# lserver-5830.dll-lserver-6054.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [WPP_SF_SL](#wpp_sf_sl) * [EvaluateCurrentStateFromRegistry](#evaluatecurrentstatefromregistry) * [EvaluateCurrentState](#evaluatecurrentstate) * [TLSRpcSecurityCallback](#tlsrpcsecuritycallback) * [RPCRT4.DLL::RpcServerInqCallAttributesW](#rpcrt4dllrpcserverinqcallattributesw) * [KERNEL32.DLL::CompareStringOrdinal](#kernel32dllcomparestringordinal) * [RPCRT4.DLL::RpcServerRegisterIf2](#rpcrt4dllrpcserverregisterif2) * [Modified](#modified) * [RPCServiceStartThread](#rpcservicestartthread) * [CTsCalPDUpgLicenseReqCtx::Process](#ctscalpdupglicensereqctxprocess) * [CTsCalPDNewLicenseReqCtx::Process](#ctscalpdnewlicensereqctxprocess) * [TLSRpcKeyPackEnumBegin](#tlsrpckeypackenumbegin) * [TLSRpcChallengeServer](#tlsrpcchallengeserver) * [CTsCalPUNewLicenseReqCtx::Process](#ctscalpunewlicensereqctxprocess) * [TLSDBTelephoneRegisterLicenseKeyPack](#tlsdbtelephoneregisterlicensekeypack) * [UnpackHydraServerCertificate](#unpackhydraservercertificate) * [HashChallengeData](#hashchallengedata) * [CDataCoding::DecodeData](#cdatacodingdecodedata) * [Modified (No Code Changes)](#modified-no-code-changes) * [StringCchPrintfW](#stringcchprintfw) * [RPCRT4.DLL::RpcStringBindingParseW](#rpcrt4dllrpcstringbindingparsew) * [No_P_Err](#no_p_err) * [KERNEL32.DLL::WaitForSingleObject](#kernel32dllwaitforsingleobject) * [StringCchCopyW](#stringcchcopyw) * [ADVAPI32.DLL::RegGetValueW](#advapi32dllreggetvaluew) * [NC](#nc) * [rc4](#rc4) * [ADVAPI32.DLL::RegQueryValueExW](#advapi32dllregqueryvalueexw) * [__GSHandlerCheck](#__gshandlercheck) * [RPCRT4.DLL::RpcBindingToStringBindingW](#rpcrt4dllrpcbindingtostringbindingw) * [RPCRT4.DLL::RpcStringFreeW](#rpcrt4dllrpcstringfreew) * [ADVAPI32.DLL::RegCloseKey](#advapi32dllregclosekey) * [WPP_SF_Sd](#wpp_sf_sd) * [WPP_SF_SS](#wpp_sf_ss) * [__security_check_cookie](#__security_check_cookie) * [ADVAPI32.DLL::RegOpenKeyExW](#advapi32dllregopenkeyexw) * [rc4_key](#rc4_key) * [ADVAPI32.DLL::TraceMessage](#advapi32dlltracemessage) * [WPP_SF_S](#wpp_sf_s) * [MSTLSAPI.DLL::Ordinal_134](#mstlsapidllordinal_134) # Visual Chart Diff ```mermaid flowchart LR RPCServiceStartThread-1-old<--Match 55%-->RPCServiceStartThread-1-new CTsCalPDUpgLicenseReqCtxProcess-1-old<--Match 44%-->CTsCalPDUpgLicenseReqCtxProcess-1-new CTsCalPDNewLicenseReqCtxProcess-1-old<--Match 28%-->CTsCalPDNewLicenseReqCtxProcess-1-new TLSRpcKeyPackEnumBegin-5-old<--Match 99%-->TLSRpcKeyPackEnumBegin-5-new TLSRpcChallengeServer-6-old<--Match 79%-->TLSRpcChallengeServer-6-new CTsCalPUNewLicenseReqCtxProcess-1-old<--Match 48%-->CTsCalPUNewLicenseReqCtxProcess-1-new TLSDBTelephoneRegisterLicenseKeyPack-5-old<--Match 82%-->TLSDBTelephoneRegisterLicenseKeyPack-5-new UnpackHydraServerCertificate-3-old<--Match 91%-->UnpackHydraServerCertificate-3-new HashChallengeData-9-old<--Match 87%-->HashChallengeData-9-new CDataCodingDecodeData-4-old<--Match 85%-->CDataCodingDecodeData-4-new subgraph lserver-6054.dll RPCServiceStartThread-1-new CTsCalPDUpgLicenseReqCtxProcess-1-new CTsCalPDNewLicenseReqCtxProcess-1-new TLSRpcKeyPackEnumBegin-5-new