# ikeext.dll 22000.318 vs 22000.434 (CVE-2022-21849, manual pair) # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [IkeFreeMMSA](#ikefreemmsa) * [IkeVerifyDosCookieIkeV2](#ikeverifydoscookieikev2) * [IkeLookupVendorId](#ikelookupvendorid) * [IkeHandleErrorNotifyIkeV2](#ikehandleerrornotifyikev2) * [IkeFindMMPolicy](#ikefindmmpolicy) * [IkeQueueRecvRequest](#ikequeuerecvrequest) * [IkeProcessPacketDispatch](#ikeprocesspacketdispatch) * [IkeReceiveCallback](#ikereceivecallback) * [IkeHandleStatusNotifyIkeV2](#ikehandlestatusnotifyikev2) * [IkeVerifyPacketHeader](#ikeverifypacketheader) * [IkeProcessNotifyPayloadGroupIkeV2](#ikeprocessnotifypayloadgroupikev2) * [IkeHandlePayloadMMVendorId](#ikehandlepayloadmmvendorid) * [IkeHandleNotifyIkeV2](#ikehandlenotifyikev2) * [IkeInitMMResponderPhase1](#ikeinitmmresponderphase1) * [IkeIsVendorIdPresent](#ikeisvendoridpresent) * [WPP_SF_iSsdd](#wpp_sf_issdd) * [IkeAddrDump](#ikeaddrdump) * [Modified (No Code Changes)](#modified-no-code-changes) * [WPP_SF_iSqq](#wpp_sf_isqq) * [_tlgKeywordOn](#_tlgkeywordon) * [_tlgCreate1Sz_wchar_t](#_tlgcreate1sz_wchar_t) * [WfpReportAppErrorAsWinError](#wfpreportapperroraswinerror) * [_tlgCreate1Sz_char](#_tlgcreate1sz_char) * [IkeDoingIkeV2](#ikedoingikev2) * [IkeGetTlsPeerAddr](#ikegettlspeeraddr) * [__GSHandlerCheck](#__gshandlercheck) * [MicrosoftTelemetryAssertTriggeredNoArgs](#microsofttelemetryasserttriggerednoargs) * [_tlgWriteTransfer_EtwEventWriteTransfer](#_tlgwritetransfer_etweventwritetransfer) * [WPP_SF_iS](#wpp_sf_is) * [IkeGetTlsMmLuid](#ikegettlsmmluid) * [WPP_SF_iSD](#wpp_sf_isd) * [WfpReportSysErrorAsWinError](#wfpreportsyserroraswinerror) # Visual Chart Diff ```mermaid flowchart LR IkeFreeMMSA-4-old<--Match 98%-->IkeFreeMMSA-4-new IkeVerifyDosCookieIkeV2-4-old<--Match 62%-->IkeVerifyDosCookieIkeV2-4-new IkeLookupVendorId-6-old<--Match 63%-->IkeLookupVendorId-6-new IkeHandleErrorNotifyIkeV2-7-old<--Match 72%-->IkeHandleErrorNotifyIkeV2-7-new IkeFindMMPolicy-5-old<--Match 98%-->IkeFindMMPolicy-5-new IkeQueueRecvRequest-4-old<--Match 90%-->IkeQueueRecvRequest-4-new IkeProcessPacketDispatch-4-old<--Match 96%-->IkeProcessPacketDispatch-4-new IkeReceiveCallback-4-old<--Match 62%-->IkeReceiveCallback-4-new IkeHandleStatusNotifyIkeV2-5-old<--Match 45%-->IkeHandleStatusNotifyIkeV2-5-new IkeVerifyPacketHeader-1-old<--Match 0%-->IkeVerifyPacketHeader-1-new IkeProcessNotifyPayloadGroupIkeV2-4-old<--Match 98%-->IkeProcessNotifyPayloadGroupIkeV2-4-new IkeHandlePayloadMMVendorId-4-old<--Match 99%-->IkeHandlePayloadMMVendorId-4-new IkeHandleNotifyIkeV2-4-old<--Match 81%-->IkeHandleNotifyIkeV2-4-new IkeInitMMResponderPhase1-4-old<--Match 80%-->IkeInitMMResponderPhase1-4-new IkeIsVendorIdPresent-4-old<--Match 93%-->IkeIsVendorIdPresent-4-new WPP_SF_iSsdd-6-old<--Match 99%-->WPP_SF_iSsdd-6-new IkeAddrDump-4-old<--Match 98%-->IkeAddrDump-4-new subgraph ikeext-10.0.22000.434.dll IkeFreeMMSA-4-new IkeVerifyDosCookieIkeV2-4-new IkeLookupVendorId-6-new IkeHandleErrorNotifyIkeV2-7-new IkeFindMMPolicy-5-new IkeQueueRecvRequest-4-new IkeProcessPacketDispatch-4-new IkeReceiveCallback-4-new IkeHandleStatusNotifyIkeV2-5-new IkeVerifyPacketHeader-1-new IkeProcessNotifyPayloadGroupIkeV2-4-new IkeHandlePayloadMMVendorId-4-new IkeHandleNotifyIkeV2-4-new IkeInitMMResponderPhase1-4-new IkeIsVendorIdPresent-4-new WPP_SF_iSsdd-6-new IkeAddrDump-4-new end subgraph ikeext-10.0.22000.318.dll IkeFreeMMSA-4-old IkeVerifyDosCookieIkeV2-4-old IkeLookupVendorId-6-old IkeHandleErrorNotifyIkeV2-7-old IkeFindMMPolicy-5-old IkeQueueRecvRequest-4-old IkeProcessPacketDispatch-4-old IkeReceiveCallback-4-old IkeHandleStatusNotifyIkeV2-5-old IkeVerifyPacketHeader-1-old IkeProcessNotifyPayloadGroupIkeV2-4-old IkeHandlePayloadMMVendorId-4-old IkeHandleNotifyIkeV2-4-old IkeInitMMResponderPhase1-4-old IkeIsVendorIdPresent-4-old WPP_SF_iSsdd-6-old IkeAddrDump-4-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 5712 ``` ```mermaid pie showData title Matched Function Similarity - 99.4398% "matched_funcs_with_code_changes_len" : 17 "matched_funcs_with_non_code_changes_len" : 15 "matched_funcs_no_changes_len" : 5680 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21849\ghidra_projects --project-name CVE-2022-21849 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21849\symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 --md-title ikeext.dll 22000.318 vs 22000.434 (CVE-2022-21849, manual pair) ikeext-10.0.22000.318.dll ikeext-10.0.22000.434.dll ``` #### Verbose Args
``` --old ['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2022-21849\\ikeext-10.0.22000.318.dll'] --new [['C:\\tools\\hugo\\patchpalooza\\ghidriff\\CVE-2022-21849\\ikeext-10.0.22000.434.dll']] --engine VersionTrackingDiff --output-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21849\output --summary False --project-location C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21849\ghidra_projects --project-name CVE-2022-21849 --symbols-path C:\tools\hugo\patchpalooza\ghidriff\CVE-2022-21849\symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title ikeext.dll 22000.318 vs 22000.434 (CVE-2022-21849, manual pair) ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/IKEEXT.DLL/95DF4EE6174000/IKEEXT.DLL -O ikeext.dll.x64.10.0.22000.318 wget https://msdl.microsoft.com/download/symbols/IKEEXT.DLL/156CC455175000/IKEEXT.DLL -O ikeext.dll.x64.10.0.22000.435 ``` ## Binary Metadata Diff ```diff --- ikeext-10.0.22000.318.dll Meta +++ ikeext-10.0.22000.434.dll Meta @@ -1,44 +1,44 @@ -Program Name: ikeext-10.0.22000.318.dll +Program Name: ikeext-10.0.22000.434.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1527552 +# of Bytes: 1531648 # of Memory Blocks: 9 -# of Instructions: 254504 -# of Defined Data: 15829 +# of Instructions: 254917 +# of Defined Data: 15940 # of Functions: 2856 -# of Symbols: 42632 +# of Symbols: 42670 # of Data Types: 815 # of Data Type Categories: 50 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Tue Jul 28 09:03:16 SGT 2026 +Date Created: Tue Jul 28 09:03:23 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21849/ikeext-10.0.22000.318.dll -Executable MD5: ab8f135ea0bcb99be65dabea538de000 -Executable SHA256: 6a606ad518e2438b49356742914748c4c0386e47b3ea79e4de1e1067685e11d3 -FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21849/ikeext-10.0.22000.318.dll?MD5=ab8f135ea0bcb99be65dabea538de000 +Executable Location: /C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21849/ikeext-10.0.22000.434.dll +Executable MD5: b861dd7951e2986637543ceea243fac5 +Executable SHA256: 51a27d16c50609c94a0178d4443cbf017fcf547f91b63687c559978e5a13aae8 +FSRL: file:///C:/tools/hugo/patchpalooza/ghidriff/CVE-2022-21849/ikeext-10.0.22000.434.dll?MD5=b861dd7951e2986637543ceea243fac5 PDB Age: 1 PDB File: ikeext.pdb -PDB GUID: 000b46dd-3e1b-f8f9-5fe5-da4d1185b433 +PDB GUID: 17ec3708-78ee-2677-1707-3702432530f0 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: IKE extension -PE Property[FileVersion]: 10.0.22000.318 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22000.435 (WinBuild.160101.0800) PE Property[InternalName]: IKEEXT.DLL PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: IKEEXT.DLL PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22000.318 +PE Property[ProductVersion]: 10.0.22000.435 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra ikeext-10.0.22000.318.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ikeext-10.0.22000.318.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ikeext-10.0.22000.318.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra ikeext-10.0.22000.434.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ikeext-10.0.22000.434.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ikeext-10.0.22000.434.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|32| |added_symbols_len|3| |deleted_symbols_len|3| |diff_time|43.99211502075195| |deleted_strings_len|0| |added_strings_len|6| |match_types|Counter({'SymbolsHash': 2798, 'ExternalsName': 422, 'StructuralGraphHash': 153, 'ExactInstructionsFunctionHasher': 6, 'StringsRefsHasher': 5, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| |items_to_process|38| |diff_types|Counter({'address': 27, 'length': 18, 'code': 17, 'refcount': 16, 'sig': 11, 'calling': 11, 'called': 8})| |unmatched_funcs_len|0| |total_funcs_len|5712| |matched_funcs_len|5712| |matched_funcs_with_code_changes_len|17| |matched_funcs_with_non_code_changes_len|15| |matched_funcs_no_changes_len|5680| |match_func_similarity_percent|99.4398%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'SymbolsHash': 2798, 'StructuralGraphHash': 153, 'ExactInstructionsFunctionHasher': 6, 'StringsRefsHasher': 5, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 2798 "ExternalsName" : 422 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 6 "BSIM" : 1 "StringsRefsHasher" : 5 "StructuralGraphHash" : 153 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2798 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 6 "BSIM" : 1 "StringsRefsHasher" : 5 "StructuralGraphHash" : 153 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 32 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 3 "deleted_symbols_len" : 3 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 6 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,6 @@ +s_Ignoring_the_vendor,_received_S +s_Process_Rekey_SA_notify +s_Process_exchange_info_notify +s_Process_transport_notify +s_Received_an_invlaid_CookieSize +s_Received_an_invlaid_notifyLen ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_Ignoring_the_vendor,_received_S|1|IkeLookupVendorId| |s_Received_an_invlaid_notifyLen|2|IkeHandleNotifyIkeV2,IkeHandleErrorNotifyIkeV2| |s_Process_exchange_info_notify|1|IkeHandleStatusNotifyIkeV2| |s_Received_an_invlaid_CookieSize|1|IkeVerifyDosCookieIkeV2| |s_Process_transport_notify|1|IkeHandleStatusNotifyIkeV2| |s_Process_Rekey_SA_notify|1|IkeHandleStatusNotifyIkeV2| # Deleted # Added # Modified *Modified functions contain code changes* ## IkeFreeMMSA ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.44| |i_ratio|0.63| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeFreeMMSA|IkeFreeMMSA| |fullname|IkeFreeMMSA|IkeFreeMMSA| |refcount|7|7| |`length`|4248|4293| |called|
Expand for full list:
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
CompleteMobikeContext
EtwEx_tidActivityInfo
FWPUCLNT.DLL::FwpmFreeMemory0
FreeFragEntry
IkeAddrGetAddrBytesIkeAddrGetIPVersion
IkeAddrGetPort
IkeClearDosModeFlag
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeDerefEntryInAuthzBypassTable
IkeDestroyAcquireContext
IkeDestroyPacketContext
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDoingIkeV2ePDGVpnTunnel
IkeFreeCertInfo
IkeFreeCrypto
IkeFreeInformationalReqList
IkeFreeIpsecIdSids
IkeFreeLarvalOnError
IkeFreeMobikeNotifyInfo
IkeFreeNotifyContext
IkeFreePacket
IkeFreeQMCrypto
IkeFreeRecvPolicy
IkeFreeSspi
IkeFreeUMPolicy
IkeFreeZombieQMContextListEntry
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeGlobalStatsUpdateCurrentUMs
IkeLpmSupportEnabled
IkeRemoveWpIfIndexRef
IkeReturnError
Ikev2ClearFragmentListEntryList
NTDLL.DLL::RtlRemoveEntryHashTable
TraceLogHelper
UMPDC.DLL::Pdcv2ActivationClientDeactivate
WPP_SF_iSD
WPP_SF_iSIqq
WfpMemFree
WfpMidlObjectDestroySafe
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::DeleteCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
CompleteMobikeContext
EtwEx_tidActivityInfo
FWPUCLNT.DLL::FwpmFreeMemory0
FreeFragEntry
IkeAddrGetAddrBytesIkeAddrGetIPVersion
IkeAddrGetPort
IkeClearDosModeFlag
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeDerefEntryInAuthzBypassTable
IkeDestroyAcquireContext
IkeDestroyPacketContext
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDoingIkeV2ePDGVpnTunnel
IkeFreeCertInfo
IkeFreeCrypto
IkeFreeInformationalReqList
IkeFreeIpsecIdSids
IkeFreeLarvalOnError
IkeFreeMobikeNotifyInfo
IkeFreeNotifyContext
IkeFreePacket
IkeFreeQMCrypto
IkeFreeRecvPolicy
IkeFreeSspi
IkeFreeUMPolicy
IkeFreeZombieQMContextListEntry
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeGlobalStatsUpdateCurrentUMs
IkeLpmSupportEnabled
IkeRemoveWpIfIndexRef
IkeReturnError
Ikev2ClearFragmentListEntryList
NTDLL.DLL::RtlRemoveEntryHashTable
TraceLogHelper
UMPDC.DLL::Pdcv2ActivationClientDeactivate
WPP_SF_iSD
WPP_SF_iSIqq
WfpMemFree
WfpMidlObjectDestroySafe
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeDeleteZombieSas
IkeProcessPacketDispatch|IkeDeleteZombieSas
IkeProcessPacketDispatch| |paramcount|4|4| |`address`|18002f070|18002f300| |`sig`|char __fastcall IkeFreeMMSA(PRTL_CRITICAL_SECTION_DEBUG param_1, undefined8 param_2, undefined * param_3, ulonglong param_4)|undefined __fastcall IkeFreeMMSA(PRTL_CRITICAL_SECTION_DEBUG param_1, undefined8 param_2, undefined * param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeFreeMMSA Diff ```diff --- IkeFreeMMSA +++ IkeFreeMMSA @@ -1,770 +1,833 @@ +/* WARNING: Instruction at (ram,0x0001800303b9) overlaps instruction at (ram,0x0001800303b8) + */ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -char IkeFreeMMSA(PRTL_CRITICAL_SECTION_DEBUG param_1,undefined8 param_2,undefined *param_3, +void IkeFreeMMSA(PRTL_CRITICAL_SECTION_DEBUG param_1,undefined8 param_2,undefined *param_3, ulonglong param_4) { LIST_ENTRY *pLVar1; LIST_ENTRY *pLVar2; - DWORD *pDVar3; - _LIST_ENTRY **pp_Var4; + _LIST_ENTRY **pp_Var3; + undefined1 uVar4; int iVar5; longlong lVar6; _RTL_CRITICAL_SECTION *p_Var7; - PRTL_CRITICAL_SECTION_DEBUG p_Var8; - longlong lVar9; - _LIST_ENTRY *p_Var10; + longlong lVar8; + IMAGE_DOS_HEADER *pIVar9; + PRTL_CRITICAL_SECTION_DEBUG p_Var10; _LIST_ENTRY *p_Var11; - _LIST_ENTRY *p_Var12; - PRTL_CRITICAL_SECTION_DEBUG p_Var13; - longlong lVar14; - longlong *plVar15; - uint *puVar16; - longlong lVar17; - code *pcVar18; - bool bVar19; + longlong lVar12; + _LIST_ENTRY *p_Var13; + uint *puVar14; + longlong lVar15; + code *pcVar16; + undefined3 uVar17; + bool bVar18; + LIST_ENTRY *pLVar19; char cVar20; uint uVar21; uint uVar22; wchar_t *pwVar23; int *piVar24; ulonglong uVar25; undefined8 uVar26; SIZE_T SVar27; longlong lVar28; longlong lVar29; char *pcVar30; - _LIST_ENTRY *p_Var31; - DWORD *pDVar32; - undefined1 *puVar33; - undefined8 *puVar34; - ulonglong uVar35; + char cVar37; + DWORD *pDVar31; + undefined1 *puVar32; + undefined8 *puVar33; + ulonglong uVar34; + longlong lVar35; longlong lVar36; - longlong lVar37; HANDLE hObject; - longlong *plVar38; - undefined *puVar39; - PRTL_CRITICAL_SECTION_DEBUG p_Var40; + int iVar38; + IMAGE_DOS_HEADER *pIVar39; + longlong *plVar40; + undefined *puVar41; + PRTL_CRITICAL_SECTION_DEBUG p_Var42; + undefined8 *puVar43; + PRTL_CRITICAL_SECTION_DEBUG unaff_RDI; longlong *lpMem; PRTL_CRITICAL_SECTION_DEBUG *lpMem_00; - PRTL_CRITICAL_SECTION_DEBUG p_Var41; - undefined1 auStackY_218 [32]; + PRTL_CRITICAL_SECTION_DEBUG p_Var44; + undefined8 auStackY_228 [3]; + undefined1 auStackY_210 [24]; undefined2 local_1d8 [2]; ushort local_1d4 [2]; PRTL_CRITICAL_SECTION_DEBUG local_1d0; - _LIST_ENTRY local_1c8; - DWORD *local_1b8; - _RTL_CRITICAL_SECTION **local_1b0; + undefined1 local_1c8 [16]; + _LIST_ENTRY *local_1b8; + _LIST_ENTRY *local_1b0; longlong local_1a8; - undefined8 local_1a0; + word local_1a0 [4]; PRTL_CRITICAL_SECTION_DEBUG local_198; undefined8 local_190; - undefined8 local_188; + byte local_188 [8]; ulonglong local_180; longlong local_178; _LIST_ENTRY *local_170; _LIST_ENTRY *local_168; ulonglong local_160 [2]; PRTL_CRITICAL_SECTION_DEBUG local_150; PRTL_CRITICAL_SECTION_DEBUG local_148; _LIST_ENTRY *local_140; undefined8 local_138; longlong local_130; PRTL_CRITICAL_SECTION_DEBUG local_128; undefined8 uStack_120; undefined8 local_118 [4]; - undefined8 *local_f8; + undefined1 *local_f8; undefined8 local_f0; longlong local_e8 [2]; longlong local_d8 [2]; PRTL_CRITICAL_SECTION_DEBUG *local_c8; undefined8 local_c0; undefined8 *local_b8; undefined8 local_b0; - undefined8 *local_a8; + byte *local_a8; undefined8 local_a0; undefined8 local_98 [4]; - _RTL_CRITICAL_SECTION ***local_78; + undefined1 *local_78; undefined8 local_70; longlong local_68 [2]; PRTL_CRITICAL_SECTION_DEBUG *local_58; undefined8 local_50; - DWORD **local_48; + undefined1 *local_48; undefined8 local_40; ulonglong local_38; - local_38 = __security_cookie ^ (ulonglong)auStackY_218; + puVar43 = auStackY_228 + 2; + local_38 = __security_cookie ^ (ulonglong)(auStackY_228 + 2); local_1d0 = param_1; TraceLogHelper("IkeFreeMMSA",1,param_3,param_4); - lVar9._0_4_ = param_1[10].Flags; - lVar9._4_2_ = param_1[10].CreatorBackTraceIndexHigh; - lVar9._6_2_ = param_1[10].SpareWORD; - bVar19 = false; - if (lVar9 != 0) { + lVar8._0_4_ = param_1[10].Flags; + lVar8._4_2_ = param_1[10].CreatorBackTraceIndexHigh; + lVar8._6_2_ = param_1[10].SpareWORD; + bVar18 = false; + if (lVar8 != 0) { param_1[10].EntryCount = 0; WfpMemFree((undefined8 *)¶m_1[10].Flags); } EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals + 0xf8)); TraceLogHelper("IkeDestroyFilterToSAStateUnderLock",1,param_3,param_4); - p_Var40 = *(PRTL_CRITICAL_SECTION_DEBUG *)¶m_1[0x17].EntryCount; - if (p_Var40 != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { + p_Var42 = *(PRTL_CRITICAL_SECTION_DEBUG *)¶m_1[0x17].EntryCount; + if (p_Var42 != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { param_1[0x17].EntryCount = 0; param_1[0x17].ContentionCount = 0; - local_128 = p_Var40; + local_128 = p_Var42; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar23 = (wchar_t *)IkeGetTlsPeerAddr(); + unaff_RDI = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsPeerAddr(); param_4 = IkeGetTlsMmLuid(); - WPP_SF_iSIqq(WPP_GLOBAL_Control[2],0x12,param_3,param_4,pwVar23); + WPP_SF_iSIqq(WPP_GLOBAL_Control[2],0x12,param_3,param_4,(wchar_t *)unaff_RDI); } - if ((4 < DAT_0) && (cVar20 = _tlgKeywordOn(0x180164278,0), cVar20 != '\0')) { - local_1a0 = IkeGetTlsMmLuid(); - local_f8 = &local_1a0; + if ((4 < DAT_0) && (cVar20 = _tlgKeywordOn(0x180165278,0), cVar20 != '\0')) { + local_1a0 = (word [4])IkeGetTlsMmLuid(); + local_f8 = local_1c8 + 0x28; local_f0 = 8; pwVar23 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_e8,pwVar23); _tlgCreate1Sz_char(local_d8,"Remove FilterToSA entry"); local_c8 = &local_198; local_b8 = &local_190; local_c0 = 8; - local_190 = 0; + local_190._0_2_ = 0; + local_190._2_2_ = 0; + local_190._4_4_ = 0; local_b0 = 8; - local_188._0_4_ = p_Var40->EntryCount; - local_188._4_4_ = p_Var40->ContentionCount; - local_a8 = &local_188; + local_188 = *(byte (*) [8])&p_Var42->EntryCount; + local_a8 = local_188; local_a0 = 8; local_198 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_1,param_3,param_4,8,local_118); + (0x180165278,&DAT_1,param_3,param_4,8,local_118); } param_3 = (undefined *)0x0; RtlRemoveEntryHashTable(gIkeExtGlobals + 0x9b8); WfpMemFree(&local_128); } + pIVar39 = (IMAGE_DOS_HEADER *)0x0; TraceLogHelper("IkeDestroyFilterToSAStateUnderLock",0,param_3,param_4); LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals + 0xf8)); - pDVar32 = ¶m_1[7].Flags; - local_1b8 = pDVar32; - switch((char)*pDVar32) { + pDVar31 = ¶m_1[7].Flags; + local_1b8 = (_LIST_ENTRY *)pDVar31; + switch((char)*pDVar31) { case '\x01': case '\x04': case '\a': break; default: - goto switchD_18002f2b8_caseD_2; + goto switchD_18002f548_caseD_2; case '\x05': case '\x06': case '\b': - bVar19 = true; - } - local_1b0 = ¶m_1[0xc].CriticalSection; - iVar5 = *(int *)local_1b0; + bVar18 = true; + } + local_1b0 = (_LIST_ENTRY *)¶m_1[0xc].CriticalSection; + iVar38 = *(int *)local_1b0; TraceLogHelper("IkeGlobalStatsUpdateCurrentMMs",1,param_3,param_4); - if (iVar5 == 0) { - if (bVar19) { + if (iVar38 == 0) { + if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x174); } else { piVar24 = (int *)(gIkeExtGlobals + 300); } } - else if (iVar5 == 1) { - if (bVar19) { + else if (iVar38 == 1) { + if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x394); } else { piVar24 = (int *)(gIkeExtGlobals + 0x34c); } } - else if (bVar19) { + else if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x5b4); } else { piVar24 = (int *)(gIkeExtGlobals + 0x56c); } LOCK(); *piVar24 = *piVar24 + -1; UNLOCK(); + pIVar39 = (IMAGE_DOS_HEADER *)0x0; TraceLogHelper("IkeGlobalStatsUpdateCurrentMMs",0,param_3,param_4); - p_Var40 = local_1d0; + p_Var42 = local_1d0; pLVar2 = &local_1d0[0xc].ProcessLocksList; if (((ulonglong)pLVar2->Flink & 1) != 0) { - p_Var31 = local_1d0[0x15].ProcessLocksList.Flink; - uVar25 = IkeFreeLarvalOnError((uint)p_Var31); + pIVar39 = (IMAGE_DOS_HEADER *)local_1d0[0x15].ProcessLocksList.Flink; + uVar25 = IkeFreeLarvalOnError((uint)pIVar39); param_3 = (undefined *)(uVar25 & 0xffffffff); - lVar6._0_2_ = p_Var40[0x15].Type; - lVar6._2_2_ = p_Var40[0x15].CreatorBackTraceIndex; - lVar6._4_4_ = *(undefined4 *)&p_Var40[0x15].field_0x4; - IkeDestroyAcquireContext(lVar6,p_Var31,(uint)uVar25); - } - p_Var7 = p_Var40[7].CriticalSection; + lVar6._0_2_ = p_Var42[0x15].Type; + lVar6._2_2_ = p_Var42[0x15].CreatorBackTraceIndex; + lVar6._4_4_ = *(undefined4 *)&p_Var42[0x15].field_0x4; + IkeDestroyAcquireContext(lVar6,pIVar39,(uint)uVar25); + } + p_Var7 = p_Var42[7].CriticalSection; if (p_Var7 != (_RTL_CRITICAL_SECTION *)0x0) { - p_Var31 = p_Var40[0x15].ProcessLocksList.Flink; - uVar25 = IkeFreeLarvalOnError((uint)p_Var31); + pIVar39 = (IMAGE_DOS_HEADER *)p_Var42[0x15].ProcessLocksList.Flink; + uVar25 = IkeFreeLarvalOnError((uint)pIVar39); param_3 = (undefined *)(uVar25 & 0xffffffff); - IkeDestroyAcquireContext((longlong)p_Var7,p_Var31,(uint)uVar25); - } - p_Var41 = p_Var40 + 2; - while (p_Var8 = *(PRTL_CRITICAL_SECTION_DEBUG *)p_Var41, param_1 = p_Var40, p_Var8 != p_Var41) { - lVar9 = *(longlong *)p_Var8; - p_Var31 = local_1c8.Blink; - if (((PRTL_CRITICAL_SECTION_DEBUG)p_Var8->CriticalSection != p_Var41) || - (*(PRTL_CRITICAL_SECTION_DEBUG *)(lVar9 + 8) != p_Var8)) goto LAB_2; - p_Var41->Type = (short)lVar9; - p_Var41->CreatorBackTraceIndex = (short)((ulonglong)lVar9 >> 0x10); - *(int *)&p_Var41->field_0x4 = (int)((ulonglong)lVar9 >> 0x20); - *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar9 + 8) = p_Var41; - IkeDestroyPacketContext((longlong)p_Var8); - } - p_Var10 = p_Var40[0x15].ProcessLocksList.Flink; + IkeDestroyAcquireContext((longlong)p_Var7,pIVar39,(uint)uVar25); + } + unaff_RDI = p_Var42 + 2; + while (p_Var44 = *(PRTL_CRITICAL_SECTION_DEBUG *)unaff_RDI, param_1 = p_Var42, + p_Var44 != unaff_RDI) { + lVar8 = *(longlong *)p_Var44; + puVar33 = auStackY_228 + 2; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; + if (((PRTL_CRITICAL_SECTION_DEBUG)p_Var44->CriticalSection != unaff_RDI) || + (puVar33 = auStackY_228 + 2, *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar8 + 8) != p_Var44)) + goto LAB_2; + unaff_RDI->Type = (short)lVar8; + unaff_RDI->CreatorBackTraceIndex = (short)((ulonglong)lVar8 >> 0x10); + *(int *)&unaff_RDI->field_0x4 = (int)((ulonglong)lVar8 >> 0x20); + *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar8 + 8) = unaff_RDI; + IkeDestroyPacketContext((longlong)p_Var44); + } + pIVar9 = (IMAGE_DOS_HEADER *)p_Var42[0x15].ProcessLocksList.Flink; + pIVar39 = (IMAGE_DOS_HEADER *)0x1; TraceLogHelper("IkeFreeAcquireList",1,param_3,param_4); - p_Var41 = p_Var40 + 1; - local_150 = p_Var41; - EnterCriticalSection((LPCRITICAL_SECTION)p_Var41); - p_Var11 = p_Var40[2].ProcessLocksList.Flink; - pLVar1 = &p_Var40[2].ProcessLocksList; - p_Var31 = local_1c8.Blink; - if (p_Var11->Blink == pLVar1) { - p_Var11->Blink = &local_1c8; - pLVar1->Flink = &local_1c8; - local_1c8.Blink = p_Var40[2].ProcessLocksList.Blink; - local_1c8.Flink = p_Var11; - p_Var31 = pLVar1; - if ((local_1c8.Blink)->Flink == pLVar1) { - (local_1c8.Blink)->Flink = &local_1c8; - p_Var40[2].ProcessLocksList.Blink = pLVar1; + p_Var44 = p_Var42 + 1; + local_150 = p_Var44; + EnterCriticalSection((LPCRITICAL_SECTION)p_Var44); + p_Var10 = (PRTL_CRITICAL_SECTION_DEBUG)p_Var42[2].ProcessLocksList.Flink; + pLVar1 = &p_Var42[2].ProcessLocksList; + puVar33 = auStackY_228 + 2; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; + if (p_Var10->CriticalSection == (_RTL_CRITICAL_SECTION *)pLVar1) { + pIVar39 = (IMAGE_DOS_HEADER *)local_1c8; + p_Var10->CriticalSection = (_RTL_CRITICAL_SECTION *)pIVar39; + pLVar1->Flink = (_LIST_ENTRY *)local_1c8; + local_1c8._8_8_ = p_Var42[2].ProcessLocksList.Blink; + puVar33 = auStackY_228 + 2; + local_1c8._0_8_ = p_Var10; + pLVar19 = pLVar1; + if (((_RTL_CRITICAL_SECTION *)local_1c8._8_8_)->DebugInfo == (PRTL_CRITICAL_SECTION_DEBUG)pLVar1 + ) { + pIVar39 = (IMAGE_DOS_HEADER *)local_1c8; + ((_RTL_CRITICAL_SECTION *)local_1c8._8_8_)->DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)pIVar39; + p_Var42[2].ProcessLocksList.Blink = pLVar1; pLVar1->Flink = pLVar1; - LeaveCriticalSection((LPCRITICAL_SECTION)p_Var41); - while (p_Var11 = local_1c8.Flink, local_1c8.Flink != &local_1c8) { - p_Var12 = (local_1c8.Flink)->Flink; - p_Var31 = local_1c8.Blink; - if (((local_1c8.Flink)->Blink != &local_1c8) || (p_Var12->Blink != local_1c8.Flink)) + LeaveCriticalSection((LPCRITICAL_SECTION)p_Var44); + while (uVar26 = local_1c8._0_8_, + (PRTL_CRITICAL_SECTION_DEBUG)local_1c8._0_8_ != (PRTL_CRITICAL_SECTION_DEBUG)local_1c8) + { + p_Var10 = *(PRTL_CRITICAL_SECTION_DEBUG *)local_1c8._0_8_; + puVar33 = auStackY_228 + 2; + unaff_RDI = (PRTL_CRITICAL_SECTION_DEBUG)local_1c8._0_8_; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; + if ((*(_RTL_CRITICAL_SECTION **)(local_1c8._0_8_ + 8) != (_RTL_CRITICAL_SECTION *)local_1c8) + || (puVar33 = auStackY_228 + 2, + (PRTL_CRITICAL_SECTION_DEBUG)p_Var10->CriticalSection != + (PRTL_CRITICAL_SECTION_DEBUG)local_1c8._0_8_)) goto LAB_2; + p_Var10->CriticalSection = (_RTL_CRITICAL_SECTION *)local_1c8; + local_1c8._0_8_ = p_Var10; + uVar25 = IkeFreeLarvalOnError((uint)pIVar9); + param_3 = (undefined *)(uVar25 & 0xffffffff); + pIVar39 = pIVar9; + IkeDestroyAcquireContext(uVar26,pIVar9,(uint)uVar25); + } + pIVar39 = (IMAGE_DOS_HEADER *)0x0; + TraceLogHelper("IkeFreeAcquireList",0,param_3,param_4); + unaff_RDI = p_Var42 + 3; + while (p_Var10 = *(PRTL_CRITICAL_SECTION_DEBUG *)unaff_RDI, p_Var10 != unaff_RDI) { + lVar8 = *(longlong *)p_Var10; + puVar33 = auStackY_228 + 2; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; + if (((PRTL_CRITICAL_SECTION_DEBUG)p_Var10->CriticalSection != unaff_RDI) || + (puVar33 = auStackY_228 + 2, *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar8 + 8) != p_Var10)) goto LAB_2; - p_Var12->Blink = &local_1c8; - local_1c8.Flink = p_Var12; - uVar25 = IkeFreeLarvalOnError((uint)p_Var10); - param_3 = (undefined *)(uVar25 & 0xffffffff); - IkeDestroyAcquireContext((longlong)p_Var11,p_Var10,(uint)uVar25); - } - uVar26 = 0; - TraceLogHelper("IkeFreeAcquireList",0,param_3,param_4); - p_Var8 = p_Var40 + 3; - while (p_Var13 = *(PRTL_CRITICAL_SECTION_DEBUG *)p_Var8, p_Var13 != p_Var8) { - lVar9 = *(longlong *)p_Var13; - p_Var31 = local_1c8.Blink; - if (((PRTL_CRITICAL_SECTION_DEBUG)p_Var13->CriticalSection != p_Var8) || - (*(PRTL_CRITICAL_SECTION_DEBUG *)(lVar9 + 8) != p_Var13)) goto LAB_2; - p_Var8->Type = (short)lVar9; - p_Var8->CreatorBackTraceIndex = (short)((ulonglong)lVar9 >> 0x10); - *(int *)&p_Var8->field_0x4 = (int)((ulonglong)lVar9 >> 0x20); - *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar9 + 8) = p_Var8; - p_Var13[4].ProcessLocksList.Flink = (_LIST_ENTRY *)0x35f0; - CompleteMobikeContext((longlong)p_Var13,uVar26,param_3,param_4); + unaff_RDI->Type = (short)lVar8; + unaff_RDI->CreatorBackTraceIndex = (short)((ulonglong)lVar8 >> 0x10); + *(int *)&unaff_RDI->field_0x4 = (int)((ulonglong)lVar8 >> 0x20); + *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar8 + 8) = unaff_RDI; + p_Var10[4].ProcessLocksList.Flink = (_LIST_ENTRY *)0x35f0; + CompleteMobikeContext((longlong)p_Var10,pIVar39,param_3,param_4); } TraceLogHelper("IkeNotifyNLB",1,param_3,param_4); lpMem = (longlong *)0x2; if ((gIkeExtGlobals[0x7e4] & 1) != 0) { - puVar39 = gIkeExtGlobals; - uVar26 = IkeAddrGetIPVersion((byte *)pDVar32); + puVar41 = gIkeExtGlobals; + uVar26 = IkeAddrGetIPVersion((byte *)pDVar31); uVar25 = 0x17; if ((int)uVar26 != 1) { uVar25 = (ulonglong)lpMem & 0xffff; } - if (*(longlong *)(puVar39 + 0xbc0) != 0) { - IkeAddrGetAddrBytes((char *)pDVar32,&local_178,(undefined4 *)&local_1a8); - IkeAddrGetPort((longlong)pDVar32,local_1d4); - lpMem = &local_1a8; - puVar33 = &p_Var40[9].field_0x4; - IkeAddrGetAddrBytes(puVar33,(longlong *)&local_180,(undefined4 *)lpMem); - IkeAddrGetPort((longlong)puVar33,local_1d8); - if (*(short *)&p_Var40[0x16].field_0x4 != 0) { + if (*(longlong *)(puVar41 + 0xbc0) != 0) { + IkeAddrGetAddrBytes((char *)pDVar31,&local_178,(undefined4 *)(local_1c8 + 0x20)); + IkeAddrGetPort((longlong)pDVar31,local_1d4); + lpMem = (longlong *)(local_1c8 + 0x20); + puVar32 = &p_Var42[9].field_0x4; + IkeAddrGetAddrBytes(puVar32,(longlong *)&local_180,(undefined4 *)lpMem); + IkeAddrGetPort((longlong)puVar32,local_1d8); + if (*(short *)&p_Var42[0x16].field_0x4 != 0) { lpMem = (longlong *)(ulonglong)local_1d4[0]; (**(code **)(gIkeExtGlobals + 0xbc8))(uVar25); - *(short *)&p_Var40[0x16].field_0x4 = *(short *)&p_Var40[0x16].field_0x4 + -1; + *(short *)&p_Var42[0x16].field_0x4 = *(short *)&p_Var42[0x16].field_0x4 + -1; param_4 = local_180; } } } TraceLogHelper("IkeNotifyNLB",0,lpMem,param_4); IkeReturnError(0,"IkeNotifyNLB",lpMem,param_4); - pDVar32 = &p_Var40[2].EntryCount; - while ((DWORD *)*(undefined1 **)pDVar32 != pDVar32) { - EnterCriticalSection((LPCRITICAL_SECTION)p_Var41); + pDVar31 = &p_Var42[2].EntryCount; + while ((DWORD *)*(undefined1 **)pDVar31 != pDVar31) { + EnterCriticalSection((LPCRITICAL_SECTION)p_Var44); lpMem = (longlong *)0x0; - IkeFreeZombieQMContextListEntry(p_Var40,(longlong *)pDVar32,0,param_4); - } - while (plVar38 = *(longlong **)&p_Var40[0x13].EntryCount, - (DWORD *)plVar38 != &p_Var40[0x13].EntryCount) { - IkeDestroyQMSA((longlong)p_Var40,plVar38,(undefined *)lpMem,param_4); - } - uVar21 = IkeDoingIkeV2ePDGVpnTunnel((longlong)p_Var40); - uVar22 = IkeLpmSupportEnabled((longlong)p_Var40); + IkeFreeZombieQMContextListEntry(p_Var42,(longlong *)pDVar31,0,param_4); + } + while (plVar40 = *(longlong **)&p_Var42[0x13].EntryCount, + (DWORD *)plVar40 != &p_Var42[0x13].EntryCount) { + IkeDestroyQMSA((longlong)p_Var42,plVar40,(undefined *)lpMem,param_4); + } + uVar21 = IkeDoingIkeV2ePDGVpnTunnel((longlong)p_Var42); + uVar22 = IkeLpmSupportEnabled((longlong)p_Var42); if (uVar22 != 0) { - IkeRemoveWpIfIndexRef((longlong)&p_Var40[5].Flags,plVar38,(undefined *)lpMem,param_4); - plVar38 = (longlong *)(*(longlong *)&p_Var40[0x17].Flags - 1); - if (plVar38 < (longlong *)0xfffffffffffffffe) { + IkeRemoveWpIfIndexRef((longlong)&p_Var42[5].Flags,plVar40,(undefined *)lpMem,param_4); + plVar40 = (longlong *)(*(longlong *)&p_Var42[0x17].Flags - 1); + if (plVar40 < (longlong *)0xfffffffffffffffe) { Pdcv2ActivationClientDeactivate(); } } - p_Var31 = p_Var40[0xf].ProcessLocksList.Flink; - local_170 = p_Var31; - if (p_Var31 != (_LIST_ENTRY *)0x0) { - if (p_Var31[5].Blink != (_LIST_ENTRY *)0x0) { - WfpMemFree(&p_Var31[5].Blink); - } - FwpmFreeMemory0(p_Var31 + 4); - IkeFreeUMPolicy((longlong *)p_Var31->Blink); - WfpMemFree(&p_Var31[1].Blink); + p_Var11 = p_Var42[0xf].ProcessLocksList.Flink; + local_170 = p_Var11; + if (p_Var11 != (_LIST_ENTRY *)0x0) { + if (p_Var11[5].Blink != (_LIST_ENTRY *)0x0) { + WfpMemFree(&p_Var11[5].Blink); + } + FwpmFreeMemory0(p_Var11 + 4); + IkeFreeUMPolicy((longlong *)p_Var11->Blink); + WfpMemFree(&p_Var11[1].Blink); WfpMemFree(&local_170); } - p_Var31 = p_Var40[0xf].ProcessLocksList.Blink; + p_Var11 = p_Var42[0xf].ProcessLocksList.Blink; uVar25 = 0; - p_Var40[0xf].ProcessLocksList.Flink = (_LIST_ENTRY *)0x0; - local_168 = p_Var31; - if (p_Var31 != (_LIST_ENTRY *)0x0) { - if (*(short *)((longlong)&p_Var31->Flink + 6) != 0) { + p_Var42[0xf].ProcessLocksList.Flink = (_LIST_ENTRY *)0x0; + local_168 = p_Var11; + if (p_Var11 != (_LIST_ENTRY *)0x0) { + if (*(short *)((longlong)&p_Var11->Flink + 6) != 0) { do { - WfpMemFree(&p_Var31[uVar25 * 0x14 + 4].Flink); + WfpMemFree(&p_Var11[uVar25 * 0x14 + 4].Flink); uVar22 = (int)uVar25 + 1; uVar25 = (ulonglong)uVar22; - } while (uVar22 < *(ushort *)((longlong)&p_Var31->Flink + 6)); + } while (uVar22 < *(ushort *)((longlong)&p_Var11->Flink + 6)); } WfpMemFree(&local_168); } - p_Var8 = p_Var40 + 0x17; - p_Var40[0xf].ProcessLocksList.Blink = (_LIST_ENTRY *)0x0; - if (*(longlong *)p_Var8 != 0) { - IkeFreeRecvPolicy(*(longlong *)(*(longlong *)p_Var8 + 0x1d8)); - *(undefined8 *)(*(longlong *)p_Var8 + 0x1d8) = 0; - } - pDVar32 = &p_Var40[0x16].Flags; - if (*(longlong *)pDVar32 != 0) { - lpMem = *(longlong **)(*(longlong *)pDVar32 + 0x178); + p_Var10 = p_Var42 + 0x17; + p_Var42[0xf].ProcessLocksList.Blink = (_LIST_ENTRY *)0x0; + if (*(longlong *)p_Var10 != 0) { + IkeFreeRecvPolicy(*(longlong *)(*(longlong *)p_Var10 + 0x1d8)); + *(undefined8 *)(*(longlong *)p_Var10 + 0x1d8) = 0; + } + pDVar31 = &p_Var42[0x16].Flags; + if (*(longlong *)pDVar31 != 0) { + lpMem = *(longlong **)(*(longlong *)pDVar31 + 0x178); if ((lpMem != (longlong *)0x0) && (WfpMemFree(lpMem + 2), *lpMem != 0)) { WfpMidlObjectDestroySafe(lpMem); } if ((gWfpTrackHeapBytes != 0) && (lpMem != (longlong *)0x0)) { SVar27 = HeapSize(gWfpHeap,0,lpMem); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar27; UNLOCK(); param_1 = local_1d0; } - plVar38 = (longlong *)0x0; + plVar40 = (longlong *)0x0; HeapFree(gWfpHeap,0,lpMem); } if ((*(uint *)&pLVar2->Flink >> 0x1c & 1) != 0) { *(uint *)&pLVar2->Flink = *(uint *)&pLVar2->Flink & 0xefffffff; local_140 = param_1[0x16].ProcessLocksList.Blink; local_138 = *(undefined8 *)(*(longlong *)(*(longlong *)(param_1 + 0x14) + 0x68) + 0x10); local_130 = *(longlong *)(*(longlong *)(param_1 + 0x14) + 0x68) + 0x28; - plVar38 = (longlong *)¶m_1[9].field_0x4; - IkeDerefEntryInAuthzBypassTable((longlong *)&local_140,(byte *)plVar38); + plVar40 = (longlong *)¶m_1[9].field_0x4; + IkeDerefEntryInAuthzBypassTable((longlong *)&local_140,(byte *)plVar40); WfpMemFree(¶m_1[0x16].ProcessLocksList.Blink); } - pDVar3 = ¶m_1[0x16].EntryCount; - puVar34 = *(undefined8 **)pDVar3; - if (puVar34 != (undefined8 *)0x0) { - if ((undefined8 *)*puVar34 != (undefined8 *)0x0) { - IkeFreeCertInfo((undefined8 *)*puVar34,plVar38,lpMem,param_4); - puVar34 = *(undefined8 **)pDVar3; - } - WfpMemFree(puVar34 + 4); - WfpMemFree((undefined8 *)(*(longlong *)pDVar3 + 0x10)); - WfpMemFree((undefined8 *)(*(longlong *)pDVar3 + 0x30)); - WfpMemFree((undefined8 *)(*(longlong *)pDVar3 + 0x40)); - WfpMemFree((undefined8 *)pDVar3); - } - lVar14._0_4_ = p_Var40[0x16].Flags; - lVar14._4_2_ = p_Var40[0x16].CreatorBackTraceIndexHigh; - lVar14._6_2_ = p_Var40[0x16].SpareWORD; - if (lVar14 != 0) { + unaff_RDI = (PRTL_CRITICAL_SECTION_DEBUG)¶m_1[0x16].EntryCount; + puVar33 = *(undefined8 **)unaff_RDI; + if (puVar33 != (undefined8 *)0x0) { + if ((undefined8 *)*puVar33 != (undefined8 *)0x0) { + IkeFreeCertInfo((undefined8 *)*puVar33,plVar40,lpMem,param_4); + puVar33 = *(undefined8 **)unaff_RDI; + } + WfpMemFree(puVar33 + 4); + WfpMemFree((undefined8 *)(*(longlong *)unaff_RDI + 0x10)); + WfpMemFree((undefined8 *)(*(longlong *)unaff_RDI + 0x30)); + WfpMemFree((undefined8 *)(*(longlong *)unaff_RDI + 0x40)); + WfpMemFree((undefined8 *)unaff_RDI); + } + lVar12._0_4_ = p_Var42[0x16].Flags; + lVar12._4_2_ = p_Var42[0x16].CreatorBackTraceIndexHigh; + lVar12._6_2_ = p_Var42[0x16].SpareWORD; + if (lVar12 != 0) { while( true ) { - plVar38 = *(longlong **)pDVar32; - plVar15 = (longlong *)*plVar38; - if (plVar15 == plVar38) break; - lVar9 = *plVar15; - p_Var31 = local_1c8.Blink; - if (((longlong *)plVar15[1] != plVar38) || - ((longlong *)*(longlong *)(lVar9 + 8) != plVar15)) goto LAB_2; - *plVar38 = lVar9; - *(longlong **)(lVar9 + 8) = plVar38; - IkeFreeNotifyContext((longlong)plVar15); + p_Var11 = *(_LIST_ENTRY **)pDVar31; + p_Var13 = p_Var11->Flink; + if (p_Var13 == p_Var11) break; + pIVar39 = (IMAGE_DOS_HEADER *)p_Var13->Flink; + puVar33 = auStackY_228 + 2; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; + if ((p_Var13->Blink != p_Var11) || + (puVar33 = auStackY_228 + 2, *(_LIST_ENTRY **)&pIVar39->e_cparhdr != p_Var13)) + goto LAB_2; + p_Var11->Flink = (_LIST_ENTRY *)pIVar39; + *(_LIST_ENTRY **)&pIVar39->e_cparhdr = p_Var11; + IkeFreeNotifyContext((longlong)p_Var13); } TraceLogHelper("IkeFreeUMSA",1,lpMem,param_4); - uVar25 = *(ulonglong *)(*(longlong *)pDVar32 + 0x18); + uVar25 = *(ulonglong *)(*(longlong *)pDVar31 + 0x18); if (uVar25 != 0) { - *(undefined8 *)(*(longlong *)pDVar32 + 0x18) = 0; + *(undefined8 *)(*(longlong *)pDVar31 + 0x18) = 0; local_160[0] = uVar25; uVar26 = IkeAddrGetIPVersion((byte *)local_1b8); - puVar39 = (undefined *)0x0; + puVar41 = (undefined *)0x0; IkeGlobalStatsUpdateCurrentUMs((int)uVar26,0); if (*(longlong *)(uVar25 + 0xd8) != 0) { - IkeFreeSspi(*(longlong *)(uVar25 + 0xd8),puVar39,(undefined *)lpMem,param_4); + IkeFreeSspi(*(longlong *)(uVar25 + 0xd8),puVar41,(undefined *)lpMem,param_4); } WfpMemFree((undefined8 *)(uVar25 + 200)); - puVar16 = *(uint **)(uVar25 + 0x40); - if (puVar16 != (uint *)0x0) { - if (*(undefined1 **)(puVar16 + 2) != (undefined1 *)0x0) { - puVar33 = *(undefined1 **)(puVar16 + 2); - for (uVar35 = (ulonglong)*puVar16; uVar35 != 0; uVar35 = uVar35 - 1) { - *puVar33 = 0; - puVar33 = puVar33 + 1; + puVar14 = *(uint **)(uVar25 + 0x40); + if (puVar14 != (uint *)0x0) { + if (*(undefined1 **)(puVar14 + 2) != (undefined1 *)0x0) { + puVar32 = *(undefined1 **)(puVar14 + 2); + for (uVar34 = (ulonglong)*puVar14; uVar34 != 0; uVar34 = uVar34 - 1) { + *puVar32 = 0; + puVar32 = puVar32 + 1; } WfpMemFree((undefined8 *)(*(longlong *)(uVar25 + 0x40) + 8)); } WfpMemFree((undefined8 *)(uVar25 + 0x40)); } - uVar35 = uVar25; + uVar34 = uVar25; IkeFreeQMCrypto((int *)local_1b0,uVar25,lpMem,param_4); if (*(longlong *)(uVar25 + 0xe0) != 0) { - IkeDestroyTimerContext((longlong *)(uVar25 + 0xe0),uVar35,(undefined *)lpMem,param_4); + IkeDestroyTimerContext((longlong *)(uVar25 + 0xe0),uVar34,(undefined *)lpMem,param_4); } if (*(HANDLE *)(uVar25 + 0xe8) != (HANDLE)0x0) { CloseHandle(*(HANDLE *)(uVar25 + 0xe8)); } WfpMemFree(local_160); } - plVar38 = (longlong *)0x0; + plVar40 = (longlong *)0x0; TraceLogHelper("IkeFreeUMSA",0,lpMem,param_4); - WfpMemFree((undefined8 *)(*(longlong *)pDVar32 + 0x30)); - lVar28 = *(longlong *)pDVar32; + WfpMemFree((undefined8 *)(*(longlong *)pDVar31 + 0x30)); + lVar28 = *(longlong *)pDVar31; if (*(longlong *)(lVar28 + 0x38) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar28 + 0x38),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar28._0_4_ = p_Var40[0x16].Flags; - lVar28._4_2_ = p_Var40[0x16].CreatorBackTraceIndexHigh; - lVar28._6_2_ = p_Var40[0x16].SpareWORD; + ((undefined8 *)(lVar28 + 0x38),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar28._0_4_ = p_Var42[0x16].Flags; + lVar28._4_2_ = p_Var42[0x16].CreatorBackTraceIndexHigh; + lVar28._6_2_ = p_Var42[0x16].SpareWORD; } if (*(undefined1 **)(lVar28 + 0x80) != (undefined1 *)0x0) { - puVar33 = *(undefined1 **)(lVar28 + 0x80); + puVar32 = *(undefined1 **)(lVar28 + 0x80); for (uVar25 = (ulonglong)*(uint *)(lVar28 + 0x78); uVar25 != 0; uVar25 = uVar25 - 1) { - *puVar33 = 0; - puVar33 = puVar33 + 1; + *puVar32 = 0; + puVar32 = puVar32 + 1; } - WfpMemFree((undefined8 *)(*(longlong *)pDVar32 + 0x80)); - } - WfpMemFree((undefined8 *)pDVar32); - p_Var41 = local_150; - } - if (*(longlong *)p_Var8 != 0) { - IkeFreeInformationalReqList((longlong *)(*(longlong *)p_Var8 + 8)); - lVar36 = *(longlong *)p_Var8; - if (*(longlong *)(lVar36 + 0x18) != 0) { + WfpMemFree((undefined8 *)(*(longlong *)pDVar31 + 0x80)); + } + WfpMemFree((undefined8 *)pDVar31); + p_Var44 = local_150; + } + if (*(longlong *)p_Var10 != 0) { + IkeFreeInformationalReqList((longlong *)(*(longlong *)p_Var10 + 8)); + lVar35 = *(longlong *)p_Var10; + if (*(longlong *)(lVar35 + 0x18) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar36 + 0x18),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - if (*(undefined8 **)(lVar36 + 0x28) != (undefined8 *)0x0) { - IkeFreeCertInfo(*(undefined8 **)(lVar36 + 0x28),plVar38,lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - if (*(longlong *)(lVar36 + 0x80) != 0) { + ((undefined8 *)(lVar35 + 0x18),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + if (*(undefined8 **)(lVar35 + 0x28) != (undefined8 *)0x0) { + IkeFreeCertInfo(*(undefined8 **)(lVar35 + 0x28),plVar40,lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + if (*(longlong *)(lVar35 + 0x80) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar36 + 0x80),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - if (*(longlong *)(lVar36 + 0x110) != 0) { + ((undefined8 *)(lVar35 + 0x80),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + if (*(longlong *)(lVar35 + 0x110) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar36 + 0x110),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - if (*(longlong *)(lVar36 + 0x248) != 0) { + ((undefined8 *)(lVar35 + 0x110),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + if (*(longlong *)(lVar35 + 0x248) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar36 + 0x248),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - if (*(longlong *)(lVar36 + 0x250) != 0) { + ((undefined8 *)(lVar35 + 0x248),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + if (*(longlong *)(lVar35 + 0x250) != 0) { IkeDestroyTimerContext - ((undefined8 *)(lVar36 + 0x250),(ulonglong)plVar38,(undefined *)lpMem,param_4); - lVar36._0_2_ = p_Var8->Type; - lVar36._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar36._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - WfpMemFree((undefined8 *)(lVar36 + 0x38)); - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x48)); - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x58)); - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x68)); + ((undefined8 *)(lVar35 + 0x250),(ulonglong)plVar40,(undefined *)lpMem,param_4); + lVar35._0_2_ = p_Var10->Type; + lVar35._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar35._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + WfpMemFree((undefined8 *)(lVar35 + 0x38)); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x48)); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x58)); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x68)); if (uVar21 != 0) { - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x78)); - } - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0xa0)); - lVar37 = *(longlong *)p_Var8; - if (*(longlong *)(lVar37 + 0xb0) != 0) { - CompleteMobikeContext(*(longlong *)(lVar37 + 0xb0),plVar38,(undefined *)lpMem,param_4); - *(undefined8 *)(*(longlong *)p_Var8 + 0xb0) = 0; - lVar37._0_2_ = p_Var8->Type; - lVar37._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar37._4_4_ = *(undefined4 *)&p_Var8->field_0x4; - } - WfpMemFree((undefined8 *)(lVar37 + 0x168)); - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x178)); - IkeFreeMobikeNotifyInfo(*(longlong *)p_Var8 + 0xb8); - IkeFreePacket((undefined8 *)(*(longlong *)p_Var8 + 0x198)); - IkeFreePacket((undefined8 *)(*(longlong *)p_Var8 + 0x200)); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x78)); + } + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0xa0)); + lVar36 = *(longlong *)p_Var10; + if (*(longlong *)(lVar36 + 0xb0) != 0) { + CompleteMobikeContext(*(longlong *)(lVar36 + 0xb0),plVar40,(undefined *)lpMem,param_4); + *(undefined8 *)(*(longlong *)p_Var10 + 0xb0) = 0; + lVar36._0_2_ = p_Var10->Type; + lVar36._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar36._4_4_ = *(undefined4 *)&p_Var10->field_0x4; + } + WfpMemFree((undefined8 *)(lVar36 + 0x168)); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x178)); + IkeFreeMobikeNotifyInfo(*(longlong *)p_Var10 + 0xb8); + IkeFreePacket((undefined8 *)(*(longlong *)p_Var10 + 0x198)); + IkeFreePacket((undefined8 *)(*(longlong *)p_Var10 + 0x200)); if ((*(byte *)(*(longlong *)¶m_1[0xc].Flags + 8) & 1) == 0) { - IkeCloseRasTunnelIkeV2((longlong)param_1,plVar38,(undefined *)lpMem,param_4); - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x140)); - lVar9 = *(longlong *)p_Var8; - *(undefined8 *)(lVar9 + 0x138) = 0; - *(undefined8 *)(lVar9 + 0x140) = 0; - lVar29 = *(longlong *)p_Var8; + IkeCloseRasTunnelIkeV2((longlong)param_1,plVar40,(undefined *)lpMem,param_4); + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x140)); + lVar8 = *(longlong *)p_Var10; + *(undefined8 *)(lVar8 + 0x138) = 0; + *(undefined8 *)(lVar8 + 0x140) = 0; + lVar29 = *(longlong *)p_Var10; if (*(undefined1 **)(lVar29 + 0x130) != (undefined1 *)0x0) { - puVar33 = *(undefined1 **)(lVar29 + 0x130); + puVar32 = *(undefined1 **)(lVar29 + 0x130); for (uVar25 = (ulonglong)*(uint *)(lVar29 + 0x128); uVar25 != 0; uVar25 = uVar25 - 1) { - *puVar33 = 0; - puVar33 = puVar33 + 1; + *puVar32 = 0; + puVar32 = puVar32 + 1; } - WfpMemFree((undefined8 *)(*(longlong *)p_Var8 + 0x130)); - lVar29._0_2_ = p_Var8->Type; - lVar29._2_2_ = p_Var8->CreatorBackTraceIndex; - lVar29._4_4_ = *(undefined4 *)&p_Var8->field_0x4; + WfpMemFree((undefined8 *)(*(longlong *)p_Var10 + 0x130)); + lVar29._0_2_ = p_Var10->Type; + lVar29._2_2_ = p_Var10->CreatorBackTraceIndex; + lVar29._4_4_ = *(undefined4 *)&p_Var10->field_0x4; } *(undefined8 *)(lVar29 + 0x128) = 0; *(undefined8 *)(lVar29 + 0x130) = 0; if ((*(byte *)(*(longlong *)¶m_1[0xc].Flags + 8) & 1) != 0) goto LAB_3; } else { LAB_3: - IkeCloseGwSvcTunnelIkeV2((longlong)param_1,plVar38,(undefined *)lpMem,param_4); - } - WfpMemFree((undefined8 *)p_Var8); + IkeCloseGwSvcTunnelIkeV2((longlong)param_1,plVar40,(undefined *)lpMem,param_4); + } + WfpMemFree((undefined8 *)p_Var10); } if (param_1[0x14].ProcessLocksList.Flink != (_LIST_ENTRY *)0x0) { IkeDestroyTimerContext - (¶m_1[0x14].ProcessLocksList.Flink,(ulonglong)plVar38,(undefined *)lpMem, + (¶m_1[0x14].ProcessLocksList.Flink,(ulonglong)plVar40,(undefined *)lpMem, param_4); } if (param_1[0xd].ProcessLocksList.Flink != (_LIST_ENTRY *)0x0) { IkeDestroyTimerContext - (¶m_1[0xd].ProcessLocksList.Flink,(ulonglong)plVar38,(undefined *)lpMem, + (¶m_1[0xd].ProcessLocksList.Flink,(ulonglong)plVar40,(undefined *)lpMem, param_4); } - if (p_Var41->Flags != 0) { - DeleteCriticalSection((LPCRITICAL_SECTION)p_Var41); - p_Var41->Flags = 0; + if (p_Var44->Flags != 0) { + DeleteCriticalSection((LPCRITICAL_SECTION)p_Var44); + p_Var44->Flags = 0; } if (param_1->Flags != 0) { DeleteCriticalSection((LPCRITICAL_SECTION)param_1); param_1->Flags = 0; } - IkeFreeCrypto((longlong)¶m_1[0xf].EntryCount,plVar38,lpMem,param_4); - pp_Var4 = ¶m_1[0xe].ProcessLocksList.Blink; + IkeFreeCrypto((longlong)¶m_1[0xf].EntryCount,plVar40,lpMem,param_4); + unaff_RDI = (PRTL_CRITICAL_SECTION_DEBUG)¶m_1[0xe].ProcessLocksList.Blink; if (((param_1[0xf].field_0x4 & 2) != 0) && (param_1[0xf].CriticalSection != (_RTL_CRITICAL_SECTION *)0x0)) { Ikev2ClearFragmentListEntryList((longlong *)param_1[0xf].CriticalSection); WfpMemFree(¶m_1[0xf].CriticalSection); } - WfpMemFree(pp_Var4); - *pp_Var4 = (_LIST_ENTRY *)0x0; + WfpMemFree((undefined8 *)unaff_RDI); + *(_LIST_ENTRY **)unaff_RDI = (_LIST_ENTRY *)0x0; param_1[0xe].EntryCount = 0; param_1[0xe].ContentionCount = 0; param_1[0xe].Flags = 0; param_1[0xe].CreatorBackTraceIndexHigh = 0; param_1[0xe].SpareWORD = 0; param_1[0xf].Type = 0; param_1[0xf].CreatorBackTraceIndex = 0; *(undefined4 *)¶m_1[0xf].field_0x4 = 0; param_1[0xf].CriticalSection = (_RTL_CRITICAL_SECTION *)0x0; - lVar17._0_2_ = param_1[0x14].Type; - lVar17._2_2_ = param_1[0x14].CreatorBackTraceIndex; - lVar17._4_4_ = *(undefined4 *)¶m_1[0x14].field_0x4; - if (lVar17 != 0) { - IkeFreeSspi(lVar17,(undefined *)plVar38,(undefined *)lpMem,param_4); + lVar15._0_2_ = param_1[0x14].Type; + lVar15._2_2_ = param_1[0x14].CreatorBackTraceIndex; + lVar15._4_4_ = *(undefined4 *)¶m_1[0x14].field_0x4; + if (lVar15 != 0) { + IkeFreeSspi(lVar15,(undefined *)plVar40,(undefined *)lpMem,param_4); } TraceLogHelper("IkeClearOpenMM",1,lpMem,param_4); uVar21 = *(uint *)&pLVar2->Flink; if ((uVar21 & 4) == 0) goto LAB_4; - switch((char)*local_1b8) { - case '\x01': - case '\x04': - case '\a': - bVar19 = false; + pIVar39 = &IMAGE_DOS_HEADER_180000000; + switch(*(undefined1 *)&local_1b8->Flink) { + case 1: + case 4: + case 7: + bVar18 = false; break; default: - pcVar18 = (code *)swi(0x29); - (*pcVar18)(0x25); - p_Var31 = local_1c8.Blink; + pcVar16 = (code *)swi(0x29); + (*pcVar16)(0x25); + puVar33 = (undefined8 *)auStackY_210; + pLVar19 = (LIST_ENTRY *)local_1c8._8_8_; goto LAB_2; - case '\x05': - case '\x06': - case '\b': - bVar19 = true; - } - iVar5 = *(int *)local_1b0; + case 5: + case 6: + case 8: + bVar18 = true; + } + iVar38 = *(int *)&local_1b0->Flink; TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",1,lpMem,param_4); - if (iVar5 == 0) { - if (bVar19) { + if (iVar38 == 0) { + if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x188); } else { piVar24 = (int *)(gIkeExtGlobals + 0x140); } } - else if (iVar5 == 1) { - if (bVar19) { + else if (iVar38 == 1) { + if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x3a8); } else { piVar24 = (int *)(gIkeExtGlobals + 0x360); } } - else if (bVar19) { + else if (bVar18) { piVar24 = (int *)(gIkeExtGlobals + 0x5c8); } else { piVar24 = (int *)(gIkeExtGlobals + 0x580); } LOCK(); *piVar24 = *piVar24 + -1; UNLOCK(); TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",0,lpMem,param_4); uVar21 = *(uint *)&pLVar2->Flink; param_1 = local_1d0; LAB_4: *(uint *)&pLVar2->Flink = uVar21 & 0xfffffffb; if ((uint)(*(int *)(gIkeExtGlobals + 0x5c8) + *(int *)(gIkeExtGlobals + 0x580) + *(int *)(gIkeExtGlobals + 0x3a8) + *(int *)(gIkeExtGlobals + 0x360) + *(int *)(gIkeExtGlobals + 0x188) + *(int *)(gIkeExtGlobals + 0x140)) < *(uint *)(gIkeExtGlobals + 0x7a8)) { - puVar39 = gIkeExtGlobals; + puVar41 = gIkeExtGlobals; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar23 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = IkeGetTlsMmLuid(); lpMem = (longlong *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; - puVar39 = (undefined *)0x19; + puVar41 = (undefined *)0x19; WPP_SF_iSD(WPP_GLOBAL_Control[2],0x19,&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids, param_4,pwVar23); } if (4 < DAT_0) { - puVar39 = (undefined *)0x0; - cVar20 = _tlgKeywordOn(0x180164278,0); + puVar41 = (undefined *)0x0; + cVar20 = _tlgKeywordOn(0x180165278,0); if (cVar20 != '\0') { - local_1b0 = (_RTL_CRITICAL_SECTION **)IkeGetTlsMmLuid(); - local_78 = &local_1b0; + local_1b0 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + local_78 = local_1c8 + 0x18; local_70 = 8; pwVar23 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_68,pwVar23); local_58 = &local_148; local_50 = 8; - local_48 = &local_1b8; - local_1b8 = (DWORD *)CONCAT44(local_1b8._4_4_, - *(int *)(gIkeExtGlobals + 0x5c8) + - *(int *)(gIkeExtGlobals + 0x580) + - *(int *)(gIkeExtGlobals + 0x3a8) + - *(int *)(gIkeExtGlobals + 0x360) + - *(int *)(gIkeExtGlobals + 0x188) + - *(int *)(gIkeExtGlobals + 0x140)); - puVar39 = &DAT_5; + local_48 = local_1c8 + 0x10; + local_1b8 = (_LIST_ENTRY *) + CONCAT44(local_1b8._4_4_, + *(int *)(gIkeExtGlobals + 0x5c8) + *(int *)(gIkeExtGlobals + 0x580) + + *(int *)(gIkeExtGlobals + 0x3a8) + + *(int *)(gIkeExtGlobals + 0x360) + *(int *)(gIkeExtGlobals + 0x188) + + *(int *)(gIkeExtGlobals + 0x140)); + puVar41 = &DAT_5; local_40 = 4; local_148 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,lpMem,param_4,6,local_98); + (0x180165278,&DAT_5,lpMem,param_4,6,local_98); } } - IkeClearDosModeFlag(2,puVar39,lpMem,param_4); + IkeClearDosModeFlag(2,puVar41,lpMem,param_4); } TraceLogHelper("IkeClearOpenMM",0,lpMem,param_4); - pp_Var4 = ¶m_1[0xd].ProcessLocksList.Blink; + pp_Var3 = ¶m_1[0xd].ProcessLocksList.Blink; TraceLogHelper("ClearFragList",1,lpMem,param_4); - p_Var31 = *pp_Var4; - while (p_Var31 != (_LIST_ENTRY *)pp_Var4) { - p_Var10 = p_Var31->Flink; - FreeFragEntry((longlong)p_Var31); - p_Var31 = p_Var10; - } - *(_LIST_ENTRY ***)¶m_1[0xd].EntryCount = pp_Var4; - *pp_Var4 = (_LIST_ENTRY *)pp_Var4; + p_Var11 = *pp_Var3; + while (p_Var11 != (_LIST_ENTRY *)pp_Var3) { + p_Var13 = p_Var11->Flink; + FreeFragEntry((longlong)p_Var11); + p_Var11 = p_Var13; + } + *(_LIST_ENTRY ***)¶m_1[0xd].EntryCount = pp_Var3; + *pp_Var3 = (_LIST_ENTRY *)pp_Var3; param_1[0xd].Flags = 0; param_1[0xd].CreatorBackTraceIndexHigh = 0; param_1[0xd].SpareWORD = 0; param_1[0xe].Type = 0; param_1[0xe].CreatorBackTraceIndex = 0; TraceLogHelper("ClearFragList",0,lpMem,param_4); IkeReturnError(0,"ClearFragList",lpMem,param_4); - p_Var31 = param_1[0x14].ProcessLocksList.Blink; - if (p_Var31 != (_LIST_ENTRY *)0x0) { - CloseHandle(p_Var31); - } - p_Var40 = param_1; + p_Var11 = param_1[0x14].ProcessLocksList.Blink; + if (p_Var11 != (_LIST_ENTRY *)0x0) { + CloseHandle(p_Var11); + } + p_Var42 = param_1; if ((gWfpTrackHeapBytes != 0) && (*(LPCVOID *)¶m_1[0x15].Flags != (LPCVOID)0x0)) { SVar27 = HeapSize(gWfpHeap,0,*(LPCVOID *)¶m_1[0x15].Flags); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar27; UNLOCK(); - p_Var40 = local_1d0; + p_Var42 = local_1d0; } lpMem_00 = *(PRTL_CRITICAL_SECTION_DEBUG **)¶m_1[0x15].Flags; HeapFree(gWfpHeap,0,lpMem_00); param_1[0x15].EntryCount = 0; param_1[0x15].ContentionCount = 0; param_1[0x15].Flags = 0; param_1[0x15].CreatorBackTraceIndexHigh = 0; param_1[0x15].SpareWORD = 0; - p_Var41 = (PRTL_CRITICAL_SECTION_DEBUG)p_Var40[6].ProcessLocksList.Flink; - if (p_Var41 != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { - local_128 = p_Var41; - IkeFreeIpsecIdSids((longlong)p_Var41); + p_Var44 = (PRTL_CRITICAL_SECTION_DEBUG)p_Var42[6].ProcessLocksList.Flink; + if (p_Var44 != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { + local_128 = p_Var44; + IkeFreeIpsecIdSids((longlong)p_Var44); WfpMidlObjectDestroySafe((longlong *)&local_128); } - p_Var31 = p_Var40[6].ProcessLocksList.Blink; - if (p_Var31 != (_LIST_ENTRY *)0x0) { - CloseHandle(p_Var31); - } - if (*(HANDLE *)&p_Var40[6].Flags != (HANDLE)0x0) { - CloseHandle(*(HANDLE *)&p_Var40[6].Flags); - } - if (*(HANDLE *)&p_Var40[6].EntryCount != (HANDLE)0x0) { - CloseHandle(*(HANDLE *)&p_Var40[6].EntryCount); - } - hObject = *(HANDLE *)(p_Var40 + 7); + p_Var11 = p_Var42[6].ProcessLocksList.Blink; + if (p_Var11 != (_LIST_ENTRY *)0x0) { + CloseHandle(p_Var11); + } + if (*(HANDLE *)&p_Var42[6].Flags != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)&p_Var42[6].Flags); + } + if (*(HANDLE *)&p_Var42[6].EntryCount != (HANDLE)0x0) { + CloseHandle(*(HANDLE *)&p_Var42[6].EntryCount); + } + hObject = *(HANDLE *)(p_Var42 + 7); if (hObject != (HANDLE)0x0) { CloseHandle(hObject); } if (Microsoft_Windows_Networking_CorrelationEnabled != 0) { - uStack_120 = uRam0000000180169238; + uStack_120 = uRam000000018016a238; local_128 = local_1d0; if (Microsoft_Windows_Networking_CorrelationEnabled != 0) { lpMem_00 = &local_128; EtwEx_tidActivityInfo(hObject,(short *)&ActivityStop,lpMem_00); } } - p_Var40 = local_1d0; + p_Var42 = local_1d0; WfpMemFree(&local_1d0[0xc].ProcessLocksList.Blink); - WfpMemFree((undefined8 *)&p_Var40[0xc].EntryCount); - WfpMemFree((undefined8 *)&p_Var40[0xc].Flags); + WfpMemFree((undefined8 *)&p_Var42[0xc].EntryCount); + WfpMemFree((undefined8 *)&p_Var42[0xc].Flags); WfpMemFree(&local_1d0); - cVar20 = TraceLogHelper("IkeFreeMMSA",0,lpMem_00,param_4); - return cVar20; + TraceLogHelper("IkeFreeMMSA",0,lpMem_00,param_4); + return; } } LAB_2: - local_1c8.Blink = p_Var31; - pcVar18 = (code *)swi(0x29); - (*pcVar18)(3); -switchD_18002f2b8_caseD_2: - pcVar18 = (code *)swi(0x29); - pcVar30 = (char *)(*pcVar18)(0x25); - cVar20 = (char)pcVar30; - *(char *)¶m_1->Type = (char)param_1->Type + cVar20; - *(char *)¶m_1->Type = (char)param_1->Type + cVar20; - DAT_6 = DAT_6 + (char)((ulonglong)param_1 >> 8); - return cVar20 + *pcVar30; + local_1c8._8_8_ = pLVar19; + pcVar16 = (code *)swi(0x29); + (*pcVar16)(3); + puVar43 = (undefined8 *)((longlong)puVar33 + 8); +switchD_18002f548_caseD_2: + cVar37 = '\0'; + pcVar16 = (code *)swi(0x29); + pcVar30 = (char *)(*pcVar16)(); + piVar24 = (int *)CONCAT71((int7)((ulonglong)pcVar30 >> 8),(char)pcVar30 + *pcVar30); + uVar21 = (int)piVar24 + *piVar24; + uVar21 = uVar21 + *(int *)(ulonglong)uVar21; + uVar17 = (undefined3)(uVar21 >> 8); + cVar20 = (char)uVar21 + *(char *)(ulonglong)uVar21; + *puVar43 = param_1; + cVar20 = cVar20 + *(char *)(ulonglong)CONCAT31(uVar17,cVar20); + puVar43[-1] = param_1; + cVar20 = cVar20 + *(char *)(ulonglong)CONCAT31(uVar17,cVar20); + cVar20 = cVar20 + *(char *)(ulonglong)CONCAT31(uVar17,cVar20); + puVar43[-2] = param_1; + uVar21 = CONCAT31(uVar17,cVar20 + *(char *)(ulonglong)CONCAT31(uVar17,cVar20)); + iVar38 = (int)pIVar39; + *(int *)(longlong)iVar38 = *(int *)(longlong)iVar38 + 1; + pcVar30 = (char *)((longlong)&unaff_RDI->CreatorBackTraceIndex + 1); + *pcVar30 = *pcVar30 + (char)((ulonglong)pIVar39 >> 8); + uVar22 = uVar21 + *(uint *)(ulonglong)uVar21; + if (!CARRY4(uVar21,*(uint *)(ulonglong)uVar21) && uVar22 != 0) { + *(int *)pIVar39->e_magic = *(int *)pIVar39->e_magic + 1; + } + iVar5 = *(int *)(ulonglong)uVar22; + *(int *)(longlong)iVar38 = *(int *)(longlong)iVar38 + 1; + pcVar30 = (char *)((longlong)unaff_RDI * 9 + 2); + *pcVar30 = *pcVar30 + cVar37; + pcVar30 = (char *)((longlong)unaff_RDI * 9 + 2); + *pcVar30 = *pcVar30 + cVar37; + pcVar30 = (char *)((longlong)&unaff_RDI[-1].SpareWORD + 1); + *pcVar30 = *pcVar30 + (char)(uVar22 + iVar5 >> 8); + uVar4 = in((short)pIVar39); + *(undefined1 *)&unaff_RDI->Type = uVar4; + *(int *)pIVar39->e_magic = *(int *)pIVar39->e_magic + 1; + pcVar16 = (code *)swi(3); + (*pcVar16)(); + return; } ``` ## IkeVerifyDosCookieIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.31| |i_ratio|0.31| |m_ratio|0.85| |b_ratio|0.62| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeVerifyDosCookieIkeV2|IkeVerifyDosCookieIkeV2| |fullname|IkeVerifyDosCookieIkeV2|IkeVerifyDosCookieIkeV2| |refcount|2|2| |`length`|716|976| |`called`|
Expand for full list:
IkeGenerateResponderDosCookie
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeReturnError
TraceLogHelper
WPP_SF_iSq
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
IkeGenerateResponderDosCookie
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeReturnError
TraceLogHelper
WPP_SF_iSD
WPP_SF_iSq
WfpMemFree
WfpReportAppErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeHandleStatusNotifyIkeV2|IkeHandleStatusNotifyIkeV2| |paramcount|4|4| |`address`|1800d026c|1800d0a48| |`sig`|undefined __fastcall IkeVerifyDosCookieIkeV2(longlong param_1, PUCHAR param_2, longlong * param_3, undefined8 param_4)|undefined __fastcall IkeVerifyDosCookieIkeV2(longlong param_1, PUCHAR param_2, longlong * param_3, longlong * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeVerifyDosCookieIkeV2 Called Diff ```diff --- IkeVerifyDosCookieIkeV2 called +++ IkeVerifyDosCookieIkeV2 called @@ -5,0 +6 @@ +WPP_SF_iSD @@ -8 +9 @@ -WfpReportSysErrorAsWinError +WfpReportAppErrorAsWinError ``` ### IkeVerifyDosCookieIkeV2 Diff ```diff --- IkeVerifyDosCookieIkeV2 +++ IkeVerifyDosCookieIkeV2 @@ -1,109 +1,136 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void IkeVerifyDosCookieIkeV2(longlong param_1,PUCHAR param_2,longlong *param_3,undefined8 param_4) +void IkeVerifyDosCookieIkeV2(longlong param_1,PUCHAR param_2,longlong *param_3,longlong **param_4) { char cVar1; - longlong lVar2; - wchar_t *pwVar3; - longlong **pplVar4; - PUCHAR pUVar5; - byte *pbVar6; - undefined *puVar7; + wchar_t *pwVar2; + longlong lVar3; + PUCHAR pUVar4; + byte *pbVar5; + undefined *puVar6; + uint uVar7; undefined1 auStackY_e8 [32]; longlong *local_b8; longlong local_b0; - longlong local_a8 [2]; + undefined8 local_a8 [2]; undefined8 local_98 [4]; - longlong *local_78; + undefined8 *local_78; undefined4 local_70; undefined4 local_6c; longlong local_68 [2]; longlong local_58 [2]; longlong *local_48; undefined4 local_40; undefined4 local_3c; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_e8; local_b8 = (longlong *)0x0; - TraceLogHelper("IkeVerifyDosCookieIkeV2",1,param_3,param_4); - pUVar5 = (PUCHAR)(param_1 + 0x2a8); - puVar7 = (undefined *)0x0; - pplVar4 = &local_b8; - lVar2 = IkeGenerateResponderDosCookie(pUVar5,param_2,0,pplVar4); - if (lVar2 == 0) { - puVar7 = (undefined *)*local_b8; - if (puVar7 != (undefined *)*param_3) { - WfpMemFree(&local_b8); - local_b8 = (longlong *)0x0; - pplVar4 = &local_b8; - puVar7 = (undefined *)0x1; - lVar2 = IkeGenerateResponderDosCookie(pUVar5,param_2,1,pplVar4); - if (lVar2 != 0) goto LAB_0; - if (*local_b8 != *param_3) { - pplVar4 = (longlong **)0x1; - puVar7 = (undefined *)0x3616; - lVar2 = WfpReportSysErrorAsWinError(pUVar5,"IkeVerifyDosCookieIkeV2",0x3616,1); - if (lVar2 != 0) goto LAB_0; - } - } + pUVar4 = (PUCHAR)&WPP_GLOBAL_Control; + uVar7 = (uint)param_4; + if (uVar7 < 8) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - pplVar4 = (longlong **)IkeGetTlsMmLuid(); - puVar7 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control[2],0x68,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,pplVar4 - ,pwVar3); + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (longlong **)IkeGetTlsMmLuid(); + param_3 = (longlong *)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pUVar4 = (PUCHAR)WPP_GLOBAL_Control[2]; + WPP_SF_iSD(pUVar4,0x6d,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,param_4,pwVar2); } - if (DAT_2 < 5) goto LAB_1800d04ef; - cVar1 = _tlgKeywordOn(0x180164278,0); - if (cVar1 == '\0') goto LAB_1; - local_b0 = IkeGetTlsMmLuid(); - local_6c = 0; - local_78 = &local_b0; - local_70 = 8; - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_68,pwVar3); - _tlgCreate1Sz_char(local_58,"DOS COOKIE verification passed"); - local_48 = local_a8; - pbVar6 = &DAT_3; - local_a8[0] = param_1; - } - else { -LAB_0: + if (4 < DAT_0) { + pUVar4 = (PUCHAR)&DAT_0; + cVar1 = _tlgKeywordOn(0x180165278,0); + if (cVar1 != '\0') { + local_a8[0] = IkeGetTlsMmLuid(); + local_6c = 0; + local_78 = local_a8; + local_70 = 8; + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_68,pwVar2); + _tlgCreate1Sz_char(local_58,"Received an invlaid CookieSize"); + local_3c = 0; + local_48 = &local_b0; + local_b0 = CONCAT44(local_b0._4_4_,uVar7); + pUVar4 = (PUCHAR)&DAT_0; + local_40 = 4; + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_1,param_3,param_4,6,local_98); + } + } +LAB_2: + puVar6 = (undefined *)0x3616; + lVar3 = WfpReportAppErrorAsWinError(pUVar4,"IkeVerifyDosCookieIkeV2",0x3616,param_4,1); + if (lVar3 == 0) goto LAB_3; +LAB_4: if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - pplVar4 = (longlong **)IkeGetTlsMmLuid(); - puVar7 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control[2],0x69,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,pplVar4 - ,pwVar3); + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (longlong **)IkeGetTlsMmLuid(); + puVar6 = &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control[2],0x6f,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,param_4 + ,pwVar2); } - if (DAT_2 < 5) goto LAB_1800d04ef; - cVar1 = _tlgKeywordOn(0x180164278,0); - if (cVar1 == '\0') goto LAB_1; + if ((DAT_0 < 5) || (cVar1 = _tlgKeywordOn(0x180165278,0), cVar1 == '\0')) + goto LAB_5; local_a8[0] = IkeGetTlsMmLuid(); local_6c = 0; local_78 = local_a8; local_70 = 8; - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_68,pwVar3); + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_68,pwVar2); _tlgCreate1Sz_char(local_58,"DOS COOKIE verification passed"); - local_48 = &local_b0; - pbVar6 = &DAT_4; - local_b0 = param_1; + pbVar5 = &DAT_6; + } + else { + TraceLogHelper("IkeVerifyDosCookieIkeV2",1,param_3,param_4); + pUVar4 = (PUCHAR)(param_1 + 0x2a8); + puVar6 = (undefined *)0x0; + param_4 = &local_b8; + lVar3 = IkeGenerateResponderDosCookie(pUVar4,param_2,0,param_4); + if (lVar3 != 0) goto LAB_4; + if (*local_b8 != *param_3) { + WfpMemFree(&local_b8); + local_b8 = (longlong *)0x0; + param_4 = &local_b8; + puVar6 = (undefined *)0x1; + lVar3 = IkeGenerateResponderDosCookie(pUVar4,param_2,1,param_4); + if (lVar3 != 0) goto LAB_4; + if (*local_b8 != *param_3) goto LAB_2; + } +LAB_3: + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (longlong **)IkeGetTlsMmLuid(); + puVar6 = &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control[2],0x6e,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,param_4 + ,pwVar2); + } + if ((DAT_0 < 5) || (cVar1 = _tlgKeywordOn(0x180165278,0), cVar1 == '\0')) + goto LAB_5; + local_a8[0] = IkeGetTlsMmLuid(); + local_6c = 0; + local_78 = local_a8; + local_70 = 8; + pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_68,pwVar2); + _tlgCreate1Sz_char(local_58,"DOS COOKIE verification passed"); + pbVar5 = &DAT_7; } local_3c = 0; + local_48 = &local_b0; local_40 = 8; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,pbVar6,puVar7,pplVar4,6,local_98); -LAB_1: + local_b0 = param_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,pbVar5,puVar6,param_4,6,local_98); +LAB_5: WfpMemFree(&local_b8); - TraceLogHelper("IkeVerifyDosCookieIkeV2",0,puVar7,pplVar4); - IkeReturnError(lVar2,"IkeVerifyDosCookieIkeV2",puVar7,pplVar4); + TraceLogHelper("IkeVerifyDosCookieIkeV2",0,puVar6,param_4); + IkeReturnError(lVar3,"IkeVerifyDosCookieIkeV2",puVar6,param_4); return; } ``` ## IkeLookupVendorId ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address,called| |ratio|0.21| |i_ratio|0.27| |m_ratio|0.92| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeLookupVendorId|IkeLookupVendorId| |fullname|IkeLookupVendorId|IkeLookupVendorId| |`refcount`|7|4| |`length`|3139|3756| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeReturnError
