & 0x40) != 0) { - WPP_SF_qqqLq(0x40e,0x60,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,param_1, - *(undefined8 *)(param_1 + 0x40),param_2,param_3,param_4); - } - *param_5 = 0; - uVar28 = 1; - uVar20 = uVar18; - uVar22 = uVar18; -LAB_1: - plVar9 = local_98; - plVar3 = local_a0; - local_a8 = (uint)uVar18; - if (local_a8 < *(uint *)(param_2 + 1)) { - plVar3 = (longlong *)(*param_2 + uVar18 * 0x18); - _Str2_00 = (byte *)*plVar3; - pbVar26 = (byte *)plVar3[1]; - uVar25 = *(uint *)((longlong)plVar3 + 0x14); - for (uVar23 = *(uint *)(plVar3 + 2); uVar18 = (ulonglong)uVar23, uVar23 != 0; - uVar23 = uVar23 - 1) { - if (((&HttpChars)[*_Str2_00] & 0x20) == 0) goto LAB_2; - _Str2_00 = _Str2_00 + 1; - } - goto joined_r0x0001400c7cf7; - } - plVar29 = local_a0; - local_c8 = UlpValidatePsuedoHeaders(param_1,local_88,local_90,local_98,local_a0,&local_c4); - uVar16 = (undefined4)((ulonglong)plVar29 >> 0x20); - lVar27 = local_b0; - iVar17 = local_c8; - if (-1 < local_c8) { - if ((bVar7) && - (local_c8 = UlpParseTransferEncodingPairs(param_1,param_2,&local_a4), local_c8 < 0)) { - local_c4 = 0x10; - lVar27 = local_b0; - iVar17 = local_c8; - } - else if (((uint)uVar20 < 2) || (local_c8 = UlpMergeCookiePairs(param_1,param_2), -1 < local_c8)) - { - local_b8 = 1; - if ((((param_3 & 0x1000) != 0) || (local_a4 != 0)) || (bVar8)) { - uVar28 = 0; - } - local_c8 = UlpInvokeHeaderHandlers - (param_1,param_2,plVar9,local_78,CONCAT44(uVar16,(int)uVar22),plVar3, - uVar28); - lVar27 = local_b0; - iVar17 = local_c8; - if ((-1 < local_c8) && (*(int *)(param_1 + 0x844) == 2)) { - uVar4 = *(undefined8 *)(param_1 + 0x7f8); - lVar1 = param_1 + 0x818; - puVar2 = (undefined8 *)(local_b0 + 0x1f0); - if ((DAT_3 & 2) != 0) { - WPP_SF_qLqqqq(0x419,10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,puVar2,0x41,uVar4, - lVar1,0,0); + WPP_SF_dD(0x40e,99,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,local_b8,*param_4); + } + return local_b8; + while (uVar18 = uVar13, uVar13 != 0) { +LAB_4: + uVar13 = uVar18 - 1; + if (((&HttpChars)[_Str2_00[uVar13]] & 0x20) == 0) break; + } +joined_r0x0001400c80d8: + do { + pbVar4 = _Str2_00; + uVar13 = uVar18; + if (uVar19 == 0) goto joined_r0x0001400c8110; + if (((&HttpChars)[*pbVar21] & 0x20) == 0) break; + pbVar21 = pbVar21 + 1; + uVar19 = uVar19 - 1; + } while( true ); + while (uVar19 = uVar1, uVar1 != 0) { + uVar1 = uVar19 - 1; + if (((&HttpChars)[pbVar21[uVar1]] & 0x20) == 0) break; + } +joined_r0x0001400c8110: + for (; uVar13 != 0; uVar13 = uVar13 - 1) { + if (((&HttpChars)[*pbVar4] & 2) != 0) { + *pbVar4 = *pbVar4 | 0x20; + } + pbVar4 = pbVar4 + 1; + } + iVar17 = 0; + *plVar14 = (longlong)_Str2_00; + iVar15 = 0; + *(uint *)(plVar14 + 2) = uVar18; + plVar14[1] = (longlong)pbVar21; + *(uint *)((longlong)plVar14 + 0x14) = uVar19; + if ((_Str2_00 == (byte *)0x0) || (uVar18 == 0)) { + iVar16 = 1; +LAB_7: + iVar11 = -0x3ffffff3; + } + else { + uVar12 = 0; + if (uVar19 != 0) { + do { + if ((pbVar21[uVar12] < 0xe) && ((0x2401U >> ((int)(char)pbVar21[uVar12] & 0x1fU) & 1) != 0)) + { + iVar16 = 3; + goto LAB_7; } - uVar6 = *puVar2; - pcVar5 = *(code **)(*(longlong *)(lVar27 + 0x1f8) + 0x88); - if (pcVar5 == UxTlConnectionControl) { - uVar31 = 0; - uVar30 = 0; - iVar17 = UxTlConnectionControl(uVar6,0x41,uVar4,lVar1,0,0); - } - else if (pcVar5 == UxSslConnectionControl) { - uVar31 = 0; - uVar30 = 0; - iVar17 = UxSslConnectionControl(uVar6,0x41,uVar4,lVar1,0,0); - } - else if (pcVar5 == UxDuoConnectionControl) { - uVar31 = 0; - uVar30 = 0; - iVar17 = UxDuoConnectionControl(); - } - else { - uVar31 = 0; - uVar30 = 0; - iVar17 = (*pcVar5)(uVar6,0x41,uVar4,lVar1,0,0); - } - if ((DAT_3 & 2) != 0) { - WPP_SF_D(0x419,0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,iVar17,uVar30,uVar31); - } - } - } - else { - local_c4 = 0x11; - lVar27 = local_b0; - iVar17 = local_c8; - } - } -LAB_4: - local_c8 = iVar17; - *param_4 = local_b8; - if (local_c4 != 0) { - if ((DAT_3 & 2) != 0) { - WPP_SF_qLqqqq(0x419,10,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids, - (undefined8 *)(lVar27 + 0x1f0),0x49,&local_c4,&local_c8,0,0); - } - uVar4 = *(undefined8 *)(lVar27 + 0x1f0); - pcVar5 = *(code **)(*(longlong *)(lVar27 + 0x1f8) + 0x88); - if (pcVar5 == UxTlConnectionControl) { - uVar16 = UxTlConnectionControl(uVar4,0x49); - } - else if (pcVar5 == UxSslConnectionControl) { - uVar16 = UxSslConnectionControl(uVar4,0x49); - } - else if (pcVar5 == UxDuoConnectionControl) { - uVar16 = UxDuoConnectionControl(); - } - else { - uVar16 = (*pcVar5)(uVar4,0x49,&local_c4,&local_c8,0,0); - } - if ((DAT_3 & 2) != 0) { - WPP_SF_D(0x419,0xb,&WPP_521b24e7d8113230b88800b18ee27299_Traceguids,uVar16); - } - } - *(undefined1 *)((ulonglong)*(uint *)(param_1 + 0x848) + 0x220 + param_1) = 0x29; - *param_5 = local_c4; - if ((DAT_0 & 0x40) != 0) { - WPP_SF_dD(0x40e,0x62,&WPP_35392aa6288d35088b5e7b5e64cc7a3b_Traceguids,local_c8,*param_4); - } - return local_c8; - while (uVar18 = (ulonglong)uVar23, uVar23 != 0) { -LAB_2: - uVar23 = (int)uVar18 - 1; - if (((&HttpChars)[_Str2_00[uVar23]] & 0x20) == 0) break; - } -joined_r0x0001400c7cf7: - do { - if (uVar25 == 0) goto LAB_5; - if (((&HttpChars)[*pbVar26] & 0x20) == 0) break; - pbVar26 = pbVar26 + 1; - uVar25 = uVar25 - 1; - } while( true ); - while (uVar25 = uVar23, uVar23 != 0) { - uVar23 = uVar25 - 1; - if (((&HttpChars)[pbVar26[uVar23]] & 0x20) == 0) break; - } -LAB_5: - uVar24 = (uint)uVar18; - uVar20 = uVar18; - pbVar19 = _Str2_00; - uVar23 = uVar24; - while (uVar23 != 0) { - if (((&HttpChars)[*pbVar19] & 2) != 0) { - *pbVar19 = *pbVar19 | 0x20; - } - pbVar19 = pbVar19 + 1; - uVar23 = (int)uVar20 - 1; - uVar20 = (ulonglong)uVar23; - } - iVar14 = 0; - *plVar3 = (longlong)_Str2_00; - iVar15 = 0; - *(uint *)(plVar3 + 2) = uVar24; - plVar3[1] = (longlong)pbVar26; - *(uint *)((longlong)plVar3 + 0x14) = uVar25; - if ((_Str2_00 == (byte *)0x0) || (uVar24 == 0)) { - iVar21 = 1; -LAB_6: - iVar17 = -0x3ffffff3; - } - else { - for (uVar20 = 0; (uint)uVar20 < uVar25; uVar20 = (ulonglong)((uint)uVar20 + 1)) { - if ((pbVar26[uVar20] < 0xe) && ((0x2401U >> ((int)(char)pbVar26[uVar20] & 0x1fU) & 1) != 0)) { - iVar21 = 3; - goto LAB_6; - } + uVar13 = (int)uVar12 + 1; + uVar12 = (ulonglong)uVar13; + } while (uVar13 < uVar19); } if ((*_Str2_00 != 0x3a) || - (((((uVar24 != 7 || - (iVar13 = strncmp(":method",(char *)_Str2_00,uVar18), iVar21 = 0, iVar17 = 0, iVar13 != 0 - )) && (((int)plVar3[2] != 7 || - (iVar13 = strncmp(":scheme",(char *)*plVar3,7), iVar21 = iVar15, iVar17 = 0, - iVar13 != 0)))) && - (((int)plVar3[2] != 5 || - (iVar13 = strncmp(":path",(char *)*plVar3,5), iVar21 = iVar15, iVar17 = iVar14, - iVar13 != 0)))) && - (((int)plVar3[2] != 10 || - (iVar13 = strncmp(":authority",(char *)*plVar3,10), iVar21 = iVar15, iVar17 = iVar14, - iVar13 != 0)))))) { - uVar18 = 0; - iVar21 = iVar15; - iVar17 = iVar14; - if (*(uint *)(plVar3 + 2) != 0) { + (((((uVar18 != 7 || + (iVar10 = strncmp(":method",(char *)_Str2_00,7), iVar16 = 0, iVar11 = 0, iVar10 != 0)) && + (((int)plVar14[2] != 7 || + (iVar10 = strncmp(":scheme",(char *)*plVar14,7), iVar16 = 0, iVar11 = 0, iVar10 != 0)))) + && (((int)plVar14[2] != 5 || + (iVar10 = strncmp(":path",(char *)*plVar14,5), iVar16 = iVar15, iVar11 = iVar17, + iVar10 != 0)))) && + (((int)plVar14[2] != 10 || + (iVar10 = strncmp(":authority",(char *)*plVar14,10), iVar16 = iVar15, iVar11 = iVar17, + iVar10 != 0)))))) { + uVar12 = 0; + iVar16 = iVar15; + iVar11 = iVar17; + if (*(uint *)(plVar14 + 2) != 0) { do { - if ((*(byte *)(uVar18 + *plVar3) < 0x3b) && - ((0x400000000002401U >> ((longlong)(char)*(byte *)(uVar18 + *plVar3) & 0x3fU) & 1) != 0 - )) { - iVar21 = 2; - goto LAB_6; + if ((*(byte *)(uVar12 + *plVar14) < 0x3b) && + ((0x400000000002401U >> ((longlong)(char)*(byte *)(uVar12 + *plVar14) & 0x3fU) & 1) != + 0)) { + iVar16 = 2; + goto LAB_7; } - uVar23 = (int)uVar18 + 1; - uVar18 = (ulonglong)uVar23; - } while (uVar23 < *(uint *)(plVar3 + 2)); - } - } - } - lVar27 = local_b0; - local_c4 = iVar21; - if (iVar17 < 0) goto LAB_4; - _Str2 = (char *)*plVar3; - iVar15 = (int)plVar3[2]; - local_c8 = iVar17; - iVar14 = HashCountedStringNoCaseA(*(undefined8 *)(local_b0 + 0x448),_Str2,iVar15); - uVar23 = iVar14 * 0x41c64e6d + 0x3039U >> 0x10 | iVar14 * 0x10dcd + 1U & 0xffff0000; - if (uVar23 == 0xd2571fdb) { - if ((iVar15 != 7) || (iVar15 = strncmp(":method",_Str2,7), iVar15 != 0)) goto LAB_7; - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = plVar3; - plVar11 = local_88; - plVar12 = local_80; - if (local_90 != (longlong *)0x0) { - local_c4 = 4; + uVar18 = (int)uVar12 + 1; + uVar12 = (ulonglong)uVar18; + } while (uVar18 < *(uint *)(plVar14 + 2)); + } + } + } + lVar20 = local_90; + local_b4 = iVar16; + if (iVar11 < 0) goto LAB_2; + _Str2 = (char *)*plVar14; + iVar15 = (int)plVar14[2]; + local_b8 = iVar11; + iVar11 = HashCountedStringNoCaseA(*(undefined8 *)(local_90 + 0x448),_Str2,iVar15); + uVar18 = iVar11 * 0x41c64e6d + 0x3039U >> 0x10 | iVar11 * 0x10dcd + 1U & 0xffff0000; + if (uVar18 == 0xd2571fdb) { + if ((iVar15 == 7) && (iVar11 = strncmp(":method",_Str2,7), iVar11 == 0)) { + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = plVar14; + plVar7 = local_78; + plVar8 = local_70; + if (local_80 != (longlong *)0x0) { + local_b4 = 4; LAB_8: - local_c8 = -0x3ffffd18; - iVar17 = local_c8; - goto LAB_4; - } + local_b8 = -0x3ffffd18; + iVar11 = local_b8; + goto LAB_2; + } + goto LAB_9; + } + } + else if (uVar18 == 0x22aa28cc) { + if ((iVar15 == 7) && (iVar11 = strncmp(":scheme",_Str2,7), iVar11 == 0)) { + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = plVar14; + plVar8 = local_70; + if (local_78 != (longlong *)0x0) { + local_b4 = 5; + goto LAB_8; + } + goto LAB_9; + } + } + else if (uVar18 == 0x8364ed5d) { + if ((iVar15 == 5) && (iVar11 = strncmp(":path",_Str2,5), iVar11 == 0)) { + plVar22 = plVar14; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + if (local_a0 != (longlong *)0x0) { + local_b4 = 6; + goto LAB_8; + } + goto LAB_9; + } + } + else if (uVar18 == 0x8e947973) { + if ((iVar15 == 10) && (iVar11 = strncmp(":authority",_Str2,10), iVar11 == 0)) { + plVar22 = local_a0; + plVar25 = plVar14; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + if (local_98 != (longlong *)0x0) { + local_b4 = 7; + goto LAB_8; + } + goto LAB_9; + } + } + else if (uVar18 == 0xa184117) { + if ((iVar15 == 4) && (iVar11 = strncmp("host",_Str2,4), iVar11 == 0)) { + if (local_b0 != 0xffffffff) { + local_b0 = local_b0 + 1; + } + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + if (local_b0 == 1) { + local_68 = plVar14; + } + goto LAB_9; + } + } + else if (uVar18 == 0x253f9d6e) { + if ((iVar15 == 6) && (iVar11 = strncmp("cookie",_Str2,6), iVar11 == 0)) { + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + if (local_ac != 0xffffffff) { + local_ac = local_ac + 1; + } + goto LAB_9; + } + } + else if (uVar18 == 0x358e428a) { + if ((iVar15 == 0x11) && (iVar11 = strncmp("transfer-encoding",_Str2,0x11), iVar11 == 0)) { + bVar5 = true; + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + goto LAB_9; + } + } + else if (uVar18 == 0xa8dce606) { + if ((iVar15 == 0xe) && (iVar11 = strncmp("content-length",_Str2,0xe), iVar11 == 0)) { + local_a8 = '\x01'; + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + goto LAB_9; + } + } + else if (((uVar18 == 0x993769e1) && (iVar15 == 0xd)) && + (iVar11 = strncmp("authorization",_Str2,0xd), iVar11 == 0)) { + if (local_70 != (longlong *)0x0) { + local_b4 = 8; + goto LAB_8; + } + local_b8 = UlpParseAuthenticationHeader(plVar14); + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = plVar14; + if (local_b8 < 0) { + local_b4 = 8; + iVar11 = local_b8; + goto LAB_2; + } + goto LAB_9; + } + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + if ((*(char *)(lVar20 + 0x3a8) == '\0') || (uVar18 != 0x58408857)) { + if (uVar18 == 0x34291785) { + if (((int)plVar14[2] == 10) && + (iVar11 = strncmp("connection",(char *)*plVar14,10), plVar22 = local_a0, plVar25 = local_98 + , plVar6 = local_80, plVar7 = local_78, plVar8 = local_70, iVar11 == 0)) { + local_b4 = 9; + goto LAB_10; + } + } + else if (uVar18 == 0xcfcde686) { + if (((int)plVar14[2] == 10) && + (iVar11 = strncmp("keep-alive",(char *)*plVar14,10), plVar22 = local_a0, plVar25 = local_98 + , plVar6 = local_80, plVar7 = local_78, plVar8 = local_70, iVar11 == 0)) { + local_b4 = 10; + goto LAB_10; + } + } + else if (uVar18 == 0x207ef02b) { + if (((int)plVar14[2] == 7) && + (iVar11 = strncmp("upgrade",(char *)*plVar14,7), plVar22 = local_a0, plVar25 = local_98, + plVar6 = local_80, plVar7 = local_78, plVar8 = local_70, iVar11 == 0)) { + local_b4 = 0xb; +LAB_10: + local_b8 = -0x3ffffff0; + iVar11 = local_b8; + goto LAB_2; + } + } + else if (((uVar18 == 0xe8829e3) && ((int)plVar14[2] == 0x10)) && + (iVar11 = strncmp("proxy-connection",(char *)*plVar14,0x10), plVar22 = local_a0, + plVar25 = local_98, plVar6 = local_80, plVar7 = local_78, plVar8 = local_70, iVar11 == 0 + )) { + local_b4 = 0xc; + goto LAB_10; + } + } + else if ((((int)plVar14[2] == 0x10) && + (iVar11 = _strnicmp("X-Correlation-ID",(char *)*plVar14,0x10), plVar22 = local_a0, + plVar25 = local_98, plVar6 = local_80, plVar7 = local_78, plVar8 = local_70, iVar11 == 0) + ) && ((DAT_11 & 1) != 0)) { + uVar18 = *(uint *)((longlong)plVar14 + 0x14); + if (8000 < *(uint *)((longlong)plVar14 + 0x14)) { + uVar18 = 8000; + } + uStack_54 = 0; + local_58 = CONCAT22((short)uVar18,(short)uVar18); + lVar20 = plVar14[1]; + uStack_50._0_4_ = (undefined4)lVar20; + uStack_50._4_4_ = (undefined4)((ulonglong)lVar20 >> 0x20); + uStack_44 = 0; + uStack_40 = (undefined4)uStack_50; + uStack_3c = uStack_50._4_4_; + uStack_50 = lVar20; + local_48 = local_58; + WPP_SF_qi_CTDSTR_(); + plVar22 = local_a0; + plVar25 = local_98; + plVar6 = local_80; + plVar7 = local_78; + plVar8 = local_70; + } LAB_9: - local_80 = plVar12; - local_88 = plVar11; - local_90 = plVar10; - local_98 = plVar29; - local_a0 = plVar9; - uVar22 = (ulonglong)local_c0; - } - else { - if (uVar23 == 0x22aa28cc) { - if ((iVar15 != 7) || (iVar15 = strncmp(":scheme",_Str2,7), iVar15 != 0)) goto LAB_7; - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = plVar3; - plVar12 = local_80; - if (local_88 != (longlong *)0x0) { - local_c4 = 5; - goto LAB_8; - } - goto LAB_9; - } - if (uVar23 == 0x8364ed5d) { - if ((iVar15 != 5) || (iVar15 = strncmp(":path",_Str2,5), iVar15 != 0)) goto LAB_7; - plVar9 = local_a0; - plVar29 = plVar3; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - if (local_98 != (longlong *)0x0) { - local_c4 = 6; - goto LAB_8; - } - goto LAB_9; - } - if (uVar23 == 0x8e947973) { - if ((iVar15 != 10) || (iVar15 = strncmp(":authority",_Str2,10), iVar15 != 0)) - goto LAB_7; - plVar9 = plVar3; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - if (local_a0 != (longlong *)0x0) { - local_c4 = 7; - goto LAB_8; - } - goto LAB_9; - } - if (uVar23 != 0xa184117) { - if (uVar23 == 0x253f9d6e) { - if ((iVar15 == 6) && (iVar15 = strncmp("cookie",_Str2,6), iVar15 == 0)) { - uVar20 = (ulonglong)local_bc; - uVar22 = (ulonglong)local_c0; - if (local_bc != 0xffffffff) { - local_bc = local_bc + 1; - uVar20 = (ulonglong)local_bc; - } - goto LAB_10; - } - } - else { - if (uVar23 != 0x358e428a) { - if (uVar23 == 0xa8dce606) { - if ((iVar15 != 0xe) || (iVar15 = strncmp("content-length",_Str2,0xe), iVar15 != 0)) - goto LAB_7; - bVar8 = true; - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - } - else { - if (((uVar23 != 0x993769e1) || (iVar15 != 0xd)) || - (iVar15 = strncmp("authorization",_Str2,0xd), iVar15 != 0)) goto LAB_7; - if (local_80 != (longlong *)0x0) { - local_c4 = 8; - goto LAB_8; - } - local_c8 = UlpParseAuthenticationHeader(plVar3); - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = plVar3; - if (local_c8 < 0) { - local_c4 = 8; - iVar17 = local_c8; - goto LAB_4; - } - } - goto LAB_9; - } - if ((iVar15 == 0x11) && (iVar15 = strncmp("transfer-encoding",_Str2,0x11), iVar15 == 0)) { - bVar7 = true; - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - goto LAB_9; - } - } -LAB_7: - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - if ((*(char *)(lVar27 + 0x3a8) == '\0') || (uVar23 != 0x58408857)) { - if (uVar23 == 0x34291785) { - if (((int)plVar3[2] == 10) && - (iVar15 = strncmp("connection",(char *)*plVar3,10), plVar9 = local_a0, - plVar29 = local_98, plVar10 = local_90, plVar11 = local_88, plVar12 = local_80, - iVar15 == 0)) { - local_c4 = 9; - goto LAB_11; - } - } - else if (uVar23 == 0xcfcde686) { - if (((int)plVar3[2] == 10) && - (iVar15 = strncmp("keep-alive",(char *)*plVar3,10), plVar9 = local_a0, - plVar29 = local_98, plVar10 = local_90, plVar11 = local_88, plVar12 = local_80, - iVar15 == 0)) { - local_c4 = 10; - goto LAB_11; - } - } - else if (uVar23 == 0x207ef02b) { - if (((int)plVar3[2] == 7) && - (iVar15 = strncmp("upgrade",(char *)*plVar3,7), plVar9 = local_a0, plVar29 = local_98, - plVar10 = local_90, plVar11 = local_88, plVar12 = local_80, iVar15 == 0)) { - local_c4 = 0xb; -LAB_11: - local_c8 = -0x3ffffff0; - iVar17 = local_c8; - goto LAB_4; - } - } - else if (((uVar23 == 0xe8829e3) && ((int)plVar3[2] == 0x10)) && - (iVar15 = strncmp("proxy-connection",(char *)*plVar3,0x10), plVar9 = local_a0, - plVar29 = local_98, plVar10 = local_90, plVar11 = local_88, plVar12 = local_80, - iVar15 == 0)) { - local_c4 = 0xc; - goto LAB_11; - } - } - else if ((((int)plVar3[2] == 0x10) && - (iVar15 = _strnicmp("X-Correlation-ID",(char *)*plVar3,0x10), plVar9 = local_a0, - plVar29 = local_98, plVar10 = local_90, plVar11 = local_88, plVar12 = local_80, - iVar15 == 0)) && ((DAT_12 & 1) != 0)) { - uVar23 = *(uint *)((longlong)plVar3 + 0x14); - if (8000 < *(uint *)((longlong)plVar3 + 0x14)) { - uVar23 = 8000; - } - uStack_64 = 0; - local_68 = CONCAT22((short)uVar23,(short)uVar23); - lVar27 = plVar3[1]; - uStack_60._0_4_ = (undefined4)lVar27; - uStack_60._4_4_ = (undefined4)((ulonglong)lVar27 >> 0x20); - uStack_54 = 0; - uStack_50 = (undefined4)uStack_60; - uStack_4c = uStack_60._4_4_; - uStack_60 = lVar27; - local_58 = local_68; - WPP_SF_qi_CTDSTR_(); - plVar9 = local_a0; - plVar29 = local_98; - plVar10 = local_90; - plVar11 = local_88; - plVar12 = local_80; - } - goto LAB_9; - } - if ((iVar15 != 4) || (iVar15 = strncmp("host",_Str2,4), iVar15 != 0)) goto LAB_7; - if (local_c0 != 0xffffffff) { - local_c0 = local_c0 + 1; - } - uVar22 = (ulonglong)local_c0; - if (local_c0 == 1) { - local_78 = plVar3; - } - } - uVar20 = (ulonglong)local_bc; -LAB_10: - uVar18 = (ulonglong)(local_a8 + 1); - goto LAB_1; + local_70 = plVar8; + local_78 = plVar7; + local_80 = plVar6; + local_98 = plVar25; + local_a0 = plVar22; + local_88 = local_88 + 1; + uVar12 = (ulonglong)local_88; + plVar14 = local_a0; + plVar22 = local_98; + uVar18 = local_ac; + uVar19 = local_b0; + if (*(uint *)(param_2 + 1) <= local_88) goto LAB_5; + goto LAB_3; } ``` ## WPP_SF_qII ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.11| |i_ratio|0.02| |m_ratio|0.27| |b_ratio|0.21| |match_types|Implied Match| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |`name`|WPP_SF_qII|UlpReferenceBuffers| |`fullname`|WPP_SF_qII|UlpReferenceBuffers| |`refcount`|180|2| |`length`|70|517| |`called`|FastWppTraceMessage|NTOSKRNL.EXE::ExAllocatePool3
NTOSKRNL.EXE::ExFreePoolWithTag
UlBugCheckEx
WPP_SF_D
WPP_SF_qII
memmove| |`calling`|