TLSRpcChallengeServer-6-new CTsCalPUNewLicenseReqCtxProcess-1-new TLSDBTelephoneRegisterLicenseKeyPack-5-new UnpackHydraServerCertificate-3-new HashChallengeData-9-new CDataCodingDecodeData-4-new subgraph Added direction LR WPP_SF_SL EvaluateCurrentStateFromRegistry EvaluateCurrentState TLSRpcSecurityCallback RPCRT4DLL-RpcServerInqCallAttributesW KERNEL32DLL-CompareStringOrdinal RPCRT4DLL-RpcServerRegisterIf2 end end subgraph lserver-5830.dll RPCServiceStartThread-1-old CTsCalPDUpgLicenseReqCtxProcess-1-old CTsCalPDNewLicenseReqCtxProcess-1-old TLSRpcKeyPackEnumBegin-5-old TLSRpcChallengeServer-6-old CTsCalPUNewLicenseReqCtxProcess-1-old TLSDBTelephoneRegisterLicenseKeyPack-5-old UnpackHydraServerCertificate-3-old HashChallengeData-9-old CDataCodingDecodeData-4-old end ``` ```mermaid pie showData title Function Matches - 99.8942% "unmatched_funcs_len" : 7 "matched_funcs_len" : 6612 ``` ```mermaid pie showData title Matched Function Similarity - 99.4707% "matched_funcs_with_code_changes_len" : 10 "matched_funcs_with_non_code_changes_len" : 25 "matched_funcs_no_changes_len" : 6577 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name lserver-38077 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 lserver-5830.dll lserver-6054.dll ``` #### Verbose Args
``` --old ['lserver-5830.dll'] --new [['lserver-6054.dll']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name lserver-38077 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/lserver.dll/F557725DF9000/lserver.dll -O lserver.dll.x64.10.0.17763.5937 wget https://msdl.microsoft.com/download/symbols/lserver.dll/884F9F3AFA000/lserver.dll -O lserver.dll.x64.10.0.17763.6189 ``` ## Binary Metadata Diff ```diff --- lserver-5830.dll Meta +++ lserver-6054.dll Meta @@ -1,44 +1,44 @@ -Program Name: lserver-5830.dll +Program Name: lserver-6054.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1008320 +# of Bytes: 1012960 # of Memory Blocks: 8 -# of Instructions: 159237 -# of Defined Data: 11587 -# of Functions: 3306 -# of Symbols: 30768 -# of Data Types: 1416 +# of Instructions: 160052 +# of Defined Data: 11625 +# of Functions: 3313 +# of Symbols: 30870 +# of Data Types: 1422 # of Data Type Categories: 97 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sat Aug 15 22:33:13 SGT 2026 +Date Created: Sat Aug 15 22:33:17 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/lserver/lserver-5830.dll -Executable MD5: e77107ab7a8e1f4da90edddc384581f8 -Executable SHA256: db97ce34a74442f2c2faeac368e4c427dfb6c537dccac81957615f3e5ef03dfa -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/lserver/lserver-5830.dll?MD5=e77107ab7a8e1f4da90edddc384581f8 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/lserver/lserver-6054.dll +Executable MD5: 456572ffdd37d87d6dc3c300e54a8aec +Executable SHA256: e8ff982568c33c565da2e552f2ec28d1e48aa873ca1680cc8410b54d3823cd2c +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/lserver/lserver-6054.dll?MD5=456572ffdd37d87d6dc3c300e54a8aec PDB Age: 1 PDB File: lserver.pdb -PDB GUID: 31507278-a9ca-d441-558b-1eeb67322eb2 +PDB GUID: 4df05a4a-301d-a4b6-f212-2eef1f950588 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft® Remote Desktop Licensing -PE Property[FileVersion]: 10.0.17763.5937 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.17763.6189 (WinBuild.160101.0800) PE Property[InternalName]: lserver.dll PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: lserver.