# lsa_8737.exe-lsa_8875.exe Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [__GSHandlerCheck_SEH](#__gshandlercheck_seh) * [Added](#added) * [Modified](#modified) * [BCryptIumRpcGetClaimKeyFlags](#bcryptiumrpcgetclaimkeyflags) * [BCryptIumGetProperty](#bcryptiumgetproperty) * [BCryptIumFinalizeKeyPair](#bcryptiumfinalizekeypair) * [BCryptIumRpcCleanup](#bcryptiumrpccleanup) * [BCryptIumDecrypt](#bcryptiumdecrypt) * [BCryptIumPingTrustlet](#bcryptiumpingtrustlet) * [BCryptIumDestroyKey](#bcryptiumdestroykey) * [BCryptIumVerifySignature](#bcryptiumverifysignature) * [BCryptIumDeriveKey](#bcryptiumderivekey) * [BCryptIumCloseAlgorithmProvider](#bcryptiumclosealgorithmprovider) * [BCryptIumEncrypt](#bcryptiumencrypt) * [BCryptIumGetIdkSPub](#bcryptiumgetidkspub) * [BCryptIumGenerateSymmetricKey](#bcryptiumgeneratesymmetrickey) * [AllocateBCryptIsoObject](#allocatebcryptisoobject) * [BCryptIumImportKey](#bcryptiumimportkey) * [BCryptIumCheckKey](#bcryptiumcheckkey) * [BCryptIumKeyDerivation](#bcryptiumkeyderivation) * [BCryptIumSignHash](#bcryptiumsignhash) * [BCryptIumDuplicateKey](#bcryptiumduplicatekey) * [BCryptIumDestroySecret](#bcryptiumdestroysecret) * [BCryptIumReleaseContext](#bcryptiumreleasecontext) * [BCryptIumRpcInit](#bcryptiumrpcinit) * [BCryptIumImportKeyPair](#bcryptiumimportkeypair) * [BCryptIumExportKey](#bcryptiumexportkey) * [WPP_SF_ssd](#wpp_sf_ssd) * [BCryptIumGetClientContext](#bcryptiumgetclientcontext) * [BCryptIumSecretAgreement](#bcryptiumsecretagreement) * [FilterPolicyFlags](#filterpolicyflags) * [BCryptIumEncapsulate](#bcryptiumencapsulate) * [BCryptIumCreateClaim](#bcryptiumcreateclaim) * [BCryptIumImportKeyGeneric](#bcryptiumimportkeygeneric) * [BCryptIumSetProperty](#bcryptiumsetproperty) * [BCryptIumGenerateKeyPair](#bcryptiumgeneratekeypair) * [WPP_SF_LDd](#wpp_sf_ldd) * [BCryptIumOpenAlgorithmProvider](#bcryptiumopenalgorithmprovider) * [BCryptIumDecapsulate](#bcryptiumdecapsulate) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared](#api-ms-win-core-synch-l1-1-0dllreleasesrwlockshared) * [__GSHandlerCheckCommon](#__gshandlercheckcommon) * [MSVCRT.DLL::__C_specific_handler](#msvcrtdll__c_specific_handler) * [WPP_SF_](#wpp_sf_) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllreleasesrwlockexclusive) * [VBS_ATTEST_TRACE_ERROR_IN](#vbs_attest_trace_error_in) * [WPP_SF_D](#wpp_sf_d) * [RPCRT4.DLL::I_RpcMapWin32Status](#rpcrt4dlli_rpcmapwin32status) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockshared) # Visual Chart Diff ```mermaid flowchart LR BCryptIumRpcGetClaimKeyFlags-2-old<--Match 98%-->BCryptIumRpcGetClaimKeyFlags-2-new BCryptIumGetProperty-7-old<--Match 75%-->BCryptIumGetProperty-7-new BCryptIumFinalizeKeyPair-3-old<--Match 88%-->BCryptIumFinalizeKeyPair-3-new BCryptIumRpcCleanup-0-old<--Match 85%-->BCryptIumRpcCleanup-0-new BCryptIumDecrypt-11-old<--Match 87%-->BCryptIumDecrypt-11-new BCryptIumPingTrustlet-3-old<--Match 96%-->BCryptIumPingTrustlet-3-new BCryptIumDestroyKey-2-old<--Match 92%-->BCryptIumDestroyKey-2-new BCryptIumVerifySignature-8-old<--Match 89%-->BCryptIumVerifySignature-8-new BCryptIumDeriveKey-8-old<--Match 81%-->BCryptIumDeriveKey-8-new BCryptIumCloseAlgorithmProvider-3-old<--Match 94%-->BCryptIumCloseAlgorithmProvider-3-new BCryptIumEncrypt-11-old<--Match 90%-->BCryptIumEncrypt-11-new BCryptIumGetIdkSPub-4-old<--Match 63%-->BCryptIumGetIdkSPub-4-new BCryptIumGenerateSymmetricKey-7-old<--Match 30%-->BCryptIumGenerateSymmetricKey-7-new AllocateBCryptIsoObject-2-old<--Match 90%-->AllocateBCryptIsoObject-2-new BCryptIumImportKey-10-old<--Match 97%-->BCryptIumImportKey-10-new BCryptIumCheckKey-6-old<--Match 92%-->BCryptIumCheckKey-6-new BCryptIumKeyDerivation-7-old<--Match 89%-->BCryptIumKeyDerivation-7-new BCryptIumSignHash-9-old<--Match 84%-->BCryptIumSignHash-9-new BCryptIumDuplicateKey-6-old<--Match 89%-->BCryptIumDuplicateKey-6-new BCryptIumDestroySecret-2-old<--Match 92%-->BCryptIumDestroySecret-2-new BCryptIumReleaseContext-3-old<--Match 82%-->BCryptIumReleaseContext-3-new BCryptIumRpcInit-1-old<--Match 98%-->BCryptIumRpcInit-1-new BCryptIumImportKeyPair-8-old<--Match 95%-->BCryptIumImportKeyPair-8-new BCryptIumExportKey-8-old<--Match 12%-->BCryptIumExportKey-8-new WPP_SF_ssd-5-old<--Match 97%-->WPP_SF_ssd-5-new BCryptIumGetClientContext-3-old<--Match 91%-->BCryptIumGetClientContext-3-new lsa_8737.exe<--11ommited-->lsa_8875.exe subgraph lsa_8875.exe BCryptIumRpcGetClaimKeyFlags-2-new BCryptIumGetProperty-7-new BCryptIumFinalizeKeyPair-3-new BCryptIumRpcCleanup-0-new BCryptIumDecrypt-11-new BCryptIumPingTrustlet-3-new BCryptIumDestroyKey-2-new BCryptIumVerifySignature-8-new BCryptIumDeriveKey-8-new BCryptIumCloseAlgorithmProvider-3-new BCryptIumEncrypt-11-new BCryptIumGetIdkSPub-4-new BCryptIumGenerateSymmetricKey-7-new AllocateBCryptIsoObject-2-new BCryptIumImportKey-10-new BCryptIumCheckKey-6-new BCryptIumKeyDerivation-7-new BCryptIumSignHash-9-new BCryptIumDuplicateKey-6-new BCryptIumDestroySecret-2-new BCryptIumReleaseContext-3-new BCryptIumRpcInit-1-new BCryptIumImportKeyPair-8-new BCryptIumExportKey-8-new WPP_SF_ssd-5-new BCryptIumGetClientContext-3-new end subgraph lsa_8737.exe BCryptIumRpcGetClaimKeyFlags-2-old BCryptIumGetProperty-7-old BCryptIumFinalizeKeyPair-3-old BCryptIumRpcCleanup-0-old BCryptIumDecrypt-11-old BCryptIumPingTrustlet-3-old BCryptIumDestroyKey-2-old BCryptIumVerifySignature-8-old BCryptIumDeriveKey-8-old BCryptIumCloseAlgorithmProvider-3-old BCryptIumEncrypt-11-old BCryptIumGetIdkSPub-4-old BCryptIumGenerateSymmetricKey-7-old AllocateBCryptIsoObject-2-old BCryptIumImportKey-10-old BCryptIumCheckKey-6-old BCryptIumKeyDerivation-7-old BCryptIumSignHash-9-old BCryptIumDuplicateKey-6-old BCryptIumDestroySecret-2-old BCryptIumReleaseContext-3-old BCryptIumRpcInit-1-old BCryptIumImportKeyPair-8-old BCryptIumExportKey-8-old WPP_SF_ssd-5-old BCryptIumGetClientContext-3-old subgraph Deleted direction LR __GSHandlerCheck_SEH end end ``` ```mermaid pie showData title Function Matches - 99.9628% "unmatched_funcs_len" : 1 "matched_funcs_len" : 2684 ``` ```mermaid pie showData title Matched Function Similarity - 98.0999% "matched_funcs_with_code_changes_len" : 36 "matched_funcs_with_non_code_changes_len" : 15 "matched_funcs_no_changes_len" : 2633 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 lsa_8737.exe lsa_8875.exe ``` #### Verbose Args
``` --old ['lsa_8737.exe'] --new [['lsa_8875.exe']] --engine VersionTrackingDiff --output-path lsa_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/LsaIso.exe/7D07A03462000/LsaIso.exe -O lsaiso.exe.x64.10.0.26100.8737 wget https://msdl.microsoft.com/download/symbols/LsaIso.exe/F972F0E661000/LsaIso.exe -O lsaiso.exe.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- lsa_8737.exe Meta +++ lsa_8875.exe Meta @@ -1,44 +1,44 @@ -Program Name: lsa_8737.exe +Program Name: lsa_8875.exe Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 140000000 Maximum Address: ff0000184f -# of Bytes: 405680 +# of Bytes: 401584 # of Memory Blocks: 10 -# of Instructions: 63461 -# of Defined Data: 5462 -# of Functions: 1343 -# of Symbols: 10904 -# of Data Types: 729 +# of Instructions: 63152 +# of Defined Data: 5442 +# of Functions: 1342 +# of Symbols: 10820 +# of Data Types: 730 # of Data Type Categories: 51 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 22 10:54:29 SGT 2026 +Date Created: Sat Aug 22 10:54:32 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/lsa/lsa_8737.exe -Executable MD5: 3cac919b22d728e9c6c281c92559c40f -Executable SHA256: f4ab2a48426d696b59cdce963780607429848617c4d9b3c2bf8d68c4d1a8d0c0 -FSRL: file:///tmp/lsa/lsa_8737.exe?MD5=3cac919b22d728e9c6c281c92559c40f +Executable Location: /tmp/lsa/lsa_8875.exe +Executable MD5: 3297d74e5bcb1800ce2a4b8519a80797 +Executable SHA256: 2a93f78621cc9ada373d94412fe78fa3f299e91a866b6518b7434e17b41b2109 +FSRL: file:///tmp/lsa/lsa_8875.exe?MD5=3297d74e5bcb1800ce2a4b8519a80797 PDB Age: 1 PDB File: LsaIso.pdb -PDB GUID: d03f5e23-0794-7ae4-07d8-93659847b85f +PDB GUID: 6f42e08c-76ff-5d84-708c-05b556825495 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Credential Guard & VBS Key Isolation -PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: LsaIso.exe PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: LsaIso.exe PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8737 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra lsa_8737.exe Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lsa_8737.exe Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lsa_8737.exe Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra lsa_8875.exe Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lsa_8875.exe Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lsa_8875.exe Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|1| |modified_funcs_len|51| |added_symbols_len|1| |deleted_symbols_len|1| |diff_time|5.473198175430298| |deleted_strings_len|0| |added_strings_len|2| |match_types|Counter({'SymbolsHash': 1323, 'ExternalsName': 287, 'ExactInstructionsFunctionHasher': 7, 'StructuralGraphHash': 2, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| |items_to_process|54| |diff_types|Counter({'address': 44, 'code': 36, 'length': 36, 'called': 24, 'refcount': 16, 'calling': 10, 'sig': 2, 'name': 1, 'fullname': 1})| |unmatched_funcs_len|1| |total_funcs_len|2685| |matched_funcs_len|2684| |matched_funcs_with_code_changes_len|36| |matched_funcs_with_non_code_changes_len|15| |matched_funcs_no_changes_len|2633| |match_func_similarity_percent|98.0999%| |func_match_overall_percent|99.9628%| |first_matches|Counter({'SymbolsHash': 1323, 'ExactInstructionsFunctionHasher': 7, 'StructuralGraphHash': 2, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1323 "ExternalsName" : 287 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 7 "BSIM" : 1 "StructuralGraphHash" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1323 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 7 "BSIM" : 1 "StructuralGraphHash" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 1 "modified_funcs_len" : 51 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 1 "deleted_symbols_len" : 1 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 2 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,2 @@ +u_PrivKeyVal +u_TRUNCATE ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_TRUNCATE|1|BCryptIumDeriveKey| |u_PrivKeyVal|1|BCryptIumSetProperty| # Deleted ## __GSHandlerCheck_SEH ### Function Meta |Key|lsa_8737.exe| | :---: | :---: | |name|__GSHandlerCheck_SEH| |fullname|__GSHandlerCheck_SEH| |refcount|2| |length|134| |called|MSVCRT.DLL::__C_specific_handler
__GSHandlerCheckCommon| |calling|| |paramcount|4| |address|140040114| |sig|undefined __fastcall __GSHandlerCheck_SEH(_EXCEPTION_RECORD * param_1, void * param_2, _CONTEXT * param_3, _DISPATCHER_CONTEXT * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- __GSHandlerCheck_SEH +++ __GSHandlerCheck_SEH @@ -1,18 +0,0 @@ - -void __GSHandlerCheck_SEH - (_EXCEPTION_RECORD *param_1,void *param_2,_CONTEXT *param_3, - _DISPATCHER_CONTEXT *param_4) - -{ - uint uVar1; - uint *puVar2; - - puVar2 = *(uint **)(param_4 + 0x38); - uVar1 = *puVar2; - __GSHandlerCheckCommon(param_2,(longlong)param_4); - if ((puVar2[(ulonglong)uVar1 * 4 + 1] & ((param_1->ExceptionFlags & 0x66) != 0) + 1) != 0) { - __C_specific_handler(param_1,param_2,param_3,param_4); - } - return; -} - ``` # Added # Modified *Modified functions contain code changes* ## BCryptIumRpcGetClaimKeyFlags ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.62| |i_ratio|0.57| |m_ratio|1.0| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumRpcGetClaimKeyFlags|BCryptIumRpcGetClaimKeyFlags| |fullname|BCryptIumRpcGetClaimKeyFlags|BCryptIumRpcGetClaimKeyFlags| |refcount|3|3| |`length`|186|188| |called|WPP_SF_D
WPP_SF_Ld|WPP_SF_D
WPP_SF_Ld| |calling|BCryptIumCreateClaim|BCryptIumCreateClaim| |paramcount|2|2| |`address`|140009080|140008ff0| |sig|long __cdecl BCryptIumRpcGetClaimKeyFlags(_BCRYPT_ISO_OBJECT * param_1, ulong * param_2)|long __cdecl BCryptIumRpcGetClaimKeyFlags(_BCRYPT_ISO_OBJECT * param_1, ulong * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### BCryptIumRpcGetClaimKeyFlags Diff ```diff --- BCryptIumRpcGetClaimKeyFlags +++ BCryptIumRpcGetClaimKeyFlags @@ -1,41 +1,42 @@ /* long __cdecl BCryptIumRpcGetClaimKeyFlags(struct _BCRYPT_ISO_OBJECT * __ptr64,unsigned long * __ptr64) */ long __cdecl BCryptIumRpcGetClaimKeyFlags(_BCRYPT_ISO_OBJECT *param_1,ulong *param_2) { uint uVar1; - uint uVar2; + undefined *puVar2; uint uVar3; + uint uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5a, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,*(undefined4 *)(param_1 + 0x10)); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x58, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,*(undefined4 *)(param_1 + 0x10)); } + puVar2 = WPP_GLOBAL_Control; uVar1 = *(uint *)(param_1 + 0x10); - uVar2 = uVar1 >> 0x1f | 0x10; + uVar3 = uVar1 >> 0x1f | 0x10; if ((uVar1 & 0x20) == 0) { - uVar2 = uVar1 >> 0x1f; + uVar3 = uVar1 >> 0x1f; } if ((uVar1 & 0x10) == 0) { if ((uVar1 & 0x40) != 0) { - uVar2 = uVar2 | 8; + uVar3 = uVar3 | 8; } } else { - uVar2 = uVar2 | 2; + uVar3 = uVar3 | 2; } - uVar3 = uVar2 | 4; + uVar4 = uVar3 | 4; if (((byte)param_1[0x10] & 4) == 0) { - uVar3 = uVar2; + uVar4 = uVar3; } - *param_2 = uVar3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_Ld(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5b,(ulonglong)uVar1,uVar3); + *param_2 = uVar4; + if (((undefined **)puVar2 != &WPP_GLOBAL_Control) && ((puVar2[0x1c] & 4) != 0)) { + WPP_SF_Ld(*(undefined8 *)(puVar2 + 0x10),0x59,(ulonglong)uVar1,uVar4); } return 0; } ``` ## BCryptIumGetProperty ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.2| |m_ratio|0.97| |b_ratio|0.75| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumGetProperty|BCryptIumGetProperty| |fullname|BCryptIumGetProperty|BCryptIumGetProperty| |refcount|3|3| |`length`|720|780| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptGetProperty
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
NTDLL.DLL::memcpy_s
WPP_SF_
WPP_SF_D
WPP_SF_IdWPP_SF_LDd
WPP_SF_Sd
wcscmp
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptGetProperty
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
NTDLL.DLL::memcpy_s
WPP_SF_
WPP_SF_D
WPP_SF_ILWPP_SF_LDd
WPP_SF_Sd
wcscmp
| |calling||| |paramcount|7|7| |`address`|140011c60|140011320| |sig|NTSTATUS __fastcall BCryptIumGetProperty(longlong param_1, __uint64 param_2, wchar_t * param_3, PUCHAR param_4, ULONG param_5, ULONG * param_6, ULONG param_7)|NTSTATUS __fastcall BCryptIumGetProperty(longlong param_1, __uint64 param_2, wchar_t * param_3, PUCHAR param_4, ULONG param_5, ULONG * param_6, ULONG param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumGetProperty Called Diff ```diff --- BCryptIumGetProperty called +++ BCryptIumGetProperty called @@ -11 +11 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumGetProperty Diff ```diff --- BCryptIumGetProperty +++ BCryptIumGetProperty @@ -1,94 +1,102 @@ NTSTATUS BCryptIumGetProperty (longlong param_1,__uint64 param_2,wchar_t *param_3,PUCHAR param_4,ULONG param_5, ULONG *param_6,ULONG param_7) { bool bVar1; bool bVar2; int iVar3; NTSTATUS NVar4; BCRYPTIUM_CONTEXT *pBVar5; _BCRYPT_ISO_OBJECT *p_Var6; + NTSTATUS unaff_EBX; undefined8 uVar7; - NVar4 = 0; bVar1 = false; - bVar2 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6c, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x68, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar5 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar5 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar4 = -0x3fffffde; + return unaff_EBX; } - else { - uVar7 = 0; - p_Var6 = LookupBCryptIsoObject(pBVar5,param_2,0); - if (p_Var6 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar4 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6d,uVar7,param_2); + if (param_6 == (ULONG *)0x0) { + NVar4 = -0x3ffffff3; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x69, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + } + goto LAB_0; + } + uVar7 = 0; + p_Var6 = LookupBCryptIsoObject(pBVar5,param_2,0); + if (p_Var6 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar4 = -0x3ffffff8; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6a,uVar7,param_2); + } + goto LAB_0; + } + iVar3 = wcscmp(param_3,L"Export Policy"); + if (iVar3 == 0) { + *param_6 = 4; + NVar4 = 0; + if (param_4 != (PUCHAR)0x0) { + if (param_5 != 4) { + NVar4 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_LDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10)); + } + goto LAB_1; } + memcpy_s(param_4,4,p_Var6 + 0x10,4); + NVar4 = 0; } - else { - iVar3 = wcscmp(param_3,L"Export Policy"); - if (iVar3 == 0) { - *param_6 = 4; - if (param_4 != (PUCHAR)0x0) { - if (param_5 == 4) { - memcpy_s(param_4,4,p_Var6 + 0x10,4); - bVar1 = bVar2; - } - else { - NVar4 = -0x3ffffff3; - bVar1 = bVar2; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_LDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10)); - } - } - } - } - else { - iVar3 = wcscmp(param_3,L"ECCCurveNameList"); - if ((iVar3 == 0) || (iVar3 = wcscmp(param_3,L"ParameterSetNameList"), iVar3 == 0)) { - NVar4 = -0x3fffff45; - bVar1 = bVar2; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6f,uVar7,param_3); - } - } - else { - AcquireSRWLockShared((PSRWLOCK)(p_Var6 + 0x28)); - bVar1 = true; - NVar4 = BCryptGetProperty(*(BCRYPT_HANDLE *)(p_Var6 + 8),param_3,param_4,param_5,param_6, - param_7); - if ((NVar4 < 0) && - (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)))) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x71,param_4,param_3); - } - } - } - } +LAB_2: if (bVar1) { ReleaseSRWLockShared((PSRWLOCK)(p_Var6 + 0x28)); } - if (p_Var6 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var6); + } + else { + iVar3 = wcscmp(param_3,L"ECCCurveNameList"); + if ((iVar3 != 0) && (iVar3 = wcscmp(param_3,L"ParameterSetNameList"), iVar3 != 0)) { + AcquireSRWLockShared((PSRWLOCK)(p_Var6 + 0x28)); + bVar1 = true; + bVar2 = true; + NVar4 = BCryptGetProperty(*(BCRYPT_HANDLE *)(p_Var6 + 8),param_3,param_4,param_5,param_6, + param_7); + if ((NVar4 < 0) && + ((bVar1 = bVar2, (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)))) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6e,param_4,param_3); + } + goto LAB_2; } + NVar4 = -0x3fffff45; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x74, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar4); + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6c,uVar7,param_3); } } - return NVar4; +LAB_1: + BCryptIumDereferenceObject(p_Var6); +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x70, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar4); + } + return unaff_EBX; } ``` ## BCryptIumFinalizeKeyPair ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.45| |i_ratio|0.24| |m_ratio|0.91| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumFinalizeKeyPair|BCryptIumFinalizeKeyPair| |fullname|BCryptIumFinalizeKeyPair|BCryptIumFinalizeKeyPair| |refcount|3|3| |`length`|560|468| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptFinalizeKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
FilterPolicyFlags
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptFinalizeKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
FilterPolicyFlags
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL
| |calling||| |paramcount|3|3| |`address`|140011030|140010970| |sig|NTSTATUS __fastcall BCryptIumFinalizeKeyPair(longlong param_1, __uint64 param_2, uint param_3)|NTSTATUS __fastcall BCryptIumFinalizeKeyPair(longlong param_1, __uint64 param_2, uint param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumFinalizeKeyPair Called Diff ```diff --- BCryptIumFinalizeKeyPair called +++ BCryptIumFinalizeKeyPair called @@ -11 +11 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumFinalizeKeyPair Diff ```diff --- BCryptIumFinalizeKeyPair +++ BCryptIumFinalizeKeyPair @@ -1,81 +1,76 @@ NTSTATUS BCryptIumFinalizeKeyPair(longlong param_1,__uint64 param_2,uint param_3) { - bool bVar1; - bool bVar2; - NTSTATUS NVar3; - BCRYPTIUM_CONTEXT *pBVar4; - _BCRYPT_ISO_OBJECT *p_Var5; - undefined8 uVar6; + NTSTATUS NVar1; + BCRYPTIUM_CONTEXT *pBVar2; + _BCRYPT_ISO_OBJECT *p_Var3; + undefined8 uVar4; uint local_res18 [2]; ulong local_res20 [2]; - p_Var5 = (_BCRYPT_ISO_OBJECT *)0x0; - bVar1 = false; - bVar2 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd9, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd6, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - pBVar4 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar4 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar3 = -0x3fffffde; + NVar1 = -0x3fffffde; } else { local_res20[0] = 0; local_res18[0] = param_3 & 0x7fffffff; if ((param_3 & 3) == 0) { - uVar6 = 0x42494f4b; - p_Var5 = LookupBCryptIsoObject(pBVar4,param_2,0x42494f4b); - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar3 = -0x3ffffff8; - bVar1 = bVar2; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdb,uVar6,param_2); + uVar4 = 0x42494f4b; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + NVar1 = -0x3ffffff8; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd8,uVar4,param_2); + NVar1 = -0x3ffffff8; } } else { FilterPolicyFlags(local_res18,local_res20); - AcquireSRWLockExclusive((PSRWLOCK)(p_Var5 + 0x28)); - bVar1 = true; - NVar3 = BCryptFinalizeKeyPair(*(BCRYPT_KEY_HANDLE *)(p_Var5 + 8),local_res18[0]); - if (NVar3 < 0) { + AcquireSRWLockExclusive((PSRWLOCK)(p_Var3 + 0x28)); + NVar1 = BCryptFinalizeKeyPair(*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),local_res18[0]); + if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdd,uVar6, - *(undefined8 *)(p_Var5 + 0x18)); + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xda,uVar4, + *(undefined8 *)(p_Var3 + 0x18)); } } else { - *(uint *)(p_Var5 + 0x10) = *(uint *)(p_Var5 + 0x10) & 0x80000000 | local_res20[0]; - *(undefined4 *)(p_Var5 + 0x24) = 1; + *(undefined4 *)(p_Var3 + 0x24) = 1; + *(uint *)(p_Var3 + 0x10) = *(uint *)(p_Var3 + 0x10) & 0x80000000 | local_res20[0]; } + ReleaseSRWLockExclusive((PSRWLOCK)(p_Var3 + 0x28)); + BCryptIumDereferenceObject(p_Var3); } } else { - NVar3 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xda, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff3; } - } - if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var5); - } - if (bVar1) { - ReleaseSRWLockExclusive((PSRWLOCK)(p_Var5 + 0x28)); + NVar1 = -0x3ffffff3; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd7, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + NVar1 = -0x3ffffff3; + } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe0, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar3); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdc, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } - return NVar3; + return NVar1; } ``` ## BCryptIumRpcCleanup ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.55| |i_ratio|0.13| |m_ratio|0.92| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumRpcCleanup|BCryptIumRpcCleanup| |fullname|BCryptIumRpcCleanup|BCryptIumRpcCleanup| |refcount|2|2| |`length`|162|188| |`called`|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventUnregister
BCryptIumContextManagerCleanUp
RPCRT4.DLL::RpcServerUnregisterIf
WPP_SF_|API-MS-WIN-EVENTING-PROVIDER-L1-1-0.DLL::EventUnregister
BCryptIumContextManagerCleanUp
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::RpcServerUnregisterIf
WPP_SF_
WPP_SF_D| |calling|wmain|wmain| |paramcount|0|0| |`address`|140008f98|140008f2c| |sig|void __cdecl BCryptIumRpcCleanup(void)|void __cdecl BCryptIumRpcCleanup(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### BCryptIumRpcCleanup Called Diff ```diff --- BCryptIumRpcCleanup called +++ BCryptIumRpcCleanup called @@ -2,0 +3 @@ +RPCRT4.DLL::I_RpcMapWin32Status @@ -4,0 +6 @@ +WPP_SF_D ``` ### BCryptIumRpcCleanup Diff ```diff --- BCryptIumRpcCleanup +++ BCryptIumRpcCleanup @@ -1,31 +1,34 @@ /* void __cdecl BCryptIumRpcCleanup(void) */ void __cdecl BCryptIumRpcCleanup(void) { + RPC_STATUS Status; + long lVar1; REGHANDLE RegHandle; - undefined8 uVar1; - undefined *puVar2; + undefined8 uVar2; + undefined *puVar3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x57, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x56, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - puVar2 = (undefined *)0x0; - uVar1 = 0; - RpcServerUnregisterIf(&DAT_0,(UUID *)0x0,0); + puVar3 = (undefined *)0x0; + uVar2 = 0; + Status = RpcServerUnregisterIf(&DAT_0,(UUID *)0x0,0); + lVar1 = I_RpcMapWin32Status(Status); RegHandle = DAT_1; + DAT_1 = 0; DAT_2 = 0; - DAT_1 = 0; EventUnregister(RegHandle); - BCryptIumContextManagerCleanUp(RegHandle,uVar1,puVar2); + BCryptIumContextManagerCleanUp(RegHandle,uVar2,puVar3); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x59, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x57, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } return; } ``` ## BCryptIumDecrypt ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,refcount,length,called| |ratio|0.55| |i_ratio|0.33| |m_ratio|0.97| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDecrypt|BCryptIumDecrypt| |fullname|BCryptIumDecrypt|BCryptIumDecrypt| |`refcount`|3|5| |`length`|547|543| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDecrypt
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDecrypt
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL| |calling||| |paramcount|11|11| |address|140002120|140002120| |sig|NTSTATUS __fastcall BCryptIumDecrypt(longlong param_1, __uint64 param_2, PUCHAR param_3, ULONG param_4, longlong param_5, PUCHAR param_6, ULONG param_7, PUCHAR param_8, ULONG param_9, ULONG * param_10, ULONG param_11)|NTSTATUS __fastcall BCryptIumDecrypt(longlong param_1, __uint64 param_2, PUCHAR param_3, ULONG param_4, longlong param_5, PUCHAR param_6, ULONG param_7, PUCHAR param_8, ULONG param_9, ULONG * param_10, ULONG param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDecrypt Called Diff ```diff --- BCryptIumDecrypt called +++ BCryptIumDecrypt called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -8 +10 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumDecrypt Diff ```diff --- BCryptIumDecrypt +++ BCryptIumDecrypt @@ -1,65 +1,68 @@ NTSTATUS BCryptIumDecrypt(longlong param_1,__uint64 param_2,PUCHAR param_3,ULONG param_4, longlong param_5,PUCHAR param_6,ULONG param_7,PUCHAR param_8,ULONG param_9, ULONG *param_10,ULONG param_11) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; + undefined8 uVar4; void *pPaddingInfo; - undefined8 uVar4; - pPaddingInfo = (void *)0x0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9f, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x97, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); NVar1 = -0x3fffffde; } else { uVar4 = 0x42494f4b; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { NVar1 = -0x3ffffff8; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa0,uVar4,param_2); - } - } - else if ((*(uint *)(p_Var3 + 0x10) & 0x70) == 0) { - if (param_5 != 0) { - pPaddingInfo = *(void **)(param_5 + 8); - } - NVar1 = BCryptDecrypt(*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),param_3,param_4,pPaddingInfo,param_6, - param_7,param_8,param_9,param_10,param_11); - if (((NVar1 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa2, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x98,uVar4,param_2); + NVar1 = -0x3ffffff8; } } else { - NVar1 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa1, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); + if ((*(uint *)(p_Var3 + 0x10) & 0x70) == 0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + pPaddingInfo = (void *)0x0; + if (param_5 != 0) { + pPaddingInfo = *(void **)(param_5 + 8); + } + NVar1 = BCryptDecrypt(*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),param_3,param_4,pPaddingInfo, + param_6,param_7,param_8,param_9,param_10,param_11); + if (((NVar1 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9b, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); + } + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); } - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { + else { + NVar1 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x99, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc00000bb); + } + } BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9d, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } return NVar1; } ``` ## BCryptIumPingTrustlet ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.85| |i_ratio|0.34| |m_ratio|0.99| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumPingTrustlet|BCryptIumPingTrustlet| |fullname|BCryptIumPingTrustlet|BCryptIumPingTrustlet| |refcount|3|3| |`length`|225|218| |called|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
WPP_SF_
WPP_SF_D
wil::details::in1diag3::Return_Hr|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
WPP_SF_
WPP_SF_D
wil::details::in1diag3::Return_Hr| |calling||| |paramcount|3|3| |`address`|140012680|140011bd0| |sig|undefined8 __fastcall BCryptIumPingTrustlet(longlong param_1, int param_2, int * param_3)|undefined8 __fastcall BCryptIumPingTrustlet(longlong param_1, int param_2, int * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumPingTrustlet Diff ```diff --- BCryptIumPingTrustlet +++ BCryptIumPingTrustlet @@ -1,37 +1,37 @@ undefined8 BCryptIumPingTrustlet(longlong param_1,int param_2,int *param_3) { undefined8 *puVar1; undefined8 uVar2; void *unaff_retaddr; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11b, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x121, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } puVar1 = BCryptIumContextManagerGetContext(param_1); if (puVar1 == (undefined8 *)0x0) { Sleep(5); uVar2 = 0xc0000022; } else if (param_3 == (int *)0x0) { wil::details::in1diag3::Return_Hr - (unaff_retaddr,0xd1d, + (unaff_retaddr,0xd51, "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", -0x7fffbffd); uVar2 = 0x80004003; } else { *param_3 = param_2 + 1; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11d, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x122, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0); } uVar2 = 0; } return uVar2; } ``` ## BCryptIumDestroyKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.39| |m_ratio|0.94| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDestroyKey|BCryptIumDestroyKey| |fullname|BCryptIumDestroyKey|BCryptIumDestroyKey| |refcount|3|3| |`length`|329|288| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL| |calling||| |paramcount|2|2| |`address`|14000fc70|14000f940| |sig|long __fastcall BCryptIumDestroyKey(longlong param_1, __uint64 param_2)|long __fastcall BCryptIumDestroyKey(longlong param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDestroyKey Called Diff ```diff --- BCryptIumDestroyKey called +++ BCryptIumDestroyKey called @@ -8 +8 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumDestroyKey Diff ```diff --- BCryptIumDestroyKey +++ BCryptIumDestroyKey @@ -1,47 +1,47 @@ long BCryptIumDestroyKey(longlong param_1,__uint64 param_2) { long lVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; undefined8 uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe1, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdd, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); lVar1 = -0x3fffffde; } else { uVar4 = 0x42494f4b; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { lVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe2,uVar4,param_2); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xde,uVar4,param_2); } } else { lVar1 = UnindexBCryptIsoObject(pBVar2,p_Var3,0x42494f4b); if (-1 < lVar1) { BCryptIumDereferenceObject(p_Var3); } - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xdf, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } } return lVar1; } ``` ## BCryptIumVerifySignature ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.59| |i_ratio|0.36| |m_ratio|0.97| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumVerifySignature|BCryptIumVerifySignature| |fullname|BCryptIumVerifySignature|BCryptIumVerifySignature| |refcount|3|3| |`length`|458|450| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptVerifySignature
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
_UnpackPaddingInfoPtr|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptVerifySignature
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL
_UnpackPaddingInfoPtr
| |calling||| |paramcount|8|8| |`address`|1400131e0|1400125c0| |sig|NTSTATUS __fastcall BCryptIumVerifySignature(longlong param_1, __uint64 param_2, _BCRYPTR_PADDING_INFO * param_3, PUCHAR param_4, ULONG param_5, PUCHAR param_6, ULONG param_7, ULONG param_8)|NTSTATUS __fastcall BCryptIumVerifySignature(longlong param_1, __uint64 param_2, _BCRYPTR_PADDING_INFO * param_3, PUCHAR param_4, ULONG param_5, PUCHAR param_6, ULONG param_7, ULONG param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumVerifySignature Called Diff ```diff --- BCryptIumVerifySignature called +++ BCryptIumVerifySignature called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -8 +10 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumVerifySignature Diff ```diff --- BCryptIumVerifySignature +++ BCryptIumVerifySignature @@ -1,58 +1,63 @@ NTSTATUS BCryptIumVerifySignature (longlong param_1,__uint64 param_2,_BCRYPTR_PADDING_INFO *param_3,PUCHAR param_4, ULONG param_5,PUCHAR param_6,ULONG param_7,ULONG param_8) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; void *pPaddingInfo; undefined8 uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xef, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xea, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); NVar1 = -0x3fffffde; } else { uVar4 = 0x42494f4b; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } NVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf0,uVar4,param_2); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xeb,uVar4,param_2); + NVar1 = -0x3ffffff8; } } - else if ((*(uint *)(p_Var3 + 0x10) & 0x50) == 0) { - pPaddingInfo = _UnpackPaddingInfoPtr(param_3); - NVar1 = BCryptVerifySignature - (*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),pPaddingInfo,param_4,param_5,param_6, - param_7,param_8); - } else { - NVar1 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf1, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); + if ((*(uint *)(p_Var3 + 0x10) & 0x50) == 0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + pPaddingInfo = _UnpackPaddingInfoPtr(param_3); + NVar1 = BCryptVerifySignature + (*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),pPaddingInfo,param_4,param_5,param_6, + param_7,param_8); + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); } - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { + else { + NVar1 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xec, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc00000bb); + } + } BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf3, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xef, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } return NVar1; } ``` ## BCryptIumDeriveKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.37| |i_ratio|0.21| |m_ratio|0.91| |b_ratio|0.81| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDeriveKey|BCryptIumDeriveKey| |fullname|BCryptIumDeriveKey|BCryptIumDeriveKey| |refcount|3|3| |`length`|370|452| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDeriveKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDeriveKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL
WPP_SF_Sdwcscmp
| |calling||| |paramcount|8|8| |`address`|14000fab0|14000f770| |`sig`|undefined8 __fastcall BCryptIumDeriveKey(longlong param_1, __uint64 param_2, LPCWSTR param_3, BCryptBufferDesc * param_4, PUCHAR param_5, ULONG param_6, ULONG * param_7, ULONG param_8)|NTSTATUS __fastcall BCryptIumDeriveKey(longlong param_1, __uint64 param_2, wchar_t * param_3, BCryptBufferDesc * param_4, PUCHAR param_5, ULONG param_6, ULONG * param_7, ULONG param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDeriveKey Called Diff ```diff --- BCryptIumDeriveKey called +++ BCryptIumDeriveKey called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -8 +10,3 @@ -WPP_SF_Id +WPP_SF_IL +WPP_SF_Sd +wcscmp ``` ### BCryptIumDeriveKey Diff ```diff --- BCryptIumDeriveKey +++ BCryptIumDeriveKey @@ -1,47 +1,60 @@ -undefined8 -BCryptIumDeriveKey(longlong param_1,__uint64 param_2,LPCWSTR param_3,BCryptBufferDesc *param_4, - PUCHAR param_5,ULONG param_6,ULONG *param_7,ULONG param_8) +NTSTATUS BCryptIumDeriveKey(longlong param_1,__uint64 param_2,wchar_t *param_3, + BCryptBufferDesc *param_4,PUCHAR param_5,ULONG param_6,ULONG *param_7, + ULONG param_8) { - BCRYPTIUM_CONTEXT *pBVar1; - undefined8 uVar2; - _BCRYPT_ISO_OBJECT *p_Var3; - undefined8 uVar4; + int iVar1; + NTSTATUS NVar2; + BCRYPTIUM_CONTEXT *pBVar3; + _BCRYPT_ISO_OBJECT *p_Var4; + undefined8 uVar5; - uVar2 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfc, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfb, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - pBVar1 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar1 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - uVar2 = 0xc0000022; + NVar2 = -0x3fffffde; } else { - uVar4 = 0x42494f53; - p_Var3 = LookupBCryptIsoObject(pBVar1,param_2,0x42494f53); - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfd,uVar4,param_2); + uVar5 = 0x42494f53; + p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0x42494f53); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + NVar2 = -0x3ffffff8; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfc,uVar5,param_2); + NVar2 = -0x3ffffff8; } } else { - BCryptDeriveKey(*(BCRYPT_SECRET_HANDLE *)(p_Var3 + 8),param_3,param_4,param_5,param_6,param_7, - param_8); - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var3); + if ((param_3 == (wchar_t *)0x0) || (iVar1 = wcscmp(param_3,L"TRUNCATE"), iVar1 != 0)) { + AcquireSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + NVar2 = BCryptDeriveKey(*(BCRYPT_SECRET_HANDLE *)(p_Var4 + 8),param_3,param_4,param_5, + param_6,param_7,param_8); + ReleaseSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + } + else { + NVar2 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfd,uVar5,param_3); + } + } + BCryptIumDereferenceObject(p_Var4); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xff, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x100, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar2); } } - return uVar2; + return NVar2; } ``` ## BCryptIumCloseAlgorithmProvider ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.78| |i_ratio|0.22| |m_ratio|0.95| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumCloseAlgorithmProvider|BCryptIumCloseAlgorithmProvider| |fullname|BCryptIumCloseAlgorithmProvider|BCryptIumCloseAlgorithmProvider| |refcount|3|3| |`length`|409|373| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_I
WPP_SF_Id|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_I
WPP_SF_IL| |calling||| |paramcount|3|3| |`address`|14000f200|14000f0c0| |sig|long __fastcall BCryptIumCloseAlgorithmProvider(longlong param_1, __uint64 param_2, undefined8 param_3)|long __fastcall BCryptIumCloseAlgorithmProvider(longlong param_1, __uint64 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumCloseAlgorithmProvider Called Diff ```diff --- BCryptIumCloseAlgorithmProvider called +++ BCryptIumCloseAlgorithmProvider called @@ -9 +9 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumCloseAlgorithmProvider Diff ```diff --- BCryptIumCloseAlgorithmProvider +++ BCryptIumCloseAlgorithmProvider @@ -1,58 +1,58 @@ long BCryptIumCloseAlgorithmProvider(longlong param_1,__uint64 param_2,undefined8 param_3) { long lVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; undefined8 uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_I(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7e,param_3,param_2); + WPP_SF_I(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7a,param_3,param_2); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); lVar1 = -0x3fffffde; } else { uVar4 = 0x42494f41; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f41); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { lVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7f,uVar4,param_2); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7b,uVar4,param_2); } } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x80, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7c, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } lVar1 = UnindexBCryptIsoObject(pBVar2,p_Var3,0x42494f41); if (lVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x81, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7d, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } } else { BCryptIumDereferenceObject(p_Var3); } - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x83, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7e, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } } return lVar1; } ``` ## BCryptIumEncrypt ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.43| |i_ratio|0.37| |m_ratio|0.92| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumEncrypt|BCryptIumEncrypt| |fullname|BCryptIumEncrypt|BCryptIumEncrypt| |refcount|3|3| |`length`|541|470| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptEncrypt
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
_UnpackPaddingInfoPtr
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptEncrypt
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL
_UnpackPaddingInfoPtr