Expand for full list:
FUN_140173cfc
FUN_140174b6c
FUN_140179aec
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlRoutingIp
HttppParseUrlScheme
QkAddPairToTable
QkComputeRequiredInsertCount
QkDecodeData
QkDecodeDuplicate

QkDecodeLiteral
QkDecodeLiteralEmbeddedLength
QkDecodeOrdinal
QkDecodeSetDynamicTableCapacity
QkDerefByOrdinal
QkEncodeData
QkEncodeDuplicate
QkEntryNeedsDuplicate
QkProcessInsertCountIncrement
QkRecalculateDrainOrdinal
QkRefByOrdinal
QkRelativeToAbsolute
QkRelativeToAbsoluteControl
QkSearchTableByOrdinal
QkSetMaxBlockedStreams
QkSetMaxRefListCount
QkTrimTable
UcAllocateConnection
UcAllocateCredential
UcCaptureCredentialParameters
UcCloseConnection
UcCloseCredential
UcStreamIdealBacklogEvent
UcpAllocateClientSession
UcpGetStreamHeaderSetToDeliver
UcpStreamSendCompletion
UlBindConfigGroupToServerSession
UlBuildFastRangeCacheMdlChain
UlBuildParsedHeaderFastRangeResponse
UlCheckCacheControlHeaders
UlCleanupHttpConnection
UlCopyEntityBodyToBuffer
UlCopyRequestToBuffer
UlCopyRequestToIrp
UlCreateConfigGroup
UlDeepCopyParsedHeaders
UlEnumerateRequestQueues
UlEnumerateServerSessions
UlEnumerateUrlGroups
UlEtwEvaluateFilterForRequestConnection
UlFastReceiveHttpRequest
UlFlushCacheForRemoveUrl
UlGetCGroupForRequest
UlGetConfigGroupInfoForSanitizedUrl
UlGetServerSessionFromId
UlNotifyServerSessionAddition
UlParseAcceptHeaderMatch
UlPurgeConsumer
UlPurgeZombieConnections
UlRegisterConsumerCallback
UlRemoveAllUrlsFromConfigGroup
UlRemoveSendIrpCancelRoutine
UlResumeParsing
UlScStartCounters
UlSendCachedResponse
UlSetConnectionsProperty
UlSetReceiveEntityBodyIrpCancelRoutine
UlSetRequestQueueSecurityDescriptor
UlSetSendIrpCancelRoutine
UlStartHttpIdealBacklogFastForwarderNotification
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlpAdjustBuffers
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpCleanupCoupling
UlpCompleteFastForwardSend
UlpCompleteWaitForDisconnects
UlpCountRequestsCoupling
UlpCreateHttpRequest
UlpDeleteClientContextHandle
UlpDeliverHttpRequest
UlpDeliverRequestStageInspection
UlpDeliverRequestStagePolicies
UlpEnumerateUrlGroupsInServerSession
UlpFlushCouplingRequests
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFlushWaitForDisconnects
UlpFreeHttpRequest
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpInsertBuffer
UlpInvokeHeaderHandlers
UlpLockRequestQueueAndCoupling
UlpMergeBuffers
UlpMergeCookiePairs
UlpMethodToVerb
UlpNotifyEdgePolicyChange
UlpParseContentLengthHeader
UlpParseLWS
UlpParseNextRequest
UlpRebuildResponseBody
UlpRedeliverFlushedRequests
UlpRemoveRequestFromLane
UlpRetrieveRequest
UlpSendResponseToExtension
UlpSspiAuthenticationHandler
UlpSynchronizeLanesWorker
UlpTreeFindRegistrationNode
UlpTreeFindReservationNode
UlpUnbindCoupling
UlpUpdatePerfCountersOnCacheSend
UlpValidateHttpHeaderName
UlpValidateHttpHeaderValue
UxCreateFileCacheEntry
UxPodTryAttachThread
UxQuicConnectionGetStatsV1
UxQuicListenerEndpointLookup
UxQuicLoadCertificateComplete
UxQuicStreamAddHeadersOrTrailersToTracker
UxQuicStreamPushInjectCreateContext
UxQuicWaitForConnectionDisconnect
UxReadCompleteFileEntry
UxReadFileEntry
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslConnectionEndpointLookupHandler
UxSslCopyErrorHeaders
UxSslLoadCertificateComplete
UxSslLogEndpointEvent
UxSslParseSni
UxSslReplaceEndpointConfig
UxTpCleanupTransmitQueue
UxTryCopyFromMode
UxTryCopyToMode
UxTryCopyUserMemoryOld
UxTryProbeAndCopyFromMode
UxTryProbeAndCopyToMode
UxpQuicAllocateConfigurationContext
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicConnectionOpen
UxpQuicParseDataFrame
UxpQuicStreamCalculateQuicBufferCount
UxpQuicStreamProcessClientHeaderSet
UxpQuicStreamProcessServerHeaderSet
UxpQuicStreamQuicDeclarePushPromise
UxpQuicUpdateEncoderSettings
UxpSslCompareTableNodes
UxpSslEnumerateEndpointConfigs
UxpSslGetClientHello
UxpSslInitiateAscHandler
UxpSslReceiver
UxpSslSetClientCertPolicy
UxpSslWaitForAscHandler
UxpSslWaitForSenderSuspendHandler