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.17763.5937 +PE Property[ProductVersion]: 10.0.17763.6189 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra lserver-5830.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lserver-5830.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lserver-5830.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra lserver-6054.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra lserver-6054.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra lserver-6054.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|7| |deleted_funcs_len|0| |modified_funcs_len|35| |added_symbols_len|25| |deleted_symbols_len|6| |diff_time|11.616158962249756| |deleted_strings_len|0| |added_strings_len|7| |match_types|Counter({'SymbolsHash': 3260, 'ExternalsName': 510, 'StructuralGraphHash': 40, 'ExactBytesFunctionHasher': 2})| |items_to_process|73| |diff_types|Counter({'address': 32, 'refcount': 23, 'calling': 15, 'length': 12, 'code': 10, 'called': 9, 'sig': 1})| |unmatched_funcs_len|7| |total_funcs_len|6619| |matched_funcs_len|6612| |matched_funcs_with_code_changes_len|10| |matched_funcs_with_non_code_changes_len|25| |matched_funcs_no_changes_len|6577| |match_func_similarity_percent|99.4707%| |func_match_overall_percent|99.8942%| |first_matches|Counter({'SymbolsHash': 3260, 'StructuralGraphHash': 40, 'ExactBytesFunctionHasher': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 3260 "ExternalsName" : 510 "ExactBytesFunctionHasher" : 2 "StructuralGraphHash" : 40 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 3260 "ExactBytesFunctionHasher" : 2 "StructuralGraphHash" : 40 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 7 "deleted_funcs_len" : 0 "modified_funcs_len" : 35 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 25 "deleted_symbols_len" : 6 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 7 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,7 @@ +u_%lu +u_DisableWorkgroupAuthEnforcement +u_Invalid_company_name._Status_=_% +u_Invalid_input._Status_=_%x +u_Invalid_product_id._Status_=_%x +u_System\CurrentControlSet\Policie +u_TLSRpcSecurityCallback ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_TLSRpcSecurityCallback|6|TLSRpcSecurityCallback,WPP_SF_SL| |u_Invalid_input._Status_=_%x|1|Process| |u_Invalid_company_name._Status_=_%|1|Process| |u_System\CurrentControlSet\Policie|1|EvaluateCurrentStateFromRegistry| |u_%lu|1|EvaluateCurrentStateFromRegistry| |u_Invalid_product_id._Status_=_%x|1|Process| |u_DisableWorkgroupAuthEnforcement|1|RPCServiceStartThread| # Deleted # Added ## WPP_SF_SL ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|WPP_SF_SL| |fullname|WPP_SF_SL| |refcount|2| |length|100| |called|ADVAPI32.DLL::TraceMessage| |calling|TLSRpcSecurityCallback| |paramcount|2| |address|180005ea4| |sig|undefined __fastcall WPP_SF_SL(undefined8 