| |calling||| |paramcount|11|11| |`address`|140010510|140010000| |sig|NTSTATUS __fastcall BCryptIumEncrypt(longlong param_1, __uint64 param_2, PUCHAR param_3, ULONG param_4, _BCRYPTR_PADDING_INFO * param_5, PUCHAR param_6, ULONG param_7, PUCHAR param_8, ULONG param_9, ULONG * param_10, ULONG param_11)|NTSTATUS __fastcall BCryptIumEncrypt(longlong param_1, __uint64 param_2, PUCHAR param_3, ULONG param_4, _BCRYPTR_PADDING_INFO * param_5, PUCHAR param_6, ULONG param_7, PUCHAR param_8, ULONG param_9, ULONG * param_10, ULONG param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumEncrypt Called Diff ```diff --- BCryptIumEncrypt called +++ BCryptIumEncrypt called @@ -10 +10 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumEncrypt Diff ```diff --- BCryptIumEncrypt +++ BCryptIumEncrypt @@ -1,61 +1,57 @@ NTSTATUS BCryptIumEncrypt(longlong param_1,__uint64 param_2,PUCHAR param_3,ULONG param_4, _BCRYPTR_PADDING_INFO *param_5,PUCHAR param_6,ULONG param_7,PUCHAR param_8, ULONG param_9,ULONG *param_10,ULONG param_11) { - bool bVar1; - NTSTATUS NVar2; - BCRYPTIUM_CONTEXT *pBVar3; - _BCRYPT_ISO_OBJECT *p_Var4; + NTSTATUS NVar1; + BCRYPTIUM_CONTEXT *pBVar2; + _BCRYPT_ISO_OBJECT *p_Var3; void *pPaddingInfo; - undefined8 uVar5; + undefined8 uVar4; - bVar1 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x98, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x91, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar2 = -0x3fffffde; + NVar1 = -0x3fffffde; } else { - uVar5 = 0x42494f4b; - p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0x42494f4b); - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar2 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x99,uVar5,param_2); + uVar4 = 0x42494f4b; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + NVar1 = -0x3ffffff8; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x92,uVar4,param_2); + NVar1 = -0x3ffffff8; } } else { - AcquireSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); - bVar1 = true; + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); pPaddingInfo = _UnpackPaddingInfoPtr(param_5); - NVar2 = BCryptEncrypt(*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8),param_3,param_4,pPaddingInfo,param_6, + NVar1 = BCryptEncrypt(*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),param_3,param_4,pPaddingInfo,param_6, param_7,param_8,param_9,param_10,param_11); - if (((NVar2 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + if (((NVar1 < 0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9b, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x94, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } - } - if (bVar1) { - ReleaseSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9e, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x96, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } - return NVar2; + return NVar1; } ``` ## BCryptIumGetIdkSPub ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.79| |i_ratio|0.32| |m_ratio|0.97| |b_ratio|0.63| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumGetIdkSPub|BCryptIumGetIdkSPub| |fullname|BCryptIumGetIdkSPub|BCryptIumGetIdkSPub| |refcount|3|3| |`length`|377|358| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
IUMBASE.DLL::GetSecureIdentitySigningKey
NTDLL.DLL::RtlNtStatusToDosError
WPP_SF_
WPP_SF_D|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
IUMBASE.DLL::GetSecureIdentitySigningKey
NTDLL.DLL::RtlNtStatusToDosError
WPP_SF_
WPP_SF_D| |calling||| |paramcount|4|4| |`address`|140011ac0|1400111b0| |sig|DWORD __fastcall BCryptIumGetIdkSPub(longlong param_1, uint * param_2, uint param_3, undefined4 * param_4)|DWORD __fastcall BCryptIumGetIdkSPub(longlong param_1, uint * param_2, uint param_3, undefined4 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumGetIdkSPub Diff ```diff --- BCryptIumGetIdkSPub +++ BCryptIumGetIdkSPub @@ -1,64 +1,64 @@ DWORD BCryptIumGetIdkSPub(longlong param_1,uint *param_2,uint param_3,undefined4 *param_4) { bool bVar1; int iVar2; DWORD DVar3; DWORD DVar4; undefined8 *puVar5; uint *puVar6; DWORD unaff_EBX; - ulonglong local_10; + ulonglong local_28 [2]; - local_10 = (ulonglong)param_3; + local_28[0] = (ulonglong)param_3; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11e, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x123, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } puVar5 = BCryptIumContextManagerGetContext(param_1); if (puVar5 == (undefined8 *)0x0) { Sleep(5); return unaff_EBX; } *param_4 = 0; if ((param_2 == (uint *)0x0) || (param_3 == 0)) { bVar1 = true; } else { bVar1 = false; } puVar6 = (uint *)0x0; if (!bVar1) { puVar6 = param_2; } - iVar2 = GetSecureIdentitySigningKey(puVar6,&local_10); + iVar2 = GetSecureIdentitySigningKey(puVar6,local_28); if (iVar2 == 0) { DVar3 = RtlNtStatusToDosError(0xc0000023); DVar4 = GetLastError(); if (DVar4 == DVar3) goto LAB_0; DVar3 = GetLastError(); if (0 < (int)DVar3) { DVar3 = DVar3 & 0xffff | 0x80070000; } -LAB_1: - if ((DVar3 != 0) || ((local_10 - 0x29 < 0xffffffd7 && ((bVar1 || (0x28 < *param_2)))))) - goto LAB_2; + if (DVar3 != 0) goto LAB_1; +LAB_2: + if ((local_28[0] - 0x29 < 0xffffffd7) && ((bVar1 || (0x28 < *param_2)))) goto LAB_1; } else if (!bVar1) { LAB_0: DVar3 = 0; - *param_4 = (int)local_10; - goto LAB_1; + *param_4 = (int)local_28[0]; + goto LAB_2; } DVar3 = 0x8000ffff; -LAB_2: +LAB_1: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11f, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,DVar3); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x124, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,DVar3); } return unaff_EBX; } ``` ## BCryptIumGenerateSymmetricKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.56| |i_ratio|0.13| |m_ratio|0.93| |b_ratio|0.3| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumGenerateSymmetricKey|BCryptIumGenerateSymmetricKey| |fullname|BCryptIumGenerateSymmetricKey|BCryptIumGenerateSymmetricKey| |refcount|3|3| |`length`|1009|867| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalFree
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptGenRandom
BCRYPT.DLL::BCryptGenerateSymmetricKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObjectFilterPolicyFlags
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_D
WPP_SF_Id
WPP_SF_sD
|
Expand for full list:
API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalFree
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptGenRandom
BCRYPT.DLL::BCryptGenerateSymmetricKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObjectFilterPolicyFlags
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_D
WPP_SF_IL
WPP_SF_sD
| |calling||| |paramcount|7|7| |`address`|1400115c0|140010db0| |sig|NTSTATUS __fastcall BCryptIumGenerateSymmetricKey(longlong param_1, __uint64 param_2, undefined8 * param_3, longlong param_4, int param_5, uint param_6, uint param_7)|NTSTATUS __fastcall BCryptIumGenerateSymmetricKey(longlong param_1, __uint64 param_2, undefined8 * param_3, longlong param_4, int param_5, uint param_6, uint param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumGenerateSymmetricKey Called Diff ```diff --- BCryptIumGenerateSymmetricKey called +++ BCryptIumGenerateSymmetricKey called @@ -16 +16 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumGenerateSymmetricKey Diff ```diff --- BCryptIumGenerateSymmetricKey +++ BCryptIumGenerateSymmetricKey @@ -1,136 +1,124 @@ NTSTATUS BCryptIumGenerateSymmetricKey (longlong param_1,__uint64 param_2,undefined8 *param_3,longlong param_4, int param_5,uint param_6,uint param_7) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; + _BCRYPT_ISO_OBJECT *p_Var3; PUCHAR pbBuffer; - _BCRYPT_ISO_OBJECT *p_Var3; + _BCRYPT_ISO_OBJECT *p_Var4; NTSTATUS unaff_EBX; - undefined8 uVar4; - _BCRYPT_ISO_OBJECT *p_Var5; - PUCHAR pUVar6; - ulong local_44; - int local_40; - BCRYPT_KEY_HANDLE local_38; - _BCRYPT_ISO_OBJECT *local_30; - PUCHAR local_28; + undefined8 uVar5; + ulong local_res20 [2]; + BCRYPT_KEY_HANDLE local_38 [2]; - p_Var5 = (_BCRYPT_ISO_OBJECT *)0x0; - local_30 = (_BCRYPT_ISO_OBJECT *)0x0; - local_40 = 0; - pbBuffer = (PUCHAR)0x0; - pUVar6 = (PUCHAR)0x0; - local_28 = (PUCHAR)0x0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x84,param_3,param_2); + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7f,param_3,param_2); } if ((param_4 == 0) && (param_5 == 0)) { pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); return unaff_EBX; } - local_38 = (void *)0x0; - local_44 = 0; - uVar4 = 0x42494f41; - p_Var5 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f41); - local_30 = p_Var5; - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { + local_38[0] = (void *)0x0; + uVar5 = 0x42494f41; + local_res20[0] = 0; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f41); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } NVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x86,uVar4,param_2); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x81,uVar5,param_2); + NVar1 = -0x3ffffff8; } } else { pbBuffer = LocalAlloc(0,(ulonglong)param_6); - local_28 = pbBuffer; if (pbBuffer == (PUCHAR)0x0) { NVar1 = -0x3fffffe9; } else { NVar1 = BCryptGenRandom((BCRYPT_ALG_HANDLE)0x0,pbBuffer,param_6,2); if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x87, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids, + WPP_SF_sD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x82, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids, "BCryptIumGenerateSymmetricKey"); } } else { param_7 = param_7 & 0x7fffffff; - FilterPolicyFlags(¶m_7,&local_44); - AcquireSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); - local_40 = 1; + FilterPolicyFlags(¶m_7,local_res20); + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); NVar1 = BCryptGenerateSymmetricKey - (*(BCRYPT_ALG_HANDLE *)(p_Var5 + 8),&local_38,(PUCHAR)0x0,0,pbBuffer, + (*(BCRYPT_ALG_HANDLE *)(p_Var3 + 8),local_38,(PUCHAR)0x0,0,pbBuffer, param_6,param_7); if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8b, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x86, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } else { - p_Var3 = AllocateBCryptIsoObject(local_38,0x42494f4b); - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + p_Var4 = AllocateBCryptIsoObject(local_38[0],0x42494f4b); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { NVar1 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x89, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x84, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); } - BCryptDestroyKey(local_38); + BCryptDestroyKey(local_38[0]); } else { - *(ulong *)(p_Var3 + 0x10) = local_44 | 0x80000000; - NVar1 = IndexBCryptIsoObject(pBVar2,p_Var3); + *(ulong *)(p_Var4 + 0x10) = local_res20[0] | 0x80000000; + NVar1 = IndexBCryptIsoObject(pBVar2,p_Var4); if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8a, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x85, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } - BCryptIumDereferenceObject(p_Var3); + BCryptIumDereferenceObject(p_Var4); } else { - *param_3 = *(undefined8 *)(p_Var3 + 0x18); + *param_3 = *(undefined8 *)(p_Var4 + 0x18); } } } + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); } + } + BCryptIumDereferenceObject(p_Var3); + if (pbBuffer != (PUCHAR)0x0) { + LocalFree(pbBuffer); } } } else { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } NVar1 = -0x3ffffff3; - pbBuffer = pUVar6; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x85, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x80, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + NVar1 = -0x3ffffff3; } - } - if (local_40 != 0) { - ReleaseSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); - } - if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var5); - } - if (pbBuffer != (PUCHAR)0x0) { - LocalFree(pbBuffer); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8e, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x88, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } return unaff_EBX; } ``` ## AllocateBCryptIsoObject ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.79| |i_ratio|0.14| |m_ratio|0.94| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|AllocateBCryptIsoObject|AllocateBCryptIsoObject| |fullname|AllocateBCryptIsoObject|AllocateBCryptIsoObject| |refcount|7|7| |`length`|268|302| |`called`|API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeSRWLock
WPP_SF_D
WPP_SF_L|API-MS-WIN-CORE-HEAP-OBSOLETE-L1-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeSRWLock
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
WPP_SF_D
WPP_SF_L| |calling|BCryptIumDuplicateKey
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumImportKeyGeneric
BCryptIumOpenAlgorithmProvider
BCryptIumSecretAgreement|BCryptIumDuplicateKey
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumImportKeyGeneric
BCryptIumOpenAlgorithmProvider
BCryptIumSecretAgreement| |paramcount|2|2| |`address`|1400080bc|14000806c| |sig|_BCRYPT_ISO_OBJECT * __cdecl AllocateBCryptIsoObject(void * param_1, ulong param_2)|_BCRYPT_ISO_OBJECT * __cdecl AllocateBCryptIsoObject(void * param_1, ulong param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### AllocateBCryptIsoObject Called Diff ```diff --- AllocateBCryptIsoObject called +++ AllocateBCryptIsoObject called @@ -1,0 +2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive @@ -2,0 +4 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive ``` ### AllocateBCryptIsoObject Diff ```diff --- AllocateBCryptIsoObject +++ AllocateBCryptIsoObject @@ -1,46 +1,50 @@ /* struct _BCRYPT_ISO_OBJECT * __ptr64 __cdecl AllocateBCryptIsoObject(void * __ptr64,unsigned long) */ _BCRYPT_ISO_OBJECT * __cdecl AllocateBCryptIsoObject(void *param_1,ulong param_2) { + _BCRYPT_ISO_OBJECT *SRWLock; _BCRYPT_ISO_OBJECT *p_Var1; undefined4 uVar2; undefined8 in_R8; uVar2 = 0; p_Var1 = LocalAlloc(0,0x30); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x61,in_R8,param_2); + WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5e,in_R8,param_2); } if (p_Var1 == (_BCRYPT_ISO_OBJECT *)0x0) { if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { return (_BCRYPT_ISO_OBJECT *)0x0; } uVar2 = 0xc0000017; if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x62, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5f, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); uVar2 = 0xc0000017; } } else { + SRWLock = p_Var1 + 0x28; + InitializeSRWLock((PSRWLOCK)SRWLock); + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + *(void **)(p_Var1 + 8) = param_1; + ReleaseSRWLockExclusive((PSRWLOCK)SRWLock); *(undefined4 *)p_Var1 = 0x30; - *(void **)(p_Var1 + 8) = param_1; - InitializeSRWLock((PSRWLOCK)(p_Var1 + 0x28)); *(undefined4 *)(p_Var1 + 4) = 0x42494f4d; *(undefined4 *)(p_Var1 + 0x10) = 0; *(ulong *)(p_Var1 + 0x14) = param_2; *(undefined8 *)(p_Var1 + 0x18) = 0; *(undefined8 *)(p_Var1 + 0x20) = 1; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),99, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,uVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x60, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,uVar2); } return p_Var1; } ``` ## BCryptIumImportKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.7| |i_ratio|0.3| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumImportKey|BCryptIumImportKey| |fullname|BCryptIumImportKey|BCryptIumImportKey| |refcount|3|3| |`length`|321|304| |called|BCryptIumImportKeyGeneric
WPP_SF_
WPP_SF_D|BCryptIumImportKeyGeneric
WPP_SF_
WPP_SF_D| |calling||| |paramcount|10|10| |`address`|140011f90|140011640| |sig|long __fastcall BCryptIumImportKey(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, longlong param_6, int param_7, uchar * param_8, ulong param_9, ulong param_10)|long __fastcall BCryptIumImportKey(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, longlong param_6, int param_7, uchar * param_8, ulong param_9, ulong param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumImportKey Diff ```diff --- BCryptIumImportKey +++ BCryptIumImportKey @@ -1,34 +1,36 @@ long BCryptIumImportKey(void *param_1,__uint64 param_2,__uint64 param_3,ushort *param_4, __uint64 *param_5,longlong param_6,int param_7,uchar *param_8,ulong param_9, ulong param_10) { long lVar1; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcc, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xca, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } if ((param_6 == 0) && (param_7 == 0)) { lVar1 = BCryptIumImportKeyGeneric (param_1,param_2,param_3,param_4,param_5,(uchar *)0x0,0,param_8,param_9, param_10,0); } else { lVar1 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcd, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff3; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcb, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcf, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcc, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } return lVar1; } ``` ## BCryptIumCheckKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.62| |i_ratio|0.35| |m_ratio|0.99| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumCheckKey|BCryptIumCheckKey| |fullname|BCryptIumCheckKey|BCryptIumCheckKey| |refcount|3|3| |`length`|800|769| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
NTDLL.DLL::memcpy_s
SafeAllocaFreeToHeap
WPP_SF_
WPP_SF_D
WPP_SF_dd
_guard_dispatch_icall$thunk$10345483385596137414|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
MIDL_user_free
NTDLL.DLL::memcpy_s
WPP_SF_
WPP_SF_D
WPP_SF_dd
_guard_dispatch_icall$thunk$10345483385596137414| |calling||| |paramcount|6|6| |`address`|14000ee90|14000edb0| |sig|int __fastcall BCryptIumCheckKey(longlong param_1, void * param_2, uint param_3, void * param_4, uint param_5, uint * param_6)|int __fastcall BCryptIumCheckKey(longlong param_1, void * param_2, uint param_3, void * param_4, uint param_5, uint * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumCheckKey Called Diff ```diff --- BCryptIumCheckKey called +++ BCryptIumCheckKey called @@ -2,0 +3 @@ +MIDL_user_free @@ -4 +4,0 @@ -SafeAllocaFreeToHeap ``` ### BCryptIumCheckKey Diff ```diff --- BCryptIumCheckKey +++ BCryptIumCheckKey @@ -1,107 +1,109 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ int BCryptIumCheckKey(longlong param_1,void *param_2,uint param_3,void *param_4,uint param_5, uint *param_6) { int iVar1; undefined8 *puVar2; ulonglong uVar3; undefined2 uVar4; int unaff_EBX; - undefined1 *puVar5; + int iVar5; uint uVar6; + undefined1 *puVar7; + uint local_38; uint local_34; - uint local_30; - uint local_2c; - undefined1 *local_28; - void *local_20; + undefined1 *local_30; + void *local_28 [2]; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x113, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11a, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - local_28 = (undefined1 *)0x0; + local_30 = (undefined1 *)0x0; + local_34 = 0; uVar6 = 0; - local_30 = 0; - local_20 = (void *)0x0; - local_34 = 0; - local_2c = 0; + local_28[0] = (void *)0x0; + local_38 = 0; puVar2 = BCryptIumContextManagerGetContext(param_1); if (puVar2 == (undefined8 *)0x0) { Sleep(5); return unaff_EBX; } if (((param_2 == (void *)0x0) || (param_3 == 0)) || (param_6 == (uint *)0x0)) { + iVar5 = -0x3ffffff3; iVar1 = -0x3ffffff3; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar4 = 0x114; - iVar1 = -0x3ffffff3; + uVar4 = 0x11b; } else if (param_3 < 5) { iVar1 = -0x3ffffff3; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || (iVar1 = -0x3ffffff3, (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar4 = 0x115; - iVar1 = -0x3ffffff3; + uVar4 = 0x11c; + iVar5 = -0x3ffffff3; } else { iVar1 = (*DAT_1)("BCryptIsoKeyData",(longlong)param_2 + 4,param_3 - 4,MIDLAllocWrapper, - MIDLFreeWrapper,&local_28,&local_30,&local_20,&local_34); + MIDLFreeWrapper,&local_30,&local_34,local_28,&local_38); if (-1 < iVar1) { - if ((local_34 != 0) && (uVar6 = local_34 + 4, local_2c = uVar6, param_4 != (void *)0x0)) { + if ((local_38 != 0) && (uVar6 = local_38 + 4, param_4 != (void *)0x0)) { if (param_5 < uVar6) { + iVar5 = -0x3fffffdd; iVar1 = -0x3fffffdd; if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar4 = 0x118; - iVar1 = -0x3fffffdd; + uVar4 = 0x11f; goto LAB_2; } memcpy_s(param_4,(ulonglong)param_5,param_2,4); - memcpy_s((void *)((longlong)param_4 + 4),(ulonglong)param_5 - 4,local_20,(ulonglong)local_34 - ); + memcpy_s((void *)((longlong)param_4 + 4),(ulonglong)param_5 - 4,local_28[0], + (ulonglong)local_38); } *param_6 = uVar6; goto LAB_0; } if (iVar1 == -0x3fff5ffe) { + iVar1 = -0x3ffffd75; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x116, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000a002); + WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11d, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000a002); + iVar1 = -0x3ffffd75; } - iVar1 = -0x3ffffd75; goto LAB_0; } if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar4 = 0x117; + uVar4 = 0x11e; + iVar5 = iVar1; } LAB_2: WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,iVar1); + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,iVar5); + iVar1 = iVar5; LAB_0: - if (local_28 != (undefined1 *)0x0) { - puVar5 = local_28; - for (uVar3 = (ulonglong)local_30; uVar3 != 0; uVar3 = uVar3 - 1) { - *puVar5 = 0; - puVar5 = puVar5 + 1; + if (local_30 != (undefined1 *)0x0) { + puVar7 = local_30; + for (uVar3 = (ulonglong)local_34; uVar3 != 0; uVar3 = uVar3 - 1) { + *puVar7 = 0; + puVar7 = puVar7 + 1; } - SafeAllocaFreeToHeap(local_28); + MIDL_user_free(local_30); } - if (local_20 != (void *)0x0) { - SafeAllocaFreeToHeap(local_20); + if (local_28[0] != (void *)0x0) { + MIDL_user_free(local_28[0]); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11a, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,iVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x120, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,iVar1); } return unaff_EBX; } ``` ## BCryptIumKeyDerivation ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.76| |i_ratio|0.27| |m_ratio|0.98| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumKeyDerivation|BCryptIumKeyDerivation| |fullname|BCryptIumKeyDerivation|BCryptIumKeyDerivation| |refcount|3|3| |`length`|368|354| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptKeyDerivation
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptKeyDerivation
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL| |calling||| |paramcount|7|7| |`address`|140012270|140011880| |sig|undefined4 __fastcall BCryptIumKeyDerivation(longlong param_1, __uint64 param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 param_6, undefined4 param_7)|undefined4 __fastcall BCryptIumKeyDerivation(longlong param_1, __uint64 param_2, undefined8 param_3, undefined8 param_4, undefined4 param_5, undefined8 param_6, undefined4 param_7)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumKeyDerivation Called Diff ```diff --- BCryptIumKeyDerivation called +++ BCryptIumKeyDerivation called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -8 +10 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumKeyDerivation Diff ```diff --- BCryptIumKeyDerivation +++ BCryptIumKeyDerivation @@ -1,48 +1,51 @@ undefined4 BCryptIumKeyDerivation (longlong param_1,__uint64 param_2,undefined8 param_3,undefined8 param_4, undefined4 param_5,undefined8 param_6,undefined4 param_7) { undefined4 uVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; undefined8 uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x100, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x101, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); uVar1 = 0xc0000022; } else { uVar4 = 0x42494f4b; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return 0xc0000008; + } uVar1 = 0xc0000008; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x101,uVar4,param_2); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x102,uVar4,param_2); + uVar1 = 0xc0000008; } } else { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); uVar1 = BCryptKeyDerivation(*(undefined8 *)(p_Var3 + 8),param_3,param_4,param_5,param_6, param_7); - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x103, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,uVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x105, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,uVar1); } } return uVar1; } ``` ## BCryptIumSignHash ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.76| |i_ratio|0.28| |m_ratio|0.97| |b_ratio|0.84| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumSignHash|BCryptIumSignHash| |fullname|BCryptIumSignHash|BCryptIumSignHash| |refcount|3|3| |`length`|681|668| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptSignHash
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
NTDLL.DLL::wcsncmp
WPP_SF_
WPP_SF_D
WPP_SF_Id
WPP_SF_Sd
_UnpackPaddingInfoPtr
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptSignHash
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
NTDLL.DLL::wcsncmp
WPP_SF_
WPP_SF_D
WPP_SF_ILWPP_SF_Sd
_UnpackPaddingInfoPtr
| |calling||| |paramcount|9|9| |`address`|140012ee0|140012310| |sig|NTSTATUS __fastcall BCryptIumSignHash(longlong param_1, __uint64 param_2, _BCRYPTR_PADDING_INFO * param_3, PUCHAR param_4, ULONG param_5, PUCHAR param_6, ULONG param_7, ULONG * param_8, uint param_9)|NTSTATUS __fastcall BCryptIumSignHash(longlong param_1, __uint64 param_2, _BCRYPTR_PADDING_INFO * param_3, PUCHAR param_4, ULONG param_5, PUCHAR param_6, ULONG param_7, ULONG * param_8, uint param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumSignHash Called Diff ```diff --- BCryptIumSignHash called +++ BCryptIumSignHash called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -9 +11 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumSignHash Diff ```diff --- BCryptIumSignHash +++ BCryptIumSignHash @@ -1,79 +1,83 @@ NTSTATUS BCryptIumSignHash(longlong param_1,__uint64 param_2,_BCRYPTR_PADDING_INFO *param_3, PUCHAR param_4,ULONG param_5,PUCHAR param_6,ULONG param_7,ULONG *param_8, uint param_9) { int iVar1; NTSTATUS NVar2; longlong *plVar3; BCRYPTIUM_CONTEXT *pBVar4; _BCRYPT_ISO_OBJECT *p_Var5; void *pPaddingInfo; NTSTATUS unaff_EBX; undefined8 uVar6; wchar_t *pwVar7; plVar3 = _UnpackPaddingInfoPtr(param_3); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe9, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe3, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar4 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar4 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); return unaff_EBX; } uVar6 = 0x42494f4b; p_Var5 = LookupBCryptIsoObject(pBVar4,param_2,0x42494f4b); if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { NVar2 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xea,uVar6,param_2); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe4,uVar6,param_2); + } + goto LAB_0; } - else if ((*(uint *)(p_Var5 + 0x10) & 0x70) == 0) { + if ((*(uint *)(p_Var5 + 0x10) & 0x70) == 0) { if (((((param_9 & 8) != 0) && (plVar3 != (longlong *)0x0)) && (iVar1 = wcsncmp((wchar_t *)*plVar3,L"SHA256",7), iVar1 != 0)) && (iVar1 = wcsncmp((wchar_t *)*plVar3,L"SHA384",7), iVar1 != 0)) { uVar6 = 7; iVar1 = wcsncmp((wchar_t *)*plVar3,L"SHA512",7); if (iVar1 != 0) { NVar2 = -0x3fffff45; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { pwVar7 = L""; if (*plVar3 != 0) { pwVar7 = (wchar_t *)*plVar3; } - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xec,uVar6,pwVar7); + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe6,uVar6,pwVar7); } - goto LAB_0; + goto LAB_1; } } + AcquireSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); pPaddingInfo = _UnpackPaddingInfoPtr(param_3); NVar2 = BCryptSignHash(*(BCRYPT_KEY_HANDLE *)(p_Var5 + 8),pPaddingInfo,param_4,param_5,param_6, param_7,param_8,param_9); + ReleaseSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); } else { NVar2 = -0x3fffff45; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xeb, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); + (NVar2 = -0x3fffff45, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe5, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc00000bb); } } +LAB_1: + BCryptIumDereferenceObject(p_Var5); LAB_0: - if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var5); - } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xee, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe9, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar2); } return unaff_EBX; } ``` ## BCryptIumDuplicateKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.57| |i_ratio|0.29| |m_ratio|0.95| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDuplicateKey|BCryptIumDuplicateKey| |fullname|BCryptIumDuplicateKey|BCryptIumDuplicateKey| |refcount|3|3| |`length`|608|562| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptDuplicateKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptDuplicateKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_WPP_SF_D
WPP_SF_IL
| |calling||| |paramcount|6|6| |`address`|14000ffb0|14000fba0| |sig|NTSTATUS __fastcall BCryptIumDuplicateKey(longlong param_1, __uint64 param_2, undefined8 * param_3, longlong param_4, int param_5, ULONG param_6)|NTSTATUS __fastcall BCryptIumDuplicateKey(longlong param_1, __uint64 param_2, undefined8 * param_3, longlong param_4, int param_5, ULONG param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDuplicateKey Called Diff ```diff --- BCryptIumDuplicateKey called +++ BCryptIumDuplicateKey called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -11 +13 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumDuplicateKey Diff ```diff --- BCryptIumDuplicateKey +++ BCryptIumDuplicateKey @@ -1,85 +1,87 @@ NTSTATUS BCryptIumDuplicateKey (longlong param_1,__uint64 param_2,undefined8 *param_3,longlong param_4, int param_5,ULONG param_6) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; + _BCRYPT_ISO_OBJECT *p_Var4; NTSTATUS unaff_EBX; - _BCRYPT_ISO_OBJECT *p_Var4; undefined8 uVar5; - BCRYPT_KEY_HANDLE local_30; - _BCRYPT_ISO_OBJECT *local_28; + BCRYPT_KEY_HANDLE local_res20; - p_Var4 = (_BCRYPT_ISO_OBJECT *)0x0; - local_28 = (_BCRYPT_ISO_OBJECT *)0x0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd3, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcf, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } if ((param_4 == 0) && (param_5 == 0)) { pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); return unaff_EBX; } uVar5 = 0x42494f4b; - p_Var4 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); - local_28 = p_Var4; - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } NVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd5,uVar5,param_2); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd1,uVar5,param_2); + NVar1 = -0x3ffffff8; } } else { - local_30 = (void *)0x0; - NVar1 = BCryptDuplicateKey(*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8),&local_30,(PUCHAR)0x0,0,param_6) - ; + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + local_res20 = (void *)0x0; + NVar1 = BCryptDuplicateKey(*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),&local_res20,(PUCHAR)0x0,0, + param_6); if (-1 < NVar1) { - p_Var3 = AllocateBCryptIsoObject(local_30,0x42494f4b); - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + p_Var4 = AllocateBCryptIsoObject(local_res20,0x42494f4b); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { NVar1 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd6, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd3, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); } - BCryptDestroyKey(local_30); + BCryptDestroyKey(local_res20); } else { - *(undefined4 *)(p_Var3 + 0x10) = *(undefined4 *)(p_Var4 + 0x10); - NVar1 = IndexBCryptIsoObject(pBVar2,p_Var3); + *(undefined4 *)(p_Var4 + 0x10) = *(undefined4 *)(p_Var3 + 0x10); + NVar1 = IndexBCryptIsoObject(pBVar2,p_Var4); if (NVar1 < 0) { - BCryptIumDereferenceObject(p_Var3); + BCryptIumDereferenceObject(p_Var4); } else { - *param_3 = *(undefined8 *)(p_Var3 + 0x18); + *param_3 = *(undefined8 *)(p_Var4 + 0x18); } } } + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + BCryptIumDereferenceObject(p_Var3); } } else { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } NVar1 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd0, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + NVar1 = -0x3ffffff3; } - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd8, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd5, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } return unaff_EBX; } ``` ## BCryptIumDestroySecret ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.8| |i_ratio|0.39| |m_ratio|0.94| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDestroySecret|BCryptIumDestroySecret| |fullname|BCryptIumDestroySecret|BCryptIumDestroySecret| |refcount|3|3| |`length`|329|288| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
UnindexBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL| |calling||| |paramcount|2|2| |`address`|14000fe10|14000fa70| |sig|long __fastcall BCryptIumDestroySecret(longlong param_1, __uint64 param_2)|long __fastcall BCryptIumDestroySecret(longlong param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDestroySecret Called Diff ```diff --- BCryptIumDestroySecret called +++ BCryptIumDestroySecret called @@ -8 +8 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumDestroySecret Diff ```diff --- BCryptIumDestroySecret +++ BCryptIumDestroySecret @@ -1,47 +1,47 @@ long BCryptIumDestroySecret(longlong param_1,__uint64 param_2) { long lVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; undefined8 uVar4; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe5, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe0, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); lVar1 = -0x3fffffde; } else { uVar4 = 0x42494f53; p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f53); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { lVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe6,uVar4,param_2); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe1,uVar4,param_2); } } else { lVar1 = UnindexBCryptIsoObject(pBVar2,p_Var3,0x42494f53); if (-1 < lVar1) { BCryptIumDereferenceObject(p_Var3); } - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe8, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xe2, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } } return lVar1; } ``` ## BCryptIumReleaseContext ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.79| |i_ratio|0.45| |m_ratio|0.95| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumReleaseContext|BCryptIumReleaseContext| |fullname|BCryptIumReleaseContext|BCryptIumReleaseContext| |refcount|4|4| |`length`|177|166| |called|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerFreeContext
BCryptIumContextManagerGetContext
WPP_SF_
WPP_SF_D|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerFreeContext
BCryptIumContextManagerGetContext
WPP_SF_
WPP_SF_D| |calling|BCRYPT_IUM_CLIENT_CONTEXT_rundown|BCRYPT_IUM_CLIENT_CONTEXT_rundown| |paramcount|3|3| |`address`|1400127b0|140011cc0| |sig|undefined8 __fastcall BCryptIumReleaseContext(longlong * param_1, undefined8 param_2, undefined * param_3)|undefined8 __fastcall BCryptIumReleaseContext(longlong * param_1, undefined8 param_2, undefined * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumReleaseContext Diff ```diff --- BCryptIumReleaseContext +++ BCryptIumReleaseContext @@ -1,31 +1,31 @@ undefined8 BCryptIumReleaseContext(longlong *param_1,undefined8 param_2,undefined *param_3) { BCRYPTIUM_CONTEXT *pBVar1; undefined8 uVar2; - uVar2 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - param_3 = &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5e, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + param_3 = &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5c, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar1 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(*param_1); if (pBVar1 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); uVar2 = 0xc0000022; } else { *param_1 = 0; BCryptIumContextManagerFreeContext(pBVar1,1,param_3); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x60, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5d, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0); } + uVar2 = 0; } return uVar2; } ``` ## BCryptIumRpcInit ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.75| |i_ratio|0.39| |m_ratio|0.99| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumRpcInit|BCryptIumRpcInit| |fullname|BCryptIumRpcInit|BCryptIumRpcInit| |refcount|2|2| |`length`|445|441| |called|BCryptIumContextManagerInit
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::RpcServerRegisterIf
TraceLoggingRegisterEx_EventRegister_EventSetInformation
WPP_SF_
WPP_SF_D
__security_check_cookie
_tlgKeywordOn
_tlgWriteTemplate::Write<>
_tlgWriteTransfer_EventWriteTransfer|BCryptIumContextManagerInit
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::RpcServerRegisterIf
TraceLoggingRegisterEx_EventRegister_EventSetInformation
WPP_SF_
WPP_SF_D
__security_check_cookie
_tlgKeywordOn
_tlgWriteTemplate::Write<>
_tlgWriteTransfer_EventWriteTransfer| |calling|wmain|wmain| |paramcount|1|1| |`address`|140009338|1400092a8| |sig|long __cdecl BCryptIumRpcInit(_LsaIsoSupportFunctions * param_1)|long __cdecl BCryptIumRpcInit(_LsaIsoSupportFunctions * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### BCryptIumRpcInit Diff ```diff --- BCryptIumRpcInit +++ BCryptIumRpcInit @@ -1,72 +1,70 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ /* long __cdecl BCryptIumRpcInit(struct _LsaIsoSupportFunctions const * __ptr64) */ long __cdecl BCryptIumRpcInit(_LsaIsoSupportFunctions *param_1) { char cVar1; RPC_STATUS Status; long lVar2; _GUID *in_R8; _GUID *in_R9; undefined1 auStackY_98 [32]; - RPC_STATUS local_68; - long local_64; + RPC_STATUS local_68 [2]; undefined8 local_60; _EVENT_DATA_DESCRIPTOR local_58 [2]; undefined8 *local_38; undefined4 local_30; undefined4 local_2c; RPC_STATUS *local_28; undefined4 local_20; undefined4 local_1c; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStackY_98; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - in_R8 = (_GUID *)&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; + in_R8 = (_GUID *)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x54, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } _BcryptIumLsaIsoFunctions = *(undefined8 *)param_1; DAT_0 = *(undefined8 *)(param_1 + 8); _DAT_1 = *(undefined8 *)(param_1 + 0x10); - uRam0000000140059d48 = *(undefined8 *)(param_1 + 0x18); + uRam0000000140058d48 = *(undefined8 *)(param_1 + 0x18); DAT_2 = *(undefined8 *)(param_1 + 0x20); - uRam0000000140059d58 = *(undefined8 *)(param_1 + 0x28); + uRam0000000140058d58 = *(undefined8 *)(param_1 + 0x28); _DAT_3 = *(undefined8 *)(param_1 + 0x30); TraceLoggingRegisterEx_EventRegister_EventSetInformation(&DAT_4); if (5 < DAT_4) { _tlgWriteTemplate - ::Write<>((_tlgProvider_t *)&DAT_4,&DAT_140053942,in_R8,in_R9); + ::Write<>((_tlgProvider_t *)&DAT_4,&DAT_1400528c2,in_R8,in_R9); } BCryptIumContextManagerInit(); Status = RpcServerRegisterIf(&DAT_5,(UUID *)0x0,(void *)0x0); lVar2 = I_RpcMapWin32Status(Status); - local_64 = lVar2; if (5 < DAT_4) { - cVar1 = _tlgKeywordOn(0x140059050,0x400000000000); + cVar1 = _tlgKeywordOn(0x140058050,0x400000000000); if (cVar1 != '\0') { + local_1c = 0; + local_28 = local_68; + local_2c = 0; + local_38 = &local_60; local_60 = 0x1000000; - local_28 = &local_68; local_20 = 4; - local_1c = 0; - local_38 = &local_60; local_30 = 8; - local_2c = 0; - local_68 = Status; + local_68[0] = Status; _tlgWriteTransfer_EventWriteTransfer - (0x140059050,&DAT_6,(LPCGUID)0x0,(LPCGUID)0x0,4,local_58); + (0x140058050,&DAT_6,(LPCGUID)0x0,(LPCGUID)0x0,4,local_58); } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x56, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x55, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar2); } return lVar2; } ``` ## BCryptIumImportKeyPair ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.79| |i_ratio|0.33| |m_ratio|0.98| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumImportKeyPair|BCryptIumImportKeyPair| |fullname|BCryptIumImportKeyPair|BCryptIumImportKeyPair| |refcount|3|3| |`length`|246|240| |called|BCryptIumImportKeyGeneric
WPP_SF_
WPP_SF_D|BCryptIumImportKeyGeneric
WPP_SF_
WPP_SF_D| |calling||| |paramcount|8|8| |`address`|140012120|140011780| |sig|long __fastcall BCryptIumImportKeyPair(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, uchar * param_6, ulong param_7, ulong param_8)|long __fastcall BCryptIumImportKeyPair(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, uchar * param_6, ulong param_7, ulong param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumImportKeyPair Diff ```diff --- BCryptIumImportKeyPair +++ BCryptIumImportKeyPair @@ -1,24 +1,24 @@ long BCryptIumImportKeyPair (void *param_1,__uint64 param_2,__uint64 param_3,ushort *param_4,__uint64 *param_5, uchar *param_6,ulong param_7,ulong param_8) { long lVar1; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd0, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xcd, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } lVar1 = BCryptIumImportKeyGeneric (param_1,param_2,param_3,param_4,param_5,(uchar *)0x0,0,param_6,param_7,param_8, 1); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd2, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xce, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } return lVar1; } ``` ## BCryptIumExportKey ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.17| |i_ratio|0.19| |m_ratio|0.94| |b_ratio|0.12| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumExportKey|BCryptIumExportKey| |fullname|BCryptIumExportKey|BCryptIumExportKey| |refcount|3|3| |`length`|2101|1928| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptExportKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IsExportableIumBlobType
LookupBCryptIsoObjectNTDLL.DLL::memcpy_s
SafeAllocaFreeToHeap
WPP_SF_
WPP_SF_D
WPP_SF_DDd
WPP_SF_Ld
WPP_SF_Sd
WPP_SF_ssd
_guard_dispatch_icall$thunk$10345483385596137414
wcscmp
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::GetProcessHeap
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapAlloc
API-MS-WIN-CORE-HEAP-L1-1-0.DLL::HeapFree
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptExportKey
BCryptIumContextManagerGetContext
BCryptIumDereferenceObjectIsExportableIumBlobType
LookupBCryptIsoObject
MIDL_user_free
NTDLL.DLL::memcpy_s
WPP_SF_
WPP_SF_D
WPP_SF_DDd
WPP_SF_Ld
WPP_SF_Sd
WPP_SF_ssd
_guard_dispatch_icall$thunk$10345483385596137414
wcscmp