|UlpParseNextRequest| |paramcount|0|0| |`address`|1401dc850|140097880| |`sig`|undefined WPP_SF_qII(void)|undefined UlpReferenceBuffers(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qII Called Diff ```diff --- WPP_SF_qII called +++ UlpReferenceBuffers called @@ -1 +1,6 @@ -FastWppTraceMessage +NTOSKRNL.EXE::ExAllocatePool3 +NTOSKRNL.EXE::ExFreePoolWithTag +UlBugCheckEx +WPP_SF_D +WPP_SF_qII +memmove ``` ### WPP_SF_qII Calling Diff ```diff --- WPP_SF_qII calling +++ UlpReferenceBuffers calling @@ -1,102 +0,0 @@ -FUN_140173cfc -FUN_140174b6c -FUN_140179aec -HttppParseUrlPath -HttppParseUrlPort -HttppParseUrlRoutingIp -HttppParseUrlScheme -QkAddPairToTable -QkComputeRequiredInsertCount -QkDecodeData -QkDecodeDuplicate -QkDecodeLiteral -QkDecodeLiteralEmbeddedLength -QkDecodeOrdinal -QkDecodeSetDynamicTableCapacity -QkDerefByOrdinal -QkEncodeData -QkEncodeDuplicate -QkEntryNeedsDuplicate -QkProcessInsertCountIncrement -QkRecalculateDrainOrdinal -QkRefByOrdinal -QkRelativeToAbsolute -QkRelativeToAbsoluteControl -QkSearchTableByOrdinal -QkSetMaxBlockedStreams -QkSetMaxRefListCount -QkTrimTable -UcAllocateConnection -UcAllocateCredential -UcCaptureCredentialParameters -UcCloseConnection -UcCloseCredential -UcStreamIdealBacklogEvent -UcpAllocateClientSession -UcpGetStreamHeaderSetToDeliver -UcpStreamSendCompletion -UlBindConfigGroupToServerSession -UlBuildFastRangeCacheMdlChain -UlBuildParsedHeaderFastRangeResponse -UlCheckCacheControlHeaders -UlCleanupHttpConnection -UlCopyEntityBodyToBuffer -UlCopyRequestToBuffer -UlCopyRequestToIrp -UlCreateConfigGroup -UlDeepCopyParsedHeaders -UlEnumerateRequestQueues -UlEnumerateServerSessions -UlEnumerateUrlGroups -UlEtwEvaluateFilterForRequestConnection -UlFastReceiveHttpRequest -UlFlushCacheForRemoveUrl -UlGetCGroupForRequest -UlGetConfigGroupInfoForSanitizedUrl -UlGetServerSessionFromId -UlNotifyServerSessionAddition -UlParseAcceptHeaderMatch -UlPurgeConsumer -UlPurgeZombieConnections -UlRegisterConsumerCallback -UlRemoveAllUrlsFromConfigGroup -UlRemoveSendIrpCancelRoutine -UlResumeParsing -UlScStartCounters -UlSendCachedResponse -UlSetConnectionsProperty -UlSetReceiveEntityBodyIrpCancelRoutine -UlSetRequestQueueSecurityDescriptor -UlSetSendIrpCancelRoutine -UlStartHttpIdealBacklogFastForwarderNotification -UlUnlinkHttpRequest -UlUnlinkRequestFromRequestQueue -UlpAdjustBuffers -UlpBuildEdgePolicyNotifyListForConfigGroup -UlpCleanupCoupling -UlpCompleteFastForwardSend -UlpCompleteWaitForDisconnects -UlpCountRequestsCoupling -UlpCreateHttpRequest -UlpDeleteClientContextHandle -UlpDeliverHttpRequest -UlpDeliverRequestStageInspection -UlpDeliverRequestStagePolicies -UlpEnumerateUrlGroupsInServerSession -UlpFlushCouplingRequests -UlpFlushHttpPushList -UlpFlushPendingConsumerIo -UlpFlushPendingRequests -UlpFlushWaitForDisconnects -UlpFreeHttpRequest -UlpHandleRequest -UlpHttpIdealBacklogFastForwarderNotification -UlpInsertBuffer -UlpInvokeHeaderHandlers -UlpLockRequestQueueAndCoupling -UlpMergeBuffers -UlpMergeCookiePairs -UlpMethodToVerb -UlpNotifyEdgePolicyChange -UlpParseContentLengthHeader -UlpParseLWS @@ -104,54 +1,0 @@ -UlpRebuildResponseBody -UlpRedeliverFlushedRequests -UlpRemoveRequestFromLane -UlpRetrieveRequest -UlpSendResponseToExtension -UlpSspiAuthenticationHandler -UlpSynchronizeLanesWorker -UlpTreeFindRegistrationNode -UlpTreeFindReservationNode -UlpUnbindCoupling -UlpUpdatePerfCountersOnCacheSend -UlpValidateHttpHeaderName -UlpValidateHttpHeaderValue -UxCreateFileCacheEntry -UxPodTryAttachThread -UxQuicConnectionGetStatsV1 -UxQuicListenerEndpointLookup -UxQuicLoadCertificateComplete -UxQuicStreamAddHeadersOrTrailersToTracker -UxQuicStreamPushInjectCreateContext -UxQuicWaitForConnectionDisconnect -UxReadCompleteFileEntry -UxReadFileEntry -UxSslCaptureCertConfig -UxSslCaptureErrorHeaders -UxSslConnectionEndpointLookupHandler -UxSslCopyErrorHeaders -UxSslLoadCertificateComplete -UxSslLogEndpointEvent -UxSslParseSni -UxSslReplaceEndpointConfig -UxTpCleanupTransmitQueue -UxTryCopyFromMode -UxTryCopyToMode -UxTryCopyUserMemoryOld -UxTryProbeAndCopyFromMode -UxTryProbeAndCopyToMode -UxpQuicAllocateConfigurationContext -UxpQuicConnectionHandleBlockedDecodeTracker -UxpQuicConnectionOpen -UxpQuicParseDataFrame -UxpQuicStreamCalculateQuicBufferCount -UxpQuicStreamProcessClientHeaderSet -UxpQuicStreamProcessServerHeaderSet -UxpQuicStreamQuicDeclarePushPromise -UxpQuicUpdateEncoderSettings -UxpSslCompareTableNodes -UxpSslEnumerateEndpointConfigs -UxpSslGetClientHello -UxpSslInitiateAscHandler -UxpSslReceiver -UxpSslSetClientCertPolicy -UxpSslWaitForAscHandler -UxpSslWaitForSenderSuspendHandler ``` ### WPP_SF_qII Diff ```diff --- WPP_SF_qII +++ UlpReferenceBuffers @@ -1,12 +1,68 @@ -void WPP_SF_qII(undefined2 param_1,undefined2 param_2,undefined8 param_3,undefined8 param_4) +undefined8 UlpReferenceBuffers(longlong param_1,longlong param_2) { - undefined8 local_res20; + int *piVar1; + int iVar2; + ushort uVar3; + undefined8 uVar4; + void *pvVar5; + ushort uVar6; + undefined8 uVar7; - local_res20 = param_4; - FastWppTraceMessage(param_1,param_2,param_3,&local_res20,8,&stack0x00000028,8,&stack0x00000030,8,0 - ); - return; + uVar7 = 0; + if ((DAT_0 & 1) != 0) { + if (param_1 == 0) { + uVar4 = 0; + } + else { + uVar4 = *(undefined8 *)(param_1 + 0x40); + } + WPP_SF_qII(0x408,0x10c,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,param_1,uVar4,param_2); + } + uVar3 = *(ushort *)(param_1 + 0x640); + if (uVar3 <= *(ushort *)(param_1 + 0x642)) { + if (UxKirRefBufferOverflowCheck == '\0') { + pvVar5 = (void *)ExAllocatePool3(0x42,(ulonglong)uVar3 * 8 + 0x28,0x52526c55, + &UxLowPriorityPool,1); + if (pvVar5 == (void *)0x0) goto LAB_1; + memmove(pvVar5,*(void **)(param_1 + 0x648),(ulonglong)*(ushort *)(param_1 + 0x642) << 3); + if (1 < *(ushort *)(param_1 + 0x640)) { + ExFreePoolWithTag(*(undefined8 *)(param_1 + 0x648),0); + } + *(short *)(param_1 + 0x640) = *(short *)(param_1 + 0x640) + 5; + *(void **)(param_1 + 0x648) = pvVar5; + } + else { + uVar6 = uVar3 + 5; + if (uVar6 < uVar3) goto LAB_1; + pvVar5 = (void *)ExAllocatePool3(0x42,(ulonglong)uVar6 << 3,0x52526c55,&UxLowPriorityPool,1); + if (pvVar5 == (void *)0x0) goto LAB_1; + memmove(pvVar5,*(void **)(param_1 + 0x648),(ulonglong)*(ushort *)(param_1 + 0x642) << 3); + if (1 < *(ushort *)(param_1 + 0x640)) { + ExFreePoolWithTag(*(undefined8 *)(param_1 + 0x648),0); + } + *(ushort *)(param_1 + 0x640) = uVar6; + *(void **)(param_1 + 0x648) = pvVar5; + } + } + piVar1 = (int *)(param_2 + 0x20); + *(longlong *)(*(longlong *)(param_1 + 0x648) + (ulonglong)*(ushort *)(param_1 + 0x642) * 8) = + param_2; + *(short *)(param_1 + 0x642) = *(short *)(param_1 + 0x642) + 1; + LOCK(); + iVar2 = *piVar1; + *piVar1 = *piVar1 + 1; + UNLOCK(); + if ((UxDebugCheckRefcount != '\0') && (iVar2 + 1 < 0)) { + /* WARNING: Subroutine does not return */ + UlBugCheckEx(3,piVar1,10,(longlong)(iVar2 + 1)); + } + uVar7 = 1; +LAB_1: + if ((DAT_0 & 1) != 0) { + WPP_SF_D(0x408,0x10d,&WPP_3202502b348434d3ab87bbca55836d9f_Traceguids,uVar7); + } + return uVar7; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## UxSslConnectionControl ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxSslConnectionControl|UxSslConnectionControl| |fullname|UxSslConnectionControl|UxSslConnectionControl| |`refcount`|110|106| |length|1227|1227| |called|

Expand for full list:
NTOSKRNL.EXE::ExAcquirePushLockSharedEx
NTOSKRNL.EXE::ExReleasePushLockSharedEx
NTOSKRNL.EXE::KeEnterCriticalRegion
NTOSKRNL.EXE::KeLeaveCriticalRegion
UlpQueryChannelBindTokenFromConnection
UxSslGetAltSvcInfo
UxSslGetCertInfo
UxSslGetCertInfoOld
UxSslGetProperties
UxSslGetTlsCipherInfo
UxSslGetTlsClientHello

UxSslGetTokenBinding
UxSslRetrieveChannelBindingToken
UxSslRetrieveClientCertificate
UxSslSetTokenBinding
UxSslVerifyRequestHost
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslQuerySni
WPP_SF_D
WPP_SF_qLqqqq
_guard_dispatch_icall

| |`calling`|

Expand for full list:
FUN_140177384
FUN_14017dad4
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlParsePushHeaderPairs
UlParseRequestHeaderPairs
UlQueryChannelBindToken

UlReceiveClientCertIoctl
UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_14016e49c::caseD_b

Expand for full list:
FUN_14017757e
FUN_14017dd94
UcCreateClientStreamIoctl
UcQueryClientStreamProperty
UlCheckRawResponseCompatibility
UlDeclarePushIoctl
UlGetQuicCreationStatsV2Size
UlGetTransportIdleConnectionTimeout
UlParsePushHeaderPairs
UlQueryChannelBindToken
UlReceiveClientCertIoctl

UlSendCachedResponse
UlSetHttpConnectionTokenBinding
UlSetTransportIdleConnectionTimeout
UlpCompleteLogRecordW3C
UlpDeliverRequestStagePolicies
UlpHkeAcquireQoS
UlpInitErrorLogInfo
UlpInitializeRequestSizingInfo
UlpInitializeRequestTimings
UlpLogErrorResposeSendEvent
UxDuoAttachConnection
UxDuoExecuteDetach
UxDuoExecuteIoReady
UxDuoExecuteRetrieveClientCert
UxDuoSetTokenBinding
UxSslAttachConnection
UxpTpSetFlowOnConnection
switchD_14016e75c::caseD_b

Expand for full list:
FUN_140170034
HkAddPairToTable
HkDecodeLiteral
HkEncode
HkEncodeString
HkExpandStorage
HkSearchTableByNameValue
HkTrimTable
HttpCopyUrl
HttpUnescapePercentHexEncoding
HttppPopCharAbsPathUtf8

QkDecodeControl
QkDecodeData
QkEncodeLiteral
QkEncodeString
QkEncodeStringPrefix
QkExpandStorage
QkResetStorage
UcSetStreamReceiveState
UcStreamTimeout
UcpCopyClientSessionProcessesInfo
UlCopyAllCacheEntryInfo
UlCopyContentType
UlCopyQosSettingInfo
UlDeliverEntityBody
UlDisableBundleTimer
UlEnableBundleTimer
UlFastReceiveHttpRequest
UlGenerateMultipleKnownHeadersOld
UlGenerateSubdomainWildcardUrl
UlGenerateTransferChunkingChunks
UlGetServerSessionProperty
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySettingConfiguration
UlReadFragmentFromCache
UlResetBundleTimer
UlScGetGlobalCounters
UlScGetSiteCounters
UlStopRequestQueueTimer
UlUpdateClientStreamReceiveLimit
UlpCopyRegisteredUrl
UlpCopyRequestQueueProcessesInfo
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpFindWSToken
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpMergeSlicesToCache
UlpParseNextRequest
UlpSynchronizeLanesWorker
UxDuoAllocateStream
UxDuoExecuteRunnerCompletion
UxGetOutputBufferForMethodNeither
UxQuicBufferInitialize
UxQuicConnectionTimeout
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslConnectionTimeout
UxSslParseSni
UxSslQueueReceiverWorkItemEx
UxSslSetEndpointLookupState
UxTlCleanupConnection
UxTlDisconnectEvent
UxWfpConnectionClassify
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicParseAndCopyDataIndication
UxpQuicStreamAbortLocked
UxpQuicStreamShutdownComplete
UxpSslCleanupConnection
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGetAlpnExtension
UxpSslLogHandshakeFailure
UxpSslPostReceiver
UxpSslSetConnectionState

Expand for full list:
FUN_1401702f4
HkAddPairToTable
HkDecodeLiteral
HkEncode
HkEncodeString
HkExpandStorage
HkSearchTableByNameValue
HkTrimTable
HttpCopyUrl
HttpUnescapePercentHexEncoding
HttppPopCharAbsPathUtf8

QkDecodeControl
QkDecodeData
QkEncodeLiteral
QkEncodeString
QkEncodeStringPrefix
QkExpandStorage
QkResetStorage
UcSetStreamReceiveState
UcStreamTimeout
UcpCopyClientSessionProcessesInfo
UlCopyAllCacheEntryInfo
UlCopyContentType
UlCopyQosSettingInfo
UlDeliverEntityBody
UlDisableBundleTimer
UlEnableBundleTimer
UlFastReceiveHttpRequest
UlGenerateMultipleKnownHeadersOld
UlGenerateSubdomainWildcardUrl
UlGenerateTransferChunkingChunks
UlGetServerSessionProperty
UlParseRequestHeaderPairs
UlQueryConfigGroupProperty
UlQueryRequestProperty
UlQuerySettingConfiguration
UlReadFragmentFromCache
UlResetBundleTimer
UlScGetGlobalCounters
UlScGetSiteCounters
UlStopRequestQueueTimer
UlUpdateClientStreamReceiveLimit
UlpCopyRegisteredUrl
UlpCopyRequestQueueProcessesInfo
UlpCreateFastForwardDataContext
UlpCreateFastForwardDataContextBuffer
UlpFindWSToken
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpMergeSlicesToCache
UlpParseNextRequest
UlpSynchronizeLanesWorker
UxDuoAllocateStream
UxDuoExecuteRunnerCompletion
UxGetOutputBufferForMethodNeither
UxQuicBufferInitialize
UxQuicConnectionTimeout
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStreamAbort
UxSslConnectionTimeout
UxSslParseSni
UxSslQueueReceiverWorkItemEx
UxSslSetEndpointLookupState
UxTlCleanupConnection
UxTlDisconnectEvent
UxWfpConnectionClassify
UxpQuicConnectionHandleBlockedDecodeTracker
UxpQuicParseAndCopyDataIndication
UxpQuicStreamAbortLocked
UxpQuicStreamShutdownComplete
UxpSslCleanupConnection
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointThrottleHandler
UxpSslEndpointWaitForThrottleHandler
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslGetAlpnExtension
UxpSslLogHandshakeFailure
UxpSslPostReceiver
UxpSslSetConnectionState

| |paramcount|0|0| |address|1401dd1c8|1401dd1c8| |sig|undefined WPP_SF_qLd(void)|undefined WPP_SF_qLd(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_qLd Calling Diff ```diff --- WPP_SF_qLd calling +++ WPP_SF_qLd calling @@ -1 +1 @@ -FUN_140170034 +FUN_1401702f4 @@ -32,0 +33 @@ +UlParseRequestHeaderPairs ``` ## NTOSKRNL.EXE::ExFreePoolWithTag ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|ExFreePoolWithTag|ExFreePoolWithTag| |fullname|NTOSKRNL.EXE::ExFreePoolWithTag|NTOSKRNL.EXE::ExFreePoolWithTag| |`refcount`|602|603| |length|0|0| |called||| |`calling`|