param_1, undefined2 param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- WPP_SF_SL +++ WPP_SF_SL @@ -0,0 +1,15 @@ + +void WPP_SF_SL(undefined8 param_1,undefined2 param_2) + +{ + longlong lVar1; + + lVar1 = -1; + do { + lVar1 = lVar1 + 1; + } while (L"TLSRpcSecurityCallback"[lVar1] != L'\0'); + TraceMessage(param_1,0x2b,&WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,param_2, + L"TLSRpcSecurityCallback",lVar1 * 2 + 2,&stack0x00000028,4,0); + return; +} + ``` ## EvaluateCurrentStateFromRegistry ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|EvaluateCurrentStateFromRegistry| |fullname|EvaluateCurrentStateFromRegistry| |refcount|2| |length|304| |called|ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegQueryValueExW
StringCchPrintfW
__security_check_cookie
memset| |calling|EvaluateCurrentState| |paramcount|3| |address|180006134| |sig|int __cdecl EvaluateCurrentStateFromRegistry(uint param_1, reg_FeatureStage param_2, long * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- EvaluateCurrentStateFromRegistry +++ EvaluateCurrentStateFromRegistry @@ -0,0 +1,48 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* int __cdecl EvaluateCurrentStateFromRegistry(unsigned int,enum reg_FeatureStage,long volatile * + __ptr64) */ + +int __cdecl EvaluateCurrentStateFromRegistry(uint param_1,reg_FeatureStage param_2,long *param_3) + +{ + LSTATUS LVar1; + uint uVar2; + uint uVar3; + undefined1 auStackY_98 [32]; + DWORD local_68; + DWORD local_64; + int local_60 [2]; + HKEY local_58; + WCHAR local_50 [16]; + ulonglong local_30; + + local_30 = __security_cookie ^ (ulonglong)auStackY_98; + local_68 = 4; + uVar2 = (uint)(param_2 != 1); + memset(local_50,0,0x20); + LVar1 = RegOpenKeyExW((HKEY)&DAT_ffffffff80000002, + L"System\\CurrentControlSet\\Policies\\Microsoft\\FeatureManagement\\Overrides" + ,0,0x20019,&local_58); + if (LVar1 == 0) { + uVar3 = param_1 ^ 0x74161a4e; + uVar3 = (uVar3 >> 0x18 | (uVar3 & 0xff0000) >> 8 | (uVar3 & 0xff00) << 8 | uVar3 << 0x18) ^ + 0x8fb23d4f; + StringCchPrintfW((ushort *)local_50,0x10,(ushort *)L"%lu", + (ulonglong)((uVar3 >> 0x1f | uVar3 << 1) ^ 0x833ea8ff)); + LVar1 = RegQueryValueExW(local_58,local_50,(LPDWORD)0x0,&local_64,(LPBYTE)local_60,&local_68); + if ((undefined1 *)((longlong)&local_58[-1].unused + 3U) < (undefined1 *)0xfffffffffffffffe) { + RegCloseKey(local_58); + } + if (((LVar1 == 0) && (local_64 == 4)) && (local_68 == 4)) { + uVar2 = (uint)(local_60[0] != 0); + } + } + LOCK(); + if (*param_3 == 0) { + *param_3 = uVar2 + 1; + } + UNLOCK(); + return (int)(*param_3 != 1); +} + ``` ## EvaluateCurrentState ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|EvaluateCurrentState| |fullname|EvaluateCurrentState| |refcount|19| |length|34| |called|EvaluateCurrentStateFromRegistry| |calling|CDataCoding::DecodeData
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
HashChallengeData
RPCServiceStartThread
TLSDBTelephoneRegisterLicenseKeyPack
TLSRpcChallengeServer