| |calling||| |paramcount|8|8| |`address`|140010790|1400101e0| |sig|NTSTATUS __fastcall BCryptIumExportKey(longlong param_1, __uint64 param_2, __uint64 param_3, wchar_t * param_4, PUCHAR param_5, uint param_6, ULONG * param_7, uint param_8)|NTSTATUS __fastcall BCryptIumExportKey(longlong param_1, __uint64 param_2, __uint64 param_3, wchar_t * param_4, PUCHAR param_5, uint param_6, ULONG * param_7, uint param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumExportKey Called Diff ```diff --- BCryptIumExportKey called +++ BCryptIumExportKey called @@ -4,0 +5 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared @@ -5,0 +7 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -11,0 +14 @@ +MIDL_user_free @@ -13 +15,0 @@ -SafeAllocaFreeToHeap ``` ### BCryptIumExportKey Diff ```diff --- BCryptIumExportKey +++ BCryptIumExportKey @@ -1,314 +1,308 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ NTSTATUS BCryptIumExportKey(longlong param_1,__uint64 param_2,__uint64 param_3,wchar_t *param_4, PUCHAR param_5,uint param_6,ULONG *param_7,uint param_8) { - int iVar1; - NTSTATUS NVar2; - BCRYPTIUM_CONTEXT *pBVar3; - _BCRYPT_ISO_OBJECT *p_Var4; - _BCRYPT_ISO_OBJECT *p_Var5; - char *pcVar6; - HANDLE pvVar7; - SIZE_T dwBytes; - ulonglong uVar8; - BCRYPT_KEY_HANDLE pvVar9; + bool bVar1; + bool bVar2; + uint dwFlags; + int iVar3; + NTSTATUS NVar4; + NTSTATUS NVar5; + _BCRYPT_ISO_OBJECT *p_Var6; + BCRYPTIUM_CONTEXT *pBVar7; + _BCRYPT_ISO_OBJECT *p_Var8; + _BCRYPT_ISO_OBJECT *p_Var9; + char *pcVar10; + HANDLE pvVar11; + undefined4 *lpMem; + ulonglong uVar12; + undefined2 uVar13; + BCRYPT_KEY_HANDLE pvVar14; NTSTATUS unaff_EBX; - undefined4 *puVar10; - undefined8 uVar11; - char *pcVar12; - uint uVar13; - uint uVar14; + _BCRYPT_ISO_OBJECT *p_Var15; + uint uVar16; + undefined4 *puVar17; + undefined8 uVar18; + ulonglong dwBytes; + undefined4 uVar19; + char *pcVar20; + uint uVar21; wchar_t *pszBlobType; - bool bVar15; - uint local_84; - ULONG local_80; - uint local_7c; - uint local_78; - uint local_74; - undefined4 local_70; - int local_6c; - undefined4 *local_68; - uint local_60; - void *local_58; - _BCRYPT_ISO_OBJECT *local_50; - _BCRYPT_ISO_OBJECT *local_48; + ULONG local_44; + uint local_40; + uint local_3c; + int local_38; + uint local_34; + void *local_30; - p_Var4 = (_BCRYPT_ISO_OBJECT *)0x0; - local_50 = (_BCRYPT_ISO_OBJECT *)0x0; - p_Var5 = (_BCRYPT_ISO_OBJECT *)0x0; - local_48 = (_BCRYPT_ISO_OBJECT *)0x0; - local_6c = 0; - local_68 = (undefined4 *)0x0; - uVar14 = 0; - uVar13 = 0; - local_84 = 0; - local_70 = 0; - local_58 = (void *)0x0; - local_7c = 0; + p_Var6 = (_BCRYPT_ISO_OBJECT *)0x0; + local_38 = 0; + p_Var15 = (_BCRYPT_ISO_OBJECT *)0x0; + bVar1 = false; + bVar2 = false; + local_30 = (void *)0x0; + local_40 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa5, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); - } - pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x9e, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); + } + pBVar7 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar7 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); return unaff_EBX; } - local_80 = 0; + local_44 = 0; + p_Var9 = p_Var15; if (param_7 == (ULONG *)0x0) { - NVar2 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa6, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } + uVar19 = 0xc000000d; + NVar4 = -0x3ffffff3; + p_Var9 = p_Var6; + p_Var8 = p_Var6; + NVar5 = -0x3ffffff3; + bVar1 = false; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + (p_Var9 = p_Var15, p_Var8 = (_BCRYPT_ISO_OBJECT *)0x0, NVar5 = -0x3ffffff3, bVar1 = bVar2, + (WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0x9f; + p_Var9 = p_Var6; + p_Var8 = p_Var6; } else { - p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0x42494f4b); - uVar14 = uVar13; - local_50 = p_Var4; - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar2 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa7, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000008); - } + p_Var8 = LookupBCryptIsoObject(pBVar7,param_2,0x42494f4b); + if (p_Var8 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar4 = -0x3ffffff8; + NVar5 = -0x3ffffff8; + bVar1 = bVar2; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xa0; + uVar19 = 0xc0000008; } else { - uVar11 = 0x42494f4b; - p_Var5 = LookupBCryptIsoObject(pBVar3,param_3,0x42494f4b); - local_48 = p_Var5; - if ((p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) || ((*(uint *)(p_Var5 + 0x10) & 0x70) == 0)) { - uVar14 = *(uint *)(p_Var4 + 0x10); - if ((uVar14 & 3) == 0) { - iVar1 = IsExportableIumBlobType((longlong)param_4); - if (iVar1 == 0) { - NVar2 = -0x3fffff45; + uVar18 = 0x42494f4b; + p_Var9 = LookupBCryptIsoObject(pBVar7,param_3,0x42494f4b); + if ((p_Var9 == (_BCRYPT_ISO_OBJECT *)0x0) || ((*(uint *)(p_Var9 + 0x10) & 0x70) == 0)) { + uVar16 = *(uint *)(p_Var8 + 0x10); + if ((uVar16 & 3) == 0) { + iVar3 = IsExportableIumBlobType((longlong)param_4); + if (iVar3 == 0) { + NVar5 = -0x3fffff45; + bVar1 = bVar2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xaa,uVar11,param_4); - } - uVar14 = 0; - } - else { - local_78 = param_8 & 4; - local_74 = param_8 & 0xfffffffb; - if (local_78 == 0) { - local_74 = param_8; - } - bVar15 = local_78 != 0; - uVar14 = uVar14 & 4; - local_60 = (uint)(uVar14 != 0); - AcquireSRWLockExclusive((PSRWLOCK)(p_Var4 + 0x28)); - local_6c = 1; - iVar1 = wcscmp(L"ISOPROTECTEDBLOB",param_4); - if (iVar1 == 0) { - if (bVar15 == local_60) { - pszBlobType = L"PRIVATEBLOB"; - while( true ) { - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - pvVar9 = (BCRYPT_KEY_HANDLE)0x0; - } - else { - pvVar9 = *(BCRYPT_KEY_HANDLE *)(p_Var5 + 8); - } - NVar2 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8),pvVar9,pszBlobType, - (PUCHAR)0x0,0,&local_80,local_74); - if (NVar2 != -0x3fffff45) break; - pszBlobType = L"KeyDataBlob"; - } - if (NVar2 < 0) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa3,uVar18,param_4); + NVar5 = -0x3fffff45; + } + goto LAB_0; + } + uVar21 = param_8 & 4; + local_3c = param_8 & 0xfffffffb; + if (uVar21 == 0) { + local_3c = param_8; + } + uVar16 = uVar16 & 4; + local_34 = uVar21; + AcquireSRWLockExclusive((PSRWLOCK)(p_Var8 + 0x28)); + local_38 = 1; + if ((p_Var9 != (_BCRYPT_ISO_OBJECT *)0x0) && (p_Var9 != p_Var8)) { + AcquireSRWLockShared((PSRWLOCK)(p_Var9 + 0x28)); + bVar1 = true; + } + iVar3 = wcscmp(L"ISOPROTECTEDBLOB",param_4); + dwFlags = local_3c; + if (iVar3 == 0) { + if ((uVar21 != 0) != (uVar16 != 0)) { + NVar5 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + pcVar20 = "TRUE"; + pcVar10 = "TRUE"; + if (uVar16 == 0) { + pcVar10 = "FALSE"; + } + if (uVar21 == 0) { + pcVar20 = "FALSE"; + } + WPP_SF_ssd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),"FALSE",uVar18,pcVar20,pcVar10 + ); + NVar5 = -0x3ffffff3; + } + goto LAB_0; + } + pszBlobType = L"PRIVATEBLOB"; + while( true ) { + if (p_Var9 == (_BCRYPT_ISO_OBJECT *)0x0) { + pvVar14 = (BCRYPT_KEY_HANDLE)0x0; + } + else { + pvVar14 = *(BCRYPT_KEY_HANDLE *)(p_Var9 + 8); + } + NVar4 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var8 + 8),pvVar14,pszBlobType, + (PUCHAR)0x0,0,&local_44,dwFlags); + if (NVar4 != -0x3fffff45) break; + pszBlobType = L"KeyDataBlob"; + } + if (NVar4 < 0) { + NVar5 = NVar4; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xa7; + } + else { + uVar16 = local_44 + 0xc; + if (local_44 <= uVar16) { + uVar12 = (ulonglong)uVar16; + pvVar11 = GetProcessHeap(); + dwBytes = (ulonglong)uVar16; + lpMem = HeapAlloc(pvVar11,0,dwBytes); + if (lpMem == (undefined4 *)0x0) { + NVar5 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xad, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_Ld(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa9,dwBytes,uVar16); + NVar5 = -0x3fffffe9; } - uVar14 = 0; + goto LAB_0; + } + if (p_Var9 == (_BCRYPT_ISO_OBJECT *)0x0) { + pvVar14 = (BCRYPT_KEY_HANDLE)0x0; } else { - local_84 = local_80 + 0xc; - dwBytes = (SIZE_T)local_84; - if (local_84 < local_80) { - dwBytes = 0xffffffff; - local_84 = 0xffffffff; - NVar2 = -0x7ff8fdea; + pvVar14 = *(BCRYPT_KEY_HANDLE *)(p_Var9 + 8); + } + NVar5 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var8 + 8),pvVar14,pszBlobType, + (PUCHAR)(lpMem + 3),local_44,&local_44,dwFlags); + puVar17 = lpMem; + if (NVar5 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar13 = 0xaa; +LAB_1: + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar13, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar5); } - else { - NVar2 = 0; - } - local_70 = (undefined4)dwBytes; - uVar14 = local_84; - if (NVar2 < 0) { + } + else { + *lpMem = 0x424f5349; + lpMem[2] = local_44; + lpMem[1] = *(uint *)(p_Var8 + 0x10) & 0xfffffffd; + NVar5 = (*_BcryptIumLsaIsoFunctions) + ("BCryptIsoKeyData",lpMem,uVar16,MIDLAllocWrapper, + MIDLFreeWrapper,local_34 == 0,&local_30,&local_40); + if (NVar5 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xae, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + uVar13 = 0xab; + goto LAB_1; } } else { - pvVar7 = GetProcessHeap(); - local_68 = HeapAlloc(pvVar7,0,dwBytes); - if (local_68 == (undefined4 *)0x0) { - NVar2 = -0x3fffffe9; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Ld(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xaf,dwBytes,local_84); - } - } - else { - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - pvVar9 = (BCRYPT_KEY_HANDLE)0x0; - } - else { - pvVar9 = *(BCRYPT_KEY_HANDLE *)(p_Var5 + 8); - } - NVar2 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8),pvVar9,pszBlobType, - (PUCHAR)(local_68 + 3),local_80,&local_80,local_74); - if (NVar2 < 0) { + if (param_5 != (PUCHAR)0x0) { + if ((ulonglong)param_6 < (ulonglong)local_40 + 4) { + NVar5 = -0x3fffffdd; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb0, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_DDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xac, + (ulonglong)param_6,local_40 + 4); } + goto code_r0x0001400107a3; } - else { - *local_68 = 0x424f5349; - local_68[2] = local_80; - local_68[1] = *(uint *)(p_Var4 + 0x10) & 0xfffffffd; - NVar2 = (*_BcryptIumLsaIsoFunctions) - ("BCryptIsoKeyData",local_68,local_84,MIDLAllocWrapper, - MIDLFreeWrapper,local_78 == 0,&local_58,&local_7c); - if (NVar2 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb1, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); - } - } - else { - if (param_5 != (PUCHAR)0x0) { - if ((ulonglong)param_6 < (ulonglong)local_7c + 4) { - NVar2 = -0x3fffffdd; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_DDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb2, - (ulonglong)param_6,local_7c + 4); - } - goto LAB_0; - } - memcpy_s(param_5,(ulonglong)param_6,local_68 + 3,4); - memcpy_s(param_5 + 4,(ulonglong)param_6 - 4,local_58,(ulonglong)local_7c - ); - } - *param_7 = local_7c + 4; - } - } + memcpy_s(param_5,(ulonglong)param_6,lpMem + 3,4); + memcpy_s(param_5 + 4,(ulonglong)param_6 - 4,local_30,(ulonglong)local_40); } + *param_7 = local_40 + 4; } } +code_r0x0001400107a3: + for (; uVar12 != 0; uVar12 = uVar12 - 1) { + *(undefined1 *)puVar17 = 0; + puVar17 = (undefined4 *)((longlong)puVar17 + 1); + } + pvVar11 = GetProcessHeap(); + HeapFree(pvVar11,0,lpMem); + goto LAB_0; } - else { - NVar2 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - pcVar12 = "TRUE"; - pcVar6 = "TRUE"; - if (uVar14 == 0) { - pcVar6 = "FALSE"; - } - if (local_78 == 0) { - pcVar12 = "FALSE"; - } - WPP_SF_ssd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),"FALSE",uVar11,pcVar12, - pcVar6); - } - uVar14 = 0; - } - } - else if (local_78 == 0) { - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - pvVar9 = (BCRYPT_KEY_HANDLE)0x0; - } - else { - pvVar9 = *(BCRYPT_KEY_HANDLE *)(p_Var5 + 8); - } - NVar2 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8),pvVar9,param_4,param_5, - param_6,param_7,local_74); - uVar14 = local_84; - if (NVar2 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); - } - uVar14 = 0; - } + NVar4 = -0x7ff8fdea; + NVar5 = -0x7ff8fdea; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xa8; + } + } + else if (uVar21 == 0) { + if (p_Var9 == (_BCRYPT_ISO_OBJECT *)0x0) { + pvVar14 = (BCRYPT_KEY_HANDLE)0x0; } else { - NVar2 = -0x3ffffff3; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb3, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } - uVar14 = 0; - } - } + pvVar14 = *(BCRYPT_KEY_HANDLE *)(p_Var9 + 8); + } + NVar4 = BCryptExportKey(*(BCRYPT_KEY_HANDLE *)(p_Var8 + 8),pvVar14,param_4,param_5, + param_6,param_7,local_3c); + NVar5 = NVar4; + if (((-1 < NVar4) || ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control)) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xae; + } + else { + NVar4 = -0x3ffffff3; + NVar5 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xad; + } + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar13, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar4); + NVar5 = NVar4; + goto LAB_0; } - else { - NVar2 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa9, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); - } - uVar14 = 0; - } + NVar5 = -0x3fffff45; + bVar1 = bVar2; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xa2; } else { - NVar2 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xa8, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); - } + NVar5 = -0x3fffff45; + bVar1 = bVar2; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; + uVar13 = 0xa1; } + NVar4 = -0x3fffff45; + uVar19 = 0xc00000bb; } } + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar13, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,uVar19); + NVar5 = NVar4; + bVar1 = bVar2; LAB_0: - if (local_68 != (undefined4 *)0x0) { - puVar10 = local_68; - for (uVar8 = (ulonglong)uVar14; uVar8 != 0; uVar8 = uVar8 - 1) { - *(undefined1 *)puVar10 = 0; - puVar10 = (undefined4 *)((longlong)puVar10 + 1); - } - pvVar7 = GetProcessHeap(); - HeapFree(pvVar7,0,local_68); - } - if (local_58 != (void *)0x0) { - SafeAllocaFreeToHeap(local_58); - } - if (local_6c != 0) { - ReleaseSRWLockExclusive((PSRWLOCK)(p_Var4 + 0x28)); - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); - } - if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var5); + if (local_30 != (void *)0x0) { + MIDL_user_free(local_30); + } + if (local_38 != 0) { + ReleaseSRWLockExclusive((PSRWLOCK)(p_Var8 + 0x28)); + } + if (bVar1) { + ReleaseSRWLockShared((PSRWLOCK)(p_Var9 + 0x28)); + } + if (p_Var8 != (_BCRYPT_ISO_OBJECT *)0x0) { + BCryptIumDereferenceObject(p_Var8); + } + if (p_Var9 != (_BCRYPT_ISO_OBJECT *)0x0) { + BCryptIumDereferenceObject(p_Var9); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb7, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb1, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar5); } return unaff_EBX; } ``` ## WPP_SF_ssd ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.92| |i_ratio|0.34| |m_ratio|0.97| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|WPP_SF_ssd|WPP_SF_ssd| |fullname|WPP_SF_ssd|WPP_SF_ssd| |refcount|2|2| |`length`|181|191| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |calling|BCryptIumExportKey|BCryptIumExportKey| |paramcount|5|5| |`address`|140013b1c|140012eb4| |sig|undefined __fastcall WPP_SF_ssd(undefined8 param_1, undefined8 param_2, undefined8 param_3, char * param_4, char * param_5)|undefined __fastcall WPP_SF_ssd(undefined8 param_1, undefined8 param_2, undefined8 param_3, char * param_4, char * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_ssd Diff ```diff --- WPP_SF_ssd +++ WPP_SF_ssd @@ -1,42 +1,44 @@ void WPP_SF_ssd(undefined8 param_1,undefined8 param_2,undefined8 param_3,char *param_4,char *param_5 ) { longlong lVar1; longlong lVar2; longlong lVar3; + undefined4 local_18 [4]; + local_18[0] = 0xc000000d; if (param_5 == (char *)0x0) { lVar3 = 5; } else { lVar2 = -1; do { lVar3 = lVar2; lVar2 = lVar3 + 1; } while (param_5[lVar2] != '\0'); lVar3 = lVar3 + 2; } if (param_5 == (char *)0x0) { param_5 = "NULL"; } lVar2 = -1; if (param_4 == (char *)0x0) { lVar1 = 5; } else { do { lVar1 = lVar2; lVar2 = lVar1 + 1; } while (param_4[lVar2] != '\0'); lVar1 = lVar1 + 2; } if (param_4 == (char *)0x0) { param_4 = "NULL"; } - TraceMessage(param_1,0x2b,&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xac,param_4,lVar1, - param_5,lVar3,&stack0x00000030,4,0); + TraceMessage(param_1,0x2b,&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xa6,param_4,lVar1, + param_5,lVar3,local_18,4,0); return; } ``` ## BCryptIumGetClientContext ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.71| |i_ratio|0.42| |m_ratio|0.97| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumGetClientContext|BCryptIumGetClientContext| |fullname|BCryptIumGetClientContext|BCryptIumGetClientContext| |refcount|3|3| |`length`|130|124| |called|BCryptIumContextManagerCreateContext
WPP_SF_
WPP_SF_D|BCryptIumContextManagerCreateContext
WPP_SF_
WPP_SF_D| |calling||| |paramcount|3|3| |`address`|140011a10|140011120| |sig|long __fastcall BCryptIumGetClientContext(undefined8 param_1, undefined8 * param_2, undefined * param_3)|long __fastcall BCryptIumGetClientContext(undefined8 param_1, undefined8 * param_2, undefined * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumGetClientContext Diff ```diff --- BCryptIumGetClientContext +++ BCryptIumGetClientContext @@ -1,24 +1,24 @@ long BCryptIumGetClientContext(undefined8 param_1,undefined8 *param_2,undefined *param_3) { long lVar1; undefined8 *puVar2; puVar2 = param_2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - puVar2 = (undefined8 *)0x5c; - param_3 = &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5c, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + param_3 = &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + puVar2 = (undefined8 *)0x5a; + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5a, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } lVar1 = BCryptIumContextManagerCreateContext(param_2,puVar2,param_3); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5d, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5b, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar1); } return lVar1; } ``` ## BCryptIumSecretAgreement ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.22| |i_ratio|0.23| |m_ratio|1.0| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumSecretAgreement|BCryptIumSecretAgreement| |fullname|BCryptIumSecretAgreement|BCryptIumSecretAgreement| |refcount|3|3| |`length`|745|783| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroySecret
BCRYPT.DLL::BCryptSecretAgreement
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroySecret
BCRYPT.DLL::BCryptSecretAgreement
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_WPP_SF_D
WPP_SF_IL
| |calling||| |paramcount|5|5| |`address`|1400128b0|140011d70| |sig|NTSTATUS __fastcall BCryptIumSecretAgreement(longlong param_1, __uint64 param_2, __uint64 param_3, undefined8 * param_4, ULONG param_5)|NTSTATUS __fastcall BCryptIumSecretAgreement(longlong param_1, __uint64 param_2, __uint64 param_3, undefined8 * param_4, ULONG param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumSecretAgreement Called Diff ```diff --- BCryptIumSecretAgreement called +++ BCryptIumSecretAgreement called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -11 +13 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumSecretAgreement Diff ```diff --- BCryptIumSecretAgreement +++ BCryptIumSecretAgreement @@ -1,110 +1,122 @@ NTSTATUS BCryptIumSecretAgreement (longlong param_1,__uint64 param_2,__uint64 param_3,undefined8 *param_4, ULONG param_5) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; _BCRYPT_ISO_OBJECT *p_Var4; _BCRYPT_ISO_OBJECT *p_Var5; - undefined8 uVar6; + undefined2 uVar6; + NTSTATUS unaff_EBX; + undefined8 uVar7; BCRYPT_SECRET_HANDLE *phAgreedSecret; - BCRYPT_SECRET_HANDLE local_40; - _BCRYPT_ISO_OBJECT *local_38; - _BCRYPT_ISO_OBJECT *local_30; + bool bVar8; + BCRYPT_SECRET_HANDLE local_38 [2]; - local_38 = (_BCRYPT_ISO_OBJECT *)0x0; - p_Var4 = (_BCRYPT_ISO_OBJECT *)0x0; - local_30 = (_BCRYPT_ISO_OBJECT *)0x0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf4, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf0, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar1 = -0x3fffffde; + return unaff_EBX; + } + uVar7 = 0x42494f4b; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + NVar1 = -0x3ffffff8; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf1,uVar7,param_2); + NVar1 = -0x3ffffff8; + } + goto LAB_0; + } + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + phAgreedSecret = (BCRYPT_SECRET_HANDLE *)0x42494f4b; + p_Var4 = LookupBCryptIsoObject(pBVar2,param_3,0x42494f4b); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar1 = -0x3ffffff8; + bVar8 = false; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (bVar8 = false, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = 0xf3; + NVar1 = -0x3ffffff8; +LAB_1: + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar6,phAgreedSecret,param_3); + } } else { - uVar6 = 0x42494f4b; - p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); - local_38 = p_Var3; - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf5,uVar6,param_2); + bVar8 = p_Var4 != p_Var3; + if (bVar8) { + AcquireSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + } + if ((*(uint *)(p_Var3 + 0x10) & 0x70) == 0) { + local_38[0] = (void *)0x0; + phAgreedSecret = local_38; + NVar1 = BCryptSecretAgreement + (*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8), + phAgreedSecret,param_5); + if (NVar1 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar6 = 0xf7; + param_3 = param_2; + goto LAB_1; + } + } + else { + p_Var5 = AllocateBCryptIsoObject(local_38[0],0x42494f53); + if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar1 = -0x3fffffe9; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf6, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); + } + BCryptDestroySecret(local_38[0]); + } + else { + NVar1 = IndexBCryptIsoObject(pBVar2,p_Var5); + if (NVar1 < 0) { + BCryptIumDereferenceObject(p_Var5); + } + else { + *param_4 = *(undefined8 *)(p_Var5 + 0x18); + } + } } } else { - uVar6 = 0x42494f4b; - p_Var4 = LookupBCryptIsoObject(pBVar2,param_3,0x42494f4b); - local_30 = p_Var4; - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar1 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf6,uVar6,param_3); - } - } - else if ((*(uint *)(p_Var3 + 0x10) & 0x70) == 0) { - local_40 = (void *)0x0; - phAgreedSecret = &local_40; - NVar1 = BCryptSecretAgreement - (*(BCRYPT_KEY_HANDLE *)(p_Var3 + 8),*(BCRYPT_KEY_HANDLE *)(p_Var4 + 8), - phAgreedSecret,param_5); - if (NVar1 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf9,phAgreedSecret,param_2); - } - } - else { - p_Var5 = AllocateBCryptIsoObject(local_40,0x42494f53); - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar1 = -0x3fffffe9; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf8, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); - } - BCryptDestroySecret(local_40); - } - else { - NVar1 = IndexBCryptIsoObject(pBVar2,p_Var5); - if (NVar1 < 0) { - BCryptIumDereferenceObject(p_Var5); - } - else { - *param_4 = *(undefined8 *)(p_Var5 + 0x18); - } - } - } - } - else { - NVar1 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf7, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); - } + NVar1 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xf5, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc00000bb); } } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var3); - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfb, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); - } } - return NVar1; + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + if (bVar8) { + ReleaseSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + } + BCryptIumDereferenceObject(p_Var3); + if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { + BCryptIumDereferenceObject(p_Var4); + } +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xfa, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); + } + return unaff_EBX; } ``` ## FilterPolicyFlags ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.6| |i_ratio|0.59| |m_ratio|0.99| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|FilterPolicyFlags|FilterPolicyFlags| |fullname|FilterPolicyFlags|FilterPolicyFlags| |refcount|4|4| |`length`|143|144| |called|WPP_SF_D
