# ipn-963.dll-ipn-2283.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [V2DhcpProcessMessage](#v2dhcpprocessmessage) * [DhcpProcessMessage](#dhcpprocessmessage) * [Modified (No Code Changes)](#modified-no-code-changes) # Visual Chart Diff ```mermaid flowchart LR V2DhcpProcessMessage-2-old<--Match 87%-->V2DhcpProcessMessage-2-new DhcpProcessMessage-2-old<--Match 87%-->DhcpProcessMessage-2-new subgraph ipn-2283.dll V2DhcpProcessMessage-2-new DhcpProcessMessage-2-new end subgraph ipn-963.dll V2DhcpProcessMessage-2-old DhcpProcessMessage-2-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 3522 ``` ```mermaid pie showData title Matched Function Similarity - 99.9432% "matched_funcs_with_code_changes_len" : 2 "matched_funcs_with_non_code_changes_len" : 0 "matched_funcs_no_changes_len" : 3520 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name ipn-38148 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 ipn-963.dll ipn-2283.dll ``` #### Verbose Args

``` --old ['ipn-963.dll'] --new [['ipn-2283.dll']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name ipn-38148 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/IPNATHLP.DLL/1964AFC5A5000/IPNATHLP.DLL -O ipnathlp.dll.x64.10.0.22621.1918 wget https://msdl.microsoft.com/download/symbols/IPNATHLP.DLL/0766216BA5000/IPNATHLP.DLL -O ipnathlp.dll.x64.10.0.22621.1244 ``` ## Binary Metadata Diff ```diff --- ipn-963.dll Meta +++ ipn-2283.dll Meta @@ -1,44 +1,44 @@ -Program Name: ipn-963.dll +Program Name: ipn-2283.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f # of Bytes: 680752 # of Memory Blocks: 9 -# of Instructions: 126159 +# of Instructions: 126161 # of Defined Data: 4797 # of Functions: 1761 # of Symbols: 15313 # of Data Types: 981 # of Data Type Categories: 57 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 12:11:31 SGT 2026 +Date Created: Sun Aug 16 12:11:35 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ipnathlp-38148/ipn-963.dll -Executable MD5: bbf9a008656de6f70e6b66344554bcce -Executable SHA256: ff29257cad0e53545286174fd7f04a819bb3989d09a6bcbea5a0f06b50b2a191 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ipnathlp-38148/ipn-963.dll?MD5=bbf9a008656de6f70e6b66344554bcce +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ipnathlp-38148/ipn-2283.dll +Executable MD5: 226d9b018681ab909fbc53ad22efe30c +Executable SHA256: 108a9bd863741f51f104c928f075bc5297fc98f9b4ed21bb1140b5c800599a3b +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/ipnathlp-38148/ipn-2283.dll?MD5=226d9b018681ab909fbc53ad22efe30c PDB Age: 1 PDB File: ipnathlp.pdb -PDB GUID: bbd4ee9e-5e73-b703-65d8-68d87ca73c6e +PDB GUID: b77a4c97-1bad-0b3c-ac9f-637d276ca89e PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft NAT Helper Components -PE Property[FileVersion]: 10.0.22621.1918 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.1244 (WinBuild.160101.0800) PE Property[InternalName]: IPNATHLP.DLL PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: IPNATHLP.DLL PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.1918 +PE Property[ProductVersion]: 10.0.22621.1244 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra ipn-963.dll Decompiler Options

Ghidra ipn-963.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ipn-963.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra ipn-2283.dll Decompiler Options

Ghidra ipn-2283.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra ipn-2283.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|2| |added_symbols_len|2| |deleted_symbols_len|2| |diff_time|3.713819980621338| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1757, 'ExternalsName': 366})| |items_to_process|6| |diff_types|Counter({'code': 2, 'length': 2, 'address': 1})| |unmatched_funcs_len|0| |total_funcs_len|3522| |matched_funcs_len|3522| |matched_funcs_with_code_changes_len|2| |matched_funcs_with_non_code_changes_len|0| |matched_funcs_no_changes_len|3520| |match_func_similarity_percent|99.9432%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'SymbolsHash': 1757})| ```mermaid pie showData title All Matches "SymbolsHash" : 1757 "ExternalsName" : 366 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1757 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 2 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 2 "deleted_symbols_len" : 2 ``` ## Strings *No string differences found* # Deleted # Added # Modified *Modified functions contain code changes* ## V2DhcpProcessMessage ### Match Info |Key|ipn-963.dll - ipn-2283.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.74| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|ipn-963.dll|ipn-2283.dll| | :---: | :---: | :---: | |name|V2DhcpProcessMessage|V2DhcpProcessMessage| |fullname|V2DhcpProcessMessage|V2DhcpProcessMessage| |refcount|2|2| |`length`|1604|1613| |called|

Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
NhQueryAddressSocket
NhReadDatagramSocket
NhReleaseBuffer
V2DhcpCancelLease
V2DhcpCleanupInterface
V2DhcpDeferReadInterface
V2DhcpExtractOptionsFromMessage
V2DhcpIsLocalHardwareAddress
V2DhcpProcessBootpMessage

V2DhcpProcessDiscoverMessage
V2DhcpProcessInformMessage
V2DhcpProcessRequestMessage
V2DhcpRemoveArpEntry
V2DumpDhcpHeaderInfo
WPP_SF_
WPP_SF_D
WPP_SF_Dd
WPP_SF_d
__security_check_cookie
memset

| |calling|V2DhcpReadCompletionRoutine|V2DhcpReadCompletionRoutine| |paramcount|2|2| |`address`|1800746f4|180074704| |sig|void __cdecl V2DhcpProcessMessage(_V2_DHCP_INTERFACE * param_1, _NH_BUFFER * param_2)|void __cdecl V2DhcpProcessMessage(_V2_DHCP_INTERFACE * param_1, _NH_BUFFER * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### V2DhcpProcessMessage Diff ```diff --- V2DhcpProcessMessage +++ V2DhcpProcessMessage @@ -1,243 +1,239 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* void __cdecl V2DhcpProcessMessage(struct _V2_DHCP_INTERFACE * __ptr64,struct _NH_BUFFER * __ptr64) */ void __cdecl V2DhcpProcessMessage(_V2_DHCP_INTERFACE *param_1,_NH_BUFFER *param_2) { LPCRITICAL_SECTION lpCriticalSection; _V2_DHCP_INTERFACE *p_Var1; _NH_BUFFER *p_Var2; int iVar3; byte bVar4; - undefined *puVar5; - uchar uVar6; - ulong uVar7; - undefined2 uVar8; + uchar uVar5; + ulong uVar6; + undefined2 uVar7; undefined1 auStackY_b8 [32]; _DHCP_OPTION *local_88; longlong local_80; longlong local_78; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_b8; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (5 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x66, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); - } - puVar5 = WPP_GLOBAL_Control; + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); + } memset(&local_88,0,0x40); - if (0x20 < (byte)param_2[0xe6]) { - if ((((undefined **)puVar5 != &WPP_GLOBAL_Control) && ((puVar5[0x1c] & 2) != 0)) && - (3 < (byte)puVar5[0x19])) { - WPP_SF_Dd(*(undefined8 *)(puVar5 + 0x10),0x67,&WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids - ,(uint)(byte)param_2[0xe6]); - } - LOCK(); - _V2DhcpStatistics = _V2DhcpStatistics + 1; - UNLOCK(); - } V2DumpDhcpHeaderInfo(param_2); - uVar7 = V2DhcpExtractOptionsFromMessage - ((_DHCP_HEADER *)(param_2 + 0xe4),*(ulong *)(param_2 + 0xdc),&local_88); - if (uVar7 != 0) goto LAB_0; - if (local_80 == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x68, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); - } - V2DhcpProcessBootpMessage(param_1,param_2,&local_88); - goto LAB_1; - } - if ((byte)param_2[0xe6] < 0x11) { + if ((byte)param_2[0xe6] < 0x21) { + uVar6 = V2DhcpExtractOptionsFromMessage + ((_DHCP_HEADER *)(param_2 + 0xe4),*(ulong *)(param_2 + 0xdc),&local_88); + if (uVar6 != 0) goto LAB_0; + if (local_80 == 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x68, + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); + } + V2DhcpProcessBootpMessage(param_1,param_2,&local_88); + goto LAB_1; + } + if (0x10 < (byte)param_2[0xe6]) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + uVar7 = 0x69; +LAB_2: + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); + } + goto LAB_0; + } p_Var2 = param_2 + 0x100; - uVar6 = V2DhcpIsLocalHardwareAddress((uchar *)p_Var2,(uint)(byte)param_2[0xe6]); - if (uVar6 != '\0') { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x6a; + uVar5 = V2DhcpIsLocalHardwareAddress((uchar *)p_Var2,(uint)(byte)param_2[0xe6]); + if (uVar5 != '\0') { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + uVar7 = 0x6a; goto LAB_2; } goto LAB_0; } bVar4 = *(byte *)(local_80 + 2); if (bVar4 == 1) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6b, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _DAT_3 = _DAT_3 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6c, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } V2DhcpProcessDiscoverMessage(param_1,param_2,&local_88); } else if (bVar4 == 3) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6d, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _DAT_4 = _DAT_4 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6e, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } V2DhcpProcessRequestMessage(param_1,param_2,&local_88); } else if (bVar4 == 4) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x71, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _DAT_5 = _DAT_5 + 1; UNLOCK(); if (local_78 == 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x72; + uVar7 = 0x72; LAB_6: - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } } else { if (V2DhcpArpForDad == 0) { - uVar7 = *(ulong *)(local_78 + 2); - V2DhcpRemoveArpEntry(param_1,uVar7); - V2DhcpCancelLease(param_1,uVar7,(uchar *)p_Var2,(uint)(byte)param_2[0xe6]); + uVar6 = *(ulong *)(local_78 + 2); + V2DhcpRemoveArpEntry(param_1,uVar6); + V2DhcpCancelLease(param_1,uVar6,(uchar *)p_Var2,(uint)(byte)param_2[0xe6]); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x73; + uVar7 = 0x73; goto LAB_6; } } } else if (bVar4 == 7) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x74, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _DAT_7 = _DAT_7 + 1; UNLOCK(); if (V2DhcpArpForDad == 0) { V2DhcpRemoveArpEntry(param_1,*(ulong *)(param_2 + 0xf0)); V2DhcpCancelLease(param_1,*(ulong *)(param_2 + 0xf0),(uchar *)p_Var2, (uint)(byte)param_2[0xe6]); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x75; + uVar7 = 0x75; goto LAB_6; } } else if (bVar4 == 8) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6f, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _DAT_8 = _DAT_8 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x70, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } V2DhcpProcessInformMessage(param_1,param_2,&local_88); } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x76, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } LOCK(); _V2DhcpStatistics = _V2DhcpStatistics + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x77, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids,(uint)bVar4); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids,(uint)bVar4); } } } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x69; -LAB_2: - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + WPP_SF_Dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x67, + &WPP_4152477554a43575dbb0159d785768f9_Traceguids,(uint)(byte)param_2[0xe6]); } LAB_0: LOCK(); _V2DhcpStatistics = _V2DhcpStatistics + 1; UNLOCK(); } LAB_1: EnterCriticalSection(&V2DhcpInterfaceLock); if (*(int *)(param_1 + 0x7c) < 0) { LeaveCriticalSection(&V2DhcpInterfaceLock); } else { LOCK(); *(int *)(param_1 + 0x38) = *(int *)(param_1 + 0x38) + 1; UNLOCK(); LeaveCriticalSection(&V2DhcpInterfaceLock); lpCriticalSection = (LPCRITICAL_SECTION)(param_1 + 0x10); EnterCriticalSection(lpCriticalSection); - uVar7 = NhReadDatagramSocket + uVar6 = NhReadDatagramSocket (&V2DhcpComponentReference,*(_NH_RCSOCKET **)(param_2 + 0x10),param_2, V2DhcpReadCompletionRoutine,*(void **)(param_2 + 0x20), *(void **)(param_2 + 0x28)); LeaveCriticalSection(lpCriticalSection); - if (uVar7 == 0) goto LAB_9; - if (uVar7 != 0x2736) { + if (uVar6 == 0) goto LAB_9; + if (uVar6 != 0x2736) { EnterCriticalSection(lpCriticalSection); V2DhcpDeferReadInterface(param_1,*(_NH_RCSOCKET **)(param_2 + 0x10)); LeaveCriticalSection(lpCriticalSection); } LOCK(); p_Var1 = param_1 + 0x38; iVar3 = *(int *)p_Var1; *(int *)p_Var1 = *(int *)p_Var1 + -1; UNLOCK(); if (iVar3 == 1) { V2DhcpCleanupInterface(param_1); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x78, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids,uVar7); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids,uVar6); } NhQueryAddressSocket(*(_NH_RCSOCKET **)(param_2 + 0x10)); } NhReleaseBuffer(param_2); LAB_9: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (5 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x79, - &WPP_b2f20779d5d63dcb459d2225129131f8_Traceguids); + &WPP_4152477554a43575dbb0159d785768f9_Traceguids); } return; } ``` ## DhcpProcessMessage ### Match Info |Key|ipn-963.dll - ipn-2283.dll| | :---: | :---: | |diff_type|code,length| |ratio|0.74| |i_ratio|0.54| |m_ratio|1.0| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|ipn-963.dll|ipn-2283.dll| | :---: | :---: | :---: | |name|DhcpProcessMessage|DhcpProcessMessage| |fullname|DhcpProcessMessage|DhcpProcessMessage| |refcount|2|2| |`length`|1592|1601| |called|

Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::EnterCriticalSection
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection
DhcpCancelLease
DhcpCleanupInterface
DhcpDeferReadInterface
DhcpExtractOptionsFromMessage
DhcpIsLocalHardwareAddress
DhcpProcessBootpMessage
DhcpProcessDiscoverMessage
DhcpProcessInformMessage
DhcpProcessRequestMessage

DhcpRemoveArpEntry
DumpDhcpHeaderInfo
NhQueryAddressSocket
NhReadDatagramSocket
NhReleaseBuffer
WPP_SF_
WPP_SF_D
WPP_SF_Dd
WPP_SF_d
__security_check_cookie
memset

| |calling|DhcpReadCompletionRoutine|DhcpReadCompletionRoutine| |paramcount|2|2| |address|18001c31c|18001c31c| |sig|void __cdecl DhcpProcessMessage(_DHCP_INTERFACE * param_1, _NH_BUFFER * param_2)|void __cdecl DhcpProcessMessage(_DHCP_INTERFACE * param_1, _NH_BUFFER * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### DhcpProcessMessage Diff ```diff --- DhcpProcessMessage +++ DhcpProcessMessage @@ -1,241 +1,237 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* void __cdecl DhcpProcessMessage(struct _DHCP_INTERFACE * __ptr64,struct _NH_BUFFER * __ptr64) */ void __cdecl DhcpProcessMessage(_DHCP_INTERFACE *param_1,_NH_BUFFER *param_2) { LPCRITICAL_SECTION lpCriticalSection; _DHCP_INTERFACE *p_Var1; _NH_BUFFER *p_Var2; int iVar3; byte bVar4; - undefined *puVar5; - uchar uVar6; - ulong uVar7; - undefined2 uVar8; + uchar uVar5; + ulong uVar6; + undefined2 uVar7; undefined1 auStackY_b8 [32]; _DHCP_OPTION *local_88; longlong local_80; longlong local_78; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_b8; if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (5 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x60, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); - } - puVar5 = WPP_GLOBAL_Control; + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); + } memset(&local_88,0,0x40); - if (0x20 < (byte)param_2[0xe6]) { - if ((((undefined **)puVar5 != &WPP_GLOBAL_Control) && ((puVar5[0x1c] & 2) != 0)) && - (3 < (byte)puVar5[0x19])) { - WPP_SF_Dd(*(undefined8 *)(puVar5 + 0x10),0x61,&WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids - ,(uint)(byte)param_2[0xe6]); - } - LOCK(); - _DhcpStatistics = _DhcpStatistics + 1; - UNLOCK(); - } DumpDhcpHeaderInfo(param_2); - uVar7 = DhcpExtractOptionsFromMessage - ((_DHCP_HEADER *)(param_2 + 0xe4),*(ulong *)(param_2 + 0xdc),&local_88); - if (uVar7 != 0) goto LAB_0; - if (local_80 == 0) { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x62, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); - } - DhcpProcessBootpMessage(param_1,param_2,&local_88); - goto LAB_1; - } - if ((byte)param_2[0xe6] < 0x11) { + if ((byte)param_2[0xe6] < 0x21) { + uVar6 = DhcpExtractOptionsFromMessage + ((_DHCP_HEADER *)(param_2 + 0xe4),*(ulong *)(param_2 + 0xdc),&local_88); + if (uVar6 != 0) goto LAB_0; + if (local_80 == 0) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x62, + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); + } + DhcpProcessBootpMessage(param_1,param_2,&local_88); + goto LAB_1; + } + if (0x10 < (byte)param_2[0xe6]) { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + uVar7 = 99; +LAB_2: + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); + } + goto LAB_0; + } p_Var2 = param_2 + 0x100; - uVar6 = DhcpIsLocalHardwareAddress((uchar *)p_Var2,(uint)(byte)param_2[0xe6]); - if (uVar6 != '\0') { - if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 100; + uVar5 = DhcpIsLocalHardwareAddress((uchar *)p_Var2,(uint)(byte)param_2[0xe6]); + if (uVar5 != '\0') { + if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { + uVar7 = 100; goto LAB_2; } goto LAB_0; } bVar4 = *(byte *)(local_80 + 2); if (bVar4 == 1) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x65, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); _DAT_3 = _DAT_3 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x66, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } DhcpProcessDiscoverMessage(param_1,param_2,&local_88); } else