UnpackHydraServerCertificate| |paramcount|1| |address|18000626c| |sig|int __cdecl EvaluateCurrentState(reg_FeatureDescriptor * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- EvaluateCurrentState +++ EvaluateCurrentState @@ -0,0 +1,17 @@ + +/* int __cdecl EvaluateCurrentState(struct reg_FeatureDescriptor const * __ptr64) */ + +int __cdecl EvaluateCurrentState(reg_FeatureDescriptor *param_1) + +{ + int iVar1; + + iVar1 = **(long **)param_1; + if (iVar1 != 0) { + return (int)(iVar1 != 1); + } + iVar1 = EvaluateCurrentStateFromRegistry + (*(uint *)(param_1 + 8),*(reg_FeatureStage *)(param_1 + 0xc),*(long **)param_1); + return iVar1; +} + ``` ## TLSRpcSecurityCallback ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|TLSRpcSecurityCallback| |fullname|TLSRpcSecurityCallback| |refcount|4| |length|767| |called|
Expand for full list:
KERNEL32.DLL::CompareStringOrdinal
RPCRT4.DLL::RpcBindingToStringBindingW
RPCRT4.DLL::RpcServerInqCallAttributesW
RPCRT4.DLL::RpcStringBindingParseW
RPCRT4.DLL::RpcStringFreeW
WPP_SF_S
WPP_SF_SL
WPP_SF_SS
WPP_SF_Sd
__security_check_cookie
memset
| |calling|| |paramcount|2| |address|1800062a0| |sig|long __cdecl TLSRpcSecurityCallback(void * param_1, void * param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- TLSRpcSecurityCallback +++ TLSRpcSecurityCallback @@ -0,0 +1,107 @@ + +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* long __cdecl TLSRpcSecurityCallback(void * __ptr64,void * __ptr64) */ + +long __cdecl TLSRpcSecurityCallback(void *param_1,void *param_2) + +{ + byte bVar1; + byte bVar2; + int iVar3; + RPC_STATUS RVar4; + undefined2 uVar5; + undefined1 auStackY_c8 [32]; + LPCWSTR local_98; + RPC_WSTR local_90; + undefined4 local_88 [10]; + int local_60; + int local_58; + int local_50; + ulonglong local_18; + + local_18 = __security_cookie ^ (ulonglong)auStackY_c8; + bVar2 = 0; + bVar1 = 0; + memset(local_88,0,0x70); + local_90 = (RPC_WSTR)0x0; + local_98 = (LPCWSTR)0x0; + local_88[0] = 2; + iVar3 = RpcServerInqCallAttributesW(param_2,local_88); + if (iVar3 == 0) { + if (local_60 == 6) { + if (local_58 != 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xc, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcSecurityCallback"); + } + goto LAB_180006553; + } + if (local_50 - 1U < 3) { + RVar4 = RpcBindingToStringBindingW(param_2,&local_90); + if (RVar4 == 0) { + RVar4 = RpcStringBindingParseW + (local_90,(RPC_WSTR *)0x0,(RPC_WSTR *)&local_98,(RPC_WSTR *)0x0, + (RPC_WSTR *)0x0,(RPC_WSTR *)0x0); + if (RVar4 == 0) { + iVar3 = CompareStringOrdinal(local_98,-1,L"ncalrpc",-1,1); + if (iVar3 != 2) { + iVar3 = CompareStringOrdinal(local_98,-1,L"ncacn_np",-1,1); + if (iVar3 != 2) { + iVar3 = CompareStringOrdinal(local_98,-1,L"ncacn_ip_tcp",-1,1); + if (iVar3 != 2) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids, + L"TLSRpcSecurityCallback",local_98); + } + goto LAB_180006553; + } + } + } + bVar1 = 1; + goto LAB_180006553; + } + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) == 0)) goto LAB_180006553; + uVar5 = 0xf; + } + else { + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) == 0)) goto LAB_180006553; + uVar5 = 0xe; + } + goto LAB_180006321; + } + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) == 0)) goto LAB_180006553; + uVar5 = 0xd; + } + else { + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) == 