WPP_SF_Ld|WPP_SF_D
WPP_SF_Ld| |calling|BCryptIumFinalizeKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumImportKeyGeneric|BCryptIumFinalizeKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumImportKeyGeneric| |paramcount|2|2| |`address`|1400099bc|1400098dc| |sig|void __cdecl FilterPolicyFlags(ulong * param_1, ulong * param_2)|void __cdecl FilterPolicyFlags(ulong * param_1, ulong * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### FilterPolicyFlags Diff ```diff --- FilterPolicyFlags +++ FilterPolicyFlags @@ -1,23 +1,27 @@ /* void __cdecl FilterPolicyFlags(unsigned long * __ptr64,unsigned long * __ptr64) */ void __cdecl FilterPolicyFlags(ulong *param_1,ulong *param_2) { + uint uVar1; undefined *in_R8; + uint uVar2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - in_R8 = &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),100, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,*param_1); + in_R8 = &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x61, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,*param_1); } - *param_2 = *param_1 & 0x80000077; - *param_1 = *param_1 & 0x7fffff88; + uVar1 = *param_1; + uVar2 = uVar1 & 0x80000077; + *param_2 = uVar2; + *param_1 = uVar1 & 0x7fffff88; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_Ld(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x65,in_R8,*param_2); + WPP_SF_Ld(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x62,in_R8,uVar2); } return; } ``` ## BCryptIumEncapsulate ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.18| |m_ratio|0.94| |b_ratio|0.76| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumEncapsulate|BCryptIumEncapsulate| |fullname|BCryptIumEncapsulate|BCryptIumEncapsulate| |refcount|3|3| |`length`|580|537| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptEncapsulate
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D
WPP_SF_Id|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptEncapsulate
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D
WPP_SF_IL
| |calling||| |paramcount|9|9| |`address`|140010270|14000fde0| |sig|undefined4 __fastcall BCryptIumEncapsulate(longlong param_1, __uint64 param_2, undefined8 param_3, undefined4 param_4, longlong param_5, undefined8 param_6, undefined4 param_7, longlong param_8, int param_9)|undefined4 __fastcall BCryptIumEncapsulate(longlong param_1, __uint64 param_2, undefined8 param_3, undefined4 param_4, longlong param_5, undefined8 param_6, undefined4 param_7, longlong param_8, int param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumEncapsulate Called Diff ```diff --- BCryptIumEncapsulate called +++ BCryptIumEncapsulate called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -9 +11 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumEncapsulate Diff ```diff --- BCryptIumEncapsulate +++ BCryptIumEncapsulate @@ -1,71 +1,78 @@ undefined4 BCryptIumEncapsulate (longlong param_1,__uint64 param_2,undefined8 param_3,undefined4 param_4,longlong param_5, undefined8 param_6,undefined4 param_7,longlong param_8,int param_9) { undefined4 uVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; - undefined8 uVar4; + undefined2 uVar4; + undefined4 unaff_EBX; + undefined8 uVar5; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x107, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10c, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - uVar1 = 0xc0000022; + return unaff_EBX; + } + uVar5 = 0x42494f4b; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + uVar1 = 0xc0000008; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10d,uVar5,param_2); + } + goto LAB_0; + } + if (param_5 == 0) { + uVar1 = 0xc000000d; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (uVar1 = 0xc000000d, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = 0x10e; +LAB_1: + uVar1 = 0xc000000d; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar4, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + } + } + else if (param_8 == 0) { + uVar1 = 0xc000000d; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = 0x10f; + goto LAB_1; + } + } + else if (param_9 == 0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + uVar1 = BCryptEncapsulate(*(undefined8 *)(p_Var3 + 8),param_3,param_4,param_5,param_6,param_7, + param_8,0); + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); } else { - uVar4 = 0x42494f4b; - p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { - uVar1 = 0xc0000008; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x108,uVar4,param_2); - } - } - else if (param_5 == 0) { - uVar1 = 0xc000000d; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x109, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } - } - else if (param_8 == 0) { - uVar1 = 0xc000000d; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10a, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } - } - else if (param_9 == 0) { - uVar1 = BCryptEncapsulate(*(undefined8 *)(p_Var3 + 8),param_3,param_4,param_5,param_6,param_7, - param_8,0); - } - else { - uVar1 = 0xc000000d; - VBS_ATTEST_TRACE_ERROR_IN - (0xc000000d, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xc24); - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var3); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10c, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,uVar1); - } + uVar1 = 0xc000000d; + VBS_ATTEST_TRACE_ERROR_IN + (0xc000000d, + "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx",0xc54 + ); } - return uVar1; + BCryptIumDereferenceObject(p_Var3); +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x112, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,uVar1); + } + return unaff_EBX; } ``` ## BCryptIumCreateClaim ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.15| |m_ratio|0.92| |b_ratio|0.8| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumCreateClaim|BCryptIumCreateClaim| |fullname|BCryptIumCreateClaim|BCryptIumCreateClaim| |refcount|3|3| |`length`|978|778| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
BCryptIumRpcGetClaimKeyFlags
CreateVsmKeyAttestationClaim
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
BCryptIumRpcGetClaimKeyFlags
CreateVsmKeyAttestationClaim
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D
| |calling||| |paramcount|9|9| |`address`|14000f3f0|14000f240| |sig|long __fastcall BCryptIumCreateClaim(longlong param_1, __uint64 param_2, __uint64 param_3, int param_4, _BCryptrBufferDesc * param_5, uchar * param_6, ulong param_7, ulong * param_8, int param_9)|long __fastcall BCryptIumCreateClaim(longlong param_1, __uint64 param_2, __uint64 param_3, int param_4, _BCryptrBufferDesc * param_5, uchar * param_6, ulong param_7, ulong * param_8, int param_9)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumCreateClaim Called Diff ```diff --- BCryptIumCreateClaim called +++ BCryptIumCreateClaim called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared ``` ### BCryptIumCreateClaim Diff ```diff --- BCryptIumCreateClaim +++ BCryptIumCreateClaim @@ -1,154 +1,135 @@ long BCryptIumCreateClaim (longlong param_1,__uint64 param_2,__uint64 param_3,int param_4, _BCryptrBufferDesc *param_5,uchar *param_6,ulong param_7,ulong *param_8,int param_9) { - long lVar1; - BCRYPTIUM_CONTEXT *pBVar2; - _BCRYPT_ISO_OBJECT *p_Var3; + bool bVar1; + long lVar2; + BCRYPTIUM_CONTEXT *pBVar3; _BCRYPT_ISO_OBJECT *p_Var4; _BCRYPT_ISO_OBJECT *p_Var5; - ulong local_34; - ulong local_30 [2]; - _BCRYPT_ISO_OBJECT *local_28; - _BCRYPT_ISO_OBJECT *local_20; + long unaff_EBX; + undefined8 uVar6; + ulong local_28 [4]; - local_28 = (_BCRYPT_ISO_OBJECT *)0x0; - p_Var4 = (_BCRYPT_ISO_OBJECT *)0x0; p_Var5 = (_BCRYPT_ISO_OBJECT *)0x0; - local_20 = (_BCRYPT_ISO_OBJECT *)0x0; + bVar1 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x104, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x106, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - lVar1 = -0x3fffffde; + return unaff_EBX; + } + p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0x42494f4b); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + lVar2 = -0x3ffffff8; + VBS_ATTEST_TRACE_ERROR_IN + (0xc0000008, + "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx",0xb8d + ); + goto LAB_0; + } + if (param_8 == (ulong *)0x0) { + uVar6 = 0xb94; +LAB_1: + lVar2 = -0x3ffffff3; + VBS_ATTEST_TRACE_ERROR_IN + (0xc000000d, + "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx",uVar6 + ); } else { - p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); - local_28 = p_Var3; - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { - lVar1 = -0x3ffffff8; - VBS_ATTEST_TRACE_ERROR_IN - (0xc0000008, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xb70); + if (param_9 != 0) { + uVar6 = 0xb9e; + goto LAB_1; } - else if (param_8 == (ulong *)0x0) { - lVar1 = -0x3ffffff3; - VBS_ATTEST_TRACE_ERROR_IN - (0xc000000d, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xb77); - } - else if (param_9 == 0) { - if (param_4 == 5) { - local_30[0] = 0; + AcquireSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + if (param_4 != 5) { + if (param_4 == 6) { + local_28[0] = 0; if (param_3 == 0) { - lVar1 = BCryptIumRpcGetClaimKeyFlags(p_Var3,local_30); - if (lVar1 == 0) { - lVar1 = CreateVsmKeyAttestationClaim - (*(void **)(p_Var3 + 8),(void *)0x0,5,param_5,param_6,param_7,param_8, - local_30[0],0); - if (lVar1 != 0) { - VBS_ATTEST_TRACE_ERROR_IN - (lVar1, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xba8); - p_Var4 = p_Var5; - } - } - else { - VBS_ATTEST_TRACE_ERROR_IN - (lVar1, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xb98); - p_Var4 = p_Var5; - } + uVar6 = 0xbd7; } else { - lVar1 = -0x3ffffff8; - VBS_ATTEST_TRACE_ERROR_IN - (0xc0000008, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xb8f); - p_Var4 = p_Var5; - } - } - else if (param_4 == 6) { - local_34 = 0; - if (param_3 == 0) { - lVar1 = -0x3ffffff8; - VBS_ATTEST_TRACE_ERROR_IN - (0xc0000008, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xbb5); - p_Var4 = p_Var5; - } - else { - p_Var4 = LookupBCryptIsoObject(pBVar2,param_3,0x42494f4b); - local_20 = p_Var4; - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { - lVar1 = -0x3ffffff8; - VBS_ATTEST_TRACE_ERROR_IN - (0xc0000008, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xbbd); - } - else { - lVar1 = BCryptIumRpcGetClaimKeyFlags(p_Var3,&local_34); - if (lVar1 == 0) { - lVar1 = CreateVsmKeyAttestationClaim - (*(void **)(p_Var3 + 8),*(void **)(p_Var4 + 8),6,param_5,param_6, - param_7,param_8,local_34,*(ulong *)(p_Var4 + 0x10)); - if (lVar1 != 0) { - VBS_ATTEST_TRACE_ERROR_IN - (lVar1, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xbd6); - } + p_Var5 = LookupBCryptIsoObject(pBVar3,param_3,0x42494f4b); + if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); + bVar1 = true; + lVar2 = BCryptIumRpcGetClaimKeyFlags(p_Var4,local_28); + if (lVar2 == 0) { + lVar2 = CreateVsmKeyAttestationClaim + (*(void **)(p_Var4 + 8),*(void **)(p_Var5 + 8),6,param_5,param_6, + param_7,param_8,local_28[0],*(ulong *)(p_Var5 + 0x10)); + if (lVar2 == 0) goto LAB_2; + uVar6 = 0xbfe; + bVar1 = true; } else { - VBS_ATTEST_TRACE_ERROR_IN - (lVar1, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx" - ,0xbc6); + uVar6 = 0xbee; + bVar1 = true; } + goto LAB_3; } + uVar6 = 0xbdf; } +LAB_4: + lVar2 = -0x3ffffff8; + bVar1 = false; } else { - lVar1 = -0x3fffff45; - VBS_ATTEST_TRACE_ERROR_IN - (0xc00000bb, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xbdd); - p_Var4 = p_Var5; + lVar2 = -0x3fffff45; + uVar6 = 0xc05; + bVar1 = false; + } + goto LAB_3; + } + local_28[0] = 0; + if (param_3 != 0) { + uVar6 = 0xbb1; + goto LAB_4; + } + lVar2 = BCryptIumRpcGetClaimKeyFlags(p_Var4,local_28); + if (lVar2 == 0) { + lVar2 = CreateVsmKeyAttestationClaim + (*(void **)(p_Var4 + 8),(void *)0x0,5,param_5,param_6,param_7,param_8, + local_28[0],0); + if (lVar2 != 0) { + uVar6 = 0xbca; + p_Var5 = (_BCRYPT_ISO_OBJECT *)0x0; + bVar1 = false; + goto LAB_3; } } else { - lVar1 = -0x3ffffff3; + uVar6 = 0xbba; + bVar1 = false; +LAB_3: VBS_ATTEST_TRACE_ERROR_IN - (0xc000000d, + (lVar2, "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xb81); + uVar6); } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var3); - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x106, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,lVar1); +LAB_2: + ReleaseSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); + if (bVar1) { + ReleaseSRWLockShared((PSRWLOCK)(p_Var5 + 0x28)); } } - return lVar1; + BCryptIumDereferenceObject(p_Var4); + if (p_Var5 != (_BCRYPT_ISO_OBJECT *)0x0) { + BCryptIumDereferenceObject(p_Var5); + } +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10b, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,lVar2); + } + return unaff_EBX; } ``` ## BCryptIumImportKeyGeneric ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.38| |i_ratio|0.08| |m_ratio|0.99| |b_ratio|0.2| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumImportKeyGeneric|BCryptIumImportKeyGeneric| |fullname|BCryptIumImportKeyGeneric|BCryptIumImportKeyGeneric| |refcount|3|3| |`length`|2076|2082| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptImportKey
BCRYPT.DLL::BCryptImportKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
FilterPolicyFlags
ImportIsolatedKey
IndexBCryptIsoObject
LookupBCryptIsoObjectSafeAllocaFreeToHeap
WPP_SF_D
WPP_SF_I
WPP_SF_IIS
WPP_SF_Id
WPP_SF_dd
_guard_dispatch_icall$thunk$10345483385596137414
wcscmp
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptImportKey
BCRYPT.DLL::BCryptImportKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
FilterPolicyFlags
ImportIsolatedKeyIndexBCryptIsoObject
LookupBCryptIsoObject
MIDL_user_free
WPP_SF_D
WPP_SF_I
WPP_SF_IIS
WPP_SF_IL
WPP_SF_dd
_guard_dispatch_icall$thunk$10345483385596137414
wcscmp
| |calling|BCryptIumImportKey
BCryptIumImportKeyPair|BCryptIumImportKey
BCryptIumImportKeyPair| |paramcount|11|11| |`address`|14000872c|140008700| |sig|long __cdecl BCryptIumImportKeyGeneric(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, uchar * param_6, ulong param_7, uchar * param_8, ulong param_9, ulong param_10, int param_11)|long __cdecl BCryptIumImportKeyGeneric(void * param_1, __uint64 param_2, __uint64 param_3, ushort * param_4, __uint64 * param_5, uchar * param_6, ulong param_7, uchar * param_8, ulong param_9, ulong param_10, int param_11)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### BCryptIumImportKeyGeneric Called Diff ```diff --- BCryptIumImportKeyGeneric called +++ BCryptIumImportKeyGeneric called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -12 +14 @@ -SafeAllocaFreeToHeap +MIDL_user_free @@ -16 +18 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumImportKeyGeneric Diff ```diff --- BCryptIumImportKeyGeneric +++ BCryptIumImportKeyGeneric @@ -1,320 +1,322 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* long __cdecl BCryptIumImportKeyGeneric(void * __ptr64,unsigned __int64,unsigned __int64,unsigned short const * __ptr64,unsigned __int64 * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned long,int) */ long __cdecl BCryptIumImportKeyGeneric (void *param_1,__uint64 param_2,__uint64 param_3,ushort *param_4,__uint64 *param_5, uchar *param_6,ulong param_7,uchar *param_8,ulong param_9,ulong param_10,int param_11) { int iVar1; uint uVar2; ulong uVar3; int iVar4; - int iVar5; - wchar_t *pwVar6; + wchar_t *pwVar5; + BCRYPTIUM_CONTEXT *pBVar6; _BCRYPT_ISO_OBJECT *p_Var7; _BCRYPT_ISO_OBJECT *p_Var8; - undefined2 uVar9; - undefined **ppuVar10; + _BCRYPT_ISO_OBJECT *p_Var9; + undefined2 uVar10; _BCRYPT_ISO_OBJECT *p_Var11; void **ppvVar12; - uint dwFlags; - ulong local_54; - uint local_50; - int local_4c; + ulong dwFlags; + ulong local_58; + uint local_54; + uint local_50 [2]; void *local_48; int *local_40; - undefined8 local_38; - _BCRYPT_ISO_OBJECT *local_30; - BCRYPTIUM_CONTEXT *local_28; - _BCRYPT_ISO_OBJECT *local_20; + BCRYPTIUM_CONTEXT *local_38; p_Var11 = (_BCRYPT_ISO_OBJECT *)0x0; - iVar5 = 0; - local_4c = 0; + local_54 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - pwVar6 = (wchar_t *)param_4; + pwVar5 = (wchar_t *)param_4; if (param_4 == (ushort *)0x0) { - pwVar6 = L"NULL"; - } - WPP_SF_IIS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),L"NULL",param_3,param_2,param_3,pwVar6); - } - local_28 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext((longlong)param_1); - if (local_28 == (BCRYPTIUM_CONTEXT *)0x0) { + pwVar5 = L"NULL"; + } + WPP_SF_IIS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),L"NULL",param_3,param_2,param_3,pwVar5); + } + pBVar6 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext((longlong)param_1); + local_38 = pBVar6; + if (pBVar6 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); return -0x3fffffde; } + ppvVar12 = (void **)0x42494f41; local_48 = (void *)0x0; local_40 = (int *)0x0; - local_50 = 0; - local_38 = (_BCRYPT_ISO_OBJECT *)((ulonglong)local_38._4_4_ << 0x20); - local_54 = 0; - ppvVar12 = (void **)0x42494f41; - local_30 = LookupBCryptIsoObject(local_28,param_2,0x42494f41); - if (local_30 == (_BCRYPT_ISO_OBJECT *)0x0) { - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - p_Var7 = p_Var11; + local_50[0] = 0; + local_58 = 0; + p_Var7 = LookupBCryptIsoObject(pBVar6,param_2,0x42494f41); + if (p_Var7 == (_BCRYPT_ISO_OBJECT *)0x0) { iVar4 = -0x3ffffff8; + p_Var8 = p_Var11; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - (p_Var7 = (_BCRYPT_ISO_OBJECT *)0x0, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb9,ppvVar12,param_2); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - p_Var7 = p_Var11; - iVar4 = -0x3ffffff8; + (p_Var8 = (_BCRYPT_ISO_OBJECT *)0x0, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb3,ppvVar12,param_2); } goto LAB_0; } ppvVar12 = (void **)0x42494f4b; - p_Var7 = LookupBCryptIsoObject(local_28,param_3,0x42494f4b); - local_20 = p_Var7; - if (((p_Var7 == (_BCRYPT_ISO_OBJECT *)0x0) && + p_Var8 = LookupBCryptIsoObject(pBVar6,param_3,0x42494f4b); + if (((p_Var8 == (_BCRYPT_ISO_OBJECT *)0x0) && ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_I(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xba,ppvVar12,param_3); - } + WPP_SF_I(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb4,ppvVar12,param_3); + } + AcquireSRWLockShared((PSRWLOCK)(p_Var7 + 0x28)); uVar3 = param_10; - ppuVar10 = (undefined **)WPP_GLOBAL_Control; dwFlags = param_10 & 0x7fffffff; param_10 = dwFlags; iVar4 = wcscmp(L"ISOPROTECTEDBLOB",(wchar_t *)param_4); if (iVar4 == 0) { if ((((uVar3 & 3) == 0) && (ppvVar12 = (void **)(ulonglong)param_9, 4 < param_9)) && (param_8 != (uchar *)0x0)) { iVar1 = *(int *)param_8; ppvVar12 = (void **)(ulonglong)(param_9 - 4); iVar4 = (*DAT_1)("BCryptIsoKeyData",param_8 + 4,ppvVar12,MIDLAllocWrapper, - MIDLFreeWrapper,&local_40,&local_50,0,0); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + MIDLFreeWrapper,&local_40,local_50,0,0); if (iVar4 < 0) { if (iVar4 == -0x3fff5ffe) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - ppvVar12 = (void **)&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xbc, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000a002); - } - ppuVar10 = (undefined **)WPP_GLOBAL_Control; iVar4 = -0x3ffffd75; - goto LAB_0; - } - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 0xbd; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + ppvVar12 = (void **)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_dd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb7, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000a002); + } + } + else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + ppvVar12 = (void **)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xb8, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,iVar4); + } } else { param_8 = (uchar *)(local_40 + 3); - if (local_50 < 0xc) { - param_9 = 0xffffffff; - iVar5 = -0x7ff8fdea; + if (local_50[0] < 0xc) { + iVar4 = -0x7ff8fdea; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xb9; + iVar4 = -0x7ff8fdea; + goto LAB_2; + } } else { - param_9 = local_50 - 0xc; - } - local_38 = (_BCRYPT_ISO_OBJECT *)param_8; - if (iVar5 < 0) { - iVar4 = iVar5; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 0xbe; - } - else { + param_9 = local_50[0] - 0xc; if (*local_40 == 0x424f5349) { uVar2 = local_40[1]; ppvVar12 = (void **)(ulonglong)(uVar2 & 0x41); if (((char)(uVar2 & 0x41) != 'A' && ((uVar2 & 0x7fffff8a) == 0 && ((byte)uVar2 & 0x11) != 0x11)) && (local_40[2] == param_9)) { *(int *)param_8 = iVar1; - local_54 = local_40[1]; + local_58 = local_40[1]; param_4 = (ushort *)L"PRIVATEBLOB"; - iVar5 = param_11; if (param_11 == 0) { param_4 = (ushort *)L"KeyDataBlob"; } - goto LAB_2; + goto LAB_3; } } iVar4 = -0x3ffff6f5; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 0xbf; - iVar4 = -0x3ffff6f5; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xba; + iVar4 = -0x3ffff6f5; + goto LAB_2; + } } } } else { iVar4 = -0x3ffffff3; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0)) - goto LAB_0; - uVar9 = 0xbb; - iVar4 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xb6; + iVar4 = -0x3ffffff3; + goto LAB_2; + } } } else { iVar4 = wcscmp((wchar_t *)param_4,L"ISOLATED_KEY_ENVELOPE"); - iVar5 = param_11; if (iVar4 == 0) { if ((uVar3 & 0x7fffffe3) == 0) { - if (p_Var7 == (_BCRYPT_ISO_OBJECT *)0x0) { + if (p_Var8 == (_BCRYPT_ISO_OBJECT *)0x0) { iVar4 = -0x3ffffff3; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0) - ) goto LAB_0; - uVar9 = 0xc1; - iVar4 = -0x3ffffff3; - } - else if ((*(uint *)(p_Var7 + 0x10) & 0x7fffffff) == 0x10) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xbc; + iVar4 = -0x3ffffff3; + goto LAB_2; + } + } + else if ((*(uint *)(p_Var8 + 0x10) & 0x7fffffff) == 0x10) { + AcquireSRWLockShared((PSRWLOCK)(p_Var8 + 0x28)); ppvVar12 = &local_48; - iVar4 = ImportIsolatedKey(*(void **)(local_30 + 8),*(void **)(p_Var7 + 8),ppvVar12,param_8 - ,param_9,param_11,&local_54); + local_54 = 1; + iVar4 = ImportIsolatedKey(*(void **)(p_Var7 + 8),*(void **)(p_Var8 + 8),ppvVar12,param_8, + param_9,param_11,&local_58); if (-1 < iVar4) { - local_4c = 1; - param_10 = dwFlags | local_54; - param_8 = (uchar *)p_Var11; - dwFlags = param_10; - param_9 = (ULONG)local_38; - goto LAB_2; - } - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 0xc3; + local_54 = 1; + goto LAB_4; + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xbf; + goto LAB_2; + } } else { iVar4 = -0x3fffffde; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0) - ) goto LAB_0; - uVar9 = 0xc2; - iVar4 = -0x3fffffde; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xbd; + iVar4 = -0x3fffffde; + goto LAB_2; + } } } else { iVar4 = -0x3ffffff3; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0)) - goto LAB_0; - uVar9 = 0xc0; - iVar4 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xbb; + iVar4 = -0x3ffffff3; + goto LAB_2; + } } } else { - iVar5 = wcscmp(L"PKCS11RsaAesWrapBlob",(wchar_t *)param_4); - if (iVar5 == 0) { - if (p_Var7 == (_BCRYPT_ISO_OBJECT *)0x0) { + iVar4 = wcscmp(L"PKCS11RsaAesWrapBlob",(wchar_t *)param_4); + if (iVar4 == 0) { + if (p_Var8 == (_BCRYPT_ISO_OBJECT *)0x0) { iVar4 = -0x3ffffff3; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0) - ) goto LAB_0; - uVar9 = 0xc4; - iVar4 = -0x3ffffff3; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xc0; + iVar4 = -0x3ffffff3; + goto LAB_2; + } } else { - if (((*(uint *)(p_Var7 + 0x10) & 0x7ffffffb) == 0x10) || - ((*(uint *)(p_Var7 + 0x10) & 0x7ffffffb) == 0x40)) goto LAB_3; + if (((*(uint *)(p_Var8 + 0x10) & 0x7ffffffb) == 0x10) || + ((*(uint *)(p_Var8 + 0x10) & 0x7ffffffb) == 0x40)) goto LAB_5; iVar4 = -0x3fffffde; - if ((ppuVar10 == &WPP_GLOBAL_Control) || ((*(byte *)((longlong)ppuVar10 + 0x1c) & 1) == 0) - ) goto LAB_0; - uVar9 = 0xc5; - iVar4 = -0x3fffffde; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xc1; + iVar4 = -0x3fffffde; + goto LAB_2; + } } } else { +LAB_5: + FilterPolicyFlags(¶m_10,&local_58); + dwFlags = param_10; LAB_3: - FilterPolicyFlags(¶m_10,&local_54); - dwFlags = param_10; - iVar5 = param_11; -LAB_2: - if (local_4c != 0) { -LAB_4: - p_Var8 = AllocateBCryptIsoObject(local_48,0x42494f4b); - if (p_Var8 == (_BCRYPT_ISO_OBJECT *)0x0) { - iVar4 = -0x3fffffe9; + p_Var9 = p_Var11; + if (p_Var8 != (_BCRYPT_ISO_OBJECT *)0x0) { + local_54 = 0; + AcquireSRWLockShared((PSRWLOCK)(p_Var8 + 0x28)); + p_Var9 = *(_BCRYPT_ISO_OBJECT **)(p_Var8 + 8); + } + local_54 = (uint)(p_Var8 != (_BCRYPT_ISO_OBJECT *)0x0); + ppvVar12 = (void **)param_4; + if (param_11 == 0) { + iVar4 = BCryptImportKey(*(BCRYPT_ALG_HANDLE *)(p_Var7 + 8),p_Var9,(LPCWSTR)param_4, + &local_48,param_6,param_7,param_8,param_9,dwFlags); + pBVar6 = local_38; + if (-1 < iVar4) goto LAB_4; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar10 = 0xc4; + goto LAB_2; + } + } + else { + iVar4 = BCryptImportKeyPair(*(BCRYPT_ALG_HANDLE *)(p_Var7 + 8),p_Var9,(LPCWSTR)param_4, + &local_48,param_8,param_9,dwFlags); + pBVar6 = local_38; + if (iVar4 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - ppvVar12 = (void **)&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),200, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + uVar10 = 0xc3; +LAB_2: + ppvVar12 = (void **)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar10, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,iVar4); } - BCryptDestroyKey(local_48); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; } else { - *(ulong *)(p_Var8 + 0x10) = local_54; - iVar5 = wcscmp((wchar_t *)param_4,L"PKCS11RsaAesWrapBlob"); - if (((iVar5 == 0) && (p_Var7 != (_BCRYPT_ISO_OBJECT *)0x0)) && - (((byte)p_Var7[0x10] & 0x40) != 0)) { - *(ulong *)(p_Var8 + 0x10) = local_54 | 4; - } - iVar4 = IndexBCryptIsoObject(local_28,p_Var8); - if (iVar4 < 0) { +LAB_4: + p_Var9 = AllocateBCryptIsoObject(local_48,0x42494f4b); + if (p_Var9 == (_BCRYPT_ISO_OBJECT *)0x0) { + iVar4 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - ppvVar12 = (void **)&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc9, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,iVar4); - } - BCryptIumDereferenceObject(p_Var8); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + ppvVar12 = (void **)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc5, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); + } + BCryptDestroyKey(local_48); } else { - *param_5 = *(__uint64 *)(p_Var8 + 0x18); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + *(ulong *)(p_Var9 + 0x10) = local_58; + iVar4 = wcscmp((wchar_t *)param_4,L"PKCS11RsaAesWrapBlob"); + if (((iVar4 == 0) && (p_Var8 != (_BCRYPT_ISO_OBJECT *)0x0)) && + (((byte)p_Var8[0x10] & 0x40) != 0)) { + *(ulong *)(p_Var9 + 0x10) = local_58 | 4; + } + iVar4 = IndexBCryptIsoObject(pBVar6,p_Var9); + if (iVar4 < 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + ppvVar12 = (void **)&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc6, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,iVar4); + } + BCryptIumDereferenceObject(p_Var9); + } + else { + *param_5 = *(__uint64 *)(p_Var9 + 0x18); + } } } - goto LAB_0; - } - p_Var8 = p_Var11; - if (p_Var7 != (_BCRYPT_ISO_OBJECT *)0x0) { - p_Var8 = *(_BCRYPT_ISO_OBJECT **)(p_Var7 + 8); - } - ppvVar12 = (void **)param_4; - if (iVar5 == 0) { - iVar4 = BCryptImportKey(*(BCRYPT_ALG_HANDLE *)(local_30 + 8),p_Var8,(LPCWSTR)param_4, - &local_48,param_6,param_7,param_8,param_9,dwFlags); - if (-1 < iVar4) goto LAB_4; - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 199; - } - else { - iVar4 = BCryptImportKeyPair(*(BCRYPT_ALG_HANDLE *)(local_30 + 8),p_Var8,(LPCWSTR)param_4, - &local_48,param_8,param_9,dwFlags); - if (-1 < iVar4) goto LAB_4; - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || - ((WPP_GLOBAL_Control[0x1c] & 1) == 0)) goto LAB_0; - uVar9 = 0xc6; - } - } - } - } - ppvVar12 = (void **)&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids; - WPP_SF_D(*(undefined8 *)((longlong)ppuVar10 + 0x10),uVar9, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,iVar4); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + } + } + } + } + ReleaseSRWLockShared((PSRWLOCK)(p_Var7 + 0x28)); + if (local_54 != 0) { + ReleaseSRWLockShared((PSRWLOCK)(p_Var8 + 0x28)); + } LAB_0: if (local_40 != (int *)0x0) { - SafeAllocaFreeToHeap(local_40); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - } - if (local_30 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(local_30); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + MIDL_user_free(local_40); } if (p_Var7 != (_BCRYPT_ISO_OBJECT *)0x0) { BCryptIumDereferenceObject(p_Var7); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - } - if ((ppuVar10 != &WPP_GLOBAL_Control) && ((*(byte *)((longlong)ppuVar10 + 0x1c) & 4) != 0)) { + } + if (p_Var8 != (_BCRYPT_ISO_OBJECT *)0x0) { + BCryptIumDereferenceObject(p_Var8); + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { if (param_5 != (__uint64 *)0x0) { p_Var11 = (_BCRYPT_ISO_OBJECT *)*param_5; } - WPP_SF_Id(ppuVar10[2],0xcb,ppvVar12,p_Var11); + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc9,ppvVar12,p_Var11); } return iVar4; } ``` ## BCryptIumSetProperty ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.25| |m_ratio|0.97| |b_ratio|0.86| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumSetProperty|BCryptIumSetProperty| |fullname|BCryptIumSetProperty|BCryptIumSetProperty| |refcount|3|3| |`length`|654|626| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptSetProperty
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_Id
WPP_SF_Sdwcscmp
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptSetProperty
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
WPP_SF_
WPP_SF_D
WPP_SF_IL
WPP_SF_Sdwcscmp
| |calling||| |paramcount|6|6| |`address`|140012bf0|140012090| |sig|NTSTATUS __fastcall BCryptIumSetProperty(longlong param_1, __uint64 param_2, wchar_t * param_3, PUCHAR param_4, ULONG param_5, ULONG param_6)|NTSTATUS __fastcall BCryptIumSetProperty(longlong param_1, __uint64 param_2, wchar_t * param_3, PUCHAR param_4, ULONG param_5, ULONG param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumSetProperty Called Diff ```diff --- BCryptIumSetProperty called +++ BCryptIumSetProperty called @@ -10 +10 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumSetProperty Diff ```diff --- BCryptIumSetProperty +++ BCryptIumSetProperty @@ -1,82 +1,88 @@ NTSTATUS BCryptIumSetProperty (longlong param_1,__uint64 param_2,wchar_t *param_3,PUCHAR param_4,ULONG param_5, ULONG param_6) { - bool bVar1; - bool bVar2; - int iVar3; - NTSTATUS NVar4; - BCRYPTIUM_CONTEXT *pBVar5; - _BCRYPT_ISO_OBJECT *p_Var6; - undefined8 uVar7; + int iVar1; + NTSTATUS NVar2; + BCRYPTIUM_CONTEXT *pBVar3; + _BCRYPT_ISO_OBJECT *p_Var4; + undefined2 uVar5; + NTSTATUS unaff_EBX; + undefined8 uVar6; - bVar1 = false; - bVar2 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x75, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x71, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } - pBVar5 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar5 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar4 = -0x3fffffde; + return unaff_EBX; + } + uVar6 = 0; + p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar2 = -0x3ffffff8; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x72,uVar6,param_2); + } + goto LAB_0; + } + iVar1 = wcscmp(param_3,L"Export Policy"); + if (iVar1 == 0) { + NVar2 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (NVar2 = -0x3fffff45, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar5 = 0x73; +LAB_1: + NVar2 = -0x3fffff45; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar5, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc00000bb); + } } else { - uVar7 = 0; - p_Var6 = LookupBCryptIsoObject(pBVar5,param_2,0); - if (p_Var6 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar4 = -0x3ffffff8; + iVar1 = wcscmp(param_3,L"PrivKeyVal"); + if (iVar1 == 0) { + NVar2 = -0x3fffff45; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x76,uVar7,param_2); + uVar5 = 0x74; + goto LAB_1; } } + else if ((*(int *)(p_Var4 + 0x24) == 0) || + ((iVar1 = wcscmp(param_3,L"DHParameters"), iVar1 != 0 && + (iVar1 = wcscmp(param_3,L"SecretAgreementParam"), iVar1 != 0)))) { + AcquireSRWLockExclusive((PSRWLOCK)(p_Var4 + 0x28)); + NVar2 = BCryptSetProperty(*(BCRYPT_HANDLE *)(p_Var4 + 8),param_3,param_4,param_5,param_6); + if ((NVar2 < 0) && + (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)))) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x77,param_4,param_3); + } + ReleaseSRWLockExclusive((PSRWLOCK)(p_Var4 + 0x28)); + } else { - iVar3 = wcscmp(param_3,L"Export Policy"); - bVar1 = bVar2; - if (iVar3 == 0) { - NVar4 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x77, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc00000bb); - } - } - else if ((*(int *)(p_Var6 + 0x24) == 0) || - ((iVar3 = wcscmp(param_3,L"DHParameters"), iVar3 != 0 && - (iVar3 = wcscmp(param_3,L"SecretAgreementParam"), iVar3 != 0)))) { - AcquireSRWLockExclusive((PSRWLOCK)(p_Var6 + 0x28)); - bVar1 = true; - NVar4 = BCryptSetProperty(*(BCRYPT_HANDLE *)(p_Var6 + 8),param_3,param_4,param_5,param_6); - if ((NVar4 < 0) && - (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)))) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7a,param_4,param_3); - } - } - else { - NVar4 = -0x3fffff45; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x78,uVar7,param_3); - } + NVar2 = -0x3fffff45; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x75,uVar6,param_3); } } - if (bVar1) { - ReleaseSRWLockExclusive((PSRWLOCK)(p_Var6 + 0x28)); - } - if (p_Var6 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var6); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7d, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar4); - } } - return NVar4; + BCryptIumDereferenceObject(p_Var4); +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x79, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar2); + } + return unaff_EBX; } ``` ## BCryptIumGenerateKeyPair ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.44| |i_ratio|0.23| |m_ratio|0.93| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumGenerateKeyPair|BCryptIumGenerateKeyPair| |fullname|BCryptIumGenerateKeyPair|BCryptIumGenerateKeyPair| |refcount|3|3| |`length`|671|586| |`called`|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptGenerateKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_DWPP_SF_Id
|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptDestroyKey
BCRYPT.DLL::BCryptGenerateKeyPair
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
LookupBCryptIsoObject
WPP_SF_DWPP_SF_IL
| |calling||| |paramcount|5|5| |`address`|1400112c0|140010b50| |sig|NTSTATUS __fastcall BCryptIumGenerateKeyPair(longlong param_1, __uint64 param_2, undefined8 * param_3, ULONG param_4, ULONG param_5)|NTSTATUS __fastcall BCryptIumGenerateKeyPair(longlong param_1, __uint64 param_2, undefined8 * param_3, ULONG param_4, ULONG param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumGenerateKeyPair Called Diff ```diff --- BCryptIumGenerateKeyPair called +++ BCryptIumGenerateKeyPair called @@ -12 +12 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumGenerateKeyPair Diff ```diff --- BCryptIumGenerateKeyPair +++ BCryptIumGenerateKeyPair @@ -1,92 +1,85 @@ NTSTATUS BCryptIumGenerateKeyPair (longlong param_1,__uint64 param_2,undefined8 *param_3,ULONG param_4, ULONG param_5) { - bool bVar1; - NTSTATUS NVar2; - BCRYPTIUM_CONTEXT *pBVar3; + NTSTATUS NVar1; + BCRYPTIUM_CONTEXT *pBVar2; + _BCRYPT_ISO_OBJECT *p_Var3; _BCRYPT_ISO_OBJECT *p_Var4; - _BCRYPT_ISO_OBJECT *p_Var5; - undefined8 uVar6; - BCRYPT_KEY_HANDLE local_30; - _BCRYPT_ISO_OBJECT *local_28; + undefined8 uVar5; + BCRYPT_KEY_HANDLE local_28 [2]; - local_28 = (_BCRYPT_ISO_OBJECT *)0x0; - bVar1 = false; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8f,param_3,param_2); + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x89,param_3,param_2); } - pBVar3 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); - if (pBVar3 == (BCRYPTIUM_CONTEXT *)0x0) { + pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); + if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - NVar2 = -0x3fffffde; + NVar1 = -0x3fffffde; } else { - local_30 = (void *)0x0; - uVar6 = 0x42494f41; - p_Var4 = LookupBCryptIsoObject(pBVar3,param_2,0x42494f41); - local_28 = p_Var4; - if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar2 = -0x3ffffff8; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x90,uVar6,param_2); + local_28[0] = (void *)0x0; + uVar5 = 0x42494f41; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f41); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return -0x3ffffff8; + } + NVar1 = -0x3ffffff8; + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8a,uVar5,param_2); + NVar1 = -0x3ffffff8; } } else { - AcquireSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); - bVar1 = true; - NVar2 = BCryptGenerateKeyPair(*(BCRYPT_ALG_HANDLE *)(p_Var4 + 8),&local_30,param_4,param_5); - if (NVar2 < 0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + NVar1 = BCryptGenerateKeyPair(*(BCRYPT_ALG_HANDLE *)(p_Var3 + 8),local_28,param_4,param_5); + if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x94, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8e, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } else { - p_Var5 = AllocateBCryptIsoObject(local_30,0x42494f4b); - if (p_Var5 == (_BCRYPT_ISO_OBJECT *)0x0) { - NVar2 = -0x3fffffe9; + p_Var4 = AllocateBCryptIsoObject(local_28[0],0x42494f4b); + if (p_Var4 == (_BCRYPT_ISO_OBJECT *)0x0) { + NVar1 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x92, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8c, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); } - BCryptDestroyKey(local_30); + BCryptDestroyKey(local_28[0]); } else { - *(uint *)(p_Var5 + 0x10) = *(uint *)(p_Var5 + 0x10) | 0x80000000; - NVar2 = IndexBCryptIsoObject(pBVar3,p_Var5); - if (NVar2 < 0) { + *(uint *)(p_Var4 + 0x10) = *(uint *)(p_Var4 + 0x10) | 0x80000000; + NVar1 = IndexBCryptIsoObject(pBVar2,p_Var4); + if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x93, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x8d, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } - BCryptIumDereferenceObject(p_Var5); + BCryptIumDereferenceObject(p_Var4); } else { - *param_3 = *(undefined8 *)(p_Var5 + 0x18); + *param_3 = *(undefined8 *)(p_Var4 + 0x18); } } } - } - if (bVar1) { - ReleaseSRWLockShared((PSRWLOCK)(p_Var4 + 0x28)); - } - if (p_Var4 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var4); + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + BCryptIumDereferenceObject(p_Var3); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x97, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar2); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x90, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } - return NVar2; + return NVar1; } ``` ## WPP_SF_LDd ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.5| |i_ratio|0.65| |m_ratio|0.98| |b_ratio|0.98| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|WPP_SF_LDd|WPP_SF_LDd| |fullname|WPP_SF_LDd|WPP_SF_LDd| |refcount|2|2| |`length`|89|97| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |calling|BCryptIumGetProperty|BCryptIumGetProperty| |paramcount|1|1| |`address`|140013828|140012bb8| |sig|undefined __fastcall WPP_SF_LDd(undefined8 param_1)|undefined __fastcall WPP_SF_LDd(undefined8 param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_LDd Diff ```diff --- WPP_SF_LDd +++ WPP_SF_LDd @@ -1,12 +1,14 @@ void WPP_SF_LDd(undefined8 param_1) { - undefined4 local_18 [6]; + undefined4 local_18 [2]; + undefined4 local_10 [4]; - local_18[0] = 4; - TraceMessage(param_1,0x2b,&WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0x6e,local_18,4, - &stack0x00000028,4,&stack0x00000030,4,0); + local_18[0] = 0xc000000d; + local_10[0] = 4; + TraceMessage(param_1,0x2b,&WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0x6b,local_10,4, + &stack0x00000028,4,local_18,4,0); return; } ``` ## BCryptIumOpenAlgorithmProvider ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address| |ratio|0.76| |i_ratio|0.28| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumOpenAlgorithmProvider|BCryptIumOpenAlgorithmProvider| |fullname|BCryptIumOpenAlgorithmProvider|BCryptIumOpenAlgorithmProvider| |refcount|3|3| |`length`|486|460| |called|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptCloseAlgorithmProvider
BCRYPT.DLL::BCryptOpenAlgorithmProvider
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
WPP_SF_D
WPP_SF_SD|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
AllocateBCryptIsoObject
BCRYPT.DLL::BCryptCloseAlgorithmProvider
BCRYPT.DLL::BCryptOpenAlgorithmProvider
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
IndexBCryptIsoObject
WPP_SF_D