Expand for full list:
DestroyAggregateSession
DestroyEventEntry
FUN_14003ddae
FUN_14004cf67
FUN_14016d35f
FUN_14016db4c
FUN_14016db73
FUN_14016dbcc
FUN_14016ddfe
FUN_140173e2c
FUN_140174b6c

FUN_140178df2
FUN_140179174
FUN_14017a948
FUN_14017a977
FUN_14017aa43
FUN_14017bcbc
FUN_14017cb64
FUN_14017dd20
FUN_14017e3e0
FUN_14017eef6
FastWppTraceMessage
HttpNormalizeNamedHost
HttpParseUrl
HttppFixParsedUrl
HttppNormalizePath
HttppRebuildFixedUrl
InitializeTelemetryAssertsKM
InsertEventEntryInLookUpTable
PplDestroyLookasideList
PplpCreateLookasideListEx
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcFreeStream
UcSendHeadersClientStreamFastIo
UcStreamDestroyHeaderBuffer
UcStreamFreeReceiveBuffer
UcStreamFreeSendTracker
UcpFreeClientSessionContext
UcpGetSendHeadersPairs
UcpStreamSendHeadersCompletionCommon
UlAddFragmentToCache
UlAddUrlToConfigGroup
UlAdjustRangesToContentSize
UlAiFreeAddressInformation
UlAllocateCacheEntry
UlAllocateWideString
UlAppendHeaderValue
UlCGRebuildHashTable
UlCanSatisfyRangesFromCache
UlCaptureCurrentProcessIdentity
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlCleanupAuthInfo
UlCleanupConfigGroupInfo
UlCleanupHttpConnection
UlCleanupRangeCacheTracker
UlCleanupSecurityContext
UlCleanupSecurityDescriptor
UlCloseLogFile
UlComputeMultipleKnownHeaderSize
UlConfigLogging
UlContentRangeHeaderHandler
UlCopyAuthConfig
UlCreateAuthCache
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlDeleteConnectionCountEntry
UlDereferenceAlternateCredential
UlDestroyCapturedResponse
UlDestroyLogDataBufferWorker
UlDestroySliceTracker
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateFailure
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFindUrlGroupId
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlFreeAuthCache
UlFreeAuthConfig
UlFreeAuthInfo
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeCapturedProcessIdentity
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreePerNode
UlFreeRequestQueue
UlFreeResponseInfoParsedElements
UlFreeServerSession
UlFreeServiceNameContainer
UlFreeUnknownCodingList
UlFreeWideString
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeBuilderCleanup
UlHkeNotifyCleanupClientContext
UlIsAuthChangeNeededOld
UlLogHttpError
UlParseCompareUriWithRequestUri
UlPmHotAddAbort
UlPmStopModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlPrepareUrlIoctl
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlReplaceHeaderValue
UlResponseInfoParsing
UlResumeParsing
UlScFreeEntry
UlScStopFacet
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlStartConfigGroupFacet
UlStopConfigGroupFacet
UlStopNamespaceFacet
UlStopUriCacheFacet
UlUnlinkUriCacheEntry
UlUpdateAuthConfig
UlpAddIpAddressToList
UlpAllocateAuthCacheEntry
UlpAllocateConfigGroupObject
UlpAllocateServerSession
UlpBasicAuthenticationHandler
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureDigestParams
UlpCleanupLoggingConfig
UlpCleanupLoggingInfo
UlpCleanupPolicyTable
UlpCleanupTimerUnit
UlpCleanupUserTokenWorker
UlpCloseLogFileWorker
UlpCompleteAuthInfo
UlpCompleteCacheSliceBuildWorker
UlpCompleteLogRecordETW
UlpCompleteSendCacheEntryWorker
UlpComputeSecureHash
UlpComputeSizeAndCreateTracker
UlpCopyIpListenList
UlpCopyRequestToBuffer
UlpCopyRequestToBufferOld
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateErrorLogFile
UlpCreateLogFile
UlpCreateLoggingConfig
UlpDeleteAuthCacheEntryWorker
UlpDeleteAuthCacheKey
UlpDeleteIpAddressFromList
UlpDeliverRequestStagePolicies
UlpDereferenceEtwRules
UlpDigestAuthenticationHandler
UlpDuplicateChunksForCacheSlice
UlpFastAuthenticate
UlpFixupAccessTokenForProcess
UlpFlCleanupFlowRateInfoWorker
UlpFlatCacheRangeWrapper
UlpFreeAuthToken
UlpFreeBasicParams
UlpFreeClientRegistration
UlpFreeConsumer
UlpFreeDigestParams
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeParsedParams
UlpFreeSliceDescriptor
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetIrpProcessIdAndImageName
UlpGetResponseInfo
UlpGetUserSidForToken
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderDeleteKnownHeader
UlpHkeBuilderDeleteUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpInitializeAlternateCredential
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpNotifyEdgePolicyChange
UlpParseNextRequest
UlpPcwCleanupInstance
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSspiAuthenticationHandler
UlpTerminateErrorLogEntry
UlpTerminateSspiSchemes
UlpTerminateThreadPoolArena
UlpTerminateThreadPoolQueue
UlpTerminateThreadPoolWorkersLocked
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUnbindSchemeFromPort
UlpUpdatePerfCountersOnCacheSend
UlpUpdateReservationInRegistry
UninitializeTelemetryAssertsKM
UxAllocateMdlAndBufferEx
UxAppendCopyToAggregator
UxCopyTrailersChunk32
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteParcelCompletion
UxDuoExecuteRunnerCompletion
UxDuoExecuteStreamCleanup
UxDuoFreeConnection
UxDuoFreeDeclarePushParameters
UxDuoFreeJob
UxDuoFreeParcel
UxDuoHpackFreeBlock
UxDuoHpackFreeInternal
UxDuoSanitizeDeclarePushParameters
UxFreeCapturedAnsiString
UxFreeCapturedUnicodeString
UxFreeMdlAndBuffer
UxGetActiveCodePage
UxGetComputerName
UxOpenSubKeyByIndex
UxQuicBufferFree
UxQuicFreeConnection
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicStopModule
UxQuicStreamPushInjectDestroyContext
UxQuicStreamSendDestroyContext
UxReadCompleteFileEntry
UxReadCompleteFileEntryFast
UxReadErrorLogDirectoryName
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCacheTlsClientHello
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCreateConfiguration
UxSslDestroyConfiguration
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetTlsExtensions
UxSslOpenConfigRegistryKey
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopSenderModule
UxSslVerifyRequestHost
UxStartEnvironmentModule
UxStopEnvironmentFacet
UxStopEnvironmentModule
UxStopOpaqueIdModule
UxTerminateExbuffer
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxTlDestroyListenEndpoint
UxTlFreeConnectionFromLookaside
UxWfpFreeThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxWskStopFacet
UxpDuoCaptureHostName
UxpFreeHeaderBufferBlock
UxpQuicBufferExpandBuffer
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDecodeResetTracker
UxpQuicFreeTlsExtensions
UxpQuicFreeTransportIndication
UxpQuicInitializeConfigurationContext
UxpQuicInitializeMsQuic
UxpQuicTerminateMsQuic
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupEndpointConfigs
UxpSslCleanupTransportIndicationList
UxpSslConfigToPrincipal
UxpSslConnectionDecryptData
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslDestroyScopedCcsConfiguration
UxpSslExpandTransportDataIndication
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeTableNode
UxpSslInitializeEndpointTable
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeHostConfigurationHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslInitializeSchCredentials
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslReceiver
UxpSslSetClientCertPolicy
UxpSslUnloadEndpointCertificateWorker
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
UxpSslWriteHostConfigToRegistryHelper
UxpTlAssociateListenEndpoints
UxpTlDestroyAddressEndpoint
UxpTpAllocateTransmitPacket
UxpTpFreeChunkTracker
UxpTpFreeSubstitution
UxpTpMdlSendCompleteWorker
UxpWskAcquirePortReservation
UxpWskCloseListenSocket
UxpWskQosNotifyAttachProvider

Expand for full list:
DestroyAggregateSession
DestroyEventEntry
FUN_14003d14e
FUN_14004c307
FUN_14016d61f
FUN_14016de0c
FUN_14016de33
FUN_14016de8c
FUN_14016e0be
FUN_140174026
FUN_140174d66

FUN_140178fec
FUN_1401794ec
FUN_14017ac08
FUN_14017ac37
FUN_14017ad03
FUN_14017bf7c
FUN_14017ce24
FUN_14017dfe0
FUN_14017e6a0
FUN_14017f1b6
FastWppTraceMessage
HttpNormalizeNamedHost
HttpParseUrl
HttppFixParsedUrl
HttppNormalizePath
HttppRebuildFixedUrl
InitializeTelemetryAssertsKM
InsertEventEntryInLookUpTable
PplDestroyLookasideList
PplpCreateLookasideListEx
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcFreeStream
UcSendHeadersClientStreamFastIo
UcStreamDestroyHeaderBuffer
UcStreamFreeReceiveBuffer
UcStreamFreeSendTracker
UcpFreeClientSessionContext
UcpGetSendHeadersPairs
UcpStreamSendHeadersCompletionCommon
UlAddFragmentToCache
UlAddUrlToConfigGroup
UlAdjustRangesToContentSize
UlAiFreeAddressInformation
UlAllocateCacheEntry
UlAllocateWideString
UlAppendHeaderValue
UlCGRebuildHashTable
UlCanSatisfyRangesFromCache
UlCaptureCurrentProcessIdentity
UlCaptureHttpResponse
UlCaptureHttpResponseOld
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlCleanupAuthInfo
UlCleanupConfigGroupInfo
UlCleanupHttpConnection
UlCleanupRangeCacheTracker
UlCleanupSecurityContext
UlCleanupSecurityDescriptor
UlCloseLogFile
UlComputeMultipleKnownHeaderSize
UlConfigLogging
UlContentRangeHeaderHandler
UlCopyAuthConfig
UlCreateAuthCache
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlDeleteConnectionCountEntry
UlDereferenceAlternateCredential
UlDestroyCapturedResponse
UlDestroyLogDataBufferWorker
UlDestroySliceTracker
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEventFlushResponseCache
UlEventLogAddUrl
UlEventLogCreateFailure
UlEventLogCreateUrlGroup
UlEventLogDeleteUrlGroup
UlEventLogRemoveAllUrls
UlEventLogRemoveUrl
UlEventLogUrlReservation
UlEventSetConfigGroupProperty
UlEventSetIpListenList
UlEventSslSettingsCreated
UlEventSslSettingsDeleted
UlEventSslSettingsUpdated
UlFastSendHttpResponse
UlFastSendHttpResponseOld
UlFindUrlGroupId
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlFreeAuthCache
UlFreeAuthConfig
UlFreeAuthInfo
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeCapturedProcessIdentity
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreePerNode
UlFreeRequestQueue
UlFreeResponseInfoParsedElements
UlFreeServerSession
UlFreeServiceNameContainer
UlFreeUnknownCodingList
UlFreeWideString
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeBuilderCleanup
UlHkeNotifyCleanupClientContext
UlIsAuthChangeNeededOld
UlLogHttpError
UlParseCompareUriWithRequestUri
UlPmHotAddAbort
UlPmStopModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlPrepareUrlIoctl
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlReplaceHeaderValue
UlResponseInfoParsing
UlResumeParsing
UlScFreeEntry
UlScStopFacet
UlSendCachedResponse
UlSendEntityBodyIoctlOld
UlSendHttpResponseIoctlOld
UlSendHttpResponseOrEntityBodyIoctl
UlSendResponseOrEntityBodyFastIoOld
UlStartConfigGroupFacet
UlStopConfigGroupFacet
UlStopNamespaceFacet
UlStopUriCacheFacet
UlUnlinkUriCacheEntry
UlUpdateAuthConfig
UlpAddIpAddressToList
UlpAllocateAuthCacheEntry
UlpAllocateConfigGroupObject
UlpAllocateServerSession
UlpBasicAuthenticationHandler
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureDigestParams
UlpCleanupLoggingConfig
UlpCleanupLoggingInfo
UlpCleanupPolicyTable
UlpCleanupTimerUnit
UlpCleanupUserTokenWorker
UlpCloseLogFileWorker
UlpCompleteAuthInfo
UlpCompleteCacheSliceBuildWorker
UlpCompleteLogRecordETW
UlpCompleteSendCacheEntryWorker
UlpComputeSecureHash
UlpComputeSizeAndCreateTracker
UlpCopyIpListenList
UlpCopyRequestToBuffer
UlpCopyRequestToBufferOld
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateErrorLogFile
UlpCreateLogFile
UlpCreateLoggingConfig
UlpDeleteAuthCacheEntryWorker
UlpDeleteAuthCacheKey
UlpDeleteIpAddressFromList
UlpDeliverRequestStagePolicies
UlpDereferenceEtwRules
UlpDigestAuthenticationHandler
UlpDuplicateChunksForCacheSlice
UlpFastAuthenticate
UlpFixupAccessTokenForProcess
UlpFlCleanupFlowRateInfoWorker
UlpFlatCacheRangeWrapper
UlpFreeAuthToken
UlpFreeBasicParams
UlpFreeClientRegistration
UlpFreeConsumer
UlpFreeDigestParams
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeParsedParams
UlpFreeSliceDescriptor
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetIrpProcessIdAndImageName
UlpGetResponseInfo
UlpGetUserSidForToken
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderDeleteKnownHeader
UlpHkeBuilderDeleteUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpInitializeAlternateCredential
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpNotifyEdgePolicyChange
UlpPcwCleanupInstance
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpReferenceBuffers
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSspiAuthenticationHandler
UlpTerminateErrorLogEntry
UlpTerminateSspiSchemes
UlpTerminateThreadPoolArena
UlpTerminateThreadPoolQueue
UlpTerminateThreadPoolWorkersLocked
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUnbindSchemeFromPort
UlpUpdatePerfCountersOnCacheSend
UlpUpdateReservationInRegistry
UninitializeTelemetryAssertsKM
UxAllocateMdlAndBufferEx
UxAppendCopyToAggregator
UxCopyTrailersChunk32
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteParcelCompletion
UxDuoExecuteRunnerCompletion
UxDuoExecuteStreamCleanup
UxDuoFreeConnection
UxDuoFreeDeclarePushParameters
UxDuoFreeJob
UxDuoFreeParcel
UxDuoHpackFreeBlock
UxDuoHpackFreeInternal
UxDuoSanitizeDeclarePushParameters
UxFreeCapturedAnsiString
UxFreeCapturedUnicodeString
UxFreeMdlAndBuffer
UxGetActiveCodePage
UxGetComputerName
UxOpenSubKeyByIndex
UxQuicBufferFree
UxQuicFreeConnection
UxQuicFreeSendTracker
UxQuicFreeSession
UxQuicStopModule
UxQuicStreamPushInjectDestroyContext
UxQuicStreamSendDestroyContext
UxReadCompleteFileEntry
UxReadCompleteFileEntryFast
UxReadErrorLogDirectoryName
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCacheTlsClientHello
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCreateConfiguration
UxSslDestroyConfiguration
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetTlsExtensions
UxSslOpenConfigRegistryKey
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslReleaseReceiveBuffers
UxSslRestartSendRawData
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopSenderModule
UxSslVerifyRequestHost
UxStartEnvironmentModule
UxStopEnvironmentFacet
UxStopEnvironmentModule
UxStopOpaqueIdModule
UxTerminateExbuffer
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxTlDestroyListenEndpoint
UxTlFreeConnectionFromLookaside
UxWfpFreeThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxWskStopFacet
UxpDuoCaptureHostName
UxpFreeHeaderBufferBlock
UxpQuicBufferExpandBuffer
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDecodeResetTracker
UxpQuicFreeTlsExtensions
UxpQuicFreeTransportIndication
UxpQuicInitializeConfigurationContext
UxpQuicInitializeMsQuic
UxpQuicTerminateMsQuic
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupEndpointConfigs
UxpSslCleanupTransportIndicationList
UxpSslConfigToPrincipal
UxpSslConnectionDecryptData
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslDestroyScopedCcsConfiguration
UxpSslExpandTransportDataIndication
UxpSslFindWildcardScopedCcsHandler
UxpSslFindWildcardSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeTableNode
UxpSslInitializeEndpointTable
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeHostConfigurationHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslInitializeSchCredentials
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslReceiver
UxpSslSetClientCertPolicy
UxpSslUnloadEndpointCertificateWorker
UxpSslVerifyTokenBinding
UxpSslWaitForAscHandler
UxpSslWriteHostConfigToRegistryHelper
UxpTlAssociateListenEndpoints
UxpTlDestroyAddressEndpoint
UxpTpAllocateTransmitPacket
UxpTpFreeChunkTracker
UxpTpFreeSubstitution
UxpTpMdlSendCompleteWorker
UxpWskAcquirePortReservation
UxpWskCloseListenSocket
UxpWskQosNotifyAttachProvider