if (bVar4 == 3) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x67, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); _DAT_4 = _DAT_4 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x68, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } DhcpProcessRequestMessage(param_1,param_2,&local_88); } else if (bVar4 == 4) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6b, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); DAT_5._0_4_ = (int)DAT_5 + 1; UNLOCK(); if (local_78 == 0) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x6c; + uVar7 = 0x6c; LAB_6: - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } } else { if (DhcpArpForDad == 0) { - uVar7 = *(ulong *)(local_78 + 2); - DhcpRemoveArpEntry(uVar7); - DhcpCancelLease(uVar7,(uchar *)p_Var2,(uint)(byte)param_2[0xe6]); + uVar6 = *(ulong *)(local_78 + 2); + DhcpRemoveArpEntry(uVar6); + DhcpCancelLease(uVar6,(uchar *)p_Var2,(uint)(byte)param_2[0xe6]); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x6d; + uVar7 = 0x6d; goto LAB_6; } } } else if (bVar4 == 7) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6e, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); DAT_5._4_4_ = DAT_5._4_4_ + 1; UNLOCK(); if (DhcpArpForDad == 0) { DhcpRemoveArpEntry(*(ulong *)(param_2 + 0xf0)); DhcpCancelLease(*(ulong *)(param_2 + 0xf0),(uchar *)p_Var2,(uint)(byte)param_2[0xe6]); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 0x6f; + uVar7 = 0x6f; goto LAB_6; } } else if (bVar4 == 8) { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x69, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); _DAT_7 = _DAT_7 + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6a, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } DhcpProcessInformMessage(param_1,param_2,&local_88); } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x70, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } LOCK(); _DhcpStatistics = _DhcpStatistics + 1; UNLOCK(); if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x71, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids,(uint)bVar4); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids,(uint)bVar4); } } } else { if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { - uVar8 = 99; -LAB_2: - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar8, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + WPP_SF_Dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x61, + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids,(uint)(byte)param_2[0xe6]); } LAB_0: LOCK(); _DhcpStatistics = _DhcpStatistics + 1; UNLOCK(); } LAB_1: EnterCriticalSection(&DhcpInterfaceLock); if (*(int *)(param_1 + 0x4c) < 0) { LeaveCriticalSection(&DhcpInterfaceLock); } else { LOCK(); *(int *)(param_1 + 0x38) = *(int *)(param_1 + 0x38) + 1; UNLOCK(); LeaveCriticalSection(&DhcpInterfaceLock); lpCriticalSection = (LPCRITICAL_SECTION)(param_1 + 0x10); EnterCriticalSection(lpCriticalSection); - uVar7 = NhReadDatagramSocket + uVar6 = NhReadDatagramSocket (&DhcpComponentReference,*(_NH_RCSOCKET **)(param_2 + 0x10),param_2, DhcpReadCompletionRoutine,*(void **)(param_2 + 0x20), *(void **)(param_2 + 0x28)); LeaveCriticalSection(lpCriticalSection); - if (uVar7 == 0) goto LAB_8; - if (uVar7 != 0x2736) { + if (uVar6 == 0) goto LAB_8; + if (uVar6 != 0x2736) { EnterCriticalSection(lpCriticalSection); DhcpDeferReadInterface(param_1,*(_NH_RCSOCKET **)(param_2 + 0x10)); LeaveCriticalSection(lpCriticalSection); } LOCK(); p_Var1 = param_1 + 0x38; iVar3 = *(int *)p_Var1; *(int *)p_Var1 = *(int *)p_Var1 + -1; UNLOCK(); if (iVar3 == 1) { DhcpCleanupInterface(param_1); } if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x72, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids,uVar7); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids,uVar6); } NhQueryAddressSocket(*(_NH_RCSOCKET **)(param_2 + 0x10)); } NhReleaseBuffer(param_2); LAB_8: if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (5 < (byte)WPP_GLOBAL_Control[0x19])) { WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x73, - &WPP_2a3aeb8dd77c3a1919c551579bb6cf5d_Traceguids); + &WPP_df007ca3347434f5610fc5a17e95e0a3_Traceguids); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T12:13:21}