MicrosoftTelemetryAssertTriggeredNoArgs
NCRYPT.DLL::BCryptCreateHash
NCRYPT.DLL::BCryptDestroyHash
NCRYPT.DLL::BCryptFinishHash
NCRYPT.DLL::BCryptGetPropertyNCRYPT.DLL::BCryptHashData
TraceLogHelper
WPP_SF_iSS
WPP_SF_iSd
WPP_SF_iSs
WPP_SF_iSsdd
WS2_32.DLL::ntohl
WfpBytesToString
WfpMemAlloc
WfpMemFree
WfpReportError
WfpReportSysErrorAsNtStatus
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
IkeDoingIkeV2
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeReturnError
MicrosoftTelemetryAssertTriggeredNoArgs
NCRYPT.DLL::BCryptCreateHash
NCRYPT.DLL::BCryptDestroyHash
NCRYPT.DLL::BCryptFinishHashNCRYPT.DLL::BCryptGetProperty
NCRYPT.DLL::BCryptHashData
TraceLogHelper
WPP_SF_iS
WPP_SF_iSS
WPP_SF_iSd
WPP_SF_iSs
WPP_SF_iSsdd
WS2_32.DLL::ntohl
WfpBytesToString
WfpMemAlloc
WfpMemFree
WfpReportAppErrorAsWinError
WfpReportError
WfpReportSysErrorAsNtStatus
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
| |calling|IkeInitMMResponderPhase1
IkeProcessVendor|IkeInitMMResponderPhase1
IkeProcessVendor| |paramcount|6|6| |`address`|180025220|180025240| |`sig`|undefined __fastcall IkeLookupVendorId(longlong * param_1, uint param_2, wchar_t * param_3, ulonglong param_4, int * param_5, uint * param_6)|undefined __fastcall IkeLookupVendorId(longlong * param_1, uint param_2, wchar_t * param_3, int * param_4, int * param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeLookupVendorId Called Diff ```diff --- IkeLookupVendorId called +++ IkeLookupVendorId called @@ -3,0 +4 @@ +IkeDoingIkeV2 @@ -13,0 +15 @@ +WPP_SF_iS @@ -21,0 +24 @@ +WfpReportAppErrorAsWinError ``` ### IkeLookupVendorId Diff ```diff --- IkeLookupVendorId +++ IkeLookupVendorId @@ -1,526 +1,619 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void IkeLookupVendorId(longlong *param_1,uint param_2,wchar_t *param_3,ulonglong param_4, - int *param_5,uint *param_6) +void IkeLookupVendorId(longlong *param_1,uint param_2,wchar_t *param_3,int *param_4,int *param_5, + uint *param_6) { int iVar1; void *_Dst; u_long *puVar2; int *piVar3; char cVar4; - uint uVar5; - u_long uVar6; - longlong lVar7; - wchar_t *pwVar8; - ulonglong uVar9; + bool bVar5; + uint uVar6; + u_long uVar7; + ulonglong uVar8; + longlong lVar9; SIZE_T SVar10; - ulonglong uVar11; + wchar_t *pwVar11; + undefined7 extraout_var; undefined8 uVar12; - BCRYPT_HANDLE pvVar13; - HANDLE pvVar14; + char *pcVar13; + BCRYPT_HANDLE pvVar14; + HANDLE pvVar15; BCRYPT_HANDLE hObject; - wchar_t *pwVar15; - char *pcVar16; - undefined4 *puVar17; + BCRYPT_HASH_HANDLE pvVar16; + byte *pbVar17; wchar_t *pwVar18; undefined8 *puVar19; - uint uVar20; - ulonglong uVar21; - bool bVar22; - undefined1 auStackY_2b8 [32]; - u_long local_278 [2]; - uint *local_270; - uint local_268 [2]; - wchar_t *local_260; - ulonglong uStack_258; - wchar_t *local_250; - ulonglong uStack_248; - wchar_t *local_240; - ulonglong uStack_238; - undefined8 local_230; - wchar_t *pwStack_228; - ULONG local_220; - uint local_21c; - int *local_218; - undefined8 local_210; - undefined8 local_208; + undefined *puVar20; + uint uVar21; + ulonglong uVar23; + undefined1 auStackY_398 [32]; + uint *local_358; + uint local_350; + uint local_34c; + BCRYPT_HASH_HANDLE local_348; + ulonglong uStack_340; + wchar_t *local_338; + ulonglong uStack_330; + wchar_t *local_328; + ulonglong uStack_320; + undefined8 local_318; + wchar_t *pwStack_310; + ULONG local_308; + undefined4 local_304; + u_long local_300 [2]; + int *local_2f8; + int *local_2f0; + undefined8 local_2e8; + undefined8 local_2e0; + undefined8 local_2d8; + undefined8 local_2d0; + undefined8 local_2c8 [2]; + undefined8 local_2b8 [4]; + undefined8 *local_298; + undefined8 local_290; + longlong local_288 [2]; + uint *local_278; + undefined8 local_270; + undefined4 *local_268; + undefined8 local_260; + longlong local_258 [2]; + undefined8 local_248 [4]; + undefined8 *local_228; + undefined8 local_220; + longlong local_218 [2]; + int **local_208; undefined8 local_200; - undefined8 local_1f8 [4]; - undefined8 *local_1d8; - undefined8 local_1d0; - longlong local_1c8 [2]; - uint *local_1b8; + int **local_1f8; + undefined8 local_1f0; + longlong local_1e8 [2]; + undefined8 local_1d8 [4]; + undefined8 *local_1b8; undefined8 local_1b0; - int **local_1a8; - undefined8 local_1a0; - longlong local_198 [2]; + longlong local_1a8 [2]; + u_long *local_198; + undefined8 local_190; undefined8 local_188 [4]; undefined8 *local_168; undefined8 local_160; longlong local_158 [2]; - u_long *local_148; - undefined8 local_140; + longlong local_148 [2]; undefined8 local_138 [4]; uint **local_118; undefined8 local_110; longlong local_108 [2]; longlong local_f8 [2]; undefined8 local_e8 [4]; undefined8 *local_c8; undefined8 local_c0; longlong local_b8 [2]; longlong local_a8 [2]; longlong local_98 [2]; wchar_t local_88 [40]; ulonglong local_38; + ulonglong uVar22; - local_38 = __security_cookie ^ (ulonglong)auStackY_2b8; - lVar7 = 0; - local_278[0] = (u_long)param_3; - local_218 = param_5; - local_270 = param_6; - local_230 = 0; - pwStack_228 = (wchar_t *)0x0; - uVar11 = param_4; + local_38 = __security_cookie ^ (ulonglong)auStackY_398; + uVar23 = 0; + local_350 = (uint)param_3; + local_2f0 = param_5; + pcVar13 = "IkeLookupVendorId"; + local_358 = param_6; + local_318 = 0; + pwStack_310 = (wchar_t *)0x0; + local_2f8 = param_4; TraceLogHelper("IkeLookupVendorId",1,param_3,param_4); *param_5 = 0; - if (((int)param_4 != 0) || (pwVar15 = pwStack_228, (param_2 - 0x10 & 0xfffffffb) == 0)) { - uVar21 = 0; + if (((param_2 - 0x10 & 0xffffffeb) == 0) && (uVar8 = uVar23, uVar22 = uVar23, param_2 != 0x24)) { do { - uVar20 = (uint)uVar21; - if (((uVar20 < 0xe) && ((0x3c11U >> (uVar20 & 0x1f) & 1) != 0)) || (param_2 == 0x10)) { - local_260 = (wchar_t *)0x0; - uStack_258 = 0; - local_250 = (wchar_t *)0x0; - uStack_248 = 0; - local_240 = (wchar_t *)0x0; - uStack_238 = 0; - TraceLogHelper("IkeGetVendorIdHash",1,param_3,uVar11); - local_260 = (wchar_t *)0x0; - uStack_258 = 0; - local_250 = (wchar_t *)0x0; - uStack_248 = 0; - uVar11 = 4; - local_240 = (wchar_t *)0x0; - uStack_238 = 0; + uVar21 = (uint)uVar22; + if (((uVar21 < 0xe) && ((0x3c11U >> (uVar21 & 0x1f) & 1) != 0)) || (param_2 == 0x10)) { + local_348 = (BCRYPT_HASH_HANDLE)0x0; + uStack_340 = 0; + local_338 = (wchar_t *)0x0; + uStack_330 = 0; + local_328 = (wchar_t *)0x0; + uStack_320 = 0; + TraceLogHelper("IkeGetVendorIdHash",1,param_3,param_4); + local_348 = (BCRYPT_HASH_HANDLE)0x0; + uStack_340 = 0; + param_4 = (int *)0x4; + local_338 = (wchar_t *)0x0; + uStack_330 = 0; + local_328 = (wchar_t *)0x0; + uStack_320 = 0; hObject = *(BCRYPT_HANDLE *)(gIkeExtGlobals + 0xa38); - pvVar13 = hObject; - uVar5 = BCryptGetProperty(hObject,L"ObjectLength",(PUCHAR)local_268,4,&local_220,0); - if (uVar5 == 0) { - uStack_248 = CONCAT44(uStack_248._4_4_,local_268[0]); - pvVar14 = gWfpHeap; - local_240 = HeapAlloc(gWfpHeap,8,(ulonglong)local_268[0]); - if (local_240 != (wchar_t *)0x0) { + pvVar14 = hObject; + uVar6 = BCryptGetProperty(hObject,L"ObjectLength",(PUCHAR)&local_34c,4,&local_308,0); + if (uVar6 == 0) { + uStack_330 = CONCAT44(uStack_330._4_4_,local_34c); + pvVar15 = gWfpHeap; + local_328 = HeapAlloc(gWfpHeap,8,(ulonglong)local_34c); + if (local_328 != (wchar_t *)0x0) { if (gWfpTrackHeapBytes != 0) { - SVar10 = HeapSize(gWfpHeap,0,local_240); + SVar10 = HeapSize(gWfpHeap,0,local_328); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar10; UNLOCK(); } LAB_0: - uVar11 = 4; - pvVar13 = hObject; - uVar5 = BCryptGetProperty(hObject,L"HashDigestLength",(PUCHAR)local_268,4,&local_220,0); - if (uVar5 == 0) { - uStack_258 = CONCAT44(uStack_258._4_4_,local_268[0]); - pvVar14 = gWfpHeap; - local_250 = HeapAlloc(gWfpHeap,8,(ulonglong)local_268[0]); - if (local_250 == (wchar_t *)0x0) { + param_4 = (int *)0x4; + pvVar14 = hObject; + uVar6 = BCryptGetProperty(hObject,L"HashDigestLength",(PUCHAR)&local_34c,4,&local_308,0) + ; + if (uVar6 == 0) { + uStack_340 = CONCAT44(uStack_340._4_4_,local_34c); + pvVar15 = gWfpHeap; + local_338 = HeapAlloc(gWfpHeap,8,(ulonglong)local_34c); + if (local_338 == (wchar_t *)0x0) { param_3 = (wchar_t *)0xc0000017; - lVar7 = WfpReportSysErrorAsNtStatus(pvVar14,"HeapAlloc",0xc0000017); - if (lVar7 != 0) { - WfpReportError((uint)lVar7,"WfpMemAlloc",param_3); + uVar8 = WfpReportSysErrorAsNtStatus(pvVar15,"HeapAlloc",0xc0000017); + if (uVar8 != 0) { + WfpReportError((uint)uVar8,"WfpMemAlloc",param_3); goto LAB_1; } } else { - lVar7 = 0; + uVar8 = uVar23; if (gWfpTrackHeapBytes != 0) { - SVar10 = HeapSize(gWfpHeap,0,local_250); + SVar10 = HeapSize(gWfpHeap,0,local_338); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar10; UNLOCK(); - lVar7 = 0; - } - } - uVar11 = uStack_248 & 0xffffffff; - uStack_238 = CONCAT44(uStack_238._4_4_,1); - param_3 = local_240; - uVar5 = BCryptCreateHash(hObject,&local_260,(PUCHAR)local_240,(ULONG)uStack_248, + uVar8 = 0; + } + } + param_4 = (int *)(uStack_330 & 0xffffffff); + uStack_320 = CONCAT44(uStack_320._4_4_,1); + param_3 = local_328; + uVar6 = BCryptCreateHash(hObject,&local_348,(PUCHAR)local_328,(ULONG)uStack_330, (PUCHAR)0x0,0,0); - if (uVar5 == 0) goto LAB_1; - pcVar16 = "BCryptCreateHash"; + if (uVar6 == 0) goto LAB_1; + pcVar13 = "BCryptCreateHash"; } else { - pcVar16 = "BCryptGetProperty"; - hObject = pvVar13; + pcVar13 = "BCryptGetProperty"; + hObject = pvVar14; } goto LAB_2; } param_3 = (wchar_t *)0xc0000017; - lVar7 = WfpReportSysErrorAsNtStatus(pvVar14,"HeapAlloc",0xc0000017); - if (lVar7 == 0) goto LAB_0; - WfpReportError((uint)lVar7,"WfpMemAlloc",param_3); + uVar8 = WfpReportSysErrorAsNtStatus(pvVar15,"HeapAlloc",0xc0000017); + if (uVar8 == 0) goto LAB_0; + WfpReportError((uint)uVar8,"WfpMemAlloc",param_3); } else { - pcVar16 = "BCryptGetProperty"; - hObject = pvVar13; + pcVar13 = "BCryptGetProperty"; + hObject = pvVar14; LAB_2: - param_3 = (wchar_t *)(ulonglong)uVar5; - lVar7 = WfpReportSysErrorAsNtStatus(hObject,pcVar16,param_3); + param_3 = (wchar_t *)(ulonglong)uVar6; + uVar8 = WfpReportSysErrorAsNtStatus(hObject,pcVar13,param_3); } LAB_1: - lVar7 = IkeReturnError(lVar7,"IkeHashInitEx",param_3,uVar11); - pwVar8 = (wchar_t *)IkeReturnError(lVar7,"IkeHashInit",param_3,uVar11); - if (pwVar8 == (wchar_t *)0x0) { - uVar9 = 0xffffffffffffffff; + lVar9 = IkeReturnError(uVar8,"IkeHashInitEx",param_3,param_4); + lVar9 = IkeReturnError(lVar9,"IkeHashInit",param_3,param_4); + if (lVar9 == 0) { + uVar8 = 0xffffffffffffffff; do { - uVar9 = uVar9 + 1; - } while ((&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[(longlong)(int)uVar20 * 3][uVar9] != '\0') + uVar8 = uVar8 + 1; + } while ((&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[(longlong)(int)uVar21 * 3][uVar8] != '\0') ; - lVar7 = 0; - if (local_260 == (wchar_t *)0x0) { - uVar11 = 1; + if (local_348 == (BCRYPT_HASH_HANDLE)0x0) { + param_4 = (int *)0x1; param_3 = (wchar_t *)0x35ec; - lVar7 = WfpReportSysErrorAsWinError(0,"IkeHashUpdate",0x35ec,1); + uVar8 = WfpReportSysErrorAsWinError(0,"IkeHashUpdate",0x35ec,1); } else { - uVar11 = 0; - param_3 = (wchar_t *)(uVar9 & 0xffffffff); - pwVar15 = local_260; - uVar5 = BCryptHashData(local_260, - (&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[(longlong)(int)uVar20 * 3] - ,(ULONG)uVar9,0); - if (uVar5 != 0) { - param_3 = (wchar_t *)(ulonglong)uVar5; - lVar7 = WfpReportSysErrorAsNtStatus(pwVar15,"BCryptHashData",param_3); - } - } - pwVar8 = (wchar_t *)IkeReturnError(lVar7,"IkeHashUpdate",param_3,uVar11); - if (pwVar8 == (wchar_t *)0x0) { - if (local_260 == (wchar_t *)0x0) { - uVar11 = 1; + param_4 = (int *)0x0; + param_3 = (wchar_t *)(uVar8 & 0xffffffff); + pvVar16 = local_348; + uVar6 = BCryptHashData(local_348, + (&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[(longlong)(int)uVar21 * 3] + ,(ULONG)uVar8,0); + uVar8 = uVar23; + if (uVar6 != 0) { + param_3 = (wchar_t *)(ulonglong)uVar6; + uVar8 = WfpReportSysErrorAsNtStatus(pvVar16,"BCryptHashData",param_3); + } + } + lVar9 = IkeReturnError(uVar8,"IkeHashUpdate",param_3,param_4); + if (lVar9 == 0) { + lVar9 = 0; + if (local_348 == (BCRYPT_HASH_HANDLE)0x0) { + param_4 = (int *)0x1; param_3 = (wchar_t *)0x35ec; - lVar7 = WfpReportSysErrorAsWinError(0,"IkeHashFinal",0x35ec,1); + lVar9 = WfpReportSysErrorAsWinError(0,"IkeHashFinal",0x35ec,1); } else { - param_3 = (wchar_t *)(uStack_258 & 0xffffffff); - uVar11 = 0; - pwVar15 = local_260; - uVar5 = BCryptFinishHash(local_260,(PUCHAR)local_250,(ULONG)uStack_258,0); - if (uVar5 == 0) { - uStack_238 = uStack_238 & 0xffffffff00000000; - if (local_260 != (wchar_t *)0x0) { - BCryptDestroyHash(local_260); - } - local_260 = pwVar8; - if (local_240 != (wchar_t *)0x0) { - bVar22 = gWfpTrackHeapBytes != 0; - pwVar15 = local_240; - for (uVar9 = uStack_248 & 0xffffffff; uVar9 != 0; uVar9 = uVar9 - 1) { - *(undefined1 *)pwVar15 = 0; - pwVar15 = (wchar_t *)((longlong)pwVar15 + 1); + param_3 = (wchar_t *)(uStack_340 & 0xffffffff); + param_4 = (int *)0x0; + pvVar16 = local_348; + uVar6 = BCryptFinishHash(local_348,(PUCHAR)local_338,(ULONG)uStack_340,0); + if (uVar6 == 0) { + uStack_320 = uStack_320 & 0xffffffff00000000; + if (local_348 != (BCRYPT_HASH_HANDLE)0x0) { + BCryptDestroyHash(local_348); + } + local_348 = (BCRYPT_HASH_HANDLE)0x0; + if (local_328 != (wchar_t *)0x0) { + bVar5 = gWfpTrackHeapBytes != 0; + pwVar18 = local_328; + for (uVar8 = uStack_330 & 0xffffffff; uVar8 != 0; uVar8 = uVar8 - 1) { + *(undefined1 *)pwVar18 = 0; + pwVar18 = (wchar_t *)((longlong)pwVar18 + 1); } - if ((bVar22) && (local_240 != (wchar_t *)0x0)) { - SVar10 = HeapSize(gWfpHeap,0,local_240); + if ((bVar5) && (local_328 != (wchar_t *)0x0)) { + SVar10 = HeapSize(gWfpHeap,0,local_328); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar10; UNLOCK(); } - HeapFree(gWfpHeap,0,local_240); - param_3 = local_240; - } - uStack_248 = uStack_248 & 0xffffffff00000000; - lVar7 = 0; - local_240 = pwVar8; - if ((int)uStack_238 != 0) { - if (local_250 != (wchar_t *)0x0) { - pwVar15 = local_250; - for (uVar9 = uStack_258 & 0xffffffff; uVar9 != 0; uVar9 = uVar9 - 1) { - *(undefined1 *)pwVar15 = 0; - pwVar15 = (wchar_t *)((longlong)pwVar15 + 1); + HeapFree(gWfpHeap,0,local_328); + param_3 = local_328; + } + local_328 = (wchar_t *)0x0; + uStack_330 = uStack_330 & 0xffffffff00000000; + if ((int)uStack_320 != 0) { + if (local_338 != (wchar_t *)0x0) { + pwVar18 = local_338; + for (uVar8 = uStack_340 & 0xffffffff; uVar8 != 0; uVar8 = uVar8 - 1) { + *(undefined1 *)pwVar18 = 0; + pwVar18 = (wchar_t *)((longlong)pwVar18 + 1); } - WfpMemFree(&local_250); + WfpMemFree(&local_338); } - uStack_258 = uStack_258 & 0xffffffff00000000; - local_250 = (wchar_t *)0x0; + local_338 = (wchar_t *)0x0; + uStack_340 = uStack_340 & 0xffffffff00000000; } } else { - param_3 = (wchar_t *)(ulonglong)uVar5; - lVar7 = WfpReportSysErrorAsNtStatus(pwVar15,"BCryptFinishHash",param_3); - } - } - pwVar8 = (wchar_t *)IkeReturnError(lVar7,"IkeHashFinal",param_3,uVar11); - if (pwVar8 == (wchar_t *)0x0) { - pwStack_228 = local_250; - } - } - } - pwVar15 = pwStack_228; - if (local_260 != (wchar_t *)0x0) { - BCryptDestroyHash(local_260); - } - local_260 = (wchar_t *)0x0; - if (local_240 != (wchar_t *)0x0) { - pwVar18 = local_240; - for (uVar9 = uStack_248 & 0xffffffff; uVar9 != 0; uVar9 = uVar9 - 1) { - *(undefined1 *)pwVar18 = 0; - pwVar18 = (wchar_t *)((longlong)pwVar18 + 1); - } - WfpMemFree(&local_240); - } - local_240 = (wchar_t *)0x0; - uStack_248 = uStack_248 & 0xffffffff00000000; - if ((int)uStack_238 != 0) { - if (local_250 != (wchar_t *)0x0) { - pwVar18 = local_250; - for (uVar9 = uStack_258 & 0xffffffff; uVar9 != 0; uVar9 = uVar9 - 1) { - *(undefined1 *)pwVar18 = 0; - pwVar18 = (wchar_t *)((longlong)pwVar18 + 1); - } - WfpMemFree(&local_250); - } - local_250 = (wchar_t *)0x0; - uStack_258 = uStack_258 & 0xffffffff00000000; - } - TraceLogHelper("IkeGetVendorIdHash",0,param_3,uVar11); - lVar7 = IkeReturnError((longlong)pwVar8,"IkeGetVendorIdHash",param_3,uVar11); - piVar3 = local_218; - if (lVar7 != 0) break; - if ((*param_1 == *(longlong *)pwVar15) && (param_1[1] == *(longlong *)(pwVar15 + 4))) { - *local_218 = (&vendorIdMapping)[uVar21 * 6]; - puVar19 = WPP_GLOBAL_Control; - if (local_278[0] == 0) { - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + param_3 = (wchar_t *)(ulonglong)uVar6; + lVar9 = WfpReportSysErrorAsNtStatus(pvVar16,"BCryptFinishHash",param_3); + } + } + lVar9 = IkeReturnError(lVar9,"IkeHashFinal",param_3,param_4); + if (lVar9 == 0) { + pwStack_310 = local_338; + } + } + } + pwVar18 = pwStack_310; + if (local_348 != (BCRYPT_HASH_HANDLE)0x0) { + BCryptDestroyHash(local_348); + } + local_348 = (BCRYPT_HASH_HANDLE)0x0; + if (local_328 != (wchar_t *)0x0) { + pwVar11 = local_328; + for (uVar8 = uStack_330 & 0xffffffff; uVar8 != 0; uVar8 = uVar8 - 1) { + *(undefined1 *)pwVar11 = 0; + pwVar11 = (wchar_t *)((longlong)pwVar11 + 1); + } + WfpMemFree(&local_328); + } + local_328 = (wchar_t *)0x0; + uStack_330 = uStack_330 & 0xffffffff00000000; + if ((int)uStack_320 != 0) { + if (local_338 != (wchar_t *)0x0) { + pwVar11 = local_338; + for (uVar8 = uStack_340 & 0xffffffff; uVar8 != 0; uVar8 = uVar8 - 1) { + *(undefined1 *)pwVar11 = 0; + pwVar11 = (wchar_t *)((longlong)pwVar11 + 1); + } + WfpMemFree(&local_338); + } + local_338 = (wchar_t *)0x0; + uStack_340 = uStack_340 & 0xffffffff00000000; + } + TraceLogHelper("IkeGetVendorIdHash",0,param_3,param_4); + uVar8 = IkeReturnError(lVar9,"IkeGetVendorIdHash",param_3,param_4); + piVar3 = local_2f0; + param_6 = local_358; + if (uVar8 != 0) break; + if ((*param_1 == *(longlong *)pwVar18) && (param_1[1] == *(longlong *)(pwVar18 + 4))) { + puVar20 = &vendorIdMapping; + puVar19 = &WPP_GLOBAL_Control; + lVar9 = uVar22 * 0x18; + *local_2f0 = *(int *)(&vendorIdMapping + lVar9); + pwVar11 = WPP_GLOBAL_Control; + if (local_350 == 0) { + if ((((wchar_t **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - uVar11 = IkeGetTlsMmLuid(); - param_3 = - L"检\xe496뮂㔵㽈簠聚\xe05a歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2"; - WPP_SF_iSs(WPP_GLOBAL_Control[2],10,&WPP_e49668c0bb823535483f207c5a805ae0_Traceguids, - uVar11,pwVar8,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[uVar21 * 3]); - } - puVar19 = WPP_GLOBAL_Control; - if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180164278,0), cVar4 != '\0')) { - local_210 = IkeGetTlsMmLuid(); - local_c8 = &local_210; + ((WPP_GLOBAL_Control[0xe] & L'\x10') != L'\0')) { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + puVar20 = (undefined *)IkeGetTlsMmLuid(); + puVar19 = (undefined8 *)&WPP_38847be305d63a5f54a05560330ecd2f_Traceguids; + WPP_SF_iSs(*(undefined8 *)(WPP_GLOBAL_Control + 8),10, + &WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,puVar20,pwVar11, + (&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); + } + pwVar11 = WPP_GLOBAL_Control; + if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180165278,0), cVar4 != '\0')) { + local_2e8 = IkeGetTlsMmLuid(); + local_c8 = &local_2e8; local_c0 = 8; - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_b8,pwVar8); + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_b8,pwVar11); _tlgCreate1Sz_char(local_a8,"Received Vendor ID"); - _tlgCreate1Sz_char(local_98,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[uVar21 * 3]); + _tlgCreate1Sz_char(local_98,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_4,param_3,uVar11,6,local_e8); - puVar19 = WPP_GLOBAL_Control; - } - } - param_6 = local_270; - pvVar14 = gWfpHeap; - puVar17 = &vendorIdMapping; + (0x180165278,&DAT_4,puVar19,puVar20,6,local_e8); + pwVar11 = WPP_GLOBAL_Control; + } + } + param_6 = local_358; + pvVar15 = gWfpHeap; + param_4 = (int *)&vendorIdMapping; + param_3 = (wchar_t *)&WPP_GLOBAL_Control; iVar1 = *piVar3; - if (((iVar1 != 1) && (iVar1 != 0x400)) && ((iVar1 != 0x800 && (iVar1 != 0x2000)))) { - if (iVar1 == 0x1000) { - param_3 = (wchar_t *)(local_270 + 2); - *local_270 = param_2 - 0x10; - lVar7 = WfpMemAlloc((ulonglong)(param_2 - 0x10),8,(undefined8 *)param_3); - if (lVar7 == 0) { - _Dst = *(void **)(param_6 + 2); - param_3 = (wchar_t *)(ulonglong)*param_6; - memcpy(_Dst,param_1 + 2,(size_t)param_3); - if (local_278[0] == 0) { - param_3 = local_88; - local_88[0x20] = 0; - local_88[0] = L'\0'; - local_88[1] = L'\0'; - local_88[2] = L'\0'; - local_88[3] = L'\0'; - local_88[4] = L'\0'; - local_88[5] = L'\0'; - local_88[6] = L'\0'; - local_88[7] = L'\0'; - local_88[8] = L'\0'; - local_88[9] = L'\0'; - local_88[10] = L'\0'; - local_88[0xb] = L'\0'; - local_88[0xc] = L'\0'; - local_88[0xd] = L'\0'; - local_88[0xe] = L'\0'; - local_88[0xf] = L'\0'; - local_88[0x10] = L'\0'; - local_88[0x11] = L'\0'; - local_88[0x12] = L'\0'; - local_88[0x13] = L'\0'; - local_88[0x14] = L'\0'; - local_88[0x15] = L'\0'; - local_88[0x16] = L'\0'; - local_88[0x17] = L'\0'; - local_88[0x18] = L'\0'; - local_88[0x19] = L'\0'; - local_88[0x1a] = L'\0'; - local_88[0x1b] = L'\0'; - local_88[0x1c] = L'\0'; - local_88[0x1d] = L'\0'; - local_88[0x1e] = L'\0'; - local_88[0x1f] = L'\0'; - WfpBytesToString((ulonglong)param_2,(longlong)_Dst,param_3); - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - uVar11 = IkeGetTlsMmLuid(); - param_3 = - L"检\xe496뮂㔵㽈簠聚\xe05a歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2" - ; - WPP_SF_iSS(WPP_GLOBAL_Control[2],0xd, - &WPP_e49668c0bb823535483f207c5a805ae0_Traceguids,uVar11,pwVar8, - local_88); - } - if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180164278,0), cVar4 != '\0')) - { - local_270 = (uint *)IkeGetTlsMmLuid(); - local_118 = &local_270; - local_110 = 8; - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_108,pwVar8); - _tlgCreate1Sz_wchar_t(local_f8,local_88); - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,param_3,uVar11,5,local_138); - } - } - } - } - break; - } - uVar20 = (&DAT_6)[uVar21 * 6]; - if (param_2 == uVar20) { - lVar7 = 0; - *local_270 = 4; + if (((iVar1 == 1) || (iVar1 == 0x400)) || ((iVar1 == 0x800 || (iVar1 == 0x2000)))) { + uVar21 = *(uint *)(&DAT_5 + lVar9); + if (param_2 != uVar21) { + if ((((wchar_t **)pwVar11 != &WPP_GLOBAL_Control) && + (1 < *(byte *)((longlong)pwVar11 + 0x19))) && ((pwVar11[0xe] & L'\x10') != L'\0')) + { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + uVar12 = IkeGetTlsMmLuid(); + WPP_SF_iSsdd(*(undefined8 *)(WPP_GLOBAL_Control + 8),0xc,param_3,uVar12,pwVar11, + (&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); + uVar21 = *(uint *)(&DAT_5 + lVar9); + } + param_4 = (int *)(ulonglong)uVar21; + if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180165278,0), cVar4 != '\0')) { + local_2c8[0] = IkeGetTlsMmLuid(); + local_228 = local_2c8; + local_220 = 8; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_218,pwVar11); + local_208 = &local_2f8; + local_2f0 = (int *)CONCAT44(local_2f0._4_4_,*(undefined4 *)(&DAT_5 + lVar9)) + ; + local_1f8 = &local_2f0; + local_2f8 = (int *)CONCAT44(local_2f8._4_4_,param_2); + local_200 = 4; + local_1f0 = 4; + _tlgCreate1Sz_char(local_1e8,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_6,param_3,param_4,7,local_248); + param_4 = (int *)(ulonglong)*(uint *)(&DAT_5 + lVar9); + } + param_6 = local_358; + if (param_2 != (uint)param_4) { + MicrosoftTelemetryAssertTriggeredNoArgs(); + param_6 = local_358; + } + break; + } + uVar8 = 0; + *local_358 = 4; param_3 = (wchar_t *)0x4; - pwVar8 = HeapAlloc(pvVar14,8,4); - *(wchar_t **)(param_6 + 2) = pwVar8; - if (pwVar8 == (wchar_t *)0x0) { + pwVar11 = HeapAlloc(pvVar15,8,4); + *(wchar_t **)(param_6 + 2) = pwVar11; + if (pwVar11 == (wchar_t *)0x0) { param_3 = (wchar_t *)0xc0000017; - lVar7 = WfpReportSysErrorAsNtStatus(pvVar14,"HeapAlloc",0xc0000017); - if (lVar7 != 0) { - WfpReportError((uint)lVar7,"WfpMemAlloc",param_3); + uVar8 = WfpReportSysErrorAsNtStatus(pvVar15,"HeapAlloc",0xc0000017); + if (uVar8 != 0) { + WfpReportError((uint)uVar8,"WfpMemAlloc",param_3); break; } } else if (gWfpTrackHeapBytes != 0) { - SVar10 = HeapSize(gWfpHeap,0,pwVar8); + SVar10 = HeapSize(gWfpHeap,0,pwVar11); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar10; UNLOCK(); - pwVar15 = pwStack_228; - param_3 = pwVar8; + pwVar18 = pwStack_310; + param_3 = pwVar11; } puVar2 = *(u_long **)(param_6 + 2); - uVar6 = *(u_long *)(param_1 + 2); - *puVar2 = uVar6; - uVar6 = ntohl(uVar6); - *puVar2 = uVar6; - param_6 = local_270; - if (local_278[0] == 0) { - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - uVar11 = IkeGetTlsMmLuid(); - param_3 = - L"检\xe496뮂㔵㽈簠聚\xe05a歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2" - ; - WPP_SF_iSd(WPP_GLOBAL_Control[2],0xb, - &WPP_e49668c0bb823535483f207c5a805ae0_Traceguids,uVar11,pwVar8); - } - param_6 = local_270; - if ((4 < DAT_3) && - (cVar4 = _tlgKeywordOn(0x180164278,0), param_6 = local_270, cVar4 != '\0')) { - local_208 = IkeGetTlsMmLuid(); - local_168 = &local_208; - local_160 = 8; - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_158,pwVar8); - local_278[0] = *puVar2; - local_148 = local_278; - local_140 = 4; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_7,param_3,uVar11,5,local_188); - param_6 = local_270; - } - } + uVar7 = *(u_long *)(param_1 + 2); + *puVar2 = uVar7; + uVar7 = ntohl(uVar7); + *puVar2 = uVar7; + param_6 = local_358; + if (local_350 != 0) break; + if ((((wchar_t **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((WPP_GLOBAL_Control[0xe] & L'\x10') != L'\0')) { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (int *)IkeGetTlsMmLuid(); + param_3 = + L"篣㢄ז㩟ꁔ恕ำ⿍歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2"; + WPP_SF_iSd(*(undefined8 *)(WPP_GLOBAL_Control + 8),0xb, + &WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,param_4,pwVar11); + } + param_6 = local_358; + if ((DAT_3 < 5) || + (cVar4 = _tlgKeywordOn(0x180165278,0), param_6 = local_358, cVar4 == '\0')) break; + local_2d0 = IkeGetTlsMmLuid(); + local_1b8 = &local_2d0; + local_1b0 = 8; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_1a8,pwVar11); + local_300[0] = *puVar2; + local_198 = local_300; + pbVar17 = &DAT_7; + puVar19 = local_1d8; + local_190 = 4; } else { - if ((((undefined8 **)puVar19 != &WPP_GLOBAL_Control) && - (1 < *(byte *)((longlong)puVar19 + 0x19))) && - ((*(byte *)((longlong)puVar19 + 0x1c) & 0x10) != 0)) { - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - uVar12 = IkeGetTlsMmLuid(); - WPP_SF_iSsdd(WPP_GLOBAL_Control[2],puVar17,param_3,uVar12,pwVar8, - (&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[uVar21 * 3]); - uVar20 = (&DAT_6)[uVar21 * 6]; - } - uVar11 = (ulonglong)uVar20; - if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180164278,0), cVar4 != '\0')) { - local_200 = IkeGetTlsMmLuid(); - local_1d8 = &local_200; - local_1d0 = 8; - pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_1c8,pwVar8); - local_1b8 = &local_21c; - local_218 = (int *)CONCAT44(local_218._4_4_,(&DAT_6)[uVar21 * 6]); - local_1a8 = &local_218; - local_1b0 = 4; - local_1a0 = 4; - local_21c = param_2; - _tlgCreate1Sz_char(local_198,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180111ff8)[uVar21 * 3]); - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_8,param_3,uVar11,7,local_1f8); - uVar11 = (ulonglong)(uint)(&DAT_6)[uVar21 * 6]; - } - param_6 = local_270; - if (param_2 != (uint)uVar11) { - MicrosoftTelemetryAssertTriggeredNoArgs(); - param_6 = local_270; - } - } + if (iVar1 != 0x1000) break; + bVar5 = IkeDoingIkeV2(local_2f8); + param_6 = local_358; + if ((int)CONCAT71(extraout_var,bVar5) != 0) { + uVar21 = param_4[uVar22 * 6 + 4]; + if (param_2 == uVar21) { + param_3 = (wchar_t *)(local_358 + 2); + *local_358 = 0x10; + uVar8 = WfpMemAlloc(0x10,8,(undefined8 *)param_3); + if (uVar8 == 0) { + _Dst = *(void **)(param_6 + 2); + param_3 = (wchar_t *)(ulonglong)*param_6; + memcpy(_Dst,param_1 + 2,(size_t)param_3); + if (local_350 == 0) { + param_3 = local_88; + local_88[0x20] = 0; + local_88[0] = L'\0'; + local_88[1] = L'\0'; + local_88[2] = L'\0'; + local_88[3] = L'\0'; + local_88[4] = L'\0'; + local_88[5] = L'\0'; + local_88[6] = L'\0'; + local_88[7] = L'\0'; + local_88[8] = L'\0'; + local_88[9] = L'\0'; + local_88[10] = L'\0'; + local_88[0xb] = L'\0'; + local_88[0xc] = L'\0'; + local_88[0xd] = L'\0'; + local_88[0xe] = L'\0'; + local_88[0xf] = L'\0'; + local_88[0x10] = L'\0'; + local_88[0x11] = L'\0'; + local_88[0x12] = L'\0'; + local_88[0x13] = L'\0'; + local_88[0x14] = L'\0'; + local_88[0x15] = L'\0'; + local_88[0x16] = L'\0'; + local_88[0x17] = L'\0'; + local_88[0x18] = L'\0'; + local_88[0x19] = L'\0'; + local_88[0x1a] = L'\0'; + local_88[0x1b] = L'\0'; + local_88[0x1c] = L'\0'; + local_88[0x1d] = L'\0'; + local_88[0x1e] = L'\0'; + local_88[0x1f] = L'\0'; + WfpBytesToString((ulonglong)*param_6,(longlong)_Dst,param_3); + if ((((wchar_t **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((WPP_GLOBAL_Control[0xe] & L'\x10') != L'\0')) { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (int *)IkeGetTlsMmLuid(); + param_3 = + L"篣㢄ז㩟ꁔ恕ำ⿍歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2" + ; + WPP_SF_iSS(*(undefined8 *)(WPP_GLOBAL_Control + 8),0xf, + &WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,param_4,pwVar11, + local_88); + } + if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180165278,0), cVar4 != '\0') + ) { + local_358 = (uint *)IkeGetTlsMmLuid(); + local_118 = &local_358; + local_110 = 8; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_108,pwVar11); + _tlgCreate1Sz_wchar_t(local_f8,local_88); + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_8,param_3,param_4,5,local_138); + } + } + } + } + else { + if (((pwVar11 != param_3) && (1 < *(byte *)((longlong)pwVar11 + 0x19))) && + ((pwVar11[0xe] & L'\x10') != L'\0')) { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + uVar12 = IkeGetTlsMmLuid(); + WPP_SF_iSsdd(*(undefined8 *)(WPP_GLOBAL_Control + 8),0xe,param_3,uVar12,pwVar11, + (&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); + uVar21 = *(uint *)(&DAT_5 + lVar9); + } + param_4 = (int *)(ulonglong)uVar21; + if ((4 < DAT_3) && (cVar4 = _tlgKeywordOn(0x180165278,0), cVar4 != '\0')) { + local_2d8 = IkeGetTlsMmLuid(); + local_298 = &local_2d8; + local_290 = 8; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_288,pwVar11); + local_278 = &local_350; + local_304 = *(undefined4 *)(&DAT_5 + lVar9); + local_268 = &local_304; + local_270 = 4; + local_260 = 4; + local_350 = param_2; + _tlgCreate1Sz_char(local_258,(&PTR_s_MS_NT5_ISAKMPOAKLEY_180112ff8)[uVar22 * 3]); + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_9,param_3,param_4,7,local_2b8); + param_4 = (int *)(ulonglong)*(uint *)(&DAT_5 + lVar9); + } + param_6 = local_358; + if (param_2 != (uint)param_4) { + MicrosoftTelemetryAssertTriggeredNoArgs(); + param_6 = local_358; + } + } + break; + } + if (((pwVar11 != param_3) && (2 < *(byte *)((longlong)pwVar11 + 0x19))) && + ((pwVar11[0xe] & L'\x10') != L'\0')) { + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = (int *)IkeGetTlsMmLuid(); + param_3 = + L"篣㢄ז㩟ꁔ恕ำ⿍歉䝥湥牥瑡䵥卍杩䉮潬䥢楮楴瑡牯歉噥2"; + WPP_SF_iS(*(undefined8 *)(WPP_GLOBAL_Control + 8),0xd, + &WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,param_4,pwVar11); + } + param_6 = local_358; + if ((DAT_3 < 4) || + (cVar4 = _tlgKeywordOn(0x180165278,0), param_6 = local_358, cVar4 == '\0')) break; + local_2e0 = IkeGetTlsMmLuid(); + local_168 = &local_2e0; + local_160 = 8; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_158,pwVar11); + _tlgCreate1Sz_char(local_148, + "Ignoring the vendor, received Security Realm Vendor ID in non-IKEv2 message" + ); + puVar19 = local_188; + pbVar17 = &DAT_10; + } + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,pbVar17,param_3,param_4,5,puVar19); + param_6 = local_358; break; } - param_3 = pwVar15; - if ((gWfpTrackHeapBytes != 0) && (pwVar15 != (wchar_t *)0x0)) { - SVar10 = HeapSize(gWfpHeap,0,pwVar15); + param_3 = pwVar18; + if ((gWfpTrackHeapBytes != 0) && (pwVar18 != (wchar_t *)0x0)) { + SVar10 = HeapSize(gWfpHeap,0,pwVar18); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar10; UNLOCK(); - param_3 = pwStack_228; + param_3 = pwStack_310; } HeapFree(gWfpHeap,0,param_3); - local_230 = 0; - pwStack_228 = (wchar_t *)0x0; + local_318 = 0; + pwStack_310 = (wchar_t *)0x0; } - uVar21 = (ulonglong)(uVar20 + 1); - pwVar15 = pwStack_228; - } while (uVar20 + 1 < 0xf); + pwVar18 = pwStack_310; + param_6 = local_358; + uVar22 = (ulonglong)(uVar21 + 1); + } while (uVar21 + 1 < 0xf); } - if (pwVar15 != (wchar_t *)0x0) { - param_3 = pwVar15; + else { + param_3 = (wchar_t *)0x35ec; + uVar8 = WfpReportAppErrorAsWinError(pcVar13,"IkeLookupVendorId",0x35ec,param_4,1); + pwVar18 = pwStack_310; + } + if (pwVar18 != (wchar_t *)0x0) { + param_3 = pwVar18; if (gWfpTrackHeapBytes != 0) { - SVar10 = HeapSize(gWfpHeap,0,pwVar15); + SVar10 = HeapSize(gWfpHeap,0,pwVar18); LOCK(); gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar10; UNLOCK(); - param_3 = pwStack_228; + param_3 = pwStack_310; } HeapFree(gWfpHeap,0,param_3); } - if ((lVar7 != 0) && (*(longlong *)(param_6 + 2) != 0)) { + if ((uVar8 != 0) && (*(longlong *)(param_6 + 2) != 0)) { WfpMemFree((undefined8 *)(param_6 + 2)); } - TraceLogHelper("IkeLookupVendorId",0,param_3,uVar11); - IkeReturnError(lVar7,"IkeLookupVendorId",param_3,uVar11); + TraceLogHelper("IkeLookupVendorId",0,param_3,param_4); + IkeReturnError(uVar8,"IkeLookupVendorId",param_3,param_4); return; } ``` ## IkeHandleErrorNotifyIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.26| |i_ratio|0.41| |m_ratio|0.91| |b_ratio|0.72| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeHandleErrorNotifyIkeV2|IkeHandleErrorNotifyIkeV2| |fullname|IkeHandleErrorNotifyIkeV2|IkeHandleErrorNotifyIkeV2| |refcount|2|2| |`length`|1293|1568| |`called`|
Expand for full list:
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeDetermineNotifyErrorInfoIkeV2
IkeDumpNotifyInfo
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeHandleDHRetryNotifyIkeV2
IkeHandlePeerReachedQMLimitIkeV2
IkeMMDhDoiToInternal
IkeReturnError
TraceLogHelperWPP_SF_iSd
WPP_SF_iSdq
WS2_32.DLL::ntohs
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeDetermineNotifyErrorInfoIkeV2
IkeDumpNotifyInfo
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeHandleDHRetryNotifyIkeV2
IkeHandlePeerReachedQMLimitIkeV2
IkeMMDhDoiToInternal
IkeReturnError
TraceLogHelperWPP_SF_iSD
WPP_SF_iSd
WPP_SF_iSdq
WS2_32.DLL::ntohs
WfpReportAppErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeHandleNotifyIkeV2|IkeHandleNotifyIkeV2| |paramcount|7|7| |`address`|1800c95b4|1800c9894| |`sig`|undefined __fastcall IkeHandleErrorNotifyIkeV2(PRTL_CRITICAL_SECTION_DEBUG param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, longlong * param_3, ulonglong param_4, _LIST_ENTRY * param_5, uint param_6, undefined4 * param_7)|undefined __fastcall IkeHandleErrorNotifyIkeV2(PRTL_CRITICAL_SECTION_DEBUG param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, _LIST_ENTRY * param_3, ulonglong param_4, _LIST_ENTRY * param_5, uint param_6, undefined4 * param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeHandleErrorNotifyIkeV2 Called Diff ```diff --- IkeHandleErrorNotifyIkeV2 called +++ IkeHandleErrorNotifyIkeV2 called @@ -11,0 +12 @@ +WPP_SF_iSD @@ -15 +16 @@ -WfpReportSysErrorAsWinError +WfpReportAppErrorAsWinError ``` ### IkeHandleErrorNotifyIkeV2 Diff ```diff --- IkeHandleErrorNotifyIkeV2 +++ IkeHandleErrorNotifyIkeV2 @@ -1,180 +1,222 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeHandleErrorNotifyIkeV2 (PRTL_CRITICAL_SECTION_DEBUG param_1,PRTL_CRITICAL_SECTION_DEBUG param_2, - longlong *param_3,ulonglong param_4,_LIST_ENTRY *param_5,uint param_6, + _LIST_ENTRY *param_3,ulonglong param_4,_LIST_ENTRY *param_5,uint param_6, undefined4 *param_7) { char cVar1; u_short uVar2; wchar_t *pwVar3; ulonglong uVar4; longlong lVar5; - _LIST_ENTRY *p_Var6; - undefined8 *puVar7; - byte bVar8; - longlong *plVar9; - char *pcVar10; - uint uVar11; - undefined1 auStackY_138 [32]; - uint local_f8; - undefined1 local_f4 [12]; - PRTL_CRITICAL_SECTION_DEBUG local_e8; - int local_e0 [2]; - _LIST_ENTRY local_d8; - PRTL_CRITICAL_SECTION_DEBUG local_c8 [2]; + undefined8 *puVar6; + byte bVar7; + _LIST_ENTRY *p_Var8; + char *pcVar9; + uint uVar10; + undefined1 auStackY_128 [32]; + uint local_e8 [2]; + _LIST_ENTRY local_e0; + _LIST_ENTRY local_d0; + _LIST_ENTRY *local_c0; undefined8 local_b8 [4]; - PRTL_CRITICAL_SECTION_DEBUG *local_98; - undefined8 local_90; + _LIST_ENTRY **local_98; + undefined4 local_90; + undefined4 local_8c; longlong local_88 [2]; longlong local_78 [2]; uint *local_68; - undefined8 local_60; - PRTL_CRITICAL_SECTION_DEBUG *local_58; - undefined8 local_50; + undefined4 local_60; + undefined4 local_5c; + _LIST_ENTRY **local_58; + undefined4 local_50; + undefined4 local_4c; ulonglong local_48; - local_48 = __security_cookie ^ (ulonglong)auStackY_138; - local_f8 = param_6; - puVar7 = (undefined8 *)(param_4 & 0xffff); - local_d8.Blink = param_5; - local_d8.Flink = (_LIST_ENTRY *)0x0; - local_f4._0_4_ = 0; - local_e0[0] = 1; - plVar9 = param_3; + local_48 = __security_cookie ^ (ulonglong)auStackY_128; + local_d0.Flink = (_LIST_ENTRY *)0x0; + local_e0.Flink._0_4_ = 0; + puVar6 = (undefined8 *)(param_4 & 0xffff); + local_c0 = param_5; + local_e0.Flink._4_4_ = 1; + p_Var8 = param_3; uVar4 = param_4; + local_d0.Blink = param_3; TraceLogHelper("IkeHandleErrorNotifyIkeV2",1,param_3,param_4); - uVar11 = (uint)puVar7; + uVar10 = (uint)puVar6; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); uVar4 = IkeGetTlsMmLuid(); - plVar9 = (longlong *)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSdq(WPP_GLOBAL_Control[2],0x27,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,uVar4, + p_Var8 = (_LIST_ENTRY *)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSdq(WPP_GLOBAL_Control[2],0x27,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,uVar4, pwVar3); - } - if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180164278,0), cVar1 != '\0')) { - local_c8[0] = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_98 = local_c8; + param_3 = local_d0.Blink; + } + if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180165278,0), cVar1 != '\0')) { + local_d0.Blink = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + local_8c = 0; + local_98 = &local_d0.Blink; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Notify payload contains error notification"); - local_68 = (uint *)(local_f4 + 4); - local_58 = &local_e8; + local_5c = 0; + local_68 = local_e8; + local_4c = 0; + local_58 = &local_e0.Blink; local_60 = 4; local_50 = 8; - local_f4._4_4_ = uVar11; - local_e8 = param_1; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,&DAT_1,plVar9,uVar4,7,local_b8); + local_e8[0] = uVar10; + local_e0.Blink = (_LIST_ENTRY *)param_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_1,p_Var8,uVar4,7,local_b8); } if (param_7 != (undefined4 *)0x0) { *param_7 = 0; } - p_Var6 = &local_d8; - pcVar10 = (char *)(ulonglong)local_f8; - bVar8 = *(byte *)(*param_3 + 0x13) & 0x20; + p_Var8 = &local_d0; + pcVar9 = (char *)(ulonglong)param_6; + bVar7 = *(byte *)((longlong)¶m_3->Flink[1].Flink + 3) & 0x20; lVar5 = IkeDetermineNotifyErrorInfoIkeV2 - (puVar7,(u_long *)param_5,pcVar10,(longlong *)p_Var6,(undefined4 *)local_f4, - local_e0); - if (lVar5 == 0) { - if (local_f4._0_4_ == 0) { - p_Var6 = (_LIST_ENTRY *)0x1; - pcVar10 = (char *)0x3610; - lVar5 = WfpReportSysErrorAsWinError(puVar7,"IkeHandleErrorNotifyIkeV2",0x3610,1); - } - else { - pcVar10 = "ProcessNotifyData"; - IkeDumpNotifyInfo((longlong)param_1,(longlong)param_2,"ProcessNotifyData",p_Var6); - if ((bVar8 == 0) && (local_e0[0] == 0)) { + (puVar6,(u_long *)param_5,pcVar9,(longlong *)p_Var8,(undefined4 *)&local_e0, + (undefined4 *)((longlong)&local_e0.Flink + 4)); + if (lVar5 != 0) goto LAB_2; + if ((int)local_e0.Flink == 0) { + pcVar9 = (char *)0x3610; +LAB_3: + lVar5 = WfpReportAppErrorAsWinError + (puVar6,"IkeHandleErrorNotifyIkeV2",(ulonglong)pcVar9,p_Var8,1); + } + else { + pcVar9 = "ProcessNotifyData"; + IkeDumpNotifyInfo((longlong)param_1,(longlong)param_2,"ProcessNotifyData",p_Var8); + if ((bVar7 == 0) && (local_e0.Flink._4_4_ == 0)) { + if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)))) { + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var8 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + pcVar9 = &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSd(WPP_GLOBAL_Control[2],0x28,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var8,pwVar3); + } + if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180165278,0), cVar1 != '\0')) { + local_e0.Blink = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + local_8c = 0; + local_98 = &local_e0.Blink; + local_90 = 8; + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar3); + _tlgCreate1Sz_char(local_78, + "Ignoring unrecognized IkeV2 error recvd in message NotifyMessage"); + local_5c = 0; + local_68 = local_e8; + local_60 = 4; + local_e8[0] = uVar10; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_4,pcVar9,p_Var8,6,local_b8) + ; + } + goto LAB_2; + } + if (uVar10 == 0x23) { + if (bVar7 != 0) { + p_Var8 = &local_e0; + pcVar9 = (char *)local_d0.Flink; + IkeHandlePeerReachedQMLimitIkeV2 + (param_1,param_2,(longlong *)local_d0.Flink,(undefined4 *)p_Var8); + } + } + else if (uVar10 == 0x11) { + local_e8[0] = 0; + if (param_6 < 2) { + puVar6 = &WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - p_Var6 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); - pcVar10 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSd(WPP_GLOBAL_Control[2],0x28,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids, - p_Var6,pwVar3); + p_Var8 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + pcVar9 = &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + puVar6 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iSD(puVar6,(short)param_4 + 0x18,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var8,pwVar3); } - if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180164278,0), cVar1 != '\0')) { - local_e8 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_98 = &local_e8; - local_90 = 8; - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_88,pwVar3); - _tlgCreate1Sz_char(local_78, - "Ignoring unrecognized IkeV2 error recvd in message NotifyMessage"); - local_68 = &local_f8; - local_60 = 4; - local_f8 = uVar11; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_2,pcVar10,p_Var6,6,local_b8); - } - } - else { - if (uVar11 == 0x23) { - if (bVar8 != 0) { - p_Var6 = (_LIST_ENTRY *)local_f4; - pcVar10 = (char *)local_d8.Flink; - IkeHandlePeerReachedQMLimitIkeV2 - (param_1,param_2,(longlong *)local_d8.Flink,(undefined4 *)p_Var6); - } - } - else if (uVar11 == 0x11) { - local_f4._4_4_ = 0; - uVar2 = ntohs(*(u_short *)&(local_d8.Blink)->Flink); - lVar5 = IkeMMDhDoiToInternal(uVar2,(ushort *)(local_f4 + 4),pcVar10,p_Var6); - if (lVar5 != 0) goto LAB_3; - pcVar10 = (char *)(ulonglong)(uint)local_f4._4_4_; - IkeHandleDHRetryNotifyIkeV2((longlong)param_1,(longlong)param_2,pcVar10,(longlong)p_Var6); - } - else if ((ushort)((short)param_4 + 0xe000U) < 0x2000) { - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); - p_Var6 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); - pcVar10 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSd(WPP_GLOBAL_Control[2],0x29,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids, - p_Var6,pwVar3); - } - if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180164278,0), cVar1 != '\0')) { - local_e8 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_98 = &local_e8; + if (4 < DAT_0) { + puVar6 = (undefined8 *)&DAT_0; + cVar1 = _tlgKeywordOn(0x180165278,0); + if (cVar1 != '\0') { + local_e0.Blink = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + local_8c = 0; + local_98 = &local_e0.Blink; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); - _tlgCreate1Sz_char(local_78,"Received a pvt error notification"); - local_68 = &local_f8; + _tlgCreate1Sz_char(local_78,"Received an invlaid notifyLen"); + local_5c = 0; + local_68 = local_e8; + local_e8[0] = param_6; + puVar6 = (undefined8 *)&DAT_0; local_60 = 4; - local_f8 = uVar11; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_4,pcVar10,p_Var6,6,local_b8); + (0x180165278,&DAT_5,pcVar9,p_Var8,6,local_b8); } } - if (local_f4._0_4_ != 0) { - if (param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0) { - pcVar10 = (char *)0x8; - IkeCleanupMMNegotiation(param_1,local_d8.Flink,8,p_Var6); - } - else { - p_Var6 = (_LIST_ENTRY *)0x1; - pcVar10 = (char *)local_d8.Flink; - IkeCleanupQMNegotiation(param_1,param_2,(longlong *)local_d8.Flink,1); - if (param_7 != (undefined4 *)0x0) { - *param_7 = 1; - } - } + pcVar9 = (char *)0x3613; + goto LAB_3; + } + uVar2 = ntohs(*(u_short *)&local_c0->Flink); + lVar5 = IkeMMDhDoiToInternal(uVar2,(ushort *)local_e8,pcVar9,p_Var8); + if (lVar5 != 0) goto LAB_2; + pcVar9 = (char *)(ulonglong)local_e8[0]; + IkeHandleDHRetryNotifyIkeV2((longlong)param_1,(longlong)param_2,pcVar9,(longlong)p_Var8); + } + else if ((ushort)((short)param_4 + 0xe000U) < 0x2000) { + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var8 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + pcVar9 = &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSd(WPP_GLOBAL_Control[2],0x2a,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var8,pwVar3); + } + if ((4 < DAT_0) && (cVar1 = _tlgKeywordOn(0x180165278,0), cVar1 != '\0')) { + local_c0 = (_LIST_ENTRY *)IkeGetTlsMmLuid(); + local_8c = 0; + local_98 = &local_c0; + local_90 = 8; + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar3); + _tlgCreate1Sz_char(local_78,"Received a pvt error notification"); + local_5c = 0; + local_68 = local_e8; + local_60 = 4; + local_e8[0] = uVar10; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_6,pcVar9,p_Var8,6,local_b8) + ; + } + } + if ((int)local_e0.Flink != 0) { + if (param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0) { + pcVar9 = (char *)0x8; + IkeCleanupMMNegotiation(param_1,local_d0.Flink,8,p_Var8); + } + else { + p_Var8 = (_LIST_ENTRY *)0x1; + pcVar9 = (char *)local_d0.Flink; + IkeCleanupQMNegotiation(param_1,param_2,(longlong *)local_d0.Flink,1); + if (param_7 != (undefined4 *)0x0) { + *param_7 = 1; } } } } -LAB_3: - TraceLogHelper("IkeHandleErrorNotifyIkeV2",0,pcVar10,p_Var6); - IkeReturnError(lVar5,"IkeHandleErrorNotifyIkeV2",pcVar10,p_Var6); +LAB_2: + TraceLogHelper("IkeHandleErrorNotifyIkeV2",0,pcVar9,p_Var8); + IkeReturnError(lVar5,"IkeHandleErrorNotifyIkeV2",pcVar9,p_Var8); return; } ``` ## IkeFindMMPolicy ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.67| |i_ratio|0.6| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeFindMMPolicy|IkeFindMMPolicy| |fullname|IkeFindMMPolicy|IkeFindMMPolicy| |refcount|6|6| |`length`|1255|1273| |called|
Expand for full list:
FWPUCLNT.DLL::FwpmFreeMemory0
FWPUCLNT.DLL::FwpmProviderContextGetByKey3
IkeCopyBlob
IkeFindCorrectMMFilterFromArray
IkeFreeUMPolicy
IkeFwpmProviderContextToMMPolicy
IkeGetKeyModString
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeInitializeAuthInfo
IkeMatchFwpmFilterIkeReturnError
LogProviderContext
TraceLogHelper
WPP_SF_iSD
WPP_SF_iSs
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
FWPUCLNT.DLL::FwpmFreeMemory0
FWPUCLNT.DLL::FwpmProviderContextGetByKey3
IkeCopyBlob
IkeFindCorrectMMFilterFromArray
IkeFreeUMPolicy
IkeFwpmProviderContextToMMPolicy
IkeGetKeyModString
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeInitializeAuthInfo
IkeMatchFwpmFilterIkeReturnError
LogProviderContext
TraceLogHelper
WPP_SF_iSD
WPP_SF_iSs
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeBeginMMResponder
IkeCopyOldMMToNewMMIkeV2
IkeIsKeyModEnabledForTraffic
IkeProcessPacketDispatch
IkeStartMMNegotiation|IkeBeginMMResponder
IkeCopyOldMMToNewMMIkeV2
IkeIsKeyModEnabledForTraffic
IkeProcessPacketDispatch
IkeStartMMNegotiation| |paramcount|5|5| |`address`|180026380|180026610| |`sig`|undefined8 * __fastcall IkeFindMMPolicy(byte * param_1, int * param_2, undefined * param_3, undefined8 param_4, undefined8 * param_5)|undefined8 * __fastcall IkeFindMMPolicy(byte * param_1, int * param_2, undefined * param_3, ulonglong param_4, undefined8 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeFindMMPolicy Diff ```diff --- IkeFindMMPolicy +++ IkeFindMMPolicy @@ -1,200 +1,206 @@ -/* WARNING: Control flow encountered bad instruction data */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ undefined8 * -IkeFindMMPolicy(byte *param_1,int *param_2,undefined *param_3,undefined8 param_4,undefined8 *param_5 - ) +IkeFindMMPolicy(byte *param_1,int *param_2,undefined *param_3,ulonglong param_4,undefined8 *param_5) { code *pcVar1; char cVar2; uint uVar3; char *pcVar4; wchar_t *pwVar5; undefined8 uVar6; undefined8 *puVar7; longlong lVar8; - longlong lVar9; - longlong *plVar10; - undefined *puVar11; + char cVar9; + longlong lVar10; + longlong *plVar11; longlong **pplVar12; - longlong *plVar13; - ulonglong uVar14; + undefined *puVar13; + longlong **pplVar14; longlong *plVar15; - int iVar16; - undefined1 auStackY_148 [32]; + ulonglong uVar16; + longlong *plVar17; + int iVar18; + undefined8 auStackY_148 [4]; longlong local_f8; uint local_f0 [2]; - undefined8 local_e8; + ulonglong local_e8; longlong local_e0; longlong *local_d8; longlong *local_d0; longlong *local_c8 [2]; undefined8 local_b8 [4]; - undefined8 *local_98; + ulonglong *local_98; undefined8 local_90; longlong local_88 [2]; longlong **local_78; undefined8 local_70; longlong local_68 [2]; ulonglong local_58; local_58 = __security_cookie ^ (ulonglong)auStackY_148; - plVar10 = (longlong *)0x0; - uVar3 = (uint)param_4; - local_e8 = CONCAT44(local_e8._4_4_,uVar3); + plVar11 = (longlong *)0x0; + local_e8 = CONCAT44(local_e8._4_4_,(int)param_4); local_f8 = 0; local_d0 = (longlong *)0x0; local_d8 = (longlong *)0x0; + pplVar12 = (longlong **)(param_4 & 0xffffffff); local_e0 = 0; local_f0[0] = 0; - puVar11 = param_3; + puVar13 = param_3; TraceLogHelper("IkeFindMMPolicy",1,param_3,param_4); *param_5 = 0; - iVar16 = (int)param_3; - if (iVar16 == 0) { + iVar18 = (int)param_3; + if (iVar18 == 0) { if ((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19)) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pcVar4 = IkeGetKeyModString(*param_2); pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); uVar6 = IkeGetTlsMmLuid(); - puVar11 = &WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids; + puVar13 = &WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids; WPP_SF_iSs(WPP_GLOBAL_Control[2],0x21,&WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids,uVar6 ,pwVar5,pcVar4); - uVar3 = (uint)local_e8; + pplVar12 = (longlong **)(local_e8 & 0xffffffff); } if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); uVar6 = IkeGetTlsMmLuid(); - puVar11 = &WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids; + puVar13 = &WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids; WPP_SF_iSD(WPP_GLOBAL_Control[2],0x22,&WPP_eaccc614382a3c2e8d059b9674a52374_Traceguids,uVar6 ,pwVar5); } } - uVar14 = (ulonglong)DAT_0; + uVar16 = (ulonglong)DAT_0; if (4 < DAT_0) { - cVar2 = _tlgKeywordOn(0x180164278,0); + cVar2 = _tlgKeywordOn(0x180165278,0); if (cVar2 != '\0') { local_e8 = IkeGetTlsMmLuid(); local_98 = &local_e8; local_90 = 8; pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar5); _tlgCreate1Sz_char((longlong *)&local_78,"Looking up MM policy for keymodtype"); pcVar4 = IkeGetKeyModString(*param_2); _tlgCreate1Sz_char(local_68,pcVar4); _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_1,puVar11,uVar14,6,local_b8); - uVar14 = (ulonglong)DAT_0; - } - if ((4 < (uint)uVar14) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { + (0x180165278,&DAT_1,puVar13,uVar16,6,local_b8); + uVar16 = (ulonglong)DAT_0; + } + if ((4 < (uint)uVar16) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { local_e8 = IkeGetTlsMmLuid(); local_98 = &local_e8; local_90 = 8; pwVar5 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar5); local_c8[0] = (longlong *)(ulonglong)*(uint *)(param_1 + 0x80); local_78 = local_c8; local_70 = 8; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_2,puVar11,uVar14,5,local_b8); + (0x180165278,&DAT_2,puVar13,uVar16,5,local_b8); } } } switch(*param_1) { case 1: case 4: case 7: - plVar15 = &FWPM_LAYER_IKEEXT_V4; + plVar17 = &FWPM_LAYER_IKEEXT_V4; break; default: + cVar9 = '\0'; + cVar2 = '%'; pcVar1 = (code *)swi(0x29); - (*pcVar1)(0x25); - /* WARNING: Bad instruction - Truncating control flow here */ - halt_baddata(); + (*pcVar1)(); + auStackY_148[0] = 2; + cRamffffffff97000268 = cRamffffffff97000268 + cVar2; + *(char *)(pplVar12 + -0x67fffb3) = *(char *)(pplVar12 + -0x67fffb3) + cVar9; + pcVar1 = (code *)swi(3); + puVar7 = (undefined8 *)(*pcVar1)(); + return puVar7; case 5: case 6: case 8: - plVar15 = (longlong *)&FWPM_LAYER_IKEEXT_V6; - } - pplVar12 = (longlong **)0x0; - puVar7 = IkeMatchFwpmFilter(param_2,param_1,0,plVar15,0,2,iVar16,(longlong *)&local_d8,local_f0); + plVar17 = (longlong *)&FWPM_LAYER_IKEEXT_V6; + } + pplVar14 = (longlong **)0x0; + puVar7 = IkeMatchFwpmFilter(param_2,param_1,0,plVar17,0,2,iVar18,(longlong *)&local_d8,local_f0); if (puVar7 == (undefined8 *)0x0) { - plVar15 = (longlong *)((ulonglong)param_3 & 0xffffffff); - pplVar12 = (longlong **)(ulonglong)uVar3; + plVar17 = (longlong *)((ulonglong)param_3 & 0xffffffff); puVar7 = (undefined8 *) IkeFindCorrectMMFilterFromArray - (local_d8,local_f0[0],(undefined *)pplVar12,plVar15,(longlong)param_1, + (local_d8,local_f0[0],(undefined *)pplVar12,plVar17,(longlong)param_1, &local_e0); + pplVar14 = pplVar12; if (puVar7 == (undefined8 *)0x0) { - plVar13 = &local_f8; - lVar9 = local_e0 + 0x98; + plVar15 = &local_f8; + lVar10 = local_e0 + 0x98; lVar8 = *(longlong *)(gIkeExtGlobals + 0xab0); uVar3 = FwpmProviderContextGetByKey3(); if (uVar3 == 0) { - if (iVar16 == 0) { + if (iVar18 == 0) { lVar8 = local_f8; - LogProviderContext(local_f8,lVar9,(undefined *)plVar13); + LogProviderContext(local_f8,lVar10,(undefined *)plVar15); } - pplVar12 = &local_d0; - puVar7 = (undefined8 *)IkeFwpmProviderContextToMMPolicy(lVar8,local_f8,pplVar12,plVar15); - plVar10 = local_d0; + pplVar14 = &local_d0; + puVar7 = (undefined8 *)IkeFwpmProviderContextToMMPolicy(lVar8,local_f8,pplVar14,plVar17); + plVar11 = local_d0; if (puVar7 == (undefined8 *)0x0) { - if (((*(byte *)(*(longlong *)(local_f8 + 0x48) + 0x20) & 0x20) != 0) && (iVar16 == 0)) { + if (((*(byte *)(*(longlong *)(local_f8 + 0x48) + 0x20) & 0x20) != 0) && (iVar18 == 0)) { *(uint *)(*(longlong *)(param_2 + 8) + 8) = *(uint *)(*(longlong *)(param_2 + 8) + 8) | 1; } local_f8 = 0; local_d0[2] = *(longlong *)(local_e0 + 0xb0); if (((((*(longlong *)(local_e0 + 0x50) != 0x4964588437a57701) || (*(longlong *)(local_e0 + 0x58) != -0x524f77b98fc1476e)) || (*(longlong *)(param_1 + 0x90) == 0)) || (puVar7 = (undefined8 *) - IkeCopyBlob((uint *)(param_1 + 0x88),(uint *)(local_d0 + 10),pplVar12), + IkeCopyBlob((uint *)(param_1 + 0x88),(uint *)(local_d0 + 10),pplVar14), puVar7 == (undefined8 *)0x0)) && ((*param_2 != 1 || (puVar7 = (undefined8 *) - IkeInitializeAuthInfo(*(uint *)(*plVar10 + 4),plVar10 + 3,pplVar12,plVar15), + IkeInitializeAuthInfo(*(uint *)(*plVar11 + 4),plVar11 + 3,pplVar14,plVar17), puVar7 == (undefined8 *)0x0)))) { - *param_5 = plVar10; + *param_5 = plVar11; } } } else { - plVar15 = (longlong *)0x1; - pplVar12 = (longlong **)(ulonglong)uVar3; + plVar17 = (longlong *)0x1; + pplVar14 = (longlong **)(ulonglong)uVar3; puVar7 = (undefined8 *) WfpReportSysErrorAsWinError - (lVar8,"FwpmProviderContextGetByKey3",(ulonglong)pplVar12,1); + (lVar8,"FwpmProviderContextGetByKey3",(ulonglong)pplVar14,1); } } } if (local_d8 != (longlong *)0x0) { FwpmFreeMemory0(&local_d8); } if (puVar7 != (undefined8 *)0x0) { if (local_f8 != 0) { FwpmFreeMemory0(&local_f8); } - local_c8[0] = plVar10; - if (plVar10 != (longlong *)0x0) { - if (plVar10[0xb] != 0) { - WfpMemFree(plVar10 + 0xb); - } - FwpmFreeMemory0(plVar10 + 8); - IkeFreeUMPolicy((longlong *)plVar10[1]); - WfpMemFree(plVar10 + 3); + local_c8[0] = plVar11; + if (plVar11 != (longlong *)0x0) { + if (plVar11[0xb] != 0) { + WfpMemFree(plVar11 + 0xb); + } + FwpmFreeMemory0(plVar11 + 8); + IkeFreeUMPolicy((longlong *)plVar11[1]); + WfpMemFree(plVar11 + 3); WfpMemFree(local_c8); } } - TraceLogHelper("IkeFindMMPolicy",0,pplVar12,plVar15); - if (iVar16 == 0) { - puVar7 = (undefined8 *)IkeReturnError((longlong)puVar7,"IkeFindMMPolicy",pplVar12,plVar15); + TraceLogHelper("IkeFindMMPolicy",0,pplVar14,plVar17); + if (iVar18 == 0) { + puVar7 = (undefined8 *)IkeReturnError((longlong)puVar7,"IkeFindMMPolicy",pplVar14,plVar17); } return puVar7; } ``` ## IkeQueueRecvRequest ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.86| |i_ratio|0.74| |m_ratio|0.96| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeQueueRecvRequest|IkeQueueRecvRequest| |fullname|IkeQueueRecvRequest|IkeQueueRecvRequest| |refcount|2|2| |`length`|525|580| |`called`|
Expand for full list:
IkeAddrGetPort
IkeLookupICookieInHiPriGlobalList
IkeQueueWorkItem
IkeQueueWorkItemHiPri
IkeReturnError
NtohHeader
TraceLogHelper
WS2_32.DLL::htons
WfpMemAlloc
WfpMemFree
__security_check_cookiememcpy
|
Expand for full list:
IkeAddrGetPort
IkeLookupICookieInHiPriGlobalList
IkeQueueWorkItem
IkeQueueWorkItemHiPri
IkeReturnError
NtohHeader
TraceLogHelper
WS2_32.DLL::htons
WfpMemAlloc
WfpMemFree
WfpReportAppErrorAsWinError__security_check_cookie
memcpy
| |calling|IkeReinjectReassembledPacket|IkeReinjectReassembledPacket| |paramcount|4|4| |`address`|18003e3d8|18003e698| |sig|undefined __fastcall IkeQueueRecvRequest(undefined8 * param_1, int param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall IkeQueueRecvRequest(undefined8 * param_1, int param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeQueueRecvRequest Called Diff ```diff --- IkeQueueRecvRequest called +++ IkeQueueRecvRequest called @@ -10,0 +11 @@ +WfpReportAppErrorAsWinError ``` ### IkeQueueRecvRequest Diff ```diff --- IkeQueueRecvRequest +++ IkeQueueRecvRequest @@ -1,120 +1,131 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeQueueRecvRequest(undefined8 *param_1,int param_2,undefined8 param_3,undefined8 param_4) { undefined8 **ppuVar1; longlong *plVar2; undefined8 uVar3; undefined8 *puVar4; u_short uVar5; int iVar6; longlong lVar7; + longlong *plVar8; void *_Src; undefined8 **_Size; - undefined1 auStack_88 [32]; + undefined1 auStackY_98 [32]; u_short local_68 [4]; undefined8 *local_60; longlong local_58; longlong lStack_50; longlong local_48; - undefined4 local_40; + uint local_40; ulonglong local_38; - local_38 = __security_cookie ^ (ulonglong)auStack_88; + local_38 = __security_cookie ^ (ulonglong)auStackY_98; local_68[0] = 0; local_60 = (undefined8 *)0x0; TraceLogHelper("IkeQueueRecvRequest",1,param_3,param_4); _Size = &local_60; lVar7 = WfpMemAlloc(0xf0,8,_Size); puVar4 = local_60; if (lVar7 == 0) { uVar3 = param_1[1]; *local_60 = *param_1; local_60[1] = uVar3; uVar3 = param_1[3]; ppuVar1 = (undefined8 **)(local_60 + 2); local_60[2] = param_1[2]; local_60[3] = uVar3; uVar3 = param_1[5]; local_60[4] = param_1[4]; local_60[5] = uVar3; uVar3 = param_1[7]; local_60[6] = param_1[6]; local_60[7] = uVar3; uVar3 = param_1[9]; local_60[8] = param_1[8]; local_60[9] = uVar3; uVar3 = param_1[0xb]; local_60[10] = param_1[10]; local_60[0xb] = uVar3; uVar3 = param_1[0xd]; local_60[0xc] = param_1[0xc]; local_60[0xd] = uVar3; uVar3 = param_1[0xf]; local_60[0xe] = param_1[0xe]; local_60[0xf] = uVar3; uVar3 = param_1[0x11]; local_60[0x10] = param_1[0x10]; local_60[0x11] = uVar3; uVar3 = param_1[0x13]; local_60[0x12] = param_1[0x12]; local_60[0x13] = uVar3; uVar3 = param_1[0x15]; local_60[0x14] = param_1[0x14]; local_60[0x15] = uVar3; uVar3 = param_1[0x17]; local_60[0x16] = param_1[0x16]; local_60[0x17] = uVar3; uVar3 = param_1[0x19]; local_60[0x18] = param_1[0x18]; local_60[0x19] = uVar3; uVar3 = param_1[0x1b]; local_60[0x1a] = param_1[0x1a]; local_60[0x1b] = uVar3; uVar3 = param_1[0x1d]; local_60[0x1c] = param_1[0x1c]; local_60[0x1d] = uVar3; _Size = ppuVar1; lVar7 = WfpMemAlloc((ulonglong)*(uint *)(param_1 + 3),0,ppuVar1); if (lVar7 == 0) { IkeAddrGetPort((longlong)(param_1 + 7),local_68); uVar5 = htons(500); if ((local_68[0] == uVar5) || (param_2 != 0)) { _Size = (undefined8 **)(ulonglong)*(uint *)(param_1 + 3); _Src = (void *)param_1[2]; memcpy(*ppuVar1,_Src,(size_t)_Size); } else { _Size = (undefined8 **)(ulonglong)(*(int *)(param_1 + 3) - 4); _Src = (void *)(param_1[2] + 4); memcpy(*ppuVar1,_Src,(size_t)_Size); *(int *)(puVar4 + 3) = *(int *)(puVar4 + 3) + -4; } plVar2 = *ppuVar1; + plVar8 = &local_58; local_58 = *plVar2; lStack_50 = plVar2[1]; local_48 = plVar2[2]; - local_40 = (undefined4)plVar2[3]; - NtohHeader((longlong)&local_58); - *(undefined4 *)(puVar4 + 3) = local_40; - puVar4[4] = puVar4; - iVar6 = IkeLookupICookieInHiPriGlobalList(&local_58,_Src,_Size,param_4); - if (iVar6 == 0) { - lVar7 = IkeQueueWorkItem(IkeHandleRecvRequest,puVar4,_Size,param_4); + local_40 = *(uint *)(plVar2 + 3); + NtohHeader((longlong)plVar8); + if (*(uint *)(param_1 + 3) < local_40) { + LOCK(); + *(int *)(gIkeExtGlobals + 0x7a0) = *(int *)(gIkeExtGlobals + 0x7a0) + 1; + UNLOCK(); + _Size = (undefined8 **)0x3600; + lVar7 = WfpReportAppErrorAsWinError(plVar8,"IkeQueueRecvRequest",0x3600,param_4,1); } else { - lVar7 = IkeQueueWorkItemHiPri(IkeHandleRecvRequest,puVar4,_Size,param_4); + *(uint *)(puVar4 + 3) = local_40; + puVar4[4] = puVar4; + iVar6 = IkeLookupICookieInHiPriGlobalList(&local_58,_Src,_Size,param_4); + if (iVar6 == 0) { + lVar7 = IkeQueueWorkItem(IkeHandleRecvRequest,puVar4,_Size,param_4); + } + else { + lVar7 = IkeQueueWorkItemHiPri(IkeHandleRecvRequest,puVar4,_Size,param_4); + } } if (lVar7 == 0) goto LAB_0; WfpMemFree(ppuVar1); } } WfpMemFree(&local_60); LAB_0: TraceLogHelper("IkeQueueRecvRequest",0,_Size,param_4); IkeReturnError(lVar7,"IkeQueueRecvRequest",_Size,param_4); return; } ``` ## IkeProcessPacketDispatch ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.31| |i_ratio|0.6| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeProcessPacketDispatch|IkeProcessPacketDispatch| |fullname|IkeProcessPacketDispatch|IkeProcessPacketDispatch| |refcount|6|6| |`length`|10884|10642| |called|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::TlsSetValue