| |paramcount|0|0| |address|EXTERNAL:00000144|EXTERNAL:00000144| |sig|undefined ExFreePoolWithTag(void)|undefined ExFreePoolWithTag(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExFreePoolWithTag Calling Diff ```diff --- NTOSKRNL.EXE::ExFreePoolWithTag calling +++ NTOSKRNL.EXE::ExFreePoolWithTag calling @@ -3,19 +3,19 @@ -FUN_14003ddae -FUN_14004cf67 -FUN_14016d35f -FUN_14016db4c -FUN_14016db73 -FUN_14016dbcc -FUN_14016ddfe -FUN_140173e2c -FUN_140174b6c -FUN_140178df2 -FUN_140179174 -FUN_14017a948 -FUN_14017a977 -FUN_14017aa43 -FUN_14017bcbc -FUN_14017cb64 -FUN_14017dd20 -FUN_14017e3e0 -FUN_14017eef6 +FUN_14003d14e +FUN_14004c307 +FUN_14016d61f +FUN_14016de0c +FUN_14016de33 +FUN_14016de8c +FUN_14016e0be +FUN_140174026 +FUN_140174d66 +FUN_140178fec +FUN_1401794ec +FUN_14017ac08 +FUN_14017ac37 +FUN_14017ad03 +FUN_14017bf7c +FUN_14017ce24 +FUN_14017dfe0 +FUN_14017e6a0 +FUN_14017f1b6 @@ -228 +227,0 @@ -UlpParseNextRequest @@ -234,0 +234 @@ +UlpReferenceBuffers ``` ## NTOSKRNL.EXE::EtwWriteTransfer ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|EtwWriteTransfer|EtwWriteTransfer| |fullname|NTOSKRNL.EXE::EtwWriteTransfer|NTOSKRNL.EXE::EtwWriteTransfer| |`refcount`|11|12| |length|0|0| |called||| |`calling`|EtwEx_tidActivityInfoTransfer
FUN_140034ce2
FlushEventEntryList
McTemplateK0qxzk_EtwWriteTransfer
McTemplateK0zqxzk_EtwWriteTransfer
UlTelemetryHttp2Usage
UlpParseNextRequest
UxGenEventWrite
_tlgWriteAgg
_tlgWriteTransfer_EtwWriteTransfer|EtwEx_tidActivityInfoTransfer
FUN_140034082
FlushEventEntryList
McTemplateK0qxzk_EtwWriteTransfer
McTemplateK0zqxzk_EtwWriteTransfer
UlTelemetryHttp2Usage
UlpParseNextRequest
UxGenEventWrite
_tlgWriteAgg
_tlgWriteTransfer_EtwWriteTransfer| |paramcount|0|0| |address|EXTERNAL:00000022|EXTERNAL:00000022| |sig|undefined EtwWriteTransfer(void)|undefined EtwWriteTransfer(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::EtwWriteTransfer Calling Diff ```diff --- NTOSKRNL.EXE::EtwWriteTransfer calling +++ NTOSKRNL.EXE::EtwWriteTransfer calling @@ -2 +2 @@ -FUN_140034ce2 +FUN_140034082 ``` ## memmove ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|memmove|memmove| |fullname|memmove|memmove| |`refcount`|392|393| |length|537|537| |called||| |`calling`|

Expand for full list:
CreateNewEventEntry
FUN_14001570f
FUN_140174038
FUN_140174b6c
FUN_140179e98
FUN_14017bd35
FUN_14017c606
FUN_14017cffd
FUN_14017f084
FastWppPackEvent
HkAddPairToTable

HkDecode
HkDecodeLiteral
HkEmitBuffer
HkEncode
HkEncodeString
HkExpandEncodingEmitter
HkExpandStorage
HttpValidateHostname
HttppFixParsedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
InitializeTelemetryAssertsKMWorkerInternal
QkAllocateElement
QkDecodingEmitterAppendPair
QkEmitBuffer
QkExpandEncodingEmitter
QkExpandRefArray
QkExpandStorage
TraceFilterEngineStoreFilterRulesInternal
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcStreamCopyReceiveList
UcpCaptureUserPairs32
UcpCopyBufferToUser
UcpCopyHeaderPairsToUser
UlAddServiceNameToContainer
UlAdjustRangesToContentSize
UlAllocateWideString
UlAppendHeaderValue
UlAuthCopyKnownAuthHeaderToBuffer
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlBufferWriterAlign
UlBufferWriterWrite
UlBuildLogHeader
UlBuildPushRequestHeaders
UlCaptureRawLogData
UlCaptureWideString
UlContentRangeHeaderHandler
UlCopyAuthConfigProperty
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigToIrp
UlCopyHttpVerb
UlCopyLogDataToCache
UlCopyLoggingProperty
UlCopyParsedHeaders
UlCopyUserAuthInfoOld
UlCopyUserChannelBindInfoOld
UlCopyUserTokenBindingInfoOld
UlCreateCacheEntryFromResponse
UlCreateConsumerHelper
UlDeepCopyParsedHeaders
UlEventLogCreateFailure
UlFastSendHttpResponseOld
UlFlushCacheByUri
UlGenerateDateHeader
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateVariableHeaders
UlGetDateTimeFields
UlGetServerHeader
UlGetTypeAndSubType
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderQueryKnownHeader
UlHkeBuilderQueryUnknownHeader
UlLargeMemSetData
UlLogHttpError
UlPrepareUrlIoctl
UlQueryKnownRequestHeader
UlQueryRequestProperty
UlQueryUnknownRequestHeader
UlReadFragmentFromCache
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlSendSimpleStatus
UlSerializeTrailers
UlWriteEventLogEntry
UlpAddIpAddressToList
UlpAiPopulateAddressList
UlpAllocateAuthCacheEntry
UlpBufferWriterUpdate
UlpBuildErrorLogRecord
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildUriKeyFromCookedUrl
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpCompleteLogRecordIIS
UlpCompleteLogRecordNCSA
UlpCompleteLogRecordW3C
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyConfigGroupInfo
UlpCopyIndicatedData
UlpCopyQuicStatsV2Old
UlpCopyRegisteredUrl
UlpCopyRequestQueueInfo
UlpCopyRequestToBufferOld
UlpCopySingleMultipleHeader
UlpCopyString
UlpCopyUrlOld
UlpCopyUserDataToFastTracker
UlpCreateTargetServiceName
UlpDeleteIpAddressFromList
UlpDigestFastAuthenticator
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFixupIISLogRecord
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGenerateBoundaryChunk
UlpGenerateCommonBoundaryBuffer
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeCopyKnownHeader
UlpLogSpecificInitFailure
UlpMergeBuffers
UlpParseNextRequest
UlpPrepare200Response
UlpPrepareOutputToken
UlpRawCopyForLogCacheHit
UlpRawCopyForLogCacheMiss
UlpRewriteLogRecord
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpSetRequestQueueExternalId
UlpSspiAuthenticationHandler
UlpTreeFindWildcardSite
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteToErrorLogFileDebug
UlpWriteToErrorLogFileExclusive
UlpWriteToLogFileDebug
UlpWriteToLogFileExclusive
UlpWriteToLogFileShared
UxAllocateBufferedMdl
UxAppendCopyToAggregator
UxAppendToExbuffer
UxCaptureString
UxCaptureUserMemory
UxCaptureWideString
UxCopyMdlChainToMdlChain
UxDuoBeginFullFrameParse
UxDuoBuildContinuationChain
UxDuoDispatchAltSvcParcel
UxDuoParse
UxDuoParseCatalog
UxDuoParseSettings
UxDuoParseWindowUpdate
UxGenerateSubdomainWildcardHostname
UxIpv4AddressToStringExW
UxIpv6AddressToStringExW
UxQuicBufferAddData
UxQuicBufferShiftData
UxQuicConnectionCopyBindings
UxQuicConnectionCopyBindings32
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV2
UxQuicPreParser
UxQuicSetSessionKeys
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslGetAltSvcInfo
UxSslGetCertInfoOld
UxSslInitializeClientCertPolicy
UxSslInitiateSend
UxSslParseTlsRestrictions
UxSslReadConfigurationPropertiesFromUser
UxSslReadExtendedConfigurationPropertiesFromUser
UxTryCopyUserMemoryOld
UxWskAcceptEvent
UxpDuoCaptureHostName
UxpQuicBufferExpandBuffer
UxpQuicConnectionCopyCertBlob
UxpQuicConnectionCopyCertBlob32
UxpQuicConnectionCopyIssuerList32
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicQueryConnectionInfo
UxpQuicStreamGetStats
UxpQuicUnknownStreamReceiveEvent
UxpSslCommonSendData
UxpSslCommonSendDataHelper
UxpSslCopyCertificateParam
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslExpandTransportDataIndication
UxpSslGetClientCertInfoOld
UxpSslGetClientHello
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessRenegotiateRecord
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReceiver

Expand for full list:
CreateNewEventEntry
FUN_14001570f
FUN_140174232
FUN_140174d66
FUN_14017a158
FUN_14017bff5
FUN_14017c8c6
FUN_14017d2bd
FUN_14017f344
FastWppPackEvent
HkAddPairToTable

HkDecode
HkDecodeLiteral
HkEmitBuffer
HkEncode
HkEncodeString
HkExpandEncodingEmitter
HkExpandStorage
HttpValidateHostname
HttppFixParsedUrl
HttppValidateIpv6Hostname
InitializeTelemetryAssertsKM
InitializeTelemetryAssertsKMWorkerInternal
QkAllocateElement
QkDecodingEmitterAppendPair
QkEmitBuffer
QkExpandEncodingEmitter
QkExpandRefArray
QkExpandStorage
TraceFilterEngineStoreFilterRulesInternal
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcQueryClientStreamProperty
UcStreamCopyReceiveList
UcpCaptureUserPairs32
UcpCopyBufferToUser
UcpCopyHeaderPairsToUser
UlAddServiceNameToContainer
UlAdjustRangesToContentSize
UlAllocateWideString
UlAppendHeaderValue
UlAuthCopyKnownAuthHeaderToBuffer
UlAuthCopyUnconfiguredAuthHeaderToBuffer
UlBufferWriterAlign
UlBufferWriterWrite
UlBuildLogHeader
UlBuildPushRequestHeaders
UlCaptureRawLogData
UlCaptureWideString
UlContentRangeHeaderHandler
UlCopyAuthConfigProperty
UlCopyAuthConfigToIrp
UlCopyAuthHeader
UlCopyChannelBindConfigToIrp
UlCopyHttpVerb
UlCopyLogDataToCache
UlCopyLoggingProperty
UlCopyParsedHeaders
UlCopyUserAuthInfoOld
UlCopyUserChannelBindInfoOld
UlCopyUserTokenBindingInfoOld
UlCreateCacheEntryFromResponse
UlCreateConsumerHelper
UlDeepCopyParsedHeaders
UlEventLogCreateFailure
UlFastSendHttpResponseOld
UlFlushCacheByUri
UlGenerateDateHeader
UlGenerateFixedHeadersOld
UlGenerateMultipleKnownHeadersOld
UlGenerateRoutingToken
UlGenerateSingleVariableHeaders
UlGenerateTrailers
UlGenerateVariableHeaders
UlGetDateTimeFields
UlGetServerHeader
UlGetTypeAndSubType
UlHkeBuilderCopyFixedHeaders
UlHkeBuilderQueryKnownHeader
UlHkeBuilderQueryUnknownHeader
UlLargeMemSetData
UlLogHttpError
UlPrepareUrlIoctl
UlQueryKnownRequestHeader
UlQueryRequestProperty
UlQueryUnknownRequestHeader
UlReadFragmentFromCache
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlSendSimpleStatus
UlSerializeTrailers
UlWriteEventLogEntry
UlpAddIpAddressToList
UlpAiPopulateAddressList
UlpAllocateAuthCacheEntry
UlpBufferWriterUpdate
UlpBuildErrorLogRecord
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildUriKeyFromCookedUrl
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpCompleteLogRecordIIS
UlpCompleteLogRecordNCSA
UlpCompleteLogRecordW3C
UlpCopyCacheEntryInfo
UlpCopyChannelBindTokenToIrp
UlpCopyConfigGroupInfo
UlpCopyIndicatedData
UlpCopyQuicStatsV2Old
UlpCopyRegisteredUrl
UlpCopyRequestQueueInfo
UlpCopyRequestToBufferOld
UlpCopySingleMultipleHeader
UlpCopyString
UlpCopyUrlOld
UlpCopyUserDataToFastTracker
UlpCreateTargetServiceName
UlpDeleteIpAddressFromList
UlpDigestFastAuthenticator
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFixupIISLogRecord
UlpGenerateAuthHeaders
UlpGenerateAuthHeadersOld
UlpGenerateBoundaryChunk
UlpGenerateCommonBoundaryBuffer
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeCopyKnownHeader
UlpLogSpecificInitFailure
UlpMergeBuffers
UlpPrepare200Response
UlpPrepareOutputToken
UlpRawCopyForLogCacheHit
UlpRawCopyForLogCacheMiss
UlpReferenceBuffers
UlpRewriteLogRecord
UlpSanitizeResponseHeaders
UlpSanitizeTrailerHeaders
UlpSetRequestQueueExternalId
UlpSspiAuthenticationHandler
UlpTreeFindWildcardSite
UlpTreeFreeNode
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UlpWriteServerHeader
UlpWriteSingleHeader
UlpWriteToErrorLogFileDebug
UlpWriteToErrorLogFileExclusive
UlpWriteToLogFileDebug
UlpWriteToLogFileExclusive
UlpWriteToLogFileShared
UxAllocateBufferedMdl
UxAppendCopyToAggregator
UxAppendToExbuffer
UxCaptureString
UxCaptureUserMemory
UxCaptureWideString
UxCopyMdlChainToMdlChain
UxDuoBeginFullFrameParse
UxDuoBuildContinuationChain
UxDuoDispatchAltSvcParcel
UxDuoParse
UxDuoParseCatalog
UxDuoParseSettings
UxDuoParseWindowUpdate
UxGenerateSubdomainWildcardHostname
UxIpv4AddressToStringExW
UxIpv6AddressToStringExW
UxQuicBufferAddData
UxQuicBufferShiftData
UxQuicConnectionCopyBindings
UxQuicConnectionCopyBindings32
UxQuicConnectionGetPeerIssuerListClient
UxQuicConnectionGetStatsV2
UxQuicPreParser
UxQuicSetSessionKeys
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslCopyConfigurationProperties
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCopySniToRequestProperty
UxSslGetAltSvcInfo
UxSslGetCertInfoOld
UxSslInitializeClientCertPolicy
UxSslInitiateSend
UxSslParseTlsRestrictions
UxSslReadConfigurationPropertiesFromUser
UxSslReadExtendedConfigurationPropertiesFromUser
UxTryCopyUserMemoryOld
UxWskAcceptEvent
UxpDuoCaptureHostName
UxpQuicBufferExpandBuffer
UxpQuicConnectionCopyCertBlob
UxpQuicConnectionCopyCertBlob32
UxpQuicConnectionCopyIssuerList32
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicParseAndCopyDataIndication
UxpQuicQueryConnectionInfo
UxpQuicStreamGetStats
UxpQuicUnknownStreamReceiveEvent
UxpSslCommonSendData
UxpSslCommonSendDataHelper
UxpSslCopyCertificateParam
UxpSslCopySniForEtwFiltering
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslExpandTransportDataIndication
UxpSslGetClientCertInfoOld
UxpSslGetClientHello
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslProcessRenegotiateRecord
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReceiver

Expand for full list:
FUN_140022dd4
FUN_140030620
FUN_14003469b
FUN_140034ce2
FUN_14005161b
FUN_1401708b4
FUN_140170942
FUN_14017097f
FUN_140170ac2
FUN_140170dfa
FUN_140171eac