WPP_SF_SD| |calling||| |paramcount|5|5| |`address`|140012440|1400119f0| |sig|NTSTATUS __fastcall BCryptIumOpenAlgorithmProvider(longlong param_1, undefined8 * param_2, LPCWSTR param_3, undefined8 param_4, ULONG param_5)|NTSTATUS __fastcall BCryptIumOpenAlgorithmProvider(longlong param_1, undefined8 * param_2, LPCWSTR param_3, undefined8 param_4, ULONG param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumOpenAlgorithmProvider Diff ```diff --- BCryptIumOpenAlgorithmProvider +++ BCryptIumOpenAlgorithmProvider @@ -1,71 +1,73 @@ NTSTATUS BCryptIumOpenAlgorithmProvider (longlong param_1,undefined8 *param_2,LPCWSTR param_3,undefined8 param_4, ULONG param_5) { NTSTATUS NVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; wchar_t *pwVar4; - BCRYPT_ALG_HANDLE local_10; + BCRYPT_ALG_HANDLE local_18 [2]; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { pwVar4 = param_3; if (param_3 == (LPCWSTR)0x0) { pwVar4 = L"(null)"; } WPP_SF_SD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),param_2,param_3,pwVar4); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); NVar1 = -0x3fffffde; } else { - local_10 = (void *)0x0; + local_18[0] = (void *)0x0; *param_2 = 0; - NVar1 = BCryptOpenAlgorithmProvider(&local_10,param_3,(LPCWSTR)0x0,param_5); + NVar1 = BCryptOpenAlgorithmProvider(local_18,param_3,(LPCWSTR)0x0,param_5); if (NVar1 < 0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x69, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return NVar1; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x66, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } else { - p_Var3 = AllocateBCryptIsoObject(local_10,0x42494f41); + p_Var3 = AllocateBCryptIsoObject(local_18[0],0x42494f41); if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { NVar1 = -0x3fffffe9; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x67, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc0000017); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),100, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc0000017); } - BCryptCloseAlgorithmProvider(local_10,0); + BCryptCloseAlgorithmProvider(local_18[0],0); } else { NVar1 = IndexBCryptIsoObject(pBVar2,p_Var3); if (NVar1 < 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x68, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x65, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } BCryptIumDereferenceObject(p_Var3); } else { *param_2 = *(undefined8 *)(p_Var3 + 0x18); } } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x6b, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,NVar1); + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x67, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,NVar1); } } return NVar1; } ``` ## BCryptIumDecapsulate ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.16| |m_ratio|0.95| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|BCryptIumDecapsulate|BCryptIumDecapsulate| |fullname|BCryptIumDecapsulate|BCryptIumDecapsulate| |refcount|3|3| |`length`|567|518| |`called`|API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDecapsulate
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D
WPP_SF_Id|
Expand for full list:
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared
API-MS-WIN-CORE-SYNCH-L1-2-0.DLL::Sleep
BCRYPT.DLL::BCryptDecapsulate
BCryptIumContextManagerGetContext
BCryptIumDereferenceObject
LookupBCryptIsoObject
VBS_ATTEST_TRACE_ERROR_IN
WPP_SF_
WPP_SF_D
WPP_SF_IL
| |calling||| |paramcount|8|8| |`address`|14000f820|14000f560| |sig|undefined4 __fastcall BCryptIumDecapsulate(longlong param_1, __uint64 param_2, longlong param_3, undefined4 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, int param_8)|undefined4 __fastcall BCryptIumDecapsulate(longlong param_1, __uint64 param_2, longlong param_3, undefined4 param_4, undefined8 param_5, undefined4 param_6, longlong param_7, int param_8)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BCryptIumDecapsulate Called Diff ```diff --- BCryptIumDecapsulate called +++ BCryptIumDecapsulate called @@ -0,0 +1,2 @@ +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared +API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared @@ -9 +11 @@ -WPP_SF_Id +WPP_SF_IL ``` ### BCryptIumDecapsulate Diff ```diff --- BCryptIumDecapsulate +++ BCryptIumDecapsulate @@ -1,71 +1,78 @@ undefined4 BCryptIumDecapsulate (longlong param_1,__uint64 param_2,longlong param_3,undefined4 param_4,undefined8 param_5, undefined4 param_6,longlong param_7,int param_8) { undefined4 uVar1; BCRYPTIUM_CONTEXT *pBVar2; _BCRYPT_ISO_OBJECT *p_Var3; - undefined8 uVar4; + undefined2 uVar4; + undefined4 unaff_EBX; + undefined8 uVar5; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10d, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids); + WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x113, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids); } pBVar2 = (BCRYPTIUM_CONTEXT *)BCryptIumContextManagerGetContext(param_1); if (pBVar2 == (BCRYPTIUM_CONTEXT *)0x0) { Sleep(5); - uVar1 = 0xc0000022; + return unaff_EBX; + } + uVar5 = 0x42494f4b; + p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); + if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { + uVar1 = 0xc0000008; + if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) { + return unaff_EBX; + } + if ((WPP_GLOBAL_Control[0x1c] & 1) != 0) { + WPP_SF_IL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x114,uVar5,param_2); + } + goto LAB_0; + } + if (param_7 == 0) { + uVar1 = 0xc000000d; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (uVar1 = 0xc000000d, (WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = 0x115; +LAB_1: + uVar1 = 0xc000000d; + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar4, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,0xc000000d); + } + } + else if (param_3 == 0) { + uVar1 = 0xc000000d; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { + uVar4 = 0x116; + goto LAB_1; + } + } + else if (param_8 == 0) { + AcquireSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); + uVar1 = BCryptDecapsulate(*(undefined8 *)(p_Var3 + 8),param_3,param_4,param_5,param_6,param_7,0) + ; + ReleaseSRWLockShared((PSRWLOCK)(p_Var3 + 0x28)); } else { - uVar4 = 0x42494f4b; - p_Var3 = LookupBCryptIsoObject(pBVar2,param_2,0x42494f4b); - if (p_Var3 == (_BCRYPT_ISO_OBJECT *)0x0) { - uVar1 = 0xc0000008; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_Id(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10e,uVar4,param_2); - } - } - else if (param_7 == 0) { - uVar1 = 0xc000000d; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10f, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } - } - else if (param_3 == 0) { - uVar1 = 0xc000000d; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x110, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,0xc000000d); - } - } - else if (param_8 == 0) { - uVar1 = BCryptDecapsulate(*(undefined8 *)(p_Var3 + 8),param_3,param_4,param_5,param_6,param_7, - 0); - } - else { - uVar1 = 0xc000000d; - VBS_ATTEST_TRACE_ERROR_IN - (0xc000000d, - "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx", - 0xc71); - } - if (p_Var3 != (_BCRYPT_ISO_OBJECT *)0x0) { - BCryptIumDereferenceObject(p_Var3); - } - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { - WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x112, - &WPP_c2bc974ad06c36b2e7589c51fe1cee53_Traceguids,uVar1); - } + uVar1 = 0xc000000d; + VBS_ATTEST_TRACE_ERROR_IN + (0xc000000d, + "onecore\\ds\\security\\cryptoapi\\ncrypt\\ium\\trustlet\\bcryptiumrpcimpl.cxx",0xca8 + ); } - return uVar1; + BCryptIumDereferenceObject(p_Var3); +LAB_0: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((WPP_GLOBAL_Control[0x1c] & 4) != 0)) { + WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x119, + &WPP_b52aeb96170734e42ce74233ea508fce_Traceguids,uVar1); + } + return unaff_EBX; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|47|48| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|140003a4c|1400039fc| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|33|34| |length|0|0| |called||| |`calling`|
Expand for full list:
::
::
BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumSetProperty
FreeBCryptIsoObject
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChangewil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
AllocateBCryptIsoObject
BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumSetProperty
FreeBCryptIsoObject
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlushwil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|EXTERNAL:0000004e|EXTERNAL:0000004e| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -2,0 +3 @@ +AllocateBCryptIsoObject ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|ReleaseSRWLockShared|ReleaseSRWLockShared| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared| |`refcount`|7|22| |length|0|0| |called||| |`calling`|BCryptIumContextManagerGetContext
BCryptIumEncrypt
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumGetProperty
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|
Expand for full list:
BCryptIumContextManagerGetContext
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDeriveKey
BCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKeyBCryptIumGetProperty
BCryptIumImportKeyGeneric
BCryptIumKeyDerivation
BCryptIumSecretAgreement
BCryptIumSignHash
BCryptIumVerifySignature
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
| |paramcount|1|1| |address|EXTERNAL:0000005c|EXTERNAL:0000005c| |sig|void __stdcall ReleaseSRWLockShared(PSRWLOCK SRWLock)|void __stdcall ReleaseSRWLockShared(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockShared calling @@ -1,0 +2,6 @@ +BCryptIumCreateClaim +BCryptIumDecapsulate +BCryptIumDecrypt +BCryptIumDeriveKey +BCryptIumDuplicateKey +BCryptIumEncapsulate @@ -2,0 +9 @@ +BCryptIumExportKey @@ -5,0 +13,5 @@ +BCryptIumImportKeyGeneric +BCryptIumKeyDerivation +BCryptIumSecretAgreement +BCryptIumSignHash +BCryptIumVerifySignature ``` ## __GSHandlerCheckCommon ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |fullname|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |`refcount`|4|3| |length|91|91| |called|__security_check_cookie|__security_check_cookie| |`calling`|__GSHandlerCheck
__GSHandlerCheck_EH4
__GSHandlerCheck_SEH|__GSHandlerCheck
__GSHandlerCheck_EH4| |paramcount|2|2| |`address`|140003a70|140003a20| |sig|ulonglong __fastcall __GSHandlerCheckCommon(undefined8 param_1, longlong param_2)|ulonglong __fastcall __GSHandlerCheckCommon(undefined8 param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __GSHandlerCheckCommon Calling Diff ```diff --- __GSHandlerCheckCommon calling +++ __GSHandlerCheckCommon calling @@ -3 +2,0 @@ -__GSHandlerCheck_SEH ``` ## MSVCRT.DLL::__C_specific_handler ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|__C_specific_handler|__C_specific_handler| |fullname|MSVCRT.DLL::__C_specific_handler|MSVCRT.DLL::__C_specific_handler| |`refcount`|4|3| |length|0|0| |called||| |`calling`|__GSHandlerCheck_SEH|| |paramcount|4|4| |address|EXTERNAL:00000026|EXTERNAL:00000026| |sig|EXCEPTION_DISPOSITION __C_specific_handler(_EXCEPTION_RECORD * ExceptionRecord, void * EstablisherFrame, _CONTEXT * ContextRecord, _DISPATCHER_CONTEXT * DispatcherContext)|EXCEPTION_DISPOSITION __C_specific_handler(_EXCEPTION_RECORD * ExceptionRecord, void * EstablisherFrame, _CONTEXT * ContextRecord, _DISPATCHER_CONTEXT * DispatcherContext)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSVCRT.DLL::__C_specific_handler Calling Diff ```diff --- MSVCRT.DLL::__C_specific_handler calling +++ MSVCRT.DLL::__C_specific_handler calling @@ -1 +0,0 @@ -__GSHandlerCheck_SEH ``` ## WPP_SF_ ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|WPP_SF_|WPP_SF_| |fullname|WPP_SF_|WPP_SF_| |`refcount`|63|62| |length|36|36| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |calling|
Expand for full list:
BCryptIumCheckKey
BCryptIumCloseAlgorithmProvider
BCryptIumContextManagerCleanUp
BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumContextManagerGetContext
BCryptIumContextManagerInit
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDereferenceObjectBCryptIumDeriveKey
BCryptIumDestroyKey
BCryptIumDestroySecret
BCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumGetClientContext
BCryptIumGetIdkSPub
BCryptIumGetProperty
BCryptIumImportKey
BCryptIumImportKeyPair
BCryptIumKeyDerivation
BCryptIumPingTrustlet
BCryptIumReferenceObject
BCryptIumReleaseContext
BCryptIumRpcCleanup
BCryptIumRpcHandleCleanup
BCryptIumRpcHandleInit
BCryptIumRpcInit
BCryptIumSecretAgreement
BCryptIumSetProperty
BCryptIumSignHash
BCryptIumVerifySignature
CloudApIumRpcCleanup
CloudApIumRpcInit
FreeBCryptIsoObject
GenerateKeyBindingKeyPair
GetContext
KerbDHCreateBCryptKey
KerbIumConvertBoundEncryptionKey
KerbIumGetClientContext
KerbIumUpdateKerb3961SharedConfiguration
KerbUnpackData
KerbVerifyTicket
KerberosCryptoPolicy::TraceKeyUsageRequirements
LookupBCryptIsoObject
RundownBCryptIsoObj
|
Expand for full list:
BCryptIumCheckKey
BCryptIumCloseAlgorithmProvider
BCryptIumContextManagerCleanUp
BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumContextManagerGetContext
BCryptIumContextManagerInit
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDereferenceObjectBCryptIumDeriveKey
BCryptIumDestroyKey
BCryptIumDestroySecret
BCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumGetClientContext
BCryptIumGetIdkSPub
BCryptIumGetProperty
BCryptIumImportKey
BCryptIumImportKeyPair
BCryptIumKeyDerivation
BCryptIumPingTrustlet
BCryptIumReferenceObject
BCryptIumReleaseContext
BCryptIumRpcCleanup
BCryptIumRpcHandleCleanup
BCryptIumRpcHandleInit
BCryptIumRpcInit
BCryptIumSecretAgreement
BCryptIumSetProperty
BCryptIumSignHash
BCryptIumVerifySignature
CloudApIumRpcCleanup
CloudApIumRpcInit
FreeBCryptIsoObject
GenerateKeyBindingKeyPair
GetContext
KerbDHCreateBCryptKey
KerbIumConvertBoundEncryptionKey
KerbIumGetClientContext
KerbIumUpdateKerb3961SharedConfiguration
KerbUnpackData
KerbVerifyTicket
KerberosCryptoPolicy::TraceKeyUsageRequirements
LookupBCryptIsoObject
RundownBCryptIsoObj
| |paramcount|3|3| |`address`|1400133fc|14001278c| |sig|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|ReleaseSRWLockExclusive|ReleaseSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`refcount`|9|10| |length|0|0| |called||| |`calling`|BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumSetProperty
FreeBCryptIsoObject
wil::details::EnabledStateManager::ProcessShutdown
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|AllocateBCryptIsoObject
BCryptIumContextManagerCreateContext
BCryptIumContextManagerFreeContext
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumSetProperty
FreeBCryptIsoObject
wil::details::EnabledStateManager::ProcessShutdown
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |paramcount|1|1| |address|EXTERNAL:00000059|EXTERNAL:00000059| |sig|void __stdcall ReleaseSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall ReleaseSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive calling @@ -0,0 +1 @@ +AllocateBCryptIsoObject ``` ## VBS_ATTEST_TRACE_ERROR_IN ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|VBS_ATTEST_TRACE_ERROR_IN|VBS_ATTEST_TRACE_ERROR_IN| |fullname|VBS_ATTEST_TRACE_ERROR_IN|VBS_ATTEST_TRACE_ERROR_IN| |`refcount`|39|31| |length|56|56| |called|WPP_SF_Dsd|WPP_SF_Dsd| |calling|
Expand for full list:
BCryptIumBuildClaimAttributes
BCryptIumBuildClaimPadding
BCryptIumBuildIdentityClaimHashBuffer
BCryptIumBuildRootClaimHashBuffer
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumEncapsulate
BCryptIumGetClaimPaddingInfo
BCryptIumGetIdentityClaimBufferParams
BCryptIumGetRootClaimBufferParams
BCryptIumSerializePublicKeyCopyULONGAdvanceDest
CreateVsmKeyAttestationClaim
CreateVsmKeyAttestationIdentityClaim
CreateVsmKeyAttestationRootClaim
VBSAttestationSerializeAttestationStatement
VBSAttestationSerializeClaimAttributes
VBSAttestationSerializeIdentityHeader
VBSAttestationSerializePadding
VBSAttestationSerializeRootHeader
|
Expand for full list:
BCryptIumBuildClaimAttributes
BCryptIumBuildClaimPadding
BCryptIumBuildIdentityClaimHashBuffer
BCryptIumBuildRootClaimHashBuffer
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumEncapsulate
BCryptIumGetClaimPaddingInfo
BCryptIumGetIdentityClaimBufferParams
BCryptIumGetRootClaimBufferParams
BCryptIumSerializePublicKeyCopyULONGAdvanceDest
CreateVsmKeyAttestationClaim
CreateVsmKeyAttestationIdentityClaim
CreateVsmKeyAttestationRootClaim
VBSAttestationSerializeAttestationStatement
VBSAttestationSerializeClaimAttributes
VBSAttestationSerializeIdentityHeader
VBSAttestationSerializePadding
VBSAttestationSerializeRootHeader
| |paramcount|3|3| |`address`|14003efa0|14003e350| |sig|undefined __fastcall VBS_ATTEST_TRACE_ERROR_IN(undefined4 param_1, undefined8 param_2, undefined8 param_3)|undefined __fastcall VBS_ATTEST_TRACE_ERROR_IN(undefined4 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## WPP_SF_D ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|WPP_SF_D|WPP_SF_D| |fullname|WPP_SF_D|WPP_SF_D| |`refcount`|118|112| |length|58|58| |called|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage|API-MS-WIN-EVENTING-CLASSICPROVIDER-L1-1-0.DLL::TraceMessage| |`calling`|
Expand for full list:
AllocateBCryptIsoObject
BCryptIumCheckKey
BCryptIumCloseAlgorithmProvider
BCryptIumContextManagerCreateContext
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDereferenceObject
BCryptIumDeriveKey
BCryptIumDestroyKey
BCryptIumDestroySecretBCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumGetClientContext
BCryptIumGetIdkSPub
BCryptIumGetProperty
BCryptIumImportKey
BCryptIumImportKeyGeneric
BCryptIumImportKeyPair
BCryptIumKeyDerivation
BCryptIumOpenAlgorithmProvider
BCryptIumPingTrustlet
BCryptIumReferenceObject
BCryptIumReleaseContext
BCryptIumRpcGetClaimKeyFlags
BCryptIumRpcHandleInit
BCryptIumRpcInit
BCryptIumSecretAgreement
BCryptIumSetProperty
BCryptIumSignHash
BCryptIumVerifySignature
CloudApIumRpcInit
FilterPolicyFlags
GenerateKeyBindingKeyPair
IndexBCryptIsoObject
KerbBuildPkinitReplyKeyCommon
KerbCreateAuthenticator
KerbDHCreateBCryptKey
KerbDHGetLegacyDHParameters
KerbDHGetLittleEndianPublicKey
KerbDHGetSharedSecretFromCapiKeyBuffer
KerbInitAsn
KerbInitDHAlgOnceHandler
KerbInitECDHAlgOnceHandler
KerbIumConvertBoundEncryptionKey
KerbIumCreateMachinePassword
KerbIumUnpackKdcReplyBody
KerbIumUpdateKerb3961SharedConfiguration
KerbPackData
KerbUnpackData
KerbUnpackTicket
KerbVerifyTicket
KerberosCryptoPolicy::TraceKeyUsageRequirements
UnindexBCryptIsoObject
VerifyKeyBindingKeyPair
|
Expand for full list:
AllocateBCryptIsoObject
BCryptIumCheckKey
BCryptIumCloseAlgorithmProvider
BCryptIumContextManagerCreateContext
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDereferenceObject
BCryptIumDeriveKey
BCryptIumDestroyKey
BCryptIumDestroySecretBCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumFinalizeKeyPair
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumGetClientContext
BCryptIumGetIdkSPub
BCryptIumGetProperty
BCryptIumImportKey
BCryptIumImportKeyGeneric
BCryptIumImportKeyPair
BCryptIumKeyDerivation
BCryptIumOpenAlgorithmProvider
BCryptIumPingTrustlet
BCryptIumReferenceObject
BCryptIumReleaseContext
BCryptIumRpcCleanup
BCryptIumRpcGetClaimKeyFlags
BCryptIumRpcHandleInit
BCryptIumRpcInit
BCryptIumSecretAgreement
BCryptIumSetProperty
BCryptIumSignHash
BCryptIumVerifySignature
CloudApIumRpcInit
FilterPolicyFlags
GenerateKeyBindingKeyPair
IndexBCryptIsoObject
KerbBuildPkinitReplyKeyCommon
KerbCreateAuthenticator
KerbDHCreateBCryptKey
KerbDHGetLegacyDHParameters
KerbDHGetLittleEndianPublicKey
KerbDHGetSharedSecretFromCapiKeyBuffer
KerbInitAsn
KerbInitDHAlgOnceHandler
KerbInitECDHAlgOnceHandler
KerbIumConvertBoundEncryptionKey
KerbIumCreateMachinePassword
KerbIumUnpackKdcReplyBody
KerbIumUpdateKerb3961SharedConfiguration
KerbPackData
KerbUnpackData
KerbUnpackTicket
KerbVerifyTicket
KerberosCryptoPolicy::TraceKeyUsageRequirements
UnindexBCryptIsoObject
VerifyKeyBindingKeyPair
| |paramcount|4|4| |`address`|140013428|1400127b8| |sig|undefined __fastcall WPP_SF_D(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_D(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_D Calling Diff ```diff --- WPP_SF_D calling +++ WPP_SF_D calling @@ -29,0 +30 @@ +BCryptIumRpcCleanup ``` ## RPCRT4.DLL::I_RpcMapWin32Status ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|I_RpcMapWin32Status|I_RpcMapWin32Status| |fullname|RPCRT4.DLL::I_RpcMapWin32Status|RPCRT4.DLL::I_RpcMapWin32Status| |`refcount`|8|9| |length|0|0| |called||| |`calling`|BCryptIumRpcInit
CloudApIumRpcInit
KerbClientIumRpcInit
LsaIsoDecryptAsymmetricKeyBlob
LsaIsoEncryptAsymmetricKeyBlob
NtlmIumRpcInit
PAC_EncodeCredentialData|BCryptIumRpcCleanup
BCryptIumRpcInit
CloudApIumRpcInit
KerbClientIumRpcInit
LsaIsoDecryptAsymmetricKeyBlob
LsaIsoEncryptAsymmetricKeyBlob
NtlmIumRpcInit
PAC_EncodeCredentialData| |paramcount|1|1| |address|EXTERNAL:000000f1|EXTERNAL:000000f1| |sig|long __stdcall I_RpcMapWin32Status(RPC_STATUS Status)|long __stdcall I_RpcMapWin32Status(RPC_STATUS Status)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### RPCRT4.DLL::I_RpcMapWin32Status Calling Diff ```diff --- RPCRT4.DLL::I_RpcMapWin32Status calling +++ RPCRT4.DLL::I_RpcMapWin32Status calling @@ -0,0 +1 @@ +BCryptIumRpcCleanup ``` ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared ### Match Info |Key|lsa_8737.exe - lsa_8875.exe| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lsa_8737.exe|lsa_8875.exe| | :---: | :---: | :---: | |name|AcquireSRWLockShared|AcquireSRWLockShared| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared| |`refcount`|7|23| |length|0|0| |called||| |`calling`|BCryptIumContextManagerGetContext
BCryptIumEncrypt
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKey
BCryptIumGetProperty
wil::details_abi::SubscriptionList::OnSignaled|
Expand for full list:
BCryptIumContextManagerGetContext
BCryptIumCreateClaim
BCryptIumDecapsulate
BCryptIumDecrypt
BCryptIumDeriveKey
BCryptIumDuplicateKey
BCryptIumEncapsulate
BCryptIumEncrypt
BCryptIumExportKey
BCryptIumGenerateKeyPair
BCryptIumGenerateSymmetricKeyBCryptIumGetProperty
BCryptIumImportKeyGeneric
BCryptIumKeyDerivation
BCryptIumSecretAgreement
BCryptIumSignHash
BCryptIumVerifySignature
wil::details_abi::SubscriptionList::OnSignaled
| |paramcount|1|1| |address|EXTERNAL:00000057|EXTERNAL:00000057| |sig|void __stdcall AcquireSRWLockShared(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockShared(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockShared calling @@ -1,0 +2,6 @@ +BCryptIumCreateClaim +BCryptIumDecapsulate +BCryptIumDecrypt +BCryptIumDeriveKey +BCryptIumDuplicateKey +BCryptIumEncapsulate @@ -2,0 +9 @@ +BCryptIumExportKey @@ -5,0 +13,5 @@ +BCryptIumImportKeyGeneric +BCryptIumKeyDerivation +BCryptIumSecretAgreement +BCryptIumSignHash +BCryptIumVerifySignature ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-22T10:55:10