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::TryEnterCriticalSection
FreeDeleteEntry
IkeAddrDump
IkeAddrGetAddrBytes
IkeAddrGetAddrBytesHigh
IkeAddrGetAddrStringIkeAddrGetIPVersion
IkeAddrGetPort
IkeCleanupMMNegotiation
IkeClearDosModeFlag
IkeDerefMMSA
IkeDestroyPacketContext
IkeDumpHeader
IkeEnableDosModeFlag
IkeFindMMPolicy
IkeFinishMMSAProcessing
IkeFreeMMSA
IkeFullMMMatch
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeGuessSubExchTypeIkeV2Responder
IkeInitMMResponderPhase1
IkeInsertFilterToSAEntry
IkeIsEstablishedIdAnonymous
IkeLookupMMSAByMyCookieIkeV2
IkePerformAddrLookupEstablished
IkePerformPeerSidThrottling
IkePerformPostponedMMWork
IkeProcessPacket
IkeRemoveMMSAFromCookieHashIkeV2
IkeReturnError
IkeSetTlsData
IkeValidateAuthArrayResponderIkeV2
MSVCRT.DLL::sprintf_s
McTemplateU0_EtwEventWriteTransfer
McTemplateU0sssqsuqzqqzqqxq_EtwEventWriteTransfer
NTDLL.DLL::EtwEventActivityIdControl
NTDLL.DLL::EtwEventEnabled
NTDLL.DLL::RtlContractHashTable
NTDLL.DLL::RtlExpandHashTable
NTDLL.DLL::RtlGetNextEntryHashTable
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
NTDLL.DLL::RtlLookupEntryHashTable
NTDLL.DLL::RtlRemoveEntryHashTable
TraceLogHelper
TryRefSA
WPP_SF_iS
WPP_SF_iSD
WPP_SF_iSI
WPP_SF_iSq
WPP_SF_iSqd
WS2_32.DLL::htonl
WS2_32.DLL::ntohl
WS2_32.DLL::ntohs
WfpMemFree
WfpReportSysErrorAsWinError
WfpRestructureHashtable
WfpTraceActivityIdSet
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcmp
memset
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::TlsSetValue
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::TryEnterCriticalSection
FreeDeleteEntry
IkeAddrDump
IkeAddrGetAddrBytes
IkeAddrGetAddrBytesHigh
IkeAddrGetAddrStringIkeAddrGetIPVersion
IkeAddrGetPort
IkeCleanupMMNegotiation
IkeClearDosModeFlag
IkeDerefMMSA
IkeDestroyPacketContext
IkeDumpHeader
IkeEnableDosModeFlag
IkeFindMMPolicy
IkeFinishMMSAProcessing
IkeFreeMMSA
IkeFullMMMatch
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeGuessSubExchTypeIkeV2Responder
IkeInitMMResponderPhase1
IkeInsertFilterToSAEntry
IkeIsEstablishedIdAnonymous
IkeLookupMMSAByMyCookieIkeV2
IkePerformAddrLookupEstablished
IkePerformPeerSidThrottling
IkePerformPostponedMMWork
IkeProcessPacket
IkeRemoveMMSAFromCookieHashIkeV2
IkeReturnError
IkeSetTlsData
IkeValidateAuthArrayResponderIkeV2
MSVCRT.DLL::sprintf_s
McTemplateU0_EtwEventWriteTransfer
McTemplateU0sssqsuqzqqzqqxq_EtwEventWriteTransfer
NTDLL.DLL::EtwEventActivityIdControl
NTDLL.DLL::EtwEventEnabled
NTDLL.DLL::RtlContractHashTable
NTDLL.DLL::RtlExpandHashTable
NTDLL.DLL::RtlGetNextEntryHashTable
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
NTDLL.DLL::RtlLookupEntryHashTable
NTDLL.DLL::RtlRemoveEntryHashTable
TraceLogHelper
TryRefSA
WPP_SF_iS
WPP_SF_iSD
WPP_SF_iSI
WPP_SF_iSq
WPP_SF_iSqd
WS2_32.DLL::htonl
WS2_32.DLL::ntohl
WS2_32.DLL::ntohs
WfpMemFree
WfpReportSysErrorAsWinError
WfpRestructureHashtable
WfpTraceActivityIdSet
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcmp
memset
| |calling|IkeHandleRecvRequest|IkeHandleRecvRequest| |paramcount|4|4| |`address`|180026f80|180027210| |`sig`|undefined __fastcall IkeProcessPacketDispatch(IMAGE_DOS_HEADER * * param_1, undefined8 param_2, undefined8 param_3, PRTL_CRITICAL_SECTION_DEBUG param_4)|byte * __fastcall IkeProcessPacketDispatch(IMAGE_DOS_HEADER * * param_1, undefined8 param_2, undefined8 param_3, PRTL_CRITICAL_SECTION_DEBUG param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeProcessPacketDispatch Diff ```diff --- IkeProcessPacketDispatch +++ IkeProcessPacketDispatch @@ -1,2617 +1,2803 @@ +/* WARNING: Instruction at (ram,0x000180029bfd) overlaps instruction at (ram,0x000180029bfb) + */ /* WARNING: Control flow encountered bad instruction data */ -/* WARNING: Instruction at (ram,0x000180029a11) overlaps instruction at (ram,0x000180029a0f) - */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* WARNING: Removing unreachable block (ram,0x000180029983) */ -/* WARNING: Removing unreachable block (ram,0x000180029907) */ -/* WARNING: Removing unreachable block (ram,0x000180029903) */ -/* WARNING: Removing unreachable block (ram,0x00018002999f) */ -/* WARNING: Removing unreachable block (ram,0x0001800299eb) */ -/* WARNING: Removing unreachable block (ram,0x000180029987) */ -/* WARNING: Removing unreachable block (ram,0x00018002994f) */ -/* WARNING: Removing unreachable block (ram,0x000180029961) */ -/* WARNING: Removing unreachable block (ram,0x000180029963) */ -/* WARNING: Removing unreachable block (ram,0x00018002995f) */ -/* WARNING: Removing unreachable block (ram,0x000180029965) */ -/* WARNING: Removing unreachable block (ram,0x000180029969) */ -/* WARNING: Removing unreachable block (ram,0x00018002996b) */ -/* WARNING: Removing unreachable block (ram,0x000180029967) */ -/* WARNING: Removing unreachable block (ram,0x00018002996d) */ -/* WARNING: Removing unreachable block (ram,0x00018002996f) */ -/* WARNING: Removing unreachable block (ram,0x000180029971) */ -/* WARNING: Removing unreachable block (ram,0x00018002997b) */ -/* WARNING: Removing unreachable block (ram,0x00018002997d) */ -/* WARNING: Removing unreachable block (ram,0x00018002997f) */ -/* WARNING: Removing unreachable block (ram,0x000180029981) */ -/* WARNING: Removing unreachable block (ram,0x000180029989) */ -/* WARNING: Removing unreachable block (ram,0x00018002998b) */ -/* WARNING: Removing unreachable block (ram,0x0001800299e7) */ -/* WARNING: Removing unreachable block (ram,0x0001800299e3) */ -/* WARNING: Removing unreachable block (ram,0x0001800299a7) */ -/* WARNING: Removing unreachable block (ram,0x0001800299af) */ -/* WARNING: Removing unreachable block (ram,0x0001800299f7) */ +/* WARNING: Removing unreachable block (ram,0x000180029b97) */ +/* WARNING: Removing unreachable block (ram,0x000180029b95) */ +/* WARNING: Removing unreachable block (ram,0x000180029baf) */ +/* WARNING: Removing unreachable block (ram,0x000180029b9d) */ +/* WARNING: Removing unreachable block (ram,0x000180029b9f) */ +/* WARNING: Removing unreachable block (ram,0x000180029bb7) */ +/* WARNING: Type propagation algorithm not settling */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ -void IkeProcessPacketDispatch - (IMAGE_DOS_HEADER **param_1,undefined8 param_2,undefined8 param_3, - PRTL_CRITICAL_SECTION_DEBUG param_4) +byte * IkeProcessPacketDispatch + (IMAGE_DOS_HEADER **param_1,undefined8 param_2,undefined8 param_3, + PRTL_CRITICAL_SECTION_DEBUG param_4) { - char *pcVar1; + uint uVar1; + DWORD dwTlsIndex; + u_long hostlong; + DWORD dwTlsIndex_00; + DWORD dwTlsIndex_01; + DWORD dwTlsIndex_02; uint uVar2; uint uVar3; uint uVar4; uint uVar5; - uint uVar6; - char cVar7; - byte bVar8; - ushort uVar9; - DWORD dwTlsIndex; - u_long hostlong; - DWORD dwTlsIndex_00; - uint uVar10; - DWORD dwTlsIndex_01; - DWORD dwTlsIndex_02; - code *pcVar11; - undefined1 auVar12 [16]; - int3 iVar13; - undefined3 uVar14; - word wVar15; - char cVar16; - byte bVar17; + code *pcVar14; + undefined1 auVar15 [16]; + word wVar16; + char cVar17; + u_short uVar22; + u_long uVar24; + u_short uVar23; + int iVar25; + u_long uVar26; byte bVar18; - u_short uVar19; - byte bVar33; - byte bVar34; - u_long uVar21; - u_short uVar20; - int iVar22; - u_long uVar23; - BOOL BVar24; - uint uVar25; - wchar_t *pwVar26; - _LIST_ENTRY *p_Var27; - dword *pdVar28; - undefined8 uVar29; - SIZE_T SVar30; - int *piVar31; - undefined7 uVar35; - byte bVar36; - word *pwVar37; - IMAGE_DOS_HEADER *pIVar38; - char *pcVar39; - uint *puVar40; - undefined2 uVar41; - byte bVar47; + byte bVar19; + byte bVar20; + byte bVar21; + BOOL BVar27; + uint uVar28; + wchar_t *pwVar29; + _LIST_ENTRY *p_Var30; + dword *pdVar31; + undefined8 uVar32; + SIZE_T SVar33; + int *piVar34; + char *pcVar35; + undefined7 uVar38; + byte *pbVar36; + byte bVar39; + byte bVar45; + char cVar46; + uint uVar48; + word *pwVar40; + uint *puVar41; IMAGE_DOS_HEADER *pIVar42; - byte *pbVar43; - undefined *puVar44; - undefined8 uVar45; - IMAGE_DOS_HEADER *pIVar46; - uint uVar48; + char *pcVar43; + longlong lVar44; + undefined6 uVar47; + char cVar54; IMAGE_DOS_HEADER *pIVar49; - undefined8 *puVar50; - undefined1 *puVar51; - undefined8 *puVar52; - undefined1 *puVar53; - undefined1 *puVar54; - undefined1 *puVar55; - undefined1 *puVar56; - undefined1 *puVar57; - undefined8 *puVar58; + byte *pbVar50; + undefined *puVar51; + undefined8 uVar52; + IMAGE_DOS_HEADER *pIVar53; + undefined7 uVar55; + byte bVar56; + ushort uVar57; + byte bVar61; + uint uVar58; + IMAGE_DOS_HEADER *pIVar59; + undefined8 *puVar62; + undefined8 *puVar63; + undefined8 *puVar64; + undefined8 *puVar65; + undefined8 *puVar66; + undefined8 *puVar67; + undefined8 *puVar68; IMAGE_DOS_HEADER *unaff_RSI; - int iVar59; - uint uVar60; + int iVar69; + uint uVar70; IMAGE_DOS_HEADER *unaff_RDI; - IMAGE_DOS_HEADER *pIVar61; - undefined8 *puVar62; - longlong lVar63; - char *pcVar64; - IMAGE_DOS_HEADER *pIVar65; - size_t sVar66; - undefined8 *in_R10; - ulonglong uVar67; - IMAGE_DOS_HEADER *pIVar68; - IMAGE_DOS_HEADER ***pppIVar69; - bool bVar70; - bool bVar71; - bool bVar72; - byte in_stack_ffffffff9dfffae3; - undefined8 uStackY_8b0; - undefined1 auStackY_8a8 [8]; - undefined8 auStackY_8a0 [3]; + IMAGE_DOS_HEADER *pIVar71; + word *pwVar72; + undefined8 *puVar73; + IMAGE_DOS_HEADER *pIVar74; + size_t sVar75; + undefined4 uVar76; + ulonglong uVar77; + IMAGE_DOS_HEADER *pIVar78; + IMAGE_DOS_HEADER ***pppIVar79; + bool bVar80; + bool bVar81; + bool bVar82; + bool bVar83; + undefined8 auStackY_8b0 [2]; + undefined1 auStackY_8a0 [24]; IMAGE_DOS_HEADER *in_stack_fffffffffffff780; - undefined4 uVar73; - undefined4 uVar74; + undefined4 uVar84; undefined4 in_stack_fffffffffffff794; undefined4 in_stack_fffffffffffff79c; undefined4 in_stack_fffffffffffff7ac; undefined4 in_stack_fffffffffffff7b4; uint local_808; uint local_804; uint local_800; uint local_7fc; uint local_7f8; _LIST_ENTRY local_7f0; undefined2 local_7e0 [2]; ushort local_7dc [2]; uint local_7d8 [2]; longlong local_7d0; IMAGE_DOS_HEADER *local_7c8; IMAGE_DOS_HEADER *local_7c0; IMAGE_DOS_HEADER *local_7b8; longlong local_7b0; IMAGE_DOS_HEADER *local_7a8; uint local_7a0; undefined4 local_79c; uint local_798; undefined4 local_794; uint local_790; int local_78c; IMAGE_DOS_HEADER *local_788; IMAGE_DOS_HEADER *local_780; uint local_778; int local_774; longlong local_770; void *local_768; PRTL_CRITICAL_SECTION_DEBUG local_760; void *local_758; PRTL_CRITICAL_SECTION_DEBUG local_750; void *local_748; PRTL_CRITICAL_SECTION_DEBUG local_740; void *local_738; PRTL_CRITICAL_SECTION_DEBUG local_730; undefined8 local_728; - undefined8 local_720; + IMAGE_DOS_HEADER *local_720; undefined8 local_718; undefined8 local_710; undefined8 local_708; undefined8 local_700; IMAGE_DOS_HEADER *local_6f8; PRTL_CRITICAL_SECTION_DEBUG local_6f0; longlong local_6e8; undefined8 local_6e0; IMAGE_DOS_HEADER *local_6d8; undefined8 local_6d0; IMAGE_DOS_HEADER *local_6c8; undefined8 local_6c0; IMAGE_DOS_HEADER *local_6b8; undefined8 local_6b0; undefined8 uStack_6a8; undefined8 local_6a0; undefined1 local_690 [48]; undefined1 local_660 [112]; undefined1 local_5f0 [168]; undefined8 local_548; undefined1 local_540 [168]; undefined1 local_498 [72]; byte local_450 [8]; undefined4 *local_448; byte local_440 [8]; undefined8 local_438 [4]; undefined8 *local_418; undefined8 local_410; longlong local_408 [2]; IMAGE_DOS_HEADER **local_3f8; undefined8 local_3f0; int *local_3e8; undefined8 local_3e0; undefined1 local_3d8 [32]; undefined8 *local_3b8; undefined8 local_3b0; longlong local_3a8 [2]; longlong local_398 [2]; uint *local_388; undefined8 local_380; IMAGE_DOS_HEADER **local_378; undefined8 local_370; undefined1 local_368 [32]; undefined8 *local_348; undefined8 local_340; longlong local_338 [2]; longlong local_328 [2]; IMAGE_DOS_HEADER **local_318; undefined8 local_310; undefined1 local_308 [32]; undefined8 *local_2e8; undefined8 local_2e0; longlong local_2d8 [2]; longlong local_2c8 [2]; IMAGE_DOS_HEADER **local_2b8; undefined8 local_2b0; undefined1 local_2a8 [112]; undefined8 *local_238; byte local_230 [8]; longlong local_228 [2]; longlong local_218 [2]; undefined8 local_208 [4]; undefined8 *local_1e8; undefined8 local_1e0; longlong local_1d8 [2]; longlong local_1c8 [2]; undefined1 local_1b8 [40]; undefined1 local_190; undefined8 local_188; wchar_t local_178 [80]; wchar_t local_d8 [80]; ulonglong local_38; - byte *pbVar32; + undefined1 uVar6; + undefined1 uVar7; + undefined1 uVar8; + undefined1 uVar9; + undefined2 uVar10; + undefined2 uVar11; + undefined2 uVar12; + undefined2 uVar13; + byte *pbVar37; + byte bVar60; - puVar56 = auStackY_8a8; - puVar57 = auStackY_8a8; - puVar50 = (undefined8 *)auStackY_8a8; - puVar52 = (undefined8 *)auStackY_8a8; - puVar53 = auStackY_8a8; - puVar54 = auStackY_8a8; - puVar55 = auStackY_8a8; - local_38 = __security_cookie ^ (ulonglong)auStackY_8a8; - pIVar42 = (IMAGE_DOS_HEADER *)0x0; - puVar62 = (undefined8 *)0xa8; + puVar67 = auStackY_8b0 + 1; + puVar68 = auStackY_8b0 + 1; + puVar62 = auStackY_8b0 + 1; + puVar63 = auStackY_8b0 + 1; + puVar64 = auStackY_8b0 + 1; + puVar65 = auStackY_8b0 + 1; + puVar66 = auStackY_8b0 + 1; + local_38 = __security_cookie ^ (ulonglong)(auStackY_8b0 + 1); pIVar49 = (IMAGE_DOS_HEADER *)0x0; + puVar73 = (undefined8 *)0xa8; + pIVar59 = (IMAGE_DOS_HEADER *)0x0; local_660[0x18] = 0; local_660[0x19] = 0; local_660[0x1a] = 0; local_660[0x1b] = 0; local_660[0x1c] = 0; local_660[0x1d] = 0; local_660[0x1e] = 0; local_660[0x1f] = 0; local_660[0x20] = 0; local_660[0x21] = 0; local_660[0x22] = 0; local_660[0x23] = 0; local_660[0x24] = 0; local_660[0x25] = 0; local_660[0x26] = 0; local_660[0x27] = 0; memset(local_660 + 0x68,0,0xa8); - uVar25._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; - uVar25._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; - uVar67 = (ulonglong)uVar25; - if (uVar25 != 0xffffffff) { - pIVar42 = (IMAGE_DOS_HEADER *)(local_660 + 0x68); - TlsSetValue(uVar25,pIVar42); + uVar28._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; + uVar28._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; + uVar77 = (ulonglong)uVar28; + if (uVar28 != 0xffffffff) { + pIVar49 = (IMAGE_DOS_HEADER *)(local_660 + 0x68); + TlsSetValue(uVar28,pIVar49); } if ((Microsoft_Windows_NetworkSecurityEnableBits & 1) != 0) { - pIVar42 = (IMAGE_DOS_HEADER *)&SaContextOperationBeginEvent; - McTemplateU0_EtwEventWriteTransfer(uVar67,&SaContextOperationBeginEvent,puVar62); + pIVar49 = (IMAGE_DOS_HEADER *)&SaContextOperationBeginEvent; + McTemplateU0_EtwEventWriteTransfer(uVar77,&SaContextOperationBeginEvent,puVar73); } switch(*(undefined1 *)((longlong)param_1 + 0x74)) { case 1: case 4: case 7: - uVar21 = ntohl(*(u_long *)((longlong)param_1 + 0x7c)); - local_7a0 = uVar21 >> 0x18 | (uVar21 & 0xff0000) >> 8 | (uVar21 & 0xff00) << 8 | uVar21 << 0x18; + uVar24 = ntohl(*(u_long *)((longlong)param_1 + 0x7c)); + local_7a0 = uVar24 >> 0x18 | (uVar24 & 0xff0000) >> 8 | (uVar24 & 0xff00) << 8 | uVar24 << 0x18; RtlIpv4AddressToStringW(&local_7a0); break; default: - goto switchD_180027027_caseD_2; + goto switchD_1800272b7_caseD_2; case 5: case 6: case 8: local_660._40_4_ = *(undefined4 *)(param_1 + 0x10); local_660._44_4_ = *(undefined4 *)((longlong)param_1 + 0x84); local_660._48_4_ = *(undefined4 *)(param_1 + 0x11); local_660._52_4_ = *(undefined4 *)((longlong)param_1 + 0x8c); RtlIpv6AddressToStringW(local_660 + 0x28); } dwTlsIndex._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; dwTlsIndex._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; if (dwTlsIndex != 0xffffffff) { TlsSetValue(dwTlsIndex,local_660 + 0x68); } if (WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) { if ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19)) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - puVar62 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + puVar73 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; WPP_SF_iS(WPP_GLOBAL_Control[2],10,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - pwVar26); + pwVar29); } if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - puVar62 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + puVar73 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; WPP_SF_iS(WPP_GLOBAL_Control[2],0xb,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - pwVar26); - } - } - if ((4 < DAT_0) && (cVar16 = _tlgKeywordOn(0x180164278,0), cVar16 != '\0')) { + pwVar29); + } + } + if ((4 < DAT_0) && (cVar17 = _tlgKeywordOn(0x180165278,0), cVar17 != '\0')) { local_710 = IkeGetTlsMmLuid(); local_2a8._32_8_ = &local_710; local_2a8._40_2_ = 8; local_2a8._42_2_ = 0; local_2a8._44_2_ = 0; local_2a8._46_2_ = 0; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t((longlong *)(local_2a8 + 0x30),pwVar26); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t((longlong *)(local_2a8 + 0x30),pwVar29); _tlgCreate1Sz_char((longlong *)(local_2a8 + 0x40),"Received Packet"); in_stack_fffffffffffff780 = (IMAGE_DOS_HEADER *)local_2a8; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_1,puVar62,param_4,5,(undefined8 *)in_stack_fffffffffffff780) + (0x180165278,&DAT_1,puVar73,param_4,5,(undefined8 *)in_stack_fffffffffffff780) ; } - IkeAddrDump("Local Address",(byte *)(param_1 + 7),puVar62,param_4); - pbVar43 = (byte *)((longlong)param_1 + 0x74); - IkeAddrDump("Peer Address",pbVar43,puVar62,param_4); + IkeAddrDump("Local Address",(byte *)(param_1 + 7),puVar73,param_4); + pbVar50 = (byte *)((longlong)param_1 + 0x74); + IkeAddrDump("Peer Address",pbVar50,puVar73,param_4); if (WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) { if ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19)) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); in_stack_fffffffffffff780 = param_1[0x16]; - puVar62 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; - pbVar43 = (byte *)0xc; + puVar73 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + pbVar50 = (byte *)0xc; WPP_SF_iSI(WPP_GLOBAL_Control[2],0xc,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - pwVar26); - } - uVar25 = (uint)((ulonglong)in_stack_fffffffffffff780 >> 0x20); + pwVar29); + } + uVar28 = (uint)((ulonglong)in_stack_fffffffffffff780 >> 0x20); if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - puVar62 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; - in_stack_fffffffffffff780 = (IMAGE_DOS_HEADER *)((ulonglong)uVar25 << 0x20); - pbVar43 = (byte *)0xd; + puVar73 = (undefined8 *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + in_stack_fffffffffffff780 = (IMAGE_DOS_HEADER *)((ulonglong)uVar28 << 0x20); + pbVar50 = (byte *)0xd; WPP_SF_iSD(WPP_GLOBAL_Control[2],0xd,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - pwVar26); + pwVar29); } } if (4 < DAT_0) { - pbVar43 = (byte *)0x0; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { + pbVar50 = (byte *)0x0; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { local_728 = IkeGetTlsMmLuid(); local_498._32_8_ = &local_728; local_498._40_2_ = 8; local_498._42_2_ = 0; local_498._44_2_ = 0; local_498._46_2_ = 0; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t((longlong *)(local_498 + 0x30),pwVar26); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t((longlong *)(local_498 + 0x30),pwVar29); local_720 = param_1[0x16]; local_498._64_8_ = &local_720; - pbVar43 = &DAT_2; + pbVar50 = &DAT_2; local_79c = *(undefined4 *)(param_1 + 0x17); local_448 = &local_79c; in_stack_fffffffffffff780 = (IMAGE_DOS_HEADER *)local_498; local_450[0] = 8; local_450[1] = 0; local_450[2] = 0; local_450[3] = 0; local_450[4] = 0; local_450[5] = 0; local_450[6] = 0; local_450[7] = 0; local_440[0] = 4; local_440[1] = 0; local_440[2] = 0; local_440[3] = 0; local_440[4] = 0; local_440[5] = 0; local_440[6] = 0; local_440[7] = 0; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_2,puVar62,param_4,6, + (0x180165278,&DAT_2,puVar73,param_4,6, (undefined8 *)in_stack_fffffffffffff780); } } - IkeDumpHeader((byte *)param_1[2],pbVar43,puVar62,(ulonglong)param_4); - TraceLogHelper("IkeOptionalResetDHMmsFailedAuth",1,puVar62,param_4); + IkeDumpHeader((byte *)param_1[2],pbVar50,puVar73,(ulonglong)param_4); + TraceLogHelper("IkeOptionalResetDHMmsFailedAuth",1,puVar73,param_4); if (*(longlong *)gIkeExtGlobals[0xf].e_program != 0) { EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - auVar12._8_8_ = 0; - auVar12._0_8_ = _DAT_3 << 8; - puVar44 = (undefined *) - (SUB168(auVar12 * (ZEXT416(_DAT_4) << 0x20),8) - + auVar15._8_8_ = 0; + auVar15._0_8_ = _DAT_3 << 8; + puVar51 = (undefined *) + (SUB168(auVar15 * (ZEXT416(_DAT_4) << 0x20),8) - *(longlong *)(gIkeExtGlobals[0xf].e_program + 8)); - if (puVar44 < (undefined *)0x2af8) { + if (puVar51 < (undefined *)0x2af8) { LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); } else { - pIVar42 = gIkeExtGlobals; - pIVar42[0xf].e_program[0] = 0; - pIVar42[0xf].e_program[1] = 0; - pIVar42[0xf].e_program[2] = 0; - pIVar42[0xf].e_program[3] = 0; - pIVar42[0xf].e_program[4] = 0; - pIVar42[0xf].e_program[5] = 0; - pIVar42[0xf].e_program[6] = 0; - pIVar42[0xf].e_program[7] = 0; + pIVar49 = gIkeExtGlobals; + pIVar49[0xf].e_program[0] = 0; + pIVar49[0xf].e_program[1] = 0; + pIVar49[0xf].e_program[2] = 0; + pIVar49[0xf].e_program[3] = 0; + pIVar49[0xf].e_program[4] = 0; + pIVar49[0xf].e_program[5] = 0; + pIVar49[0xf].e_program[6] = 0; + pIVar49[0xf].e_program[7] = 0; if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - puVar62 = (undefined8 *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; - puVar44 = (undefined *)0x1b; + puVar73 = (undefined8 *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; + puVar51 = (undefined *)0x1b; WPP_SF_iS(WPP_GLOBAL_Control[2],0x1b,&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids, - param_4,pwVar26); + param_4,pwVar29); } if (4 < DAT_0) { - puVar44 = (undefined *)0x0; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { + puVar51 = (undefined *)0x0; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { local_718 = IkeGetTlsMmLuid(); local_238 = &local_718; local_230[0] = 8; local_230[1] = 0; local_230[2] = 0; local_230[3] = 0; local_230[4] = 0; local_230[5] = 0; local_230[6] = 0; local_230[7] = 0; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_228,pwVar26); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_228,pwVar29); _tlgCreate1Sz_char(local_218,"DH DOS Throttle failed-auth-count reset to 0"); in_stack_fffffffffffff780 = (IMAGE_DOS_HEADER *)(local_2a8 + 0x50); - puVar44 = &DAT_5; + puVar51 = &DAT_5; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,puVar62,param_4,5, + (0x180165278,&DAT_5,puVar73,param_4,5, (undefined8 *)in_stack_fffffffffffff780); } } LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - IkeClearDosModeFlag(1,puVar44,puVar62,param_4); - } - TraceLogHelper("IkeOptionalResetDHMmsFailedAuth",0,puVar62,param_4); + IkeClearDosModeFlag(1,puVar51,puVar73,param_4); + } + TraceLogHelper("IkeOptionalResetDHMmsFailedAuth",0,puVar73,param_4); } unaff_RDI = (IMAGE_DOS_HEADER *)0xffffffffffffffff; - bVar70 = false; + bVar82 = false; if (((*(int *)(gIkeExtGlobals[0xf].e_program + 0x30) == 2) && - (cVar16 = (char)param_1[2]->e_csum, cVar16 != -10)) && ((cVar16 != '\x05' && (cVar16 != '%'))) + (cVar17 = (char)param_1[2]->e_csum, cVar17 != -10)) && ((cVar17 != '\x05' && (cVar17 != '%'))) ) { param_4 = (PRTL_CRITICAL_SECTION_DEBUG)0x1; - pIVar42 = (IMAGE_DOS_HEADER *)0x3643; + pIVar49 = (IMAGE_DOS_HEADER *)0x3643; local_7d0 = WfpReportSysErrorAsWinError(gIkeExtGlobals,"IkeProcessPacketDispatch",0x3643,1); - puVar55 = auStackY_8a8; + puVar66 = auStackY_8b0 + 1; unaff_RSI = (IMAGE_DOS_HEADER *)&WPP_GLOBAL_Control; LAB_6: - *(undefined8 *)(puVar55 + -8) = 0x180028670; + puVar66[0xffffffffffffffff] = 0x180028900; IkeDestroyPacketContext((longlong)param_1); - pcVar39 = (char *)param_1; - param_1 = (IMAGE_DOS_HEADER **)pIVar42; + pcVar43 = (char *)param_1; + param_1 = (IMAGE_DOS_HEADER **)pIVar49; LAB_7: - pppIVar69 = &WPP_GLOBAL_Control; - if (*(int *)(gIkeExtGlobals[0xf].e_program + 0x30) == 2) goto LAB_8; - uVar60._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; - uVar60._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; - pcVar39 = (char *)(ulonglong)uVar60; - pcVar64 = (char *)param_1; - if (uVar60 != 0xffffffff) { - *(undefined8 *)(puVar55 + -8) = 0x18002869f; - TlsSetValue(uVar60,(LPVOID)0x0); - pcVar64 = (char *)param_1; - } - *(undefined8 *)(puVar55 + -8) = 0x1800286a9; - IkePerformPostponedMMWork(); - iVar22 = DAT_9; - LOCK(); - DAT_9 = 1; - UNLOCK(); - param_1 = (IMAGE_DOS_HEADER **)pcVar64; - if (iVar22 != 0) goto LAB_8; - pIVar42 = (IMAGE_DOS_HEADER *)0x1; - *(undefined8 *)(puVar55 + -8) = 0x1800286cb; - TraceLogHelper("IkeDeprecateOldMMs",1,pcVar64,param_4); - *(undefined8 *)(puVar55 + -8) = 0x1800286d9; - EnterCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - *(undefined8 *)(puVar55 + -8) = 0x1800286f0; - EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_res2_10_ + 8)); - while( true ) { - unaff_RDI = *(IMAGE_DOS_HEADER **)(gIkeExtGlobals->e_program + 0x28); - pIVar46 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals->e_program + 0x28); - pIVar65 = gIkeExtGlobals; - if (unaff_RDI == pIVar46) break; - lVar63 = *(longlong *)unaff_RDI; - if ((*(IMAGE_DOS_HEADER **)&unaff_RDI->e_cparhdr != pIVar46) || - (*(IMAGE_DOS_HEADER **)(lVar63 + 8) != unaff_RDI)) goto LAB_10; - pIVar46->e_magic[0] = (char)lVar63; - pIVar46->e_magic[1] = (char)((ulonglong)lVar63 >> 8); - pIVar46->e_cblp = (short)((ulonglong)lVar63 >> 0x10); - pIVar46->e_cp = (short)((ulonglong)lVar63 >> 0x20); - pIVar46->e_crlc = (short)((ulonglong)lVar63 >> 0x30); - pcVar64 = (char *)(unaff_RDI[1].e_program + 0x28); - *(IMAGE_DOS_HEADER **)(lVar63 + 8) = pIVar46; - pIVar42 = (IMAGE_DOS_HEADER *)(unaff_RDI[1].e_res2_10_ + 8); - *(undefined8 *)(puVar55 + -8) = 0x18002874d; - IkePerformAddrLookupEstablished - ((char *)&unaff_RDI->e_sp,(longlong)pIVar42,(int *)pcVar64,param_4); - *(undefined8 *)(puVar55 + -8) = 0x180028759; - uVar29 = IkeIsEstablishedIdAnonymous - ((longlong)(unaff_RDI[1].e_res2_10_ + 8),pIVar42,pcVar64,param_4); - if ((int)uVar29 == 0) { - *(undefined8 *)(puVar55 + -8) = 0x180028769; - IkePerformPeerSidThrottling((longlong)(unaff_RDI[1].e_res2_10_ + 8),pIVar42,pcVar64,param_4) - ; - } - *(undefined8 *)(puVar55 + -8) = 0x180028771; - FreeDeleteEntry((longlong)unaff_RDI); - } - } - else { - EnterCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - local_7d0 = 0; - TraceLogHelper("IkeLookupMMSAWithRetry",1,puVar62,param_4); - unaff_RSI = param_1[2]; - local_7a8 = (IMAGE_DOS_HEADER *)0x0; - TraceLogHelper("IkeLookupMMSA",1,puVar62,param_4); - pIVar42 = (IMAGE_DOS_HEADER *) - ((((((((ulonglong)(byte)unaff_RSI->e_magic[0] * 0x25 + - (ulonglong)(byte)unaff_RSI->e_magic[1]) * 0x25 + - (ulonglong)(byte)unaff_RSI->e_cblp) * 0x25 + - (ulonglong)*(byte *)((longlong)&unaff_RSI->e_cblp + 1)) * 0x25 + - (ulonglong)(byte)unaff_RSI->e_cp) * 0x25 + - (ulonglong)*(byte *)((longlong)&unaff_RSI->e_cp + 1)) * 0x25 + - (ulonglong)(byte)unaff_RSI->e_crlc) * 0x25 + - (ulonglong)*(byte *)((longlong)&unaff_RSI->e_crlc + 1)); + pppIVar79 = &WPP_GLOBAL_Control; + if (*(int *)(gIkeExtGlobals[0xf].e_program + 0x30) != 2) { + uVar70._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; + uVar70._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; + pcVar43 = (char *)(ulonglong)uVar70; + pcVar35 = (char *)param_1; + if (uVar70 != 0xffffffff) { + puVar66[0xffffffffffffffff] = 0x18002892f; + TlsSetValue(uVar70,(LPVOID)0x0); + pcVar35 = (char *)param_1; + } + puVar66[0xffffffffffffffff] = 0x180028939; + IkePerformPostponedMMWork(); + iVar25 = DAT_8; + LOCK(); + DAT_8 = 1; + UNLOCK(); + param_1 = (IMAGE_DOS_HEADER **)pcVar35; + if (iVar25 == 0) { + pIVar49 = (IMAGE_DOS_HEADER *)0x1; + puVar66[0xffffffffffffffff] = 0x18002895b; + TraceLogHelper("IkeDeprecateOldMMs",1,pcVar35,param_4); + puVar66[0xffffffffffffffff] = 0x180028969; + EnterCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); + puVar66[0xffffffffffffffff] = 0x180028980; + EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_res2_10_ + 8)); + while( true ) { + unaff_RDI = *(IMAGE_DOS_HEADER **)(gIkeExtGlobals->e_program + 0x28); + pIVar53 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals->e_program + 0x28); + pIVar74 = gIkeExtGlobals; + if (unaff_RDI == pIVar53) break; + lVar44 = *(longlong *)unaff_RDI; + if ((*(IMAGE_DOS_HEADER **)&unaff_RDI->e_cparhdr != pIVar53) || + (*(IMAGE_DOS_HEADER **)(lVar44 + 8) != unaff_RDI)) goto LAB_9; + pIVar53->e_magic[0] = (char)lVar44; + pIVar53->e_magic[1] = (char)((ulonglong)lVar44 >> 8); + pIVar53->e_cblp = (short)((ulonglong)lVar44 >> 0x10); + pIVar53->e_cp = (short)((ulonglong)lVar44 >> 0x20); + pIVar53->e_crlc = (short)((ulonglong)lVar44 >> 0x30); + pcVar35 = (char *)(unaff_RDI[1].e_program + 0x28); + *(IMAGE_DOS_HEADER **)(lVar44 + 8) = pIVar53; + pIVar49 = (IMAGE_DOS_HEADER *)(unaff_RDI[1].e_res2_10_ + 8); + puVar66[0xffffffffffffffff] = 0x1800289dd; + IkePerformAddrLookupEstablished + ((char *)&unaff_RDI->e_sp,(longlong)pIVar49,(int *)pcVar35,param_4); + puVar66[0xffffffffffffffff] = 0x1800289e9; + uVar32 = IkeIsEstablishedIdAnonymous + ((longlong)(unaff_RDI[1].e_res2_10_ + 8),pIVar49,pcVar35,param_4); + if ((int)uVar32 == 0) { + puVar66[0xffffffffffffffff] = 0x1800289f9; + IkePerformPeerSidThrottling + ((longlong)(unaff_RDI[1].e_res2_10_ + 8),pIVar49,pcVar35,param_4); + } + puVar66[0xffffffffffffffff] = 0x180028a01; + FreeDeleteEntry((longlong)unaff_RDI); + } + goto LAB_10; + } + } +LAB_11: + if ((Microsoft_Windows_NetworkSecurityEnableBits & 1) != 0) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029aeb; + McTemplateU0_EtwEventWriteTransfer(pcVar43,&SaContextOperationEndEvent,param_1); + } + dwTlsIndex_02._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; + dwTlsIndex_02._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; + if (dwTlsIndex_02 != 0xffffffff) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029b06; + TlsSetValue(dwTlsIndex_02,(LPVOID)0x0); + } + *(undefined **)((longlong)puVar66 + -8) = &UNK_12; + pbVar50 = (byte *)IkeReturnError(local_7d0,"IkeProcessPacketDispatch",param_1,param_4); +code_r0x000180029b23: + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029b4a; + return pbVar50; + } + EnterCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); + local_7d0 = 0; + TraceLogHelper("IkeLookupMMSAWithRetry",1,puVar73,param_4); + unaff_RSI = param_1[2]; + local_7a8 = (IMAGE_DOS_HEADER *)0x0; + TraceLogHelper("IkeLookupMMSA",1,puVar73,param_4); + pIVar49 = (IMAGE_DOS_HEADER *) + ((((((((ulonglong)(byte)unaff_RSI->e_magic[0] * 0x25 + + (ulonglong)(byte)unaff_RSI->e_magic[1]) * 0x25 + + (ulonglong)(byte)unaff_RSI->e_cblp) * 0x25 + + (ulonglong)*(byte *)((longlong)&unaff_RSI->e_cblp + 1)) * 0x25 + + (ulonglong)(byte)unaff_RSI->e_cp) * 0x25 + + (ulonglong)*(byte *)((longlong)&unaff_RSI->e_cp + 1)) * 0x25 + + (ulonglong)(byte)unaff_RSI->e_crlc) * 0x25 + + (ulonglong)*(byte *)((longlong)&unaff_RSI->e_crlc + 1)); + switch(*(undefined1 *)((longlong)param_1 + 0x74)) { + case 1: + case 4: + case 7: + lVar44 = 4; + break; + default: + goto switchD_1800278a7_caseD_2; + case 5: + case 6: + case 8: + lVar44 = 0x10; + } + do { + lVar44 = lVar44 + -1; + } while (lVar44 != 0); + pIVar49 = (IMAGE_DOS_HEADER *)(local_690 + 0x18); + lVar44 = RtlLookupEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); + uVar84 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); + while (pIVar74 = pIVar59, lVar44 != 0) { + param_4 = *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar44 + 0x18); + pIVar49 = (IMAGE_DOS_HEADER *)(param_1 + 7); + iVar25 = IkeFullMMMatch((longlong *)unaff_RSI,(longlong *)&unaff_RSI->e_cparhdr,(char *)pIVar49, + (longlong)param_4); + uVar84 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); + if (iVar25 != 0) { + pIVar74 = *(IMAGE_DOS_HEADER **)(lVar44 + 0x18); + local_7a8 = pIVar74; + break; + } + lVar44 = RtlGetNextEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); + uVar84 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); + } + TraceLogHelper("IkeLookupMMSA",0,pIVar49,param_4); + if (pIVar74 == (IMAGE_DOS_HEADER *)0x0) { + pIVar53 = param_1[2]; + local_6b0._0_1_ = pIVar53->e_magic[0]; + local_6b0._1_1_ = pIVar53->e_magic[1]; + local_6b0._2_2_ = pIVar53->e_cblp; + local_6b0._4_2_ = pIVar53->e_cp; + local_6b0._6_2_ = pIVar53->e_crlc; + uStack_6a8._0_2_ = pIVar53->e_cparhdr; + uStack_6a8._2_2_ = pIVar53->e_minalloc; + uStack_6a8._4_2_ = pIVar53->e_maxalloc; + uStack_6a8._6_2_ = pIVar53->e_ss; + uVar24._0_2_ = pIVar53->e_lfarlc; + uVar24._2_2_ = pIVar53->e_ovno; + local_6a0._0_2_ = pIVar53->e_sp; + local_6a0._2_2_ = pIVar53->e_csum; + local_6a0._4_2_ = pIVar53->e_ip; + local_6a0._6_2_ = pIVar53->e_cs; + ntohl(uVar24); + ntohl(local_6a0._4_4_); + if (((byte)(local_6a0._2_1_ - 0x22U) < 4) || (local_6a0._2_1_ == -0x38)) { + pIVar74 = (IMAGE_DOS_HEADER *)¶m_1[2]->e_cparhdr; + if ((local_6a0 & 0x8000000) == 0) { + pIVar74 = param_1[2]; + } + pIVar49 = (IMAGE_DOS_HEADER *)0x0; + local_7d0 = IkeLookupMMSAByMyCookieIkeV2 + ((byte *)pIVar74,(longlong *)&local_7a8,(longlong *)0x0,param_4); + pIVar74 = local_7a8; + if ((local_7d0 == 0) && (local_7a8 != (IMAGE_DOS_HEADER *)0x0)) { + *(uint *)((longlong)param_1 + 0x2c) = *(uint *)((longlong)param_1 + 0x2c) | 1; + } + } + } + TraceLogHelper("IkeLookupMMSAWithRetry",0,pIVar49,param_4); + local_7d0 = IkeReturnError(local_7d0,"IkeLookupMMSAWithRetry",pIVar49,param_4); + puVar67 = auStackY_8b0 + 1; + if (local_7d0 != 0) { +LAB_13: + puVar67[0xffffffffffffffff] = 0x1800288f3; + LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); + puVar66 = puVar67; + goto LAB_6; + } + puVar51 = &IKE_PACKET_RECV; + cVar17 = EtwEventEnabled(WfpEventTraceHandle); + if (cVar17 != '\0') { + WfpTraceActivityIdSet(pIVar74,puVar51,(longlong)(local_660 + 0x18)); + } + if (pIVar74 != (IMAGE_DOS_HEADER *)0x0) { + IkeAddrGetAddrString((char *)(pIVar74[3].e_res2_10_ + 6),local_5f0); + local_660._104_8_ = *(undefined8 *)(pIVar74[7].e_program + 0x20); + IkeSetTlsData(local_660 + 0x68); + } + pIVar49 = param_1[2]; + local_7c8 = pIVar49; + memset(local_d8,0,0xa0); + memset(local_178,0,0xa0); + sprintf_s(local_1b8 + 0x18,0x11,"%02x%02x%02x%02x%02x%02x%02x%02x", + (ulonglong)(byte)pIVar49->e_magic[0]); + unaff_RDI = (IMAGE_DOS_HEADER *)(ulonglong)(byte)pIVar49->e_minalloc; + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(ulonglong)(byte)pIVar49->e_cparhdr; + pcVar35 = "%02x%02x%02x%02x%02x%02x%02x%02x"; + uVar76 = 0; + local_190 = 0; + sprintf_s(local_1b8,0x11,"%02x%02x%02x%02x%02x%02x%02x%02x"); + local_1b8[0x10] = 0; + switch(*(undefined1 *)(param_1 + 7)) { + case 1: + case 4: + case 7: + uVar24 = ntohl(*(u_long *)(param_1 + 8)); + local_798 = uVar24 >> 0x18 | (uVar24 & 0xff0000) >> 8 | (uVar24 & 0xff00) << 8 | uVar24 << 0x18; + RtlIpv4AddressToStringW(&local_798); + break; + default: + goto switchD_180027bcb_caseD_2; + case 5: + case 6: + case 8: + local_660._56_4_ = *(undefined4 *)((longlong)param_1 + 0x44); + local_660._60_4_ = *(undefined4 *)(param_1 + 9); + local_660._64_4_ = *(undefined4 *)((longlong)param_1 + 0x4c); + local_660._68_4_ = *(undefined4 *)(param_1 + 10); + RtlIpv6AddressToStringW(local_660 + 0x38); + } + switch(*(undefined1 *)(param_1 + 7)) { + case 1: + case 4: + case 5: + case 6: + case 7: + case 8: + uVar23 = *(u_short *)((longlong)param_1 + 0x3e); switch(*(undefined1 *)((longlong)param_1 + 0x74)) { case 1: case 4: case 7: - lVar63 = 4; + uVar24 = ntohl(*(u_long *)((longlong)param_1 + 0x7c)); + local_778 = uVar24 >> 0x18 | (uVar24 & 0xff0000) >> 8 | (uVar24 & 0xff00) << 8 | + uVar24 << 0x18; + RtlIpv4AddressToStringW(&local_778); break; default: - goto switchD_180027617_caseD_2; + goto switchD_180027c70_caseD_2; case 5: case 6: case 8: - lVar63 = 0x10; - } - do { - lVar63 = lVar63 + -1; - } while (lVar63 != 0); - pIVar42 = (IMAGE_DOS_HEADER *)(local_690 + 0x18); - lVar63 = RtlLookupEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - uVar73 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); - while (pIVar65 = pIVar49, lVar63 != 0) { - param_4 = *(PRTL_CRITICAL_SECTION_DEBUG *)(lVar63 + 0x18); - pIVar42 = (IMAGE_DOS_HEADER *)(param_1 + 7); - iVar22 = IkeFullMMMatch((longlong *)unaff_RSI,(longlong *)&unaff_RSI->e_cparhdr, - (char *)pIVar42,(longlong)param_4); - uVar73 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); - if (iVar22 != 0) { - pIVar65 = *(IMAGE_DOS_HEADER **)(lVar63 + 0x18); - local_7a8 = pIVar65; - break; - } - lVar63 = RtlGetNextEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - uVar73 = (undefined4)((ulonglong)in_stack_fffffffffffff780 >> 0x20); - } - TraceLogHelper("IkeLookupMMSA",0,pIVar42,param_4); - if (pIVar65 == (IMAGE_DOS_HEADER *)0x0) { - pIVar46 = param_1[2]; - local_6b0._0_1_ = pIVar46->e_magic[0]; - local_6b0._1_1_ = pIVar46->e_magic[1]; - local_6b0._2_2_ = pIVar46->e_cblp; - local_6b0._4_2_ = pIVar46->e_cp; - local_6b0._6_2_ = pIVar46->e_crlc; - uStack_6a8._0_2_ = pIVar46->e_cparhdr; - uStack_6a8._2_2_ = pIVar46->e_minalloc; - uStack_6a8._4_2_ = pIVar46->e_maxalloc; - uStack_6a8._6_2_ = pIVar46->e_ss; - uVar21._0_2_ = pIVar46->e_lfarlc; - uVar21._2_2_ = pIVar46->e_ovno; - local_6a0._0_2_ = pIVar46->e_sp; - local_6a0._2_2_ = pIVar46->e_csum; - local_6a0._4_2_ = pIVar46->e_ip; - local_6a0._6_2_ = pIVar46->e_cs; - ntohl(uVar21); - ntohl(local_6a0._4_4_); - if (((byte)(local_6a0._2_1_ - 0x22U) < 4) || (local_6a0._2_1_ == -0x38)) { - pIVar65 = (IMAGE_DOS_HEADER *)¶m_1[2]->e_cparhdr; - if ((local_6a0 & 0x8000000) == 0) { - pIVar65 = param_1[2]; - } - pIVar42 = (IMAGE_DOS_HEADER *)0x0; - local_7d0 = IkeLookupMMSAByMyCookieIkeV2 - ((byte *)pIVar65,(longlong *)&local_7a8,(longlong *)0x0,param_4); - pIVar65 = local_7a8; - if ((local_7d0 == 0) && (local_7a8 != (IMAGE_DOS_HEADER *)0x0)) { - *(uint *)((longlong)param_1 + 0x2c) = *(uint *)((longlong)param_1 + 0x2c) | 1; - } - } - } - TraceLogHelper("IkeLookupMMSAWithRetry",0,pIVar42,param_4); - local_7d0 = IkeReturnError(local_7d0,"IkeLookupMMSAWithRetry",pIVar42,param_4); - puVar51 = auStackY_8a8; - if (local_7d0 != 0) { -LAB_11: - *(undefined8 *)(puVar51 + -8) = 0x180028663; - LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - puVar55 = puVar51; - goto LAB_6; - } - puVar44 = &IKE_PACKET_RECV; - cVar16 = EtwEventEnabled(WfpEventTraceHandle); - if (cVar16 != '\0') { - WfpTraceActivityIdSet(pIVar65,puVar44,(longlong)(local_660 + 0x18)); - } - if (pIVar65 != (IMAGE_DOS_HEADER *)0x0) { - IkeAddrGetAddrString((char *)(pIVar65[3].e_res2_10_ + 6),local_5f0); - local_660._104_8_ = *(undefined8 *)(pIVar65[7].e_program + 0x20); - IkeSetTlsData(local_660 + 0x68); - } - pIVar42 = param_1[2]; - local_7c8 = pIVar42; - memset(local_d8,0,0xa0); - memset(local_178,0,0xa0); - sprintf_s(local_1b8 + 0x18,0x11,"%02x%02x%02x%02x%02x%02x%02x%02x", - (ulonglong)(byte)pIVar42->e_magic[0]); - in_R10 = (undefined8 *)(ulonglong)(byte)pIVar42->e_maxalloc; - unaff_RDI = (IMAGE_DOS_HEADER *)(ulonglong)(byte)pIVar42->e_minalloc; - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(ulonglong)(byte)pIVar42->e_cparhdr; - pcVar64 = "%02x%02x%02x%02x%02x%02x%02x%02x"; - uVar74 = 0; - local_190 = 0; - sprintf_s(local_1b8,0x11,"%02x%02x%02x%02x%02x%02x%02x%02x"); - local_1b8[0x10] = 0; - switch(*(undefined1 *)(param_1 + 7)) { - case 1: - case 4: - case 7: - uVar21 = ntohl(*(u_long *)(param_1 + 8)); - local_798 = uVar21 >> 0x18 | (uVar21 & 0xff0000) >> 8 | (uVar21 & 0xff00) << 8 | - uVar21 << 0x18; - RtlIpv4AddressToStringW(&local_798); - break; - default: - goto switchD_18002793b_caseD_2; - case 5: - case 6: - case 8: - local_660._56_4_ = *(undefined4 *)((longlong)param_1 + 0x44); - local_660._60_4_ = *(undefined4 *)(param_1 + 9); - local_660._64_4_ = *(undefined4 *)((longlong)param_1 + 0x4c); - local_660._68_4_ = *(undefined4 *)(param_1 + 10); - RtlIpv6AddressToStringW(local_660 + 0x38); - } - switch(*(undefined1 *)(param_1 + 7)) { + local_660._72_4_ = *(undefined4 *)(param_1 + 0x10); + local_660._76_4_ = *(undefined4 *)((longlong)param_1 + 0x84); + local_660._80_4_ = *(undefined4 *)(param_1 + 0x11); + local_660._84_4_ = *(undefined4 *)((longlong)param_1 + 0x8c); + RtlIpv6AddressToStringW(local_660 + 0x48); + } + switch(*(undefined1 *)((longlong)param_1 + 0x74)) { case 1: case 4: case 5: case 6: case 7: case 8: - uVar20 = *(u_short *)((longlong)param_1 + 0x3e); - switch(*(undefined1 *)((longlong)param_1 + 0x74)) { - case 1: - case 4: - case 7: - uVar21 = ntohl(*(u_long *)((longlong)param_1 + 0x7c)); - local_778 = uVar21 >> 0x18 | (uVar21 & 0xff0000) >> 8 | (uVar21 & 0xff00) << 8 | - uVar21 << 0x18; - RtlIpv4AddressToStringW(&local_778); - break; - default: - goto switchD_1800279e0_caseD_2; - case 5: - case 6: - case 8: - local_660._72_4_ = *(undefined4 *)(param_1 + 0x10); - local_660._76_4_ = *(undefined4 *)((longlong)param_1 + 0x84); - local_660._80_4_ = *(undefined4 *)(param_1 + 0x11); - local_660._84_4_ = *(undefined4 *)((longlong)param_1 + 0x8c); - RtlIpv6AddressToStringW(local_660 + 0x48); - } - switch(*(undefined1 *)((longlong)param_1 + 0x74)) { - case 1: - case 4: - case 5: - case 6: - case 7: - case 8: - goto switchD_180027a59_caseD_1; - default: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar52 = auStackY_8a0; -switchD_1800279e0_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar53 = (undefined1 *)((longlong)puVar52 + 8); - goto switchD_1800279b1_caseD_2; - } + goto switchD_180027ce9_caseD_1; default: -switchD_1800279b1_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar54 = puVar53 + 8; -switchD_18002793b_caseD_2: - pIVar65 = (IMAGE_DOS_HEADER *)&DAT_12; - pcVar11 = (code *)swi(0x29); - (*pcVar11)(); - puVar55 = puVar54 + 8; - pppIVar69 = (IMAGE_DOS_HEADER ***)param_1; - } - } - *(undefined8 *)(puVar55 + -8) = 0x18002895b; - LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar65->e_res2_10_ + 8)); - *(undefined8 *)(puVar55 + -8) = 0x18002896e; + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar63 = (undefined8 *)auStackY_8a0; +switchD_180027c70_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar64 = puVar63 + 1; + goto switchD_180027c41_caseD_2; + } + default: +switchD_180027c41_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar65 = puVar64 + 1; +switchD_180027bcb_caseD_2: + pIVar74 = (IMAGE_DOS_HEADER *)&DAT_14; + pcVar14 = (code *)swi(0x29); + (*pcVar14)(); + puVar66 = puVar65 + 1; + pppIVar79 = (IMAGE_DOS_HEADER ***)param_1; + } +LAB_10: + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028beb; + LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar74->e_res2_10_ + 8)); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028bfe; LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - *(undefined8 *)(puVar55 + -8) = 0x180028981; - TraceLogHelper("IkeDeprecateOldMMs",0,pcVar64,param_4); - pIVar42 = (IMAGE_DOS_HEADER *)0xa8; - *(undefined8 *)(puVar55 + -8) = 0x180028997; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c11; + TraceLogHelper("IkeDeprecateOldMMs",0,pcVar35,param_4); + pIVar49 = (IMAGE_DOS_HEADER *)0xa8; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c27; memset(&local_548,0,0xa8); - unaff_RSI = pIVar49; -LAB_13: + unaff_RSI = pIVar59; +LAB_15: local_7f8 = (uint)unaff_RSI; - *(undefined8 *)(puVar55 + -8) = 0x1800289b4; - TraceLogHelper("IkeDeleteZombieSas",1,pIVar42,param_4); - uVar2._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; - uVar2._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; - uVar67 = (ulonglong)uVar2; - pIVar65 = pIVar42; - if (uVar2 != 0xffffffff) { - *(undefined8 *)(puVar55 + -8) = 0x1800289d4; - TlsSetValue(uVar2,&local_548); - pIVar65 = pIVar42; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c44; + TraceLogHelper("IkeDeleteZombieSas",1,pIVar49,param_4); + uVar1._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; + uVar1._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; + uVar77 = (ulonglong)uVar1; + pIVar74 = pIVar49; + if (uVar1 != 0xffffffff) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c64; + TlsSetValue(uVar1,&local_548); + pIVar74 = pIVar49; } if ((Microsoft_Windows_NetworkSecurityEnableBits & 1) != 0) { - *(undefined8 *)(puVar55 + -8) = 0x1800289ee; - McTemplateU0_EtwEventWriteTransfer(uVar67,&SaContextOperationBeginEvent,pIVar65); - } - *(undefined8 *)(puVar55 + -8) = 0x1800289fc; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c7e; + McTemplateU0_EtwEventWriteTransfer(uVar77,&SaContextOperationBeginEvent,pIVar74); + } + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028c8c; EnterCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - *(undefined8 *)(puVar55 + -8) = 0x180028a13; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028ca3; EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - pwVar37 = gIkeExtGlobals[1].e_res2_10_; - puVar62 = *(undefined8 **)pwVar37; - if ((word *)puVar62 == pwVar37) { + pwVar40 = gIkeExtGlobals[1].e_res2_10_; + puVar67 = *(undefined8 **)pwVar40; + if ((word *)puVar67 == pwVar40) { unaff_RSI = (IMAGE_DOS_HEADER *)0x1; - *(undefined8 *)(puVar55 + -8) = 0x180028a3e; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028cce; LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - *(undefined8 *)(puVar55 + -8) = 0x180028a51; - pIVar46 = gIkeExtGlobals; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028ce1; + pIVar53 = gIkeExtGlobals; LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - goto LAB_14; - } - pIVar42 = (IMAGE_DOS_HEADER *)*puVar62; - if (((word *)puVar62[1] != pwVar37) || (*(undefined8 **)&pIVar42->e_cparhdr != puVar62)) - goto LAB_10; - pIVar46 = (IMAGE_DOS_HEADER *)(puVar62 + -0x44); - *(IMAGE_DOS_HEADER **)pwVar37 = pIVar42; - *(word **)&pIVar42->e_cparhdr = pwVar37; - local_7c0 = pIVar46; - if (pIVar46 != (IMAGE_DOS_HEADER *)0x0) { - switch(*(undefined1 *)((longlong)puVar62 + -0x6c)) { - case 1: - case 4: - case 7: - uVar21 = *(u_long *)((longlong)puVar62 + -100); - *(undefined8 *)(puVar55 + -8) = 0x180028ac7; - uVar21 = ntohl(uVar21); - local_790 = uVar21 >> 0x18 | (uVar21 & 0xff0000) >> 8 | (uVar21 & 0xff00) << 8 | - uVar21 << 0x18; - *(undefined8 *)(puVar55 + -8) = 0x180028ae3; - RtlIpv4AddressToStringW(&local_790,local_540); - break; - default: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180028f0d_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180028edf_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; - pIVar42 = pIVar65; -switchD_180028e15_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180028de6_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180029162_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_18002947b_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_18002944c_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180029396_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180029367_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -LAB_15: - pcVar39 = "IkeDeleteZombieSas"; - *(undefined8 *)(puVar55 + -8) = 0x18002983b; - TraceLogHelper("IkeDeleteZombieSas",0,pIVar42,param_4); - *(undefined8 *)(puVar55 + -8) = 0x180029840; - IkePerformPostponedMMWork(); - LOCK(); - DAT_9 = 0; - UNLOCK(); - param_1 = (IMAGE_DOS_HEADER **)pIVar42; -LAB_8: - if ((Microsoft_Windows_NetworkSecurityEnableBits & 1) != 0) { - *(undefined8 *)(puVar55 + -8) = 0x18002985b; - McTemplateU0_EtwEventWriteTransfer(pcVar39,&SaContextOperationEndEvent,param_1); - } - dwTlsIndex_02._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; - dwTlsIndex_02._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; - if (dwTlsIndex_02 != 0xffffffff) { - *(undefined8 *)(puVar55 + -8) = 0x180029876; - TlsSetValue(dwTlsIndex_02,(LPVOID)0x0); - } - *(undefined8 *)(puVar55 + -8) = 0x18002988b; - IkeReturnError(local_7d0,"IkeProcessPacketDispatch",param_1,param_4); - *(undefined8 *)(puVar55 + -8) = 0x1800298ba; - return; - case 5: - case 6: - case 8: - local_660._88_4_ = *(undefined4 *)(puVar62 + -0xc); - local_660._92_4_ = *(undefined4 *)((longlong)puVar62 + -0x5c); - local_660._96_4_ = *(undefined4 *)(puVar62 + -0xb); - local_660._100_4_ = *(undefined4 *)((longlong)puVar62 + -0x54); - *(undefined8 *)(puVar55 + -8) = 0x180028b0e; - RtlIpv6AddressToStringW(local_660 + 0x58,local_540); - } - local_548 = puVar62[0x38]; - dwTlsIndex_00._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; - dwTlsIndex_00._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; - if (dwTlsIndex_00 != 0xffffffff) { - *(undefined8 *)(puVar55 + -8) = 0x180028b41; - TlsSetValue(dwTlsIndex_00,&local_548); - } - } + goto LAB_16; + } + pIVar49 = (IMAGE_DOS_HEADER *)*puVar67; + if (((word *)puVar67[1] != pwVar40) || (*(undefined8 **)&pIVar49->e_cparhdr != puVar67)) + goto LAB_9; + pIVar53 = (IMAGE_DOS_HEADER *)(puVar67 + -0x44); + *(IMAGE_DOS_HEADER **)pwVar40 = pIVar49; + *(word **)&pIVar49->e_cparhdr = pwVar40; + local_7c0 = pIVar53; + if (pIVar53 == (IMAGE_DOS_HEADER *)0x0) goto LAB_17; + switch(*(undefined1 *)((longlong)puVar67 + -0x6c)) { + case 1: + case 4: + case 7: + uVar24 = *(u_long *)((longlong)puVar67 + -100); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028d57; + uVar24 = ntohl(uVar24); + local_790 = uVar24 >> 0x18 | (uVar24 & 0xff0000) >> 8 | (uVar24 & 0xff00) << 8 | uVar24 << 0x18; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028d73; + RtlIpv4AddressToStringW(&local_790,local_540); + break; + default: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_18002919d_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_18002916f_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); + pIVar49 = pIVar74; +switchD_1800290a5_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_180029076_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_1800293f2_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_18002970b_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_1800296dc_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_180029626_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_1800295f7_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +LAB_18: + pcVar43 = "IkeDeleteZombieSas"; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029acb; + TraceLogHelper("IkeDeleteZombieSas",0,pIVar49,param_4); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029ad0; + IkePerformPostponedMMWork(); + LOCK(); + DAT_8 = 0; + UNLOCK(); + param_1 = (IMAGE_DOS_HEADER **)pIVar49; + goto LAB_11; + case 5: + case 6: + case 8: + local_660._88_4_ = *(undefined4 *)(puVar67 + -0xc); + local_660._92_4_ = *(undefined4 *)((longlong)puVar67 + -0x5c); + local_660._96_4_ = *(undefined4 *)(puVar67 + -0xb); + local_660._100_4_ = *(undefined4 *)((longlong)puVar67 + -0x54); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028d9e; + RtlIpv6AddressToStringW(local_660 + 0x58,local_540); + } + local_548 = puVar67[0x38]; + dwTlsIndex_00._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; + dwTlsIndex_00._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; + if (dwTlsIndex_00 != 0xffffffff) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028dd1; + TlsSetValue(dwTlsIndex_00,&local_548); + } +LAB_17: unaff_RSI = &IMAGE_DOS_HEADER_180000000; local_7f0.Blink = (_LIST_ENTRY *)0x0; - *(undefined8 *)(puVar55 + -8) = 0x180028b64; - TraceLogHelper("IkeRemoveMMSAFromLists",1,pIVar65,param_4); - if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)pppIVar69) && + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028df4; + TraceLogHelper("IkeRemoveMMSAFromLists",1,pIVar74,param_4); + if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)pppIVar79) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - *(undefined8 *)(puVar55 + -8) = 0x180028b81; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e11; unaff_RDI = (IMAGE_DOS_HEADER *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x180028b89; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e19; param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - pIVar65 = (IMAGE_DOS_HEADER *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; - *(IMAGE_DOS_HEADER **)(puVar55 + 0x28) = pIVar46; - *(IMAGE_DOS_HEADER **)(puVar55 + 0x20) = unaff_RDI; - pIVar42 = WPP_GLOBAL_Control[2]; - *(undefined8 *)(puVar55 + -8) = 0x180028bb2; - WPP_SF_iSq(pIVar42,0x20,&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids,param_4, - *(wchar_t **)(puVar55 + 0x20)); + pIVar74 = (IMAGE_DOS_HEADER *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; + *(IMAGE_DOS_HEADER **)((longlong)puVar66 + 0x28) = pIVar53; + *(IMAGE_DOS_HEADER **)((longlong)puVar66 + 0x20) = unaff_RDI; + pIVar49 = WPP_GLOBAL_Control[2]; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e42; + WPP_SF_iSq(pIVar49,0x20,&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids,param_4, + *(wchar_t **)((longlong)puVar66 + 0x20)); } if (4 < DAT_0) { - *(undefined8 *)(puVar55 + -8) = 0x180028bcd; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { - *(undefined8 *)(puVar55 + -8) = 0x180028bda; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e5d; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e6a; local_6c0 = IkeGetTlsMmLuid(); local_2e8 = &local_6c0; local_2e0 = 8; - *(undefined8 *)(puVar55 + -8) = 0x180028bff; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x180028c0e; - _tlgCreate1Sz_wchar_t(local_2d8,pwVar26); - *(undefined8 *)(puVar55 + -8) = 0x180028c21; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e8f; + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028e9e; + _tlgCreate1Sz_wchar_t(local_2d8,pwVar29); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028eb1; _tlgCreate1Sz_char(local_2c8,"Deleting MM from lists"); - local_6b8 = pIVar46; + local_6b8 = pIVar53; local_2b8 = &local_6b8; local_2b0 = 8; - *(undefined1 **)(puVar55 + 0x28) = local_308; - *(undefined4 *)(puVar55 + 0x20) = 6; - *(undefined8 *)(puVar55 + -8) = 0x180028c68; + *(undefined1 **)((longlong)puVar66 + 0x28) = local_308; + *(undefined4 *)((longlong)puVar66 + 0x20) = 6; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028ef8; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_16,pIVar65,param_4,*(undefined4 *)(puVar55 + 0x20), - *(undefined8 **)(puVar55 + 0x28)); - } - } - pIVar42 = (IMAGE_DOS_HEADER *)0x1; - bVar70 = true; - *(undefined8 *)(puVar55 + -8) = 0x180028c80; - TraceLogHelper("IkeRemoveMMSAFromAddrHash",1,pIVar65,param_4); - pcVar64 = (char *)(puVar62 + -0x15); - pIVar65 = pIVar49; - switch(*pcVar64) { + (0x180165278,&DAT_19,pIVar74,param_4, + *(undefined4 *)((longlong)puVar66 + 0x20), + *(undefined8 **)((longlong)puVar66 + 0x28)); + } + } + pIVar49 = (IMAGE_DOS_HEADER *)0x1; + bVar82 = true; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180028f10; + TraceLogHelper("IkeRemoveMMSAFromAddrHash",1,pIVar74,param_4); + pcVar35 = (char *)(puVar67 + -0x15); + pIVar74 = pIVar59; + switch(*pcVar35) { case '\x01': case '\x04': case '\a': - pbVar43 = (byte *)(puVar62 + -0x14); - pIVar42 = (IMAGE_DOS_HEADER *)0x4; + pbVar50 = (byte *)(puVar67 + -0x14); + pIVar49 = (IMAGE_DOS_HEADER *)0x4; break; default: - goto switchD_180028ca6_caseD_2; + goto switchD_180028f36_caseD_2; case '\x05': case '\x06': case '\b': - pbVar43 = (byte *)((longlong)puVar62 + -0x9c); - pIVar42 = (IMAGE_DOS_HEADER *)0x10; + pbVar50 = (byte *)((longlong)puVar67 + -0x9c); + pIVar49 = (IMAGE_DOS_HEADER *)0x10; } do { - bVar34 = *pbVar43; - pbVar43 = pbVar43 + 1; - pIVar65 = (IMAGE_DOS_HEADER *)((longlong)pIVar65 * 0x25 + (ulonglong)bVar34); - pIVar42 = (IMAGE_DOS_HEADER *)(pIVar42[-1].e_program + 0x3f); - } while (pIVar42 != (IMAGE_DOS_HEADER *)0x0); - switch(*(undefined1 *)((longlong)puVar62 + -0x6c)) { + bVar56 = *pbVar50; + pbVar50 = pbVar50 + 1; + pIVar74 = (IMAGE_DOS_HEADER *)((longlong)pIVar74 * 0x25 + (ulonglong)bVar56); + pIVar49 = (IMAGE_DOS_HEADER *)(pIVar49[-1].e_program + 0x3f); + } while (pIVar49 != (IMAGE_DOS_HEADER *)0x0); + switch(*(undefined1 *)((longlong)puVar67 + -0x6c)) { case 1: case 4: case 7: - pbVar43 = (byte *)((longlong)puVar62 + -100); - lVar63 = 4; + pbVar50 = (byte *)((longlong)puVar67 + -100); + lVar44 = 4; break; default: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; -switchD_180028ca6_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar55 = puVar55 + 8; - goto LAB_10; + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); +switchD_180028f36_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar66 = (undefined8 *)((longlong)puVar66 + 8); + goto LAB_9; case 5: case 6: case 8: - pbVar43 = (byte *)(puVar62 + -0xc); - lVar63 = 0x10; + pbVar50 = (byte *)(puVar67 + -0xc); + lVar44 = 0x10; } do { - bVar34 = *pbVar43; - pbVar43 = pbVar43 + 1; - pIVar65 = (IMAGE_DOS_HEADER *)((longlong)pIVar65 * 0x25 + (ulonglong)bVar34); - lVar63 = lVar63 + -1; - } while (lVar63 != 0); -LAB_17: + bVar56 = *pbVar50; + pbVar50 = pbVar50 + 1; + pIVar74 = (IMAGE_DOS_HEADER *)((longlong)pIVar74 * 0x25 + (ulonglong)bVar56); + lVar44 = lVar44 + -1; + } while (lVar44 != 0); +LAB_20: do { - if (bVar70) { - pIVar42 = (IMAGE_DOS_HEADER *)local_660; - pIVar46 = pIVar65; - if (pIVar65 == (IMAGE_DOS_HEADER *)0x0) { - pIVar46 = (IMAGE_DOS_HEADER *)0xffffffffffffffff; - } - *(undefined8 *)(puVar55 + -8) = 0x180028d71; - pIVar46 = (IMAGE_DOS_HEADER *) - RtlLookupEntryHashTable(gIkeExtGlobals[0x11].e_res_4_ + 2,pIVar46); - bVar70 = false; + if (bVar82) { + pIVar49 = (IMAGE_DOS_HEADER *)local_660; + pIVar53 = pIVar74; + if (pIVar74 == (IMAGE_DOS_HEADER *)0x0) { + pIVar53 = (IMAGE_DOS_HEADER *)0xffffffffffffffff; + } + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029001; + pIVar53 = (IMAGE_DOS_HEADER *) + RtlLookupEntryHashTable(gIkeExtGlobals[0x11].e_res_4_ + 2,pIVar53); + bVar82 = false; } else { - *(undefined8 *)(puVar55 + -8) = 0x180028d8e; - pIVar42 = pIVar65; - pIVar46 = (IMAGE_DOS_HEADER *) + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002901e; + pIVar49 = pIVar74; + pIVar53 = (IMAGE_DOS_HEADER *) RtlGetNextEntryHashTable(gIkeExtGlobals[0x11].e_res_4_ + 2,local_660); } - pIVar61 = pIVar49; - if (pIVar46 != (IMAGE_DOS_HEADER *)0x0) { - lVar63 = *(longlong *)&pIVar46->e_lfarlc; - cVar16 = *(char *)((longlong)puVar62 + -0x6c); - if (cVar16 != *(char *)(lVar63 + 0x1b4)) goto LAB_17; - pIVar42 = &IMAGE_DOS_HEADER_180000000; - switch(cVar16) { + pIVar71 = pIVar59; + if (pIVar53 != (IMAGE_DOS_HEADER *)0x0) { + lVar44 = *(longlong *)&pIVar53->e_lfarlc; + cVar17 = *(char *)((longlong)puVar67 + -0x6c); + if (cVar17 != *(char *)(lVar44 + 0x1b4)) goto LAB_20; + pIVar49 = &IMAGE_DOS_HEADER_180000000; + switch(cVar17) { case '\x01': case '\x04': case '\a': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar62 + -100); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar67 + -100); break; default: - goto switchD_180028de6_caseD_2; + goto switchD_180029076_caseD_2; case '\x05': case '\x06': case '\b': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar62 + -0xc); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar67 + -0xc); } local_760 = param_4; - switch(*(char *)(lVar63 + 0x1b4)) { + switch(*(char *)(lVar44 + 0x1b4)) { case '\x01': case '\x04': case '\a': local_808 = 4; - local_768 = (void *)(lVar63 + 0x1bc); - sVar66 = 4; + local_768 = (void *)(lVar44 + 0x1bc); + sVar75 = 4; break; default: - goto switchD_180028e15_caseD_2; + goto switchD_1800290a5_caseD_2; case '\x05': case '\x06': case '\b': local_808 = 0x10; - local_768 = (void *)(lVar63 + 0x1c0); - sVar66 = 0x10; - } - *(undefined8 *)(puVar55 + -8) = 0x180028e4b; - iVar22 = memcmp(param_4,local_768,sVar66); - if (iVar22 != 0) goto LAB_17; - if ((byte)(cVar16 - 7U) < 2) { - *(undefined8 *)(puVar55 + -8) = 0x180028e76; + local_768 = (void *)(lVar44 + 0x1c0); + sVar75 = 0x10; + } + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800290db; + iVar25 = memcmp(param_4,local_768,sVar75); + if (iVar25 != 0) goto LAB_20; + if ((byte)(cVar17 - 7U) < 2) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029106; IkeAddrGetAddrBytesHigh - ((char *)((longlong)puVar62 + -0x6c),(longlong *)&local_760,&local_808); - *(undefined8 *)(puVar55 + -8) = 0x180028e87; - IkeAddrGetAddrBytesHigh((char *)(lVar63 + 0x1b4),(longlong *)&local_768,&local_808); - *(undefined8 *)(puVar55 + -8) = 0x180028e98; - iVar22 = memcmp(local_760,local_768,(ulonglong)local_808); - if (iVar22 != 0) goto LAB_17; - } - cVar16 = *pcVar64; - cVar7 = *(char *)(lVar63 + 0x178); - if (cVar16 != cVar7) goto LAB_17; - switch(cVar16) { + ((char *)((longlong)puVar67 + -0x6c),(longlong *)&local_760,&local_808); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029117; + IkeAddrGetAddrBytesHigh((char *)(lVar44 + 0x1b4),(longlong *)&local_768,&local_808); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029128; + iVar25 = memcmp(local_760,local_768,(ulonglong)local_808); + if (iVar25 != 0) goto LAB_20; + } + cVar17 = *pcVar35; + cVar46 = *(char *)(lVar44 + 0x178); + if (cVar17 != cVar46) goto LAB_20; + switch(cVar17) { case '\x01': case '\x04': case '\a': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar62 + -0x14); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar67 + -0x14); break; default: - goto switchD_180028edf_caseD_2; + goto switchD_18002916f_caseD_2; case '\x05': case '\x06': case '\b': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar62 + -0x9c); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar67 + -0x9c); } local_750 = param_4; - switch(cVar7) { + switch(cVar46) { case '\x01': case '\x04': case '\a': local_804 = 4; - local_758 = (void *)(lVar63 + 0x180); - sVar66 = 4; + local_758 = (void *)(lVar44 + 0x180); + sVar75 = 4; break; default: - goto switchD_180028f0d_caseD_2; + goto switchD_18002919d_caseD_2; case '\x05': case '\x06': case '\b': local_804 = 0x10; - local_758 = (void *)(lVar63 + 0x184); - sVar66 = 0x10; - } - *(undefined8 *)(puVar55 + -8) = 0x180028f43; - iVar22 = memcmp(param_4,local_758,sVar66); - if (iVar22 != 0) goto LAB_17; - if ((byte)(cVar16 - 7U) < 2) { - *(undefined8 *)(puVar55 + -8) = 0x180028f6c; - IkeAddrGetAddrBytesHigh(pcVar64,(longlong *)&local_750,&local_804); - *(undefined8 *)(puVar55 + -8) = 0x180028f7c; - IkeAddrGetAddrBytesHigh((char *)(lVar63 + 0x178),(longlong *)&local_758,&local_804); - *(undefined8 *)(puVar55 + -8) = 0x180028f8d; - iVar22 = memcmp(local_750,local_758,(ulonglong)local_804); - if (iVar22 != 0) goto LAB_17; - } - if (puVar62[-6] != *(longlong *)(lVar63 + 0x1f0)) goto LAB_17; - pIVar61 = *(IMAGE_DOS_HEADER **)&pIVar46->e_lfarlc; - pIVar42 = pIVar65; - local_780 = pIVar46; - } - pIVar38 = local_780; - uVar29 = 0; - *(undefined8 *)(puVar55 + -8) = 0x180028fd8; + local_758 = (void *)(lVar44 + 0x184); + sVar75 = 0x10; + } + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800291d3; + iVar25 = memcmp(param_4,local_758,sVar75); + if (iVar25 != 0) goto LAB_20; + if ((byte)(cVar17 - 7U) < 2) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800291fc; + IkeAddrGetAddrBytesHigh(pcVar35,(longlong *)&local_750,&local_804); + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002920c; + IkeAddrGetAddrBytesHigh((char *)(lVar44 + 0x178),(longlong *)&local_758,&local_804); + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002921d; + iVar25 = memcmp(local_750,local_758,(ulonglong)local_804); + if (iVar25 != 0) goto LAB_20; + } + if (puVar67[-6] != *(longlong *)(lVar44 + 0x1f0)) goto LAB_20; + pIVar71 = *(IMAGE_DOS_HEADER **)&pIVar53->e_lfarlc; + pIVar49 = pIVar74; + local_780 = pIVar53; + } + pIVar42 = local_780; + uVar32 = 0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029268; local_788 = local_780; - lVar63 = IkeReturnError(0,"IkeNextFindAddrMatch",pIVar42,param_4); - pIVar46 = local_7c0; - pIVar68 = (IMAGE_DOS_HEADER *)local_7f0.Blink; - if (lVar63 != 0) goto LAB_18; - if (pIVar61 == local_7c0) { - pIVar42 = (IMAGE_DOS_HEADER *)0x0; - *(undefined8 *)(puVar55 + -8) = 0x180029183; + lVar44 = IkeReturnError(0,"IkeNextFindAddrMatch",pIVar49,param_4); + pIVar53 = local_7c0; + pIVar78 = (IMAGE_DOS_HEADER *)local_7f0.Blink; + if (lVar44 != 0) goto LAB_21; + if (pIVar71 == local_7c0) { + pIVar49 = (IMAGE_DOS_HEADER *)0x0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029413; RtlRemoveEntryHashTable(gIkeExtGlobals[0x11].e_res_4_ + 2); - pIVar61 = gIkeExtGlobals; - pIVar65 = gIkeExtGlobals + 0x11; - uVar25 = *(uint *)gIkeExtGlobals[0x11].e_res2_10_; - uVar60 = *(uint *)(gIkeExtGlobals[0x11].e_res2_10_ + 6); - local_7f0.Blink = (_LIST_ENTRY *)pIVar38; - pIVar68 = pIVar38; - if (uVar60 <= uVar25 * 3) goto joined_r0x0001800291d8; - goto LAB_19; - } - } while (pIVar61 != (IMAGE_DOS_HEADER *)0x0); + pIVar71 = gIkeExtGlobals; + pIVar74 = gIkeExtGlobals + 0x11; + uVar28 = *(uint *)(gIkeExtGlobals[0x11].e_res2_10_ + 6); + local_7f0.Blink = (_LIST_ENTRY *)pIVar42; + pIVar78 = pIVar42; + if (*(uint *)gIkeExtGlobals[0x11].e_res2_10_ * 3 < uVar28) goto LAB_22; + if (*(uint *)gIkeExtGlobals[0x11].e_res2_10_ <= uVar28) goto LAB_21; + goto LAB_23; + } + } while (pIVar71 != (IMAGE_DOS_HEADER *)0x0); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)0x1; - pIVar42 = (IMAGE_DOS_HEADER *)0x490; - *(undefined8 *)(puVar55 + -8) = 0x180029010; - lVar63 = WfpReportSysErrorAsWinError(uVar29,"IkeRemoveMMSAFromAddrHash",0x490,1); - pIVar68 = (IMAGE_DOS_HEADER *)local_7f0.Blink; - goto LAB_18; -switchD_180027a59_caseD_1: - wVar15 = pIVar42->e_sp; + pIVar49 = (IMAGE_DOS_HEADER *)0x490; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800292a0; + lVar44 = WfpReportSysErrorAsWinError(uVar32,"IkeRemoveMMSAFromAddrHash",0x490,1); + pIVar78 = (IMAGE_DOS_HEADER *)local_7f0.Blink; + goto LAB_21; +switchD_180027ce9_caseD_1: + wVar16 = pIVar49->e_sp; local_7f8 = CONCAT22(local_7f8._2_2_,*(undefined2 *)((longlong)param_1 + 0x7a)); - TraceLogHelper("IkeGetNextPayloadString",1,pcVar64,param_4); - pcVar39 = "UNKNOWN"; - switch((char)wVar15) { + TraceLogHelper("IkeGetNextPayloadString",1,pcVar35,param_4); + pcVar43 = "UNKNOWN"; + switch((char)wVar16) { case '\x01': case '!': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_SA; break; default: unaff_RSI = (IMAGE_DOS_HEADER *)"UNKNOWN"; break; case '\x04': case '\"': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_KE; break; case '\x05': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_ID; break; case '\x06': case '%': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_CERT; break; case '\a': case '&': unaff_RSI = (IMAGE_DOS_HEADER *)"CERT_REQ"; break; case '\b': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_HASH; break; case '\t': unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_SIG; break; case '\n': case '(': unaff_RSI = (IMAGE_DOS_HEADER *)"NONCE"; break; case '\v': case ')': unaff_RSI = (IMAGE_DOS_HEADER *)"NOTIFY"; break; case '\f': case '*': unaff_RSI = (IMAGE_DOS_HEADER *)"DELETE"; break; case '\r': case '+': unaff_RSI = (IMAGE_DOS_HEADER *)"VENDOR_ID"; break; case '\x14': unaff_RSI = (IMAGE_DOS_HEADER *)"NATDISC"; break; case '\x15': unaff_RSI = (IMAGE_DOS_HEADER *)"NATOA"; break; case '#': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_IDi_STR; break; case '$': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_IDr_STR; break; case '\'': case -0x79: unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_AUTH; break; case ',': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_TSi_STR; break; case '-': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_TSr_STR; break; case '.': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_ENCR_STR; break; case '/': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_CP_STR; break; case '0': unaff_RSI = (IMAGE_DOS_HEADER *)&IKEV2_EAP_STR; break; case '5': case -0x7c: unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_FRAG; break; case -0x7f: unaff_RSI = (IMAGE_DOS_HEADER *)&IKE_SSPI_PAYLOAD; break; case -0x7b: unaff_RSI = (IMAGE_DOS_HEADER *)"CRYPTO"; break; case -0x7a: unaff_RSI = (IMAGE_DOS_HEADER *)"SSPI_ID"; } - wVar15 = local_7c8->e_csum; - TraceLogHelper("IkeGetExchTypeString",1,pcVar64,param_4); - uVar29 = 0x180000000; - switch((char)wVar15) { + wVar16 = local_7c8->e_csum; + TraceLogHelper("IkeGetExchTypeString",1,pcVar35,param_4); + uVar32 = 0x180000000; + switch((char)wVar16) { case '\x02': - pcVar39 = "IKE Main Mode"; + pcVar43 = "IKE Main Mode"; break; case '\x05': - pcVar39 = "IKE Informational Mode"; + pcVar43 = "IKE Informational Mode"; break; case ' ': - pcVar39 = "IKE Quick Mode"; + pcVar43 = "IKE Quick Mode"; break; case '\"': - pcVar39 = "IKEv2 SA Init Mode"; + pcVar43 = "IKEv2 SA Init Mode"; break; case '#': - pcVar39 = "IKEv2 Auth Mode"; + pcVar43 = "IKEv2 Auth Mode"; break; case '$': - pcVar39 = "IKEv2 Create Child Mode"; + pcVar43 = "IKEv2 Create Child Mode"; break; case '%': - pcVar39 = "IKEv2 Informational Mode"; + pcVar43 = "IKEv2 Informational Mode"; break; case '5': - pcVar39 = "IKEv2 Encrypt Fragment Payload"; + pcVar43 = "IKEv2 Encrypt Fragment Payload"; break; case -0xd: - pcVar39 = "Authip Main Mode"; + pcVar43 = "Authip Main Mode"; break; case -0xc: - pcVar39 = "Authip Quick Mode"; + pcVar43 = "Authip Quick Mode"; break; case -0xb: - pcVar39 = "Authip User Mode"; + pcVar43 = "Authip User Mode"; break; case -10: - pcVar39 = "Authip Informational Mode"; + pcVar43 = "Authip Informational Mode"; } local_7b8 = param_1[0x16]; unaff_RDI = (IMAGE_DOS_HEADER *)(ulonglong)*(uint *)(param_1 + 0x17); local_788 = (IMAGE_DOS_HEADER *) CONCAT44(local_788._4_4_,(uint)*(byte *)((longlong)param_1 + 0x75)); - uVar19 = ntohs((u_short)local_7f8); - local_7b0 = CONCAT44(local_7b0._4_4_,(uint)uVar19); + uVar22 = ntohs((u_short)local_7f8); + local_7b0 = CONCAT44(local_7b0._4_4_,(uint)uVar22); local_7c0 = (IMAGE_DOS_HEADER *) CONCAT44(local_7c0._4_4_,(uint)*(byte *)((longlong)param_1 + 0x39)); - uVar20 = ntohs(uVar20); - uVar23._0_2_ = local_7c8->e_ip; - uVar23._2_2_ = local_7c8->e_cs; - uVar21 = htonl(uVar23); + uVar23 = ntohs(uVar23); + uVar26._0_2_ = local_7c8->e_ip; + uVar26._2_2_ = local_7c8->e_cs; + uVar24 = htonl(uVar26); hostlong._0_2_ = local_7c8->e_lfarlc; hostlong._2_2_ = local_7c8->e_ovno; local_7f8 = CONCAT31(local_7f8._1_3_,*(undefined1 *)((longlong)&local_7c8->e_csum + 1)); - uVar23 = htonl(hostlong); - pIVar42 = (IMAGE_DOS_HEADER *)(ulonglong)uVar23; + uVar26 = htonl(hostlong); + pIVar49 = (IMAGE_DOS_HEADER *)(ulonglong)uVar26; if ((Microsoft_Windows_WFPEnableBits & 0x80) != 0) { param_4 = (PRTL_CRITICAL_SECTION_DEBUG)local_1b8; - pIVar42 = (IMAGE_DOS_HEADER *)(local_1b8 + 0x18); + pIVar49 = (IMAGE_DOS_HEADER *)(local_1b8 + 0x18); McTemplateU0sssqsuqzqqzqqxq_EtwEventWriteTransfer - ((ulonglong)(uint)uVar20,uVar29,(char *)pIVar42,(char *)param_4,pcVar39, - CONCAT44(uVar73,uVar23),unaff_RSI->e_magic, + ((ulonglong)(uint)uVar23,uVar32,(char *)pIVar49,(char *)param_4,pcVar43, + CONCAT44(uVar84,uVar26),unaff_RSI->e_magic, CONCAT44(in_stack_fffffffffffff794, - CONCAT31((int3)((uint)uVar74 >> 8),(undefined1)local_7f8)), - CONCAT44(in_stack_fffffffffffff79c,uVar21),local_d8, - CONCAT44(in_stack_fffffffffffff7ac,(uint)uVar20), + CONCAT31((int3)((uint)uVar76 >> 8),(undefined1)local_7f8)), + CONCAT44(in_stack_fffffffffffff79c,uVar24),local_d8, + CONCAT44(in_stack_fffffffffffff7ac,(uint)uVar23), CONCAT44(in_stack_fffffffffffff7b4,local_7c0._0_4_),local_178); } - cVar16 = EtwEventEnabled(WfpEventTraceHandle,&IKE_PACKET_RECV); - if (cVar16 != '\0') { + cVar17 = EtwEventEnabled(WfpEventTraceHandle,&IKE_PACKET_RECV); + if (cVar17 != '\0') { EtwEventActivityIdControl(2,local_660 + 0x18); } - puVar51 = auStackY_8a8; - if (pIVar65 != (IMAGE_DOS_HEADER *)0x0) { -LAB_20: - puVar55 = puVar51; - local_660._104_8_ = *(undefined8 *)(pIVar65[7].e_program + 0x20); - *(undefined8 *)(puVar55 + -8) = 0x1800284fd; - EnterCriticalSection((LPCRITICAL_SECTION)(pIVar65->e_res2_10_ + 4)); - uVar9 = *(ushort *)pIVar65[1].e_program; - if (0x1d < uVar9) { + puVar67 = auStackY_8b0 + 1; + if (pIVar74 != (IMAGE_DOS_HEADER *)0x0) { +LAB_24: + puVar66 = puVar67; + local_660._104_8_ = *(undefined8 *)(pIVar74[7].e_program + 0x20); + puVar66[0xffffffffffffffff] = 0x18002878d; + EnterCriticalSection((LPCRITICAL_SECTION)(pIVar74->e_res2_10_ + 4)); + uVar57 = *(ushort *)pIVar74[1].e_program; + if (0x1d < uVar57) { if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - *(undefined8 *)(puVar55 + -8) = 0x180028539; + puVar66[0xffffffffffffffff] = 0x1800287c9; unaff_RSI = (IMAGE_DOS_HEADER *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x180028541; + puVar66[0xffffffffffffffff] = 0x1800287d1; param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - pIVar42 = (IMAGE_DOS_HEADER *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; - *(uint *)(puVar55 + 0x30) = (uint)uVar9; - *(IMAGE_DOS_HEADER **)(puVar55 + 0x28) = pIVar65; - *(IMAGE_DOS_HEADER **)(puVar55 + 0x20) = unaff_RSI; - pIVar46 = WPP_GLOBAL_Control[2]; - *(undefined8 *)(puVar55 + -8) = 0x18002856e; - WPP_SF_iSqd(pIVar46,0xe,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - *(wchar_t **)(puVar55 + 0x20)); + pIVar49 = (IMAGE_DOS_HEADER *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + *(uint *)(puVar66 + 6) = (uint)uVar57; + puVar66[5] = pIVar74; + puVar66[4] = unaff_RSI; + pIVar53 = WPP_GLOBAL_Control[2]; + puVar66[0xffffffffffffffff] = 0x1800287fe; + WPP_SF_iSqd(pIVar53,0xe,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, + (wchar_t *)puVar66[4]); } if (4 < DAT_0) { - *(undefined8 *)(puVar55 + -8) = 0x180028589; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { - *(undefined8 *)(puVar55 + -8) = 0x180028596; + puVar66[0xffffffffffffffff] = 0x180028819; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { + puVar66[0xffffffffffffffff] = 0x180028826; local_6e0 = IkeGetTlsMmLuid(); local_3b8 = &local_6e0; local_3b0 = 8; - *(undefined8 *)(puVar55 + -8) = 0x1800285bb; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x1800285ca; - _tlgCreate1Sz_wchar_t(local_3a8,pwVar26); - *(undefined8 *)(puVar55 + -8) = 0x1800285dd; + puVar66[0xffffffffffffffff] = 0x18002884b; + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + puVar66[0xffffffffffffffff] = 0x18002885a; + _tlgCreate1Sz_wchar_t(local_3a8,pwVar29); + puVar66[0xffffffffffffffff] = 0x18002886d; _tlgCreate1Sz_char(local_398,"Too many packets queued on MM. Dropping packet."); local_388 = local_7d8; - local_7d8[0] = (uint)*(ushort *)pIVar65[1].e_program; + local_7d8[0] = (uint)*(ushort *)pIVar74[1].e_program; local_378 = &local_6d8; local_380 = 4; - *(undefined1 **)(puVar55 + 0x28) = local_3d8; - *(undefined4 *)(puVar55 + 0x20) = 7; - local_6d8 = pIVar65; + puVar66[5] = local_3d8; + *(undefined4 *)(puVar66 + 4) = 7; + local_6d8 = pIVar74; local_370 = 8; - *(undefined8 *)(puVar55 + -8) = 0x180028645; + puVar66[0xffffffffffffffff] = 0x1800288d5; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_21,pIVar42,param_4,*(undefined4 *)(puVar55 + 0x20), - *(undefined8 **)(puVar55 + 0x28)); - } - } - *(undefined8 *)(puVar55 + -8) = 0x180028650; - LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar65->e_res2_10_ + 4)); - puVar51 = puVar55; - goto LAB_11; - } - pIVar42 = *(IMAGE_DOS_HEADER **)(pIVar65->e_program + 0x28); - if (*(IMAGE_DOS_HEADER **)pIVar42 == (IMAGE_DOS_HEADER *)(pIVar65->e_program + 0x20)) { - *param_1 = (IMAGE_DOS_HEADER *)(pIVar65->e_program + 0x20); - param_1[1] = pIVar42; - *(IMAGE_DOS_HEADER ***)pIVar42 = param_1; - *(IMAGE_DOS_HEADER ***)(pIVar65->e_program + 0x28) = param_1; - *(short *)pIVar65[1].e_program = *(short *)pIVar65[1].e_program + 1; - *(undefined8 *)(puVar55 + -8) = 0x1800287a5; - LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar65->e_res2_10_ + 4)); + (0x180165278,&DAT_25,pIVar49,param_4,*(undefined4 *)(puVar66 + 4), + (undefined8 *)puVar66[5]); + } + } + puVar66[0xffffffffffffffff] = 0x1800288e0; + LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar74->e_res2_10_ + 4)); + puVar67 = puVar66; + goto LAB_13; + } + pIVar49 = *(IMAGE_DOS_HEADER **)(pIVar74->e_program + 0x28); + if (*(IMAGE_DOS_HEADER **)pIVar49 == (IMAGE_DOS_HEADER *)(pIVar74->e_program + 0x20)) { + *param_1 = (IMAGE_DOS_HEADER *)(pIVar74->e_program + 0x20); + param_1[1] = pIVar49; + *(IMAGE_DOS_HEADER ***)pIVar49 = param_1; + *(IMAGE_DOS_HEADER ***)(pIVar74->e_program + 0x28) = param_1; + *(short *)pIVar74[1].e_program = *(short *)pIVar74[1].e_program + 1; + puVar66[0xffffffffffffffff] = 0x180028a35; + LeaveCriticalSection((LPCRITICAL_SECTION)(pIVar74->e_res2_10_ + 4)); param_1 = (IMAGE_DOS_HEADER **)0x0; - uVar45 = 0; - *(undefined8 *)(puVar55 + -8) = 0x1800287b7; - uVar29 = TryRefSA((longlong)pIVar65,0,0,param_4); - if ((int)uVar29 == 0) { - *(undefined8 *)(puVar55 + -8) = 0x1800287cd; - puVar40 = (uint *)gIkeExtGlobals; + uVar52 = 0; + puVar66[0xffffffffffffffff] = 0x180028a47; + uVar32 = TryRefSA((longlong)pIVar74,0,0,param_4); + if ((int)uVar32 == 0) { + puVar66[0xffffffffffffffff] = 0x180028a5d; + puVar41 = (uint *)gIkeExtGlobals; LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - unaff_RSI = pIVar49; + unaff_RSI = pIVar59; } else { - *(undefined8 *)(puVar55 + -8) = 0x180028900; - BVar24 = TryEnterCriticalSection((LPCRITICAL_SECTION)pIVar65); - *(undefined8 *)(puVar55 + -8) = 0x180028915; - puVar40 = (uint *)gIkeExtGlobals; + puVar66[0xffffffffffffffff] = 0x180028b90; + BVar27 = TryEnterCriticalSection((LPCRITICAL_SECTION)pIVar74); + puVar66[0xffffffffffffffff] = 0x180028ba5; + puVar41 = (uint *)gIkeExtGlobals; LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); unaff_RSI = (IMAGE_DOS_HEADER *)0x1; - if (BVar24 != 0) { - *(undefined8 *)(puVar55 + -8) = 0x18002892f; + if (BVar27 != 0) { + puVar66[0xffffffffffffffff] = 0x180028bbf; IkeFinishMMSAProcessing - ((PRTL_CRITICAL_SECTION_DEBUG)pIVar65,uVar45, + ((PRTL_CRITICAL_SECTION_DEBUG)pIVar74,uVar52, (PRTL_CRITICAL_SECTION_DEBUG)param_1,param_4); - pcVar39 = pIVar65->e_magic; + pcVar43 = pIVar74->e_magic; goto LAB_7; } } if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - *(undefined8 *)(puVar55 + -8) = 0x1800287f8; - lVar63 = IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x180028800; + puVar66[0xffffffffffffffff] = 0x180028a88; + lVar44 = IkeGetTlsPeerAddr(); + puVar66[0xffffffffffffffff] = 0x180028a90; param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); param_1 = (IMAGE_DOS_HEADER **)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; - *(IMAGE_DOS_HEADER **)(puVar55 + 0x28) = pIVar65; - *(longlong *)(puVar55 + 0x20) = lVar63; - puVar40 = (uint *)WPP_GLOBAL_Control[2]; - *(undefined8 *)(puVar55 + -8) = 0x180028829; - WPP_SF_iSq(puVar40,0xf,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - *(wchar_t **)(puVar55 + 0x20)); + puVar66[5] = pIVar74; + puVar66[4] = lVar44; + puVar41 = (uint *)WPP_GLOBAL_Control[2]; + puVar66[0xffffffffffffffff] = 0x180028ab9; + WPP_SF_iSq(puVar41,0xf,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, + (wchar_t *)puVar66[4]); } if (4 < DAT_0) { - puVar40 = &DAT_0; - *(undefined8 *)(puVar55 + -8) = 0x180028844; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { - *(undefined8 *)(puVar55 + -8) = 0x180028851; + puVar41 = &DAT_0; + puVar66[0xffffffffffffffff] = 0x180028ad4; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { + puVar66[0xffffffffffffffff] = 0x180028ae1; local_6d0 = IkeGetTlsMmLuid(); local_348 = &local_6d0; local_340 = 8; - *(undefined8 *)(puVar55 + -8) = 0x180028876; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar55 + -8) = 0x180028885; - _tlgCreate1Sz_wchar_t(local_338,pwVar26); - *(undefined8 *)(puVar55 + -8) = 0x180028898; + puVar66[0xffffffffffffffff] = 0x180028b06; + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + puVar66[0xffffffffffffffff] = 0x180028b15; + _tlgCreate1Sz_wchar_t(local_338,pwVar29); + puVar66[0xffffffffffffffff] = 0x180028b28; _tlgCreate1Sz_char(local_328,"Packet queued inside MM SA, and will be processed later"); - local_6c8 = pIVar65; + local_6c8 = pIVar74; local_318 = &local_6c8; local_310 = 8; - *(undefined1 **)(puVar55 + 0x28) = local_368; - puVar40 = &DAT_0; - *(undefined4 *)(puVar55 + 0x20) = 6; - *(undefined8 *)(puVar55 + -8) = 0x1800288df; + puVar66[5] = local_368; + puVar41 = &DAT_0; + *(undefined4 *)(puVar66 + 4) = 6; + puVar66[0xffffffffffffffff] = 0x180028b6f; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_22,param_1,param_4,*(undefined4 *)(puVar55 + 0x20), - *(undefined8 **)(puVar55 + 0x28)); - } - } - pcVar39 = (char *)puVar40; + (0x180165278,&DAT_26,param_1,param_4,*(undefined4 *)(puVar66 + 4), + (undefined8 *)puVar66[5]); + } + } + pcVar43 = (char *)puVar41; if ((int)unaff_RSI != 0) { - *(undefined8 *)(puVar55 + -8) = 0x1800288f1; - IkeDerefMMSA((longlong)pIVar65,0,(undefined *)param_1,param_4); - pcVar39 = pIVar65->e_magic; + puVar66[0xffffffffffffffff] = 0x180028b81; + IkeDerefMMSA((longlong)pIVar74,0,(undefined *)param_1,param_4); + pcVar43 = pIVar74->e_magic; } goto LAB_7; } -LAB_10: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(3); - puVar56 = puVar55 + 8; -switchD_180027617_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar57 = puVar56 + 8; -switchD_180027027_caseD_2: - puVar40 = (uint *)&DAT_12; - pcVar11 = (code *)swi(0x29); - (*pcVar11)(); - uVar25 = in(0x98); - iVar22 = CONCAT31((int3)(uVar25 >> 8),(char)uVar25 + *(char *)(ulonglong)uVar25); - uVar25 = iVar22 + 0xa4fffd90; - pcVar64 = (char *)(ulonglong)uVar25; - bVar34 = (byte)((ulonglong)puVar40 >> 8); - if (!SBORROW4(iVar22,0x5b000270)) { - pcVar64 = (char *)(ulonglong) - (CONCAT31((int3)(uVar25 >> 8),(char)uVar25 + *pcVar64) + 0xa4fffd90); - } - iVar13 = (int3)(char)((ulonglong)pcVar64 >> 8); - cVar16 = (char)pcVar64 + *(char *)(ulonglong)(uint)(int)(short)pcVar64; - cVar16 = cVar16 + *(char *)(ulonglong)CONCAT31(iVar13,cVar16); - pcVar64 = (char *)(ulonglong)CONCAT31(iVar13,cVar16); - *(int *)&unaff_RSI->e_cblp = *(int *)&unaff_RSI->e_cblp - (int)unaff_RSI; - bVar70 = CARRY1((byte)*puVar40,bVar34); - *(byte *)puVar40 = (byte)*puVar40 + bVar34; - bVar72 = (char)(byte)*puVar40 < '\0'; - bVar71 = (byte)*puVar40 == 0; - if (bVar70 || bVar71) { - if (!bVar70 && !bVar71) { - bVar70 = CARRY1((byte)*puVar40,bVar34); - *(byte *)puVar40 = (byte)*puVar40 + bVar34; - bVar72 = (char)(byte)*puVar40 < '\0'; - bVar71 = (byte)*puVar40 == 0; - } +LAB_9: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(3); + puVar67 = (undefined8 *)((longlong)puVar66 + 8); +switchD_1800278a7_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar68 = puVar67 + 1; +switchD_1800272b7_caseD_2: + lVar44 = 0x25; + pcVar14 = (code *)swi(0x29); + pcVar35 = (char *)(*pcVar14)(); + puVar66 = puVar68 + 1; + puVar67 = puVar68 + 1; + uVar38 = (undefined7)((ulonglong)pcVar35 >> 8); + cVar17 = (char)pcVar35 + *pcVar35; + pbVar50 = (byte *)CONCAT71(uVar38,cVar17); + if (cVar17 != '\0') { + *pbVar50 = *pbVar50 + cVar17; + goto code_r0x000180029b23; + } + bVar56 = (byte)((ulonglong)lVar44 >> 8); + DAT_27 = DAT_27 + bVar56; + cVar17 = *pbVar50 + *(char *)CONCAT71(uVar38,*pbVar50); + out(unaff_RSI->e_magic[0],(short)pIVar49); + cVar17 = cVar17 + *(char *)CONCAT71(uVar38,cVar17); + pwVar40 = (word *)((longlong)&unaff_RSI->e_cp + 1); + cVar46 = (char)pIVar49; + if (cVar17 < '\0') { + bVar82 = true; } else { - bVar70 = false; - bVar72 = DAT_23 < '\0'; - bVar71 = DAT_23 == '\0'; - } - bVar36 = (byte)puVar40; - uVar41 = SUB82(pIVar42,0); - bVar33 = (byte)((ulonglong)pIVar42 >> 8); - if (bVar70 || bVar71) { - if (!bVar72) { - pIVar42->e_magic[0] = cVar16; - pIVar42->e_magic[1] = (char)iVar13; - pIVar42->e_cblp = (short)((uint3)iVar13 >> 8); - goto code_r0x000180029933; - } - *(byte *)((longlong)puVar40 + -0x77) = *(byte *)((longlong)puVar40 + -0x77) + bVar36; - cVar16 = cVar16 + *pcVar64; - *in_R10 = (char *)(ulonglong)CONCAT31(iVar13,cVar16); - *(byte *)((longlong)puVar40 + 0x79) = *(byte *)((longlong)puVar40 + 0x79) + cVar16; - cVar16 = cVar16 + *(char *)(ulonglong)CONCAT31(iVar13,cVar16); - pcVar64 = (char *)(ulonglong)CONCAT31(iVar13,cVar16); - bVar70 = cVar16 < '\0'; - pIVar49 = (IMAGE_DOS_HEADER *)&unaff_RSI->e_cp; - uVar4._0_1_ = unaff_RSI->e_magic[0]; - uVar4._1_1_ = unaff_RSI->e_magic[1]; - uVar4._2_2_ = unaff_RSI->e_cblp; - out(uVar4,uVar41); -LAB_24_2: - if (!bVar70) goto code_r0x000180029941; - unaff_RDI->e_program[0x39] = unaff_RDI->e_program[0x39] + bVar34; - uVar35 = (undefined7)((ulonglong)pcVar64 >> 8); - cVar16 = (char)pcVar64 + *pcVar64; - pcVar64 = (char *)CONCAT71(uVar35,cVar16); - bVar70 = false; - if (-1 < cVar16) goto code_r0x000180029949; - unaff_RDI->e_program[0x39] = unaff_RDI->e_program[0x39] + bVar34; - pcVar64 = (char *)CONCAT71(uVar35,cVar16 + *pcVar64 + - *(char *)CONCAT71(uVar35,cVar16 + *pcVar64)); - uVar25 = (uint)pcVar64; - pIVar42->e_magic[0] = (char)uVar25; - pIVar42->e_magic[1] = (char)(uVar25 >> 8); - pIVar42->e_cblp = (short)(uVar25 >> 0x10); + pcVar35 = (char *)(lVar44 + -0x46fffd88); + *pcVar35 = *pcVar35; + bVar82 = *pcVar35 < '\0'; + cVar17 = *pcVar35; + } + if (bVar82) { + bVar82 = true; } else { - *(byte *)((longlong)puVar40 + 0x79) = *(byte *)((longlong)puVar40 + 0x79) + cVar16; - pcVar64 = (char *)(ulonglong)CONCAT31(iVar13,cVar16 + *pcVar64); - *in_R10 = pcVar64; -code_r0x000180029933: - *(byte *)((longlong)puVar40 + -0x77) = *(byte *)((longlong)puVar40 + -0x77) + bVar36; - uVar35 = (undefined7)((ulonglong)pcVar64 >> 8); - cVar16 = (char)pcVar64 + *pcVar64; - pcVar64 = (char *)CONCAT71(uVar35,cVar16); - bVar70 = cVar16 < '\0'; - pIVar49 = unaff_RSI; - if (!bVar70) goto LAB_24_2; - unaff_RDI->e_program[0x39] = unaff_RDI->e_program[0x39] + bVar34; - cVar7 = *pcVar64; - pcVar64 = (char *)CONCAT71(uVar35,cVar16 + cVar7); - bVar70 = (char)(cVar16 + cVar7) < '\0'; - pIVar49 = (IMAGE_DOS_HEADER *)&unaff_RSI->e_cp; - uVar5._0_1_ = unaff_RSI->e_magic[0]; - uVar5._1_1_ = unaff_RSI->e_magic[1]; - uVar5._2_2_ = unaff_RSI->e_cblp; - out(uVar5,uVar41); -code_r0x000180029941: - if (bVar70) { - *(byte *)((longlong)puVar40 + 0x79) = *(byte *)((longlong)puVar40 + 0x79) + (char)pcVar64; - cVar16 = (char)pcVar64 + *pcVar64; - pcVar64 = (char *)CONCAT71((int7)((ulonglong)pcVar64 >> 8),cVar16); - bVar70 = cVar16 < '\0'; - uVar6._0_1_ = pIVar49->e_magic[0]; - uVar6._1_1_ = pIVar49->e_magic[1]; - uVar6._2_2_ = pIVar49->e_cblp; - out(uVar6,uVar41); - pIVar49 = (IMAGE_DOS_HEADER *)&pIVar49->e_cp; + cVar17 = DAT_28 + bVar56; + bVar82 = cVar17 < '\0'; + DAT_28 = cVar17; + } + if (!bVar82) { + cVar17 = (char)lVar44 + cVar46; + lVar44 = CONCAT71((int7)((ulonglong)lVar44 >> 8),cVar17); + } + if ((POPCOUNT(cVar17) & 1U) == 0) { + lVar44 = CONCAT71((int7)((ulonglong)lVar44 >> 8),(char)lVar44 + bVar56); + } + cVar17 = (char)lVar44 + bVar56; + uVar2._0_1_ = pIVar49->e_magic[0]; + uVar6 = pIVar49->e_magic[1]; + uVar10 = pIVar49->e_cblp; + uVar2._1_3_ = CONCAT21(uVar10,uVar6); + bVar39 = cVar17 + cVar46; + bVar45 = POPCOUNT(bVar39) & 1; + bVar18 = bVar39; + if (bVar45 == 0) { + bVar18 = 0; + } + bVar83 = bVar45 != 0 && SCARRY1(cVar17,cVar46); + pbVar50 = (byte *)(ulonglong)bVar56; + bVar82 = false; + if (bVar45 == 0) { + bVar83 = SCARRY1(bVar39,cVar46); + bVar39 = bVar39 + cVar46; + bVar82 = (POPCOUNT(bVar39) & 1U) == 0; + bVar18 = bVar39; + } + puVar41 = (uint *)CONCAT71((int7)((ulonglong)lVar44 >> 8),bVar39); + if (bVar82) { + bVar83 = false; + bVar18 = 0; + } + uVar47 = (undefined6)((ulonglong)lVar44 >> 0x10); + bVar45 = (byte)((ulonglong)lVar44 >> 8); + if (bVar82) { + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + (undefined1)uVar2; + cVar17 = (undefined1)uVar2 + *(char *)(ulonglong)uVar2; + uVar28 = CONCAT31(uVar2._1_3_,cVar17); + pbVar36 = pbVar50 + -0x742dfffe; + *pbVar36 = *pbVar36 >> (bVar39 & 7) | *pbVar36 << 8 - (bVar39 & 7); + bVar83 = SCARRY1(cVar17,*(char *)(ulonglong)uVar28); + cVar17 = cVar17 + *(char *)(ulonglong)uVar28; + uVar28 = CONCAT31(uVar2._1_3_,cVar17); + pbVar36 = (byte *)(ulonglong)uVar28; + bVar82 = cVar17 < '\0'; + if (bVar83 == bVar82) { + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + cVar17; + bVar83 = SCARRY1(cVar17,*pbVar36); + bVar18 = *pbVar36; + uVar28 = CONCAT31(uVar2._1_3_,cVar17 + bVar18); + pbVar36 = (byte *)(ulonglong)uVar28; + bVar82 = (char)(cVar17 + bVar18) < '\0'; + if (bVar83 != bVar82) goto LAB_29_2; +code_r0x000180029bf3: + cVar17 = (char)pbVar36; + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + cVar17; + bVar83 = SCARRY1(cVar17,*pbVar36); + bVar18 = *pbVar36; + pbVar36 = (byte *)CONCAT71((int7)((ulonglong)pbVar36 >> 8),cVar17 + bVar18); + bVar82 = (char)(cVar17 + bVar18) < '\0'; + if (bVar83 == bVar82) { +code_r0x000180029bfb: + unaff_RSI[1].e_magic[1] = unaff_RSI[1].e_magic[1] + (char)((ulonglong)pIVar49 >> 8); + goto code_r0x000180029bfe; + } } else { - bVar70 = false; - } -code_r0x000180029949: - if (bVar70) { - unaff_RDI[0x840004].e_program[0x39] = unaff_RDI[0x840004].e_program[0x39] + bVar33; - } - uVar25 = (uint)pcVar64; - pIVar42->e_magic[0] = (char)uVar25; - pIVar42->e_magic[1] = (char)(uVar25 >> 8); - pIVar42->e_cblp = (short)(uVar25 >> 0x10); - } - pcVar39 = (char *)((longlong)&pIVar42[-1].e_cparhdr + 1); - *pcVar39 = *pcVar39 + (char)pcVar64; - uVar35 = (undefined7)((ulonglong)pcVar64 >> 8); - cVar16 = (char)pcVar64 + *pcVar64; - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - out(0x79,cVar16); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - bVar17 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - out(0x79,bVar17); - bVar17 = bVar17 + *(byte *)CONCAT71(uVar35,bVar17) + 'z' + - CARRY1(bVar17,*(byte *)CONCAT71(uVar35,bVar17)); - cVar16 = bVar17 + *(byte *)CONCAT71(uVar35,bVar17) + 'z' + - CARRY1(bVar17,*(byte *)CONCAT71(uVar35,bVar17)); - bVar17 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - out(0x79,bVar17); - cVar16 = bVar17 + *(byte *)CONCAT71(uVar35,bVar17) + 'z' + - CARRY1(bVar17,*(byte *)CONCAT71(uVar35,bVar17)); - cVar16 = cVar16 + *(char *)CONCAT71(uVar35,cVar16); - pbVar43 = (byte *)CONCAT71(uVar35,cVar16); - if ((POPCOUNT(cVar16) & 1U) == 0) { - uVar25 = (uint)pbVar43; - pIVar42->e_magic[0] = (char)uVar25; - pIVar42->e_magic[1] = (char)(uVar25 >> 8); - pIVar42->e_cblp = (short)(uVar25 >> 0x10); - *(char *)((longlong)puVar40 * 5) = *(char *)((longlong)puVar40 * 5) + bVar33; - } - else { - *(char *)((longlong)puVar40 * 5) = *(char *)((longlong)puVar40 * 5) + bVar33; - pbVar43 = (byte *)(CONCAT71(uVar35,cVar16 + *pbVar43) ^ 0x89); - } - puVar55 = &DAT_25; - bVar70 = CARRY1((byte)pbVar43,*pbVar43); - uVar35 = (undefined7)((ulonglong)pbVar43 >> 8); - bVar17 = (byte)pbVar43 + *pbVar43; - pbVar43 = (byte *)CONCAT71(uVar35,bVar17); - pcVar64 = *(char **)(puVar57 + 0x10); - puVar58 = (undefined8 *)(puVar57 + 0x18); - if ((POPCOUNT(bVar17) & 1U) == 0) { - bVar71 = true; - } - else { - pcVar64[0x7a] = pcVar64[0x7a]; - bVar70 = CARRY1(bVar17,*pbVar43); - bVar47 = *pbVar43; - pbVar43 = (byte *)CONCAT71(uVar35,bVar17 + bVar47); - bVar71 = (POPCOUNT(bVar17 + bVar47) & 1U) == 0; - pcVar64 = *(char **)(puVar57 + 0x18); - puVar58 = (undefined8 *)(puVar57 + 0x20); - } - if (bVar71) { - bVar71 = true; - } - else { - pcVar64[0x7a] = pcVar64[0x7a]; - bVar70 = CARRY1((byte)pbVar43,*pbVar43); - cVar16 = (byte)pbVar43 + *pbVar43; - pbVar43 = (byte *)CONCAT71((int7)((ulonglong)pbVar43 >> 8),cVar16); - bVar71 = (POPCOUNT(cVar16) & 1U) == 0; - pcVar64 = (char *)*puVar58; - puVar58 = puVar58 + 1; - } - bVar17 = (byte)pbVar43; - if (bVar71) { - bVar71 = true; - } - else { - pbVar32 = pIVar49[-0x8bfffc].e_program + 0x3a; - bVar70 = CARRY1(*pbVar32,bVar34); - *pbVar32 = *pbVar32 + bVar34; - bVar71 = (POPCOUNT(*pbVar32) & 1U) == 0; - } - if (!bVar71) { - bVar70 = CARRY1(bVar33,bVar17); - pIVar42 = (IMAGE_DOS_HEADER *) - CONCAT62((int6)((ulonglong)pIVar42 >> 0x10),CONCAT11(bVar33 + bVar17,(char)pIVar42)) - ; - bVar71 = (POPCOUNT(bVar33 + bVar17) & 1U) == 0; - } - if (!bVar71) { - bVar33 = (byte)pIVar42; - bVar70 = CARRY1(bVar33,bVar33); - pIVar42 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar42 >> 8),bVar33 * '\x02'); - bVar71 = (POPCOUNT(bVar33 * '\x02') & 1U) == 0; - } - if (!bVar71) { - bVar70 = false; - bVar71 = (POPCOUNT((char)((ulonglong)pIVar42 >> 8)) & 1U) == 0; - } - if (!bVar71) { - bVar70 = CARRY1((byte)pIVar42,bVar34); - cVar16 = (byte)pIVar42 + bVar34; - pIVar42 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar42 >> 8),cVar16); - bVar71 = (POPCOUNT(cVar16) & 1U) == 0; - } - if (!bVar71) { - bVar33 = (byte)((ulonglong)pIVar42 >> 8); - bVar70 = CARRY1(bVar33,bVar33); - pIVar42 = (IMAGE_DOS_HEADER *) - CONCAT62((int6)((ulonglong)pIVar42 >> 0x10),CONCAT11(bVar33 * '\x02',(char)pIVar42)) - ; - bVar71 = (POPCOUNT(bVar33 * '\x02') & 1U) == 0; - } - if (!bVar71) { - bVar70 = CARRY1(pIVar42->e_magic[0],bVar17); - pIVar42->e_magic[0] = pIVar42->e_magic[0] + bVar17; - bVar71 = (POPCOUNT(pIVar42->e_magic[0]) & 1U) == 0; - } - bVar72 = false; - if (bVar71) { - bVar70 = CARRY1(pIVar49->e_magic[0],bVar36); - pIVar49->e_magic[0] = pIVar49->e_magic[0] + bVar36; - bVar72 = (POPCOUNT(pIVar49->e_magic[0]) & 1U) == 0; - } - bVar71 = false; - if (bVar72) { - bVar70 = false; - pIVar42->e_magic[0] = pIVar42->e_magic[0]; - bVar71 = (POPCOUNT(pIVar42->e_magic[0]) & 1U) == 0; - } - bVar72 = false; - if (bVar71) { - bVar33 = (byte)((ulonglong)pbVar43 >> 8); - bVar70 = CARRY1(pIVar49->e_magic[0],bVar33); - pIVar49->e_magic[0] = pIVar49->e_magic[0] + bVar33; - bVar72 = (POPCOUNT(pIVar49->e_magic[0]) & 1U) == 0; - } - bVar71 = false; - if (bVar72) { - bVar70 = 0x86 < DAT_25; - DAT_25 = DAT_25 + 0x79; - bVar71 = (POPCOUNT(DAT_25) & 1U) == 0; - } - bVar33 = (byte)pIVar42; - bVar47 = (byte)((ulonglong)pIVar42 >> 8); - if (bVar71) { - (&bRam0000000000007902)[(longlong)pcVar64 * 2] = - (&bRam0000000000007902)[(longlong)pcVar64 * 2] + bVar17; - *(byte *)((longlong)puVar40 + 0x7b) = *(byte *)((longlong)puVar40 + 0x7b) + bVar47; - bVar8 = *pbVar43; - uVar35 = (undefined7)((ulonglong)pbVar43 >> 8); - bVar18 = bVar17 + *pbVar43; - pbVar32 = (byte *)CONCAT71(uVar35,bVar18); - if ((POPCOUNT(bVar18) & 1U) == 0) { - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - (uint)CARRY1(bVar17,bVar8); - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < (uint)CARRY1(bVar17,bVar8)); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar2 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar2 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - 0x7900) - uVar2; - uVar25 = (uint)(uVar25 < 0x7900 || uVar60 - 0x7900 < uVar2); - uVar3._0_1_ = pIVar49->e_magic[0]; - uVar3._1_1_ = pIVar49->e_magic[1]; - uVar3._2_2_ = pIVar49->e_cblp; - uVar60 = *(uint *)pIVar49 - (uint)pIVar42; - *(uint *)pIVar49 = uVar60 - uVar25; - uVar2 = (uint)(uVar3 < (uint)pIVar42 || uVar60 < uVar25); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - 0x7900) - uVar2; - uVar25 = (uint)(uVar60 < 0x7900 || uVar25 - 0x7900 < uVar2); - iVar22 = (int)pbVar32 + -0x6ff0e7e9; - bVar71 = SCARRY4((int)pbVar32,-0x6ff0e7e9) != SCARRY4(iVar22,uVar25); - uVar25 = iVar22 + uVar25; - pcVar39 = (char *)(ulonglong)uVar25; - bVar70 = (int)uVar25 < 0; - uVar14 = (undefined3)(uVar25 >> 8); - cVar16 = (char)uVar25; - if ((POPCOUNT(uVar25 & 0xff) & 1U) == 0) { - bVar71 = SCARRY1(cRam0000000184029d21,bVar36); - cRam0000000184029d21 = cRam0000000184029d21 + bVar36; - bVar70 = cRam0000000184029d21 < '\0'; -code_r0x000180029aa5: - if (bVar71 == bVar70) { - bVar71 = SCARRY1(pIVar42->e_magic[0],'y'); - pIVar42->e_magic[0] = pIVar42->e_magic[0] + 'y'; - bVar70 = pIVar42->e_magic[0] < '\0'; + if (bVar83 != bVar82) goto code_r0x000180029bf1; +code_r0x000180029bef: + cVar17 = (char)pbVar36; + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + cVar17; + bVar83 = SCARRY1(cVar17,*pbVar36); + bVar18 = *pbVar36; + pbVar36 = (byte *)CONCAT71((int7)((ulonglong)pbVar36 >> 8),cVar17 + bVar18); + bVar82 = (char)(cVar17 + bVar18) < '\0'; + if (bVar83 == bVar82) goto code_r0x000180029bf7; +code_r0x000180029bf9: + if (bVar83 == bVar82) goto code_r0x000180029bfb; + } + if (bVar83 == bVar82) { + bVar56 = bVar56 + bVar39; + } + bVar56 = bVar56 + bVar39; + uVar4._0_1_ = pIVar49->e_magic[0]; + uVar8 = pIVar49->e_magic[1]; + uVar12 = pIVar49->e_cblp; + uVar4._1_3_ = CONCAT21(uVar12,uVar8); + bVar18 = (byte)((ulonglong)pIVar49 >> 8); + unaff_RSI[1].e_magic[1] = unaff_RSI[1].e_magic[1] + bVar18; + bVar83 = SCARRY1((undefined1)uVar4,*(char *)(ulonglong)uVar4); + cVar17 = (undefined1)uVar4 + *(char *)(ulonglong)uVar4; + uVar28 = CONCAT31(uVar4._1_3_,cVar17); + bVar82 = cVar17 < '\0'; + pwVar72 = (word *)(unaff_RDI->e_magic + 1); + unaff_RDI->e_magic[0] = *(byte *)pwVar40; + if (bVar83 == bVar82) { +code_r0x000180029c0f: + pcVar35 = (char *)((longlong)puVar68 + (longlong)pwVar72 * 2 + 0x7c76000a); + *pcVar35 = *pcVar35 + uVar8; + bVar83 = SCARRY1(cVar17,*(char *)(ulonglong)uVar28); + bVar82 = (char)(cVar17 + *(char *)(ulonglong)uVar28) < '\0'; + *(byte *)pwVar72 = (byte)unaff_RSI->e_crlc; + pwVar40 = (word *)((longlong)&unaff_RSI->e_crlc + 1); + pwVar72 = &unaff_RDI->e_cblp; + } + else { + if (bVar83 == bVar82) { + *(byte *)&unaff_RSI[1].e_cblp = (char)unaff_RSI[1].e_cblp + bVar18; + goto code_r0x000180029c0f; + } + pwVar40 = &unaff_RSI->e_crlc; + if (bVar83 == bVar82) { + pcVar35 = (char *)((longlong)puVar68 + (longlong)pwVar72 * 2 + 0x7cef000a); + *pcVar35 = *pcVar35 + uVar8; + /* WARNING: Bad instruction - Truncating control flow here */ + halt_baddata(); + } + } + bVar19 = 0; + if (bVar83 == bVar82) { + bVar19 = bVar45; + } + uVar5._0_1_ = pIVar49->e_magic[0]; + uVar9 = pIVar49->e_magic[1]; + uVar13 = pIVar49->e_cblp; + uVar5._1_3_ = CONCAT21(uVar13,uVar9); + pbVar37 = (byte *)(ulonglong)uVar5; + bVar83 = SCARRY1(bVar19,bVar45); + bVar60 = bVar19 + bVar45; + bVar82 = (char)bVar60 < '\0'; + bVar61 = bVar60; + if (bVar83 == bVar82) { + bVar83 = SCARRY1(bVar60,bVar45); + bVar61 = bVar60 + bVar45; + bVar82 = (char)bVar61 < '\0'; + bVar19 = bVar60; + } + bVar60 = bVar61; + if (bVar83 == bVar82) { + bVar83 = SCARRY1(bVar61,bVar45); + bVar60 = bVar61 + bVar45; + bVar82 = (char)bVar60 < '\0'; + bVar19 = bVar61; + } + bVar61 = bVar60; + if (bVar83 == bVar82) { + bVar83 = SCARRY1(bVar60,bVar45); + bVar61 = bVar60 + bVar45; + bVar82 = (char)bVar61 < '\0'; + bVar19 = bVar60; + } + bVar60 = bVar61; + if (bVar83 == bVar82) { + bVar83 = SCARRY1(bVar61,bVar45); + bVar60 = bVar61 + bVar45; + bVar82 = (char)bVar60 < '\0'; + bVar19 = bVar61; + } + uVar57 = CONCAT11(bVar60,bVar56); + bVar80 = CARRY1(bVar19,bVar45); + pbVar50 = (byte *)(ulonglong)uVar57; + bVar19 = bVar60; + if (bVar83 == bVar82) { + bVar80 = CARRY1((byte)*pwVar40,bVar60); + bVar83 = SCARRY1((byte)*pwVar40,bVar60); + *(byte *)pwVar40 = (byte)*pwVar40 + bVar60; + bVar82 = (char)(byte)*pwVar40 < '\0'; + bVar19 = (byte)*pwVar40; + } + bVar61 = (byte)pIVar49; + if (bVar83 == bVar82) { + if (bVar83 != bVar82) { + *(byte *)((longlong)pwVar40 + 0x7d) = *(byte *)((longlong)pwVar40 + 0x7d) + bVar61; + /* WARNING: Bad instruction - Truncating control flow here */ + halt_baddata(); + } + } + else { + pIVar49->e_program[0x3d] = pIVar49->e_program[0x3d] + bVar39; + bVar80 = CARRY1((undefined1)uVar5,*pbVar37); + bVar83 = SCARRY1((undefined1)uVar5,*pbVar37); + bVar19 = (undefined1)uVar5 + *pbVar37; + uVar28 = CONCAT31(uVar5._1_3_,bVar19); + pbVar37 = (byte *)(ulonglong)uVar28; + bVar82 = (char)bVar19 < '\0'; + *puVar68 = pwVar40; + puVar67 = puVar68; + } + uVar38 = (undefined7)((ulonglong)pbVar37 >> 8); + bVar20 = (byte)pbVar37; + if (bVar83 == bVar82) { + if (bVar83 == bVar82) goto code_r0x000180029c4d; + *(byte *)((longlong)pwVar40 + 0x7d) = *(byte *)((longlong)pwVar40 + 0x7d) + bVar45; + bVar19 = *pbVar37; + bVar21 = bVar20 + *pbVar37; + pbVar37 = (byte *)CONCAT71(uVar38,bVar21); + if ((POPCOUNT(bVar21) & 1U) == 0) { + bVar18 = (byte)*puVar41 + bVar61; + bVar82 = CARRY1((byte)*puVar41,bVar61) || CARRY1(bVar18,CARRY1(bVar20,bVar19)); + *(byte *)puVar41 = bVar18 + CARRY1(bVar20,bVar19); + bVar83 = CARRY1(bVar61,*pbVar50) || CARRY1(bVar61 + *pbVar50,bVar82); + uVar55 = (undefined7)((ulonglong)pIVar49 >> 8); + cVar17 = bVar61 + *pbVar50 + bVar82; + lVar44 = CONCAT71(uVar55,cVar17); + uVar1 = (uint)(0xe6 < bVar21 || CARRY1(bVar21 + 0x19,bVar83)); + uVar70 = *puVar41; + uVar58 = (uint)uVar57; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar28 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar48 = (uint)lVar44; + bVar82 = uRam00000001991bb5f6 < uVar48; + uVar70 = uRam00000001991bb5f6 - uVar48; + uRam00000001991bb5f6 = uVar70 - uVar28; + uVar1 = (uint)(bVar82 || uVar70 < uVar28); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar58) - uVar1; + uVar1 = (uint)(uVar28 < uVar58 || uVar70 - uVar58 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar1 = (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + uVar28 = *(uint *)pwVar40; + uVar70 = *(uint *)pwVar40; + *(uint *)pwVar40 = (uVar70 - uVar48) - uVar1; + uVar1 = (uint)(uVar28 < uVar48 || uVar70 - uVar48 < uVar1); + uVar70 = *puVar41; + uVar28 = *puVar41; + *puVar41 = (uVar28 - uVar58) - uVar1; + uVar28 = (int)CONCAT71(uVar38,bVar21 + 0x19 + bVar83) + -0x6ff0e7e9 + + (uint)(uVar70 < uVar58 || uVar28 - uVar58 < uVar1); + bVar80 = SCARRY1(cRam000000007f0004f0,bVar56); + cRam000000007f0004f0 = cRam000000007f0004f0 + bVar56; + bVar83 = cRam000000007f0004f0 < '\0'; + bVar82 = cRam000000007f0004f0 == '\0'; + if (!bVar82 && bVar80 == bVar83) { + bVar80 = SCARRY1(cVar17,bVar39); + cVar17 = cVar17 + bVar39; + lVar44 = CONCAT71(uVar55,cVar17); + bVar83 = cVar17 < '\0'; + bVar82 = cVar17 == '\0'; } - if (bVar71 == bVar70) { - cRam000000000000797c = cRam000000000000797c + cVar16; - bVar71 = SCARRY1(cVar16,*pcVar39); - cVar7 = *pcVar39; - pcVar39 = (char *)(ulonglong)CONCAT31(uVar14,cVar16 + cVar7); - bVar70 = (char)(cVar16 + cVar7) < '\0'; - if (bVar71 != bVar70) { -code_r0x000180029ab5: - if (bVar71 == bVar70) { - pIVar49->e_program[0x3c] = pIVar49->e_program[0x3c]; - /* WARNING: Bad instruction - Truncating control flow here */ - halt_baddata(); - } - goto code_r0x000180029ab9; + if (!bVar82 && bVar80 == bVar83) { + bVar80 = SCARRY1(bVar56,(char)lVar44); + cVar17 = bVar56 + (char)lVar44; + uVar57 = CONCAT11(bVar60,cVar17); + bVar83 = cVar17 < '\0'; + bVar82 = cVar17 == '\0'; + } + if (!bVar82 && bVar80 == bVar83) { + cVar17 = (char)(uVar28 >> 8); + bVar80 = SCARRY1(cVar17,(char)uVar57); + cVar17 = cVar17 + (char)uVar57; + uVar28 = CONCAT22((short)(uVar28 >> 0x10),CONCAT11(cVar17,(char)uVar28)); + bVar83 = cVar17 < '\0'; + bVar82 = cVar17 == '\0'; + } + pcVar35 = (char *)(ulonglong)uVar28; + cVar17 = (char)(uVar28 >> 8); + if (!bVar82 && bVar80 == bVar83) { + bVar80 = SCARRY1(bVar45,cVar17); + cVar46 = bVar45 + cVar17; + puVar41 = (uint *)CONCAT62(uVar47,CONCAT11(cVar46,bVar39)); + bVar83 = cVar46 < '\0'; + bVar82 = cVar46 == '\0'; + } + cVar46 = (char)((ulonglong)puVar41 >> 8); + if (!bVar82 && bVar80 == bVar83) { + cVar54 = (char)((ulonglong)lVar44 >> 8); + bVar80 = SCARRY1(cVar54,cVar46); + bVar56 = cVar54 + cVar46; + lVar44 = (ulonglong)bVar56 << 8; + bVar83 = (short)((ushort)bVar56 << 8) < 0; + bVar82 = bVar56 == 0; + } + cVar54 = (char)uVar28; + if (bVar82 || bVar80 != bVar83) { + if (bVar82 || bVar80 != bVar83) goto code_r0x000180029d51; + pcVar43 = (char *)((ulonglong)*(uint *)(pwVar40 + 1) - 0x47fffd82); + bVar80 = SCARRY1(*pcVar43,cVar46); + *pcVar43 = *pcVar43 + cVar46; + bVar83 = *pcVar43 < '\0'; + bVar82 = *pcVar43 == '\0'; + } + else { + pbVar50 = (byte *)(pwVar40 + -0x287ffec1); + bVar80 = SCARRY1(*pbVar50,cVar17); + *pbVar50 = *pbVar50 + cVar17; + bVar83 = (char)*pbVar50 < '\0'; + bVar82 = *pbVar50 == 0; +code_r0x000180029d51: + if (!bVar82 && bVar80 == bVar83) { + pcVar43 = pcVar35 + -0x3efffd82; + cVar17 = (char)(uVar57 >> 8); + bVar80 = SCARRY1(*pcVar43,cVar17); + *pcVar43 = *pcVar43 + cVar17; + bVar83 = *pcVar43 < '\0'; + bVar82 = *pcVar43 == '\0'; + goto code_r0x000180029d59; } } - else { - if (bVar71 == bVar70) goto code_r0x000180029aaf; -code_r0x000180029ab1: - if (bVar71 != bVar70) goto code_r0x000180029ab5; + if (!bVar82 && bVar80 == bVar83) { + bVar80 = SCARRY1((char)puVar41,cVar54); + cVar17 = (char)puVar41 + cVar54; + puVar41 = (uint *)CONCAT71((int7)((ulonglong)puVar41 >> 8),cVar17); + bVar83 = cVar17 < '\0'; + bVar82 = cVar17 == '\0'; } - } - else { - if (bVar71 != bVar70) goto code_r0x000180029aa5; - *(char *)((longlong)puVar58 + (longlong)pcVar64 * 2) = - *(char *)((longlong)puVar58 + (longlong)pcVar64 * 2) + cVar16; - pcVar39 = (char *)(ulonglong)CONCAT31(uVar14,cVar16 + *pcVar39); - cVar16 = pcVar39[(longlong)pIVar42->e_magic]; - bVar71 = SBORROW1('y',cVar16); - bVar70 = (char)('y' - cVar16) < '\0'; - if ('y' < cVar16) goto code_r0x000180029ab1; -code_r0x000180029aaf: - pcVar1 = (char *)((longlong)puVar58 + (longlong)pcVar64 * 2 + 2); - *pcVar1 = *pcVar1 + bVar36; - } - local_720._0_5_ = CONCAT14(local_720._4_1_ + bVar33,(undefined4)local_720); - bVar71 = SCARRY1((char)pcVar39,*pcVar39); - cVar16 = (char)pcVar39 + *pcVar39; - pcVar39 = (char *)CONCAT71((int7)((ulonglong)pcVar39 >> 8),cVar16); - bVar70 = cVar16 < '\0'; - pIVar49 = (IMAGE_DOS_HEADER *)*puVar58; - puVar58 = puVar58 + 1; -code_r0x000180029ab9: - if (bVar71 == bVar70) { - bVar71 = SCARRY1(pIVar49->e_magic[0],bVar33); - pIVar49->e_magic[0] = pIVar49->e_magic[0] + bVar33; - bVar70 = pIVar49->e_magic[0] < '\0'; - } - if (bVar71 == bVar70) { - bVar71 = false; - *pcVar64 = *pcVar64; - bVar70 = *pcVar64 < '\0'; - } - if (bVar71 == bVar70) { - bVar71 = SCARRY1(*pcVar39,bVar34); - *pcVar39 = *pcVar39 + bVar34; - bVar70 = *pcVar39 < '\0'; - } - if (bVar71 == bVar70) { - bVar71 = SCARRY1((byte)*puVar40,bVar47); - *(byte *)puVar40 = (byte)*puVar40 + bVar47; - bVar70 = (char)(byte)*puVar40 < '\0'; - } - if (bVar71 != bVar70) { - if (bVar71 == bVar70) { - *pcVar39 = *pcVar39 + (char)pcVar39; +code_r0x000180029d59: + if (!bVar82 && bVar80 == bVar83) { + cVar17 = (char)((ulonglong)puVar41 >> 8); + cVar46 = (char)((ulonglong)lVar44 >> 8); + bVar80 = SCARRY1(cVar17,cVar46); + cVar17 = cVar17 + cVar46; + puVar41 = (uint *)CONCAT62((int6)((ulonglong)puVar41 >> 0x10), + CONCAT11(cVar17,(char)puVar41)); + bVar83 = cVar17 < '\0'; + bVar82 = cVar17 == '\0'; } - pcVar39 = (char *)((ulonglong)pcVar39 & 0xffffffffffffff00); - } - local_720._0_5_ = - CONCAT14(local_720._4_1_ + (char)((ulonglong)pcVar39 >> 8),(undefined4)local_720); - *(char *)((longlong)puVar58 + (longlong)puVar40) = - *(char *)((longlong)puVar58 + (longlong)puVar40) + bVar36; - *(int *)((longlong)puVar58 + (longlong)puVar40) = - *(int *)((longlong)puVar58 + (longlong)puVar40) + (int)puVar40; - /* WARNING: Bad instruction - Truncating control flow here */ - halt_baddata(); - } - bVar70 = CARRY1(bVar18,*pbVar32); - pbVar43 = (byte *)CONCAT71(uVar35,bVar18 + *pbVar32); - bVar71 = (POPCOUNT(bVar18 + *pbVar32) & 1U) == 0; - puVar58[-1] = 0xffffffff8300027b; - } - else { - bVar71 = false; - } - if (bVar71) { - pcVar39 = (char *)((longlong)pcVar64 * 2 + 0x7b957902); - *pcVar39 = *pcVar39 + bVar36; - bVar71 = ((ulonglong)pbVar43 & 0x400) != 0; - bVar70 = ((ulonglong)pbVar43 & 0x100) != 0; - pbVar43 = (byte *)CONCAT71((int7)((ulonglong)pbVar43 >> 8),(char)pbVar43 + *pbVar43); - /* WARNING: Bad instruction - Truncating control flow here */ - } - else if (bVar71) { - bVar70 = CARRY1(in_stack_ffffffff9dfffae3,bVar33); - bVar71 = (POPCOUNT(in_stack_ffffffff9dfffae3 + bVar33) & 1U) == 0; - } - else { - bVar71 = false; - } - uVar35 = (undefined7)((ulonglong)pbVar43 >> 8); - if (bVar71) { - pbVar32 = (byte *)(pcVar64 + 0x4d00027b); - bVar34 = (byte)((ulonglong)pbVar43 >> 8); - bVar70 = CARRY1(*pbVar32,bVar34); - *pbVar32 = *pbVar32 + bVar34; - bVar71 = (POPCOUNT(*pbVar32) & 1U) == 0; -code_r0x000180029a01: - bVar72 = false; - if (bVar71) { - bVar70 = CARRY1(pIVar42->e_magic[0],bVar47); - pIVar42->e_magic[0] = pIVar42->e_magic[0] + bVar47; - bVar72 = (POPCOUNT(pIVar42->e_magic[0]) & 1U) == 0; - } - if (!bVar72) { - bVar71 = false; - if (bVar72) { - pcVar64[0x7b] = pcVar64[0x7b]; - cVar16 = *(char *)CONCAT71(uVar35,0x7b); - *(byte *)puVar40 = (byte)*puVar40; - *puVar40 = *puVar40 - (int)CONCAT71(uVar35,cVar16 + '{'); + if (!bVar82 && bVar80 == bVar83) { + *pcVar35 = *pcVar35 + cVar54; + } + *(int *)((longlong)puVar67 + (longlong)puVar41) = + *(int *)((longlong)puVar67 + (longlong)puVar41) + (int)puVar41; /* WARNING: Bad instruction - Truncating control flow here */ halt_baddata(); } - goto code_r0x000180029a0d; +code_r0x000180029c52: + pbVar37 = (byte *)CONCAT71((int7)((ulonglong)pbVar37 >> 8),(char)pbVar37 + *pbVar37); + LOCK(); + pbVar50 = (byte *)(ulonglong)CONCAT11(bRam00000000eb000274,bVar56); + UNLOCK(); + bRam00000000eb000274 = bVar60; +code_r0x000180029c57: + pbVar36 = pIVar49[-0xc3fffc].e_program + 0x3d; + bVar80 = CARRY1(*pbVar36,bVar61); + bVar83 = SCARRY1(*pbVar36,bVar61); + *pbVar36 = *pbVar36 + bVar61; + bVar82 = (char)*pbVar36 < '\0'; + bVar19 = *pbVar36; +code_r0x000180029c5d: + if (bVar83 == bVar82) goto code_r0x000180029c61; + pbVar36 = pIVar49[-0x93fffc].e_program + 0x3d; + bVar80 = CARRY1(*pbVar36,bVar45); + bVar83 = SCARRY1(*pbVar36,bVar45); + *pbVar36 = *pbVar36 + bVar45; + bVar82 = (char)*pbVar36 < '\0'; + bVar19 = *pbVar36; +code_r0x000180029c65: + bVar81 = bVar19 == 0; + if (bVar83 != bVar82) { + bVar56 = (byte)pbVar50; + bVar80 = CARRY1(bVar56,bVar39); + bVar83 = SCARRY1(bVar56,bVar39); + cVar17 = bVar56 + bVar39; + pbVar50 = (byte *)CONCAT71((int7)((ulonglong)pbVar50 >> 8),cVar17); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + } + else { + pIVar49->e_program[0x3d] = pIVar49->e_program[0x3d] + (char)((ulonglong)pbVar37 >> 8); + bVar80 = CARRY1(bVar20,*pbVar37); + bVar83 = SCARRY1(bVar20,*pbVar37); + bVar19 = bVar20 + *pbVar37; + pbVar37 = (byte *)CONCAT71(uVar38,bVar19); + bVar82 = (char)bVar19 < '\0'; + out((byte)*pwVar40,(short)pIVar49); + pwVar40 = (word *)((longlong)pwVar40 + 1); +code_r0x000180029c4d: + if (bVar83 != bVar82) { + pIVar49->e_program[0x3d] = pIVar49->e_program[0x3d] + bVar60; + goto code_r0x000180029c52; + } + if (bVar83 == bVar82) { + if (bVar83 == bVar82) goto code_r0x000180029c59; + goto code_r0x000180029c57; + } + pbVar36 = (byte *)((longlong)pwVar40 + -0x6dfffd83); + bVar19 = (byte)pbVar37; + bVar80 = CARRY1(*pbVar36,bVar19); + bVar83 = SCARRY1(*pbVar36,bVar19); + *pbVar36 = *pbVar36 + bVar19; + bVar82 = (char)*pbVar36 < '\0'; + bVar19 = *pbVar36; +code_r0x000180029c59: + if (bVar83 == bVar82) goto code_r0x000180029c5d; + pbVar36 = (byte *)((longlong)pwVar40 + -0x55fffd83); + bVar80 = CARRY1(*pbVar36,bVar56); + bVar83 = SCARRY1(*pbVar36,bVar56); + *pbVar36 = *pbVar36 + bVar56; + bVar82 = (char)*pbVar36 < '\0'; + bVar19 = *pbVar36; +code_r0x000180029c61: + if (bVar83 == bVar82) goto code_r0x000180029c65; + pbVar36 = (byte *)((longlong)pwVar40 + -0x34fffd83); + bVar80 = CARRY1(*pbVar36,bVar18); + bVar83 = SCARRY1(*pbVar36,bVar18); + *pbVar36 = *pbVar36 + bVar18; + bVar82 = (char)*pbVar36 < '\0'; + bVar81 = *pbVar36 == 0; + } + if (bVar83 != bVar82) { + bVar56 = (byte)((ulonglong)pbVar37 >> 8); + bVar80 = CARRY1(bVar56,bVar61); + bVar83 = SCARRY1(bVar56,bVar61); + cVar17 = bVar56 + bVar61; + pbVar37 = (byte *)CONCAT62((int6)((ulonglong)pbVar37 >> 0x10),CONCAT11(cVar17,(char)pbVar37) + ); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + bVar56 = (byte)pbVar37; + if (bVar83 != bVar82) { + bVar80 = CARRY1((byte)*puVar41,bVar56); + bVar83 = SCARRY1((byte)*puVar41,bVar56); + *(byte *)puVar41 = (byte)*puVar41 + bVar56; + bVar82 = (char)(byte)*puVar41 < '\0'; + bVar81 = (byte)*puVar41 == 0; + } + if (!bVar81 && bVar83 == bVar82) { + bVar80 = CARRY1(pIVar49->e_magic[0],bVar39); + bVar83 = SCARRY1(pIVar49->e_magic[0],bVar39); + pIVar49->e_magic[0] = pIVar49->e_magic[0] + bVar39; + bVar82 = pIVar49->e_magic[0] < '\0'; + bVar81 = pIVar49->e_magic[0] == '\0'; + } + if (!bVar81 && bVar83 == bVar82) { + bVar18 = (byte)((ulonglong)pbVar50 >> 8); + bVar80 = CARRY1(bVar56,bVar18); + bVar83 = SCARRY1(bVar56,bVar18); + cVar17 = bVar56 + bVar18; + pbVar37 = (byte *)CONCAT71((int7)((ulonglong)pbVar37 >> 8),cVar17); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + if (bVar83 != bVar82) { + bVar80 = CARRY1(*pbVar50,bVar61); + bVar83 = SCARRY1(*pbVar50,bVar61); + *pbVar50 = *pbVar50 + bVar61; + bVar82 = (char)*pbVar50 < '\0'; + bVar81 = *pbVar50 == 0; + } + if (bVar81 || bVar83 != bVar82) { + if (bVar81 || bVar83 != bVar82) { + if (!bVar81 && bVar83 == bVar82) { + bVar80 = CARRY1((byte)*pwVar40,bVar45); + bVar83 = SCARRY1((byte)*pwVar40,bVar45); + *(byte *)pwVar40 = (byte)*pwVar40 + bVar45; + bVar82 = (char)(byte)*pwVar40 < '\0'; + bVar81 = (byte)*pwVar40 == 0; + } + } + else { + bVar56 = (byte)((ulonglong)pbVar37 >> 8); + bVar80 = CARRY1(bRam00000001ae029f07,bVar56); + bVar83 = SCARRY1(bRam00000001ae029f07,bVar56); + bRam00000001ae029f07 = bRam00000001ae029f07 + bVar56; + bVar82 = (char)bRam00000001ae029f07 < '\0'; + bVar81 = bRam00000001ae029f07 == 0; + } + goto code_r0x000180029c89; } } else { - if (!bVar71) goto code_r0x000180029a01; - local_720._0_4_ = CONCAT13(local_720._3_1_ + bVar36,(undefined3)local_720); - pbVar43 = (byte *)CONCAT71(uVar35,(char)pbVar43 + *pbVar43); - puVar55 = (undefined1 *)((ulonglong)(bRam0000000000007902 ^ 0x79) << 8); - } - pIVar49->e_program[0x3b] = pIVar49->e_program[0x3b] + bVar33; - bVar70 = CARRY1((byte)pbVar43,*pbVar43); - cVar16 = (byte)pbVar43 + *pbVar43; - pbVar43 = (byte *)CONCAT71((int7)((ulonglong)pbVar43 >> 8),cVar16); - bVar71 = (POPCOUNT(cVar16) & 1U) == 0; -code_r0x000180029a0d: - bVar34 = (byte)pbVar43; - if (bVar71) { - pbVar32 = pbVar43 + 0x27b; - bVar70 = CARRY1(*pbVar32,bVar47); - *pbVar32 = *pbVar32 + bVar47; - } - else if (bVar71) { - bVar70 = CARRY1(*pbVar43,bVar34); - *pbVar43 = *pbVar43 + bVar34; - } - *puVar40 = (*puVar40 - (int)puVar55) - (uint)bVar70; - *(uint *)pIVar42 = *(uint *)pIVar42 + (int)pbVar43; - uVar73 = *(undefined4 *)(pbVar43 + 0x9080706); - piVar31 = (int *)CONCAT71((int7)((ulonglong)puVar55 >> 8),(byte)*puVar40); - uVar25 = *puVar40; - uVar48 = (uint)piVar31; - *puVar40 = *puVar40 - uVar48; - uVar60 = *puVar40; - uVar2 = *puVar40; - *puVar40 = (uVar2 - uVar48) - (uint)(uVar25 < uVar48); - *piVar31 = (*piVar31 - (int)puVar40) - - (uint)(uVar60 < uVar48 || uVar2 - uVar48 < (uint)(uVar25 < uVar48)); - uVar25 = *puVar40; - *puVar40 = *puVar40 - uVar48; - uVar2 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - uVar48) - (uint)(uVar25 < uVar48); - uVar2 = (uint)(uVar2 < uVar48 || uVar60 - uVar48 < (uint)(uVar25 < uVar48)); - uVar60 = *puVar40; - uVar25 = *puVar40; - *puVar40 = (uVar25 - uVar48) - uVar2; - uVar2 = (uint)(uVar60 < uVar48 || uVar25 - uVar48 < uVar2); - uVar25 = *puVar40; - uVar60 = *puVar40; - *puVar40 = (uVar60 - uVar48) - uVar2; - *puVar40 = (*puVar40 - uVar48) - (uint)(uVar25 < uVar48 || uVar60 - uVar48 < uVar2); - *(byte *)puVar40 = (byte)*puVar40 + (bVar34 + (char)uVar73 | 0x19); + if (bVar83 == (char)bVar18 < '\0') { + pIVar49 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar49 >> 8),cVar46 * '\x02'); + } + pIVar49 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar49 >> 8),(char)pIVar49 * '\x02') + ; + uVar3._0_1_ = pIVar49->e_magic[0]; + uVar7 = pIVar49->e_magic[1]; + uVar11 = pIVar49->e_cblp; + uVar3._1_3_ = CONCAT21(uVar11,uVar7); + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + (undefined1)uVar3; + bVar83 = SCARRY1((undefined1)uVar3,*(char *)(ulonglong)uVar3); + cVar17 = (undefined1)uVar3 + *(char *)(ulonglong)uVar3; + uVar28 = CONCAT31(uVar3._1_3_,cVar17); + pbVar36 = (byte *)(ulonglong)uVar28; + bVar82 = cVar17 < '\0'; + if (bVar83 == bVar82) goto code_r0x000180029bef; +code_r0x000180029bf1: + if (bVar83 == bVar82) goto code_r0x000180029bf3; +LAB_29_2: + if (bVar83 != bVar82) goto code_r0x000180029bf9; +code_r0x000180029bf7: + bVar18 = (byte)pbVar36; + unaff_RDI->e_program[0x3c] = unaff_RDI->e_program[0x3c] + bVar18; + bVar56 = *pbVar36; + uVar38 = (undefined7)((ulonglong)pbVar36 >> 8); + bVar19 = bVar18 + *pbVar36; + pbVar36 = (byte *)CONCAT71(uVar38,bVar19); + if (!CARRY1(bVar18,bVar56) && bVar19 != 0) { +code_r0x000180029bfe: + return (byte *)CONCAT71((int7)((ulonglong)pbVar36 >> 8),(char)pbVar36 + *pbVar36); + } + pbVar37 = (byte *)CONCAT71(uVar38,bVar19 + *pbVar36); + pwVar72 = (word *)(ulonglong) + ((int)unaff_RDI + *(int *)((longlong)&unaff_RSI->e_crlc + 1) + + (uint)CARRY1(bVar19,*pbVar36)); + } + *(byte *)(pwVar40 + (longlong)pwVar72) = (byte)pwVar40[(longlong)pwVar72] + (char)pbVar50; + uVar77 = CONCAT71((int7)((ulonglong)pbVar37 >> 8),(char)pbVar37 + *pbVar37); + bVar80 = false; + bVar83 = false; + pbVar37 = (byte *)(ulonglong)((uint)uVar77 & 0x2e00027e); + bVar82 = false; + bVar81 = (uVar77 & 0x2e00027e) == 0; +code_r0x000180029c89: + if (!bVar81 && bVar83 == bVar82) { + bVar56 = (byte)((ulonglong)pIVar49 >> 8); + bVar80 = CARRY1((byte)*pwVar72,bVar56); + bVar83 = SCARRY1((byte)*pwVar72,bVar56); + *(byte *)pwVar72 = (byte)*pwVar72 + bVar56; + bVar82 = (char)(byte)*pwVar72 < '\0'; + bVar81 = (byte)*pwVar72 == 0; + } + bVar56 = (byte)pbVar50; + if (!bVar81 && bVar83 == bVar82) { + bVar80 = CARRY1(bVar45,bVar56); + bVar83 = SCARRY1(bVar45,bVar56); + cVar17 = bVar45 + bVar56; + puVar41 = (uint *)CONCAT62(uVar47,CONCAT11(cVar17,bVar39)); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + bVar45 = (byte)pbVar37; + if (bVar83 != bVar82) { + bVar18 = (byte)pIVar49; + bVar80 = CARRY1(bVar18,bVar45); + bVar83 = SCARRY1(bVar18,bVar45); + cVar17 = bVar18 + bVar45; + pIVar49 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar49 >> 8),cVar17); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + if (bVar83 != bVar82) { + bVar18 = (byte)((ulonglong)pbVar37 >> 8); + bVar39 = (byte)((ulonglong)pIVar49 >> 8); + bVar80 = CARRY1(bVar39,bVar18); + bVar83 = SCARRY1(bVar39,bVar18); + cVar17 = bVar39 + bVar18; + pIVar49 = (IMAGE_DOS_HEADER *) + CONCAT62((int6)((ulonglong)pIVar49 >> 0x10),CONCAT11(cVar17,(char)pIVar49)); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + if (bVar83 != bVar82) { + bVar18 = (byte)((ulonglong)puVar41 >> 8); + bVar39 = (byte)((ulonglong)pbVar50 >> 8); + bVar80 = CARRY1(bVar39,bVar18); + bVar83 = SCARRY1(bVar39,bVar18); + cVar17 = bVar39 + bVar18; + pbVar50 = (byte *)(ulonglong)CONCAT11(cVar17,bVar56); + bVar82 = cVar17 < '\0'; + bVar81 = cVar17 == '\0'; + } + bVar56 = (byte)pbVar50; + if (bVar83 == bVar82) { + if (!bVar81 && bVar83 == bVar82) { + bVar80 = CARRY1(*pbVar37,bVar45); + *pbVar37 = *pbVar37 + bVar45; + } + *puVar41 = (*puVar41 - (int)pbVar50) - (uint)bVar80; + *(uint *)pIVar49 = *(uint *)pIVar49 + (int)pbVar37; + uVar84 = *(undefined4 *)(pbVar37 + 0x9080706); + piVar34 = (int *)CONCAT71((int7)((ulonglong)pbVar50 >> 8),bVar56 | (byte)*puVar41); + uVar28 = *puVar41; + uVar48 = (uint)piVar34; + *puVar41 = *puVar41 - uVar48; + uVar70 = *puVar41; + uVar1 = *puVar41; + *puVar41 = (uVar1 - uVar48) - (uint)(uVar28 < uVar48); + *piVar34 = (*piVar34 - (int)puVar41) - + (uint)(uVar70 < uVar48 || uVar1 - uVar48 < (uint)(uVar28 < uVar48)); + uVar28 = *puVar41; + *puVar41 = *puVar41 - uVar48; + uVar1 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar48) - (uint)(uVar28 < uVar48); + uVar1 = (uint)(uVar1 < uVar48 || uVar70 - uVar48 < (uint)(uVar28 < uVar48)); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar48) - uVar1; + uVar1 = (uint)(uVar28 < uVar48 || uVar70 - uVar48 < uVar1); + uVar28 = *puVar41; + uVar70 = *puVar41; + *puVar41 = (uVar70 - uVar48) - uVar1; + *puVar41 = (*puVar41 - uVar48) - (uint)(uVar28 < uVar48 || uVar70 - uVar48 < uVar1); + *(byte *)puVar41 = (byte)*puVar41 + (bVar45 + (char)uVar84 | 0x19); + /* WARNING: Bad instruction - Truncating control flow here */ + halt_baddata(); + } + pbVar37[0x7e] = pbVar37[0x7e] + bVar45; + bVar18 = *pbVar37; + uVar28 = *puVar41; + *(byte *)puVar41 = (byte)*puVar41 + bVar56; + *puVar41 = (*puVar41 - (int)CONCAT71((int7)((ulonglong)pbVar37 >> 8),bVar45 + bVar18)) - + (uint)CARRY1((byte)uVar28,bVar56); /* WARNING: Bad instruction - Truncating control flow here */ halt_baddata(); } LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); - cVar16 = (char)param_1[2]->e_csum; - if (((cVar16 == -0xd) || (cVar16 == '\x02')) || (cVar16 == '\"')) { + cVar17 = (char)param_1[2]->e_csum; + if (((cVar17 == -0xd) || (cVar17 == '\x02')) || (cVar17 == '\"')) { local_7f0.Flink = (_LIST_ENTRY *)0x0; local_770 = 0; - TraceLogHelper("IkeBeginMMResponder",1,pIVar42,param_4); - pcVar64 = (char *)&local_7f0; - p_Var27 = (_LIST_ENTRY *) + TraceLogHelper("IkeBeginMMResponder",1,pIVar49,param_4); + pcVar35 = (char *)&local_7f0; + p_Var30 = (_LIST_ENTRY *) IkeInitMMResponderPhase1 - ((longlong)param_1,(undefined8 *)pcVar64,pIVar42,(_LIST_ENTRY **)param_4); + ((longlong)param_1,(undefined8 *)pcVar35,pIVar49,(_LIST_ENTRY **)param_4); unaff_RSI = (IMAGE_DOS_HEADER *)local_7f0.Flink; - if (p_Var27 == (_LIST_ENTRY *)0x0) { - TraceLogHelper("IkeSetOpenMM",1,pIVar42,param_4); + if (p_Var30 == (_LIST_ENTRY *)0x0) { + TraceLogHelper("IkeSetOpenMM",1,pIVar49,param_4); unaff_RDI = (IMAGE_DOS_HEADER *)0x0; switch(((IMAGE_DOS_HEADER *)((_LIST_ENTRY *)unaff_RSI + 2))->e_program[0x38]) { case 1: case 4: case 7: - unaff_RDI = pIVar49; + unaff_RDI = pIVar59; break; default: - goto switchD_180027f33_caseD_2; + goto switchD_1800281c3_caseD_2; case 5: case 6: case 8: unaff_RDI = (IMAGE_DOS_HEADER *)0x1; } - iVar22 = *(int *)(((IMAGE_DOS_HEADER *)((_LIST_ENTRY *)unaff_RSI + 4))->e_program + 8); - TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",1,pIVar42,param_4); - iVar59 = (int)unaff_RDI; - if (iVar22 == 0) { - if (iVar59 == 0) { - pIVar65 = (IMAGE_DOS_HEADER *)gIkeExtGlobals[2].e_program; + iVar25 = *(int *)(((IMAGE_DOS_HEADER *)((_LIST_ENTRY *)unaff_RSI + 4))->e_program + 8); + TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",1,pIVar49,param_4); + iVar69 = (int)unaff_RDI; + if (iVar25 == 0) { + if (iVar69 == 0) { + pIVar74 = (IMAGE_DOS_HEADER *)gIkeExtGlobals[2].e_program; } else { - pIVar65 = (IMAGE_DOS_HEADER *)&gIkeExtGlobals[3].e_cparhdr; - } - } - else if (iVar22 == 1) { - if (iVar59 == 0) { - pIVar65 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals[6].e_program + 0x20); + pIVar74 = (IMAGE_DOS_HEADER *)&gIkeExtGlobals[3].e_cparhdr; + } + } + else if (iVar25 == 1) { + if (iVar69 == 0) { + pIVar74 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals[6].e_program + 0x20); } else { - pIVar65 = (IMAGE_DOS_HEADER *)gIkeExtGlobals[7].e_res2_10_; - } - } - else if (iVar59 == 0) { - pIVar65 = gIkeExtGlobals + 0xb; + pIVar74 = (IMAGE_DOS_HEADER *)gIkeExtGlobals[7].e_res2_10_; + } + } + else if (iVar69 == 0) { + pIVar74 = gIkeExtGlobals + 0xb; } else { - pIVar65 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals[0xb].e_program + 8); + pIVar74 = (IMAGE_DOS_HEADER *)(gIkeExtGlobals[0xb].e_program + 8); } LOCK(); - *(int *)pIVar65 = *(int *)pIVar65 + 1; + *(int *)pIVar74 = *(int *)pIVar74 + 1; UNLOCK(); - TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",0,pIVar42,param_4); + TraceLogHelper("IkeGlobalStatsUpdateCurrentNewRespMMs",0,pIVar49,param_4); *(uint *)(((IMAGE_DOS_HEADER *)((_LIST_ENTRY *)unaff_RSI + 4))->e_program + 0x10) = *(uint *)(((IMAGE_DOS_HEADER *)((_LIST_ENTRY *)unaff_RSI + 4))->e_program + 0x10) | 4; - uVar25 = *(int *)(gIkeExtGlobals[0xb].e_program + 8) + *(int *)(gIkeExtGlobals + 0xb) + + uVar28 = *(int *)(gIkeExtGlobals[0xb].e_program + 8) + *(int *)(gIkeExtGlobals + 0xb) + *(int *)gIkeExtGlobals[7].e_res2_10_ + *(int *)(gIkeExtGlobals[6].e_program + 0x20) + *(int *)&gIkeExtGlobals[3].e_cparhdr + *(int *)gIkeExtGlobals[2].e_program; - pIVar65 = (IMAGE_DOS_HEADER *)(ulonglong)uVar25; - if (*(uint *)(gIkeExtGlobals[0xf].e_res2_10_ + 2) < uVar25) { - pppIVar69 = &WPP_GLOBAL_Control; + pIVar74 = (IMAGE_DOS_HEADER *)(ulonglong)uVar28; + if (*(uint *)(gIkeExtGlobals[0xf].e_res2_10_ + 2) < uVar28) { + pppIVar79 = &WPP_GLOBAL_Control; if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { unaff_RDI = (IMAGE_DOS_HEADER *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - pIVar42 = (IMAGE_DOS_HEADER *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; - pppIVar69 = (IMAGE_DOS_HEADER ***)0x1a; + pIVar49 = (IMAGE_DOS_HEADER *)&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids; + pppIVar79 = (IMAGE_DOS_HEADER ***)0x1a; WPP_SF_iSD(WPP_GLOBAL_Control[2],0x1a,&WPP_1f0420dba9ff3ce2f92712af36ae43e7_Traceguids, param_4,(wchar_t *)unaff_RDI); } if (4 < DAT_0) { - pppIVar69 = (IMAGE_DOS_HEADER ***)0x0; - cVar16 = _tlgKeywordOn(0x180164278,0); - if (cVar16 != '\0') { + pppIVar79 = (IMAGE_DOS_HEADER ***)0x0; + cVar17 = _tlgKeywordOn(0x180165278,0); + if (cVar17 != '\0') { local_700 = IkeGetTlsMmLuid(); local_418 = &local_700; local_410 = 8; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_408,pwVar26); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_408,pwVar29); local_6f8 = unaff_RSI; local_3f8 = &local_6f8; - pppIVar69 = (IMAGE_DOS_HEADER ***)&DAT_26; + pppIVar79 = (IMAGE_DOS_HEADER ***)&DAT_30; local_3f0 = 8; local_78c = *(int *)(gIkeExtGlobals[0xb].e_program + 8) + *(int *)(gIkeExtGlobals + 0xb) + *(int *)gIkeExtGlobals[7].e_res2_10_ + *(int *)(gIkeExtGlobals[6].e_program + 0x20) + *(int *)&gIkeExtGlobals[3].e_cparhdr + *(int *)gIkeExtGlobals[2].e_program; local_3e8 = &local_78c; local_3e0 = 4; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_26,pIVar42,param_4,6,local_438); + (0x180165278,&DAT_30,pIVar49,param_4,6,local_438); } } - IkeEnableDosModeFlag(2,pppIVar69,(undefined8 *)pIVar42,param_4); - } - TraceLogHelper("IkeSetOpenMM",0,pIVar42,param_4); - pIVar42 = &IMAGE_DOS_HEADER_180000000; + IkeEnableDosModeFlag(2,pppIVar79,(undefined8 *)pIVar49,param_4); + } + TraceLogHelper("IkeSetOpenMM",0,pIVar49,param_4); + pIVar49 = &IMAGE_DOS_HEADER_180000000; switch(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x100))->e_program[0x38]) { case 1: case 4: case 7: break; default: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar50 = auStackY_8a0; -switchD_180027f33_caseD_2: - pcVar11 = (code *)swi(0x29); - (*pcVar11)(0x25); - puVar51 = (undefined1 *)((longlong)puVar50 + 8); - goto LAB_20; + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar62 = (undefined8 *)auStackY_8a0; +switchD_1800281c3_caseD_2: + pcVar14 = (code *)swi(0x29); + (*pcVar14)(0x25); + puVar67 = puVar62 + 1; + goto LAB_24; case 5: case 6: case 8: - bVar70 = true; - } - iVar22 = *(int *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x200))->e_program + 8); + bVar82 = true; + } + iVar25 = *(int *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x200))->e_program + 8); TraceLogHelper("IkeGlobalStatsUpdateTotalRespMMs",1,0x180000000,param_4); - if (iVar22 == 0) { - if (bVar70) { - pdVar28 = (dword *)&gIkeExtGlobals[3].e_cp; + if (iVar25 == 0) { + if (bVar82) { + pdVar31 = (dword *)&gIkeExtGlobals[3].e_cp; } else { - pdVar28 = &gIkeExtGlobals[2].e_lfanew; - } - } - else if (iVar22 == 1) { - if (bVar70) { - pdVar28 = (dword *)&gIkeExtGlobals[7].e_oemid; + pdVar31 = &gIkeExtGlobals[2].e_lfanew; + } + } + else if (iVar25 == 1) { + if (bVar82) { + pdVar31 = (dword *)&gIkeExtGlobals[7].e_oemid; } else { - pdVar28 = (dword *)(gIkeExtGlobals[6].e_program + 0x1c); - } - } - else if (bVar70) { - pdVar28 = (dword *)(gIkeExtGlobals[0xb].e_program + 4); + pdVar31 = (dword *)(gIkeExtGlobals[6].e_program + 0x1c); + } + } + else if (bVar82) { + pdVar31 = (dword *)(gIkeExtGlobals[0xb].e_program + 4); } else { - pdVar28 = (dword *)(gIkeExtGlobals[10].e_program + 0x3c); + pdVar31 = (dword *)(gIkeExtGlobals[10].e_program + 0x3c); } LOCK(); - *pdVar28 = *pdVar28 + 1; + *pdVar31 = *pdVar31 + 1; UNLOCK(); - TraceLogHelper("IkeGlobalStatsUpdateTotalRespMMs",0,pIVar42,param_4); + TraceLogHelper("IkeGlobalStatsUpdateTotalRespMMs",0,pIVar49,param_4); EnterCriticalSection((LPCRITICAL_SECTION)local_7f0.Flink); - p_Var27 = local_7f0.Flink; - TraceLogHelper("IkeNotifyNLB",1,pIVar42,param_4); + p_Var30 = local_7f0.Flink; + TraceLogHelper("IkeNotifyNLB",1,pIVar49,param_4); if ((gIkeExtGlobals[0xf].e_program[0x24] & 1) != 0) { - pbVar43 = ((IMAGE_DOS_HEADER *)((longlong)p_Var27 + 0x100))->e_program + 0x38; - pIVar65 = gIkeExtGlobals; - uVar29 = IkeAddrGetIPVersion(pbVar43); - uVar67 = 0x17; - if ((int)uVar29 != 1) { - uVar67 = 2; - } - if (*(longlong *)pIVar65[0x17].e_program != 0) { - IkeAddrGetAddrBytes((char *)pbVar43,&local_6e8,&local_794); - IkeAddrGetPort((longlong)pbVar43,local_7dc); - pwVar37 = ((IMAGE_DOS_HEADER *)((longlong)p_Var27 + 0x180))->e_res2_10_ + 6; - IkeAddrGetAddrBytes((char *)pwVar37,(longlong *)&local_6f0,&local_794); - IkeAddrGetPort((longlong)pwVar37,local_7e0); - in_R10 = (undefined8 *)0x9b3127775cd09a70; - pIVar42 = (IMAGE_DOS_HEADER *)(ulonglong)local_7dc[0]; - iVar22 = (**(code **)gIkeExtGlobals[0x17].e_program)(uVar67 & 0xffff); + pbVar50 = ((IMAGE_DOS_HEADER *)((longlong)p_Var30 + 0x100))->e_program + 0x38; + pIVar74 = gIkeExtGlobals; + uVar32 = IkeAddrGetIPVersion(pbVar50); + uVar77 = 0x17; + if ((int)uVar32 != 1) { + uVar77 = 2; + } + if (*(longlong *)pIVar74[0x17].e_program != 0) { + IkeAddrGetAddrBytes((char *)pbVar50,&local_6e8,&local_794); + IkeAddrGetPort((longlong)pbVar50,local_7dc); + pwVar40 = ((IMAGE_DOS_HEADER *)((longlong)p_Var30 + 0x180))->e_res2_10_ + 6; + IkeAddrGetAddrBytes((char *)pwVar40,(longlong *)&local_6f0,&local_794); + IkeAddrGetPort((longlong)pwVar40,local_7e0); + pIVar49 = (IMAGE_DOS_HEADER *)(ulonglong)local_7dc[0]; + iVar25 = (**(code **)gIkeExtGlobals[0x17].e_program)(uVar77 & 0xffff); param_4 = local_6f0; - if ((iVar22 == 0) && (local_774 == 1000)) { - ((IMAGE_DOS_HEADER *)((longlong)p_Var27 + 0x400))->e_oemid = - ((IMAGE_DOS_HEADER *)((longlong)p_Var27 + 0x400))->e_oemid + 1; + if ((iVar25 == 0) && (local_774 == 1000)) { + ((IMAGE_DOS_HEADER *)((longlong)p_Var30 + 0x400))->e_oemid = + ((IMAGE_DOS_HEADER *)((longlong)p_Var30 + 0x400))->e_oemid + 1; } } } - TraceLogHelper("IkeNotifyNLB",0,pIVar42,param_4); - pcVar64 = "IkeNotifyNLB"; - p_Var27 = (_LIST_ENTRY *)IkeReturnError(0,"IkeNotifyNLB",pIVar42,param_4); - if (p_Var27 == (_LIST_ENTRY *)0x0) { + TraceLogHelper("IkeNotifyNLB",0,pIVar49,param_4); + pcVar35 = "IkeNotifyNLB"; + p_Var30 = (_LIST_ENTRY *)IkeReturnError(0,"IkeNotifyNLB",pIVar49,param_4); + if (p_Var30 == (_LIST_ENTRY *)0x0) { param_4 = (PRTL_CRITICAL_SECTION_DEBUG) (ulonglong)(-(uint)(param_1[0x19] != (IMAGE_DOS_HEADER *)0x0) & 0x10000); - pcVar64 = (char *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x200))->e_program + 8) + pcVar35 = (char *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x200))->e_program + 8) ; - pIVar42 = (IMAGE_DOS_HEADER *)0x0; - p_Var27 = (_LIST_ENTRY *) - IkeFindMMPolicy((byte *)(param_1 + 7),(int *)pcVar64,(undefined *)0x0,param_4, - &local_770); - if (p_Var27 == (_LIST_ENTRY *)0x0) { - pIVar42 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar42 >> 8),1); - pcVar64 = (char *)0x0; + pIVar49 = (IMAGE_DOS_HEADER *)0x0; + p_Var30 = (_LIST_ENTRY *) + IkeFindMMPolicy((byte *)(param_1 + 7),(int *)pcVar35,(undefined *)0x0, + (ulonglong)param_4,&local_770); + if (p_Var30 == (_LIST_ENTRY *)0x0) { + pIVar49 = (IMAGE_DOS_HEADER *)CONCAT71((int7)((ulonglong)pIVar49 >> 8),1); + pcVar35 = (char *)0x0; *(longlong *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x280))->e_program + 0x20) = local_770; param_4 = *(PRTL_CRITICAL_SECTION_DEBUG *)(local_770 + 0x10); - p_Var27 = (_LIST_ENTRY *) - IkeInsertFilterToSAEntry((longlong)local_7f0.Flink,0,pIVar42,param_4); - if (p_Var27 == (_LIST_ENTRY *)0x0) { + p_Var30 = (_LIST_ENTRY *) + IkeInsertFilterToSAEntry((longlong)local_7f0.Flink,0,pIVar49,param_4); + if (p_Var30 == (_LIST_ENTRY *)0x0) { if (*(int *)(((IMAGE_DOS_HEADER *)((longlong)local_7f0.Flink + 0x200))->e_program + 8) == 2) { - p_Var27 = (_LIST_ENTRY *) + p_Var30 = (_LIST_ENTRY *) IkeValidateAuthArrayResponderIkeV2 - ((longlong)local_7f0.Flink,pcVar64,pIVar42,param_4); - if (p_Var27 != (_LIST_ENTRY *)0x0) goto LAB_27; - IkeGuessSubExchTypeIkeV2Responder((longlong)local_7f0.Flink,pcVar64,pIVar42,param_4); + ((longlong)local_7f0.Flink,pcVar35,pIVar49,param_4); + if (p_Var30 != (_LIST_ENTRY *)0x0) goto LAB_31; + IkeGuessSubExchTypeIkeV2Responder((longlong)local_7f0.Flink,pcVar35,pIVar49,param_4); } - pcVar64 = (char *)0x1; - pIVar42 = (IMAGE_DOS_HEADER *)param_1; - p_Var27 = (_LIST_ENTRY *) + pcVar35 = (char *)0x1; + pIVar49 = (IMAGE_DOS_HEADER *)param_1; + p_Var30 = (_LIST_ENTRY *) IkeProcessPacket((PRTL_CRITICAL_SECTION_DEBUG)local_7f0.Flink,1, (_RTL_CRITICAL_SECTION *)param_1,param_4); } } } } -LAB_27: +LAB_31: if ((IMAGE_DOS_HEADER *)local_7f0.Flink != (IMAGE_DOS_HEADER *)0x0) { - if (p_Var27 != (_LIST_ENTRY *)0x0) { - uVar60 = (uint)p_Var27; - uVar25 = uVar60 & 0xffff; - if ((uVar60 & 0x1fff0000) != 0x70000) { - uVar25 = uVar60; - } - pIVar42 = (IMAGE_DOS_HEADER *)0x2; - if (uVar25 == 0x364f) { - pIVar42 = pIVar49; - } - pcVar64 = (char *)p_Var27; + if (p_Var30 != (_LIST_ENTRY *)0x0) { + uVar70 = (uint)p_Var30; + uVar28 = uVar70 & 0xffff; + if ((uVar70 & 0x1fff0000) != 0x70000) { + uVar28 = uVar70; + } + pIVar49 = (IMAGE_DOS_HEADER *)0x2; + if (uVar28 == 0x364f) { + pIVar49 = pIVar59; + } + pcVar35 = (char *)p_Var30; IkeCleanupMMNegotiation - ((PRTL_CRITICAL_SECTION_DEBUG)local_7f0.Flink,p_Var27,(ulonglong)pIVar42, + ((PRTL_CRITICAL_SECTION_DEBUG)local_7f0.Flink,p_Var30,(ulonglong)pIVar49, (_LIST_ENTRY *)param_4); } IkeFinishMMSAProcessing - ((PRTL_CRITICAL_SECTION_DEBUG)local_7f0.Flink,pcVar64, - (PRTL_CRITICAL_SECTION_DEBUG)pIVar42,param_4); - } - TraceLogHelper("IkeBeginMMResponder",0,pIVar42,param_4); + ((PRTL_CRITICAL_SECTION_DEBUG)local_7f0.Flink,pcVar35, + (PRTL_CRITICAL_SECTION_DEBUG)pIVar49,param_4); + } + TraceLogHelper("IkeBeginMMResponder",0,pIVar49,param_4); unaff_RSI = (IMAGE_DOS_HEADER *) - IkeReturnError((longlong)p_Var27,"IkeBeginMMResponder",pIVar42,param_4); + IkeReturnError((longlong)p_Var30,"IkeBeginMMResponder",pIVar49,param_4); } else { if (((WPP_GLOBAL_Control != (IMAGE_DOS_HEADER **)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - pIVar42 = (IMAGE_DOS_HEADER *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; + pIVar49 = (IMAGE_DOS_HEADER *)&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids; WPP_SF_iS(WPP_GLOBAL_Control[2],0x10,&WPP_7839098f36e932e1dfe7bdc4a8e55e90_Traceguids,param_4, - pwVar26); - } - unaff_RSI = pIVar49; - if ((4 < DAT_0) && (cVar16 = _tlgKeywordOn(0x180164278,0), cVar16 != '\0')) { + pwVar29); + } + unaff_RSI = pIVar59; + if ((4 < DAT_0) && (cVar17 = _tlgKeywordOn(0x180165278,0), cVar17 != '\0')) { local_708 = IkeGetTlsMmLuid(); local_1e8 = &local_708; local_1e0 = 8; - pwVar26 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_1d8,pwVar26); + pwVar29 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_1d8,pwVar29); _tlgCreate1Sz_char(local_1c8, "Dropping non-initial MM packet with no state to process"); _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_28,pIVar42,param_4,5,local_208); + (0x180165278,&DAT_32,pIVar49,param_4,5,local_208); unaff_RSI = (IMAGE_DOS_HEADER *)0x0; } } if ((gWfpTrackHeapBytes != 0) && (param_1[2] != (IMAGE_DOS_HEADER *)0x0)) { - SVar30 = HeapSize(gWfpHeap,0,param_1[2]); + SVar33 = HeapSize(gWfpHeap,0,param_1[2]); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar30; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar33; UNLOCK(); } HeapFree(gWfpHeap,0,param_1[2]); param_1[2] = (IMAGE_DOS_HEADER *)0xbadbadfabadbadfa; if (param_1[0x19] != (IMAGE_DOS_HEADER *)0x0) { WfpMemFree(param_1 + 0x19); } if (gWfpTrackHeapBytes != 0) { - SVar30 = HeapSize(gWfpHeap,0,param_1); + SVar33 = HeapSize(gWfpHeap,0,param_1); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar30; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar33; UNLOCK(); } HeapFree(gWfpHeap,0,param_1); - pcVar39 = unaff_RSI->e_magic; + pcVar43 = unaff_RSI->e_magic; local_7d0 = IkeReturnError((longlong)unaff_RSI,"IkeProcessPacketNoSa",param_1,param_4); goto LAB_7; - while ((uint)(*(int *)pIVar61[0x11].e_res2_10_ * 3) < uVar60) { -LAB_19: - *(undefined8 *)(puVar55 + -8) = 0x1800291ba; - cVar16 = RtlExpandHashTable(pIVar65->e_res_4_ + 2); - if (cVar16 == '\0') break; - } -LAB_18: - *(undefined8 *)(puVar55 + -8) = 0x180029025; - TraceLogHelper("IkeRemoveMMSAFromAddrHash",0,pIVar42,param_4); - *(undefined8 *)(puVar55 + -8) = 0x180029034; - IkeReturnError(lVar63,"IkeRemoveMMSAFromAddrHash",pIVar42,param_4); - if ((gWfpTrackHeapBytes != 0) && (pIVar68 != (IMAGE_DOS_HEADER *)0x0)) { - *(undefined8 *)(puVar55 + -8) = 0x180029054; - SVar30 = HeapSize(gWfpHeap,0,pIVar68); + while ((uint)(*(int *)pIVar71[0x11].e_res2_10_ * 3) < uVar28) { +LAB_22: + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002944a; + cVar17 = RtlExpandHashTable(pIVar74->e_res_4_ + 2); + if (cVar17 == '\0') break; + } + goto LAB_21; + while (uVar28 < *(uint *)pIVar71[0x11].e_res2_10_) { +LAB_23: + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002947a; + cVar17 = RtlContractHashTable(pIVar74->e_res_4_ + 2); + if (cVar17 == '\0') break; + } +LAB_21: + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800292b5; + TraceLogHelper("IkeRemoveMMSAFromAddrHash",0,pIVar49,param_4); + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800292c4; + IkeReturnError(lVar44,"IkeRemoveMMSAFromAddrHash",pIVar49,param_4); + if ((gWfpTrackHeapBytes != 0) && (pIVar78 != (IMAGE_DOS_HEADER *)0x0)) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800292e4; + SVar33 = HeapSize(gWfpHeap,0,pIVar78); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar30; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar33; UNLOCK(); } - *(undefined8 *)(puVar55 + -8) = 0x180029077; - pIVar42 = (IMAGE_DOS_HEADER *)local_7f0.Blink; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029307; + pIVar49 = (IMAGE_DOS_HEADER *)local_7f0.Blink; HeapFree(gWfpHeap,0,local_7f0.Blink); local_7f0.Blink = (_LIST_ENTRY *)0x0; local_7b0 = 0; local_7c8 = (IMAGE_DOS_HEADER *)0x0; - bVar70 = true; - *(undefined8 *)(puVar55 + -8) = 0x1800290a1; - TraceLogHelper("IkeRemoveMMSAFromHash",1,pIVar42,param_4); - pwVar37 = pIVar46[5].e_res2_10_ + 4; - pIVar65 = pIVar49; + bVar82 = true; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029331; + TraceLogHelper("IkeRemoveMMSAFromHash",1,pIVar49,param_4); + pwVar40 = pIVar53[5].e_res2_10_ + 4; + pIVar74 = pIVar59; do { - *(undefined8 *)(puVar55 + -8) = 0x1800290c4; - TraceLogHelper("IkeLookupMMSA",1,pIVar42,param_4); - if (bVar70) { - pIVar42 = &IMAGE_DOS_HEADER_180000000; - switch(*(undefined1 *)((longlong)puVar62 + -0x6c)) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029354; + TraceLogHelper("IkeLookupMMSA",1,pIVar49,param_4); + if (bVar82) { + pIVar49 = &IMAGE_DOS_HEADER_180000000; + switch(*(undefined1 *)((longlong)puVar67 + -0x6c)) { case 1: case 4: case 7: - lVar63 = 4; + lVar44 = 4; break; default: - goto switchD_180029162_caseD_2; + goto switchD_1800293f2_caseD_2; case 5: case 6: case 8: - lVar63 = 0x10; + lVar44 = 0x10; } do { - lVar63 = lVar63 + -1; - } while (lVar63 != 0); - pIVar42 = (IMAGE_DOS_HEADER *)local_690; - *(undefined8 *)(puVar55 + -8) = 0x18002925e; - pIVar46 = (IMAGE_DOS_HEADER *)RtlLookupEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - bVar70 = false; + lVar44 = lVar44 + -1; + } while (lVar44 != 0); + pIVar49 = (IMAGE_DOS_HEADER *)local_690; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800294ee; + pIVar53 = (IMAGE_DOS_HEADER *)RtlLookupEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); + bVar82 = false; } else { - *(undefined8 *)(puVar55 + -8) = 0x180029284; - pIVar46 = (IMAGE_DOS_HEADER *)RtlGetNextEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - } - pIVar61 = pIVar49; - if (pIVar46 != (IMAGE_DOS_HEADER *)0x0) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029514; + pIVar53 = (IMAGE_DOS_HEADER *)RtlGetNextEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); + } + pIVar71 = pIVar59; + if (pIVar53 != (IMAGE_DOS_HEADER *)0x0) { local_188 = 0; do { - lVar63 = *(longlong *)&pIVar46->e_lfarlc; - *(undefined8 *)(puVar55 + -8) = 0x1800292b5; - TraceLogHelper("IkeFullMMMatch",1,pIVar42,param_4); - if (*(longlong *)local_7c0[5].e_res2_10_ == *(longlong *)(lVar63 + 0x2a8)) { - if (pwVar37 != (word *)0x0) { - if (*(int *)(lVar63 + 0x248) == 0) { - piVar31 = *(int **)(lVar63 + 600); + lVar44 = *(longlong *)&pIVar53->e_lfarlc; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029545; + TraceLogHelper("IkeFullMMMatch",1,pIVar49,param_4); + if (*(longlong *)local_7c0[5].e_res2_10_ == *(longlong *)(lVar44 + 0x2a8)) { + if (pwVar40 != (word *)0x0) { + if (*(int *)(lVar44 + 0x248) == 0) { + piVar34 = *(int **)(lVar44 + 600); } - else if (*(int *)(lVar63 + 0x248) == 1) { - piVar31 = *(int **)(lVar63 + 0x260); + else if (*(int *)(lVar44 + 0x248) == 1) { + piVar34 = *(int **)(lVar44 + 0x260); } else { - piVar31 = *(int **)(lVar63 + 0x268); + piVar34 = *(int **)(lVar44 + 0x268); } - if ((((*piVar31 != 1) || ((*(byte *)(lVar63 + 0x250) & 1) == 0)) && - (((*(uint *)(lVar63 + 0x250) & 2) == 0 || - (((*(uint *)(lVar63 + 0x250) & 4) == 0 || (*(longlong *)pwVar37 != 0)))))) && - (*(longlong *)pwVar37 != *(longlong *)(lVar63 + 0x2b0))) goto LAB_29; + if ((((*piVar34 != 1) || ((*(byte *)(lVar44 + 0x250) & 1) == 0)) && + (((*(uint *)(lVar44 + 0x250) & 2) == 0 || + (((*(uint *)(lVar44 + 0x250) & 4) == 0 || (*(longlong *)pwVar40 != 0)))))) && + (*(longlong *)pwVar40 != *(longlong *)(lVar44 + 0x2b0))) goto LAB_33; } - cVar16 = *(char *)((longlong)puVar62 + -0x6c); - if (cVar16 == *(char *)(lVar63 + 0x1b4)) { - pIVar42 = &IMAGE_DOS_HEADER_180000000; - switch(cVar16) { + cVar17 = *(char *)((longlong)puVar67 + -0x6c); + if (cVar17 == *(char *)(lVar44 + 0x1b4)) { + pIVar49 = &IMAGE_DOS_HEADER_180000000; + switch(cVar17) { case '\x01': case '\x04': case '\a': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar62 + -100); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar67 + -100); break; default: - goto switchD_180029367_caseD_2; + goto switchD_1800295f7_caseD_2; case '\x05': case '\x06': case '\b': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar62 + -0xc); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar67 + -0xc); } local_740 = param_4; - switch(*(char *)(lVar63 + 0x1b4)) { + switch(*(char *)(lVar44 + 0x1b4)) { case '\x01': case '\x04': case '\a': local_800 = 4; - local_748 = (void *)(lVar63 + 0x1bc); - pIVar42 = (IMAGE_DOS_HEADER *)0x4; + local_748 = (void *)(lVar44 + 0x1bc); + pIVar49 = (IMAGE_DOS_HEADER *)0x4; break; default: - goto switchD_180029396_caseD_2; + goto switchD_180029626_caseD_2; case '\x05': case '\x06': case '\b': local_800 = 0x10; - local_748 = (void *)(lVar63 + 0x1c0); - pIVar42 = (IMAGE_DOS_HEADER *)0x10; + local_748 = (void *)(lVar44 + 0x1c0); + pIVar49 = (IMAGE_DOS_HEADER *)0x10; } - *(undefined8 *)(puVar55 + -8) = 0x1800293cc; - iVar22 = memcmp(param_4,local_748,(size_t)pIVar42); - if (iVar22 == 0) { - if ((byte)(cVar16 - 7U) < 2) { - *(undefined8 *)(puVar55 + -8) = 0x1800293f0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002965c; + iVar25 = memcmp(param_4,local_748,(size_t)pIVar49); + if (iVar25 == 0) { + if ((byte)(cVar17 - 7U) < 2) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029680; IkeAddrGetAddrBytesHigh - ((char *)((longlong)puVar62 + -0x6c),(longlong *)&local_740,&local_800); - *(undefined8 *)(puVar55 + -8) = 0x180029401; - IkeAddrGetAddrBytesHigh((char *)(lVar63 + 0x1b4),(longlong *)&local_748,&local_800); - pIVar42 = (IMAGE_DOS_HEADER *)(ulonglong)local_800; - *(undefined8 *)(puVar55 + -8) = 0x180029412; - iVar22 = memcmp(local_740,local_748,(size_t)pIVar42); - if (iVar22 != 0) goto LAB_29; + ((char *)((longlong)puVar67 + -0x6c),(longlong *)&local_740,&local_800); + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029691; + IkeAddrGetAddrBytesHigh((char *)(lVar44 + 0x1b4),(longlong *)&local_748,&local_800); + pIVar49 = (IMAGE_DOS_HEADER *)(ulonglong)local_800; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800296a2; + iVar25 = memcmp(local_740,local_748,(size_t)pIVar49); + if (iVar25 != 0) goto LAB_33; } - cVar16 = *(char *)(lVar63 + 0x178); - cVar7 = *pcVar64; - if (cVar7 == cVar16) { - pIVar42 = &IMAGE_DOS_HEADER_180000000; - switch(cVar7) { + cVar17 = *(char *)(lVar44 + 0x178); + cVar46 = *pcVar35; + if (cVar46 == cVar17) { + pIVar49 = &IMAGE_DOS_HEADER_180000000; + switch(cVar46) { case '\x01': case '\x04': case '\a': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar62 + -0x14); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)(puVar67 + -0x14); break; default: - goto switchD_18002944c_caseD_2; + goto switchD_1800296dc_caseD_2; case '\x05': case '\x06': case '\b': - param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar62 + -0x9c); + param_4 = (PRTL_CRITICAL_SECTION_DEBUG)((longlong)puVar67 + -0x9c); } local_730 = param_4; - switch(cVar16) { + switch(cVar17) { case '\x01': case '\x04': case '\a': local_7fc = 4; - local_738 = (void *)(lVar63 + 0x180); - pIVar42 = (IMAGE_DOS_HEADER *)0x4; + local_738 = (void *)(lVar44 + 0x180); + pIVar49 = (IMAGE_DOS_HEADER *)0x4; break; default: - goto switchD_18002947b_caseD_2; + goto switchD_18002970b_caseD_2; case '\x05': case '\x06': case '\b': local_7fc = 0x10; - local_738 = (void *)(lVar63 + 0x184); - pIVar42 = (IMAGE_DOS_HEADER *)0x10; + local_738 = (void *)(lVar44 + 0x184); + pIVar49 = (IMAGE_DOS_HEADER *)0x10; } - *(undefined8 *)(puVar55 + -8) = 0x1800294b1; - iVar22 = memcmp(param_4,local_738,(size_t)pIVar42); - if (iVar22 == 0) { - if ((byte)(cVar7 - 7U) < 2) { - *(undefined8 *)(puVar55 + -8) = 0x1800294cf; - IkeAddrGetAddrBytesHigh(pcVar64,(longlong *)&local_730,&local_7fc); - *(undefined8 *)(puVar55 + -8) = 0x1800294df; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029741; + iVar25 = memcmp(param_4,local_738,(size_t)pIVar49); + if (iVar25 == 0) { + if ((byte)(cVar46 - 7U) < 2) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002975f; + IkeAddrGetAddrBytesHigh(pcVar35,(longlong *)&local_730,&local_7fc); + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002976f; IkeAddrGetAddrBytesHigh - ((char *)(lVar63 + 0x178),(longlong *)&local_738,&local_7fc); - pIVar42 = (IMAGE_DOS_HEADER *)(ulonglong)local_7fc; - *(undefined8 *)(puVar55 + -8) = 0x1800294f0; - iVar22 = memcmp(local_730,local_738,(size_t)pIVar42); - if (iVar22 != 0) goto LAB_29; + ((char *)(lVar44 + 0x178),(longlong *)&local_738,&local_7fc); + pIVar49 = (IMAGE_DOS_HEADER *)(ulonglong)local_7fc; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029780; + iVar25 = memcmp(local_730,local_738,(size_t)pIVar49); + if (iVar25 != 0) goto LAB_33; } - if (puVar62[-6] == *(longlong *)(lVar63 + 0x1f0)) { - *(undefined8 *)(puVar55 + -8) = 0x1800295a3; - TraceLogHelper("IkeFullMMMatch",0,pIVar42,param_4); - pIVar61 = *(IMAGE_DOS_HEADER **)&pIVar46->e_lfarlc; - pIVar65 = pIVar46; - local_7c8 = pIVar46; + if (puVar67[-6] == *(longlong *)(lVar44 + 0x1f0)) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029833; + TraceLogHelper("IkeFullMMMatch",0,pIVar49,param_4); + pIVar71 = *(IMAGE_DOS_HEADER **)&pIVar53->e_lfarlc; + pIVar74 = pIVar53; + local_7c8 = pIVar53; break; } } } } } } -LAB_29: - *(undefined8 *)(puVar55 + -8) = 0x180029515; - TraceLogHelper("IkeFullMMMatch",0,pIVar42,param_4); - *(undefined8 *)(puVar55 + -8) = 0x180029531; - pIVar46 = (IMAGE_DOS_HEADER *) +LAB_33: + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800297a5; + TraceLogHelper("IkeFullMMMatch",0,pIVar49,param_4); + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800297c1; + pIVar53 = (IMAGE_DOS_HEADER *) RtlGetNextEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - pIVar65 = local_7c8; - } while (pIVar46 != (IMAGE_DOS_HEADER *)0x0); - } - pcVar39 = "IkeLookupMMSA"; - *(undefined8 *)(puVar55 + -8) = 0x180029557; - TraceLogHelper("IkeLookupMMSA",0,pIVar42,param_4); - pIVar38 = local_7c0; - if (pIVar61 == local_7c0) { - uVar29 = 0; - *(undefined8 *)(puVar55 + -8) = 0x1800295cb; + pIVar74 = local_7c8; + } while (pIVar53 != (IMAGE_DOS_HEADER *)0x0); + } + pcVar43 = "IkeLookupMMSA"; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800297e7; + TraceLogHelper("IkeLookupMMSA",0,pIVar49,param_4); + pIVar42 = local_7c0; + if (pIVar71 == local_7c0) { + uVar32 = 0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002985b; RtlRemoveEntryHashTable(gIkeExtGlobals[0x10].e_program + 0x38); - pIVar46 = gIkeExtGlobals; - pIVar42 = gIkeExtGlobals + 0x10; - uVar48 = *(uint *)(gIkeExtGlobals + 0x11); - uVar10._0_2_ = gIkeExtGlobals[0x11].e_maxalloc; - uVar10._2_2_ = gIkeExtGlobals[0x11].e_ss; - local_7f0.Blink = (_LIST_ENTRY *)pIVar65; - if (uVar10 <= uVar48 * 3) goto joined_r0x000180029621; - goto LAB_30; - } - } while (pIVar61 != (IMAGE_DOS_HEADER *)0x0); + pIVar53 = gIkeExtGlobals; + pIVar49 = gIkeExtGlobals + 0x10; + uVar48._0_2_ = gIkeExtGlobals[0x11].e_maxalloc; + uVar48._2_2_ = gIkeExtGlobals[0x11].e_ss; + local_7f0.Blink = (_LIST_ENTRY *)pIVar74; + if (*(uint *)(gIkeExtGlobals + 0x11) * 3 < uVar48) goto LAB_34; + if (*(uint *)(gIkeExtGlobals + 0x11) <= uVar48) goto LAB_35; + goto LAB_36; + } + } while (pIVar71 != (IMAGE_DOS_HEADER *)0x0); param_4 = (PRTL_CRITICAL_SECTION_DEBUG)0x1; - uVar29 = 0x490; - *(undefined8 *)(puVar55 + -8) = 0x180029588; - local_7b0 = WfpReportSysErrorAsWinError(pcVar39,"IkeRemoveMMSAFromHash",0x490,1); - pIVar65 = (IMAGE_DOS_HEADER *)local_7f0.Blink; -LAB_31: - *(undefined8 *)(puVar55 + -8) = 0x180029656; - TraceLogHelper("IkeRemoveMMSAFromHash",0,uVar29,param_4); - *(undefined8 *)(puVar55 + -8) = 0x180029666; - IkeReturnError(local_7b0,"IkeRemoveMMSAFromHash",uVar29,param_4); - if ((gWfpTrackHeapBytes != 0) && (pIVar65 != (IMAGE_DOS_HEADER *)0x0)) { - *(undefined8 *)(puVar55 + -8) = 0x180029686; - SVar30 = HeapSize(gWfpHeap,0,pIVar65); + uVar32 = 0x490; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029818; + local_7b0 = WfpReportSysErrorAsWinError(pcVar43,"IkeRemoveMMSAFromHash",0x490,1); + pIVar74 = (IMAGE_DOS_HEADER *)local_7f0.Blink; +LAB_35: + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800298e6; + TraceLogHelper("IkeRemoveMMSAFromHash",0,uVar32,param_4); + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800298f6; + IkeReturnError(local_7b0,"IkeRemoveMMSAFromHash",uVar32,param_4); + if ((gWfpTrackHeapBytes != 0) && (pIVar74 != (IMAGE_DOS_HEADER *)0x0)) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029916; + SVar33 = HeapSize(gWfpHeap,0,pIVar74); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar30; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar33; UNLOCK(); } - *(undefined8 *)(puVar55 + -8) = 0x1800296a9; - pIVar65 = (IMAGE_DOS_HEADER *)local_7f0.Blink; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029939; + pIVar74 = (IMAGE_DOS_HEADER *)local_7f0.Blink; HeapFree(gWfpHeap,0,local_7f0.Blink); local_7f0.Blink = (_LIST_ENTRY *)0x0; - if (*(int *)(pIVar38[4].e_program + 8) == 2) { - *(undefined8 *)(puVar55 + -8) = 0x1800296c8; - IkeRemoveMMSAFromCookieHashIkeV2((longlong)pIVar38,(longlong *)&local_7f0.Blink,pIVar65,param_4) + if (*(int *)(pIVar42[4].e_program + 8) == 2) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029958; + IkeRemoveMMSAFromCookieHashIkeV2((longlong)pIVar42,(longlong *)&local_7f0.Blink,pIVar74,param_4) ; - *(undefined8 *)(puVar55 + -8) = 0x1800296d1; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029961; WfpMemFree(&local_7f0.Blink); } - *(undefined8 *)(puVar55 + -8) = 0x1800296e3; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029973; EnterCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - if ((*(uint *)(pIVar38[4].e_program + 0x10) & 0x100000) != 0) { - pIVar65 = (IMAGE_DOS_HEADER *)0x0; - *(undefined8 *)(puVar55 + -8) = 0x180029714; + if ((*(uint *)(pIVar42[4].e_program + 0x10) & 0x100000) != 0) { + pIVar74 = (IMAGE_DOS_HEADER *)0x0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800299a4; RtlRemoveEntryHashTable(&gIkeExtGlobals[0x12].e_lfarlc); - *(undefined8 *)(puVar55 + -8) = 0x18002972c; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800299bc; WfpRestructureHashtable((longlong)&gIkeExtGlobals[0x12].e_lfarlc); - *(uint *)(pIVar38[4].e_program + 0x10) = *(uint *)(pIVar38[4].e_program + 0x10) & 0xffefffff; - } - *(undefined8 *)(puVar55 + -8) = 0x180029749; + *(uint *)(pIVar42[4].e_program + 0x10) = *(uint *)(pIVar42[4].e_program + 0x10) & 0xffefffff; + } + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800299d9; LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - uVar29 = 0; - *(undefined8 *)(puVar55 + -8) = 0x18002975c; - TraceLogHelper("IkeRemoveMMSAFromLists",0,pIVar65,param_4); - *(undefined8 *)(puVar55 + -8) = 0x18002976e; + uVar32 = 0; + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800299ec; + TraceLogHelper("IkeRemoveMMSAFromLists",0,pIVar74,param_4); + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800299fe; LeaveCriticalSection((LPCRITICAL_SECTION)(gIkeExtGlobals->e_program + 0x38)); - *(undefined8 *)(puVar55 + -8) = 0x180029781; - pIVar46 = gIkeExtGlobals; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029a11; + pIVar53 = gIkeExtGlobals; LeaveCriticalSection((LPCRITICAL_SECTION)gIkeExtGlobals); unaff_RDI = local_788; local_780 = local_788; - if (pIVar38 != (IMAGE_DOS_HEADER *)0x0) { - *(undefined8 *)(puVar55 + -8) = 0x18002979b; - IkeFreeMMSA((PRTL_CRITICAL_SECTION_DEBUG)pIVar38,uVar29,pIVar65->e_magic,(ulonglong)param_4); - pIVar46 = pIVar38; + if (pIVar42 != (IMAGE_DOS_HEADER *)0x0) { + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029a2b; + IkeFreeMMSA((PRTL_CRITICAL_SECTION_DEBUG)pIVar42,uVar32,pIVar74->e_magic,(ulonglong)param_4); + pIVar53 = pIVar42; } local_780 = unaff_RDI; unaff_RSI = (IMAGE_DOS_HEADER *)(ulonglong)local_7f8; -LAB_14: - pIVar42 = pIVar65; +LAB_16: + pIVar49 = pIVar74; if ((Microsoft_Windows_NetworkSecurityEnableBits & 1) != 0) { - *(undefined8 *)(puVar55 + -8) = 0x1800297b7; - McTemplateU0_EtwEventWriteTransfer(pIVar46,&SaContextOperationEndEvent,pIVar65); - pIVar42 = pIVar65; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029a47; + McTemplateU0_EtwEventWriteTransfer(pIVar53,&SaContextOperationEndEvent,pIVar74); + pIVar49 = pIVar74; } dwTlsIndex_01._0_2_ = gIkeExtGlobals[0x1b].e_cparhdr; dwTlsIndex_01._2_2_ = gIkeExtGlobals[0x1b].e_minalloc; if (dwTlsIndex_01 != 0xffffffff) { - *(undefined8 *)(puVar55 + -8) = 0x1800297d2; + *(undefined8 *)((longlong)puVar66 + -8) = 0x180029a62; TlsSetValue(dwTlsIndex_01,(LPVOID)0x0); } - if ((int)unaff_RSI != 0) goto LAB_15; - pppIVar69 = &WPP_GLOBAL_Control; - goto LAB_13; -joined_r0x0001800291d8: - if (uVar25 <= uVar60) goto LAB_18; - *(undefined8 *)(puVar55 + -8) = 0x1800291ea; - cVar16 = RtlContractHashTable(pIVar65->e_res_4_ + 2); - if (cVar16 == '\0') goto LAB_18; - uVar25 = *(uint *)pIVar61[0x11].e_res2_10_; - goto joined_r0x0001800291d8; - while ((uint)(*(int *)(pIVar46 + 0x11) * 3) < uVar10) { -LAB_30: - *(undefined8 *)(puVar55 + -8) = 0x18002960a; - cVar16 = RtlExpandHashTable(pIVar42->e_program + 0x38); - if (cVar16 == '\0') break; - } - goto LAB_31; -joined_r0x000180029621: - if (uVar48 <= uVar10) goto LAB_31; - *(undefined8 *)(puVar55 + -8) = 0x18002963a; - cVar16 = RtlContractHashTable(pIVar42->e_program + 0x38); - if (cVar16 == '\0') goto LAB_31; - uVar48._0_1_ = pIVar46[0x11].e_magic[0]; - uVar48._1_1_ = pIVar46[0x11].e_magic[1]; - uVar48._2_2_ = pIVar46[0x11].e_cblp; - goto joined_r0x000180029621; + if ((int)unaff_RSI != 0) goto LAB_18; + pppIVar79 = &WPP_GLOBAL_Control; + goto LAB_15; + while ((uint)(*(int *)(pIVar53 + 0x11) * 3) < uVar48) { +LAB_34: + *(undefined8 *)((longlong)puVar66 + -8) = 0x18002989a; + cVar17 = RtlExpandHashTable(pIVar49->e_program + 0x38); + if (cVar17 == '\0') break; + } + goto LAB_35; + while (uVar58._0_1_ = pIVar53[0x11].e_magic[0], uVar58._1_1_ = pIVar53[0x11].e_magic[1], + uVar58._2_2_ = pIVar53[0x11].e_cblp, uVar48 < uVar58) { +LAB_36: + *(undefined8 *)((longlong)puVar66 + -8) = 0x1800298ca; + cVar17 = RtlContractHashTable(pIVar49->e_program + 0x38); + if (cVar17 == '\0') break; + } + goto LAB_35; } ``` ## IkeReceiveCallback ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.4| |i_ratio|0.44| |m_ratio|0.74| |b_ratio|0.62| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeReceiveCallback|IkeReceiveCallback| |fullname|IkeReceiveCallback|IkeReceiveCallback| |refcount|10|10| |`length`|4782|2855| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::TlsSetValue
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWait
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::TrySubmitThreadpoolCallback
IkeAddrInitialize
IkeAddrSetPort
IkeGetTlsMmLuidIkeGetTlsPeerAddr
IkeParseRecvAncillaryInfo
IkeQueueWorkItemHiPri
IkeReturnError
IkeThrottleRecvIfNecessary
IkeVerifyPacketHeader
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
NtohHeader
TraceLogHelper
WPP_SF_iS
WPP_SF_iSd
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::htons
WS2_32.DLL::ntohl
WfpMemFree
WfpReportError
WfpReportSysErrorAsNtStatus
WfpReportSysErrorAsWinError
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
memset
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL::TlsSetValue
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::SetThreadpoolWait
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::TrySubmitThreadpoolCallback
IkeAddrInitialize
IkeAddrSetPort
IkeGetTlsMmLuidIkeGetTlsPeerAddr
IkeParseRecvAncillaryInfo
IkeQueueWorkItemHiPri
IkeReturnError
IkeThrottleRecvIfNecessary
IkeVerifyPacketHeader
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
TraceLogHelper
WPP_SF_iS
WPP_SF_iSd
WS2_32.DLL::WSAGetLastError
WS2_32.DLL::htons
WS2_32.DLL::ntohl
WfpMemFree
WfpReportAppErrorAsWinError
WfpReportError
WfpReportSysErrorAsNtStatus
WfpReportSysErrorAsWinError
__security_check_cookie
_guard_xfg_dispatch_icall_nop
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memcpy
memset
| |calling||| |paramcount|4|4| |`address`|180035500|180035790| |sig|undefined __fastcall IkeReceiveCallback(undefined8 param_1, undefined8 param_2, _ACTIVATION_CONTEXT * param_3, undefined8 param_4)|undefined __fastcall IkeReceiveCallback(undefined8 param_1, undefined8 param_2, _ACTIVATION_CONTEXT * param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeReceiveCallback Called Diff ```diff --- IkeReceiveCallback called +++ IkeReceiveCallback called @@ -20 +19,0 @@ -NtohHeader @@ -27,0 +27 @@ +WfpReportAppErrorAsWinError ``` ### IkeReceiveCallback Diff ```diff --- IkeReceiveCallback +++ IkeReceiveCallback @@ -1,749 +1,657 @@ /* WARNING: Control flow encountered bad instruction data */ -/* WARNING: Instruction at (ram,0x00018003602e) overlaps instruction at (ram,0x00018003602c) - */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_xfg_dispatch_icall_nop replaced with injection: guard_dispatch_icall */ -/* WARNING: Removing unreachable block (ram,0x000180035fd6) */ -/* WARNING: Removing unreachable block (ram,0x000180036032) */ -/* WARNING: Removing unreachable block (ram,0x000180035fda) */ -/* WARNING: Removing unreachable block (ram,0x00018003604b) */ -/* WARNING: Removing unreachable block (ram,0x000180035ff2) */ -/* WARNING: Removing unreachable block (ram,0x000180036057) */ -/* WARNING: Removing unreachable block (ram,0x00018003605c) */ -/* WARNING: Removing unreachable block (ram,0x000180035ffe) */ -/* WARNING: Removing unreachable block (ram,0x000180036063) */ -/* WARNING: Removing unreachable block (ram,0x00018003608a) */ -/* WARNING: Removing unreachable block (ram,0x0001800367d2) */ -/* WARNING: Removing unreachable block (ram,0x0001800360a4) */ -/* WARNING: Removing unreachable block (ram,0x0001800361e2) */ -/* WARNING: Removing unreachable block (ram,0x0001800361ec) */ -/* WARNING: Removing unreachable block (ram,0x00018003621d) */ -/* WARNING: Removing unreachable block (ram,0x00018003622b) */ -/* WARNING: Removing unreachable block (ram,0x00018003668d) */ -/* WARNING: Removing unreachable block (ram,0x0001800366a0) */ -/* WARNING: Removing unreachable block (ram,0x0001800366a6) */ -/* WARNING: Removing unreachable block (ram,0x0001800366ac) */ -/* WARNING: Removing unreachable block (ram,0x0001800366dd) */ -/* WARNING: Removing unreachable block (ram,0x0001800366e6) */ -/* WARNING: Removing unreachable block (ram,0x0001800366f8) */ -/* WARNING: Removing unreachable block (ram,0x0001800360d4) */ -/* WARNING: Removing unreachable block (ram,0x0001800360de) */ -/* WARNING: Removing unreachable block (ram,0x000180036120) */ -/* WARNING: Removing unreachable block (ram,0x000180036129) */ -/* WARNING: Removing unreachable block (ram,0x00018003613c) */ -/* WARNING: Removing unreachable block (ram,0x000180036142) */ -/* WARNING: Removing unreachable block (ram,0x000180036148) */ -/* WARNING: Removing unreachable block (ram,0x000180036179) */ -/* WARNING: Removing unreachable block (ram,0x000180036186) */ -/* WARNING: Removing unreachable block (ram,0x00018003619c) */ -/* WARNING: Removing unreachable block (ram,0x00018003622e) */ -/* WARNING: Removing unreachable block (ram,0x00018003623c) */ -/* WARNING: Removing unreachable block (ram,0x000180036245) */ -/* WARNING: Removing unreachable block (ram,0x000180036253) */ -/* WARNING: Removing unreachable block (ram,0x000180036259) */ -/* WARNING: Removing unreachable block (ram,0x00018003626d) */ -/* WARNING: Removing unreachable block (ram,0x000180036278) */ -/* WARNING: Removing unreachable block (ram,0x00018003628b) */ -/* WARNING: Removing unreachable block (ram,0x000180036291) */ -/* WARNING: Removing unreachable block (ram,0x000180036297) */ -/* WARNING: Removing unreachable block (ram,0x0001800362c8) */ -/* WARNING: Removing unreachable block (ram,0x0001800362d5) */ -/* WARNING: Removing unreachable block (ram,0x0001800362eb) */ -/* WARNING: Removing unreachable block (ram,0x000180036331) */ -/* WARNING: Removing unreachable block (ram,0x00018003633b) */ -/* WARNING: Removing unreachable block (ram,0x000180036503) */ -/* WARNING: Removing unreachable block (ram,0x000180036514) */ -/* WARNING: Removing unreachable block (ram,0x000180036345) */ -/* WARNING: Removing unreachable block (ram,0x0001800364e4) */ -/* WARNING: Removing unreachable block (ram,0x0001800364ee) */ -/* WARNING: Removing unreachable block (ram,0x0001800364f8) */ -/* WARNING: Removing unreachable block (ram,0x0001800364fe) */ -/* WARNING: Removing unreachable block (ram,0x000180036350) */ -/* WARNING: Removing unreachable block (ram,0x000180036364) */ -/* WARNING: Removing unreachable block (ram,0x000180036377) */ -/* WARNING: Removing unreachable block (ram,0x00018003637d) */ -/* WARNING: Removing unreachable block (ram,0x000180036383) */ -/* WARNING: Removing unreachable block (ram,0x0001800363b4) */ -/* WARNING: Removing unreachable block (ram,0x0001800363c1) */ -/* WARNING: Removing unreachable block (ram,0x0001800363d7) */ -/* WARNING: Removing unreachable block (ram,0x00018003641d) */ -/* WARNING: Removing unreachable block (ram,0x00018003642b) */ -/* WARNING: Removing unreachable block (ram,0x00018003643e) */ -/* WARNING: Removing unreachable block (ram,0x000180036444) */ -/* WARNING: Removing unreachable block (ram,0x00018003644a) */ -/* WARNING: Removing unreachable block (ram,0x00018003647b) */ -/* WARNING: Removing unreachable block (ram,0x000180036488) */ -/* WARNING: Removing unreachable block (ram,0x00018003649e) */ -/* WARNING: Removing unreachable block (ram,0x000180036739) */ -/* WARNING: Removing unreachable block (ram,0x00018003651d) */ -/* WARNING: Removing unreachable block (ram,0x000180036527) */ -/* WARNING: Removing unreachable block (ram,0x00018003652e) */ -/* WARNING: Removing unreachable block (ram,0x000180036536) */ -/* WARNING: Removing unreachable block (ram,0x00018003653c) */ -/* WARNING: Removing unreachable block (ram,0x000180036545) */ -/* WARNING: Removing unreachable block (ram,0x00018003654b) */ -/* WARNING: Removing unreachable block (ram,0x000180036553) */ -/* WARNING: Removing unreachable block (ram,0x000180036756) */ -/* WARNING: Removing unreachable block (ram,0x00018003655c) */ -/* WARNING: Removing unreachable block (ram,0x00018003656b) */ -/* WARNING: Removing unreachable block (ram,0x00018003657e) */ -/* WARNING: Removing unreachable block (ram,0x000180036599) */ -/* WARNING: Removing unreachable block (ram,0x0001800365a7) */ -/* WARNING: Removing unreachable block (ram,0x0001800365ba) */ -/* WARNING: Removing unreachable block (ram,0x0001800365c0) */ -/* WARNING: Removing unreachable block (ram,0x0001800365c6) */ -/* WARNING: Removing unreachable block (ram,0x0001800365f7) */ -/* WARNING: Removing unreachable block (ram,0x000180036600) */ -/* WARNING: Removing unreachable block (ram,0x000180036612) */ -/* WARNING: Removing unreachable block (ram,0x000180036670) */ -/* WARNING: Removing unreachable block (ram,0x00018003667b) */ -/* WARNING: Removing unreachable block (ram,0x000180036682) */ -/* WARNING: Removing unreachable block (ram,0x00018003675c) */ -/* WARNING: Removing unreachable block (ram,0x000180036776) */ -/* WARNING: Removing unreachable block (ram,0x000180036784) */ -/* WARNING: Recovered jumptable eliminated as dead code */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void IkeReceiveCallback(undefined8 param_1,undefined8 param_2,_ACTIVATION_CONTEXT *param_3, undefined8 param_4) { longlong *plVar1; + int *piVar2; + char *pcVar3; + undefined4 uVar4; void *_Dst; - undefined8 *puVar2; - bool bVar3; - char cVar4; - u_short uVar5; - u_short uVar6; - u_long uVar7; - u_long uVar8; - BOOL BVar9; - DWORD DVar10; - uint uVar11; - int iVar12; - uint uVar13; - wchar_t *pwVar14; - undefined8 uVar15; - PTP_CALLBACK_ENVIRON pTVar16; - TP_CALLBACK_PRIORITY *pTVar17; - longlong lVar18; - undefined8 *lpMem; - PTP_CALLBACK_ENVIRON pTVar19; - SIZE_T SVar20; - longlong lVar21; - longlong *plVar22; - int *piVar23; + undefined8 *puVar5; + char cVar6; + u_short uVar7; + u_short uVar8; + int iVar9; + u_long uVar10; + u_long uVar11; + BOOL BVar12; + DWORD DVar13; + uint uVar14; + wchar_t *pwVar15; + undefined8 uVar16; + PTP_CALLBACK_ENVIRON pTVar17; + TP_CALLBACK_PRIORITY *pTVar18; + undefined8 *puVar19; + PTP_CALLBACK_ENVIRON pTVar20; + SIZE_T SVar21; + longlong lVar22; + longlong *plVar23; undefined4 *puVar24; HANDLE pvVar25; - code *pcVar26; - uint *puVar27; + ulonglong uVar26; + code *pcVar27; + uint *puVar28; _ACTIVATION_CONTEXT *pwa; - undefined8 uVar28; + char *pcVar29; + undefined8 uVar30; _ACTIVATION_CONTEXT *h; - undefined1 *puVar29; - undefined1 *puVar30; - undefined1 *puVar31; - PTP_CLEANUP_GROUP p_Var32; - undefined *puVar33; - ulonglong uVar34; - char in_AF; + longlong lVar31; + undefined1 *puVar32; + undefined1 *puVar33; + undefined1 *puVar34; + PTP_CLEANUP_GROUP p_Var35; + undefined *puVar36; + ulonglong uVar37; undefined8 uStackY_330; undefined1 auStackY_328 [8]; undefined1 auStackY_320 [24]; int local_2f8; undefined4 uStack_2f4; undefined8 local_2e8; undefined8 uStack_2e0; undefined8 local_2d8; undefined8 uStack_2d0; undefined8 local_2c8; undefined8 uStack_2c0; undefined8 local_2b8; undefined8 local_2b0; void *pvStack_2a8; undefined8 local_2a0; undefined4 uStack_298; undefined4 uStack_294; undefined8 local_288; undefined8 uStack_280; void *local_278; uint uStack_270; undefined4 uStack_26c; undefined8 local_268; undefined8 uStack_260; undefined8 local_258; undefined8 uStack_250; undefined8 local_248; undefined8 uStack_240; undefined8 local_238; undefined8 uStack_230; undefined8 local_228; undefined8 uStack_220; undefined4 local_218; uint uStack_214; undefined2 uStack_210; undefined2 uStack_20e; u_long uStack_20c; undefined4 local_208; undefined4 uStack_204; undefined4 uStack_200; undefined4 uStack_1fc; undefined4 local_1f8; undefined4 uStack_1f4; undefined4 uStack_1f0; undefined4 uStack_1ec; undefined4 local_1e8; undefined4 uStack_1e4; undefined4 uStack_1e0; undefined4 uStack_1dc; undefined8 local_1d8; undefined8 uStack_1d0; undefined8 local_1c8; undefined8 uStack_1c0; undefined8 local_1b8; undefined8 uStack_1b0; undefined8 local_1a8; undefined8 uStack_1a0; PTP_CLEANUP_GROUP local_198; undefined8 uStack_190; undefined8 local_188; u_long local_180; undefined1 local_178 [176]; undefined8 local_c8 [4]; undefined8 *local_a8; undefined8 local_a0; longlong local_98 [2]; longlong local_88 [2]; int *local_78; undefined8 local_70; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; undefined8 uStack_40; undefined8 local_38; undefined8 uStack_30; ulonglong local_28; - puVar29 = auStackY_328; - puVar31 = auStackY_328; - puVar30 = auStackY_328; + puVar32 = auStackY_328; + puVar34 = auStackY_328; + puVar33 = auStackY_328; local_28 = __security_cookie ^ (ulonglong)auStackY_328; - lVar21 = 0; + lVar22 = 0; uStack_2f4 = 0; - uVar15 = param_4; + uVar16 = param_4; memset(&local_288,0,0xf0); local_2b8 = 0; - puVar33 = (undefined *)0xa8; + puVar36 = (undefined *)0xa8; local_2b0 = 0; pvStack_2a8 = (void *)0x0; local_68 = 0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; local_48 = 0; uStack_40 = 0; local_38 = 0; uStack_30 = 0; local_2e8 = 0; uStack_2e0 = 0; local_2d8 = 0; uStack_2d0 = 0; local_2c8 = 0; uStack_2c0 = 0; memset(local_178,0,0xa8); - uVar28 = 1; - TraceLogHelper("IkeReceiveCallback",1,puVar33,uVar15); + uVar30 = 1; + TraceLogHelper("IkeReceiveCallback",1,puVar36,uVar16); if (*(int *)&gIkeExtGlobals[0x1c].CleanupGroup == 2) goto LAB_0; if ((int)param_4 != 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar14 = (wchar_t *)IkeGetTlsPeerAddr(); - uVar15 = IkeGetTlsMmLuid(); - puVar33 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - WPP_SF_iSd(WPP_GLOBAL_Control[2],0x19,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,uVar15, - pwVar14); - } - puVar31 = auStackY_328; - pTVar19 = gIkeExtGlobals; + pwVar15 = (wchar_t *)IkeGetTlsPeerAddr(); + uVar16 = IkeGetTlsMmLuid(); + puVar36 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + WPP_SF_iSd(WPP_GLOBAL_Control[2],0x19,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,uVar16, + pwVar15); + } + puVar34 = auStackY_328; + pTVar20 = gIkeExtGlobals; if ((4 < DAT_1) && - (cVar4 = _tlgKeywordOn(0x180164278,0), puVar31 = auStackY_328, cVar4 != '\0')) { + (cVar6 = _tlgKeywordOn(0x180165278,0), puVar34 = auStackY_328, cVar6 != '\0')) { local_2a0 = IkeGetTlsMmLuid(); local_a8 = &local_2a0; local_a0 = 8; - pwVar14 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_98,pwVar14); + pwVar15 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_98,pwVar15); _tlgCreate1Sz_char(local_88,"Ignoring IkeReceiveCallback for wait result"); local_78 = &local_2f8; local_70 = 4; local_2f8 = (int)param_4; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,&DAT_2,puVar33,pTVar19,6,local_c8) + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_2,puVar36,pTVar20,6,local_c8) ; - puVar31 = auStackY_328; - pTVar19 = gIkeExtGlobals; + puVar34 = auStackY_328; + pTVar20 = gIkeExtGlobals; } goto LAB_3; } - pTVar19 = gIkeExtGlobals; + pTVar20 = gIkeExtGlobals; if (*(DWORD *)&gIkeExtGlobals[0x30].Pool != 0xffffffff) { - uVar28 = 0; + uVar30 = 0; TlsSetValue(*(DWORD *)&gIkeExtGlobals[0x30].Pool,(LPVOID)0x0); } - IkeThrottleRecvIfNecessary((uint *)&gThrottleState,uVar28,puVar33,pTVar19); - TraceLogHelper("IkeInitRcvBuffers",1,puVar33,pTVar19); - bVar3 = false; + IkeThrottleRecvIfNecessary((uint *)&gThrottleState,uVar30,puVar36,pTVar20); + TraceLogHelper("IkeInitRcvBuffers",1,puVar36,pTVar20); if (param_3 == gIkeExtGlobals[0x2d].ActivationContext) { - p_Var32 = *(PTP_CLEANUP_GROUP *)&gIkeExtGlobals[0x27].Size; - cVar4 = '\x01'; + p_Var35 = *(PTP_CLEANUP_GROUP *)&gIkeExtGlobals[0x27].Size; + cVar6 = '\x01'; IkeAddrInitialize((char *)&uStack_214,'\x01'); - IkeAddrInitialize((char *)&uStack_250,cVar4); - uVar5 = htons(500); - IkeAddrSetPort((char *)&uStack_250,uVar5); + IkeAddrInitialize((char *)&uStack_250,cVar6); + uVar7 = htons(500); + IkeAddrSetPort((char *)&uStack_250,uVar7); uStack_2e0 = CONCAT44(uStack_2e0._4_4_,0x10); local_2c8 = CONCAT44(local_2c8._4_4_,0x30); - puVar30 = auStackY_328; + lVar31 = lVar22; + puVar33 = auStackY_328; } else if (param_3 == (_ACTIVATION_CONTEXT *)gIkeExtGlobals[0x2d].FinalizationCallback) { - p_Var32 = *(PTP_CLEANUP_GROUP *)(gIkeExtGlobals + 0x28); - cVar4 = '\x01'; + p_Var35 = *(PTP_CLEANUP_GROUP *)(gIkeExtGlobals + 0x28); + cVar6 = '\x01'; IkeAddrInitialize((char *)&uStack_214,'\x01'); - IkeAddrInitialize((char *)&uStack_250,cVar4); - uVar5 = htons(0x1194); - IkeAddrSetPort((char *)&uStack_250,uVar5); + IkeAddrInitialize((char *)&uStack_250,cVar6); + uVar7 = htons(0x1194); + IkeAddrSetPort((char *)&uStack_250,uVar7); uStack_2e0 = CONCAT44(uStack_2e0._4_4_,0x10); + lVar31 = 0; local_2c8 = CONCAT44(local_2c8._4_4_,0x30); - puVar30 = auStackY_328; + puVar33 = auStackY_328; } else { - pTVar16 = gIkeExtGlobals; + pTVar17 = gIkeExtGlobals; if (param_3 == *(_ACTIVATION_CONTEXT **)&gIkeExtGlobals[0x2d].u) { - p_Var32 = (PTP_CLEANUP_GROUP)gIkeExtGlobals[0x28].Pool; + p_Var35 = (PTP_CLEANUP_GROUP)gIkeExtGlobals[0x28].Pool; uStack_20e = 0; uStack_20c = 0; local_208 = 0; uStack_210 = 0x17; local_248 = 0; uStack_204 = 0; uStack_200 = 0; uStack_1fc = 0; local_1f8 = 0; uStack_1e4 = 0; uStack_1e0 = 0; uStack_1f4 = 0; uStack_1f0 = 0; uStack_1ec = 0; local_1e8 = 0; uStack_1dc = 0; uStack_214 = 5; uStack_240 = 0; local_238 = 0; uStack_220 = 0; uStack_230 = 0; local_228 = 0; local_218 = 0; uStack_250 = 0x1700000005; - uVar5 = htons(500); - cVar4 = (char)uStack_250; - switch(cVar4) { + uVar7 = htons(500); + cVar6 = (char)uStack_250; + switch(cVar6) { default: - pcVar26 = (code *)swi(0x29); - pTVar16 = (PTP_CALLBACK_ENVIRON)(*pcVar26)(0x25); - puVar29 = auStackY_320; + pcVar27 = (code *)swi(0x29); + pTVar17 = (PTP_CALLBACK_ENVIRON)(*pcVar27)(0x25); + puVar32 = auStackY_320; goto LAB_4; case '\a': - uStack_240 = CONCAT26(uVar5,(undefined6)uStack_240); - uStack_250 = CONCAT26(uVar5,(undefined6)uStack_250); + uStack_240 = CONCAT26(uVar7,(undefined6)uStack_240); + uStack_250 = CONCAT26(uVar7,(undefined6)uStack_250); break; case '\b': - uStack_230._0_4_ = CONCAT22(uVar5,(undefined2)uStack_230); + uStack_230._0_4_ = CONCAT22(uVar7,(undefined2)uStack_230); case '\x01': case '\x04': case '\x05': case '\x06': - uStack_250 = CONCAT26(uVar5,(undefined6)uStack_250); - puVar30 = auStackY_328; + uStack_250 = CONCAT26(uVar7,(undefined6)uStack_250); + puVar33 = auStackY_328; } } else { LAB_4: - p_Var32 = pTVar16[0x28].CleanupGroup; - cVar4 = '\x05'; - *(undefined8 *)(puVar29 + -8) = 0x18003588a; + p_Var35 = pTVar17[0x28].CleanupGroup; + cVar6 = '\x05'; + *(undefined8 *)(puVar32 + -8) = 0x180035b1a; IkeAddrInitialize((char *)&uStack_214,'\x05'); - *(undefined8 *)(puVar29 + -8) = 0x180035893; - IkeAddrInitialize((char *)&uStack_250,cVar4); - *(undefined8 *)(puVar29 + -8) = 0x18003589f; - uVar5 = htons(0x1194); - *(undefined8 *)(puVar29 + -8) = 0x1800358b0; - IkeAddrSetPort((char *)&uStack_250,uVar5); - puVar30 = puVar29; - } - bVar3 = true; - *(undefined4 *)(puVar30 + 0x60) = 0x40; - *(undefined4 *)(puVar30 + 0x48) = 0x1c; - } - *(undefined4 *)(puVar30 + 0x78) = 0x10000; - *(undefined1 **)(puVar30 + 0x50) = puVar30 + 0x78; - *(undefined2 **)(puVar30 + 0x40) = &uStack_210; - *(undefined8 **)(puVar30 + 0x68) = &local_68; + *(undefined8 *)(puVar32 + -8) = 0x180035b23; + IkeAddrInitialize((char *)&uStack_250,cVar6); + *(undefined8 *)(puVar32 + -8) = 0x180035b2f; + uVar7 = htons(0x1194); + *(undefined8 *)(puVar32 + -8) = 0x180035b40; + IkeAddrSetPort((char *)&uStack_250,uVar7); + puVar33 = puVar32; + } + lVar31 = 1; + *(undefined4 *)(puVar33 + 0x60) = 0x40; + *(undefined4 *)(puVar33 + 0x48) = 0x1c; + } + *(undefined4 *)(puVar33 + 0x78) = 0x10000; + *(undefined1 **)(puVar33 + 0x50) = puVar33 + 0x78; + *(undefined2 **)(puVar33 + 0x40) = &uStack_210; + *(undefined8 **)(puVar33 + 0x68) = &local_68; pvStack_2a8 = recvBuffer; - *(undefined4 *)(puVar30 + 0x58) = 1; + *(undefined4 *)(puVar33 + 0x58) = 1; uStack_270 = 0x10000; local_278 = recvBuffer; - *(undefined8 *)(puVar30 + -8) = 0x180035918; - TraceLogHelper("IkeInitRcvBuffers",0,puVar33,pTVar19); - pcVar26 = *(code **)&gIkeExtGlobals[0x28].u; - pTVar16 = (PTP_CALLBACK_ENVIRON)(puVar30 + 0x34); - plVar22 = (longlong *)0x0; - *(undefined8 *)(puVar30 + 0x20) = 0; - *(undefined8 *)(puVar30 + -8) = 0x18003594b; - iVar12 = (*pcVar26)(p_Var32); + *(undefined8 *)(puVar33 + -8) = 0x180035ba8; + TraceLogHelper("IkeInitRcvBuffers",0,puVar36,pTVar20); + pcVar27 = *(code **)&gIkeExtGlobals[0x28].u; + pTVar17 = (PTP_CALLBACK_ENVIRON)(puVar33 + 0x34); + plVar23 = (longlong *)0x0; + *(undefined8 *)(puVar33 + 0x20) = 0; + *(undefined8 *)(puVar33 + -8) = 0x180035bdb; + iVar9 = (*pcVar27)(p_Var35,puVar33 + 0x40); switch(uStack_214 & 0xff) { case 1: case 4: case 7: - *(undefined8 *)(puVar30 + -8) = 0x18003597a; - uVar7 = ntohl(uStack_20c); - *(u_long *)(puVar30 + 0x30) = - uVar7 >> 0x18 | (uVar7 & 0xff0000) >> 8 | (uVar7 & 0xff00) << 8 | uVar7 << 0x18; - *(undefined8 *)(puVar30 + -8) = 0x180035998; - RtlIpv4AddressToStringW(puVar30 + 0x30); + *(undefined8 *)(puVar33 + -8) = 0x180035c0a; + uVar10 = ntohl(uStack_20c); + *(u_long *)(puVar33 + 0x30) = + uVar10 >> 0x18 | (uVar10 & 0xff0000) >> 8 | (uVar10 & 0xff00) << 8 | uVar10 << 0x18; + *(undefined8 *)(puVar33 + -8) = 0x180035c28; + RtlIpv4AddressToStringW(puVar33 + 0x30); break; default: - pcVar26 = (code *)swi(0x29); - piVar23 = (int *)(*pcVar26)(); - uVar13 = (int)piVar23 + *piVar23; - uVar11 = uVar13 + *(uint *)(ulonglong)uVar13; - uVar11 = CONCAT22((short)(uVar11 >> 0x10), - CONCAT11(((int)uVar11 < 0) << 7 | (uVar11 == 0) << 6 | in_AF << 4 | - ((POPCOUNT(uVar11 & 0xff) & 1U) == 0) << 2 | 2U | - CARRY4(uVar13,*(uint *)(ulonglong)uVar13),(char)uVar11)); - uVar15 = *(undefined8 *)(puVar30 + 8); - uVar11 = uVar11 + *(int *)(ulonglong)uVar11; - *(undefined4 *)(ulonglong)uVar11 = *(undefined4 *)(ulonglong)uVar11; - uVar11 = CONCAT31((int3)(uVar11 >> 8),(char)uVar11 + '^'); - iVar12 = uVar11 + *(int *)(ulonglong)uVar11; - uVar11 = CONCAT31((int3)((uint)iVar12 >> 8),(char)iVar12 + '^'); - puVar24 = (undefined4 *)(ulonglong)(uVar11 + *(int *)(ulonglong)uVar11); - *puVar24 = *puVar24; - *puVar24 = *puVar24; - *puVar24 = *puVar24; - *puVar24 = *puVar24; - *puVar24 = *puVar24; - pcVar26 = (code *)swi(3); - (*pcVar26)(uVar15); - return; + pcVar29 = &DAT_5; + pcVar27 = (code *)swi(0x29); + puVar24 = (undefined4 *)(*pcVar27)(); + uVar4 = *puVar24; + *(int *)(lVar31 + 3) = *(int *)(lVar31 + 3) + (int)lVar31; + *pcVar29 = *pcVar29 + (char)puVar24 + (char)uVar4; + uVar14 = in((short)*(undefined8 *)(puVar33 + 0x28)); + lVar22 = *(longlong *)(puVar33 + 0x30); + uVar14 = uVar14 + *(int *)(ulonglong)uVar14; + piVar2 = (int *)(lVar22 + 3); + *piVar2 = -*piVar2; + *(char *)(ulonglong)uVar14 = *(char *)(ulonglong)uVar14 + (char)uVar14; + pcVar3 = (char *)(lVar22 + 0x362); + *pcVar3 = *pcVar3 + (char)pcVar29; + /* WARNING: Bad instruction - Truncating control flow here */ + halt_baddata(); case 5: case 6: case 8: local_2a0 = CONCAT44(uStack_204,local_208); uStack_298 = uStack_200; uStack_294 = uStack_1fc; - *(undefined8 *)(puVar30 + -8) = 0x1800359b9; + *(undefined8 *)(puVar33 + -8) = 0x180035c49; RtlIpv6AddressToStringW(&local_2a0); } - uVar11 = *(uint *)&gIkeExtGlobals[0x30].Pool; - puVar27 = (uint *)(ulonglong)uVar11; - if (uVar11 != 0xffffffff) { - *(undefined8 *)(puVar30 + -8) = 0x1800359de; - TlsSetValue(uVar11,local_178); - } - if (iVar12 != 0) { - if (bVar3) { - pTVar17 = (TP_CALLBACK_PRIORITY *)&gIkeExtGlobals[0x1a].field_0x44; + uVar14 = *(uint *)&gIkeExtGlobals[0x30].Pool; + puVar28 = (uint *)(ulonglong)uVar14; + if (uVar14 != 0xffffffff) { + *(undefined8 *)(puVar33 + -8) = 0x180035c6e; + TlsSetValue(uVar14,local_178); + } + if (iVar9 != 0) { + if ((int)lVar31 == 0) { + pTVar18 = &gIkeExtGlobals[0x1a].CallbackPriority; } else { - pTVar17 = &gIkeExtGlobals[0x1a].CallbackPriority; + pTVar18 = (TP_CALLBACK_PRIORITY *)&gIkeExtGlobals[0x1a].field_0x44; } LOCK(); - *pTVar17 = *pTVar17 + TP_CALLBACK_PRIORITY_NORMAL; + *pTVar18 = *pTVar18 + TP_CALLBACK_PRIORITY_NORMAL; UNLOCK(); - *(undefined8 *)(puVar30 + -8) = 0x180035a0a; - uVar11 = WSAGetLastError(); - uVar34 = (ulonglong)uVar11; -LAB_5: - *(undefined8 *)(puVar30 + -8) = 0x180035efb; - WfpReportSysErrorAsWinError(puVar27,"IkeReceiveCallback",uVar34,1); - puVar31 = puVar30; - pTVar19 = gIkeExtGlobals; + *(undefined8 *)(puVar33 + -8) = 0x180035c9a; + uVar14 = WSAGetLastError(); + uVar37 = (ulonglong)uVar14; +LAB_6: + *(undefined8 *)(puVar33 + -8) = 0x1800361bd; + WfpReportSysErrorAsWinError(puVar28,"IkeReceiveCallback",uVar37,1); + puVar34 = puVar33; + pTVar20 = gIkeExtGlobals; goto LAB_3; } LOCK(); *(int *)&gIkeExtGlobals[0x1b].field_0x4 = *(int *)&gIkeExtGlobals[0x1b].field_0x4 + 1; UNLOCK(); - if (((*(uint *)(puVar30 + 0x70) >> 10 & 1) != 0) || ((*(uint *)(puVar30 + 0x70) >> 0xb & 1) != 0)) + if (((*(uint *)(puVar33 + 0x70) >> 10 & 1) != 0) || ((*(uint *)(puVar33 + 0x70) >> 0xb & 1) != 0)) { -LAB_6: - puVar27 = (uint *)&WPP_GLOBAL_Control; +LAB_7: + puVar28 = (uint *)&WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - *(undefined8 *)(puVar30 + -8) = 0x180035e2f; - lVar21 = IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar30 + -8) = 0x180035e37; - plVar22 = (longlong *)IkeGetTlsMmLuid(); - pTVar16 = (PTP_CALLBACK_ENVIRON)&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - *(longlong *)(puVar30 + 0x20) = lVar21; - puVar27 = (uint *)WPP_GLOBAL_Control[2]; - *(undefined8 *)(puVar30 + -8) = 0x180035e5b; - WPP_SF_iS(puVar27,0x1a,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,plVar22, - *(wchar_t **)(puVar30 + 0x20)); + *(undefined8 *)(puVar33 + -8) = 0x1800360f1; + lVar22 = IkeGetTlsPeerAddr(); + *(undefined8 *)(puVar33 + -8) = 0x1800360f9; + plVar23 = (longlong *)IkeGetTlsMmLuid(); + pTVar17 = (PTP_CALLBACK_ENVIRON)&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + *(longlong *)(puVar33 + 0x20) = lVar22; + puVar28 = (uint *)WPP_GLOBAL_Control[2]; + *(undefined8 *)(puVar33 + -8) = 0x18003611d; + WPP_SF_iS(puVar28,0x1a,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,plVar23, + *(wchar_t **)(puVar33 + 0x20)); } if (4 < DAT_1) { - puVar27 = &DAT_1; - *(undefined8 *)(puVar30 + -8) = 0x180035e72; - cVar4 = _tlgKeywordOn(0x180164278,0); - if (cVar4 != '\0') { - *(undefined8 *)(puVar30 + -8) = 0x180035e7b; + puVar28 = &DAT_1; + *(undefined8 *)(puVar33 + -8) = 0x180036134; + cVar6 = _tlgKeywordOn(0x180165278,0); + if (cVar6 != '\0') { + *(undefined8 *)(puVar33 + -8) = 0x18003613d; local_2a0 = IkeGetTlsMmLuid(); local_a8 = &local_2a0; local_a0 = 8; - *(undefined8 *)(puVar30 + -8) = 0x180035e9a; - pwVar14 = (wchar_t *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar30 + -8) = 0x180035ea9; - _tlgCreate1Sz_wchar_t(local_98,pwVar14); - *(undefined8 *)(puVar30 + -8) = 0x180035ebc; + *(undefined8 *)(puVar33 + -8) = 0x18003615c; + pwVar15 = (wchar_t *)IkeGetTlsPeerAddr(); + *(undefined8 *)(puVar33 + -8) = 0x18003616b; + _tlgCreate1Sz_wchar_t(local_98,pwVar15); + *(undefined8 *)(puVar33 + -8) = 0x18003617e; _tlgCreate1Sz_char(local_88,"Dropping incoming MCAST/BCAST packet."); - *(undefined8 **)(puVar30 + 0x28) = local_c8; - puVar27 = &DAT_1; - *(undefined4 *)(puVar30 + 0x20) = 5; - *(undefined8 *)(puVar30 + -8) = 0x180035ee3; + *(undefined8 **)(puVar33 + 0x28) = local_c8; + puVar28 = &DAT_1; + *(undefined4 *)(puVar33 + 0x20) = 5; + *(undefined8 *)(puVar33 + -8) = 0x1800361a5; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_7,pTVar16,plVar22,*(undefined4 *)(puVar30 + 0x20), - *(undefined8 **)(puVar30 + 0x28)); + (0x180165278,&DAT_8,pTVar17,plVar23,*(undefined4 *)(puVar33 + 0x20), + *(undefined8 **)(puVar33 + 0x28)); } } - uVar34 = 0x32; - goto LAB_5; - } - *(undefined8 *)(puVar30 + -8) = 0x180035a44; - lVar18 = IkeParseRecvAncillaryInfo - ((longlong)(puVar30 + 0x40),(longlong)&local_288,(longlong *)pTVar16,plVar22); - puVar31 = puVar30; - pTVar19 = gIkeExtGlobals; - if (lVar18 != 0) goto LAB_3; - uStack_270 = *(uint *)(puVar30 + 0x34); - *(undefined8 *)(puVar30 + -8) = 0x180035a5d; - lVar18 = IkeVerifyPacketHeader((undefined1 *)&local_288); - pTVar19 = gIkeExtGlobals; - if (lVar18 != 0) goto LAB_3; - _DAT_8 = _DAT_8 + 1; - *(undefined8 *)(puVar30 + -8) = 0x180035a7b; - TraceLogHelper("IkeQueueRecvRequest",1,pTVar16,plVar22); - *(undefined8 *)(puVar30 + -8) = 0x180035a94; + uVar37 = 0x32; + goto LAB_6; + } + puVar19 = &local_288; + *(undefined8 *)(puVar33 + -8) = 0x180035cd4; + lVar31 = IkeParseRecvAncillaryInfo + ((longlong)(puVar33 + 0x40),(longlong)puVar19,(longlong *)pTVar17,plVar23); + puVar34 = puVar33; + pTVar20 = gIkeExtGlobals; + if (lVar31 != 0) goto LAB_3; + uStack_270 = *(uint *)(puVar33 + 0x34); + *(undefined8 *)(puVar33 + -8) = 0x180035ced; + lVar31 = IkeVerifyPacketHeader((undefined1 *)&local_288,puVar19,(undefined *)pTVar17,plVar23); + pTVar20 = gIkeExtGlobals; + if (lVar31 != 0) goto LAB_3; + _DAT_9 = _DAT_9 + 1; + *(undefined8 *)(puVar33 + -8) = 0x180035d0b; + TraceLogHelper("IkeQueueRecvRequest",1,pTVar17,plVar23); + *(undefined8 *)(puVar33 + -8) = 0x180035d24; pvVar25 = gWfpHeap; - lpMem = HeapAlloc(gWfpHeap,8,0xf0); - *(undefined8 **)(puVar30 + 0x38) = lpMem; - if (lpMem != (undefined8 *)0x0) { + puVar19 = HeapAlloc(gWfpHeap,8,0xf0); + *(undefined8 **)(puVar33 + 0x38) = puVar19; + if (puVar19 != (undefined8 *)0x0) { if (gWfpTrackHeapBytes != 0) { - *(undefined8 *)(puVar30 + -8) = 0x180035aef; - SVar20 = HeapSize(gWfpHeap,0,lpMem); + *(undefined8 *)(puVar33 + -8) = 0x180035d7f; + SVar21 = HeapSize(gWfpHeap,0,puVar19); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar20; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar21; UNLOCK(); - lpMem = *(undefined8 **)(puVar30 + 0x38); - } -LAB_9: - *lpMem = local_288; - lpMem[1] = uStack_280; - plVar1 = lpMem + 2; - lpMem[2] = local_278; - lpMem[3] = CONCAT44(uStack_26c,uStack_270); - lpMem[4] = local_268; - lpMem[5] = uStack_260; - lpMem[6] = local_258; - lpMem[7] = uStack_250; - lpMem[8] = local_248; - lpMem[9] = uStack_240; - lpMem[10] = local_238; - lpMem[0xb] = uStack_230; - lpMem[0xc] = local_228; - lpMem[0xd] = uStack_220; - lpMem[0xe] = CONCAT44(uStack_214,local_218); - lpMem[0xf] = CONCAT44(uStack_20c,CONCAT22(uStack_20e,uStack_210)); - lpMem[0x10] = CONCAT44(uStack_204,local_208); - lpMem[0x11] = CONCAT44(uStack_1fc,uStack_200); - lpMem[0x12] = CONCAT44(uStack_1f4,local_1f8); - lpMem[0x13] = CONCAT44(uStack_1ec,uStack_1f0); - lpMem[0x14] = CONCAT44(uStack_1e4,local_1e8); - lpMem[0x15] = CONCAT44(uStack_1dc,uStack_1e0); - lpMem[0x16] = local_1d8; - lpMem[0x17] = uStack_1d0; - lpMem[0x18] = local_1c8; - lpMem[0x19] = uStack_1c0; - lpMem[0x1a] = local_1b8; - lpMem[0x1b] = uStack_1b0; - lpMem[0x1c] = local_1a8; - lpMem[0x1d] = uStack_1a0; - pTVar16 = (PTP_CALLBACK_ENVIRON)(ulonglong)uStack_270; - *(undefined8 *)(puVar30 + -8) = 0x180035b9f; + puVar19 = *(undefined8 **)(puVar33 + 0x38); + } +LAB_10: + *puVar19 = local_288; + puVar19[1] = uStack_280; + plVar1 = puVar19 + 2; + puVar19[2] = local_278; + puVar19[3] = CONCAT44(uStack_26c,uStack_270); + puVar19[4] = local_268; + puVar19[5] = uStack_260; + puVar19[6] = local_258; + puVar19[7] = uStack_250; + puVar19[8] = local_248; + puVar19[9] = uStack_240; + puVar19[10] = local_238; + puVar19[0xb] = uStack_230; + puVar19[0xc] = local_228; + puVar19[0xd] = uStack_220; + puVar19[0xe] = CONCAT44(uStack_214,local_218); + puVar19[0xf] = CONCAT44(uStack_20c,CONCAT22(uStack_20e,uStack_210)); + puVar19[0x10] = CONCAT44(uStack_204,local_208); + puVar19[0x11] = CONCAT44(uStack_1fc,uStack_200); + puVar19[0x12] = CONCAT44(uStack_1f4,local_1f8); + puVar19[0x13] = CONCAT44(uStack_1ec,uStack_1f0); + puVar19[0x14] = CONCAT44(uStack_1e4,local_1e8); + puVar19[0x15] = CONCAT44(uStack_1dc,uStack_1e0); + puVar19[0x16] = local_1d8; + puVar19[0x17] = uStack_1d0; + puVar19[0x18] = local_1c8; + puVar19[0x19] = uStack_1c0; + puVar19[0x1a] = local_1b8; + puVar19[0x1b] = uStack_1b0; + puVar19[0x1c] = local_1a8; + puVar19[0x1d] = uStack_1a0; + pTVar17 = (PTP_CALLBACK_ENVIRON)(ulonglong)uStack_270; + *(undefined8 *)(puVar33 + -8) = 0x180035e2f; pvVar25 = gWfpHeap; - pTVar19 = HeapAlloc(gWfpHeap,0,(SIZE_T)pTVar16); - *plVar1 = (longlong)pTVar19; - if (pTVar19 == (PTP_CALLBACK_ENVIRON)0x0) { - pTVar16 = (PTP_CALLBACK_ENVIRON)0xc0000017; - *(undefined8 *)(puVar30 + -8) = 0x180035bbe; - lVar18 = WfpReportSysErrorAsNtStatus(pvVar25,"HeapAlloc",0xc0000017); - if (lVar18 != 0) { - *(undefined8 *)(puVar30 + -8) = 0x180035bd5; - WfpReportError((uint)lVar18,"WfpMemAlloc",pTVar16); - goto LAB_10; + pTVar20 = HeapAlloc(gWfpHeap,0,(SIZE_T)pTVar17); + *plVar1 = (longlong)pTVar20; + if (pTVar20 == (PTP_CALLBACK_ENVIRON)0x0) { + pTVar17 = (PTP_CALLBACK_ENVIRON)0xc0000017; + *(undefined8 *)(puVar33 + -8) = 0x180035e4e; + lVar31 = WfpReportSysErrorAsNtStatus(pvVar25,"HeapAlloc",0xc0000017); + if (lVar31 != 0) { + *(undefined8 *)(puVar33 + -8) = 0x180035e65; + WfpReportError((uint)lVar31,"WfpMemAlloc",pTVar17); + goto LAB_11; } } else if (gWfpTrackHeapBytes != 0) { - *(undefined8 *)(puVar30 + -8) = 0x180035bf5; - SVar20 = HeapSize(gWfpHeap,0,pTVar19); + *(undefined8 *)(puVar33 + -8) = 0x180035e85; + SVar21 = HeapSize(gWfpHeap,0,pTVar20); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar20; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated + (int)SVar21; UNLOCK(); - lpMem = *(undefined8 **)(puVar30 + 0x38); - pTVar16 = pTVar19; + puVar19 = *(undefined8 **)(puVar33 + 0x38); + pTVar17 = pTVar20; } switch((char)uStack_250) { case '\x01': case '\x04': case '\x05': case '\x06': case '\a': case '\b': - goto switchD_180035c23_caseD_1; + goto switchD_180035eb3_caseD_1; default: - pcVar26 = (code *)swi(0x29); - (*pcVar26)(0x25); - puVar30 = puVar30 + 8; - goto LAB_6; - } - } - pTVar16 = (PTP_CALLBACK_ENVIRON)0xc0000017; - *(undefined8 *)(puVar30 + -8) = 0x180035ab8; - lVar18 = WfpReportSysErrorAsNtStatus(pvVar25,"HeapAlloc",0xc0000017); - if (lVar18 == 0) goto LAB_9; - *(undefined8 *)(puVar30 + -8) = 0x180035acf; - WfpReportError((uint)lVar18,"WfpMemAlloc",pTVar16); -LAB_10: - *(undefined8 *)(puVar30 + -8) = 0x180035de2; - WfpMemFree((undefined8 *)(puVar30 + 0x38)); - goto LAB_11; -switchD_180035c23_caseD_1: - uVar5 = uStack_250._6_2_; - *(undefined8 *)(puVar30 + -8) = 0x180035c39; - uVar6 = htons(500); + pcVar27 = (code *)swi(0x29); + (*pcVar27)(0x25); + puVar33 = puVar33 + 8; + goto LAB_7; + } + } + pTVar17 = (PTP_CALLBACK_ENVIRON)0xc0000017; + *(undefined8 *)(puVar33 + -8) = 0x180035d48; + lVar31 = WfpReportSysErrorAsNtStatus(pvVar25,"HeapAlloc",0xc0000017); + if (lVar31 == 0) goto LAB_10; + *(undefined8 *)(puVar33 + -8) = 0x180035d5f; + WfpReportError((uint)lVar31,"WfpMemAlloc",pTVar17); +LAB_11: + *(undefined8 *)(puVar33 + -8) = 0x1800360a4; + WfpMemFree((undefined8 *)(puVar33 + 0x38)); + goto LAB_12; +switchD_180035eb3_caseD_1: + uVar7 = uStack_250._6_2_; + *(undefined8 *)(puVar33 + -8) = 0x180035ec9; + uVar8 = htons(500); _Dst = (void *)*plVar1; - if (uVar5 == uVar6) { - uVar34 = (ulonglong)uStack_270; - *(undefined8 *)(puVar30 + -8) = 0x180035c6a; - memcpy(_Dst,local_278,uVar34); + if (uVar7 == uVar8) { + uVar37 = (ulonglong)uStack_270; + *(undefined8 *)(puVar33 + -8) = 0x180035efa; + memcpy(_Dst,local_278,uVar37); } else { - uVar34 = (ulonglong)(uStack_270 - 4); - *(undefined8 *)(puVar30 + -8) = 0x180035c5b; - memcpy(_Dst,(void *)((longlong)local_278 + 4),uVar34); - *(int *)(lpMem + 3) = *(int *)(lpMem + 3) + -4; - } - puVar2 = (undefined8 *)*plVar1; - local_198 = (PTP_CLEANUP_GROUP)*puVar2; - uStack_190 = puVar2[1]; - uVar7 = *(u_long *)(puVar2 + 3); - local_188 = puVar2[2]; - *(undefined8 *)(puVar30 + -8) = 0x180035c8e; - uVar7 = ntohl(uVar7); - *(undefined8 *)(puVar30 + -8) = 0x180035ca8; - local_180 = uVar7; - uVar8 = ntohl(local_188._4_4_); - *(u_long *)(lpMem + 3) = uVar7; - local_188 = CONCAT44(uVar8,(undefined4)local_188); - lpMem[4] = lpMem; - *(undefined8 *)(puVar30 + -8) = 0x180035cce; - TraceLogHelper("IkeLookupICookieInHiPriGlobalList",1,uVar34,plVar22); - *(undefined8 *)(puVar30 + -8) = 0x180035ce0; - EnterCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); - for (pTVar19 = *(PTP_CALLBACK_ENVIRON *)(gIkeExtGlobals + 0x2e); pTVar19 != gIkeExtGlobals + 0x2e; - pTVar19 = *(PTP_CALLBACK_ENVIRON *)pTVar19) { - if (local_198 == pTVar19->CleanupGroup) { - *(undefined8 *)(puVar30 + -8) = 0x180035d83; - pTVar16 = gIkeExtGlobals; - LeaveCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); - *(undefined8 *)(puVar30 + -8) = 0x180035d92; - TraceLogHelper("IkeLookupICookieInHiPriGlobalList",0,pTVar16,plVar22); - *(undefined8 *)(puVar30 + -8) = 0x180035da1; - lVar18 = IkeQueueWorkItemHiPri(IkeHandleRecvRequest,lpMem,pTVar16,plVar22); - goto joined_r0x000180035da7; - } - } - *(undefined8 *)(puVar30 + -8) = 0x180035d1b; - pTVar19 = gIkeExtGlobals; - LeaveCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); - *(undefined8 *)(puVar30 + -8) = 0x180035d2a; - TraceLogHelper("IkeLookupICookieInHiPriGlobalList",0,pTVar19,plVar22); - pcVar26 = IkeHandleRecvRequest; - pTVar16 = (PTP_CALLBACK_ENVIRON)&gIkeExtGlobals[0x2a].CleanupGroupCancelCallback; - *(undefined8 *)(puVar30 + -8) = 0x180035d49; - BVar9 = TrySubmitThreadpoolCallback(IkeHandleRecvRequest,lpMem,pTVar16); - if (BVar9 == 0) { - *(undefined8 *)(puVar30 + -8) = 0x180035d59; - DVar10 = GetLastError(); - plVar22 = (longlong *)0x1; - pTVar16 = (PTP_CALLBACK_ENVIRON)(ulonglong)DVar10; - *(undefined8 *)(puVar30 + -8) = 0x180035d73; - lVar21 = WfpReportSysErrorAsWinError(pcVar26,"TrySubmitThreadpoolCallback",(ulonglong)pTVar16,1) - ; + uVar37 = (ulonglong)(uStack_270 - 4); + *(undefined8 *)(puVar33 + -8) = 0x180035eeb; + memcpy(_Dst,(void *)((longlong)local_278 + 4),uVar37); + *(int *)(puVar19 + 3) = *(int *)(puVar19 + 3) + -4; + } + puVar5 = (undefined8 *)*plVar1; + local_198 = (PTP_CLEANUP_GROUP)*puVar5; + uStack_190 = puVar5[1]; + uVar10 = *(u_long *)(puVar5 + 3); + local_188 = puVar5[2]; + *(undefined8 *)(puVar33 + -8) = 0x180035f1e; + uVar10 = ntohl(uVar10); + uVar26 = (ulonglong)local_188._4_4_; + *(undefined8 *)(puVar33 + -8) = 0x180035f38; + local_180 = uVar10; + uVar11 = ntohl(local_188._4_4_); + local_188 = CONCAT44(uVar11,(undefined4)local_188); + if (uStack_270 < uVar10) { + LOCK(); + *(int *)&gIkeExtGlobals[0x1b].Pool = *(int *)&gIkeExtGlobals[0x1b].Pool + 1; + UNLOCK(); + pTVar17 = (PTP_CALLBACK_ENVIRON)0x3600; + *(undefined4 *)(puVar33 + 0x20) = 1; + *(undefined8 *)(puVar33 + -8) = 0x180035f70; + lVar31 = WfpReportAppErrorAsWinError + (uVar26,"IkeQueueRecvRequest",0x3600,plVar23,*(int *)(puVar33 + 0x20)); } else { - LOCK(); - piVar23 = (int *)((longlong)&gIkeExtGlobals[0x1b].Pool + 4); - *piVar23 = *piVar23 + 1; - UNLOCK(); - } - *(undefined8 *)(puVar30 + -8) = 0x180035dc8; - lVar18 = IkeReturnError(lVar21,"IkeQueueWorkItem",pTVar16,plVar22); -joined_r0x000180035da7: - if (lVar18 != 0) { - *(undefined8 *)(puVar30 + -8) = 0x180035dd8; + *(u_long *)(puVar19 + 3) = uVar10; + puVar19[4] = puVar19; + *(undefined8 *)(puVar33 + -8) = 0x180035f90; + TraceLogHelper("IkeLookupICookieInHiPriGlobalList",1,uVar37,plVar23); + *(undefined8 *)(puVar33 + -8) = 0x180035fa2; + EnterCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); + for (pTVar20 = *(PTP_CALLBACK_ENVIRON *)(gIkeExtGlobals + 0x2e); + pTVar20 != gIkeExtGlobals + 0x2e; pTVar20 = *(PTP_CALLBACK_ENVIRON *)pTVar20) { + if (local_198 == pTVar20->CleanupGroup) { + *(undefined8 *)(puVar33 + -8) = 0x180036045; + pTVar17 = gIkeExtGlobals; + LeaveCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); + *(undefined8 *)(puVar33 + -8) = 0x180036054; + TraceLogHelper("IkeLookupICookieInHiPriGlobalList",0,pTVar17,plVar23); + *(undefined8 *)(puVar33 + -8) = 0x180036063; + lVar31 = IkeQueueWorkItemHiPri(IkeHandleRecvRequest,puVar19,pTVar17,plVar23); + goto joined_r0x000180036069; + } + } + *(undefined8 *)(puVar33 + -8) = 0x180035fdd; + pTVar20 = gIkeExtGlobals; + LeaveCriticalSection((LPCRITICAL_SECTION)&gIkeExtGlobals[1].FinalizationCallback); + *(undefined8 *)(puVar33 + -8) = 0x180035fec; + TraceLogHelper("IkeLookupICookieInHiPriGlobalList",0,pTVar20,plVar23); + pcVar27 = IkeHandleRecvRequest; + pTVar17 = (PTP_CALLBACK_ENVIRON)&gIkeExtGlobals[0x2a].CleanupGroupCancelCallback; + *(undefined8 *)(puVar33 + -8) = 0x18003600b; + BVar12 = TrySubmitThreadpoolCallback(IkeHandleRecvRequest,puVar19,pTVar17); + if (BVar12 == 0) { + *(undefined8 *)(puVar33 + -8) = 0x18003601b; + DVar13 = GetLastError(); + plVar23 = (longlong *)0x1; + pTVar17 = (PTP_CALLBACK_ENVIRON)(ulonglong)DVar13; + *(undefined8 *)(puVar33 + -8) = 0x180036035; + lVar22 = WfpReportSysErrorAsWinError + (pcVar27,"TrySubmitThreadpoolCallback",(ulonglong)pTVar17,1); + } + else { + LOCK(); + piVar2 = (int *)((longlong)&gIkeExtGlobals[0x1b].Pool + 4); + *piVar2 = *piVar2 + 1; + UNLOCK(); + } + *(undefined8 *)(puVar33 + -8) = 0x18003608a; + lVar31 = IkeReturnError(lVar22,"IkeQueueWorkItem",pTVar17,plVar23); + } +joined_r0x000180036069: + if (lVar31 != 0) { + *(undefined8 *)(puVar33 + -8) = 0x18003609a; WfpMemFree(plVar1); - goto LAB_10; - } -LAB_11: - *(undefined8 *)(puVar30 + -8) = 0x180035df0; - TraceLogHelper("IkeQueueRecvRequest",0,pTVar16,plVar22); - *(undefined8 *)(puVar30 + -8) = 0x180035dff; - IkeReturnError(lVar18,"IkeQueueRecvRequest",pTVar16,plVar22); - pTVar19 = gIkeExtGlobals; + goto LAB_11; + } +LAB_12: + *(undefined8 *)(puVar33 + -8) = 0x1800360b2; + TraceLogHelper("IkeQueueRecvRequest",0,pTVar17,plVar23); + *(undefined8 *)(puVar33 + -8) = 0x1800360c1; + IkeReturnError(lVar31,"IkeQueueRecvRequest",pTVar17,plVar23); + pTVar20 = gIkeExtGlobals; LAB_3: - pwa = pTVar19[0x2d].ActivationContext; + pwa = pTVar20[0x2d].ActivationContext; if (param_3 == pwa) { - h = (_ACTIVATION_CONTEXT *)pTVar19[0x28].CleanupGroupCancelCallback; + h = (_ACTIVATION_CONTEXT *)pTVar20[0x28].CleanupGroupCancelCallback; } else { - pwa = (_ACTIVATION_CONTEXT *)pTVar19[0x2d].FinalizationCallback; + pwa = (_ACTIVATION_CONTEXT *)pTVar20[0x2d].FinalizationCallback; if (param_3 == pwa) { - h = pTVar19[0x28].RaceDll; + h = pTVar20[0x28].RaceDll; } else { - pwa = *(_ACTIVATION_CONTEXT **)&pTVar19[0x2d].u; + pwa = *(_ACTIVATION_CONTEXT **)&pTVar20[0x2d].u; if (param_3 == pwa) { - h = pTVar19[0x28].ActivationContext; + h = pTVar20[0x28].ActivationContext; } else { - h = (_ACTIVATION_CONTEXT *)pTVar19[0x28].FinalizationCallback; - pwa = *(_ACTIVATION_CONTEXT **)&pTVar19[0x2d].Size; + h = (_ACTIVATION_CONTEXT *)pTVar20[0x28].FinalizationCallback; + pwa = *(_ACTIVATION_CONTEXT **)&pTVar20[0x2d].Size; } } } - uVar15 = 0; - *(undefined8 *)(puVar31 + -8) = 0x180035f59; + uVar16 = 0; + *(undefined8 *)(puVar34 + -8) = 0x18003621b; SetThreadpoolWait((PTP_WAIT)pwa,h,(PFILETIME)0x0); - DVar10 = *(DWORD *)&gIkeExtGlobals[0x30].Pool; - if (DVar10 != 0xffffffff) { - *(undefined8 *)(puVar31 + -8) = 0x180035f79; - TlsSetValue(DVar10,(LPVOID)0x0); - } - *(undefined8 *)(puVar31 + -8) = 0x180035f8c; - TraceLogHelper("IkeReceiveCallback",0,uVar15,pTVar19); + DVar13 = *(DWORD *)&gIkeExtGlobals[0x30].Pool; + if (DVar13 != 0xffffffff) { + *(undefined8 *)(puVar34 + -8) = 0x18003623b; + TlsSetValue(DVar13,(LPVOID)0x0); + } + *(undefined8 *)(puVar34 + -8) = 0x18003624e; + TraceLogHelper("IkeReceiveCallback",0,uVar16,pTVar20); LAB_0: - *(undefined8 *)(puVar31 + -8) = 0x180035fb3; + *(undefined8 *)(puVar34 + -8) = 0x180036275; return; } ``` ## IkeHandleStatusNotifyIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.46| |i_ratio|0.14| |m_ratio|0.91| |b_ratio|0.45| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeHandleStatusNotifyIkeV2|IkeHandleStatusNotifyIkeV2| |fullname|IkeHandleStatusNotifyIkeV2|IkeHandleStatusNotifyIkeV2| |refcount|2|2| |`length`|3651|4374| |`called`|
Expand for full list:
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeParseMobikeNotifyPayload
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessNatDiscIkeV2
IkeProcessRekeySa
IkeResendReqWithDosCookieIkeV2
IkeReturnError
IkeSendDosCookieNotifyIkeV2
IkeVerifyDosCookieIkeV2
TraceLogHelperWPP_SF_iS
WPP_SF_iSd
WPP_SF_iSdq
WPP_SF_iSq
WPP_SF_iSqq
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeParseMobikeNotifyPayload
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessNatDiscIkeV2
IkeProcessRekeySa
IkeResendReqWithDosCookieIkeV2
IkeReturnError
IkeSendDosCookieNotifyIkeV2
IkeVerifyDosCookieIkeV2
TraceLogHelperWPP_SF_iS
WPP_SF_iSd
WPP_SF_iSdq
WPP_SF_iSq
WPP_SF_iSqq
WfpMemFree
WfpReportAppErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeHandleNotifyIkeV2|IkeHandleNotifyIkeV2| |paramcount|5|5| |`address`|1800cb3d0|1800cb8d8| |sig|undefined __fastcall IkeHandleStatusNotifyIkeV2(LPCRITICAL_SECTION param_1, LPCRITICAL_SECTION param_2, LPCRITICAL_SECTION param_3, LPCRITICAL_SECTION param_4, uint param_5)|undefined __fastcall IkeHandleStatusNotifyIkeV2(LPCRITICAL_SECTION param_1, LPCRITICAL_SECTION param_2, LPCRITICAL_SECTION param_3, LPCRITICAL_SECTION param_4, uint param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeHandleStatusNotifyIkeV2 Called Diff ```diff --- IkeHandleStatusNotifyIkeV2 called +++ IkeHandleStatusNotifyIkeV2 called @@ -18 +18 @@ -WfpReportSysErrorAsWinError +WfpReportAppErrorAsWinError ``` ### IkeHandleStatusNotifyIkeV2 Diff ```diff --- IkeHandleStatusNotifyIkeV2 +++ IkeHandleStatusNotifyIkeV2 @@ -1,456 +1,552 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeHandleStatusNotifyIkeV2 (LPCRITICAL_SECTION param_1,LPCRITICAL_SECTION param_2,LPCRITICAL_SECTION param_3, LPCRITICAL_SECTION param_4,uint param_5) { HANDLE pvVar1; char cVar2; wchar_t *pwVar3; undefined8 uVar4; LPCRITICAL_SECTION p_Var5; - uint uVar6; - char *pcVar7; - undefined4 *puVar8; - HANDLE *ppvVar9; - byte *pbVar10; - LPCRITICAL_SECTION p_Var11; + longlong lVar6; + uint uVar7; + char *pcVar8; + byte *pbVar9; + HANDLE *ppvVar10; + uint uVar11; LPCRITICAL_SECTION p_Var12; + LPCRITICAL_SECTION p_Var13; + longlong lVar14; undefined1 auStackY_128 [32]; - undefined4 uVar13; - longlong local_e8; - LPCRITICAL_SECTION local_e0; - LPCRITICAL_SECTION local_d8; - undefined8 local_d0; + undefined4 uVar15; + LPCRITICAL_SECTION local_e8; + undefined8 local_e0; + LPCRITICAL_SECTION local_d8 [2]; LPCRITICAL_SECTION local_c8 [2]; undefined8 local_b8 [4]; LPCRITICAL_SECTION *local_98; undefined8 local_90; longlong local_88 [2]; longlong local_78 [2]; LPCRITICAL_SECTION *local_68; undefined8 local_60; LPCRITICAL_SECTION *local_58; undefined8 local_50; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_128; - local_e8 = 0; - pcVar7 = "IkeHandleStatusNotifyIkeV2"; - uVar6 = (uint)param_3 & 0xffff; - local_d0 = (LPCRITICAL_SECTION)CONCAT44(local_d0._4_4_,param_5); - p_Var12 = param_3; + lVar14 = 0; + pcVar8 = "IkeHandleStatusNotifyIkeV2"; + uVar11 = (uint)param_3 & 0xffff; + local_c8[0] = (LPCRITICAL_SECTION)CONCAT44(local_c8[0]._4_4_,param_5); + p_Var13 = param_3; p_Var5 = param_4; - local_d8 = param_2; - local_c8[0] = param_4; + local_e8 = param_2; + local_d8[0] = param_4; TraceLogHelper("IkeHandleStatusNotifyIkeV2",1,param_3,param_4); - if (uVar6 < 0x4009) { - if (uVar6 == 0x4008) { + local_e0 = (LPCRITICAL_SECTION)(CONCAT44(local_e0._4_4_,(uint)param_3) & 0xffffffff0000ffff); + lVar6 = lVar14; + if (uVar11 < 0x4009) { + if (uVar11 == 0x4008) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x34, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x35, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process HTTP_CERT_LOOKUP_SUPPORTED notify"); - local_68 = &local_d8; + local_68 = local_d8; local_60 = 8; - local_d8 = param_1; + local_d8[0] = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_1,p_Var12,p_Var5,6,local_b8); + (0x180165278,&DAT_1,p_Var13,p_Var5,6,local_b8); } *(uint *)¶m_1[0xe].SpinCount = (uint)param_1[0xe].SpinCount | 0x80000; goto LAB_2; } - if (uVar6 == 0x4000) { + if (uVar11 == 0x4000) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x35, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x37, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process INITIAL_CONTACT notify"); - local_68 = &local_d8; + local_68 = local_d8; local_60 = 8; - local_d8 = param_1; + local_d8[0] = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_3,p_Var12,p_Var5,6,local_b8); + (0x180165278,&DAT_3,p_Var13,p_Var5,6,local_b8); } *(undefined4 *)((longlong)param_1[0x1b].LockSemaphore + 0x230) = 1; goto LAB_2; } - if (uVar6 == 0x4004) { + if (uVar11 == 0x4004) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x30, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - param_5 = (uint)local_d0; - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x31, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process NAT_DETECTION_SOURCE_IP notify"); - local_68 = &local_d8; + local_68 = (LPCRITICAL_SECTION *)&local_e0; local_60 = 8; - local_d8 = param_1; + local_e0 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_4,p_Var12,p_Var5,6,local_b8); - } - uVar6 = 0; + (0x180165278,&DAT_4,p_Var13,p_Var5,6,local_b8); + param_4 = local_d8[0]; + } + uVar11 = 0; } else { - if (uVar6 != 0x4005) { - uVar6 = uVar6 - 0x4006; - puVar8 = (undefined4 *)(ulonglong)uVar6; - if (uVar6 == 0) { + if (uVar11 != 0x4005) { + uVar7 = uVar11 - 0x4006; + pcVar8 = (char *)(ulonglong)uVar7; + if (uVar7 == 0) { if ((param_1[0xe].SpinCount & 1) == 0) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - puVar8 = WPP_GLOBAL_Control->OwningThread; - WPP_SF_iSq(puVar8,0x2e,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3) + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSq(pcVar8,0x2f,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3) ; - param_5 = (uint)local_d0; } if (4 < DAT_0) { - puVar8 = &DAT_0; - cVar2 = _tlgKeywordOn(0x180164278,0); + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); if (cVar2 != '\0') { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Verify DOS COOKIE notify sent with request"); - local_68 = &local_d8; - puVar8 = &DAT_0; + local_68 = (LPCRITICAL_SECTION *)&local_e0; + pcVar8 = (char *)&DAT_0; local_60 = 8; - local_d8 = param_1; + local_e0 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,p_Var12,p_Var5,6,local_b8); + (0x180165278,&DAT_5,p_Var13,p_Var5,6,local_b8); } } - if (param_5 == 8) { - ppvVar9 = ¶m_1[9].OwningThread; - p_Var12 = local_c8[0]; - local_e8 = IkeVerifyDosCookieIkeV2 - ((longlong)param_1,(PUCHAR)ppvVar9,(longlong *)local_c8[0],p_Var5 - ); - if (local_e8 != 0) { + if ((int)local_c8[0] == 8) { + ppvVar10 = ¶m_1[9].OwningThread; + p_Var5 = (LPCRITICAL_SECTION)0x8; + p_Var13 = local_d8[0]; + lVar6 = IkeVerifyDosCookieIkeV2 + ((longlong)param_1,(PUCHAR)ppvVar10,(longlong *)local_d8[0], + (longlong **)0x8); + if (lVar6 != 0) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - ppvVar9 = (HANDLE *)0x2f; - WPP_SF_iS(WPP_GLOBAL_Control->OwningThread,0x2f, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + ppvVar10 = (HANDLE *)0x30; + WPP_SF_iS(WPP_GLOBAL_Control->OwningThread,0x30, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); } if (4 < DAT_0) { - ppvVar9 = (HANDLE *)0x0; - cVar2 = _tlgKeywordOn(0x180164278,0); + ppvVar10 = (HANDLE *)0x0; + cVar2 = _tlgKeywordOn(0x180165278,0); if (cVar2 != '\0') { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78, "Recreate and send another DoS cookie back to Initiator"); - ppvVar9 = (HANDLE *)&DAT_6; + ppvVar10 = (HANDLE *)&DAT_6; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_6,p_Var12,p_Var5,5,local_b8); + (0x180165278,&DAT_6,p_Var13,p_Var5,5,local_b8); } } - IkeSendDosCookieNotifyIkeV2((PUCHAR ***)param_1,ppvVar9,(undefined *)p_Var12,p_Var5) - ; + IkeSendDosCookieNotifyIkeV2 + ((PUCHAR ***)param_1,ppvVar10,(undefined *)p_Var13,p_Var5); } goto LAB_2; } } else if (param_5 - 1 < 0x40) { if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x2d, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - param_5 = (uint)local_d0; - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x2e, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Resend request with DOS COOKIE notify"); - local_68 = &local_d8; + local_68 = (LPCRITICAL_SECTION *)&local_e0; local_60 = 8; - local_d8 = param_1; + local_e0 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_7,p_Var12,p_Var5,6,local_b8); + (0x180165278,&DAT_7,p_Var13,p_Var5,6,local_b8); + param_4 = local_d8[0]; } WfpMemFree((undefined8 *)((longlong)param_1[0x1b].LockSemaphore + 0x38)); pvVar1 = param_1[0x1b].LockSemaphore; *(undefined8 *)((longlong)pvVar1 + 0x30) = 0; *(undefined8 *)((longlong)pvVar1 + 0x38) = 0; WfpMemFree((undefined8 *)((longlong)param_1[0x1b].LockSemaphore + 0x48)); pvVar1 = param_1[0x1b].LockSemaphore; - p_Var12 = (LPCRITICAL_SECTION)(ulonglong)param_5; + p_Var13 = (LPCRITICAL_SECTION)((ulonglong)local_c8[0] & 0xffffffff); *(undefined8 *)((longlong)pvVar1 + 0x40) = 0; *(undefined8 *)((longlong)pvVar1 + 0x48) = 0; - local_e8 = IkeResendReqWithDosCookieIkeV2 - (param_1,local_c8[0],(undefined *)p_Var12,p_Var5); + lVar6 = IkeResendReqWithDosCookieIkeV2(param_1,param_4,(undefined *)p_Var13,p_Var5); goto LAB_2; } - p_Var12 = (LPCRITICAL_SECTION)0x3616; + p_Var13 = (LPCRITICAL_SECTION)0x3616; } else { - if (uVar6 != 1) goto LAB_8; + if (uVar7 != 1) goto LAB_8; if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); uVar4 = IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - puVar8 = WPP_GLOBAL_Control->OwningThread; - WPP_SF_iSqq(puVar8,0x36,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,uVar4,pwVar3); - } - p_Var11 = local_d8; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSqq(pcVar8,0x38,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,uVar4,pwVar3); + } + p_Var12 = local_e8; p_Var5 = WPP_GLOBAL_Control; if (4 < DAT_0) { - puVar8 = &DAT_0; - cVar2 = _tlgKeywordOn(0x180164278,0); - p_Var11 = local_d8; + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); + p_Var12 = local_e8; if (cVar2 != '\0') { - local_c8[0] = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = local_c8; + local_d8[0] = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = local_d8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process USE_TRANSPORT_MODE notify"); - p_Var11 = local_d8; - local_68 = (LPCRITICAL_SECTION *)&local_d0; - local_58 = &local_e0; - puVar8 = &DAT_0; + p_Var12 = local_e8; + local_68 = (LPCRITICAL_SECTION *)&local_e0; + pcVar8 = (char *)&DAT_0; + local_58 = local_c8; local_60 = 8; - local_e0 = local_d8; + local_c8[0] = local_e8; local_50 = 8; - local_d0 = param_1; + local_e0 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_9,p_Var12,p_Var5,7,local_b8); + (0x180165278,&DAT_9,p_Var13,p_Var5,7,local_b8); p_Var5 = WPP_GLOBAL_Control; } } if (*(int *)((longlong)param_1[0x1b].LockSemaphore + 0x234) != 1) { - *(undefined1 *)(*(longlong *)&p_Var11[6].LockCount + 8) = 1; - *(undefined4 *)((longlong)param_1[0x1b].LockSemaphore + 0x234) = 2; - goto LAB_2; + if (p_Var12 != (LPCRITICAL_SECTION)0x0) { + *(undefined1 *)(*(longlong *)&p_Var12[6].LockCount + 8) = 1; + *(undefined4 *)((longlong)param_1[0x1b].LockSemaphore + 0x234) = 2; + lVar6 = 0; + goto LAB_2; + } + if (((p_Var5 != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)&p_Var5->LockSemaphore + 1))) && + (((ulonglong)p_Var5->LockSemaphore & 0x1000000000) != 0)) { + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSqq(pcVar8,0x3a,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3 + ); + } + if (4 < DAT_0) { + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); + if (cVar2 != '\0') { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; + local_90 = 8; + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar3); + _tlgCreate1Sz_char(local_78,"Process transport notify"); + pbVar9 = &DAT_10; + goto LAB_11; + } + } + goto LAB_12; } if (((p_Var5 != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&p_Var5->LockSemaphore + 1))) && (((ulonglong)p_Var5->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - puVar8 = WPP_GLOBAL_Control->OwningThread; - WPP_SF_iSq(puVar8,0x37,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSq(pcVar8,0x39,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); } if (4 < DAT_0) { - puVar8 = &DAT_0; - cVar2 = _tlgKeywordOn(0x180164278,0); + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); if (cVar2 != '\0') { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78, "Previous QM on this MM was for tunnel, but this QM is for transport. Not supported" ); - local_68 = &local_d8; + local_68 = local_d8; + pcVar8 = (char *)&DAT_0; local_60 = 8; - puVar8 = &DAT_0; - local_d8 = param_1; + local_d8[0] = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_10,p_Var12,p_Var5,6,local_b8); - } - } - p_Var12 = (LPCRITICAL_SECTION)0x35ec; + (0x180165278,&DAT_13,p_Var13,p_Var5,6,local_b8); + } + } + p_Var13 = (LPCRITICAL_SECTION)0x35ec; } - p_Var5 = (LPCRITICAL_SECTION)0x1; - local_e8 = WfpReportSysErrorAsWinError - (puVar8,"IkeHandleStatusNotifyIkeV2",(ulonglong)p_Var12,1); - goto LAB_2; + goto LAB_14; } if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x31, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - param_5 = (uint)local_d0; - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x32, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process NAT_DETECTION_DESTINATION_IP notify"); - local_68 = &local_d8; + local_68 = (LPCRITICAL_SECTION *)&local_e0; local_60 = 8; - local_d8 = param_1; + local_e0 = param_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_11,p_Var12,p_Var5,6,local_b8); - } - uVar6 = 1; - } - p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; - p_Var12 = local_c8[0]; - local_e8 = IkeProcessNatDiscIkeV2 - ((longlong)param_1,(byte *)¶m_1[9].OwningThread,local_c8[0],p_Var5, - uVar6,(uint *)¶m_1[0xf].LockSemaphore); + (0x180165278,&DAT_15,p_Var13,p_Var5,6,local_b8); + param_4 = local_d8[0]; + } + uVar11 = 1; + } + p_Var5 = (LPCRITICAL_SECTION)((ulonglong)local_c8[0] & 0xffffffff); + lVar6 = IkeProcessNatDiscIkeV2 + ((longlong)param_1,(byte *)¶m_1[9].OwningThread,param_4,p_Var5,uVar11, + (uint *)¶m_1[0xf].LockSemaphore); + p_Var13 = param_4; goto LAB_2; } - if (uVar6 == 0x4009) { - p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; - local_e8 = IkeProcessRekeySa(¶m_1->DebugInfo,¶m_2->DebugInfo,(u_long *)param_4,p_Var5); - p_Var12 = param_4; - goto LAB_2; - } - if (uVar6 == 0x400c) { + if (uVar11 == 0x4009) { + if (param_2 != (LPCRITICAL_SECTION)0x0) { + p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; + lVar6 = IkeProcessRekeySa(¶m_1->DebugInfo,¶m_2->DebugInfo,(u_long *)param_4,p_Var5); + p_Var13 = param_4; + goto LAB_2; + } if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x32, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - } - if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 != '\0')) { - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSqq(pcVar8,0x36,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if (4 < DAT_0) { + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); + if (cVar2 != '\0') { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; + local_90 = 8; + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar3); + _tlgCreate1Sz_char(local_78,"Process Rekey SA notify"); + pbVar9 = &DAT_16; +LAB_11: + local_50 = 8; + local_60 = 8; + local_e0 = (LPCRITICAL_SECTION)0x0; + local_68 = local_d8; + pcVar8 = (char *)&DAT_0; + local_58 = (LPCRITICAL_SECTION *)&local_e0; + local_d8[0] = param_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,pbVar9,p_Var13,p_Var5,7,local_b8); + } + } +LAB_12: + p_Var13 = (LPCRITICAL_SECTION)0x3610; +LAB_14: + lVar6 = WfpReportAppErrorAsWinError + (pcVar8,"IkeHandleStatusNotifyIkeV2",(ulonglong)p_Var13,p_Var5,1); + goto LAB_2; + } + if (uVar11 == 0x400c) { + if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && + (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSq(WPP_GLOBAL_Control->OwningThread,0x33, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if ((4 < DAT_0) && (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 != '\0')) { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Process MOBIKE_SUPPORTED notify"); - local_68 = &local_d8; + local_68 = local_d8; local_60 = 8; - local_d8 = param_1; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,&DAT_12,p_Var12,p_Var5,6,local_b8); + local_d8[0] = param_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_17,p_Var13,p_Var5,6,local_b8); } *(undefined4 *)((longlong)param_1[0x1b].LockSemaphore + 0xa8) = 1; goto LAB_2; } - if (uVar6 < 0x400d) { + if (uVar11 < 0x400d) { LAB_8: if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSdq(WPP_GLOBAL_Control->OwningThread,0x38, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - } - if ((DAT_0 < 5) || (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 == '\0')) - goto LAB_2; - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSdq(WPP_GLOBAL_Control->OwningThread,0x3c, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + uVar11 = (uint)local_e0; + } + lVar6 = 0; + if ((DAT_0 < 5) || (cVar2 = _tlgKeywordOn(0x180165278,0), lVar6 = lVar14, cVar2 == '\0') + ) goto LAB_2; + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Ignoring STATUS notify"); - pbVar10 = &DAT_13; - local_58 = &local_d8; - uVar13 = 7; + pbVar9 = &DAT_18; + local_58 = local_d8; + uVar15 = 7; local_50 = 8; - local_d8 = param_1; + local_d8[0] = param_1; } else { - if (0x400f < uVar6) { - if (uVar6 < 0x4012) goto LAB_2; - if (uVar6 == 0xa415) { - p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; - local_e8 = IkeProcessExchangeInfoNotifyIkeV2 - (pcVar7,(longlong)param_2,(u_long *)param_4,p_Var5); - p_Var12 = param_4; - goto LAB_2; + if (0x400f < uVar11) { + if (uVar11 < 0x4012) goto LAB_2; + if (uVar11 == 0xa415) { + if (param_2 != (LPCRITICAL_SECTION)0x0) { + p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; + lVar6 = IkeProcessExchangeInfoNotifyIkeV2 + (pcVar8,(longlong)param_2,(u_long *)param_4,p_Var5); + p_Var13 = param_4; + goto LAB_2; + } + if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && + (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + pcVar8 = WPP_GLOBAL_Control->OwningThread; + WPP_SF_iSqq(pcVar8,0x3b,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + } + if (4 < DAT_0) { + pcVar8 = (char *)&DAT_0; + cVar2 = _tlgKeywordOn(0x180165278,0); + if (cVar2 != '\0') { + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; + local_90 = 8; + pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_88,pwVar3); + _tlgCreate1Sz_char(local_78,"Process exchange info notify"); + pbVar9 = &DAT_19; + goto LAB_11; + } + } + goto LAB_12; } goto LAB_8; } if (*(int *)((longlong)param_1[0x1b].LockSemaphore + 0x234) == 1) { p_Var5 = (LPCRITICAL_SECTION)(ulonglong)param_5; - local_e8 = IkeParseMobikeNotifyPayload - ((longlong)param_1,(ushort)param_3,(uint *)param_4,p_Var5, - (uint *)((longlong)param_1[0x1b].LockSemaphore + 0xb8)); - p_Var12 = param_4; + lVar6 = IkeParseMobikeNotifyPayload + ((longlong)param_1,(ushort)param_3,(uint *)param_4,p_Var5, + (uint *)((longlong)param_1[0x1b].LockSemaphore + 0xb8)); + p_Var13 = param_4; goto LAB_2; } if (((WPP_GLOBAL_Control != (LPCRITICAL_SECTION)&WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)&WPP_GLOBAL_Control->LockSemaphore + 1))) && (((ulonglong)WPP_GLOBAL_Control->LockSemaphore & 0x1000000000) != 0)) { pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); p_Var5 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSd(WPP_GLOBAL_Control->OwningThread,0x33, - &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,p_Var5,pwVar3); - } - if ((DAT_0 < 5) || (cVar2 = _tlgKeywordOn(0x180164278,0), cVar2 == '\0')) + p_Var13 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSd(WPP_GLOBAL_Control->OwningThread,0x34, + &WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var5,pwVar3); + uVar11 = (uint)local_e0; + } + if ((DAT_0 < 5) || (cVar2 = _tlgKeywordOn(0x180165278,0), cVar2 == '\0')) goto LAB_2; - local_e0 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - local_98 = &local_e0; + local_e8 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + local_98 = &local_e8; local_90 = 8; pwVar3 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_88,pwVar3); _tlgCreate1Sz_char(local_78,"Ignoring Notify"); - pbVar10 = &DAT_14; - uVar13 = 6; + pbVar9 = &DAT_20; + uVar15 = 6; } local_60 = 4; - local_68 = (LPCRITICAL_SECTION *)&local_d0; - local_d0 = (LPCRITICAL_SECTION)(CONCAT44(local_d0._4_4_,(uint)param_3) & 0xffffffff0000ffff); - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,pbVar10,p_Var12,p_Var5,uVar13,local_b8); + local_68 = (LPCRITICAL_SECTION *)&local_e0; + local_e0 = (LPCRITICAL_SECTION)CONCAT44(local_e0._4_4_,uVar11); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,pbVar9,p_Var13,p_Var5,uVar15,local_b8); + lVar6 = lVar14; LAB_2: - TraceLogHelper("IkeHandleStatusNotifyIkeV2",0,p_Var12,p_Var5); - IkeReturnError(local_e8,"IkeHandleStatusNotifyIkeV2",p_Var12,p_Var5); + TraceLogHelper("IkeHandleStatusNotifyIkeV2",0,p_Var13,p_Var5); + IkeReturnError(lVar6,"IkeHandleStatusNotifyIkeV2",p_Var13,p_Var5); return; } ``` ## IkeVerifyPacketHeader ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.35| |i_ratio|0.02| |m_ratio|0.02| |b_ratio|0.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeVerifyPacketHeader|IkeVerifyPacketHeader| |fullname|IkeVerifyPacketHeader|IkeVerifyPacketHeader| |refcount|4|4| |`length`|9|2006| |`called`||
Expand for full list:
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeReturnError
NtohHeader
TraceLogHelper
WPP_SF_iS
WS2_32.DLL::htons
WS2_32.DLL::ntohl
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeReceiveCallback|IkeReceiveCallback| |paramcount|1|4| |`address`|180036040|180036300| |`sig`|undefined __fastcall IkeVerifyPacketHeader(undefined1 * param_1)|undefined __fastcall IkeVerifyPacketHeader(undefined1 * param_1, undefined8 param_2, undefined * param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeVerifyPacketHeader Called Diff ```diff --- IkeVerifyPacketHeader called +++ IkeVerifyPacketHeader called @@ -0,0 +1,14 @@ +IkeGetTlsMmLuid +IkeGetTlsPeerAddr +IkeReturnError +NtohHeader +TraceLogHelper +WPP_SF_iS +WS2_32.DLL::htons +WS2_32.DLL::ntohl +WfpReportSysErrorAsWinError +__security_check_cookie +_tlgCreate1Sz_char +_tlgCreate1Sz_wchar_t +_tlgKeywordOn +_tlgWriteTransfer_EtwEventWriteTransfer ``` ### IkeVerifyPacketHeader Diff ```diff --- IkeVerifyPacketHeader +++ IkeVerifyPacketHeader @@ -1,322 +1,338 @@ -/* WARNING: Control flow encountered bad instruction data */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void IkeVerifyPacketHeader(undefined1 *param_1) +void IkeVerifyPacketHeader + (undefined1 *param_1,undefined8 param_2,undefined *param_3,undefined8 param_4) { - u_short uVar1; - longlong *plVar2; - code *pcVar3; - byte bVar4; - char cVar5; - u_short uVar6; - u_long uVar7; - u_long uVar8; - wchar_t *pwVar9; - longlong lVar10; - undefined8 *puVar11; - byte *pbVar12; - undefined1 *puVar13; - undefined1 *puVar14; - undefined1 *unaff_RDI; - undefined *in_R8; - undefined8 in_R9; - undefined1 auStackY_d8 [8]; + char *pcVar1; + undefined1 *puVar2; + u_short uVar3; + undefined4 uVar4; + longlong *plVar5; + code *pcVar6; + byte bVar7; + undefined8 *puVar8; + char cVar9; + u_short uVar10; + u_long uVar11; + u_long uVar12; + wchar_t *pwVar13; + longlong lVar14; + undefined8 *puVar15; + byte *pbVar16; + undefined8 *puVar17; + undefined4 *in_FS_OFFSET; + undefined8 uStackY_d8; undefined1 auStackY_d0 [24]; - undefined8 uStack_a8; - longlong lStack_a0; + undefined8 local_a8; + longlong local_a0; longlong lStack_98; - undefined8 uStack_90; - u_long uStack_88; - undefined8 auStack_78 [4]; - undefined8 *puStack_58; - undefined8 uStack_50; - longlong alStack_48 [2]; - longlong alStack_38 [2]; - undefined8 uStack_28; - ulonglong uStack_20; + undefined8 local_90; + u_long local_88; + undefined8 local_78 [3]; + undefined1 local_5f [7]; + undefined8 *local_58; + undefined8 local_50; + longlong local_48 [2]; + longlong local_38 [2]; + undefined8 local_28; + ulonglong local_20; - puVar13 = auStackY_d8; - uStack_20 = __security_cookie ^ (ulonglong)auStackY_d8; - uStack_28 = 0; - TraceLogHelper("IkeVerifyPacketHeader",1,in_R8,in_R9); + puVar17 = &uStackY_d8; + local_20 = __security_cookie ^ (ulonglong)&uStackY_d8; + local_28 = 0; + lVar14 = 1; + TraceLogHelper("IkeVerifyPacketHeader",1,param_3,param_4); switch(param_1[0x38]) { case 1: case 4: case 5: case 6: case 7: case 8: break; default: - pcVar3 = (code *)swi(0x29); - (*pcVar3)(0x25); - *unaff_RDI = *param_1; - /* WARNING: Bad instruction - Truncating control flow here */ - halt_baddata(); + pcVar6 = (code *)swi(0x29); + (*pcVar6)(0x25); + uVar4 = *in_FS_OFFSET; + *(char *)(lVar14 + -0x6dfffc96) = *(char *)(lVar14 + -0x6dfffc96) + (char)lVar14; + uStackY_d8 = 3; + cRam0000000000000003 = cRam0000000000000003 + (char)((uint)uVar4 >> 8) * '\x05'; + pcVar1 = (char *)(lVar14 + 3 + (longlong)local_5f * 2); + *pcVar1 = *pcVar1 + (char)uVar4; + puVar2 = (undefined1 *)(lVar14 + 3 + (longlong)local_5f * 2); + *puVar2 = *puVar2; + *param_1 = *param_1; + *param_1 = *param_1; + pcVar6 = (code *)swi(3); + (*pcVar6)(); + return; } - puVar11 = (undefined8 *)0x1f4; - uVar1 = *(u_short *)(param_1 + 0x3e); - uVar6 = htons(500); - if (uVar1 == uVar6) { + puVar15 = (undefined8 *)0x1f4; + uVar3 = *(u_short *)(param_1 + 0x3e); + uVar10 = htons(500); + if (uVar3 == uVar10) { if (*(uint *)(param_1 + 0x18) < 0x1d) goto LAB_0; - plVar2 = *(longlong **)(param_1 + 0x10); - lStack_a0 = *plVar2; - lStack_98 = plVar2[1]; - uStack_90 = plVar2[2]; - uVar7 = ntohl(*(u_long *)(plVar2 + 3)); - puVar11 = (undefined8 *)(ulonglong)uStack_90._4_4_; - uStack_88 = uVar7; - uVar8 = ntohl(uStack_90._4_4_); - uStack_90 = CONCAT44(uVar8,(undefined4)uStack_90); - if ((uVar7 < 0x1d) || (*(uint *)(param_1 + 0x18) < uVar7)) { - puVar11 = WPP_GLOBAL_Control; + plVar5 = *(longlong **)(param_1 + 0x10); + local_a0 = *plVar5; + lStack_98 = plVar5[1]; + local_90 = plVar5[2]; + uVar11 = ntohl(*(u_long *)(plVar5 + 3)); + puVar15 = (undefined8 *)(ulonglong)local_90._4_4_; + local_88 = uVar11; + uVar12 = ntohl(local_90._4_4_); + local_90 = CONCAT44(uVar12,(undefined4)local_90); + if ((uVar11 < 0x1d) || (*(uint *)(param_1 + 0x18) < uVar11)) { + puVar15 = WPP_GLOBAL_Control; if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)))) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x11,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x11,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4,pwVar13); } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38,"Invalid length in IKE header, dropping packet"); - pbVar12 = &DAT_2; + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38,"Invalid length in IKE header, dropping packet"); + pbVar16 = &DAT_2; LAB_3: - puVar11 = (undefined8 *)&DAT_1; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,pbVar12,in_R8,in_R9,5,auStack_78); + puVar15 = (undefined8 *)&DAT_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,pbVar16,param_3,param_4,5,local_78); } } goto LAB_0; } LAB_4: - puVar14 = auStackY_d8; - if ((lStack_a0 != lStack_98) && (puVar14 = auStackY_d8, lStack_a0 != 0)) { - bVar4 = uStack_90._2_1_; - puVar11 = WPP_GLOBAL_Control; - if (uStack_90._2_1_ == 2) { + puVar8 = &uStackY_d8; + if ((local_a0 != lStack_98) && (puVar8 = &uStackY_d8, local_a0 != 0)) { + bVar7 = local_90._2_1_; + puVar15 = WPP_GLOBAL_Control; + if (local_90._2_1_ == 2) { LAB_5: - if (((uStack_90._1_1_ & 0xf0) == 0x10) && ((uStack_90 & 0xf00) == 0)) { + if (((local_90._1_1_ & 0xf0) == 0x10) && ((local_90 & 0xf00) == 0)) { LAB_6: - puVar11 = (undefined8 *)(uStack_90 >> 0x18 & 0xff); - if ((((uStack_90._2_1_ == 0x20) || ((byte)(uStack_90._2_1_ + 0xc) < 2)) && - ((uVar8 == 0 || (((char)uStack_90 != -0x7c && ((uStack_90 & 0x1000000) == 0)))))) || - ((uStack_90._2_1_ == 2 && ((uVar8 != 0 || ((uStack_90 & 0x2000000) != 0)))))) + puVar15 = (undefined8 *)(local_90 >> 0x18 & 0xff); + if ((((local_90._2_1_ == 0x20) || ((byte)(local_90._2_1_ + 0xc) < 2)) && + ((uVar12 == 0 || (((char)local_90 != -0x7c && ((local_90 & 0x1000000) == 0)))))) || + ((local_90._2_1_ == 2 && ((uVar12 != 0 || ((local_90 & 0x2000000) != 0)))))) goto LAB_0; LAB_7: - lVar10 = 0; - puVar14 = auStackY_d8; + lVar14 = 0; + puVar15 = &uStackY_d8; switch(param_1[0x38]) { case 1: case 4: case 7: - goto switchD_180036578_caseD_1; + goto switchD_180036838_caseD_1; default: - puVar11 = (undefined8 *)0x25; - pcVar3 = (code *)swi(0x29); - (*pcVar3)(); - puVar14 = auStackY_d0; + puVar15 = (undefined8 *)0x25; + pcVar6 = (code *)swi(0x29); + (*pcVar6)(); + puVar8 = (undefined8 *)auStackY_d0; goto LAB_8; case 5: case 6: case 8: - uVar6 = htons(0x1194); - lVar10 = 0; - puVar14 = auStackY_d8; - if ((uVar1 != uVar6) || (puVar14 = auStackY_d8, (byte)(bVar4 - 0x22) < 4)) - goto switchD_180036578_caseD_1; - puVar11 = WPP_GLOBAL_Control; + uVar10 = htons(0x1194); + lVar14 = 0; + puVar15 = &uStackY_d8; + if ((uVar3 != uVar10) || (puVar15 = &uStackY_d8, (byte)(bVar7 - 0x22) < 4)) + goto switchD_180036838_caseD_1; + puVar15 = WPP_GLOBAL_Control; if (((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)))) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x16,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x16,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4, + pwVar13); } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38, + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38, "IPv6 packet recvd at port 4500 for non-IkeV2 Keying Module"); - puVar11 = (undefined8 *)&DAT_1; + puVar15 = (undefined8 *)&DAT_1; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_9,in_R8,in_R9,5,auStack_78); + (0x180165278,&DAT_9,param_3,param_4,5,local_78); } } - in_R8 = (undefined *)0x32; + param_3 = (undefined *)0x32; } goto LAB_10; } } else { - if (((0x25 < uStack_90._2_1_) || - ((0x3d00000020U >> ((ulonglong)uStack_90._2_1_ & 0x3f) & 1) == 0)) && - (3 < (byte)(uStack_90._2_1_ + 0xd))) { + if (((0x25 < local_90._2_1_) || + ((0x3d00000020U >> ((ulonglong)local_90._2_1_ & 0x3f) & 1) == 0)) && + (3 < (byte)(local_90._2_1_ + 0xd))) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x13,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x13,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4,pwVar13) + ; } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38,"Invalid Exchange Type in IKE header, dropping packet"); - pbVar12 = &DAT_11; + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38,"Invalid Exchange Type in IKE header, dropping packet"); + pbVar16 = &DAT_11; goto LAB_3; } } goto LAB_0; } - if ((uStack_90._2_1_ == 0x20) || (uStack_90._2_1_ == 5)) goto LAB_5; - if (3 < (byte)(uStack_90._2_1_ + 0xd)) { - if ((uStack_90._1_1_ & 0xf0) == 0x20) goto LAB_6; - if ((uStack_90._2_1_ != 0x22) || ((uStack_90 & 0x20000000) != 0)) goto LAB_12; + if ((local_90._2_1_ == 0x20) || (local_90._2_1_ == 5)) goto LAB_5; + if (3 < (byte)(local_90._2_1_ + 0xd)) { + if ((local_90._1_1_ & 0xf0) == 0x20) goto LAB_6; + if ((local_90._2_1_ != 0x22) || ((local_90 & 0x20000000) != 0)) goto LAB_12; goto LAB_7; } if ((*(byte *)(gIkeExtGlobals + 0x7e8) & 0x40) != 0) { if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x14,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x14,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4,pwVar13) + ; } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38,"Dropping Authip packet because Authip is disabled"); - pbVar12 = &DAT_13; + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38,"Dropping Authip packet because Authip is disabled"); + pbVar16 = &DAT_13; goto LAB_3; } } goto LAB_0; } - if (0xf < (uStack_90._1_1_ & 0xf0)) goto LAB_6; + if (0xf < (local_90._1_1_ & 0xf0)) goto LAB_6; } LAB_12: if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x15,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x15,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4,pwVar13); } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38,"Invalid Isakmp Version in IKE header, dropping packet"); - pbVar12 = &DAT_14; + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38,"Invalid Isakmp Version in IKE header, dropping packet"); + pbVar16 = &DAT_14; goto LAB_3; } } goto LAB_0; } LAB_8: - puVar13 = puVar14; - in_R8 = (undefined *)0x3616; + puVar17 = puVar8; + param_3 = (undefined *)0x3616; } else { if (0x20 < *(uint *)(param_1 + 0x18)) { - lVar10 = *(longlong *)(param_1 + 0x10); - lStack_a0 = *(longlong *)(lVar10 + 4); - lStack_98 = *(longlong *)(lVar10 + 0xc); - uStack_90 = *(ulonglong *)(lVar10 + 0x14); - uStack_88 = *(uint *)(lVar10 + 0x1c); - NtohHeader((longlong)&lStack_a0); - puVar11 = (undefined8 *)(ulonglong)uStack_88; - if ((0x1c < uStack_88) && (uStack_88 <= *(int *)(param_1 + 0x18) - 4U)) { - uVar8 = uStack_90._4_4_; + lVar14 = *(longlong *)(param_1 + 0x10); + local_a0 = *(longlong *)(lVar14 + 4); + lStack_98 = *(longlong *)(lVar14 + 0xc); + local_90 = *(ulonglong *)(lVar14 + 0x14); + local_88 = *(uint *)(lVar14 + 0x1c); + NtohHeader((longlong)&local_a0); + puVar15 = (undefined8 *)(ulonglong)local_88; + if ((0x1c < local_88) && (local_88 <= *(int *)(param_1 + 0x18) - 4U)) { + uVar12 = local_90._4_4_; goto LAB_4; } - puVar11 = WPP_GLOBAL_Control; + puVar15 = WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - in_R9 = IkeGetTlsMmLuid(); - in_R8 = &WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids; - puVar11 = (undefined8 *)WPP_GLOBAL_Control[2]; - WPP_SF_iS(puVar11,0x12,&WPP_8a8d10d3053434a598e8c3fe127d93fc_Traceguids,in_R9,pwVar9); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + param_4 = IkeGetTlsMmLuid(); + param_3 = &WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids; + puVar15 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iS(puVar15,0x12,&WPP_f0287a122ac63bd9b3682352c8dab350_Traceguids,param_4,pwVar13); } if (4 < DAT_1) { - puVar11 = (undefined8 *)&DAT_1; - cVar5 = _tlgKeywordOn(0x180164278,0); - if (cVar5 != '\0') { - uStack_a8 = IkeGetTlsMmLuid(); - puStack_58 = &uStack_a8; - uStack_50 = 8; - pwVar9 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(alStack_48,pwVar9); - _tlgCreate1Sz_char(alStack_38,"Invalid length in IKE header, dropping packet"); - pbVar12 = &DAT_15; + puVar15 = (undefined8 *)&DAT_1; + cVar9 = _tlgKeywordOn(0x180165278,0); + if (cVar9 != '\0') { + local_a8 = IkeGetTlsMmLuid(); + local_58 = &local_a8; + local_50 = 8; + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_48,pwVar13); + _tlgCreate1Sz_char(local_38,"Invalid length in IKE header, dropping packet"); + pbVar16 = &DAT_15; goto LAB_3; } } } LAB_0: - in_R8 = (undefined *)0x3600; - puVar13 = auStackY_d8; + param_3 = (undefined *)0x3600; + puVar17 = &uStackY_d8; } LAB_10: - in_R9 = 1; - *(undefined8 *)(puVar13 + -8) = 0x18003676e; - lVar10 = WfpReportSysErrorAsWinError(puVar11,"IkeVerifyPacketHeader",(ulonglong)in_R8,1); - puVar14 = puVar13; - if (lVar10 != 0) { + param_4 = 1; + *(undefined8 *)((longlong)puVar17 + -8) = 0x180036a2e; + lVar14 = WfpReportSysErrorAsWinError(puVar15,"IkeVerifyPacketHeader",(ulonglong)param_3,1); + puVar15 = puVar17; + if (lVar14 != 0) { LOCK(); *(int *)(gIkeExtGlobals + 0x7a0) = *(int *)(gIkeExtGlobals + 0x7a0) + 1; UNLOCK(); } -switchD_180036578_caseD_1: - *(undefined8 *)(puVar14 + -8) = 0x180036792; - TraceLogHelper("IkeVerifyPacketHeader",0,in_R8,in_R9); - *(undefined8 *)(puVar14 + -8) = 0x1800367a1; - IkeReturnError(lVar10,"IkeVerifyPacketHeader",in_R8,in_R9); - *(undefined8 *)(puVar14 + -8) = 0x1800367bd; +switchD_180036838_caseD_1: + *(undefined8 *)((longlong)puVar15 + -8) = 0x180036a52; + TraceLogHelper("IkeVerifyPacketHeader",0,param_3,param_4); + *(undefined8 *)((longlong)puVar15 + -8) = 0x180036a61; + IkeReturnError(lVar14,"IkeVerifyPacketHeader",param_3,param_4); + *(undefined8 *)((longlong)puVar15 + -8) = 0x180036a7d; return; } ``` ## IkeProcessNotifyPayloadGroupIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.96| |i_ratio|0.73| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeProcessNotifyPayloadGroupIkeV2|IkeProcessNotifyPayloadGroupIkeV2| |fullname|IkeProcessNotifyPayloadGroupIkeV2|IkeProcessNotifyPayloadGroupIkeV2| |refcount|2|2| |`length`|223|224| |called|IkeDetermineNotifyType
IkeHandleNotifyIkeV2
IkeProcessGenericPayload
IkeReturnError
TraceLogHelper|IkeDetermineNotifyType
IkeHandleNotifyIkeV2
IkeProcessGenericPayload
IkeReturnError
TraceLogHelper| |calling|IkeProcessInBandNotifyPayloadsIkeV2|IkeProcessInBandNotifyPayloadsIkeV2| |paramcount|4|4| |`address`|1800ce20c|1800ce9e8| |sig|undefined __fastcall IkeProcessNotifyPayloadGroupIkeV2(uint param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, PRTL_CRITICAL_SECTION_DEBUG param_3, PRTL_CRITICAL_SECTION_DEBUG param_4)|undefined __fastcall IkeProcessNotifyPayloadGroupIkeV2(uint param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, PRTL_CRITICAL_SECTION_DEBUG param_3, PRTL_CRITICAL_SECTION_DEBUG param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeProcessNotifyPayloadGroupIkeV2 Diff ```diff --- IkeProcessNotifyPayloadGroupIkeV2 +++ IkeProcessNotifyPayloadGroupIkeV2 @@ -1,53 +1,53 @@ void IkeProcessNotifyPayloadGroupIkeV2 (uint param_1,PRTL_CRITICAL_SECTION_DEBUG param_2,PRTL_CRITICAL_SECTION_DEBUG param_3 ,PRTL_CRITICAL_SECTION_DEBUG param_4) { longlong lVar1; WORD WVar2; PRTL_CRITICAL_SECTION_DEBUG p_Var3; WORD WVar4; char cVar5; PRTL_CRITICAL_SECTION_DEBUG p_Var6; PRTL_CRITICAL_SECTION_DEBUG p_Var7; WORD local_res8; undefined4 local_38; WVar2 = (WORD)param_1; p_Var3 = (PRTL_CRITICAL_SECTION_DEBUG)0x1; cVar5 = ')'; p_Var6 = param_3; p_Var7 = param_4; local_res8 = WVar2; TraceLogHelper("IkeProcessNotifyPayloadGroupIkeV2",1,param_3,param_4); WVar4 = WVar2; while( true ) { if ((cVar5 == ')') && (WVar4 == WVar2)) { local_38._0_2_ = 0; local_38._2_2_ = 0; p_Var7 = (PRTL_CRITICAL_SECTION_DEBUG)&local_38; p_Var3 = param_4; p_Var6 = param_2; - lVar1 = IkeHandleNotifyIkeV2(param_3,param_4,(LPCRITICAL_SECTION)param_2,(undefined4 *)p_Var7) - ; + lVar1 = IkeHandleNotifyIkeV2 + (param_3,param_4,(LPCRITICAL_SECTION)param_2,(LPCRITICAL_SECTION)p_Var7); } else { lVar1 = IkeProcessGenericPayload((longlong *)param_2,p_Var3,p_Var6,p_Var7); } if (lVar1 != 0) break; cVar5 = *(char *)((ulonglong)*(ushort *)((longlong)¶m_2->CriticalSection + 6) + *(longlong *)param_2); if (cVar5 == ')') { p_Var3 = (PRTL_CRITICAL_SECTION_DEBUG)&local_res8; lVar1 = IkeDetermineNotifyType((longlong *)param_2,(undefined2 *)p_Var3,p_Var6,p_Var7); WVar4 = local_res8; if (lVar1 != 0) break; } if (((param_1 >> 0x10 & 1) == 0) || (cVar5 == '\0')) break; } TraceLogHelper("IkeProcessNotifyPayloadGroupIkeV2",0,p_Var6,p_Var7); IkeReturnError(lVar1,"IkeProcessNotifyPayloadGroupIkeV2",p_Var6,p_Var7); return; } ``` ## IkeHandlePayloadMMVendorId ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.92| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeHandlePayloadMMVendorId|IkeHandlePayloadMMVendorId| |fullname|IkeHandlePayloadMMVendorId|IkeHandlePayloadMMVendorId| |refcount|2|2| |`length`|402|406| |called|
Expand for full list:
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkePostPayloadProcessMMVendorId
IkeProcessVendor
IkeReturnError
TraceLogHelper
WPP_SF_iSq
WfpMemFree
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkePostPayloadProcessMMVendorId
IkeProcessVendor
IkeReturnError
TraceLogHelper
WPP_SF_iSq
WfpMemFree
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeProcessPayloadMM|IkeProcessPayloadMM| |paramcount|4|4| |`address`|1800f3230|1800f3b10| |sig|undefined __fastcall IkeHandlePayloadMMVendorId(longlong * param_1, longlong param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall IkeHandlePayloadMMVendorId(longlong * param_1, longlong param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeHandlePayloadMMVendorId Diff ```diff --- IkeHandlePayloadMMVendorId +++ IkeHandlePayloadMMVendorId @@ -1,67 +1,67 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeHandlePayloadMMVendorId (longlong *param_1,longlong param_2,undefined8 param_3,undefined8 param_4) { char cVar1; wchar_t *pwVar2; longlong lVar3; uint *puVar4; undefined1 auStackY_c8 [32]; uint local_98 [2]; uint local_90 [2]; longlong lStack_88; undefined8 local_80; undefined1 local_78 [32]; undefined8 *local_58; undefined4 local_50; undefined4 local_4c; longlong local_48 [2]; longlong local_38 [2]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_c8; local_98[0] = 0; local_90[0] = 0; local_90[1] = 0; lStack_88 = 0; TraceLogHelper("IkeHandlePayloadMMVendorId",1,param_3,param_4); if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = IkeGetTlsMmLuid(); - WPP_SF_iSq(WPP_GLOBAL_Control[2],0x17,&WPP_e49668c0bb823535483f207c5a805ae0_Traceguids,param_4, + WPP_SF_iSq(WPP_GLOBAL_Control[2],0x19,&WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,param_4, pwVar2); } if (4 < DAT_0) { - cVar1 = _tlgKeywordOn(0x180164278,0); + cVar1 = _tlgKeywordOn(0x180165278,0); if (cVar1 != '\0') { local_80 = IkeGetTlsMmLuid(); local_4c = 0; local_58 = &local_80; local_50 = 8; pwVar2 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_48,pwVar2); _tlgCreate1Sz_char(local_38,"Process Payload VENDOR ID"); _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_1,local_78,param_4,5,(undefined8 *)local_78); + (0x180165278,&DAT_1,local_78,param_4,5,(undefined8 *)local_78); } } - puVar4 = (uint *)0x0; + puVar4 = (uint *)(param_2 + 0x248); pwVar2 = (wchar_t *)local_98; - lVar3 = IkeProcessVendor(param_1,0,0,(int *)pwVar2,local_90); + lVar3 = IkeProcessVendor(param_1,0,(int *)puVar4,(int *)pwVar2,local_90); if (lVar3 == 0) { puVar4 = local_90; IkePostPayloadProcessMMVendorId(param_2,local_98[0],(undefined *)puVar4,pwVar2); } if (lStack_88 != 0) { WfpMemFree(&lStack_88); } TraceLogHelper("IkeHandlePayloadMMVendorId",0,puVar4,pwVar2); IkeReturnError(lVar3,"IkeHandlePayloadMMVendorId",puVar4,pwVar2); return; } ``` ## IkeHandleNotifyIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.2| |i_ratio|0.33| |m_ratio|0.93| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeHandleNotifyIkeV2|IkeHandleNotifyIkeV2| |fullname|IkeHandleNotifyIkeV2|IkeHandleNotifyIkeV2| |refcount|6|6| |`length`|1574|1850| |`called`|
Expand for full list:
IkeDumpNotifyInfo
IkeFindQMSA
IkeFindQMSAByMySpi
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeHandleErrorNotifyIkeV2
IkeHandleStatusNotifyIkeV2
IkeIsIkeV2FragmentationSupportedNotify
IkeProcessNotifyIkeV2
IkeReturnError
TraceLogHelperWPP_SF_iS
WPP_SF_iSDq
WPP_SF_iSqD
WPP_SF_iSqq
WS2_32.DLL::ntohl
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
IkeDumpNotifyInfo
IkeFindQMSA
IkeFindQMSAByMySpi
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
IkeHandleErrorNotifyIkeV2
IkeHandleStatusNotifyIkeV2
IkeIsIkeV2FragmentationSupportedNotify
IkeProcessNotifyIkeV2
IkeReturnError
TraceLogHelperWPP_SF_iS
WPP_SF_iSD
WPP_SF_iSDq
WPP_SF_iSqD
WPP_SF_iSqq
WS2_32.DLL::ntohl
WfpReportAppErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeHandleErrNotifyReqIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleQMPacketDispatchIkeV2
IkeProcessNotifyPayloadGroupIkeV2
IkeProcessPayloadMM|IkeHandleErrNotifyReqIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleQMPacketDispatchIkeV2
IkeProcessNotifyPayloadGroupIkeV2