FUN_140172735
FUN_14017520e
FUN_1401768da
FUN_1401769c0
FUN_140179e98
FUN_14017b8d8
FUN_14017ceaa
FUN_14017e34e
FUN_14017e410
FUN_14017eaa8
FUN_14017f006
FindChunkHeaderEnd
HkInitializeModule
HttpEtwCallback
HttpFindUrlToken
HttpNormalizeNamedHost
HttpParseUrl
HttpStringToULongLong
HttpStringToUShort
HttpValidateHostname
HttppNormalizePath
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlScheme
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
ParseChunkLength
ParseLastModified
UcAbortConnection
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientSessionContext
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamIngressDisconnectEvent
UcStreamTimeout
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStream
UcpAbortStreamsFromConnection
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpCancelConnectionIo
UcpCancelStreamIo
UcpCleanupClientSession
UcpCleanupConnection
UcpCoupleSessionContextAndSession
UcpDeleteConnection
UcpDeleteCredential
UcpDestroySendEntityChunks
UcpFlushConnectionsFromSessionContext
UcpFlushCredentialsFromSessionContext
UcpFlushStreamsFromConnection
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpRemoveSessionContextFromSessionList
UcpResetReceiveTimer
UcpSendEntityBodyClientStream
UcpSetReceiveTimer
UcpStreamCancelIrp
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UlAccessCheck
UlAddSslBinding
UlAiFreeAddressInformation
UlAiPktMonRegisterAddressInformation
UlAiPktMonUnregisterAddresses
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAiStopModule
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCGAddHashTableEntry
UlCGRebuildHashTable
UlCacheAndSendResponse
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureDelegateRequestParameters
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckProtocolCompliance
UlCheckinUriCacheEntry
UlCleanupCommChannel
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupConsumerInternal
UlCleanupHttpConnection
UlClearCentralizedLogged
UlCloseCommChannel
UlCloseConnection
UlCloseConsumer
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlConsumeBytesFromConnection
UlConsumerCleanupCompletion
UlCopyAuthConfig
UlCopyConfigGroupInfoForCache
UlCopyEntityBodyToBuffer
UlCreateCacheEntryFromResponse
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAutoServerSession
UlDeleteConsumerCallback
UlDeleteSslBinding
UlDeliverEntityBody
UlDestroyCapturedChunk
UlDestroyCapturedResponse
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlErrorLog
UlEvaluateRequest
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardLogData
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFlushCache
UlFlushCacheByConfigGroup
UlFlushCacheByConsumer
UlFlushCacheByRequestQueue
UlFlushCacheByServerSession
UlFlushCacheForAddUrl
UlFlushCacheForRemoveUrl
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreeRequestQueue
UlFreeServerSession
UlFreeUnknownCodingList
UlGetRequestFromId
UlGetTypeAndSubType
UlHandle100Continue
UlHttpAttachConnection
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpIoReadyEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlIncrementChunkPointer
UlInitSearchKeyFromRequest
UlInitSearchKeyFromUrl
UlInitializeAnchor
UlInitializeConfigGroupInfo
UlInitializeFastTrackerPool
UlInitializeParsedHeaders
UlLookupAndVerifyCacheEntry
UlLookupHeader
UlLowMemoryCacheScavenger
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlParseHeader
UlPeriodicCacheScavenger
UlPeriodicZombieConnectionListFlush
UlPktMonCleanupCallback
UlPktMonRegister
UlPktMonRegisterComponentsCallback
UlPktMonUnRegisterInterface
UlPktMonUnregister
UlPrepareUrlIoctl
UlPurgeZombieConnections
UlQosDeleteAllFlowCharacterisitics
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReInitializeParsedHeaders
UlReceiveHttpRequest
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScFreeEntry
UlScStopCounters
UlScStopFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendErrorResponse
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlSetErrorCode
UlSetErrorCodeEx
UlSetHttpConnectionTokenBinding
UlSetPreSendState
UlSetResponseTransformerState
UlSetZeroLengthSendState
UlShutdownConsumer
UlStartDataModule
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueModule
UlStartRequestQueueTimer
UlStartScavenger2Module
UlStartUriCacheFacet
UlStopConfigGroupFacet
UlStopHttpConnFacet
UlStopHttpIdealBacklogFastForwarderNotification
UlStopHttpReceiveModule
UlStopRequestQueueFacet
UlStopRequestQueueTimer
UlStopScavenger2Module
UlStopThreadPoolModule
UlStopUriCacheFacet
UlTransformResponseFiniteBody
UlTransformResponseTail
UlTrimCache
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateParsedHeader
UlUpdateSslBinding
UlWaitForDemandStart
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiDestroyAddressList
UlpAiInsertAddressInformation
UlpAiIpAddressChangeCallback
UlpAiNlChangeCallback
UlpAiPopulateAddressList
UlpAiRemoveAddress
UlpAiRemoveAddressInformation
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBufferTimerHandler
UlpCacheAndSendResponseWorker
UlpCacheMdlReadCompleteWorker
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupRequestQueueCouplings
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteResponse
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyGlobalCounters
UlpCopyIndicatedData
UlpCountRequestsCoupling
UlpCreateHttpRequest
UlpDeferredAddSiteWorker
UlpDeleteServerSession
UlpDeliverHttpRequest
UlpDeliverHttpRequestWorker
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDetachConsumerFromRequestQueue
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpErrorLogBufferTimerHandler
UlpErrorLogConnectionReset
UlpErrorLogRolloverTimerHandler
UlpEtwEvaluateFilterInternal
UlpFilteredFlushUriCache
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushCouplingRequests
UlpFlushExcessRequests
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterIncScavengerTicks
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeReceiveBufferList
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpHandleFastForwardChunk
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInsertBuffer
UlpInsertInCommChannelList
UlpInvokeFlushedConsumerCallbacks
UlpLockRequestQueueAndCoupling
UlpLogErrorResposeSendEvent
UlpLogTimerHandler
UlpMergeBuffers
UlpNotifyEdgePolicyChange
UlpNotifyIPListenListChangesOfConfigGroup
UlpNotifyIPListenListChangesOfServerSession
UlpOpenRequestQueue
UlpParseAuthenticationHeader
UlpParseNextRequest
UlpProcessSendCompletion
UlpProcessZeroLengthSend
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQosDeleteFlowCharacteristicsOfServerSession
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequest
UlpRedeliverFlushedRequests
UlpRejectFlushedRequests
UlpReleaseCurrentChunkBuffer
UlpReleaseReadEntityBodyBuffers
UlpReleaseRemainingEntityBodyBuffers
UlpRemoveEntryStats
UlpRemoveFromCommChannelList
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRestartAddFragmentToCache
UlpRestartFastForwardSend
UlpRestartFastForwardSendWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpRetrieveRequest
UlpScResetSiteCounters
UlpScavengerThread
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendHttpResponseWorker
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpToggleRequestQueueTimer
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpUpdatePerfCountersOnCacheSend
UlpZombifyHttpConnection
UxDuoExecuteDetach
UxDuoExecuteReleaseBuffer
UxDuoExecuteSendGoaway
UxDuoReleaseReceiveBuffers
UxDuoSanitizeDeclarePushParameters
UxDuoSetTransportIdleConnectionTimeout
UxDuoStartFacet
UxDuoStartModule
UxFreeOpaqueId
UxFreeOpaqueIdEx
UxGetActiveCodePage
UxParseAuthBlobSingle
UxPodStopModule
UxQuicAbortConnection
UxQuicBufferShiftData
UxQuicConnectionSetCertSettings
UxQuicInvalidateCertificate
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStartModule
UxQuicStreamAbort
UxQuicStreamCompleteHeadersDecode
UxQuicStreamInitiateReceive
UxQuicUnloadCertificate
UxSslAbortConnection
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslCompleteRetrieveIrp
UxSslConnectionDisableReconnects
UxSslConnectionTimeout
UxSslConsumerCleanupHandler
UxSslCreateConfiguration
UxSslDeleteEndpointConfig
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetProperties
UxSslGetTokenBinding
UxSslIdealBacklogEvent
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateSend
UxSslInvalidateCertificate
UxSslIoReadyEvent
UxSslLogEndpointEvent
UxSslOpenConfigRegistryKey
UxSslPeriodicCertificateScavenger
UxSslPostsendCheck
UxSslQueueDisconnectEvent
UxSslQueueIndicationList
UxSslQueueReceiverWorkItem
UxSslQueueReceiverWorkItemEx
UxSslReadConfigurationPropertiesFromUser
UxSslReceiverQueueServerHelloMessage
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslReplaceEndpointConfig
UxSslRestartSendRawData
UxSslScavengeCertificate
UxSslSendHelloRequest
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxSslSetEndpointConfig
UxSslSetEndpointLookupState
UxSslStartRenegotiationTimer
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopRenegotiationTimer
UxSslStopSenderModule
UxSslUnloadCertificate
UxSslValidateSni
UxStartEnvironmentModule
UxTpTransmitPacket
UxpQuicAbortConnectionLocked
UxpQuicCacheTlsClientHello
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConfigurationLoadComplete
UxpQuicCopyPeerCertToIrp
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseIntegerOnlyFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicStreamAbortLocked
UxpQuicStreamDetach
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateIngressDisconnect
UxpQuicStreamPeerReceiveAbort
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamReceiveEvent
UxpQuicStreamSendShutdownComplete
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownStreamReceiveEvent
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslConsumeReceiveBufferSpace
UxpSslCopyCertificateParam
UxpSslCopyClientCertToIrp
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteEndpointConfigLocked
UxpSslEndpointFreeTlsExtensions
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLogEvent
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointSetNotifyCallout
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslEnumerateEndpointConfigs
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeSendRequestTracker
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslHandleRenegotiateRequest
UxpSslIndicateReceiveEvent
UxpSslInitializeCcsConfigurationByRegistryIndex
UxpSslInitializeCcsConfigurationByUserKey
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslLoadCertificateWorker
UxpSslLogHandshakeFailure
UxpSslProcessCloseNotify
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSendStaticServerHello
UxpSslSetAscCountTaken
UxpSslSetConnectionState
UxpSslSetIrpConnection
UxpSslSetNotifyCallout
UxpSslUnloadEndpointCertificateWorker
UxpSslValidateHostConfigurationProperties
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpSslWriteCcsConfigurationToRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpSslWriteIpConfigurationToRegistry
UxpTpDequeueTransmitPacket
UxpTpEnqueueTransmitPacket
UxpTpProcessMdlRuns

Expand for full list:
FUN_140022dd4
FUN_14002f9c0
FUN_140033a3b
FUN_140034082
FUN_1400509bb
FUN_140170b74
FUN_140170c02
FUN_140170c3f
FUN_140170d82
FUN_1401710ba
FUN_1401720a6