0)) goto LAB_180006553; + uVar5 = 0xb; + } + WPP_SF_SL(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar5); + } + else { + bVar1 = bVar2; + if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) || + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) == 0)) goto LAB_180006553; + uVar5 = 10; +LAB_180006321: + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar5, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcSecurityCallback"); + bVar1 = bVar2; + } +LAB_180006553: + if (local_98 != (LPCWSTR)0x0) { + RpcStringFreeW((RPC_WSTR *)&local_98); + } + if (local_90 != (RPC_WSTR)0x0) { + RpcStringFreeW(&local_90); + } + return ~-(uint)bVar1 & 5; +} + ``` ## RPCRT4.DLL::RpcServerInqCallAttributesW ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|RpcServerInqCallAttributesW| |fullname|RPCRT4.DLL::RpcServerInqCallAttributesW| |refcount|2| |length|0| |called|| |calling|TLSRpcSecurityCallback| |paramcount|0| |address|EXTERNAL:000000e3| |sig|undefined RpcServerInqCallAttributesW(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for RPCRT4.DLL::RpcServerInqCallAttributesW* ## KERNEL32.DLL::CompareStringOrdinal ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|CompareStringOrdinal| |fullname|KERNEL32.DLL::CompareStringOrdinal| |refcount|4| |length|0| |called|| |calling|TLSRpcSecurityCallback| |paramcount|5| |address|EXTERNAL:00000178| |sig|int __stdcall CompareStringOrdinal(LPCWSTR lpString1, int cchCount1, LPCWSTR lpString2, int cchCount2, BOOL bIgnoreCase)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for KERNEL32.DLL::CompareStringOrdinal* ## RPCRT4.DLL::RpcServerRegisterIf2 ### Function Meta |Key|lserver-6054.dll| | :---: | :---: | |name|RpcServerRegisterIf2| |fullname|RPCRT4.DLL::RpcServerRegisterIf2| |refcount|2| |length|0| |called|| |calling|RPCServiceStartThread| |paramcount|7| |address|EXTERNAL:000000f4| |sig|RPC_STATUS __stdcall RpcServerRegisterIf2(RPC_IF_HANDLE IfSpec, UUID * MgrTypeUuid, void * MgrEpv, uint Flags, uint MaxCalls, uint MaxRpcSize, RPC_IF_CALLBACK_FN * IfCallbackFn)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for RPCRT4.DLL::RpcServerRegisterIf2* # Modified *Modified functions contain code changes* ## RPCServiceStartThread ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.38| |i_ratio|0.17| |m_ratio|0.69| |b_ratio|0.55| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RPCServiceStartThread|RPCServiceStartThread| |fullname|RPCServiceStartThread|RPCServiceStartThread| |refcount|3|3| |`length`|534|950| |`called`|
Expand for full list:
KERNEL32.DLL::ExitThread
NTDLL.DLL::EtwEventWriteFull
RPCRT4.DLL::RpcEpRegisterW
RPCRT4.DLL::RpcServerInqBindings
RPCRT4.DLL::RpcServerRegisterAuthInfoW
RPCRT4.DLL::RpcServerRegisterIf
RPCRT4.DLL::RpcServerUseProtseqEpW
RPCRT4.DLL::RpcServerUseProtseqW
SetSecurityDescriptorOnNamedPipe
TLSLogEvent
WPP_SF_DWPP_SF_S
|
Expand for full list:
ADVAPI32.DLL::RegGetValueW
EvaluateCurrentState
KERNEL32.DLL::ExitThread
MSTLSAPI.DLL::Ordinal_134
NTDLL.DLL::EtwEventWriteFull
RPCRT4.DLL::RpcEpRegisterW
RPCRT4.DLL::RpcServerInqBindings
RPCRT4.DLL::RpcServerRegisterAuthInfoW
RPCRT4.DLL::RpcServerRegisterIf