IkeProcessPayloadMM| |paramcount|4|4| |`address`|1800caacc|1800caec0| |`sig`|undefined __fastcall IkeHandleNotifyIkeV2(PRTL_CRITICAL_SECTION_DEBUG param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, LPCRITICAL_SECTION param_3, undefined4 * param_4)|undefined __fastcall IkeHandleNotifyIkeV2(PRTL_CRITICAL_SECTION_DEBUG param_1, PRTL_CRITICAL_SECTION_DEBUG param_2, LPCRITICAL_SECTION param_3, LPCRITICAL_SECTION param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeHandleNotifyIkeV2 Called Diff ```diff --- IkeHandleNotifyIkeV2 called +++ IkeHandleNotifyIkeV2 called @@ -12,0 +13 @@ +WPP_SF_iSD @@ -17 +18 @@ -WfpReportSysErrorAsWinError +WfpReportAppErrorAsWinError ``` ### IkeHandleNotifyIkeV2 Diff ```diff --- IkeHandleNotifyIkeV2 +++ IkeHandleNotifyIkeV2 @@ -1,233 +1,269 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeHandleNotifyIkeV2 (PRTL_CRITICAL_SECTION_DEBUG param_1,PRTL_CRITICAL_SECTION_DEBUG param_2, - LPCRITICAL_SECTION param_3,undefined4 *param_4) + LPCRITICAL_SECTION param_3,LPCRITICAL_SECTION param_4) { PRTL_CRITICAL_SECTION_DEBUG p_Var1; LPCRITICAL_SECTION p_Var2; char cVar3; bool bVar4; u_long uVar5; wchar_t *pwVar6; - undefined4 *puVar7; + LPCRITICAL_SECTION p_Var7; longlong lVar8; undefined7 extraout_var; ushort uVar9; - ulonglong uVar10; - uint uVar11; - LPCRITICAL_SECTION p_Var12; - char *pcVar13; - undefined *puVar14; - LPCRITICAL_SECTION p_Var15; - undefined1 auStackY_148 [32]; - undefined1 local_108 [8]; - undefined1 local_100 [16]; - PRTL_CRITICAL_SECTION_DEBUG local_f0; - PRTL_CRITICAL_SECTION_DEBUG local_e8; - undefined4 *local_e0; - LPCRITICAL_SECTION local_d8; - PRTL_CRITICAL_SECTION_DEBUG local_d0; + undefined8 *puVar10; + LPCRITICAL_SECTION p_Var11; + char *pcVar12; + LPCRITICAL_SECTION p_Var13; + uint uVar14; + undefined1 auStackY_158 [32]; + undefined1 local_118 [8]; + ushort local_110 [4]; + PRTL_CRITICAL_SECTION_DEBUG local_108; + PRTL_CRITICAL_SECTION_DEBUG local_100; + undefined1 local_f8 [16]; + LPCRITICAL_SECTION local_e8; + LPCRITICAL_SECTION local_e0; + PRTL_CRITICAL_SECTION_DEBUG local_d8 [2]; undefined8 local_c8 [4]; PRTL_CRITICAL_SECTION_DEBUG *local_a8; undefined8 local_a0; longlong local_98 [2]; longlong local_88 [2]; PRTL_CRITICAL_SECTION_DEBUG *local_78; undefined8 local_70; PRTL_CRITICAL_SECTION_DEBUG *local_68; undefined8 local_60; ulonglong local_58; - local_58 = __security_cookie ^ (ulonglong)auStackY_148; - local_d8 = (LPCRITICAL_SECTION)0x0; - local_100._8_4_ = 0; - local_108._4_2_ = 0; - local_108[0] = 0; - local_108[1] = 0; - p_Var12 = param_3; - puVar7 = param_4; - local_100._0_8_ = param_2; + local_58 = __security_cookie ^ (ulonglong)auStackY_158; + local_e8 = (LPCRITICAL_SECTION)0x0; + local_118._4_4_ = 0; + local_110[0] = 0; + local_118[0] = 0; + local_118[1] = 0; + p_Var11 = param_3; + p_Var7 = param_4; + local_f8._0_8_ = param_2; + local_f8._8_8_ = param_3; local_e0 = param_4; TraceLogHelper("IkeHandleNotifyIkeV2",1,param_3,param_4); if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - puVar7 = (undefined4 *)IkeGetTlsMmLuid(); - p_Var12 = (LPCRITICAL_SECTION)&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSqq(WPP_GLOBAL_Control[2],0x3a,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids,puVar7, + p_Var7 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var11 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSqq(WPP_GLOBAL_Control[2],0x3e,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var7, pwVar6); - } - if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180164278,0), cVar3 != '\0')) { - local_d0 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_a8 = &local_d0; + param_4 = local_e0; + } + if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180165278,0), cVar3 != '\0')) { + local_d8[0] = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); + local_a8 = local_d8; local_a0 = 8; pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); _tlgCreate1Sz_wchar_t(local_98,pwVar6); _tlgCreate1Sz_char(local_88,"Process Payload Notify"); - local_78 = &local_e8; - local_68 = &local_f0; + local_78 = &local_100; + local_68 = &local_108; local_70 = 8; local_60 = 8; - local_f0 = param_2; - local_e8 = param_1; - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,&DAT_1,p_Var12,puVar7,7,local_c8); - } - if (param_4 != (undefined4 *)0x0) { - *param_4 = 0; - } - uVar10 = (ulonglong)*(ushort *)((longlong)¶m_3->RecursionCount + 2); - if (*(char *)((longlong)¶m_3->DebugInfo->Type + uVar10) == ')') { - p_Var12 = (LPCRITICAL_SECTION)local_108; - pcVar13 = local_100 + 8; + local_108 = param_2; + local_100 = param_1; + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_1,p_Var11,p_Var7,7,local_c8); + } + if (param_4 != (LPCRITICAL_SECTION)0x0) { + *(undefined4 *)¶m_4->DebugInfo = 0; + } + puVar10 = (undefined8 *)(ulonglong)*(ushort *)((longlong)¶m_3->RecursionCount + 2); + if (*(char *)((longlong)puVar10 + (longlong)param_3->DebugInfo) == ')') { + p_Var7 = (LPCRITICAL_SECTION)local_118; + p_Var11 = (LPCRITICAL_SECTION)(local_118 + 4); lVar8 = IkeProcessNotifyIkeV2 - ((longlong *)param_3,(longlong *)&local_d8,(uint *)pcVar13,(byte *)p_Var12, - (short *)(local_108 + 4),local_108 + 1); - p_Var2 = local_d8; - p_Var15 = p_Var12; - if (lVar8 == 0) { - if ((1 < local_108[1]) && (param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0)) { - if ((byte)(local_108[1] - 2) < 2) { - uVar5 = ntohl(*(u_long *)&local_d8->DebugInfo); - p_Var12 = (LPCRITICAL_SECTION)local_100; - puVar14 = (undefined *)0x1; - IkeFindQMSAByMySpi((longlong)param_1,uVar5,1,(undefined8 *)p_Var12); - param_2 = (PRTL_CRITICAL_SECTION_DEBUG)local_100._0_8_; + ((longlong *)param_3,(longlong *)&local_e8,(uint *)p_Var11,(byte *)p_Var7, + (short *)local_110,local_118 + 1); + p_Var2 = local_e8; + uVar14 = local_118._4_4_; + pcVar12 = (char *)p_Var11; + p_Var13 = p_Var7; + if (lVar8 != 0) goto LAB_2; + pcVar12 = (char *)param_3; + if ((1 < local_118[1]) && + (pcVar12 = (char *)param_3, param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0)) { + if ((byte)(local_118[1] - 2) < 2) { + if ((uint)local_118._4_4_ < 4) { + puVar10 = &WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - p_Var12 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - puVar14 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSDq(WPP_GLOBAL_Control[2],0x3b,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids, - p_Var12,pwVar6); + p_Var7 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var11 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + puVar10 = (undefined8 *)WPP_GLOBAL_Control[2]; + WPP_SF_iSD(puVar10,0x3f,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids,p_Var7,pwVar6); } - if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180164278,0), cVar3 != '\0')) { - local_f0 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_a8 = &local_f0; - local_a0 = 8; - pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_98,pwVar6); - _tlgCreate1Sz_char(local_88,"IkeHandleNotifyIkeV2 found QMSA for mySpi "); - local_78 = (PRTL_CRITICAL_SECTION_DEBUG *)local_100; - local_100._0_4_ = uVar5; - local_68 = &local_e8; - local_70 = 4; - local_e8 = param_2; - local_60 = 8; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_2,puVar14,p_Var12,7,local_c8); + if (4 < DAT_0) { + puVar10 = (undefined8 *)&DAT_0; + cVar3 = _tlgKeywordOn(0x180165278,0); + if (cVar3 != '\0') { + local_108 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); + local_a8 = &local_108; + local_a0 = 8; + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_98,pwVar6); + _tlgCreate1Sz_char(local_88,"Received an invlaid notifyLen"); + local_78 = (PRTL_CRITICAL_SECTION_DEBUG *)(local_118 + 4); + local_70 = 4; + puVar10 = (undefined8 *)&DAT_0; + local_118._4_4_ = uVar14; + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_3,p_Var11,p_Var7,6,local_c8); + } } - param_4 = local_e0; - if (param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0) { - pcVar13 = "HandleNotifyQMDrop"; - IkeDumpNotifyInfo((longlong)param_1,0,"HandleNotifyQMDrop",p_Var12); - p_Var15 = p_Var12; - goto LAB_3; - } - } - else { - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - p_Var12 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - pcVar13 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iS(WPP_GLOBAL_Control[2],0x3c,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids, - p_Var12,pwVar6); - } - if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180164278,0), cVar3 != '\0')) { - local_f0 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_a8 = &local_f0; - local_a0 = 8; - pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_98,pwVar6); - _tlgCreate1Sz_char(local_88,"IkeHandleNotifyIkeV2 recvd notify with protocol id 0"); - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_4,pcVar13,p_Var12,5,local_c8); - } - p_Var1 = param_3->DebugInfo; - uVar5 = ntohl(*(u_long *)((longlong)&(p_Var1->ProcessLocksList).Flink + 4)); - pcVar13 = local_100; - p_Var12 = (LPCRITICAL_SECTION)0x3; - IkeFindQMSA((char *)param_1,uVar5,pcVar13,3, - *(byte *)((longlong)&(p_Var1->ProcessLocksList).Flink + 3)); - param_2 = (PRTL_CRITICAL_SECTION_DEBUG)local_100._0_8_; - if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && - ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - p_Var12 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); - pcVar13 = &WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids; - WPP_SF_iSqD(WPP_GLOBAL_Control[2],0x3d,&WPP_5f6c3a5979de3f2ee5bd7e46d8486197_Traceguids, - p_Var12,pwVar6); - } - param_4 = local_e0; - if ((4 < DAT_0) && - (cVar3 = _tlgKeywordOn(0x180164278,0), param_4 = local_e0, cVar3 != '\0')) { - local_f0 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); - local_a8 = &local_f0; - local_a0 = 8; - pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_98,pwVar6); - _tlgCreate1Sz_char(local_88, - "IkeHandleNotifyIkeV2 recvd notify with protocol id 0 found QMSA for mesgid" - ); - local_78 = (PRTL_CRITICAL_SECTION_DEBUG *)local_100; - local_100._0_4_ = uVar5; - local_68 = &local_e8; - local_70 = 4; - local_e8 = param_2; - local_60 = 8; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,pcVar13,p_Var12,7,local_c8); - param_4 = local_e0; - } - } - } - p_Var15 = p_Var2; - uVar11 = local_100._8_4_; - if (local_108._4_2_ != 0x4009) { - p_Var15 = (LPCRITICAL_SECTION)((longlong)&p_Var2->DebugInfo + (ulonglong)local_108[0]); - uVar11 = local_100._8_4_ - (uint)local_108[0]; - } - pcVar13 = (char *)(ulonglong)uVar11; - if ((ushort)local_108._4_2_ < 0x4000) { - p_Var12 = (LPCRITICAL_SECTION)(ulonglong)(ushort)local_108._4_2_; - lVar8 = IkeHandleErrorNotifyIkeV2 - (param_1,param_2,(longlong *)param_3,(ulonglong)p_Var12, - (_LIST_ENTRY *)p_Var15,uVar11,param_4); - pcVar13 = (char *)param_3; - p_Var15 = p_Var12; + pcVar12 = (char *)0x3613; + goto LAB_4; + } + uVar5 = ntohl(*(u_long *)&local_e8->DebugInfo); + p_Var7 = (LPCRITICAL_SECTION)local_f8; + p_Var11 = (LPCRITICAL_SECTION)0x1; + IkeFindQMSAByMySpi((longlong)param_1,uVar5,1,(undefined8 *)p_Var7); + param_2 = (PRTL_CRITICAL_SECTION_DEBUG)local_f8._0_8_; + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var7 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var11 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSDq(WPP_GLOBAL_Control[2],0x40,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var7,pwVar6); + } + if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180165278,0), cVar3 != '\0')) { + local_108 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); + local_a8 = &local_108; + local_a0 = 8; + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_98,pwVar6); + _tlgCreate1Sz_char(local_88,"IkeHandleNotifyIkeV2 found QMSA for mySpi "); + local_78 = (PRTL_CRITICAL_SECTION_DEBUG *)(local_118 + 4); + local_68 = &local_100; + local_70 = 4; + local_100 = param_2; + local_60 = 8; + local_118._4_4_ = uVar5; + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_5,p_Var11,p_Var7,7,local_c8); + } + pcVar12 = (char *)local_f8._8_8_; + if (param_2 == (PRTL_CRITICAL_SECTION_DEBUG)0x0) { + pcVar12 = "HandleNotifyQMDrop"; + IkeDumpNotifyInfo((longlong)param_1,0,"HandleNotifyQMDrop",p_Var7); + p_Var13 = p_Var7; + goto LAB_2; + } } else { - uVar9 = local_108._4_2_; - bVar4 = IkeIsIkeV2FragmentationSupportedNotify(local_108._4_2_); - if ((int)CONCAT71(extraout_var,bVar4) == 0) { - uVar11 = (uint)pcVar13; - pcVar13 = (char *)(ulonglong)uVar9; - lVar8 = IkeHandleStatusNotifyIkeV2 - ((LPCRITICAL_SECTION)param_1,(LPCRITICAL_SECTION)param_2, - (LPCRITICAL_SECTION)pcVar13,p_Var15,uVar11); - } - else { - *(undefined4 *)(*(longlong *)(param_1 + 0x17) + 0x264) = 1; - p_Var15 = p_Var12; - } + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var7 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var11 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iS(WPP_GLOBAL_Control[2],0x41,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var7,pwVar6); + } + if ((4 < DAT_0) && (cVar3 = _tlgKeywordOn(0x180165278,0), cVar3 != '\0')) { + local_108 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); + local_a8 = &local_108; + local_a0 = 8; + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_98,pwVar6); + _tlgCreate1Sz_char(local_88,"IkeHandleNotifyIkeV2 recvd notify with protocol id 0"); + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_6,p_Var11,p_Var7,5,local_c8); + } + p_Var1 = param_3->DebugInfo; + uVar5 = ntohl(*(u_long *)((longlong)&(p_Var1->ProcessLocksList).Flink + 4)); + p_Var11 = (LPCRITICAL_SECTION)local_f8; + p_Var7 = (LPCRITICAL_SECTION)0x3; + IkeFindQMSA((char *)param_1,uVar5,(char *)p_Var11,3, + *(byte *)((longlong)&(p_Var1->ProcessLocksList).Flink + 3)); + param_2 = (PRTL_CRITICAL_SECTION_DEBUG)local_f8._0_8_; + if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && + ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + p_Var7 = (LPCRITICAL_SECTION)IkeGetTlsMmLuid(); + p_Var11 = (LPCRITICAL_SECTION)&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids; + WPP_SF_iSqD(WPP_GLOBAL_Control[2],0x42,&WPP_4303eb0f14f73ae83819a90a933359e4_Traceguids, + p_Var7,pwVar6); + } + pcVar12 = (char *)local_f8._8_8_; + if ((4 < DAT_0) && + (cVar3 = _tlgKeywordOn(0x180165278,0), pcVar12 = (char *)local_f8._8_8_, cVar3 != '\0')) + { + local_108 = (PRTL_CRITICAL_SECTION_DEBUG)IkeGetTlsMmLuid(); + local_a8 = &local_108; + local_a0 = 8; + pwVar6 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_98,pwVar6); + _tlgCreate1Sz_char(local_88, + "IkeHandleNotifyIkeV2 recvd notify with protocol id 0 found QMSA for mesgid" + ); + local_78 = (PRTL_CRITICAL_SECTION_DEBUG *)(local_118 + 4); + local_68 = &local_100; + local_70 = 4; + local_100 = param_2; + local_60 = 8; + local_118._4_4_ = uVar5; + _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,&DAT_7,p_Var11,p_Var7,7,local_c8); + pcVar12 = (char *)local_f8._8_8_; + } + } + } + p_Var13 = p_Var2; + if (local_110[0] != 0x4009) { + p_Var13 = (LPCRITICAL_SECTION)((longlong)&p_Var2->DebugInfo + (ulonglong)local_118[0]); + uVar14 = uVar14 - local_118[0]; + } + if (local_110[0] < 0x4000) { + p_Var7 = (LPCRITICAL_SECTION)(ulonglong)local_110[0]; + lVar8 = IkeHandleErrorNotifyIkeV2 + (param_1,param_2,(_LIST_ENTRY *)pcVar12,(ulonglong)p_Var7, + (_LIST_ENTRY *)p_Var13,uVar14,(undefined4 *)local_e0); + p_Var13 = p_Var7; + } + else { + uVar9 = local_110[0]; + bVar4 = IkeIsIkeV2FragmentationSupportedNotify(local_110[0]); + if ((int)CONCAT71(extraout_var,bVar4) == 0) { + pcVar12 = (char *)(ulonglong)uVar9; + lVar8 = IkeHandleStatusNotifyIkeV2 + ((LPCRITICAL_SECTION)param_1,(LPCRITICAL_SECTION)param_2, + (LPCRITICAL_SECTION)pcVar12,p_Var13,uVar14); + } + else { + *(undefined4 *)(*(longlong *)(param_1 + 0x17) + 0x264) = 1; + pcVar12 = (char *)p_Var11; + p_Var13 = p_Var7; } } } else { - p_Var15 = (LPCRITICAL_SECTION)0x1; - pcVar13 = (char *)0x3610; - lVar8 = WfpReportSysErrorAsWinError(uVar10,"IkeHandleNotifyIkeV2",0x3610,1); - } -LAB_3: - TraceLogHelper("IkeHandleNotifyIkeV2",0,pcVar13,p_Var15); - IkeReturnError(lVar8,"IkeHandleNotifyIkeV2",pcVar13,p_Var15); + pcVar12 = (char *)0x3610; +LAB_4: + lVar8 = WfpReportAppErrorAsWinError(puVar10,"IkeHandleNotifyIkeV2",(ulonglong)pcVar12,p_Var7,1); + p_Var13 = p_Var7; + } +LAB_2: + TraceLogHelper("IkeHandleNotifyIkeV2",0,pcVar12,p_Var13); + IkeReturnError(lVar8,"IkeHandleNotifyIkeV2",pcVar12,p_Var13); return; } ``` ## IkeInitMMResponderPhase1 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length| |ratio|0.44| |i_ratio|0.38| |m_ratio|1.0| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeInitMMResponderPhase1|IkeInitMMResponderPhase1| |fullname|IkeInitMMResponderPhase1|IkeInitMMResponderPhase1| |refcount|5|5| |`length`|4547|4584| |called|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
IkeAllowNewIncomingConnection
IkeCopyPacket
IkeCreateMMSA
IkeDerefMMSA
IkeGenerateResponderDosCookie
IkeGetTlsMmLuid
IkeGetTlsPeerAddrIkeHandleSecurityRealmVendorId
IkeInitializeMMSAResponder
IkeIsKeyModEnabledForTraffic
IkeLookupVendorId
IkeReturnError
IkeSendDosCookieNotify
IkeTerminateMMWithoutLock
TraceLogHelper
WPP_SF_iS
WPP_SF_iSD
WPP_SF_iSS
WS2_32.DLL::ntohs
WfpErrorToWindowsError
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapSize
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
IkeAllowNewIncomingConnection
IkeCopyPacket
IkeCreateMMSA
IkeDerefMMSA
IkeGenerateResponderDosCookie
IkeGetTlsMmLuid
IkeGetTlsPeerAddrIkeHandleSecurityRealmVendorId
IkeInitializeMMSAResponder
IkeIsKeyModEnabledForTraffic
IkeLookupVendorId
IkeReturnError
IkeSendDosCookieNotify
IkeTerminateMMWithoutLock
TraceLogHelper
WPP_SF_iS
WPP_SF_iSD
WPP_SF_iSS
WS2_32.DLL::ntohs
WfpErrorToWindowsError
WfpMemFree
WfpReportSysErrorAsWinError
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
| |calling|IkeBeginMMResponder
IkeProcessPacketDispatch|IkeBeginMMResponder
IkeProcessPacketDispatch| |paramcount|4|4| |address|180024050|180024050| |sig|undefined __fastcall IkeInitMMResponderPhase1(longlong param_1, undefined8 * param_2, undefined8 param_3, _LIST_ENTRY * * param_4)|undefined __fastcall IkeInitMMResponderPhase1(longlong param_1, undefined8 * param_2, undefined8 param_3, _LIST_ENTRY * * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeInitMMResponderPhase1 Diff ```diff --- IkeInitMMResponderPhase1 +++ IkeInitMMResponderPhase1 @@ -1,828 +1,834 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void IkeInitMMResponderPhase1 (longlong param_1,undefined8 *param_2,undefined8 param_3,_LIST_ENTRY **param_4) { int iVar1; PUCHAR pUVar2; PUCHAR **pppUVar3; bool bVar4; bool bVar5; int iVar6; - char cVar7; - u_short uVar8; - uint uVar9; - undefined4 uVar10; - uint uVar11; - wchar_t *pwVar12; - longlong lVar13; - SIZE_T SVar14; - _LIST_ENTRY *p_Var15; - undefined8 uVar16; - PUCHAR pUVar17; - PUCHAR ***ppppUVar18; - _LIST_ENTRY **pp_Var19; - char *pcVar20; - uint uVar21; - _LIST_ENTRY *p_Var22; - short sVar23; - ushort uVar24; - wchar_t *pwVar25; - PUCHAR ***ppppUVar27; - undefined8 *puVar28; - _RTL_CRITICAL_SECTION_DEBUG *p_Var29; - _LIST_ENTRY *p_Var30; - undefined *puVar31; - wchar_t *pwVar32; + longlong *plVar7; + char cVar8; + u_short uVar9; + uint uVar10; + undefined4 uVar11; + uint uVar12; + wchar_t *pwVar13; + longlong lVar14; + SIZE_T SVar15; + _LIST_ENTRY *p_Var16; + _LIST_ENTRY *p_Var17; + longlong lVar18; + undefined8 uVar19; + PUCHAR ***ppppUVar20; + PUCHAR pUVar21; + _LIST_ENTRY **pp_Var22; + char *pcVar23; + uint uVar24; + _LIST_ENTRY *p_Var25; + short sVar26; + ushort uVar27; + wchar_t *pwVar28; + PUCHAR ***ppppUVar30; + undefined8 *puVar31; + _RTL_CRITICAL_SECTION_DEBUG *p_Var32; _LIST_ENTRY *p_Var33; - ulonglong uVar34; - longlong *plVar35; + undefined *puVar34; + wchar_t *pwVar35; + ulonglong uVar36; undefined1 auStackY_258 [32]; undefined4 local_228; PUCHAR ***local_220; undefined4 local_218; _LIST_ENTRY *local_210; undefined4 local_208; undefined4 local_204; - _LIST_ENTRY *local_200; - longlong *local_1f8; + _LIST_ENTRY **local_200; + _LIST_ENTRY *local_1f8; uint local_1f0 [2]; _LIST_ENTRY *p_Stack_1e8; undefined4 local_1e0; - int local_1dc; - uint local_1d8; - uint local_1d4; - uint local_1d0 [2]; - PUCHAR ***local_1c8; - longlong local_1c0; - undefined8 uStack_1b8; - undefined8 local_1b0; - undefined8 uStack_1a8; - longlong local_1a0; + longlong local_1d8; + longlong *local_1d0; + int local_1c8; + uint local_1c4; + uint local_1c0; + uint local_1bc; + longlong local_1b8; + undefined8 uStack_1b0; + undefined8 local_1a8; + undefined8 uStack_1a0; longlong local_198; - undefined8 uStack_190; - undefined8 local_188; - undefined8 uStack_180; - undefined8 local_178; - longlong local_170; + longlong local_190; + undefined8 uStack_188; + undefined8 local_180; + undefined8 uStack_178; + undefined8 local_170; undefined8 local_168; undefined8 *local_160; undefined8 local_158 [4]; - longlong **local_138; + _LIST_ENTRY ***local_138; undefined8 local_130; longlong local_128 [2]; longlong local_118 [2]; _LIST_ENTRY **local_108; undefined8 local_100; undefined8 local_f8 [4]; undefined8 *local_d8; undefined8 local_d0; longlong local_c8 [2]; longlong local_b8 [2]; undefined1 local_a8 [32]; - PUCHAR ****local_88; + longlong **local_88; undefined8 local_80; longlong local_78 [2]; longlong local_68 [2]; undefined8 local_58; undefined8 local_50; ulonglong local_48; - ulonglong uVar26; + ulonglong uVar29; local_48 = __security_cookie ^ (ulonglong)auStackY_258; - p_Var22 = (_LIST_ENTRY *)0x0; - uVar21 = 0; + p_Var25 = (_LIST_ENTRY *)0x0; + uVar24 = 0; bVar5 = false; local_220 = (PUCHAR ***)0x0; - local_1d0[0] = 0; - local_1dc = 0; + local_1bc = 0; + local_1c8 = 0; local_1f0[0] = 0; local_1f0[1] = 0; p_Stack_1e8 = (_LIST_ENTRY *)0x0; local_160 = param_2; TraceLogHelper("IkeInitMMResponderPhase1",1,param_3,param_4); pUVar2 = *(PUCHAR *)(param_1 + 0x10); - local_1f8 = (longlong *)(param_1 + 0x10); + local_1d0 = (longlong *)(param_1 + 0x10); if (pUVar2[0x12] == '\x02') { local_228 = 0; } else { local_228 = (pUVar2[0x12] != 0xf3) + 1; } iVar6 = local_228; - puVar28 = &WPP_GLOBAL_Control; - pwVar32 = L"IKE"; + puVar31 = &WPP_GLOBAL_Control; + pwVar35 = L"IKE"; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { if (local_228 == 0) { - pwVar25 = L"IKE"; + pwVar28 = L"IKE"; } else if (local_228 == 1) { - pwVar25 = L"AuthIP"; + pwVar28 = L"AuthIP"; } else { - pwVar25 = L"IKEv2"; + pwVar28 = L"IKEv2"; if (local_228 != 2) { - pwVar25 = L"U"; + pwVar28 = L"U"; } } - pwVar12 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar13 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (_LIST_ENTRY **)IkeGetTlsMmLuid(); - puVar28 = (undefined8 *)&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids; + puVar31 = (undefined8 *)&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids; WPP_SF_iSS(WPP_GLOBAL_Control[2],0x12,&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids,param_4, - pwVar12,pwVar25); + pwVar13,pwVar28); } - if ((4 < DAT_0) && (cVar7 = _tlgKeywordOn(0x180164278,0), cVar7 != '\0')) { + if ((4 < DAT_0) && (cVar8 = _tlgKeywordOn(0x180165278,0), cVar8 != '\0')) { local_168 = IkeGetTlsMmLuid(); local_d8 = &local_168; local_d0 = 8; - pwVar25 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_c8,pwVar25); + pwVar28 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_c8,pwVar28); if (local_228 != 0) { if (local_228 == 1) { - pwVar32 = L"AuthIP"; + pwVar35 = L"AuthIP"; } else { - pwVar32 = L"IKEv2"; + pwVar35 = L"IKEv2"; if (local_228 != 2) { - pwVar32 = L"U"; + pwVar35 = L"U"; } } } - _tlgCreate1Sz_wchar_t(local_b8,pwVar32); - _tlgWriteTransfer_EtwEventWriteTransfer(0x180164278,&DAT_1,puVar28,param_4,5,local_f8); + _tlgCreate1Sz_wchar_t(local_b8,pwVar35); + _tlgWriteTransfer_EtwEventWriteTransfer(0x180165278,&DAT_1,puVar31,param_4,5,local_f8); } local_210 = (_LIST_ENTRY *)(param_1 + 0x38); - p_Var29 = (_RTL_CRITICAL_SECTION_DEBUG *)&local_220; - lVar13 = IkeCreateMMSA(local_228,(undefined8 *)local_210,p_Var29,param_4); - ppppUVar27 = local_220; - if (lVar13 == 0) { + p_Var32 = (_RTL_CRITICAL_SECTION_DEBUG *)&local_220; + lVar14 = IkeCreateMMSA(local_228,(undefined8 *)local_210,p_Var32,param_4); + ppppUVar30 = local_220; + if (lVar14 == 0) { pppUVar3 = *(PUCHAR ***)(param_1 + 0xe8); local_58 = 0; - local_200 = (_LIST_ENTRY *)0x0; + local_1f8 = (_LIST_ENTRY *)0x0; local_220[0x23] = *(PUCHAR ***)(param_1 + 0xe0); local_220[0x24] = pppUVar3; - p_Var33 = (_LIST_ENTRY *)0x0; local_220[0x55] = *(PUCHAR ***)pUVar2; - TraceLogHelper("IkeValidateRCookie",1,p_Var29,param_4); - p_Var30 = local_210; - local_1c8 = ppppUVar27 + 0x49; - iVar1 = *(int *)local_1c8; - p_Var15 = (_LIST_ENTRY *)0x0; - bVar4 = bVar5; + TraceLogHelper("IkeValidateRCookie",1,p_Var32,param_4); + p_Var33 = local_210; + local_200 = (_LIST_ENTRY **)(ppppUVar30 + 0x49); + iVar1 = *(int *)local_200; + p_Var17 = p_Var25; + p_Var16 = p_Var25; + bVar4 = false; if (iVar1 != 2) { if (*(longlong *)(pUVar2 + 8) == 0) { + bVar4 = false; if ((((iVar1 == 0) && (gIkeExtGlobals[0x32].LockCount != 0)) || (iVar1 == 1)) && - (p_Var15 = p_Var22, p_Var33 = p_Var22, (int)gIkeExtGlobals[0x32].SpinCount == 1)) { + ((int)gIkeExtGlobals[0x32].SpinCount == 1)) { bVar4 = true; } } else { - param_4 = &local_200; - p_Var33 = (_LIST_ENTRY *)IkeGenerateResponderDosCookie(pUVar2,(PUCHAR)local_210,0,param_4); - p_Var15 = local_200; - if (p_Var33 == (_LIST_ENTRY *)0x0) { - if (*(_LIST_ENTRY **)(pUVar2 + 8) == local_200->Flink) { - ppppUVar27[0x56] = (PUCHAR **)*(_LIST_ENTRY **)(pUVar2 + 8); + param_4 = &local_1f8; + p_Var16 = (_LIST_ENTRY *)IkeGenerateResponderDosCookie(pUVar2,(PUCHAR)local_210,0,param_4); + p_Var17 = local_1f8; + bVar4 = bVar5; + if (p_Var16 == (_LIST_ENTRY *)0x0) { + if (*(_LIST_ENTRY **)(pUVar2 + 8) == local_1f8->Flink) { + ppppUVar30[0x56] = (PUCHAR **)*(_LIST_ENTRY **)(pUVar2 + 8); } else { - WfpMemFree(&local_200); - param_4 = &local_200; - local_200 = (_LIST_ENTRY *)0x0; - pUVar17 = pUVar2; - p_Var33 = (_LIST_ENTRY *)IkeGenerateResponderDosCookie(pUVar2,(PUCHAR)p_Var30,1,param_4) + WfpMemFree(&local_1f8); + param_4 = &local_1f8; + local_1f8 = (_LIST_ENTRY *)0x0; + pUVar21 = pUVar2; + p_Var16 = (_LIST_ENTRY *)IkeGenerateResponderDosCookie(pUVar2,(PUCHAR)p_Var33,1,param_4) ; - p_Var15 = local_200; - if (p_Var33 == (_LIST_ENTRY *)0x0) { - if (*(_LIST_ENTRY **)(pUVar2 + 8) == local_200->Flink) { - ppppUVar27[0x56] = (PUCHAR **)*(_LIST_ENTRY **)(pUVar2 + 8); + p_Var17 = local_1f8; + if (p_Var16 == (_LIST_ENTRY *)0x0) { + if (*(_LIST_ENTRY **)(pUVar2 + 8) == local_1f8->Flink) { + ppppUVar30[0x56] = (PUCHAR **)*(_LIST_ENTRY **)(pUVar2 + 8); } else { param_4 = (_LIST_ENTRY **)0x1; - p_Var33 = (_LIST_ENTRY *) - WfpReportSysErrorAsWinError(pUVar17,"IkeValidateRCookie",0x3616,1); + p_Var16 = (_LIST_ENTRY *) + WfpReportSysErrorAsWinError(pUVar21,"IkeValidateRCookie",0x3616,1); } } } } } } - if ((gWfpTrackHeapBytes != 0) && (p_Var15 != (_LIST_ENTRY *)0x0)) { - SVar14 = HeapSize(gWfpHeap,0,p_Var15); + if ((gWfpTrackHeapBytes != 0) && (p_Var17 != (_LIST_ENTRY *)0x0)) { + SVar15 = HeapSize(gWfpHeap,0,p_Var17); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar14; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar15; UNLOCK(); - p_Var15 = local_200; - ppppUVar27 = local_220; - } - HeapFree(gWfpHeap,0,p_Var15); - uVar11 = (uint)p_Var33; - uVar9 = uVar11 & 0xffff; - if ((uVar11 & 0x1fff0000) != 0x70000) { - uVar9 = uVar11; - } - if (uVar9 == 0x3616) { + p_Var17 = local_1f8; + ppppUVar30 = local_220; + } + HeapFree(gWfpHeap,0,p_Var17); + uVar12 = (uint)p_Var16; + uVar10 = uVar12 & 0xffff; + if ((uVar12 & 0x1fff0000) != 0x70000) { + uVar10 = uVar12; + } + if (uVar10 == 0x3616) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - ppppUVar27 = local_220; - } - TraceLogHelper("IkeValidateRCookie",0,p_Var15,param_4); - pcVar20 = "IkeValidateRCookie"; - lVar13 = IkeReturnError((longlong)p_Var33,"IkeValidateRCookie",p_Var15,param_4); - ppppUVar18 = local_1c8; - if (lVar13 == 0) { + ppppUVar30 = local_220; + } + TraceLogHelper("IkeValidateRCookie",0,p_Var17,param_4); + pcVar23 = "IkeValidateRCookie"; + lVar14 = IkeReturnError((longlong)p_Var16,"IkeValidateRCookie",p_Var17,param_4); + pp_Var22 = local_200; + if (lVar14 == 0) { local_50 = 0; - if ((((*(int *)local_1c8 == 1) && (*(longlong *)(pUVar2 + 8) == 0)) && + if ((((*(int *)local_200 == 1) && (*(longlong *)(pUVar2 + 8) == 0)) && (0x10 < (pUVar2[0x11] & 0xf0))) || (bVar4)) { - ppppUVar18 = ppppUVar27; - lVar13 = IkeSendDosCookieNotify(ppppUVar27,pcVar20,(PUCHAR ***)p_Var15,(PUCHAR ***)param_4); - if (lVar13 == 0) { + ppppUVar20 = ppppUVar30; + lVar14 = IkeSendDosCookieNotify(ppppUVar30,pcVar23,(PUCHAR ***)p_Var17,(PUCHAR ***)param_4); + if (lVar14 == 0) { param_4 = (_LIST_ENTRY **)0x1; - lVar13 = WfpReportSysErrorAsWinError(ppppUVar18,"IkeInitMMResponderPhase1",0x3642,1); + lVar14 = WfpReportSysErrorAsWinError(ppppUVar20,"IkeInitMMResponderPhase1",0x3642,1); goto LAB_2; } } else { EnterCriticalSection(gIkeExtGlobals); - plVar35 = local_1f8; - param_4 = (_LIST_ENTRY **)&local_1dc; - lVar13 = IkeAllowNewIncomingConnection(local_1f8,local_228,(byte *)p_Var30,(int *)param_4); - if (lVar13 == 0) { - if (local_1dc != 0) { - *(uint *)(ppppUVar27 + 0x4a) = *(uint *)(ppppUVar27 + 0x4a) | 0x800000; + param_4 = (_LIST_ENTRY **)&local_1c8; + lVar14 = IkeAllowNewIncomingConnection(local_1d0,local_228,(byte *)p_Var33,(int *)param_4); + if (lVar14 == 0) { + if (local_1c8 != 0) { + *(uint *)(ppppUVar30 + 0x4a) = *(uint *)(ppppUVar30 + 0x4a) | 0x800000; } - lVar13 = IkeInitializeMMSAResponder((longlong)ppppUVar27,local_1d0,p_Var30,param_4); - local_170 = lVar13; - if (lVar13 == 0) { - uVar34 = 0x1c; + lVar14 = IkeInitializeMMSAResponder((longlong)ppppUVar30,&local_1bc,p_Var33,param_4); + plVar7 = local_1d0; + local_1d8 = lVar14; + if (lVar14 == 0) { + uVar36 = 0x1c; if (pUVar2[0x12] == '\x02') { - local_1c0 = 0; - uStack_1b8 = 0; - cVar7 = *(char *)(*plVar35 + 0x10); - local_1d8 = 0; - local_1b0 = 0; - uStack_1a8 = 0; - local_1a0 = lVar13; - TraceLogHelper("IkeIsVendorIdPresent",1,p_Var30,param_4); + local_1b8 = 0; + uStack_1b0 = 0; + local_1a8 = 0; + uStack_1a0 = 0; + cVar8 = *(char *)(*local_1d0 + 0x10); + local_1c4 = 0; + local_198 = lVar14; + TraceLogHelper("IkeIsVendorIdPresent",1,p_Var33,param_4); local_1e0 = 0xd; - if (*(int *)ppppUVar18 == 2) { + if (*(int *)pp_Var22 == 2) { local_1e0 = 0x2b; } - uVar10 = IkeCopyPacket(&local_1c0,plVar35); - uStack_1b8._0_6_ = CONCAT24(0x1c,(uint)uStack_1b8); - uVar26 = 0x1c; - if (cVar7 == '\0') { + uVar11 = IkeCopyPacket(&local_1b8,plVar7); + uStack_1b0._0_6_ = CONCAT24(0x1c,(uint)uStack_1b0); + uVar29 = 0x1c; + if (cVar8 == '\0') { LAB_3: - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); } else { do { - iVar1 = (int)uVar26; - if (cVar7 == (char)uVar10) { + iVar1 = (int)uVar29; + if (cVar8 == (char)uVar11) { local_218 = 0; - TraceLogHelper("IkeProcessVendor",1,p_Var30,param_4); - p_Var15 = p_Var22; - if ((uint)uStack_1b8 < iVar1 + 4U) { + TraceLogHelper("IkeProcessVendor",1,p_Var33,param_4); + p_Var17 = p_Var25; + if ((uint)uStack_1b0 < iVar1 + 4U) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; - } - } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30, + uVar29 = uStack_1b0 >> 0x20 & 0xffff; + } + } + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33, param_4); - if (lVar13 == 0) { - local_218 = *(undefined4 *)(uVar26 + local_1c0); - } - lVar13 = IkeReturnError(lVar13,"IkeCopyIncomingData",p_Var30,param_4); - if (lVar13 == 0) { - uVar8 = ntohs(local_218._2_2_); - local_218 = CONCAT22(uVar8,(undefined2)local_218); - p_Var15 = p_Var22; - if (uVar8 < 4) { + if (lVar14 == 0) { + local_218 = *(undefined4 *)(uVar29 + local_1b8); + } + lVar14 = IkeReturnError(lVar14,"IkeCopyIncomingData",p_Var33,param_4); + if (lVar14 == 0) { + uVar9 = ntohs(local_218._2_2_); + local_218 = CONCAT22(uVar9,(undefined2)local_218); + p_Var17 = p_Var25; + if (uVar9 < 4) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(4,"IkeVerifyPayloadLen",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; - uVar8 = local_218._2_2_; + uVar29 = uStack_1b0 >> 0x20 & 0xffff; + uVar9 = local_218._2_2_; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyPayloadLen",p_Var30, + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyPayloadLen",p_Var33, param_4); - if (lVar13 == 0) { - p_Var15 = p_Var22; - uVar24 = uVar8; - if ((uint)uStack_1b8 < iVar1 + (uint)uVar8) { + if (lVar14 == 0) { + p_Var17 = p_Var25; + uVar27 = uVar9; + if ((uint)uStack_1b0 < iVar1 + (uint)uVar9) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError (0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; - uVar24 = local_218._2_2_; + uVar29 = uStack_1b0 >> 0x20 & 0xffff; + uVar27 = local_218._2_2_; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize", - p_Var30,param_4); - if (lVar13 == 0) { - sVar23 = (short)uVar26; - p_Var30 = (_LIST_ENTRY *)0x1; - param_4 = (_LIST_ENTRY **)0x0; - lVar13 = IkeLookupVendorId((longlong *)(uVar26 + local_1c0 + 4),uVar8 - 4, - (wchar_t *)0x1,0,(int *)&local_1d8,local_1f0); - if (lVar13 == 0) { - uVar24 = sVar23 + uVar24; - uVar26 = (ulonglong)uVar24; - uStack_1b8._0_6_ = CONCAT24(uVar24,(uint)uStack_1b8); - uStack_1b8 = CONCAT26(sVar23,(undefined6)uStack_1b8); + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize", + p_Var33,param_4); + if (lVar14 == 0) { + sVar26 = (short)uVar29; + p_Var33 = (_LIST_ENTRY *)0x1; + param_4 = local_200; + lVar14 = IkeLookupVendorId((longlong *)(uVar29 + local_1b8 + 4),uVar9 - 4, + (wchar_t *)0x1,(int *)local_200, + (int *)&local_1c4,local_1f0); + if (lVar14 == 0) { + uVar27 = sVar26 + uVar27; + uVar29 = (ulonglong)uVar27; + uStack_1b0._0_6_ = CONCAT24(uVar27,(uint)uStack_1b0); + uStack_1b0 = CONCAT26(sVar26,(undefined6)uStack_1b0); } } } } - TraceLogHelper("IkeProcessVendor",0,p_Var30,param_4); - lVar13 = IkeReturnError(lVar13,"IkeProcessVendor",p_Var30,param_4); - if (lVar13 != 0) break; - if ((local_1d8 & 0x40) != 0) { - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); - p_Var30 = (_LIST_ENTRY *)0x0; - uVar16 = IkeIsKeyModEnabledForTraffic + TraceLogHelper("IkeProcessVendor",0,p_Var33,param_4); + lVar14 = IkeReturnError(lVar14,"IkeProcessVendor",p_Var33,param_4); + if (lVar14 != 0) break; + if ((local_1c4 & 0x40) != 0) { + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); + p_Var33 = (_LIST_ENTRY *)0x0; + uVar19 = IkeIsKeyModEnabledForTraffic (1,(byte *)local_210,(longlong **)0x0,param_4); - ppppUVar27 = local_220; - if ((int)uVar16 == 0) goto LAB_4; - pp_Var19 = (_LIST_ENTRY **)&WPP_GLOBAL_Control; + ppppUVar30 = local_220; + if ((int)uVar19 == 0) goto LAB_4; + pp_Var22 = (_LIST_ENTRY **)&WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar32 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar35 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (_LIST_ENTRY **)IkeGetTlsMmLuid(); - pp_Var19 = (_LIST_ENTRY **)WPP_GLOBAL_Control[2]; - WPP_SF_iS(pp_Var19,0x13,&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids, - param_4,pwVar32); + pp_Var22 = (_LIST_ENTRY **)WPP_GLOBAL_Control[2]; + WPP_SF_iS(pp_Var22,0x13,&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids, + param_4,pwVar35); } if (4 < DAT_0) { - pp_Var19 = (_LIST_ENTRY **)&DAT_0; - cVar7 = _tlgKeywordOn(0x180164278,0); - if (cVar7 != '\0') { - local_1c8 = (PUCHAR ***)IkeGetTlsMmLuid(); - local_88 = &local_1c8; + pp_Var22 = (_LIST_ENTRY **)&DAT_0; + cVar8 = _tlgKeywordOn(0x180165278,0); + if (cVar8 != '\0') { + local_1d0 = (longlong *)IkeGetTlsMmLuid(); + local_88 = &local_1d0; local_80 = 8; - pwVar32 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_78,pwVar32); + pwVar35 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_78,pwVar35); _tlgCreate1Sz_char(local_68, "Dropping IKE packet because co-existence is active and Authip is enabled" ); - pp_Var19 = (_LIST_ENTRY **)&DAT_0; + pp_Var22 = (_LIST_ENTRY **)&DAT_0; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_5,local_a8,param_4,5, + (0x180165278,&DAT_5,local_a8,param_4,5, (undefined8 *)local_a8); } } if (p_Stack_1e8 != (_LIST_ENTRY *)0x0) { - pp_Var19 = &p_Stack_1e8; - WfpMemFree(pp_Var19); + pp_Var22 = &p_Stack_1e8; + WfpMemFree(pp_Var22); } goto LAB_6; } - p_Var30 = p_Stack_1e8; + p_Var33 = p_Stack_1e8; if (p_Stack_1e8 != (_LIST_ENTRY *)0x0) { if (gWfpTrackHeapBytes != 0) { - SVar14 = HeapSize(gWfpHeap,0,p_Stack_1e8); + SVar15 = HeapSize(gWfpHeap,0,p_Stack_1e8); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar14; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar15; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; - } - p_Var30 = p_Stack_1e8; + uVar29 = uStack_1b0 >> 0x20 & 0xffff; + } + p_Var33 = p_Stack_1e8; HeapFree(gWfpHeap,0,p_Stack_1e8); p_Stack_1e8 = (_LIST_ENTRY *)0x0; } } else { - p_Var15 = p_Var22; - if ((uint)uStack_1b8 < iVar1 + 4U) { + p_Var17 = p_Var25; + if ((uint)uStack_1b0 < iVar1 + 4U) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; - } - } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30, + uVar29 = uStack_1b0 >> 0x20 & 0xffff; + } + } + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33, param_4); - if (lVar13 == 0) { - local_208 = *(uint *)(uVar26 + local_1c0); - } - lVar13 = IkeReturnError(lVar13,"IkeCopyIncomingData",p_Var30,param_4); - if (lVar13 == 0) { - uVar8 = ntohs(local_208._2_2_); - uStack_1b8 = CONCAT26((short)uVar26,(undefined6)uStack_1b8); - local_208 = CONCAT22(uVar8,(undefined2)local_208); - p_Var30 = p_Var22; - if (uVar8 < 4) { + if (lVar14 == 0) { + local_208 = *(uint *)(uVar29 + local_1b8); + } + lVar14 = IkeReturnError(lVar14,"IkeCopyIncomingData",p_Var33,param_4); + if (lVar14 == 0) { + uVar9 = ntohs(local_208._2_2_); + uStack_1b0 = CONCAT26((short)uVar29,(undefined6)uStack_1b0); + local_208 = CONCAT22(uVar9,(undefined2)local_208); + p_Var33 = p_Var25; + if (uVar9 < 4) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(4,"IkeVerifyPayloadLen",0x3613,1); - if (p_Var30 != (_LIST_ENTRY *)0x0) { + if (p_Var33 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; + uVar29 = uStack_1b0 >> 0x20 & 0xffff; } } - lVar13 = IkeReturnError((longlong)p_Var30,"IkeVerifyPayloadLen",p_Var30, + lVar14 = IkeReturnError((longlong)p_Var33,"IkeVerifyPayloadLen",p_Var33, param_4); - if (lVar13 == 0) { - p_Var15 = p_Var22; - if ((uint)uStack_1b8 < (local_208 >> 0x10) + iVar1) { + if (lVar14 == 0) { + p_Var17 = p_Var25; + if ((uint)uStack_1b0 < (local_208 >> 0x10) + iVar1) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError (0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar26 = uStack_1b8 >> 0x20 & 0xffff; + uVar29 = uStack_1b0 >> 0x20 & 0xffff; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize", - p_Var30,param_4); - if (lVar13 == 0) { - uVar24 = (short)uVar26 + local_208._2_2_; - uVar26 = (ulonglong)uVar24; - uStack_1b8._0_6_ = CONCAT24(uVar24,(uint)uStack_1b8); + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize", + p_Var33,param_4); + if (lVar14 == 0) { + uVar27 = (short)uVar29 + local_208._2_2_; + uVar29 = (ulonglong)uVar27; + uStack_1b0._0_6_ = CONCAT24(uVar27,(uint)uStack_1b0); } } } - lVar13 = IkeReturnError(lVar13,"IkeProcessGenericPayload",p_Var30,param_4); - ppppUVar27 = local_220; - if (lVar13 != 0) goto LAB_3; - } - cVar7 = *(char *)((uStack_1b8 >> 0x30) + local_1c0); - uVar10 = local_1e0; - } while (cVar7 != '\0'); - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); - ppppUVar27 = local_220; + lVar14 = IkeReturnError(lVar14,"IkeProcessGenericPayload",p_Var33,param_4); + ppppUVar30 = local_220; + if (lVar14 != 0) goto LAB_3; + } + cVar8 = *(char *)((uStack_1b0 >> 0x30) + local_1b8); + uVar11 = local_1e0; + } while (cVar8 != '\0'); + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); + ppppUVar30 = local_220; } } LAB_4: - plVar35 = local_1f8; - local_178 = 0; - local_198 = 0; - uStack_190 = 0; - local_188 = 0; - uStack_180 = 0; - cVar7 = *(char *)(*local_1f8 + 0x10); - local_1d4 = 0; - TraceLogHelper("IkeIsVendorIdPresent",1,p_Var30,param_4); + lVar14 = local_1d8; + local_170 = 0; + local_190 = 0; + uStack_188 = 0; + local_180 = 0; + uStack_178 = 0; + cVar8 = *(char *)(*local_1d0 + 0x10); + local_1c0 = 0; + TraceLogHelper("IkeIsVendorIdPresent",1,p_Var33,param_4); + pp_Var22 = local_200; local_1e0 = 0xd; - if (*(int *)local_1c8 == 2) { + if (*(int *)local_200 == 2) { local_1e0 = 0x2b; } - uVar10 = IkeCopyPacket(&local_198,plVar35); - uStack_190._0_6_ = CONCAT24(0x1c,(uint)uStack_190); - if (cVar7 != '\0') { + uVar11 = IkeCopyPacket(&local_190,local_1d0); + uStack_188._0_6_ = CONCAT24(0x1c,(uint)uStack_188); + if (cVar8 != '\0') { LAB_7: - iVar1 = (int)uVar34; - if (cVar7 != (char)uVar10) { - p_Var15 = p_Var22; - if ((uint)uStack_190 < iVar1 + 4U) { + iVar1 = (int)uVar36; + if (cVar8 != (char)uVar11) { + p_Var17 = p_Var25; + if ((uint)uStack_188 < iVar1 + 4U) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; + uVar36 = uStack_188 >> 0x20 & 0xffff; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30, + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33, param_4); - if (lVar13 == 0) { - local_204 = *(uint *)(uVar34 + local_198); + if (lVar14 == 0) { + local_204 = *(uint *)(uVar36 + local_190); } - lVar13 = IkeReturnError(lVar13,"IkeCopyIncomingData",p_Var30,param_4); - if (lVar13 == 0) { - uVar8 = ntohs(local_204._2_2_); - uStack_190 = CONCAT26((short)uVar34,(undefined6)uStack_190); - local_204 = CONCAT22(uVar8,(undefined2)local_204); - p_Var30 = p_Var22; - if (uVar8 < 4) { + lVar14 = IkeReturnError(lVar14,"IkeCopyIncomingData",p_Var33,param_4); + if (lVar14 == 0) { + uVar9 = ntohs(local_204._2_2_); + uStack_188 = CONCAT26((short)uVar36,(undefined6)uStack_188); + local_204 = CONCAT22(uVar9,(undefined2)local_204); + p_Var33 = p_Var25; + if (uVar9 < 4) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(4,"IkeVerifyPayloadLen",0x3613,1); - if (p_Var30 != (_LIST_ENTRY *)0x0) { + if (p_Var33 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; - } - } - lVar13 = IkeReturnError((longlong)p_Var30,"IkeVerifyPayloadLen",p_Var30,param_4); - if (lVar13 == 0) { - p_Var15 = p_Var22; - if ((uint)uStack_190 < (local_204 >> 0x10) + iVar1) { + uVar36 = uStack_188 >> 0x20 & 0xffff; + } + } + lVar14 = IkeReturnError((longlong)p_Var33,"IkeVerifyPayloadLen",p_Var33,param_4); + if (lVar14 == 0) { + p_Var17 = p_Var25; + if ((uint)uStack_188 < (local_204 >> 0x10) + iVar1) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; - } - } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30, + uVar36 = uStack_188 >> 0x20 & 0xffff; + } + } + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33, param_4); - if (lVar13 == 0) { - uVar24 = (short)uVar34 + local_204._2_2_; - uVar34 = (ulonglong)uVar24; - uStack_190._0_6_ = CONCAT24(uVar24,(uint)uStack_190); + if (lVar14 == 0) { + uVar27 = (short)uVar36 + local_204._2_2_; + uVar36 = (ulonglong)uVar27; + uStack_188._0_6_ = CONCAT24(uVar27,(uint)uStack_188); } } } - lVar13 = IkeReturnError(lVar13,"IkeProcessGenericPayload",p_Var30,param_4); - ppppUVar27 = local_220; - plVar35 = local_1f8; - if (lVar13 == 0) goto LAB_8; + lVar18 = IkeReturnError(lVar14,"IkeProcessGenericPayload",p_Var33,param_4); + ppppUVar30 = local_220; + lVar14 = local_1d8; + if (lVar18 == 0) goto LAB_8; goto LAB_9; } local_228._2_2_ = 0; - TraceLogHelper("IkeProcessVendor",1,p_Var30,param_4); - p_Var15 = p_Var22; - if ((uint)uStack_190 < iVar1 + 4U) { + TraceLogHelper("IkeProcessVendor",1,p_Var33,param_4); + p_Var17 = p_Var25; + if ((uint)uStack_188 < iVar1 + 4U) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; + uVar36 = uStack_188 >> 0x20 & 0xffff; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30,param_4) + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33,param_4) ; - if (lVar13 == 0) { - local_228._2_2_ = (u_short)((uint)*(undefined4 *)(uVar34 + local_198) >> 0x10); - } - lVar13 = IkeReturnError(lVar13,"IkeCopyIncomingData",p_Var30,param_4); - if (lVar13 == 0) { - uVar8 = ntohs(local_228._2_2_); - p_Var15 = p_Var22; - if (uVar8 < 4) { + if (lVar14 == 0) { + local_228._2_2_ = (u_short)((uint)*(undefined4 *)(uVar36 + local_190) >> 0x10); + } + lVar14 = IkeReturnError(lVar14,"IkeCopyIncomingData",p_Var33,param_4); + pp_Var22 = local_200; + if (lVar14 == 0) { + uVar9 = ntohs(local_228._2_2_); + p_Var17 = p_Var25; + if (uVar9 < 4) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(4,"IkeVerifyPayloadLen",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; + uVar36 = uStack_188 >> 0x20 & 0xffff; } } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyPayloadLen",p_Var30,param_4); - if (lVar13 == 0) { - p_Var15 = p_Var22; - if ((uint)uStack_190 < iVar1 + (uint)uVar8) { + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyPayloadLen",p_Var33,param_4); + pp_Var22 = local_200; + if (lVar14 == 0) { + p_Var17 = p_Var25; + if ((uint)uStack_188 < iVar1 + (uint)uVar9) { param_4 = (_LIST_ENTRY **)0x1; - p_Var30 = (_LIST_ENTRY *)0x3613; - p_Var15 = (_LIST_ENTRY *) + p_Var33 = (_LIST_ENTRY *)0x3613; + p_Var17 = (_LIST_ENTRY *) WfpReportSysErrorAsWinError(0,"IkeVerifyIncomingDataSize",0x3613,1); - if (p_Var15 != (_LIST_ENTRY *)0x0) { + if (p_Var17 != (_LIST_ENTRY *)0x0) { LOCK(); *(int *)&gIkeExtGlobals[0x30].SpinCount = (int)gIkeExtGlobals[0x30].SpinCount + 1; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; - } - } - lVar13 = IkeReturnError((longlong)p_Var15,"IkeVerifyIncomingDataSize",p_Var30, + uVar36 = uStack_188 >> 0x20 & 0xffff; + } + } + lVar14 = IkeReturnError((longlong)p_Var17,"IkeVerifyIncomingDataSize",p_Var33, param_4); - if (lVar13 == 0) { - sVar23 = (short)uVar34; - param_4 = (_LIST_ENTRY **)0x0; - p_Var30 = (_LIST_ENTRY *)0x1; - lVar13 = IkeLookupVendorId((longlong *)(uVar34 + local_198 + 4),uVar8 - 4, - (wchar_t *)0x1,0,(int *)&local_1d4,local_1f0); - if (lVar13 == 0) { - uVar24 = sVar23 + uVar8; - uVar34 = (ulonglong)uVar24; - uStack_190._0_6_ = CONCAT24(uVar24,(uint)uStack_190); - uStack_190 = CONCAT26(sVar23,(undefined6)uStack_190); + pp_Var22 = local_200; + if (lVar14 == 0) { + sVar26 = (short)uVar36; + p_Var33 = (_LIST_ENTRY *)0x1; + param_4 = local_200; + lVar14 = IkeLookupVendorId((longlong *)(uVar36 + local_190 + 4),uVar9 - 4, + (wchar_t *)0x1,(int *)local_200,(int *)&local_1c0, + local_1f0); + if (lVar14 == 0) { + uVar27 = sVar26 + uVar9; + uVar36 = (ulonglong)uVar27; + uStack_188._0_6_ = CONCAT24(uVar27,(uint)uStack_188); + uStack_188 = CONCAT26(sVar26,(undefined6)uStack_188); } } } } - TraceLogHelper("IkeProcessVendor",0,p_Var30,param_4); - lVar13 = IkeReturnError(lVar13,"IkeProcessVendor",p_Var30,param_4); - if (lVar13 == 0) { - if ((local_1d4 & 0x400) == 0) { - p_Var30 = p_Stack_1e8; + TraceLogHelper("IkeProcessVendor",0,p_Var33,param_4); + lVar14 = IkeReturnError(lVar14,"IkeProcessVendor",p_Var33,param_4); + if (lVar14 == 0) { + if ((local_1c0 & 0x400) == 0) { + p_Var33 = p_Stack_1e8; if (p_Stack_1e8 != (_LIST_ENTRY *)0x0) { if (gWfpTrackHeapBytes != 0) { - SVar14 = HeapSize(gWfpHeap,0,p_Stack_1e8); + SVar15 = HeapSize(gWfpHeap,0,p_Stack_1e8); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar14; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar15; UNLOCK(); - uVar34 = uStack_190 >> 0x20 & 0xffff; - } - p_Var30 = p_Stack_1e8; + uVar36 = uStack_188 >> 0x20 & 0xffff; + } + p_Var33 = p_Stack_1e8; HeapFree(gWfpHeap,0,p_Stack_1e8); p_Stack_1e8 = (_LIST_ENTRY *)0x0; } goto LAB_8; } - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); - uVar9 = *(uint *)&p_Stack_1e8->Flink; - TraceLogHelper("IkeCheckKeyModuleCoexistencePolicy",1,p_Var30,param_4); - p_Var22 = local_210; + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); + uVar10 = *(uint *)&p_Stack_1e8->Flink; + TraceLogHelper("IkeCheckKeyModuleCoexistencePolicy",1,p_Var33,param_4); + p_Var25 = local_210; + bVar4 = bVar5; if (iVar6 != 1) { if (iVar6 == 2) { - if ((uVar9 & 4) != 0) { - p_Var30 = (_LIST_ENTRY *)0x0; - uVar16 = IkeIsKeyModEnabledForTraffic + if ((uVar10 & 4) != 0) { + p_Var33 = (_LIST_ENTRY *)0x0; + uVar19 = IkeIsKeyModEnabledForTraffic (1,(byte *)local_210,(longlong **)0x0,param_4); - if ((int)uVar16 != 0) { - bVar5 = true; + if ((int)uVar19 != 0) { + bVar4 = true; } } } else if (iVar6 == 0) { - if ((uVar9 & 4) != 0) { - p_Var30 = (_LIST_ENTRY *)0x0; - uVar16 = IkeIsKeyModEnabledForTraffic + if ((uVar10 & 4) != 0) { + p_Var33 = (_LIST_ENTRY *)0x0; + uVar19 = IkeIsKeyModEnabledForTraffic (1,(byte *)local_210,(longlong **)0x0,param_4); - if ((int)uVar16 != 0) { - bVar5 = true; - goto LAB_10; - } - } - if ((uVar9 & 2) != 0) { - p_Var30 = (_LIST_ENTRY *)0x0; - uVar16 = IkeIsKeyModEnabledForTraffic - (2,(byte *)p_Var22,(longlong **)0x0,param_4); - bVar5 = false; - if ((int)uVar16 != 0) { - bVar5 = true; + bVar4 = true; + if ((int)uVar19 != 0) goto LAB_10; + } + bVar4 = bVar5; + if ((uVar10 & 2) != 0) { + p_Var33 = (_LIST_ENTRY *)0x0; + uVar19 = IkeIsKeyModEnabledForTraffic + (2,(byte *)p_Var25,(longlong **)0x0,param_4); + bVar4 = false; + if ((int)uVar19 != 0) { + bVar4 = true; } } } } LAB_10: - TraceLogHelper("IkeCheckKeyModuleCoexistencePolicy",0,p_Var30,param_4); - lVar13 = IkeReturnError(0,"IkeCheckKeyModuleCoexistencePolicy",p_Var30,param_4); - ppppUVar27 = local_220; - if (lVar13 != 0) goto LAB_11; - plVar35 = local_1f8; - if (bVar5) { - pp_Var19 = (_LIST_ENTRY **)&WPP_GLOBAL_Control; + TraceLogHelper("IkeCheckKeyModuleCoexistencePolicy",0,p_Var33,param_4); + lVar14 = IkeReturnError(0,"IkeCheckKeyModuleCoexistencePolicy",p_Var33,param_4); + ppppUVar30 = local_220; + if (lVar14 != 0) goto LAB_11; + if (bVar4) { + pp_Var22 = (_LIST_ENTRY **)&WPP_GLOBAL_Control; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - pwVar32 = (wchar_t *)IkeGetTlsPeerAddr(); + pwVar35 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = (_LIST_ENTRY **)IkeGetTlsMmLuid(); - p_Var30 = (_LIST_ENTRY *)&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids; - pp_Var19 = (_LIST_ENTRY **)WPP_GLOBAL_Control[2]; - WPP_SF_iSD(pp_Var19,0x14,&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids, - param_4,pwVar32); + p_Var33 = (_LIST_ENTRY *)&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids; + pp_Var22 = (_LIST_ENTRY **)WPP_GLOBAL_Control[2]; + WPP_SF_iSD(pp_Var22,0x14,&WPP_e49e67839dae32528cd44ba3efc2ddc1_Traceguids, + param_4,pwVar35); } if (4 < DAT_0) { - pp_Var19 = (_LIST_ENTRY **)&DAT_0; - cVar7 = _tlgKeywordOn(0x180164278,0); - if (cVar7 != '\0') { - local_1f8 = (longlong *)IkeGetTlsMmLuid(); - local_138 = &local_1f8; + pp_Var22 = (_LIST_ENTRY **)&DAT_0; + cVar8 = _tlgKeywordOn(0x180165278,0); + if (cVar8 != '\0') { + local_200 = (_LIST_ENTRY **)IkeGetTlsMmLuid(); + local_138 = &local_200; local_130 = 8; - pwVar32 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_128,pwVar32); + pwVar35 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_128,pwVar35); _tlgCreate1Sz_char(local_118,"Aborting negotiation for coexistenceAbort"); local_108 = &local_210; - local_210 = (_LIST_ENTRY *)CONCAT44(local_210._4_4_,uVar9); + local_210 = (_LIST_ENTRY *)CONCAT44(local_210._4_4_,uVar10); local_100 = 4; - pp_Var19 = (_LIST_ENTRY **)&DAT_0; + pp_Var22 = (_LIST_ENTRY **)&DAT_0; _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,&DAT_12,p_Var30,param_4,6,local_158); + (0x180165278,&DAT_12,p_Var33,param_4,6,local_158); } } if (p_Stack_1e8 != (_LIST_ENTRY *)0x0) { - pp_Var19 = &p_Stack_1e8; - WfpMemFree(pp_Var19); + pp_Var22 = &p_Stack_1e8; + WfpMemFree(pp_Var22); p_Stack_1e8 = (_LIST_ENTRY *)0x0; } LAB_6: - ppppUVar27 = local_220; + ppppUVar30 = local_220; param_4 = (_LIST_ENTRY **)0x1; *(uint *)(local_220 + 0x4a) = *(uint *)(local_220 + 0x4a) | 0x800; - lVar13 = WfpReportSysErrorAsWinError(pp_Var19,"IkeInitMMResponderPhase1",0x35ec,1) + lVar14 = WfpReportSysErrorAsWinError(pp_Var22,"IkeInitMMResponderPhase1",0x35ec,1) ; goto LAB_2; } goto LAB_13; } goto LAB_14; } LAB_9: - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); - lVar13 = local_170; + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); goto LAB_13; } } else { LeaveCriticalSection(gIkeExtGlobals); } } } } LAB_11: - if (ppppUVar27 != (PUCHAR ***)0x0) { - if (*(int *)(ppppUVar27 + 0x49) == 2) { - uVar21 = 0x100; - } - uVar11 = WfpErrorToWindowsError((uint)lVar13); - uVar9 = uVar21 | 2; - if (uVar11 == 0x364f) { - uVar9 = uVar21; - } - puVar31 = (undefined *)(ulonglong)uVar9; + if (ppppUVar30 != (PUCHAR ***)0x0) { + if (*(int *)(ppppUVar30 + 0x49) == 2) { + uVar24 = 0x100; + } + uVar12 = WfpErrorToWindowsError((uint)lVar14); + uVar10 = uVar24 | 2; + if (uVar12 == 0x364f) { + uVar10 = uVar24; + } + puVar34 = (undefined *)(ulonglong)uVar10; param_4 = (_LIST_ENTRY **)0x0; - IkeTerminateMMWithoutLock(ppppUVar27,lVar13,uVar9,0); - if (local_1d0[0] != 0) { - IkeDerefMMSA((longlong)ppppUVar27,0,puVar31,param_4); + IkeTerminateMMWithoutLock(ppppUVar30,lVar14,uVar10,0); + if (local_1bc != 0) { + IkeDerefMMSA((longlong)ppppUVar30,0,puVar34,param_4); } } LAB_15: - p_Var22 = p_Stack_1e8; + p_Var25 = p_Stack_1e8; if (p_Stack_1e8 != (_LIST_ENTRY *)0x0) { if (gWfpTrackHeapBytes != 0) { - SVar14 = HeapSize(gWfpHeap,0,p_Stack_1e8); + SVar15 = HeapSize(gWfpHeap,0,p_Stack_1e8); LOCK(); - gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar14; + gWfpHeapBytesAllocated = gWfpHeapBytesAllocated - (int)SVar15; UNLOCK(); } - p_Var22 = p_Stack_1e8; + p_Var25 = p_Stack_1e8; HeapFree(gWfpHeap,0,p_Stack_1e8); p_Stack_1e8 = (_LIST_ENTRY *)0xbadbadfabadbadfa; } - TraceLogHelper("IkeInitMMResponderPhase1",0,p_Var22,param_4); - IkeReturnError(lVar13,"IkeInitMMResponderPhase1",p_Var22,param_4); + TraceLogHelper("IkeInitMMResponderPhase1",0,p_Var25,param_4); + IkeReturnError(lVar14,"IkeInitMMResponderPhase1",p_Var25,param_4); return; LAB_8: - cVar7 = *(char *)((uStack_190 >> 0x30) + local_198); - uVar10 = local_1e0; - if (cVar7 == '\0') goto LAB_14; + cVar8 = *(char *)((uStack_188 >> 0x30) + local_190); + uVar11 = local_1e0; + if (cVar8 == '\0') goto LAB_14; goto LAB_7; LAB_14: - TraceLogHelper("IkeIsVendorIdPresent",0,p_Var30,param_4); - ppppUVar27 = local_220; - lVar13 = local_170; - plVar35 = local_1f8; + TraceLogHelper("IkeIsVendorIdPresent",0,p_Var33,param_4); + ppppUVar30 = local_220; + lVar14 = local_1d8; LAB_13: - if ((*(int *)local_1c8 != 2) || - (lVar13 = IkeHandleSecurityRealmVendorId((longlong)ppppUVar27,0,plVar35,param_4), lVar13 == 0)) - { - *local_160 = ppppUVar27; + if ((*(int *)pp_Var22 != 2) || + (lVar14 = IkeHandleSecurityRealmVendorId((longlong)ppppUVar30,0,local_1d0,param_4), lVar14 == 0 + )) { + *local_160 = ppppUVar30; LAB_2: - if (lVar13 == 0) goto LAB_15; + if (lVar14 == 0) goto LAB_15; } goto LAB_11; } ``` ## IkeIsVendorIdPresent ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.73| |i_ratio|0.48| |m_ratio|0.98| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeIsVendorIdPresent|IkeIsVendorIdPresent| |fullname|IkeIsVendorIdPresent|IkeIsVendorIdPresent| |refcount|3|3| |`length`|277|265| |called|IkeCopyPacket
IkeProcessGenericPayload
IkeProcessVendor
TraceLogHelper
WfpMemFree|IkeCopyPacket
IkeProcessGenericPayload
IkeProcessVendor
TraceLogHelper
WfpMemFree| |calling|IkeHandleMMPacketXboxIkeNegoType
IkeHandleSecurityRealmVendorId|IkeHandleMMPacketXboxIkeNegoType
IkeHandleSecurityRealmVendorId| |paramcount|4|4| |`address`|1800408e8|180040be0| |`sig`|undefined8 __fastcall IkeIsVendorIdPresent(longlong * param_1, int * param_2, ulonglong param_3, uint * param_4)|undefined8 __fastcall IkeIsVendorIdPresent(longlong * param_1, int * param_2, int * param_3, uint * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeIsVendorIdPresent Diff ```diff --- IkeIsVendorIdPresent +++ IkeIsVendorIdPresent @@ -1,67 +1,67 @@ -undefined8 IkeIsVendorIdPresent(longlong *param_1,int *param_2,ulonglong param_3,uint *param_4) +undefined8 IkeIsVendorIdPresent(longlong *param_1,int *param_2,int *param_3,uint *param_4) { uint *puVar1; char cVar2; - char cVar3; - longlong lVar4; + longlong lVar3; + char cVar4; undefined8 uVar5; - ulonglong uVar6; + int *piVar6; uint *puVar7; uint local_res8 [2]; longlong local_58; undefined8 uStack_50; undefined8 local_48; undefined8 uStack_40; undefined8 local_38; local_38 = 0; local_res8[0] = 0; - cVar2 = *(char *)(*param_1 + 0x10); + cVar4 = *(char *)(*param_1 + 0x10); local_58 = 0; uStack_50 = 0; local_48 = 0; uStack_40 = 0; - uVar6 = param_3; + piVar6 = param_3; puVar7 = param_4; TraceLogHelper("IkeIsVendorIdPresent",1,param_3,param_4); - cVar3 = '+'; + cVar2 = '+'; if (*param_2 != 2) { - cVar3 = '\r'; + cVar2 = '\r'; } IkeCopyPacket(&local_58,param_1); uStack_50._0_6_ = CONCAT24(0x1c,(undefined4)uStack_50); do { uVar5 = 0; - if (cVar2 == '\0') { + if (cVar4 == '\0') { LAB_0: - TraceLogHelper("IkeIsVendorIdPresent",0,uVar6,puVar7); + TraceLogHelper("IkeIsVendorIdPresent",0,piVar6,puVar7); return uVar5; } - if (cVar2 == cVar3) { + if (cVar4 == cVar2) { + param_1 = (longlong *)0x1; puVar7 = local_res8; - param_1 = (longlong *)0x1; - uVar6 = (ulonglong)((uint)param_3 == 0x1000); - lVar4 = IkeProcessVendor(&local_58,1,uVar6,(int *)puVar7,param_4); - if (lVar4 != 0) goto LAB_0; + piVar6 = param_2; + lVar3 = IkeProcessVendor(&local_58,1,param_2,(int *)puVar7,param_4); + if (lVar3 != 0) goto LAB_0; if ((local_res8[0] & (uint)param_3) != 0) { uVar5 = 1; goto LAB_0; } puVar1 = param_4 + 2; if (*(longlong *)puVar1 != 0) { WfpMemFree((undefined8 *)puVar1); puVar1[0] = 0; puVar1[1] = 0; } } else { - lVar4 = IkeProcessGenericPayload(&local_58,param_1,uVar6,puVar7); + lVar3 = IkeProcessGenericPayload(&local_58,param_1,piVar6,puVar7); uVar5 = 0; - if (lVar4 != 0) goto LAB_0; + if (lVar3 != 0) goto LAB_0; } - cVar2 = *(char *)((uStack_50 >> 0x30) + local_58); + cVar4 = *(char *)((uStack_50 >> 0x30) + local_58); } while( true ); } ``` ## WPP_SF_iSsdd ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,refcount,length,sig,address| |ratio|0.95| |i_ratio|0.36| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WPP_SF_iSsdd|WPP_SF_iSsdd| |fullname|WPP_SF_iSsdd|WPP_SF_iSsdd| |`refcount`|2|3| |`length`|254|250| |called|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |calling|IkeLookupVendorId|IkeLookupVendorId| |paramcount|6|6| |`address`|18004a578|18004a868| |`sig`|undefined __fastcall WPP_SF_iSsdd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5, char * param_6)|undefined __fastcall WPP_SF_iSsdd(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5, char * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iSsdd Diff ```diff --- WPP_SF_iSsdd +++ WPP_SF_iSsdd @@ -1,43 +1,43 @@ -void WPP_SF_iSsdd(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, +void WPP_SF_iSsdd(undefined8 param_1,undefined2 param_2,undefined8 param_3,undefined8 param_4, wchar_t *param_5,char *param_6) { longlong lVar1; longlong lVar2; longlong lVar3; undefined8 local_res20; lVar3 = -1; if (param_6 == (char *)0x0) { lVar2 = 5; } else { lVar1 = -1; do { lVar2 = lVar1; lVar1 = lVar2 + 1; } while (param_6[lVar1] != '\0'); lVar2 = lVar2 + 2; } if (param_6 == (char *)0x0) { param_6 = "NULL"; } if (param_5 == (wchar_t *)0x0) { lVar3 = 10; } else { do { lVar3 = lVar3 + 1; } while (param_5[lVar3] != L'\0'); lVar3 = lVar3 * 2 + 2; } if (param_5 == (wchar_t *)0x0) { param_5 = L"NULL"; } local_res20 = param_4; - EtwTraceMessage(param_1,0x2b,&WPP_e49668c0bb823535483f207c5a805ae0_Traceguids,0xc,&local_res20,8, - param_5,lVar3,param_6,lVar2,&stack0x00000038,4,&stack0x00000040,4,0); + EtwTraceMessage(param_1,0x2b,&WPP_38847be305d63a5f54a05560330ecd2f_Traceguids,param_2,&local_res20 + ,8,param_5,lVar3,param_6,lVar2,&stack0x00000038,4,&stack0x00000040,4,0); return; } ``` ## IkeAddrDump ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|code,length,sig,address| |ratio|0.5| |i_ratio|0.73| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeAddrDump|IkeAddrDump| |fullname|IkeAddrDump|IkeAddrDump| |refcount|30|30| |`length`|1539|1574| |called|
Expand for full list:
IkeAddrGetAddrString
IkeAddrGetAddrStringHigh
IkeAddrGetMaskString
IkeAddrGetPort
IkeAddrGetPortHigh
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
WPP_SF_iSsSdSd
WPP_SF_iSsSdSddWPP_SF_iSsSdd
WS2_32.DLL::ntohl
WS2_32.DLL::ntohs
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memset
|
Expand for full list:
IkeAddrGetAddrString
IkeAddrGetAddrStringHigh
IkeAddrGetMaskString
IkeAddrGetPort
IkeAddrGetPortHigh
IkeGetTlsMmLuid
IkeGetTlsPeerAddr
NTDLL.DLL::RtlIpv4AddressToStringW
NTDLL.DLL::RtlIpv6AddressToStringW
WPP_SF_iSsSdSd
WPP_SF_iSsSdSddWPP_SF_iSsSdd
WS2_32.DLL::ntohl
WS2_32.DLL::ntohs
__security_check_cookie
_tlgCreate1Sz_char
_tlgCreate1Sz_wchar_t
_tlgKeywordOn
_tlgWriteTransfer_EtwEventWriteTransfer
memset
| |calling|
Expand for full list:
DumpTSsIkeV2
IkeAddInboundSA
IkeAddOutboundSA
IkeConstructId
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeFindQMPolicy
IkeGetSpi
IkeOptionalAddTransportFilter
IkePostPayloadProcessQMTS
IkeProcessNotifyPayloadIkeProcessPacketDispatch
IkeSendPacketEx
IkeSendPacketFragment
|
Expand for full list:
DumpTSsIkeV2
IkeAddInboundSA
IkeAddOutboundSA
IkeConstructId
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeFindQMPolicy
IkeGetSpi
IkeOptionalAddTransportFilter
IkePostPayloadProcessQMTS
IkeProcessNotifyPayloadIkeProcessPacketDispatch
IkeSendPacketEx
IkeSendPacketFragment
| |paramcount|4|4| |`address`|18002a670|18002a900| |`sig`|undefined __fastcall IkeAddrDump(char * param_1, byte * param_2, undefined8 param_3, undefined8 param_4)|char __fastcall IkeAddrDump(char * param_1, byte * param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeAddrDump Diff ```diff --- IkeAddrDump +++ IkeAddrDump @@ -1,262 +1,277 @@ -/* WARNING: Control flow encountered bad instruction data */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void IkeAddrDump(char *param_1,byte *param_2,undefined8 param_3,undefined8 param_4) +char IkeAddrDump(char *param_1,byte *param_2,undefined8 param_3,undefined8 param_4) { byte bVar1; code *pcVar2; char cVar3; - u_short uVar4; + char cVar4; u_short uVar5; - u_long uVar6; - wchar_t *pwVar7; - longlong lVar8; - undefined8 uVar9; - wchar_t *pwVar10; - undefined2 *puVar11; - undefined4 *puVar12; - byte *pbVar13; - undefined1 *puVar14; - undefined1 *puVar15; - undefined1 *puVar16; - undefined8 uVar17; + u_short uVar6; + u_long uVar7; + wchar_t *pwVar8; + longlong lVar9; + undefined8 uVar10; + wchar_t *pwVar11; + char *pcVar12; + undefined7 uVar13; + undefined2 *puVar14; + undefined4 *puVar15; + byte *pbVar16; + undefined1 *puVar17; + undefined1 *puVar18; + undefined1 *puVar19; + undefined8 uVar20; undefined8 uStackY_350; undefined1 auStackY_348 [8]; undefined1 auStackY_340 [24]; undefined4 in_stack_fffffffffffffcf4; uint local_300 [6]; undefined4 local_2e8; undefined4 local_2e4; undefined8 local_2e0; uint local_2d8 [2]; undefined8 local_2d0; undefined4 uStack_2c8; undefined4 uStack_2c4; undefined1 local_2b8 [32]; undefined8 *local_298; undefined8 local_290; longlong local_288 [2]; longlong local_278 [2]; longlong local_268 [2]; undefined4 *local_258; undefined8 local_250; undefined4 *local_248; undefined8 local_240; uint *local_238; undefined8 local_230; undefined8 *local_228; undefined8 local_220; wchar_t local_218 [80]; wchar_t local_178 [80]; wchar_t local_d8 [80]; ulonglong local_38; - puVar14 = auStackY_348; - puVar16 = auStackY_348; + puVar17 = auStackY_348; + puVar19 = auStackY_348; local_38 = __security_cookie ^ (ulonglong)auStackY_348; memset(local_218,0,0xa0); memset(local_d8,0,0xa0); - uVar17 = 0xa0; + uVar20 = 0xa0; memset(local_178,0,0xa0); local_2e4 = (uint)local_2e4._2_2_ << 0x10; local_2e8 = (uint)local_2e8._2_2_ << 0x10; - puVar15 = auStackY_348; + puVar18 = auStackY_348; switch(*param_2 - 1) { case 0: case 4: switch(*param_2 - 1) { case 0: case 3: case 6: - uVar6 = ntohl(*(u_long *)(param_2 + 8)); - local_2e8 = uVar6 >> 0x18 | (uVar6 & 0xff0000) >> 8 | (uVar6 & 0xff00) << 8 | uVar6 << 0x18; - pwVar10 = local_218; + uVar7 = ntohl(*(u_long *)(param_2 + 8)); + local_2e8 = uVar7 >> 0x18 | (uVar7 & 0xff0000) >> 8 | (uVar7 & 0xff00) << 8 | uVar7 << 0x18; + pwVar11 = local_218; RtlIpv4AddressToStringW(&local_2e8); break; default: - goto switchD_18002a72c_caseD_1; + goto switchD_18002a9bc_caseD_1; case 4: case 5: case 7: local_2d0 = *(undefined8 *)(param_2 + 0xc); uStack_2c8 = *(undefined4 *)(param_2 + 0x14); uStack_2c4 = *(undefined4 *)(param_2 + 0x18); - pwVar10 = local_218; + pwVar11 = local_218; RtlIpv6AddressToStringW(&local_2d0); } switch(*param_2) { case 1: case 4: case 5: case 6: case 7: case 8: - uVar4 = *(u_short *)(param_2 + 6); + cVar4 = 'p'; + uVar5 = *(u_short *)(param_2 + 6); if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { - ntohs(uVar4); - pwVar7 = (wchar_t *)IkeGetTlsPeerAddr(); + ntohs(uVar5); + pwVar8 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = IkeGetTlsMmLuid(); - WPP_SF_iSsSdd(WPP_GLOBAL_Control[2],pwVar10,uVar17,param_4,pwVar7,param_1,local_218); + cVar4 = WPP_SF_iSsSdd(WPP_GLOBAL_Control[2],pwVar11,uVar20,param_4,pwVar8,param_1,local_218) + ; } - puVar15 = auStackY_348; - if ((DAT_0 < 5) || - (cVar3 = _tlgKeywordOn(0x180164278,0), puVar15 = auStackY_348, cVar3 == '\0')) - goto LAB_1; + puVar18 = auStackY_348; + if (DAT_1 < 5) goto LAB_18002ab74; + cVar3 = _tlgKeywordOn(0x180165278,0); + cVar4 = '\0'; + puVar18 = auStackY_348; + if (cVar3 == '\0') goto LAB_0; local_2e0 = IkeGetTlsMmLuid(); local_298 = &local_2e0; local_290 = 8; - pwVar10 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_288,pwVar10); + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_288,pwVar11); _tlgCreate1Sz_char(local_278,param_1); _tlgCreate1Sz_wchar_t(local_268,local_218); - uVar4 = ntohs(uVar4); + uVar5 = ntohs(uVar5); local_250 = 4; - pbVar13 = &DAT_2; - local_2e8 = (uint)uVar4; + pbVar16 = &DAT_2; + local_2e8 = (uint)uVar5; local_258 = &local_2e8; local_2e4 = (uint)param_2[1]; local_248 = &local_2e4; local_240 = 4; break; default: pcVar2 = (code *)swi(0x29); (*pcVar2)(0x25); - puVar16 = auStackY_340; -switchD_18002a72c_caseD_1: + puVar19 = auStackY_340; +switchD_18002a9bc_caseD_1: pcVar2 = (code *)swi(0x29); (*pcVar2)(0x25); - puVar15 = puVar16 + 8; - goto switchD_18002a710_caseD_3; + puVar18 = puVar19 + 8; + goto switchD_18002a9a0_caseD_3; } break; default: pcVar2 = (code *)swi(0x29); - (*pcVar2)(0x25); - /* WARNING: Bad instruction - Truncating control flow here */ - halt_baddata(); + pcVar12 = (char *)(*pcVar2)(0x25); + uVar13 = (undefined7)((ulonglong)pcVar12 >> 8); + cVar4 = (char)pcVar12 + *pcVar12; + uRamffffffffabae0003 = uRamffffffffabae0003 | (uint)&local_248; + cVar4 = cVar4 + *(char *)CONCAT71(uVar13,cVar4); + cVar4 = cVar4 + *(char *)CONCAT71(uVar13,cVar4); + return cVar4 + *(char *)CONCAT71(uVar13,cVar4); case 3: case 5: -switchD_18002a710_caseD_3: - puVar14 = puVar15; - *(undefined8 *)(puVar14 + -8) = 0x18002a92a; +switchD_18002a9a0_caseD_3: + puVar17 = puVar18; + *(undefined8 *)(puVar17 + -8) = 0x18002abba; IkeAddrGetAddrString((char *)param_2,local_218); - *(undefined8 *)(puVar14 + -8) = 0x18002a939; - IkeAddrGetMaskString((char *)param_2,local_178,(uint)uVar17); - puVar11 = (undefined2 *)(puVar14 + 100); - *(undefined8 *)(puVar14 + -8) = 0x18002a946; - IkeAddrGetPort((longlong)param_2,puVar11); - uVar4 = *(u_short *)(puVar14 + 100); + *(undefined8 *)(puVar17 + -8) = 0x18002abc9; + IkeAddrGetMaskString((char *)param_2,local_178,(uint)uVar20); + puVar14 = (undefined2 *)(puVar17 + 100); + *(undefined8 *)(puVar17 + -8) = 0x18002abd6; + IkeAddrGetPort((longlong)param_2,puVar14); + cVar4 = 'p'; + uVar5 = *(u_short *)(puVar17 + 100); if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { bVar1 = param_2[1]; - *(undefined8 *)(puVar14 + -8) = 0x18002a97b; - uVar5 = ntohs(uVar4); - *(undefined8 *)(puVar14 + -8) = 0x18002a988; - lVar8 = IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar14 + -8) = 0x18002a990; + *(undefined8 *)(puVar17 + -8) = 0x18002ac0b; + uVar6 = ntohs(uVar5); + *(undefined8 *)(puVar17 + -8) = 0x18002ac18; + lVar9 = IkeGetTlsPeerAddr(); + *(undefined8 *)(puVar17 + -8) = 0x18002ac20; param_4 = IkeGetTlsMmLuid(); - *(uint *)(puVar14 + 0x48) = (uint)bVar1; - *(wchar_t **)(puVar14 + 0x40) = local_178; - *(uint *)(puVar14 + 0x38) = (uint)uVar5; - uVar9 = WPP_GLOBAL_Control[2]; - *(wchar_t **)(puVar14 + 0x30) = local_218; - *(char **)(puVar14 + 0x28) = param_1; - *(longlong *)(puVar14 + 0x20) = lVar8; - *(undefined8 *)(puVar14 + -8) = 0x18002a9ca; - WPP_SF_iSsSdSd(uVar9,puVar11,uVar17,param_4,*(wchar_t **)(puVar14 + 0x20), - *(char **)(puVar14 + 0x28),*(wchar_t **)(puVar14 + 0x30), - *(undefined8 *)(puVar14 + 0x38),*(wchar_t **)(puVar14 + 0x40)); - } - puVar15 = puVar14; - if (DAT_0 < 5) goto LAB_18002a8e4; - *(undefined8 *)(puVar14 + -8) = 0x18002a9e5; - cVar3 = _tlgKeywordOn(0x180164278,0); - if (cVar3 == '\0') goto LAB_1; - *(undefined8 *)(puVar14 + -8) = 0x18002a9f2; - uVar9 = IkeGetTlsMmLuid(); - *(undefined8 *)(puVar14 + 0x68) = uVar9; - local_298 = (undefined8 *)(puVar14 + 0x68); + *(uint *)(puVar17 + 0x48) = (uint)bVar1; + *(wchar_t **)(puVar17 + 0x40) = local_178; + *(uint *)(puVar17 + 0x38) = (uint)uVar6; + uVar10 = WPP_GLOBAL_Control[2]; + *(wchar_t **)(puVar17 + 0x30) = local_218; + *(char **)(puVar17 + 0x28) = param_1; + *(longlong *)(puVar17 + 0x20) = lVar9; + *(undefined8 *)(puVar17 + -8) = 0x18002ac5a; + cVar4 = WPP_SF_iSsSdSd(uVar10,puVar14,uVar20,param_4,*(wchar_t **)(puVar17 + 0x20), + *(char **)(puVar17 + 0x28),*(wchar_t **)(puVar17 + 0x30), + *(undefined8 *)(puVar17 + 0x38),*(wchar_t **)(puVar17 + 0x40)); + } + puVar18 = puVar17; + if (DAT_1 < 5) goto LAB_18002ab74; + *(undefined8 *)(puVar17 + -8) = 0x18002ac75; + cVar3 = _tlgKeywordOn(0x180165278,0); + cVar4 = '\0'; + if (cVar3 == '\0') goto LAB_0; + *(undefined8 *)(puVar17 + -8) = 0x18002ac82; + uVar10 = IkeGetTlsMmLuid(); + *(undefined8 *)(puVar17 + 0x68) = uVar10; + local_298 = (undefined8 *)(puVar17 + 0x68); local_290 = 8; - *(undefined8 *)(puVar14 + -8) = 0x18002aa0d; - pwVar10 = (wchar_t *)IkeGetTlsPeerAddr(); - *(undefined8 *)(puVar14 + -8) = 0x18002aa19; - _tlgCreate1Sz_wchar_t(local_288,pwVar10); - *(undefined8 *)(puVar14 + -8) = 0x18002aa25; + *(undefined8 *)(puVar17 + -8) = 0x18002ac9d; + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + *(undefined8 *)(puVar17 + -8) = 0x18002aca9; + _tlgCreate1Sz_wchar_t(local_288,pwVar11); + *(undefined8 *)(puVar17 + -8) = 0x18002acb5; _tlgCreate1Sz_char(local_278,param_1); - *(undefined8 *)(puVar14 + -8) = 0x18002aa32; + *(undefined8 *)(puVar17 + -8) = 0x18002acc2; _tlgCreate1Sz_wchar_t(local_268,local_218); - *(undefined8 *)(puVar14 + -8) = 0x18002aa3d; - uVar4 = ntohs(uVar4); + *(undefined8 *)(puVar17 + -8) = 0x18002accd; + uVar5 = ntohs(uVar5); local_250 = 4; - *(uint *)(puVar14 + 0x60) = (uint)uVar4; - local_258 = (undefined4 *)(puVar14 + 0x60); - *(undefined8 *)(puVar14 + -8) = 0x18002aa6a; + *(uint *)(puVar17 + 0x60) = (uint)uVar5; + local_258 = (undefined4 *)(puVar17 + 0x60); + *(undefined8 *)(puVar17 + -8) = 0x18002acfa; _tlgCreate1Sz_wchar_t((longlong *)&local_248,local_178); - local_238 = (uint *)(puVar14 + 100); - pbVar13 = &DAT_3; - *(uint *)(puVar14 + 100) = (uint)param_2[1]; - *(undefined1 **)(puVar14 + 0x28) = local_2b8; - *(undefined4 *)(puVar14 + 0x20) = 9; + local_238 = (uint *)(puVar17 + 100); + pbVar16 = &DAT_3; + *(uint *)(puVar17 + 100) = (uint)param_2[1]; + *(undefined1 **)(puVar17 + 0x28) = local_2b8; + *(undefined4 *)(puVar17 + 0x20) = 9; local_230 = 4; break; case 6: case 7: IkeAddrGetAddrString((char *)param_2,local_218); IkeAddrGetAddrStringHigh((char *)param_2,local_d8); - pbVar13 = param_2; + pbVar16 = param_2; IkeAddrGetPort((longlong)param_2,(undefined2 *)&local_2e4); - puVar12 = &local_2e8; - IkeAddrGetPortHigh((char *)pbVar13,(undefined2 *)puVar12); - uVar4 = (u_short)local_2e8; + puVar15 = &local_2e8; + IkeAddrGetPortHigh((char *)pbVar16,(undefined2 *)puVar15); + cVar4 = 'p'; + uVar5 = (u_short)local_2e8; if ((((undefined8 **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && (3 < *(byte *)((longlong)WPP_GLOBAL_Control + 0x19))) && ((*(byte *)((longlong)WPP_GLOBAL_Control + 0x1c) & 0x10) != 0)) { ntohs((u_short)local_2e8); - uVar4 = ntohs((u_short)local_2e4); - pwVar10 = (wchar_t *)IkeGetTlsPeerAddr(); + uVar5 = ntohs((u_short)local_2e4); + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); param_4 = IkeGetTlsMmLuid(); - WPP_SF_iSsSdSdd(WPP_GLOBAL_Control[2],puVar12,uVar17,param_4,pwVar10,param_1,local_218, - CONCAT44(in_stack_fffffffffffffcf4,(uint)uVar4),local_d8); - uVar4 = (u_short)local_2e8; - } - puVar15 = auStackY_348; - if ((DAT_0 < 5) || - (cVar3 = _tlgKeywordOn(0x180164278,0), puVar15 = auStackY_348, cVar3 == '\0')) - goto LAB_1; + cVar4 = WPP_SF_iSsSdSdd(WPP_GLOBAL_Control[2],puVar15,uVar20,param_4,pwVar11,param_1,local_218 + ,CONCAT44(in_stack_fffffffffffffcf4,(uint)uVar5),local_d8); + uVar5 = (u_short)local_2e8; + } + puVar18 = auStackY_348; + if (DAT_1 < 5) goto LAB_18002ab74; + cVar3 = _tlgKeywordOn(0x180165278,0); + cVar4 = '\0'; + puVar18 = auStackY_348; + if (cVar3 == '\0') goto LAB_0; local_2d0 = IkeGetTlsMmLuid(); local_298 = &local_2d0; local_290 = 8; - pwVar10 = (wchar_t *)IkeGetTlsPeerAddr(); - _tlgCreate1Sz_wchar_t(local_288,pwVar10); + pwVar11 = (wchar_t *)IkeGetTlsPeerAddr(); + _tlgCreate1Sz_wchar_t(local_288,pwVar11); _tlgCreate1Sz_char(local_278,param_1); _tlgCreate1Sz_wchar_t(local_268,local_218); - uVar5 = ntohs((u_short)local_2e4); + uVar6 = ntohs((u_short)local_2e4); local_250 = 4; - local_2e8 = (uint)uVar5; + local_2e8 = (uint)uVar6; local_258 = &local_2e8; _tlgCreate1Sz_wchar_t((longlong *)&local_248,local_d8); - uVar4 = ntohs(uVar4); + uVar5 = ntohs(uVar5); local_230 = 4; - pbVar13 = &DAT_4; - local_2d8[0] = (uint)uVar4; + pbVar16 = &DAT_4; + local_2d8[0] = (uint)uVar5; local_238 = local_2d8; local_2e0 = CONCAT44(local_2e0._4_4_,(uint)param_2[1]); local_228 = &local_2e0; local_220 = 4; - puVar14 = auStackY_348; + puVar17 = auStackY_348; } - *(undefined8 *)(puVar14 + -8) = 0x18002a8e4; - _tlgWriteTransfer_EtwEventWriteTransfer - (0x180164278,pbVar13,uVar17,param_4,*(undefined4 *)(puVar14 + 0x20), - *(undefined8 **)(puVar14 + 0x28)); - puVar15 = puVar14; -LAB_1: - *(undefined8 *)(puVar15 + -8) = 0x18002a8f3; - return; + *(undefined8 *)(puVar17 + -8) = 0x18002ab74; + cVar4 = _tlgWriteTransfer_EtwEventWriteTransfer + (0x180165278,pbVar16,uVar20,param_4,*(undefined4 *)(puVar17 + 0x20), + *(undefined8 **)(puVar17 + 0x28)); + puVar18 = puVar17; +LAB_0: + *(undefined8 *)(puVar18 + -8) = 0x18002ab83; + return cVar4; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## WPP_SF_iSqq ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WPP_SF_iSqq|WPP_SF_iSqq| |fullname|WPP_SF_iSqq|WPP_SF_iSqq| |`refcount`|57|60| |length|168|168| |called|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |calling|