FUN_14017292f
FUN_140175408
FUN_140176ad4
FUN_140176bba
FUN_14017a158
FUN_14017bb98
FUN_14017d16a
FUN_14017e60e
FUN_14017e6d0
FUN_14017ed68
FUN_14017f2c6
FindChunkHeaderEnd
HkInitializeModule
HttpEtwCallback
HttpFindUrlToken
HttpNormalizeNamedHost
HttpParseUrl
HttpStringToULongLong
HttpStringToUShort
HttpValidateHostname
HttppNormalizePath
HttppParseIPv6Address
HttppParseUrlPath
HttppParseUrlPort
HttppParseUrlScheme
HttppRebuildFixedUrl
HttppValidateIpv6Hostname
ParseChunkLength
ParseLastModified
UcAbortConnection
UcCleanupClientSessionContext
UcClientStreamDereferenceBundle
UcClientStreamReferenceBundle
UcCloseClientConnectionIoctl
UcCloseClientCredentialIoctl
UcCloseClientSessionContext
UcCloseClientStreamIoctl
UcConnectionCancelIrp
UcCreateClientConnectionIoctl
UcCreateClientCredentialIoctl
UcCreateClientStreamIoctl
UcDeleteStream
UcFreeCaptureConnectionParameters
UcFreeCaptureCredentialParameters
UcFreeClientSession
UcFreeConnection
UcFreeCredential
UcQueryClientConnectionFastIo
UcQueryClientStreamFastIo
UcReferenceClientConnectionFromId
UcReferenceClientCredentialFromId
UcReferenceClientStreamFromId
UcSendHeadersClientStreamFastIo
UcSetClientConnectionFastIo
UcSetClientStreamPropertyFastIo
UcStreamIngressDisconnectEvent
UcStreamTimeout
UcpAbortClientConnection
UcpAbortClientStream
UcpAbortStream
UcpAbortStreamsFromConnection
UcpAddConnectionToSessionContext
UcpAddCredentialToSessionContext
UcpCancelConnectionIo
UcpCancelStreamIo
UcpCleanupClientSession
UcpCleanupConnection
UcpCoupleSessionContextAndSession
UcpDeleteConnection
UcpDeleteCredential
UcpDestroySendEntityChunks
UcpFlushConnectionsFromSessionContext
UcpFlushCredentialsFromSessionContext
UcpFlushStreamsFromConnection
UcpFreeClientSessionContext
UcpNotifyDisconnectClientStream
UcpReceiveEntityBodyClientStream
UcpReceiveHeadersClientStream
UcpRemoveSessionContextFromSessionList
UcpResetReceiveTimer
UcpSendEntityBodyClientStream
UcpSetReceiveTimer
UcpStreamCancelIrp
UcpStreamProcessFastForwardReceiveDataWorker
UcpStreamSendCompletion
UcpStreamSendHeadersCompletionCommon
UlAccessCheck
UlAddSslBinding
UlAiFreeAddressInformation
UlAiPktMonRegisterAddressInformation
UlAiPktMonUnregisterAddresses
UlAiStartModule
UlAiStartTrackingAddressInformation
UlAiStopModule
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateConnectionRequestId
UlBeginOpaqueMode
UlBindConfigGroupToServerSession
UlBuildCacheEntryWorker
UlCGAddHashTableEntry
UlCGRebuildHashTable
UlCacheAndSendResponse
UlCancelRequestIo
UlCancelSendHttpResponse
UlCaptureDelegateRequestParameters
UlCheckCacheControlHeaders
UlCheckCachePreconditions
UlCheckProtocolCompliance
UlCheckinUriCacheEntry
UlCleanupCommChannel
UlCleanupConfigGroupInfo
UlCleanupConnectionCouplings
UlCleanupConsumer
UlCleanupConsumerInternal
UlCleanupHttpConnection
UlClearCentralizedLogged
UlCloseCommChannel
UlCloseConnection
UlCloseConsumer
UlCompleteReceiveEntityBodyIrp
UlCompleteWaitForDisconnects
UlConnectionCleanupWorker
UlConsumeBytesFromConnection
UlConsumerCleanupCompletion
UlCopyAuthConfig
UlCopyConfigGroupInfoForCache
UlCopyEntityBodyToBuffer
UlCreateCacheEntryFromResponse
UlDeclarePushIoctl
UlDelegateRequest
UlDeleteAutoServerSession
UlDeleteConsumerCallback
UlDeleteSslBinding
UlDeliverEntityBody
UlDestroyCapturedChunk
UlDestroyCapturedResponse
UlDestroyUriBaseCacheEntry
UlDestroyUriCacheEntry
UlEgressDisconnectCompletion
UlErrorLog
UlEvaluateRequest
UlFastForwardDetachEvent
UlFastForwardIdealBacklogEvent
UlFastForwardLogData
UlFastReceiveHttpRequest
UlFastSendCompleteWorker
UlFlushCache
UlFlushCacheByConfigGroup
UlFlushCacheByConsumer
UlFlushCacheByRequestQueue
UlFlushCacheByServerSession
UlFlushCacheForAddUrl
UlFlushCacheForRemoveUrl
UlFreeBuildTracker
UlFreeCacheTracker
UlFreeChannelBindToken
UlFreeCommChannel
UlFreeConfigGroup
UlFreeFastTracker
UlFreeHttpConnection
UlFreeRequestQueue
UlFreeServerSession
UlFreeUnknownCodingList
UlGetRequestFromId
UlGetTypeAndSubType
UlHandle100Continue
UlHttpAttachConnection
UlHttpConnectionTimeout
UlHttpDetachConnection
UlHttpIdealBacklogEvent
UlHttpIngressDisconnectEvent
UlHttpIoReadyEvent
UlHttpReceiveHeadersEvent
UlIncCacheEntryAges
UlIncrementChunkPointer
UlInitSearchKeyFromRequest
UlInitSearchKeyFromUrl
UlInitializeAnchor
UlInitializeConfigGroupInfo
UlInitializeFastTrackerPool
UlInitializeParsedHeaders
UlLookupAndVerifyCacheEntry
UlLookupHeader
UlLowMemoryCacheScavenger
UlNotifyForAllChannels
UlNotifyForAllConfigGroups
UlNotifyServerSessionAddition
UlNotifyServerSessionRemoval
UlParseHeader
UlPeriodicCacheScavenger
UlPeriodicZombieConnectionListFlush
UlPktMonCleanupCallback
UlPktMonRegister
UlPktMonRegisterComponentsCallback
UlPktMonUnRegisterInterface
UlPktMonUnregister
UlPrepareUrlIoctl
UlPurgeZombieConnections
UlQosDeleteAllFlowCharacterisitics
UlQuerySslBinding
UlQuerySslBindingExtendedProperties
UlReInitializeParsedHeaders
UlReceiveHttpRequest
UlReleaseRequestBuffer
UlRemoveUrlFromConfigGroup
UlRemoveUrlFromUrlGroupIoctl
UlRestartFastSendHttpResponse
UlRestartSendHttpResponseIoctl
UlResumeParsing
UlScFreeEntry
UlScStopCounters
UlScStopFacet
UlSendCacheEntryWorker
UlSendCachedResponse
UlSendErrorResponse
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlSetErrorCode
UlSetErrorCodeEx
UlSetHttpConnectionTokenBinding
UlSetPreSendState
UlSetResponseTransformerState
UlSetZeroLengthSendState
UlShutdownConsumer
UlStartDataModule
UlStartHttpIdealBacklogFastForwarderNotification
UlStartHttpReceiveModule
UlStartRequestQueueModule
UlStartRequestQueueTimer
UlStartScavenger2Module
UlStartUriCacheFacet
UlStopConfigGroupFacet
UlStopHttpConnFacet
UlStopHttpIdealBacklogFastForwarderNotification
UlStopHttpReceiveModule
UlStopRequestQueueFacet
UlStopRequestQueueTimer
UlStopScavenger2Module
UlStopThreadPoolModule
UlStopUriCacheFacet
UlTransformResponseFiniteBody
UlTransformResponseTail
UlTrimCache
UlUnlinkHkeContext
UlUnlinkHttpRequest
UlUnlinkRequestFromRequestQueue
UlUnlinkUriCacheEntry
UlUpdateParsedHeader
UlUpdateSslBinding
UlWaitForDemandStart
UlpAbortFlushedRequests
UlpAddFragmentCacheCompleteWorker
UlpAiDestroyAddressList
UlpAiInsertAddressInformation
UlpAiIpAddressChangeCallback
UlpAiNlChangeCallback
UlpAiPopulateAddressList
UlpAiRemoveAddress
UlpAiRemoveAddressInformation
UlpAuthenticateRequestCompletion
UlpBindServerSessionToCommChannel
UlpBufferTimerHandler
UlpCacheAndSendResponseWorker
UlpCacheMdlReadCompleteWorker
UlpCancelDemandStartIrp
UlpCancelEntityBody
UlpCancelEntityBodyWorker
UlpCancelHttpReceiveIrp
UlpCancelWaitForDisconnectIrp
UlpCancelWaitForDisconnectWorker
UlpCleanupCoupling
UlpCleanupRequestQueueCouplings
UlpCleanupZombieCacheEntry
UlpCleanupZombieHttpConnection
UlpCloseConnectionWorker
UlpCloseDisconnectedConnection
UlpCompleteCacheBuild
UlpCompleteCacheBuildWorker
UlpCompleteFailedFastForwardResponseWorker
UlpCompleteFastForwardSend
UlpCompleteResponse
UlpCompleteSendCacheEntry
UlpCompleteSendCacheEntryWorker
UlpCompleteSendErrorResponse
UlpCompleteSendResponseToExtension
UlpCompleteSendToExtensionWorker
UlpCompleteWaitForDisconnects
UlpConnectionDisconnectWorker
UlpCopyCacheEntryInfo
UlpCopyGlobalCounters
UlpCopyIndicatedData
UlpCountRequestsCoupling
UlpCreateHttpRequest
UlpDeferredAddSiteWorker
UlpDeleteServerSession
UlpDeliverHttpRequest
UlpDeliverHttpRequestWorker
UlpDeliverRequestStageInitial
UlpDeliverRequestStagePolicies
UlpDetachConsumerFromRequestQueue
UlpDispatchToRequestQueue
UlpEnumerateCouplings
UlpErrorLogBufferTimerHandler
UlpErrorLogConnectionReset
UlpErrorLogRolloverTimerHandler
UlpEtwEvaluateFilterInternal
UlpFilteredFlushUriCache
UlpFinalizeQValueTable
UlpFlushConsumerCallbacks
UlpFlushCouplingRequests
UlpFlushExcessRequests
UlpFlushFilterClearCentralizedLogged
UlpFlushFilterIncScavengerTicks
UlpFlushHttpPushList
UlpFlushPendingConsumerIo
UlpFlushPendingRequests
UlpFlushWaitForDisconnects
UlpFreeConsumer
UlpFreeCoupling
UlpFreeFastForwardDataContext
UlpFreeHttpRequest
UlpFreeReceiveBufferList
UlpGetFastForwardingContext
UlpGetFastForwardingContextOld
UlpHandleFastForwardChunk
UlpHandleRequest
UlpHttpIdealBacklogFastForwarderNotification
UlpInitErrorLogInfo
UlpInitializeInternalResponseHeaders
UlpInitializeInternalResponseHeadersOld
UlpInsertBuffer
UlpInsertInCommChannelList
UlpInvokeFlushedConsumerCallbacks
UlpLockRequestQueueAndCoupling
UlpLogErrorResposeSendEvent
UlpLogTimerHandler
UlpMergeBuffers
UlpNotifyEdgePolicyChange
UlpNotifyIPListenListChangesOfConfigGroup
UlpNotifyIPListenListChangesOfServerSession
UlpOpenRequestQueue
UlpParseAuthenticationHeader
UlpParseNextRequest
UlpProcessSendCompletion
UlpProcessZeroLengthSend
UlpQosDeleteFlowCharacteristicsOfConfigGroup
UlpQosDeleteFlowCharacteristicsOfServerSession
UlpQueueFreeHttpRequest
UlpRedeliverFlushedRequest
UlpRedeliverFlushedRequests
UlpRejectFlushedRequests
UlpReleaseCurrentChunkBuffer
UlpReleaseReadEntityBodyBuffers
UlpReleaseRemainingEntityBodyBuffers
UlpRemoveEntryStats
UlpRemoveFromCommChannelList
UlpRemoveZombieHttpConnection
UlpReplaceSystemAccessToken
UlpRestartAddFragmentToCache
UlpRestartFastForwardSend
UlpRestartFastForwardSendWorker
UlpRestartSendHttpResponse
UlpRestartSendSimpleStatus
UlpResumeParsingWorker
UlpRetrieveRequest
UlpScResetSiteCounters
UlpScavengerThread
UlpSendCacheEntry
UlpSendErrorResponse
UlpSendFastForwardDataContext
UlpSendHttpResponseRegular
UlpSendHttpResponseWorker
UlpSendResponseOrEntityBodyFastIo
UlpSendSimpleCleanupWorker
UlpSetRequestQueue503Verbosity
UlpSetRequestQueueLengthLimit
UlpSetRequestQueueState
UlpSynchronizeLanes
UlpSynchronizeLanesWorker
UlpTerminateZombieList
UlpToggleRequestQueueTimer
UlpUnbindCoupling
UlpUpdateFlushedRequestState
UlpUpdatePerfCountersOnCacheSend
UlpZombifyHttpConnection
UxDuoExecuteDetach
UxDuoExecuteReleaseBuffer
UxDuoExecuteSendGoaway
UxDuoReleaseReceiveBuffers
UxDuoSanitizeDeclarePushParameters
UxDuoSetTransportIdleConnectionTimeout
UxDuoStartFacet
UxDuoStartModule
UxFreeOpaqueId
UxFreeOpaqueIdEx
UxGetActiveCodePage
UxParseAuthBlobSingle
UxPodStopModule
UxQuicAbortConnection
UxQuicBufferShiftData
UxQuicConnectionSetCertSettings
UxQuicInvalidateCertificate
UxQuicLoadCertificateWorker
UxQuicParseFrame
UxQuicPreParser
UxQuicSetConnectionState
UxQuicSetTransportIdleConnectionTimeout
UxQuicStartModule
UxQuicStreamAbort
UxQuicStreamCompleteHeadersDecode
UxQuicStreamInitiateReceive
UxQuicUnloadCertificate
UxSslAbortConnection
UxSslAcceptSecurityContextCallback
UxSslAcquireCredentialsHandleLookupCallback
UxSslCompleteRetrieveIrp
UxSslConnectionDisableReconnects
UxSslConnectionTimeout
UxSslConsumerCleanupHandler
UxSslCreateConfiguration
UxSslDeleteEndpointConfig
UxSslDestroyConfiguration
UxSslDetachComplete
UxSslDetachConnection
UxSslEndpointLoadCertificateSync
UxSslFreeAchContext
UxSslFreeAscContext
UxSslFreeBufferIndication
UxSslFreeConnection
UxSslFreeSendBufferList
UxSslFreeTlsExtensions
UxSslGetProperties
UxSslGetTokenBinding
UxSslIdealBacklogEvent
UxSslIngressDisconnectEvent
UxSslInitiateAbort
UxSslInitiateSend
UxSslInvalidateCertificate
UxSslIoReadyEvent
UxSslLogEndpointEvent
UxSslOpenConfigRegistryKey
UxSslPeriodicCertificateScavenger
UxSslPostsendCheck
UxSslQueueDisconnectEvent
UxSslQueueIndicationList
UxSslQueueReceiverWorkItem
UxSslQueueReceiverWorkItemEx
UxSslReadConfigurationPropertiesFromUser
UxSslReceiverQueueServerHelloMessage
UxSslReleaseEndpointConfiguration
UxSslReleaseReceiveBuffers
UxSslReplaceEndpointConfig
UxSslRestartSendRawData
UxSslScavengeCertificate
UxSslSendHelloRequest
UxSslSendRawData
UxSslSetCurrentLookupConfig
UxSslSetEndpointConfig
UxSslSetEndpointLookupState
UxSslStartRenegotiationTimer
UxSslStartSenderModule
UxSslStopReceiverFacet
UxSslStopRenegotiationTimer
UxSslStopSenderModule
UxSslUnloadCertificate
UxSslValidateSni
UxStartEnvironmentModule
UxTpTransmitPacket
UxpQuicAbortConnectionLocked
UxpQuicCacheTlsClientHello
UxpQuicCompleteDecodeControlBytes
UxpQuicCompleteEncodeControlBytes
UxpQuicConfigurationLoadComplete
UxpQuicCopyPeerCertToIrp
UxpQuicCreateCustomAlpnArray
UxpQuicFreeConfigurationContext
UxpQuicFreeDataIndication
UxpQuicFreeTransportIndication
UxpQuicParseCancelPushFrame
UxpQuicParseDataFrame
UxpQuicParseGoawayFrame
UxpQuicParseHeadersFrame
UxpQuicParseIntegerOnlyFrame
UxpQuicParseMaxPushIdFrame
UxpQuicParsePushPromiseFrame
UxpQuicParseSettingsFrame
UxpQuicReceiveControlStreamReceiveEvent
UxpQuicReceivePeerDecodeControlStreamReceiveEvent
UxpQuicReceivePeerEncodeControlStreamReceiveEvent
UxpQuicStreamAbortLocked
UxpQuicStreamDetach
UxpQuicStreamIndicateHeadersEvent
UxpQuicStreamIndicateIngressDisconnect
UxpQuicStreamPeerReceiveAbort
UxpQuicStreamProcessReceiveWorkItem
UxpQuicStreamReceiveEvent
UxpQuicStreamSendShutdownComplete
UxpQuicStreamShutdownComplete
UxpQuicStreamStartDrain
UxpQuicUnknownStreamReceiveEvent
UxpSslAcquireCredentialsHandleCreationCallback
UxpSslCertificateScavenger
UxpSslCleanupConnection
UxpSslCleanupDecryptPendingList
UxpSslCleanupTransportIndicationList
UxpSslCommonSendDataHelper
UxpSslConnectionDecryptData
UxpSslConsumeReceiveBufferSpace
UxpSslCopyCertificateParam
UxpSslCopyClientCertToIrp
UxpSslCopyTransportIndicationsToHandshakeBuffer
UxpSslDeleteEndpointConfigLocked
UxpSslEndpointFreeTlsExtensions
UxpSslEndpointInvalidateCertificate
UxpSslEndpointLogEvent
UxpSslEndpointLookupCompleteHandler
UxpSslEndpointParseSni
UxpSslEndpointSetNotifyCallout
UxpSslEndpointThrottleHandler
UxpSslEndpointUnloadCertificate
UxpSslEnumerateEndpointConfigs
UxpSslExpandTransportDataIndication
UxpSslFindCcsHandler
UxpSslFindIpHandler
UxpSslFindIpv4WildcardHandler
UxpSslFindIpv6WildcardHandler
UxpSslFindSniHandler
UxpSslFreeDataIndication
UxpSslFreeRegistration
UxpSslFreeSendRequestTracker
UxpSslGetHandshakeSizes
UxpSslGetHandshakeTiming
UxpSslHandleRenegotiateRequest
UxpSslIndicateReceiveEvent
UxpSslInitializeCcsConfigurationByRegistryIndex
UxpSslInitializeCcsConfigurationByUserKey
UxpSslInitializeHostConfigByRegistryIndexHelper
UxpSslInitializeHostConfigByUserKeyHelper
UxpSslInitializeIpConfigurationByRegistryIndex
UxpSslLoadCertificateWorker
UxpSslLogHandshakeFailure
UxpSslProcessCloseNotify
UxpSslReceiver
UxpSslReceiverWorker
UxpSslRemoveEndpointConfig
UxpSslRetrieveIrpCancelRoutine
UxpSslScavengerCallback
UxpSslSendStaticServerHello
UxpSslSetAscCountTaken
UxpSslSetConnectionState
UxpSslSetIrpConnection
UxpSslSetNotifyCallout
UxpSslUnloadEndpointCertificateWorker
UxpSslValidateHostConfigurationProperties
UxpSslValidateHostname
UxpSslWaitForAscHandler
UxpSslWriteCcsConfigurationToRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpSslWriteIpConfigurationToRegistry
UxpTpDequeueTransmitPacket
UxpTpEnqueueTransmitPacket
UxpTpProcessMdlRuns

Expand for full list:
Feature_1164959034__private_IsEnabledFallback
Feature_1255102777__private_IsEnabledFallback
Feature_1282877755__private_IsEnabledFallback
Feature_DtHttpIsbLimitHttp2__private_IsEnabledFallback
Feature_HttpBugFix2605__private_IsEnabledFallback
Feature_HttpBugFix26Q1__private_IsEnabledFallback
Feature_HttpBugFix26Q2__private_IsEnabledFallback
Feature_HttpPerformanceImprovements__private_IsEnabledFallback
Feature_HttpQueryTcpTtlRedux__private_IsEnabledFallback
Feature_HttpTlsHandshakePerfCounter__private_IsEnabledFallback
Feature_HttpsysHKERangeRequestH2StatusCode__private_IsEnabledFallback

Feature_ModernWpp__private_IsEnabledFallback
Feature_MsQuic_2_5__private_IsEnabledFallback
Feature_NVBugFixes2507__private_IsEnabledFallback
Feature_NewUMAHttpSys__private_IsEnabledFallback
Feature_RefactorIoctls__private_IsEnabledFallback

Expand for full list:
Feature_1164959034__private_IsEnabledFallback
Feature_1255102777__private_IsEnabledFallback
Feature_1282877755__private_IsEnabledFallback
Feature_1508879674__private_IsEnabledFallback
Feature_3936850235__private_IsEnabledFallback
Feature_DtHttpIsbLimitHttp2__private_IsEnabledFallback
Feature_HttpBugFix2605__private_IsEnabledFallback
Feature_HttpBugFix26Q1__private_IsEnabledFallback
Feature_HttpBugFix26Q2__private_IsEnabledFallback
Feature_HttpPerformanceImprovements__private_IsEnabledFallback
Feature_HttpQueryTcpTtlRedux__private_IsEnabledFallback