Expand for full list:
CompleteMobikeContext
DoesSaExistMatchLingeringSa
IkeAddInboundSA
IkeAddOutboundSA
IkeBeginQMInitiator
IkeCheckSimultaneousSaCompleteIkeV2
IkeCompleteResponder
IkeCopyOldMMToNewMMIkeV2
IkeDestroyQMSA
IkeFindNextCompatibleSa
IkeFindQMPolicyIkeV2ResponderIkeFindSaForAcquire
IkeFinishMMSAProcessing
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleMobikeAckIkeV2
IkeHandleNotify
IkeHandleNotifyIkeV2
IkeHandlePayloadKeyDict
IkeHandlePayloadQMCFG
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeInplaceRekeyCompleteIkeV2
IkeMMDpdAttemptCallback
IkeMMLifetimeExpireCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMigrateQmSaToBfe
IkeNatKeepaliveCallback
IkeQMRetransNotifyCallback
IkeQueueMobikeAddressCheckResponder
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendOakDelete
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeUpdateOutstandingTimerContextIkeV2
|
Expand for full list:
CompleteMobikeContext
DoesSaExistMatchLingeringSa
IkeAddInboundSA
IkeAddOutboundSA
IkeBeginQMInitiator
IkeCheckSimultaneousSaCompleteIkeV2
IkeCompleteResponder
IkeCopyOldMMToNewMMIkeV2
IkeDestroyQMSA
IkeFindNextCompatibleSa
IkeFindQMPolicyIkeV2ResponderIkeFindSaForAcquire
IkeFinishMMSAProcessing
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleMobikeAckIkeV2
IkeHandleNotify
IkeHandleNotifyIkeV2
IkeHandlePayloadKeyDict
IkeHandlePayloadQMCFG
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeInplaceRekeyCompleteIkeV2
IkeMMDpdAttemptCallback
IkeMMLifetimeExpireCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMigrateQmSaToBfe
IkeNatKeepaliveCallback
IkeQMRetransNotifyCallback
IkeQueueMobikeAddressCheckResponder
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendOakDelete
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeUpdateOutstandingTimerContextIkeV2
| |paramcount|5|5| |`address`|180066c64|180066f44| |sig|undefined __fastcall WPP_SF_iSqq(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_iSqq(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## _tlgKeywordOn ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|_tlgKeywordOn|_tlgKeywordOn| |fullname|_tlgKeywordOn|_tlgKeywordOn| |`refcount`|1318|1326| |length|34|34| |called||| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeAddImpersonateEntryIkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMMProposalSpiInfoIkeV2
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLogUsageTelemetry
IkeLookupDestinationTunnelChecksConfig
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
LookUpTableFlushComplete
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeAddImpersonateEntryIkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMMProposalSpiInfoIkeV2
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLogUsageTelemetry
IkeLookupDestinationTunnelChecksConfig
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
LookUpTableFlushComplete
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
WFP_TRACE_IPSEC_TS
| |paramcount|2|2| |address|1800011f8|1800011f8| |sig|undefined1 __fastcall _tlgKeywordOn(longlong param_1, ulonglong param_2)|undefined1 __fastcall _tlgKeywordOn(longlong param_1, ulonglong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgKeywordOn Calling Diff ```diff --- _tlgKeywordOn calling +++ _tlgKeywordOn calling @@ -628,0 +629 @@ +IkeVerifyPacketHeader ``` ## _tlgCreate1Sz_wchar_t ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|_tlgCreate1Sz_wchar_t|_tlgCreate1Sz_wchar_t| |fullname|_tlgCreate1Sz_wchar_t|_tlgCreate1Sz_wchar_t| |`refcount`|1432|1440| |length|57|57| |called||| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
| |paramcount|2|2| |address|18000112c|18000112c| |sig|undefined __fastcall _tlgCreate1Sz_wchar_t(longlong * param_1, wchar_t * param_2)|undefined __fastcall _tlgCreate1Sz_wchar_t(longlong * param_1, wchar_t * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgCreate1Sz_wchar_t Calling Diff ```diff --- _tlgCreate1Sz_wchar_t calling +++ _tlgCreate1Sz_wchar_t calling @@ -641,0 +642 @@ +IkeVerifyPacketHeader ``` ## WfpReportAppErrorAsWinError ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WfpReportAppErrorAsWinError|WfpReportAppErrorAsWinError| |fullname|WfpReportAppErrorAsWinError|WfpReportAppErrorAsWinError| |`refcount`|2|9| |length|10|10| |called|WfpReportSysErrorAsWinError|WfpReportSysErrorAsWinError| |`calling`|IkeHandleMobikeAckIkeV2
IkeProcessInformationalRequestIkeV2|IkeHandleErrorNotifyIkeV2
IkeHandleMobikeAckIkeV2
IkeHandleNotifyIkeV2
IkeHandleStatusNotifyIkeV2
IkeLookupVendorId
IkeProcessInformationalRequestIkeV2
IkeQueueRecvRequest
IkeReceiveCallback
IkeVerifyDosCookieIkeV2| |paramcount|5|5| |`address`|180042458|180042748| |sig|undefined __fastcall WfpReportAppErrorAsWinError(undefined8 param_1, char * param_2, ulonglong param_3, undefined8 param_4, int param_5)|undefined __fastcall WfpReportAppErrorAsWinError(undefined8 param_1, char * param_2, ulonglong param_3, undefined8 param_4, int param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WfpReportAppErrorAsWinError Calling Diff ```diff --- WfpReportAppErrorAsWinError calling +++ WfpReportAppErrorAsWinError calling @@ -0,0 +1 @@ +IkeHandleErrorNotifyIkeV2 @@ -1,0 +3,3 @@ +IkeHandleNotifyIkeV2 +IkeHandleStatusNotifyIkeV2 +IkeLookupVendorId @@ -2,0 +7,3 @@ +IkeQueueRecvRequest +IkeReceiveCallback +IkeVerifyDosCookieIkeV2 ``` ## _tlgCreate1Sz_char ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|_tlgCreate1Sz_char|_tlgCreate1Sz_char| |fullname|_tlgCreate1Sz_char|_tlgCreate1Sz_char| |`refcount`|1170|1178| |length|45|45| |called||| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeAddInboundSA
IkeAddOutboundSAIkeAddRefEntryInAuthzBypassTable
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructQM
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAuthzBypassParams
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHeader
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMResponderPhase1
IkeInitSockets
IkeInitThreadpool
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLogUsageTelemetry
IkeLookupDestinationTunnelChecksConfig
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMDpdAttemptCallback
IkeMMEstablished
IkeMMInfoReqKeepAliveCallback
IkeMMLifetimeExpireCallback
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseSspiAuthIpAndProcessHdr
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMLifetimeExpireCallback
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
LogAcquire
OptionalClearCompletedMobikeContext
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeAddInboundSA
IkeAddOutboundSAIkeAddRefEntryInAuthzBypassTable
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructQM
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAuthzBypassParams
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHeader
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMResponderPhase1
IkeInitSockets
IkeInitThreadpool
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLogUsageTelemetry
IkeLookupDestinationTunnelChecksConfig
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMDpdAttemptCallback
IkeMMEstablished
IkeMMInfoReqKeepAliveCallback
IkeMMLifetimeExpireCallback
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseSspiAuthIpAndProcessHdr
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMLifetimeExpireCallback
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
LogAcquire
OptionalClearCompletedMobikeContext
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
WFP_TRACE_IPSEC_TS
| |paramcount|2|2| |address|1800010f8|1800010f8| |sig|undefined __fastcall _tlgCreate1Sz_char(longlong * param_1, char * param_2)|undefined __fastcall _tlgCreate1Sz_char(longlong * param_1, char * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgCreate1Sz_char Calling Diff ```diff --- _tlgCreate1Sz_char calling +++ _tlgCreate1Sz_char calling @@ -555,0 +556 @@ +IkeVerifyPacketHeader ``` ## IkeDoingIkeV2 ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeDoingIkeV2|IkeDoingIkeV2| |fullname|IkeDoingIkeV2|IkeDoingIkeV2| |`refcount`|29|30| |length|14|14| |called||| |`calling`|
Expand for full list:
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeConstructOptionalIdr
IkeGetUdpEncapIfDoingNatt
IkeHandleMMCryptoAndDeterminePath
IkeIfrRecordEvent
IkeInsertFragEntry
IkeLogUsageTelemetry
IkeProcessFrag
IkeReinjectReassembledPacketIkeSendPacketEx
IkeSendPacketFragment
IkeSetQmSaIPsecIdTokenState
IkeSetSaBundleFlags
Ikev2IsFragmentationNeeded
Ikev2IsFragmentationSupported
IsFullPacket
|
Expand for full list:
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeConstructOptionalIdr
IkeGetUdpEncapIfDoingNatt
IkeHandleMMCryptoAndDeterminePath
IkeIfrRecordEvent
IkeInsertFragEntry
IkeLogUsageTelemetry
IkeLookupVendorId
IkeProcessFragIkeReinjectReassembledPacket
IkeSendPacketEx
IkeSendPacketFragment
IkeSetQmSaIPsecIdTokenState
IkeSetSaBundleFlags
Ikev2IsFragmentationNeeded
Ikev2IsFragmentationSupported
IsFullPacket
| |paramcount|1|1| |`address`|18002dcc0|18002df50| |sig|bool __fastcall IkeDoingIkeV2(int * param_1)|bool __fastcall IkeDoingIkeV2(int * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeDoingIkeV2 Calling Diff ```diff --- IkeDoingIkeV2 calling +++ IkeDoingIkeV2 calling @@ -9,0 +10 @@ +IkeLookupVendorId ``` ## IkeGetTlsPeerAddr ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeGetTlsPeerAddr|IkeGetTlsPeerAddr| |fullname|IkeGetTlsPeerAddr|IkeGetTlsPeerAddr| |`refcount`|2734|2750| |length|23|23| |called|IkeGetTlsData|IkeGetTlsData| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeIfrInitializeContext
IkeIfrRecordEvent
IkeIfrSupressEvent
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeIfrInitializeContext
IkeIfrRecordEvent
IkeIfrSupressEvent
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
| |paramcount|0|0| |`address`|180044310|180044600| |sig|longlong __fastcall IkeGetTlsPeerAddr(void)|longlong __fastcall IkeGetTlsPeerAddr(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeGetTlsPeerAddr Calling Diff ```diff --- IkeGetTlsPeerAddr calling +++ IkeGetTlsPeerAddr calling @@ -649,0 +650 @@ +IkeVerifyPacketHeader ``` ## __GSHandlerCheck ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|475|476| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18004bad8|18004bdb8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## MicrosoftTelemetryAssertTriggeredNoArgs ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|MicrosoftTelemetryAssertTriggeredNoArgs|MicrosoftTelemetryAssertTriggeredNoArgs| |fullname|MicrosoftTelemetryAssertTriggeredNoArgs|MicrosoftTelemetryAssertTriggeredNoArgs| |`refcount`|2|3| |length|153|153| |called|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleExA
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
_guard_xfg_dispatch_icall_nop|API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetModuleHandleExA
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress
_guard_xfg_dispatch_icall_nop| |calling|IkeLookupVendorId|IkeLookupVendorId| |paramcount|0|0| |`address`|18004a680|18004a96c| |sig|undefined __fastcall MicrosoftTelemetryAssertTriggeredNoArgs(void)|undefined __fastcall MicrosoftTelemetryAssertTriggeredNoArgs(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## _tlgWriteTransfer_EtwEventWriteTransfer ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|_tlgWriteTransfer_EtwEventWriteTransfer|_tlgWriteTransfer_EtwEventWriteTransfer| |fullname|_tlgWriteTransfer_EtwEventWriteTransfer|_tlgWriteTransfer_EtwEventWriteTransfer| |`refcount`|1199|1204| |length|154|154| |called|NTDLL.DLL::EtwEventWriteTransfer|NTDLL.DLL::EtwEventWriteTransfer| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMMProposalSpiInfoIkeV2
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMMProposalSpiInfoIkeV2
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
| |paramcount|6|6| |address|180001224|180001224| |sig|undefined __fastcall _tlgWriteTransfer_EtwEventWriteTransfer(longlong param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)|undefined __fastcall _tlgWriteTransfer_EtwEventWriteTransfer(longlong param_1, byte * param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### _tlgWriteTransfer_EtwEventWriteTransfer Calling Diff ```diff --- _tlgWriteTransfer_EtwEventWriteTransfer calling +++ _tlgWriteTransfer_EtwEventWriteTransfer calling @@ -642,0 +643 @@ +IkeVerifyPacketHeader ``` ## WPP_SF_iS ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WPP_SF_iS|WPP_SF_iS| |fullname|WPP_SF_iS|WPP_SF_iS| |`refcount`|507|508| |length|128|128| |called|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |`calling`|
Expand for full list:
DumpTSsIkeV2
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetwork
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimitIkeBeginMMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCanProcessAcquire
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckForCertificateRenewal
IkeCheckKMAuthzBypass
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupMMNegotiation
IkeClearDosModeFlag
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConvertCRPPolicyToIkev2Format
IkeCreateMMSA
IkeCreateQMSA
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDerefCacheEntry
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAuthzBypassParams
IkeDumpCertChain
IkeDumpEkuList
IkeDumpNameCriteria
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEndCertCriteriaMatch
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindNextCompatibleSa
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindSaForAcquire
IkeFindSspiCert
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeGenerateBaseKeysIkeV2
IkeGetIDPayloadFromCert
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetPeerTokenInitiator
IkeGetTsNative
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleEmptyAckIkeV2
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleNotifyIkeV2
IkeHandlePayloadMMSspi
IkeHandlePossiblePeerKMAuthFailure
IkeHandleStatusNotifyIkeV2
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeImpersonate
IkeInit
IkeInitMMResponderPhase1
IkeInitSockets
IkeInitializePdc
IkeInitializeSspi
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsMMProposalValid
IkeIsPacketFinishedExpectedAuthip
IkeLoadNlb
IkeLookupInAuthzBypassTable
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateQmList
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructNatDisc
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseMMAttributes
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformPolicyReinit
IkePnpNotifyCallback
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquire
IkeProcessCFG
IkeProcessClearTextResponse
IkeProcessDosCookieNotify
IkeProcessExpire
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessInformationalRequestIkeV2
IkeProcessMMFilterChange
IkeProcessMMPolicyChange
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPowerEvent
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQueueWorkItemHiPri
IkeRasProcessEapPacketAsyncCallback
IkeRasUninitialize
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeRetrieveCredentialHandleFromCache
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSaProcessMobikeApiRequest
IkeSendDosCookieNotify
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendNotify
IkeSendPacketEx
IkeSendPacketFragment
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShutdown
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeUPNNameDecode
IkeUpdateCumulativeHash
IkeUpdateMessageIdAuthIp
IkeUpdateNatState
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2OptionalConstructCorrelation
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IsRecvPolicyTunnelPolicy
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
|
Expand for full list:
DumpTSsIkeV2
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetwork
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimitIkeBeginMMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCanProcessAcquire
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckForCertificateRenewal
IkeCheckKMAuthzBypass
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupMMNegotiation
IkeClearDosModeFlag
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConvertCRPPolicyToIkev2Format
IkeCreateMMSA
IkeCreateQMSA
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDerefCacheEntry
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAuthzBypassParams
IkeDumpCertChain
IkeDumpEkuList
IkeDumpNameCriteria
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEndCertCriteriaMatch
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindNextCompatibleSa
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindSaForAcquire
IkeFindSspiCert
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeGenerateBaseKeysIkeV2
IkeGetIDPayloadFromCert
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetPeerTokenInitiator
IkeGetTsNative
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleEmptyAckIkeV2
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleNotifyIkeV2
IkeHandlePayloadMMSspi
IkeHandlePossiblePeerKMAuthFailure
IkeHandleStatusNotifyIkeV2
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeImpersonate
IkeInit
IkeInitMMResponderPhase1
IkeInitSockets
IkeInitializePdc
IkeInitializeSspi
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsMMProposalValid
IkeIsPacketFinishedExpectedAuthip
IkeLoadNlb
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateQmList
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructNatDisc
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseMMAttributes
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformPolicyReinit
IkePnpNotifyCallback
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquire
IkeProcessCFG
IkeProcessClearTextResponse
IkeProcessDosCookieNotify
IkeProcessExpire
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessInformationalRequestIkeV2
IkeProcessMMFilterChange
IkeProcessMMPolicyChange
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPowerEvent
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQueueWorkItemHiPri
IkeRasProcessEapPacketAsyncCallback
IkeRasUninitialize
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeRemoveRasTSsIkeV2
IkeResendLastResponseIkeV2
IkeRetrieveCredentialHandleFromCache
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSaProcessMobikeApiRequest
IkeSendDosCookieNotify
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendNotify
IkeSendPacketEx
IkeSendPacketFragment
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShutdown
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeUPNNameDecode
IkeUpdateCumulativeHash
IkeUpdateMessageIdAuthIp
IkeUpdateNatState
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2OptionalConstructCorrelation
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IsRecvPolicyTunnelPolicy
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
| |paramcount|5|5| |`address`|180052890|180052b70| |sig|undefined __fastcall WPP_SF_iS(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_iS(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iS Calling Diff ```diff --- WPP_SF_iS calling +++ WPP_SF_iS calling @@ -153,0 +154 @@ +IkeLookupVendorId @@ -285,0 +287 @@ +IkeVerifyPacketHeader ``` ## IkeGetTlsMmLuid ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|IkeGetTlsMmLuid|IkeGetTlsMmLuid| |fullname|IkeGetTlsMmLuid|IkeGetTlsMmLuid| |`refcount`|2734|2750| |length|22|22| |called|IkeGetTlsData|IkeGetTlsData| |`calling`|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeIfrInitializeContext
IkeIfrRecordEvent
IkeIfrSupressEvent
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
|
Expand for full list:
CheckMMSslDelayState
CheckUMSslDelayState
CompleteMobikeContext
DoesSaExistMatchLingeringSa
DoesSaMatchLingeringSa
DumpTSsIkeV2
DumpTokenGroups
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetworkIkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddRefEntryInAuthzBypassTable
IkeAddRemoveWpOnIfindex
IkeAddWpIfIndexRef
IkeAddrDump
IkeAdjustIPsecQMAuth
IkeAdjustIPsecQMCipher
IkeAdjustIkeCipherType
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowKeyDictate
IkeAllowKeyNotify
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeArbitrateSimultaneousSasIkeV2
IkeAreQMProposalsValid
IkeAreQMProposalsValidIkeV2
IkeAssociateSimultaneousQmSasIkeV2
IkeAuditEstablishedMMCertUMCert
IkeAuditEstablishedMMCertUMNoCert
IkeAuditEstablishedMMNoCertUMCert
IkeAuditEstablishedMMNoCertUMNoCert
IkeAuditInvalidMMPacket
IkeAuditInvalidQMPacket
IkeAuditInvalidUMPacket
IkeAuditMMEstablishedCertNoUM
IkeAuditMMEstablishedNoUM
IkeAuditMMTerminationFailure
IkeAuditMMTerminationFailureCert
IkeAuditMMTerminationSuccess
IkeAuditQMTermination
IkeAuditUMTerminationFailure
IkeAuditUMTerminationFailureCert
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginMMInitiator
IkeBeginMMInplaceRekeyInitiatorIkeV2
IkeBeginQMInitiator
IkeBuildAndCheckCertChain
IkeCalculatePskHashToSend
IkeCalculatePskHashToVerify
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertCriteriaNameMatch
IkeCertCriteriaProcessAndGetChain
IkeChainSelect
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckAttribute
IkeCheckCertKeyUsage
IkeCheckForCertificateRenewal
IkeCheckForCriticalBitIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckKMAuthzBypass
IkeCheckNewIncomingReqMessageId
IkeCheckSAFloatInitiator
IkeCheckSAFloatResponder
IkeCheckSimultaneousSaCompleteIkeV2
IkeCheckSspiName
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupIfrGlobals
IkeCleanupLingeringState
IkeCleanupMMNegotiation
IkeCleanupQMNegotiation
IkeClearDosModeFlag
IkeClearOpenMM
IkeClearRequestWorkInProgressStateIkeV2
IkeCloseGwSvcTunnelIkeV2
IkeCloseRasTunnelIkeV2
IkeCloseSockets
IkeCompareMultipleAddrTunnelEndpoint
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompareSimpleChainArrayWithPolicyRoot
IkeCompareTunnelEndpoint
IkeCompleteResponder
IkeConstructAndSendMMResponse
IkeConstructAuth
IkeConstructAuthIkeV2
IkeConstructCFG
IkeConstructCert
IkeConstructCertReq
IkeConstructCrypto
IkeConstructDelete
IkeConstructDeleteIkeV2
IkeConstructEAP
IkeConstructEncryptIkeV2
IkeConstructFragmentedEncryptIkeV2
IkeConstructHashRaw
IkeConstructHdr
IkeConstructId
IkeConstructInplaceRekeyResponderIkeV2
IkeConstructKE
IkeConstructKEIkeV2
IkeConstructKeyDictationPayload
IkeConstructMMKEIkeV2
IkeConstructMMSA
IkeConstructMMSAIkeV2
IkeConstructNatDisc
IkeConstructNatDiscIkeV2
IkeConstructNatOA
IkeConstructNonce
IkeConstructNotify
IkeConstructNotifyIkeV2
IkeConstructOakMMSspiInitiator
IkeConstructOakMMSspiResponder
IkeConstructOakQMInitiator
IkeConstructOakQMResponder
IkeConstructOakQmConnectNotify
IkeConstructOptionalIdr
IkeConstructQM
IkeConstructQMId
IkeConstructQMInitiator
IkeConstructQMInitiatorEmbedded
IkeConstructQMInitiatorEmbeddedFast
IkeConstructQMResponder
IkeConstructQMResponderEmbedded
IkeConstructQMResponderEmbeddedFast
IkeConstructQMSA
IkeConstructQMSAIkeV2
IkeConstructQMTSIkeV2
IkeConstructQMTSTransportModeIkeV2
IkeConstructQMTransform
IkeConstructSig
IkeConstructSspi
IkeConstructSspiAuthIp
IkeConstructSspiId
IkeConstructSspiPeerIdKnownInitiator
IkeConstructVendor
IkeConvertCRPPolicyToIkev2Format
IkeConvertVpnTrafficSelectorsToIkeAddrs
IkeCopyIkeV2Sa
IkeCopyOldMMToNewMMIkeV2
IkeCopyOutKeysFromQMSAToSABundle
IkeCreateAndInsertImpersonateEntry
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateQMResponderIkeV2
IkeCreateQMSA
IkeCreateRasTunnelIkeV2
IkeCreateSspiAuthIp
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecrypt
IkeDeleteAllSAs
IkeDeleteAllTransportModeSAs
IkeDerefCacheEntry
IkeDerefTimerContext
IkeDestroyFilterToSAStateUnderLock
IkeDestroyQMSA
IkeDestroyTimerContext
IkeDetectAndHandleDupeAddressUpdateRequestIkeV2
IkeDetermineMMExchType
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineQMPathIkeV2
IkeDetermineSspiInfo
IkeDetermineSubExchTypeAuthip
IkeDetermineSubExchTypeIkeV2Initiator
IkeDetermineSubExchTypeIkeV2Responder
IkeDoesAcquireMatchEncap
IkeDownloadCertInfoFromUrl
IkeDropDHPktIfNecessary
IkeDumpAcquire
IkeDumpAuthzBypassParams
IkeDumpCert
IkeDumpCertChain
IkeDumpEkuList
IkeDumpHash
IkeDumpHeader
IkeDumpMessageIdWindowAuthIp
IkeDumpNameCriteria
IkeDumpNotifyInfo
IkeDumpOutstandingSa
IkeDumpPacket
IkeDumpString
IkeEkuCriteriaMatch
IkeEnableDosModeFlag
IkeEncodeCertChainIkeV2
IkeEncryptDoiToInternalIkeV2
IkeEndCertCriteriaMatch
IkeFindActiveTcpConnectionsMatchingSa
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindCertByHash
IkeFindCertMatchingCriteria
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindFilterToSAEntry
IkeFindIfIndexInWpIfindexStateList
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindNextCompatibleSa
IkeFindPayloadInPacket
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindSaForAcquire
IkeFindSaForAcquireNoLimitCheckIkeV2
IkeFindSspiCert
IkeFinishMMSAProcessing
IkeFireEventMMFailure
IkeFireEventQMFailure
IkeFireEventUMFailure
IkeFreeAcquireContext
IkeFreeMMSA
IkeFreeSspi
IkeGenerateBaseKeysIkeV2
IkeGetAltNameChoice
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetDhGroupForRetryHint
IkeGetExplicitCred
IkeGetIDPayloadFromCert
IkeGetIfIndex
IkeGetIfIndexAndIfLUID
IkeGetImpersonationHandle
IkeGetLongestCertChain
IkeGetMaxTimerCountIkeV2
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextRetransTimeoutIkeV2
IkeGetNextSspiToken
IkeGetOptionalLocalCertHashFromAcquire
IkeGetPeerTokenInitiator
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSpi
IkeGetSspiContextAuthIp
IkeGetTsNative
IkeGetTunnelTSsFromTsIdIkev2
IkeGetUdpEncapIfDoingNatt
IkeGuessSubExchTypeIkeV2Initiator
IkeGuessSubExchTypeIkeV2Responder
IkeGwSvcDelayLoad
IkeGwSvcUninitialize
IkeHandleAuthIPDHRetryNotify
IkeHandleCryptoActiveInfoReqIkeV2
IkeHandleCryptoActiveInfoRespIkeV2
IkeHandleDHRetryNotifyIkeV2
IkeHandleDeleteAckIkeV2
IkeHandleDeleteIkeV2
IkeHandleDeleteReqIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrNotifyReqIkeV2
IkeHandleErrorInRequestProcessingIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleLinger
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleMobikeAckIkeV2
IkeHandleNDIkeV2
IkeHandleNewSaError
IkeHandleNotify
IkeHandleNotifyAck
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandlePayloadFrag
IkeHandlePayloadKeyDict
IkeHandlePayloadKeyDictWt
IkeHandlePayloadMMAuth
IkeHandlePayloadMMAuthIkeV2
IkeHandlePayloadMMCert
IkeHandlePayloadMMCertReq
IkeHandlePayloadMMCrypto
IkeHandlePayloadMMEAP
IkeHandlePayloadMMHash
IkeHandlePayloadMMId
IkeHandlePayloadMMKE
IkeHandlePayloadMMKEIkeV2
IkeHandlePayloadMMNatdisc
IkeHandlePayloadMMNonce
IkeHandlePayloadMMSA
IkeHandlePayloadMMSAIkeV2
IkeHandlePayloadMMSig
IkeHandlePayloadMMSspi
IkeHandlePayloadMMSspiId
IkeHandlePayloadMMVendorId
IkeHandlePayloadQMCFG
IkeHandlePayloadQMCrypto
IkeHandlePayloadQMEncryptIkeV2
IkeHandlePayloadQMHash
IkeHandlePayloadQMId
IkeHandlePayloadQMKE
IkeHandlePayloadQMNatoa
IkeHandlePayloadQMNonce
IkeHandlePayloadQMNotify
IkeHandlePayloadQMSA
IkeHandlePayloadTS
IkeHandlePayloadUMAuth
IkeHandlePayloadUMCrypto
IkeHandlePayloadUMHash
IkeHandlePayloadUMSspi
IkeHandlePayloadUMSspiId
IkeHandlePeerReachedQMLimitIkeV2
IkeHandlePossiblePeerKMAuthFailure
IkeHandleQMPacketDispatch
IkeHandleQMPacketDispatchAuthip
IkeHandleQMPacketDispatchIkeV2
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHasSaLingeredTooLong
IkeIfrCleanupCallback
IkeIfrCleanupStaleTunnels
IkeIfrEventFlushCallback
IkeIfrFlushPendingEvents
IkeIfrInitializeContext
IkeIfrRecordEvent
IkeIfrSupressEvent
IkeImpersonate
IkeInactivateMMSA
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeInit
IkeInitCryptContextIkeV2
IkeInitMMInitiatorPhase1
IkeInitMMResponderPhase1
IkeInitSACryptoAlgos
IkeInitSockets
IkeInitThreadpool
IkeInitializeConfig
IkeInitializePdc
IkeInitializeSspi
IkeInitiatorFindDHGroupForKEPayload
IkeInplaceRekeyCompleteIkeV2
IkeInsertAddressToMobikeInfo
IkeInsertFilterToSAEntry
IkeInsertFragEntry
IkeInsertICookieInHiPriGlobalList
IkeInsertToCredCache
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsAcquireCompatible
IkeIsAcquireValid
IkeIsCertChainAcceptable
IkeIsDPDRequired
IkeIsKeyModEnabledForTraffic
IkeIsMMProposalValid
IkeIsMMProposalValidIkeV2
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeLoadNlb
IkeLogClearTextResp
IkeLogCredCacheEntry
IkeLogEvent
IkeLogExpire
IkeLogPlaintextErrorNotifyIkeV2
IkeLookupDestinationTunnelChecksConfig
IkeLookupDisableNATKeepalive
IkeLookupInAuthzBypassTable
IkeLookupVendorId
IkeMMAuthDoiToInternal
IkeMMCipherDoiToInternal
IkeMMDhDoiToInternal
IkeMMDpdAttemptCallback
IkeMMEncryptDoiToInternalIkeV2
IkeMMEstablished
IkeMMHashDoiToInternal
IkeMMInfoReqKeepAliveCallback
IkeMMIntegrityDoiToInternalIkeV2
IkeMMLifetimeExpireCallback
IkeMMPrfDoiToInternalIkeV2
IkeMMResponderTimeoutCallback
IkeMMRetransCallback
IkeMMRetransNotifyCallback
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeMatchFwpmFilter
IkeMergeServerEkuIfRequired
IkeMigrateNatStateIkeV2
IkeMigrateQmList
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeModifyKeyDictSaBundleFlagsAndSPI
IkeMoveMMToZombieList
IkeNameCriteriaMatch
IkeNatKeepaliveCallback
IkeNegotiateTrafficSelectors
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalCompletePendingTunnelSmartCardRetry
IkeOptionalConstructAuthipInitiatorKeDhGroupVendorId
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeOptionalConstructKeyDictWtAuthIp
IkeOptionalConstructKeyDictationPayloads
IkeOptionalConstructLifetimeNotify
IkeOptionalConstructNatDisc
IkeOptionalConstructSecurityRealmVendorId
IkeOptionalConstructXboxIkeNegoVendorId
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalDeleteICookieFromHiPriGlobalList
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkeOptionalResetDHMmsFailedAuth
IkeOptionalScheduleLingerCheckOnSaDelete
IkeOptionalUpdateGlobalUserTunnelToken
IkeOptionalUpdateMmSelectorOnTunnel
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMTransforms
IkeParseMMTransformsIkeV2
IkeParseMobikeNotifyPayload
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransforms
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkeParseTransformIkeV2
IkePeekIntoIncomingAuthPayloadIkeV2
IkePerformAddrLookupEstablished
IkePerformAddrLookupUnestablished
IkePerformPeerSidThrottling
IkePerformPolicyReinit
IkePerformPostponedCoexistenceSuppress
IkePerformPostponedLingerCheck
IkePerformPostponedMMWork
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMCertReq
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessMMSig
IkePostPayloadProcessMMVendorId
IkePostPayloadProcessQMNotify
IkePostPayloadProcessQMTS
IkePostPayloadProcessUMSspi
IkePostProcessSspiHelper
IkePowerStateChangeCallback
IkeProcessAcquireDispatch
IkeProcessCFG
IkeProcessClearTextRespDispatch
IkeProcessClearTextResponse
IkeProcessCrypto
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpire
IkeProcessFilterPolicyChange
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessInformationalRequestIkeV2
IkeProcessLifetimeNotify
IkeProcessMMFilterChange
IkeProcessMMId
IkeProcessMMPolicyChange
IkeProcessMobikeNotify
IkeProcessMobikeRequest
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNotifyByType
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessPnPNotify
IkeProcessPolicyChange
IkeProcessPostponedAddressUpdateIkeV2
IkeProcessPostponedWorkMobike
IkeProcessPowerEvent
IkeProcessPowerEventForMMSaWithoutLock
IkeProcessQMAlgo
IkeProcessQMFilterChange
IkeProcessQMPolicyChange
IkeProcessQMPolicyValidation
IkeProcessQMSAIkeV2
IkeProcessRekeySa
IkeProcessSspiComplete
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeQMAhHashDoiToInternal
IkeQMCompleteCommon
IkeQMEmbeddedResponderTimeoutCallback
IkeQMEspCipherDoiToInternal
IkeQMHmacDoiToInternal
IkeQMIntegrityDoiToInternalIkeV2
IkeQMLifetimeExpireCallback
IkeQMPfsDoiToInternal
IkeQMResponderTimeoutCallback
IkeQMRetransCallback
IkeQMRetransNotifyCallback
IkeQMSelectorToGetSpi
IkeQueueAcquireToSa
IkeQueueInformationalReqIkeV2
IkeQueueMMAbort
IkeQueueMobikeAddressCheckResponder
IkeQueuePostponedWorkEntry
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeRasUninitialize
IkeReRegisterRegConfigChangeNotification
IkeReceiveCallback
IkeRegConfigChangeNotifyCallback
IkeRegisterForPowerStateChange
IkeRegisterWithBFE
IkeReinitLingeringSa
IkeReinitQM
IkeRemoveImpersonateEntry
IkeRemoveMMSAFromLists
IkeRemoveRasTSsIkeV2
IkeRemoveWpIfIndexRef
IkeResendLastResponseIkeV2
IkeResendPacketFromTimerContext
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRetrieveCredentialHandleFromCache
IkeReturnError
IkeRpcIkeGetStatistics
IkeRpcIkeSACreateEnumHandle
IkeRpcIkeSADeleteById
IkeRpcIkeSADestroyEnumHandle
IkeRpcIkeSAEnum
IkeRpcIkeSAGetById
IkeRpcIkeSaUpdatePreferredAddressesAsync
IkeRpcInit
IkeRpcShutdown
IkeSQMLogQMAuthTransform
IkeSQMLogQMCipherTransform
IkeSQMLogQMIpsecMode
IkeSQMLogTransformType
IkeSQMLoggingEMAuthMethod
IkeSQMLoggingEMEstablished
IkeSQMLoggingKeyingModule
IkeSQMLoggingMMAuthMethod
IkeSQMLoggingMMCipher
IkeSQMLoggingMMDHGroup
IkeSQMLoggingMMEstablished
IkeSQMLoggingMMIntegrity
IkeSQMLoggingNATT
IkeSQMLoggingQMEstablished
IkeSQMLoggingServiceShutdown
IkeSaProcessMobikeApiRequest
IkeScheduleCoexistenceSuppressCheck
IkeSendDeleteAckIkeV2
IkeSendDosCookieNotify
IkeSendDosCookieNotifyIkeV2
IkeSendEmptyAckIkeV2
IkeSendEmptyInformationalReqIkeV2
IkeSendExtNotify
IkeSendInformationalReqWithDeleteIkeV2
IkeSendInformationalReqWithErrorNotifyIkeV2
IkeSendMobikeAckIkeV2
IkeSendMobikeNotify
IkeSendNotify
IkeSendNotifyOrDeleteIkeV2
IkeSendOakDelete
IkeSendOakDeleteAck
IkeSendPacketEx
IkeSendPacketFragment
IkeSendQMPacket
IkeSetFwpStatus
IkeSetKdcProxySettings
IkeSetOpenMM
IkeSetQMMessageId
IkeSetQmRekeyIkeV2
IkeSetSaCompleteRekeyIkeV2
IkeShouldSkipMmTransformForFipsPolicy
IkeShouldSkipQmProposalForFipsPolicy
IkeShouldSuppressNegotiation
IkeShutdown
IkeShutdownCapi
IkeShutdownFwpPhase1
IkeShutdownFwpPhase2
IkeShutdownMMSa
IkeSignAndEncryptPacketIkeV2
IkeStartNatKeepaliveTimer
IkeStartTracing
IkeStopReceivingPackets
IkeStopTracing
IkeStorePeerUrlEncodedCerts
IkeSubjectAltNameMatch
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithLocalToken
IkeTerminateMMWithoutLock
IkeTestAndSetWorkInProgressIkeV2
IkeThrottleRecvIfNecessary
IkeTryExhaustedSAQueueIkeV2
IkeTryExpireSAQueueAuthIp
IkeUPNNameDecode
IkeUninitializePdc
IkeUpdateCumulativeHash
IkeUpdateDriverStatus
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateLastResponseSentIkeV2
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateNatState
IkeUpdateOutstandingTimerContextIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeUpdateTimerContext
IkeUpdateTransformType
IkeV2ConstructCorrelation
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPeerCertChain
IkeVerifyPeerCertChainAuthIp
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IsRecvPolicyTunnelPolicy
LogAcquire
LogGetSpi
LogProviderContext
LogSABundle
LogSaContext
OptionalClearCompletedMobikeContext
SetIscFlags
SetSspiError
ShouldIgnoreMalformedPacket
TraceLogHelper
VpnFreeIDPayloadBuffer
VpnGetIDPayload
VpnGetOptionalIDrPayload
WFP_TRACE_IPSEC_TS
| |paramcount|0|0| |`address`|180052f8c|18005326c| |sig|undefined8 __fastcall IkeGetTlsMmLuid(void)|undefined8 __fastcall IkeGetTlsMmLuid(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### IkeGetTlsMmLuid Calling Diff ```diff --- IkeGetTlsMmLuid calling +++ IkeGetTlsMmLuid calling @@ -649,0 +650 @@ +IkeVerifyPacketHeader ``` ## WPP_SF_iSD ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WPP_SF_iSD|WPP_SF_iSD| |fullname|WPP_SF_iSD|WPP_SF_iSD| |`refcount`|76|79| |length|153|153| |called|NTDLL.DLL::EtwTraceMessage|NTDLL.DLL::EtwTraceMessage| |`calling`|
Expand for full list:
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetwork
IkeAddInboundSA
IkeAddOutboundSA
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCheckForCertificateRenewal
IkeClassifyKMAuthorizationEx
IkeClearOpenMM
IkeCloseGwSvcTunnelIkeV2IkeCloseRasTunnelIkeV2
IkeDetermineNotifyErrorInfoIkeV2
IkeDumpAcquire
IkeFindMMPolicy
IkeFindPayloadInPacket
IkeFindQMPolicy
IkeFreeMMSA
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetNextSspiToken
IkeGetSpi
IkeHandlePayloadKeyDict
IkeInitMMResponderPhase1
IkeInitializePdc
IkeInsertAddressToMobikeInfo
IkeInsertToCredCache
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeOptionalAddTransportFilter
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeParseMMAttributes
IkeParseQMAttributes
IkeParseQMTransforms
IkeParseRecvAncillaryInfo
IkePostPayloadProcessQMNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessPacketDispatch
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeRegisterForPowerStateChange
IkeRemoveRasTSsIkeV2
IkeSetOpenMM
IkeUninitializePdc
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeValidateChainAgainstCAPI
SetIscFlags
SetSspiError
|
Expand for full list:
IPSecUpdateFwdPathSaLifetime
IkeAcquireCredentialsHandleHelper
IkeActivatePdcNetwork
IkeAddInboundSA
IkeAddOutboundSA
IkeCallGwSvcCloseTunnel
IkeCallRasCloseTunnel
IkeCheckForCertificateRenewal
IkeClassifyKMAuthorizationEx
IkeClearOpenMM
IkeCloseGwSvcTunnelIkeV2IkeCloseRasTunnelIkeV2
IkeDetermineNotifyErrorInfoIkeV2
IkeDumpAcquire
IkeFindMMPolicy
IkeFindPayloadInPacket
IkeFindQMPolicy
IkeFreeMMSA
IkeGetAndUpdateNewOutboundReqMessageId
IkeGetNextSspiToken
IkeGetSpi
IkeHandleErrorNotifyIkeV2
IkeHandleNotifyIkeV2
IkeHandlePayloadKeyDict
IkeInitMMResponderPhase1
IkeInitializePdc
IkeInsertAddressToMobikeInfo
IkeInsertToCredCache
IkeMapWin32ErrorCodeToNotifyType
IkeMapWin32ErrorCodeToNotifyTypeIkeV2
IkeOptionalAddTransportFilter
IkeOptionalConstructCoexistenceVendorId
IkeOptionalConstructExchangeInfoNotify
IkeOptionalConstructExchangeInfoNotifyAuthIp
IkeOptionalConstructExchangeInfoNotifyIkeV2
IkeParseMMAttributes
IkeParseQMAttributes
IkeParseQMTransforms
IkeParseRecvAncillaryInfo
IkePostPayloadProcessQMNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessPacketDispatch
IkeProcessSspiInitiator
IkeProcessSspiResponder
IkeRegisterForPowerStateChange
IkeRemoveRasTSsIkeV2
IkeSetOpenMM
IkeUninitializePdc
IkeUpdateExpectedIncomingReqMessageId
IkeUpdateMessageIdAuthIp
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateTestIkeSaLifetime
IkeUpdateTestIpsecSaLifetime
IkeValidateChainAgainstCAPI
IkeVerifyDosCookieIkeV2
SetIscFlags
SetSspiError
| |paramcount|5|5| |`address`|180052918|180052bf8| |sig|undefined __fastcall WPP_SF_iSD(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_iSD(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_iSD Calling Diff ```diff --- WPP_SF_iSD calling +++ WPP_SF_iSD calling @@ -21,0 +22,2 @@ +IkeHandleErrorNotifyIkeV2 +IkeHandleNotifyIkeV2 @@ -52,0 +55 @@ +IkeVerifyDosCookieIkeV2 ``` ## WfpReportSysErrorAsWinError ### Match Info |Key|ikeext-10.0.22000.318.dll - ikeext-10.0.22000.434.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.66| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ikeext-10.0.22000.318.dll|ikeext-10.0.22000.434.dll| | :---: | :---: | :---: | |name|WfpReportSysErrorAsWinError|WfpReportSysErrorAsWinError| |fullname|WfpReportSysErrorAsWinError|WfpReportSysErrorAsWinError| |`refcount`|494|490| |length|133|133| |called|IkeGetTlsData
WPP_SF_SsD
WfpCallUsermodeErrorUTMacro|IkeGetTlsData
WPP_SF_SsD
WfpCallUsermodeErrorUTMacro| |`calling`|
Expand for full list:
CanAcceptExplicitCreds
CanDoNonEmbeddedQM
CgaCreateCgaCertForKeyInfo
CgaGetCgaCertSubject
CgaHashFinal
CgaHashInit
CgaHashUpdate
CgaLibInit
CgaVerifyHash1
CgaVerifyHash2Sec
CgaVerifyPeerAddressFUN_180035390
FUN_18004c789
GetNatHash
GetSidFromToken
GssUnwrapHash
GssWrapHash
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IkeAcquireCredentialsHandleHelper
IkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddSocket
IkeAddrSetAddrBytes
IkeAddrSetAddrBytesHigh
IkeAddrSetFromId
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeAssociateSimultaneousQmSasIkeV2
IkeAuthzAccessCheck
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginUMResponder
IkeCalculateCertSig
IkeCanAcceptRpcCall
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertChainBuild
IkeCertCriteriaProcessAndGetChain
IkeCertNameToStr
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckCertECDSAKeyType
IkeCheckCertKeyUsage
IkeCheckCertRSAKeyType
IkeCheckForCriticalBitIkeV2
IkeCheckForMMSAIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckMMValidForAcquireIkeV2
IkeCheckNewIncomingReqMessageId
IkeCheckQMLimitsForQmResponder
IkeCheckQMSelectorsIkeV2
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupMMNegotiation
IkeCompareChainWithTrustCAAndCRP
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompleteResponder
IkeConstructCertReq
IkeConstructEAP
IkeConstructId
IkeConstructMMProposalInitiator
IkeConstructOptionalIdr
IkeConstructQMProposalInitiator
IkeConvertCRPPolicyToIkev2Format
IkeConvertStoreToCRPRootList
IkeCopyDesKey
IkeCopyOutKeysFromQMSAToSABundle
IkeCopySid
IkeCopyV4InfoToAcquireContext
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateRasTunnelIkeV2
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecodeCertBundle
IkeDecryptOakNDPacket
IkeDecryptOakPacket
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineOakQMPath
IkeDetermineSspiInfo
IkeDownloadCertInfoFromUrl
IkeDupeTokenHandle
IkeEkuCriteriaMatch
IkeEncodeCertChainIkeV2
IkeEncodeCertChainPkcs7
IkeEndCertCriteriaMatch
IkeEnumFwpmLayer
IkeExpandPacket
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindAuthConfig
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindLocalCGACert
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindPayloadInPacket
IkeFindPayloadValidationDefByExchangeTypeAuthip
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindQMSABySaContext
IkeFindSspiCert
IkeFwpConditionValueValidate
IkeFwpPortConditionToIkeAddr
IkeFwpProtocolConditionToIkeAddr
IkeFwpV4AddrConditionToIkeAddr
IkeFwpmProviderContextToQMPolicy
IkeGenerateBaseKeySspiAuthIp
IkeGenerateDHSharedSecret
IkeGenerateOakMMIV
IkeGenerateOakNotifyIV
IkeGenerateOakQMIV
IkeGetAccessTokenFromRpcClientBinding
IkeGetAeadEncrParams
IkeGetCertHash
IkeGetExplicitCred
IkeGetFwpmFilterById
IkeGetGroupsFromToken
IkeGetGwSvcIkeDllName
IkeGetIDPayloadFromCert
IkeGetImpersonationHandle
IkeGetLuidFromToken
IkeGetMsTcpipProtocolInfo
IkeGetMyNtlmMachineName
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextAuthMethod
IkeGetPeerCGACertContext
IkeGetPeerTokenInitiator
IkeGetPeerTokenResponder
IkeGetPrimaryGroupFromToken
IkeGetQMFromMM
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSigKeyProv
IkeGetSpi
IkeGetTSsFromRas
IkeGetTsNative
IkeGetUserNameFromToken
IkeGetUserSidFromToken
IkeGetWSASendRecvFunc
IkeGwSvcDelayLoad
IkeHandleDeleteRespIkev2
IkeHandleEmptyAckIkeV2
IkeHandleErrorNotifyIkeV2
IkeHandleMMCryptoAndDeterminePath
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleNDIkeV2
IkeHandleNotify
IkeHandleNotifyIkeV2
IkeHandleOakND
IkeHandleOakNotify
IkeHandlePayloadKeyDict
IkeHandlePayloadQMCFG
IkeHandlePayloadQMKE
IkeHandlePayloadQMNotify
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleStatusNotifyIkeV2
IkeHandleUMPacketDispatch
IkeHashFinal
IkeHashUpdate
IkeHmacInit
IkeImpersonate
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeIndicateTSsToRas
IkeInit
IkeInitAnonymousToken
IkeInitDbgRegConfig
IkeInitMMResponderPhase1
IkeInitRegConfigNotification
IkeInitSockets
IkeInitThreadpool
IkeInitThreadpoolHelper
IkeInitalizeIfrGlobals
IkeInitializeAuthReplicaLayer
IkeInitializeConfig
IkeInitializeFwp
IkeInitializeMMSAInitiator
IkeInitializeTokenInformation
IkeInsertAddressToMobikeInfo
IkeInsertQMSAToMMSA
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsDPDRequired
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsPacketValid
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeIsRemoteTokenMachine
IkeIsSHA1CertHashEqual
IkeIsSaValidForTunnel
IkeLoadSaDbSecurity
IkeLookupDestinationTunnelChecksConfig
IkeLookupIPsecThroughNatRegConfig
IkeLookupRegConfig
IkeLookupVendorId
IkeMMAuthDoiToInternalIkeV2
IkeMMValidateHeaderFlags
IkeMMValidateMajorVerForSaInitIkeV2
IkeMapAcquireIdToInternal
IkeMatchFwpmFilter
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeObtainSortedRemoteTunnelEndpoint
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalConstructQMPfsKEResponder
IkeOptionalConstructRekeySaNotifyIkeV2
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkePackS4u
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMProposal
IkeParseMMProposalIkeV2
IkeParseMMTransforms
IkeParseMobikeNotifyPayload
IkeParseMobikeNotifyPayloads
IkeParseNotify
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkePerfMonAdd
IkePerfMonInit
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessQMNotify
IkePostPayloadProcessUMHash
IkeProcessAcquire
IkeProcessAcquireDispatch
IkeProcessAuth
IkeProcessAuthIkeV2
IkeProcessAuthipCryptolessNotify
IkeProcessCFG
IkeProcessCert
IkeProcessCrypto
IkeProcessDelete
IkeProcessDeleteIkeV2
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpireDispatch
IkeProcessFrag
IkeProcessHash
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketCrypto
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessKE
IkeProcessKEIkeV2
IkeProcessLifetimeNotify
IkeProcessMMId
IkeProcessMMSA
IkeProcessMMSAIkeV2
IkeProcessMobikeNotify
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNatOA
IkeProcessNonce
IkeProcessNotifyByType
IkeProcessNotifyCrypto
IkeProcessNotifyIkeV2
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotify
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessQMAlgo
IkeProcessQMId
IkeProcessQMPolicyValidation
IkeProcessQMSA
IkeProcessQMTS
IkeProcessRekeySa
IkeProcessSig
IkeProcessSspi
IkeProcessSspiComplete
IkeQMSelectorToGetSpi
IkeQueueMobikeAddressCheckResponder
IkeQueueWorkItem
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasGetVpnIkeDllName
IkeRasProcessAdditionalAddressNotificationIkeV2
IkeRasProcessEapAuthPacket
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeReadIdPayloadFromRegistry
IkeReceiveCallback
IkeRegisterWithBFE
IkeRemoveMMSAFromAddrHash
IkeRemoveMMSAFromHash
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRevertImpersonation
IkeRpcIkeSAGetById
IkeRpcInterfaceCreate
IkeRpcInterfaceSecurityCallback
IkeSaDbGetSecurityInfo
IkeSaDbSetSecurityInfo
IkeSaLookupById
IkeSaLookupByKeymodType
IkeSadbSdValidate
IkeSecurityDescriptorCreateFromSddl
IkeSecurityInformationValidate
IkeSendExtNotify
IkeSendPacketEx
IkeSendPacketFragment
IkeSetKdcProxySettingsOnCred
IkeSetQMStatus
IkeSetQmRekeyIkeV2
IkeSetSaBundleFlags
IkeSpecifyAuthipV4NonRefCounters
IkeSpecifyAuthipV4RefCounters
IkeSpecifyAuthipV6NonRefCounters
IkeSpecifyAuthipV6RefCounters
IkeSpecifyCommonNonRefCounters
IkeSpecifyCommonRefCounters
IkeSpecifyIkeV2IpV4NonRefCounters
IkeSpecifyIkeV2IpV4RefCounters
IkeSpecifyIkeV2IpV6NonRefCounters
IkeSpecifyIkeV2IpV6RefCounters
IkeSpecifyIkeV4NonRefCounters
IkeSpecifyIkeV4RefCounters
IkeSpecifyIkeV6NonRefCounters
IkeSpecifyIkeV6RefCounters
IkeStartTracing
IkeStorePeerCert
IkeStorePeerUrlEncodedCerts
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithIKEToken
IkeTraceBytes
IkeTraceInit
IkeTraceUInt32
IkeTraceUInt64
IkeUpdateHashWithCertHash
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateRCookie
IkeUpdateTimerContext
IkeV1LookupEspNullAesGmac23
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAdditionalAddressRequest
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateKePayloadReceived
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerfiyCGACertBinding
IkeVerifyCertMapping
IkeVerifyDosCookieIkeV2
IkeVerifyDynamicFilterThrottle
IkeVerifyExchTypeForMMSa
IkeVerifyIncomingDataSize
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPayloadLen
IkeVerifyPeerCertChain
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IkeVerifySelectorComparableIkeV2
IkeVerifySilentKeyCNG
IkeWriteEvent
SetRetryState
SetSspiError
WfpAuditLogEvent
WfpAuditPolicyNotifyCreate
WfpAuditPolicyNotifyOnChange
WfpCreateFastRWLock
WfpCriticalSectionCreate
WfpMidlObjectDecode
WfpMidlObjectDestroy
WfpMidlObjectEncode
WfpMidlObjectInit
WfpPnPInitProtocolState
WfpPnPLookupLocalIFProperties
WfpPnPNotifyInit
WfpPnPRegisterForAddressListChange
WfpPoolInit
WfpPoolPop
WfpRegCreateKey
WfpRegOpenKey
WfpRegQueryBinary
WfpRegQueryDWord
WfpRegQueryNumValues
WfpRegQueryString
WfpRegSetBinary
WfpReportAppErrorAsWinError
WfpServiceChangeState
WfpServiceHandlerEx
WfpServiceMain
WfpStartTimer
WfpStringCopyWtoAAlloc
WfpStringExpand
|
Expand for full list:
CanAcceptExplicitCreds
CanDoNonEmbeddedQM
CgaCreateCgaCertForKeyInfo
CgaGetCgaCertSubject
CgaHashFinal
CgaHashInit
CgaHashUpdate
CgaLibInit
CgaVerifyHash1
CgaVerifyHash2Sec
CgaVerifyPeerAddressFUN_180035620
FUN_18004ca69
GetNatHash
GetSidFromToken
GssUnwrapHash
GssWrapHash
IKeCheckTransportAndQMPoliciesForSecurityRealmCompatibility
IkeAcquireCredentialsHandleHelper
IkeAddImpersonateEntry
IkeAddInboundSA
IkeAddOutboundSA
IkeAddSocket
IkeAddrSetAddrBytes
IkeAddrSetAddrBytesHigh
IkeAddrSetFromId
IkeAdjustMMLifetimeFromCert
IkeAdjustMMRekeyLifetimeFromCertIkeV2
IkeAllocAndInitTimerContext
IkeAllowNewIncomingConnection
IkeApplyPeerIPRateLimit
IkeAssociateSimultaneousQmSasIkeV2
IkeAuthzAccessCheck
IkeBeginLifeExpireInplaceRekeyIkeV2
IkeBeginUMResponder
IkeCalculateCertSig
IkeCanAcceptRpcCall
IkeCanProcessAcquire
IkeCanProcessPacket
IkeCertChainBuild
IkeCertCriteriaProcessAndGetChain
IkeCertNameToStr
IkeCheckAndIncrementHalfOpenRespQmCount
IkeCheckCertECDSAKeyType
IkeCheckCertKeyUsage
IkeCheckCertRSAKeyType
IkeCheckForCriticalBitIkeV2
IkeCheckForMMSAIkeV2
IkeCheckIncomingResponseMessageIdIkeV2
IkeCheckMMValidForAcquireIkeV2
IkeCheckNewIncomingReqMessageId
IkeCheckQMLimitsForQmResponder
IkeCheckQMSelectorsIkeV2
IkeClassifyKMAuthorization
IkeClassifyKMAuthorizationEx
IkeCleanupMMNegotiation
IkeCompareChainWithTrustCAAndCRP
IkeCompareSimpleChainArrayWithCRPRootList
IkeCompleteResponder
IkeConstructCertReq
IkeConstructEAP
IkeConstructId
IkeConstructMMProposalInitiator
IkeConstructOptionalIdr
IkeConstructQMProposalInitiator
IkeConvertCRPPolicyToIkev2Format
IkeConvertStoreToCRPRootList
IkeCopyDesKey
IkeCopyOutKeysFromQMSAToSABundle
IkeCopySid
IkeCopyV4InfoToAcquireContext
IkeCreateGwSvcTunnelIkeV2
IkeCreateMMSA
IkeCreateRasTunnelIkeV2
IkeCreateV4Socket
IkeCreateV6Socket
IkeCriteriaVerifyPeerCertChainAuthIp
IkeCriteriaVerifyPeerCertChainIke
IkeDecodeCertBundle
IkeDecryptOakNDPacket
IkeDecryptOakPacket
IkeDetermineMMPathIkeV2
IkeDetermineNotifyErrorInfo
IkeDetermineNotifyErrorInfoIkeV2
IkeDetermineOakQMPath
IkeDetermineSspiInfo
IkeDownloadCertInfoFromUrl
IkeDupeTokenHandle
IkeEkuCriteriaMatch
IkeEncodeCertChainIkeV2
IkeEncodeCertChainPkcs7
IkeEndCertCriteriaMatch
IkeEnumFwpmLayer
IkeExpandPacket
IkeFindActiveTcpConnectionsV4
IkeFindActiveTcpConnectionsV6
IkeFindAuthConfig
IkeFindCorrectMMFilterFromArray
IkeFindCorrectQMFilterFromArray
IkeFindLocalCGACert
IkeFindLocalCertChain
IkeFindMMPolicy
IkeFindPayloadInPacket
IkeFindPayloadValidationDefByExchangeTypeAuthip
IkeFindPayloadValidationDefMMAuthip
IkeFindPayloadValidationDefQMAuthip
IkeFindPayloadValidationDefUMAuthip
IkeFindQMPolicy
IkeFindQMPolicyIkeV2Responder
IkeFindQMSA
IkeFindQMSABySaContext
IkeFindSspiCert
IkeFwpConditionValueValidate
IkeFwpPortConditionToIkeAddr
IkeFwpProtocolConditionToIkeAddr
IkeFwpV4AddrConditionToIkeAddr
IkeFwpmProviderContextToQMPolicy
IkeGenerateBaseKeySspiAuthIp
IkeGenerateDHSharedSecret
IkeGenerateOakMMIV
IkeGenerateOakNotifyIV
IkeGenerateOakQMIV
IkeGetAccessTokenFromRpcClientBinding
IkeGetAeadEncrParams
IkeGetCertHash
IkeGetExplicitCred
IkeGetFwpmFilterById
IkeGetGroupsFromToken
IkeGetGwSvcIkeDllName
IkeGetIDPayloadFromCert
IkeGetImpersonationHandle
IkeGetLuidFromToken
IkeGetMsTcpipProtocolInfo
IkeGetMyNtlmMachineName
IkeGetMySPNAuthIp
IkeGetMySPNOak
IkeGetNextAuthMethod
IkeGetPeerCGACertContext
IkeGetPeerTokenInitiator
IkeGetPeerTokenResponder
IkeGetPrimaryGroupFromToken
IkeGetQMFromMM
IkeGetSharedElliptic
IkeGetSharedModp
IkeGetSigKeyProv
IkeGetSpi
IkeGetTSsFromRas
IkeGetTsNative
IkeGetUserNameFromToken
IkeGetUserSidFromToken
IkeGetWSASendRecvFunc
IkeGwSvcDelayLoad
IkeHandleDeleteRespIkev2
IkeHandleEmptyAckIkeV2
IkeHandleMMCryptoAndDeterminePath
IkeHandleMMInplaceFromQMIkeV2
IkeHandleMMPacketDispatchIkeV2
IkeHandleMMPacketIkeV2
IkeHandleMMPacketXboxIkeNegoType
IkeHandleNDIkeV2
IkeHandleNotify
IkeHandleOakND
IkeHandleOakNotify
IkeHandlePayloadKeyDict
IkeHandlePayloadQMCFG
IkeHandlePayloadQMKE
IkeHandlePayloadQMNotify
IkeHandleQMPacketIkeV2
IkeHandleSecurityRealmVendorId
IkeHandleUMPacketDispatch
IkeHashFinal
IkeHashUpdate
IkeHmacInit
IkeImpersonate
IkeIndicateDriverInitiatedCallGwSvcIkeV2
IkeIndicateIncomingCallGwSvcIkeV2
IkeIndicateTSsToRas
IkeInit
IkeInitAnonymousToken
IkeInitDbgRegConfig
IkeInitMMResponderPhase1
IkeInitRegConfigNotification
IkeInitSockets
IkeInitThreadpool
IkeInitThreadpoolHelper
IkeInitalizeIfrGlobals
IkeInitializeAuthReplicaLayer
IkeInitializeConfig
IkeInitializeFwp
IkeInitializeMMSAInitiator
IkeInitializeTokenInformation
IkeInsertAddressToMobikeInfo
IkeInsertQMSAToMMSA
IkeInvokeTIADictationCheck
IkeInvokeTIKeyNotify
IkeInvokeTISetKey
IkeIsDPDRequired
IkeIsNextPayloadExpectedAuthip
IkeIsPacketFinishedExpectedAuthip
IkeIsPacketValid
IkeIsRemoteAuthMethodAcceptableIkeV2
IkeIsRemoteTokenMachine
IkeIsSHA1CertHashEqual
IkeIsSaValidForTunnel
IkeLoadSaDbSecurity
IkeLookupDestinationTunnelChecksConfig
IkeLookupIPsecThroughNatRegConfig
IkeLookupRegConfig
IkeLookupVendorId
IkeMMAuthDoiToInternalIkeV2
IkeMMValidateHeaderFlags
IkeMMValidateMajorVerForSaInitIkeV2
IkeMapAcquireIdToInternal
IkeMatchFwpmFilter
IkeMigrateQmSaToBfe
IkeMigrateQmToRasMobike
IkeNegotiateTsNative
IkeObtainPeerKerberosTokenOnInitiator
IkeObtainSortedRemoteTunnelEndpoint
IkeOptionalAddTransportFilter
IkeOptionalCheckCACert
IkeOptionalConstructQMPfsKEResponder
IkeOptionalConstructRekeySaNotifyIkeV2
IkeOptionalDHThrottleBegin
IkeOptionalDHThrottleEnd
IkeOptionalIndicateIncomingCallRasIkeV2
IkeOptionalMakeIkeextAutoStart
IkePackS4u
IkeParseAttributesIkeV2
IkeParseMMAttributes
IkeParseMMProposal
IkeParseMMProposalIkeV2
IkeParseMMTransforms
IkeParseMobikeNotifyPayload
IkeParseMobikeNotifyPayloads
IkeParseNotify
IkeParseQMAttributes
IkeParseQMProposal
IkeParseQMProposalIkeV2
IkeParseQMTransformsIkeV2
IkeParseRecvAncillaryInfo
IkeParseSspiAuthIpAndProcessHdr
IkePerfMonAdd
IkePerfMonInit
IkePnpNotifyCallback
IkePostPayloadProcessEAP
IkePostPayloadProcessMMEapAuth
IkePostPayloadProcessMMPsk
IkePostPayloadProcessQMNotify
IkePostPayloadProcessUMHash
IkeProcessAcquire
IkeProcessAcquireDispatch
IkeProcessAuth
IkeProcessAuthIkeV2
IkeProcessAuthipCryptolessNotify
IkeProcessCFG
IkeProcessCert
IkeProcessCrypto
IkeProcessDelete
IkeProcessDeleteIkeV2
IkeProcessDosCookieNotify
IkeProcessExchangeInfoNotifyIkeV2
IkeProcessExpireDispatch
IkeProcessFrag
IkeProcessHash
IkeProcessHashND
IkeProcessHashQM
IkeProcessHashUM
IkeProcessIncomingPacketCrypto
IkeProcessIncomingPacketEncryptIkeV2
IkeProcessKE
IkeProcessKEIkeV2
IkeProcessLifetimeNotify
IkeProcessMMId
IkeProcessMMSA
IkeProcessMMSAIkeV2
IkeProcessMobikeNotify
IkeProcessNatDisc
IkeProcessNatDiscIkeV2
IkeProcessNatOA
IkeProcessNonce
IkeProcessNotifyByType
IkeProcessNotifyCrypto
IkeProcessNotifyIkeV2
IkeProcessNotifyPayload
IkeProcessOakCryptolessNotify
IkeProcessOakDeleteData
IkeProcessOakNotify
IkeProcessOakNotifyData
IkeProcessPacket
IkeProcessPacketDispatch
IkeProcessQMAlgo
IkeProcessQMId
IkeProcessQMPolicyValidation
IkeProcessQMSA
IkeProcessQMTS
IkeProcessRekeySa
IkeProcessSig
IkeProcessSspi
IkeProcessSspiComplete
IkeQMSelectorToGetSpi
IkeQueueMobikeAddressCheckResponder
IkeQueueWorkItem
IkeQueueWorkItemHiPri
IkeRasClientGetCFGRequest
IkeRasClientProcessCFGResponse
IkeRasDelayLoad
IkeRasGetVpnIkeDllName
IkeRasProcessAdditionalAddressNotificationIkeV2
IkeRasProcessEapAuthPacket
IkeRasProcessEapPacketAsyncCallback
IkeRasServerProcessCFGRequest
IkeReadIdPayloadFromRegistry
IkeReceiveCallback
IkeRegisterWithBFE
IkeRemoveMMSAFromAddrHash
IkeRemoveMMSAFromHash
IkeResendReqWithDosCookieIkeV2
IkeResolveTunnelFqdn
IkeRevertImpersonation
IkeRpcIkeSAGetById
IkeRpcInterfaceCreate
IkeRpcInterfaceSecurityCallback
IkeSaDbGetSecurityInfo
IkeSaDbSetSecurityInfo
IkeSaLookupById
IkeSaLookupByKeymodType
IkeSadbSdValidate
IkeSecurityDescriptorCreateFromSddl
IkeSecurityInformationValidate
IkeSendExtNotify
IkeSendPacketEx
IkeSendPacketFragment
IkeSetKdcProxySettingsOnCred
IkeSetQMStatus
IkeSetQmRekeyIkeV2
IkeSetSaBundleFlags
IkeSpecifyAuthipV4NonRefCounters
IkeSpecifyAuthipV4RefCounters
IkeSpecifyAuthipV6NonRefCounters
IkeSpecifyAuthipV6RefCounters
IkeSpecifyCommonNonRefCounters
IkeSpecifyCommonRefCounters
IkeSpecifyIkeV2IpV4NonRefCounters
IkeSpecifyIkeV2IpV4RefCounters
IkeSpecifyIkeV2IpV6NonRefCounters
IkeSpecifyIkeV2IpV6RefCounters
IkeSpecifyIkeV4NonRefCounters
IkeSpecifyIkeV4RefCounters
IkeSpecifyIkeV6NonRefCounters
IkeSpecifyIkeV6RefCounters
IkeStartTracing
IkeStorePeerCert
IkeStorePeerUrlEncodedCerts
IkeSubjectRDNMatch
IkeSubstituteIPsecIDInTunnelAcquireWithIKEToken
IkeTraceBytes
IkeTraceInit
IkeTraceUInt32
IkeTraceUInt64
IkeUpdateHashWithCertHash
IkeUpdateMessageIdOnIncomingPacketIkeV2
IkeUpdateRCookie
IkeUpdateTimerContext
IkeV1LookupEspNullAesGmac23
IkeV2HandlePayloadMMCorrelation
IkeV2OptionalConstructCorrelation
IkeV2VerifyCorrelationHash
IkeV2VerifyCorrelationPayload
IkeValidateAdditionalAddressRequest
IkeValidateAuthArrayInitiatorIkeV2
IkeValidateAuthArrayResponderIkeV2
IkeValidateChainAgainstCAPI
IkeValidateIkeV2Address
IkeValidateIkeV2Port
IkeValidateKeDhGroupAuthipResponder
IkeValidateKePayloadReceived
IkeValidateMatchedSecurityRealmQMFilter
IkeValidatePeerSPNForKerbAuth
IkeValidateQmSelectorSentByPeer
IkeValidateQmTsInitiatorIkeV2
IkeVerfiyCGACertBinding
IkeVerifyCertMapping
IkeVerifyDynamicFilterThrottle
IkeVerifyExchTypeForMMSa
IkeVerifyIncomingDataSize
IkeVerifyMMHash
IkeVerifyOakMMHash
IkeVerifyPacketHeader
IkeVerifyPayloadLen
IkeVerifyPeerCertChain
IkeVerifyPeerSig
IkeVerifyRespQMThrottleIkeV2
IkeVerifySelectorComparableIkeV2
IkeVerifySilentKeyCNG
IkeWriteEvent
SetRetryState
SetSspiError
WfpAuditLogEvent
WfpAuditPolicyNotifyCreate
WfpAuditPolicyNotifyOnChange
WfpCreateFastRWLock
WfpCriticalSectionCreate
WfpMidlObjectDecode
WfpMidlObjectDestroy
WfpMidlObjectEncode
WfpMidlObjectInit
WfpPnPInitProtocolState
WfpPnPLookupLocalIFProperties
WfpPnPNotifyInit
WfpPnPRegisterForAddressListChange
WfpPoolInit
WfpPoolPop
WfpRegCreateKey
WfpRegOpenKey
WfpRegQueryBinary
WfpRegQueryDWord
WfpRegQueryNumValues
WfpRegQueryString
WfpRegSetBinary
WfpReportAppErrorAsWinError
WfpServiceChangeState
WfpServiceHandlerEx
WfpServiceMain
WfpStartTimer
WfpStringCopyWtoAAlloc
WfpStringExpand
| |paramcount|4|4| |`address`|180042468|180042758| |sig|longlong __fastcall WfpReportSysErrorAsWinError(undefined8 param_1, char * param_2, ulonglong param_3, int param_4)|longlong __fastcall WfpReportSysErrorAsWinError(undefined8 param_1, char * param_2, ulonglong param_3, int param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WfpReportSysErrorAsWinError Calling Diff ```diff --- WfpReportSysErrorAsWinError calling +++ WfpReportSysErrorAsWinError calling @@ -12,2 +12,2 @@ -FUN_180035390 -FUN_18004c789 +FUN_180035620 +FUN_18004ca69 @@ -155 +154,0 @@ -IkeHandleErrorNotifyIkeV2 @@ -163 +161,0 @@ -IkeHandleNotifyIkeV2 @@ -172 +169,0 @@ -IkeHandleStatusNotifyIkeV2 @@ -387 +383,0 @@ -IkeVerifyDosCookieIkeV2 @@ -392,0 +389 @@ +IkeVerifyPacketHeader ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-28T09:07:22