Feature_HttpTlsHandshakePerfCounter__private_IsEnabledFallback
Feature_HttpsysHKERangeRequestH2StatusCode__private_IsEnabledFallback
Feature_ModernWpp__private_IsEnabledFallback
Feature_MsQuic_2_5__private_IsEnabledFallback
Feature_NVBugFixes2507__private_IsEnabledFallback
Feature_NewUMAHttpSys__private_IsEnabledFallback
Feature_RefactorIoctls__private_IsEnabledFallback

Expand for full list:
UlAiFreeAddressInformation
UlAiGetAddressInformation
UlBugCheckEx
UlEtIsConnectionEdgeTraversed
UxPodReferenceSilo
UxTlGetDscpTag
UxTlGetTcpFastOpen
UxTlGetTcpInfo
UxTlGetTcpInitialPacketTtl
UxTlQosSetFlowOnConnection
UxTlSetAggressiveIcw

UxTlSetDscpTag
UxTlSetIsbPrecision
WPP_SF_D
WPP_SF_qL
WPP_SF_qLqqqq

| |`calling`|

| |paramcount|0|0| |address|14000e420|14000e420| |sig|undefined UxTlConnectionControl(void)|undefined UxTlConnectionControl(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UxTlConnectionControl Calling Diff ```diff --- UxTlConnectionControl calling +++ UxTlConnectionControl calling @@ -1,2 +1,2 @@ -FUN_140177384 -FUN_14017dad4 +FUN_14017757e +FUN_14017dd94 @@ -10 +9,0 @@ -UlParseRequestHeaderPairs @@ -30 +29 @@ -switchD_14016e49c::caseD_b +switchD_14016e75c::caseD_b ``` ## UxReadBoundedULongSetting ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|UxReadBoundedULongSetting|UxReadBoundedULongSetting| |fullname|UxReadBoundedULongSetting|UxReadBoundedULongSetting| |`refcount`|38|39| |length|119|119| |called|UlReadLongParameter|UlReadLongParameter| |calling|UxReadErrorLogSettings
UxReadHttp11ParserSettings
UxStartEnvironmentFacet
UxStartEnvironmentModule|UxReadErrorLogSettings
UxReadHttp11ParserSettings
UxStartEnvironmentFacet
UxStartEnvironmentModule| |paramcount|0|0| |`address`|1400bb598|1400bb740| |sig|undefined UxReadBoundedULongSetting(void)|undefined UxReadBoundedULongSetting(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NTOSKRNL.EXE::ExAllocatePool3 ### Match Info |Key|http-8521.sys - http-8655.sys| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|http-8521.sys|http-8655.sys| | :---: | :---: | :---: | |name|ExAllocatePool3|ExAllocatePool3| |fullname|NTOSKRNL.EXE::ExAllocatePool3|NTOSKRNL.EXE::ExAllocatePool3| |`refcount`|317|318| |length|0|0| |called||| |`calling`|

Expand for full list:
FUN_1401743f6
FUN_140174b6c
FUN_14017cb64
FUN_14017dd20
FastWppTraceMessage
HttpNormalizeNamedHost
HttppNormalizePath
HttppRebuildFixedUrl
PplpCreateLookasideListEx
UcAllocateConnection
UcAllocateConnectionParameters

UcAllocateCredential
UcAllocateCredentialParameters
UcAllocateStream
UcStreamAllocateSendTracker
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpGetSendHeadersPairs
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UlAddServiceNameToContainer
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateFastTracker
UlAllocateLogDataBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateServiceNameContainer
UlAllocateToLookaside
UlAllocateWideString
UlAppendHeaderValue
UlAuthenticate
UlCGCreateHashTable
UlCanSatisfyRangesFromCache
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlConfigLogging
UlContentRangeHeaderHandler
UlCookUrl
UlCreateAuthCache
UlCreateCommChannel
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlEventLogCreateFailure
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlCopyFlowRateParamsToCache
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeNotifyAttachClient
UlHkeRegisterExtension
UlInitializeHashTable
UlLookupHeader
UlParseCompareUriWithRequestUri
UlPmHotAddNotify
UlPmStartModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlResponseInfoParsing
UlScStartCounters
UlScStartFacet
UlSendCachedResponse
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlStartConfigGroupFacet
UlpAddIpAddressToList
UlpAiInsertAddress
UlpAllocErrorLogBuffer
UlpAllocateAuthCacheEntry
UlpAllocateAuthToken
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateParsedParams
UlpAllocateRequestQueue
UlpAllocateServerSession
UlpBindSchemeToPort
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpComputeSecureHash
UlpCopyFilterData
UlpCopyRequestToBuffer
UlpCopyRequestToBufferOld
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateDigestContextCacheKey
UlpCreateFastForwardDataContext
UlpCreateLoggingConfig
UlpCreateTargetServiceName
UlpDeliverRequestStagePolicies
UlpDuplicateChunksForCacheSlice
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFlatCacheRangeWrapper
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetResponseInfo
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeBuilderPrepareForRequest
UlpInitTokenBufferLookaside
UlpInitializeAlternateCredential
UlpInitializeThreadPoolArena
UlpInitializeThreadPoolQueue
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpParseAcceptEncoding
UlpParseNextRequest
UlpParseUnknownHeader
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpSendCacheEntry
UlpSetRequestQueueExternalId
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UxAllocateMdlAndBufferEx
UxAllocateRefBlob
UxAppendCopyToAggregator
UxCaptureString
UxCaptureWideString
UxCopyTrailersChunk32
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAttachConnection
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoCaptureDeclarePushParameters
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocateInternal
UxDuoHpackAllocatePairs
UxDuoSanitizeDeclarePushParameters
UxGenerateSubdomainWildcardHostname
UxOpenSubKeyByIndex
UxQuicBufferInitialize
UxQuicConnectionQueueDecoderReset
UxQuicCreateConnection
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushSendCreateContext
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCreateConfiguration
UxSslGetAltSvcInfo
UxSslInitializeCertificateContext
UxSslInitializeClientCertPolicy
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxStartOpaqueIdModule
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxWfpAllocateThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxpAllocateHeaderBufferBlock
UxpDuoCaptureHostName
UxpExpandOpaqueIdTable
UxpQuicAllocateConfigurationContext
UxpQuicAllocateTransportIndication
UxpQuicBufferExpandBuffer
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpSslAllocateRegistration
UxpSslAllocateTableNode
UxpSslCommonSendDataHelper
UxpSslConfigToPrincipal
UxpSslCopySniForEtwFiltering
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslGetClientHello
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpTlCreateAddressEndpoint
UxpTlCreateListenEndpoint
UxpTpAllocateChunkTracker
UxpTpDirectTransmitFromMdl
UxpTpProcessMemoryBuffer
UxpWskAcquirePortReservation
UxpWskQosNotifyAttachProvider

Expand for full list:
FUN_1401745f0
FUN_140174d66
FUN_14017ce24
FUN_14017dfe0
FastWppTraceMessage
HttpNormalizeNamedHost
HttppNormalizePath
HttppRebuildFixedUrl
PplpCreateLookasideListEx
UcAllocateConnection
UcAllocateConnectionParameters

UcAllocateCredential
UcAllocateCredentialParameters
UcAllocateStream
UcStreamAllocateSendTracker
UcpAllocateClientSession
UcpAllocateClientSessionContext
UcpGetSendHeadersPairs
UcpStreamAllocateReceiveBuffer
UcpStreamCreateHeaderBuffer
UlAddServiceNameToContainer
UlAllocateBuildTracker
UlAllocateCacheEntry
UlAllocateCacheTracker
UlAllocateChannelBindToken
UlAllocateFastTracker
UlAllocateLogDataBuffer
UlAllocatePerNode
UlAllocateRequestBuffer
UlAllocateServiceNameContainer
UlAllocateToLookaside
UlAllocateWideString
UlAppendHeaderValue
UlAuthenticate
UlCGCreateHashTable
UlCanSatisfyRangesFromCache
UlCaptureTokenUserByHandle
UlCaptureTokenUserByPointer
UlCaptureWideString
UlCheckAuthHeader
UlConfigLogging
UlContentRangeHeaderHandler
UlCookUrl
UlCreateAuthCache
UlCreateCommChannel
UlCreateConsumerHelper
UlCreateSecurityDescriptor
UlEventLogCreateFailure
UlFlAddPerResponseFlow
UlFlCaptureFlowRateInfoOld
UlFlCopyFlowRateParamsToCache
UlFlFlowRateInfoProcessing
UlFlushCacheByUri
UlGenerateDigestChallenge
UlGenerateRoutingToken
UlGetCGroupForRequest
UlGetServerHeader
UlHkeNotifyAttachClient
UlHkeRegisterExtension
UlInitializeHashTable
UlLookupHeader
UlParseCompareUriWithRequestUri
UlPmHotAddNotify
UlPmStartModule
UlPrepare416Response
UlPrepareCacheMissRangeResponse
UlPrepareParsedHeader416Response
UlPrepareParsedHeaderRangeResponse
UlQueryDirectory
UlReadGenericParameter
UlReadStringParameter
UlRefreshFileName
UlReplaceHeaderValue
UlResponseInfoParsing
UlScStartCounters
UlScStartFacet
UlSendCachedResponse
UlSendHttpResponseIoctlOld
UlSendResponseOrEntityBodyFastIoOld
UlSendSimpleStatus
UlSetConnectionsProperty
UlStartConfigGroupFacet
UlpAddIpAddressToList
UlpAiInsertAddress
UlpAllocErrorLogBuffer
UlpAllocateAuthCacheEntry
UlpAllocateAuthToken
UlpAllocateConfigGroupObject
UlpAllocateConsumer
UlpAllocateInternalResponse
UlpAllocateParsedParams
UlpAllocateRequestQueue
UlpAllocateServerSession
UlpBindSchemeToPort
UlpBuildEdgePolicyNotifyListForConfigGroup
UlpBuildMultiRangeMdlChainFromSlices
UlpBuildParsedHeaderRangeResponseFromSlices
UlpBuildSingleRangeMdlChainFromSlices
UlpCaptureBasicParams
UlpCaptureDigestParams
UlpCaptureSoftwareDirective
UlpCompleteAuthInfo
UlpCompleteLogRecordETW
UlpComputeSecureHash
UlpCopyFilterData
UlpCopyRequestToBuffer
UlpCopyRequestToBufferOld
UlpCopyTokenIntegrityLevel
UlpCreateBasicTokenCacheKey
UlpCreateCacheRangeSliceTracker
UlpCreateDigestContextCacheKey
UlpCreateFastForwardDataContext
UlpCreateLoggingConfig
UlpCreateTargetServiceName
UlpDeliverRequestStagePolicies
UlpDuplicateChunksForCacheSlice
UlpDuplicateSliceTrackerForCache
UlpFastAuthenticate
UlpFlatCacheRangeWrapper
UlpGetChunkInfo
UlpGetChunkInfoOld
UlpGetResponseInfo
UlpHandleErrorLogFileRecycle
UlpHandleRecycle
UlpHkeBuilderAddKnownHeader
UlpHkeBuilderAddUnknownHeader
UlpHkeBuilderModifyKnownHeader
UlpHkeBuilderModifyStatusCode
UlpHkeBuilderModifyUnknownHeader
UlpHkeBuilderPrepareForRequest
UlpInitTokenBufferLookaside
UlpInitializeAlternateCredential
UlpInitializeThreadPoolArena
UlpInitializeThreadPoolQueue
UlpInitializeThreadPoolWorkers
UlpInitializeTimerUnit
UlpLogSpecificInitFailure
UlpMergeSlicesToCache
UlpModifyLoggingConfig
UlpParseAcceptEncoding
UlpParseUnknownHeader
UlpPcwCreateInstance
UlpQueryAttributeInfo
UlpQueryLogFileSecurity
UlpReadReservations
UlpRebuildResponseHeaders
UlpReferenceBuffers
UlpSendCacheEntry
UlpSetRequestQueueExternalId
UlpTreeInsertEntry
UlpUpdateReservationInRegistry
UxAllocateMdlAndBufferEx
UxAllocateRefBlob
UxAppendCopyToAggregator
UxCaptureString
UxCaptureWideString
UxCopyTrailersChunk32
UxDuoAllocateJob
UxDuoAllocateParcel
UxDuoAllocateRunner
UxDuoAttachConnection
UxDuoBuildCatalogFrames
UxDuoBuildContinuationChain
UxDuoBuildDataFrames
UxDuoBuildStreamEndFrame
UxDuoCaptureDeclarePushParameters
UxDuoDispatchAltSvcParcel
UxDuoDispatchParcel
UxDuoDispatchWindowParcel
UxDuoExecuteStreamDisconnect
UxDuoHpackAllocateBlock
UxDuoHpackAllocateInternal
UxDuoHpackAllocatePairs
UxDuoSanitizeDeclarePushParameters
UxGenerateSubdomainWildcardHostname
UxOpenSubKeyByIndex
UxQuicBufferInitialize
UxQuicConnectionQueueDecoderReset
UxQuicCreateConnection
UxQuicCreateSendTracker
UxQuicCreateSession
UxQuicStreamPushInjectCreateContext
UxQuicStreamPushSendCreateContext
UxReadFileEntry
UxReadRegistryKeyValue
UxSetExbufferSize
UxSslAllocateAchContext
UxSslAllocateAscContext
UxSslAllocateSendBuffer
UxSslAllocateTransportDataIndication
UxSslCaptureCertConfig
UxSslCaptureErrorHeaders
UxSslCopyErrorHeaders
UxSslCopyExtendedProperties
UxSslCreateConfiguration
UxSslGetAltSvcInfo
UxSslInitializeCertificateContext
UxSslInitializeClientCertPolicy
UxSslOpenConfigRegistryKey
UxSslParseSni
UxSslParseTlsRestrictions
UxSslReadExtendedConfigurationPropertiesFromUser
UxSslSetTokenBinding
UxSslStartReceiverFacet
UxSslStartSenderModule
UxStartOpaqueIdModule
UxTlAllocateConnectionForLookaside
UxTlCreateListenAddressList
UxWfpAllocateThrottleContext
UxWskNotifyAttachProvider
UxWskStartFacet
UxpAllocateHeaderBufferBlock
UxpDuoCaptureHostName
UxpExpandOpaqueIdTable
UxpQuicAllocateConfigurationContext
UxpQuicAllocateTransportIndication
UxpQuicBufferExpandBuffer
UxpQuicConnectionQueryIssuerListInfo
UxpQuicConnectionStoreClientCert
UxpQuicConvertString
UxpQuicCreateCustomAlpnArray
UxpQuicInitializeConfigurationContext
UxpQuicListenerNewConnection
UxpQuicQueryConnectionInfo
UxpSslAllocateRegistration
UxpSslAllocateTableNode
UxpSslCommonSendDataHelper
UxpSslConfigToPrincipal
UxpSslCopySniForEtwFiltering
UxpSslDeleteTlsRestrictionsFromRegistry
UxpSslGetClientHello
UxpSslInitializeEndpointTable
UxpSslInitializeSchCredentials
UxpSslParseAndCopyDataIndication
UxpSslPrepareSendBuffer
UxpSslReadCertConfigFromRegistry
UxpSslReadConfigurationPropertiesFromRegistry
UxpSslReadErrorHeadersFromRegistry
UxpSslReadTlsRestrictionsFromRegistry
UxpSslWriteHostConfigToRegistryHelper
UxpTlCreateAddressEndpoint
UxpTlCreateListenEndpoint
UxpTpAllocateChunkTracker
UxpTpDirectTransmitFromMdl
UxpTpProcessMemoryBuffer
UxpWskAcquirePortReservation
UxpWskQosNotifyAttachProvider

| |paramcount|0|0| |address|EXTERNAL:00000143|EXTERNAL:00000143| |sig|undefined ExAllocatePool3(void)|undefined ExAllocatePool3(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTOSKRNL.EXE::ExAllocatePool3 Calling Diff ```diff --- NTOSKRNL.EXE::ExAllocatePool3 calling +++ NTOSKRNL.EXE::ExAllocatePool3 calling @@ -1,4 +1,4 @@ -FUN_1401743f6 -FUN_140174b6c -FUN_14017cb64 -FUN_14017dd20 +FUN_1401745f0 +FUN_140174d66 +FUN_14017ce24 +FUN_14017dfe0 @@ -141 +140,0 @@ -UlpParseNextRequest @@ -147,0 +147 @@ +UlpReferenceBuffers ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-15T23:31:09}