RPCRT4.DLL::RpcServerRegisterIf2
RPCRT4.DLL::RpcServerUseProtseqEpWRPCRT4.DLL::RpcServerUseProtseqW
SetSecurityDescriptorOnNamedPipe
TLSLogEvent
WPP_SF_D
WPP_SF_S
WPP_SF_Sd
| |calling||| |paramcount|1|1| |`address`|18002fa80|18002ff80| |sig|ulong __cdecl RPCServiceStartThread(void * param_1)|ulong __cdecl RPCServiceStartThread(void * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RPCServiceStartThread Called Diff ```diff --- RPCServiceStartThread called +++ RPCServiceStartThread called @@ -0,0 +1,2 @@ +ADVAPI32.DLL::RegGetValueW +EvaluateCurrentState @@ -1,0 +4 @@ +MSTLSAPI.DLL::Ordinal_134 @@ -6,0 +10 @@ +RPCRT4.DLL::RpcServerRegisterIf2 @@ -12,0 +17 @@ +WPP_SF_Sd ``` ### RPCServiceStartThread Diff ```diff --- RPCServiceStartThread +++ RPCServiceStartThread @@ -1,111 +1,172 @@ /* unsigned long __cdecl RPCServiceStartThread(void * __ptr64) */ ulong __cdecl RPCServiceStartThread(void *param_1) { RPC_STATUS RVar1; long lVar2; - wchar_t *pwVar3; - uint uVar4; + int iVar3; + LSTATUS LVar4; + wchar_t *pwVar5; + uint uVar6; DWORD dwExitCode; - char cVar5; - undefined1 auStack_78 [32]; - undefined8 local_58; - undefined4 local_50; - undefined8 local_48; - RPC_BINDING_VECTOR *local_38 [2]; - _EVENT_DESCRIPTOR local_28; - ulonglong local_18; + char cVar7; + undefined1 auStackY_98 [32]; + uint local_58; + int local_54 [3]; + RPC_BINDING_VECTOR *local_48 [2]; + _EVENT_DESCRIPTOR local_38; + ulonglong local_28; - local_18 = __security_cookie ^ (ulonglong)auStack_78; - local_38[0] = (RPC_BINDING_VECTOR *)0x0; + local_28 = __security_cookie ^ (ulonglong)auStackY_98; + local_48[0] = (RPC_BINDING_VECTOR *)0x0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1e, - &WPP_fe089017f47f33bb1a0a0b90bc308178_Traceguids,L"RPCServiceStartThread"); + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread"); } RVar1 = RpcServerUseProtseqW((RPC_WSTR)L"ncalrpc",10,(void *)0x0); - cVar5 = RVar1 == 0; - pwVar3 = L"ncacn_np"; + cVar7 = RVar1 == 0; + pwVar5 = L"ncacn_np"; RVar1 = RpcServerUseProtseqEpW ((RPC_WSTR)L"ncacn_np",10,(RPC_WSTR)L"\\pipe\\HydraLsPipe",(void *)0x0); if (RVar1 == 0) { - cVar5 = cVar5 + '\x01'; + cVar7 = cVar7 + '\x01'; } - lVar2 = SetSecurityDescriptorOnNamedPipe((ushort *)pwVar3); + lVar2 = SetSecurityDescriptorOnNamedPipe((ushort *)pwVar5); if (lVar2 == 0) { RVar1 = RpcServerUseProtseqW((RPC_WSTR)L"ncacn_ip_tcp",10,(void *)0x0); if (RVar1 == 0) { - cVar5 = cVar5 + '\x01'; + cVar7 = cVar7 + '\x01'; } - if (cVar5 == '\0') { - uVar4 = 0xc0040001; + if (cVar7 == '\0') { + uVar6 = 0xc0040001; } else { - RVar1 = RpcServerInqBindings(local_38); + RVar1 = RpcServerInqBindings(local_48); if (RVar1 == 0) { - RVar1 = RpcEpRegisterW(&DAT_0,local_38[0],(UUID_VECTOR *)0x0,(RPC_WSTR)L""); + RVar1 = RpcEpRegisterW(&DAT_0,local_48[0],(UUID_VECTOR *)0x0,(RPC_WSTR)L""); if (RVar1 == 0) { - RVar1 = RpcServerRegisterIf(&DAT_0,(UUID *)0x0,(void *)0x0); - if (RVar1 == 0) { + iVar3 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_2625984825_51019577_FeatureDescriptorDetails); + if (iVar3 == 0) { +LAB_1: + iVar3 = RpcServerRegisterIf(&DAT_0,(UUID *)0x0,(void *)0x0); + } + else { + local_54[0] = 0; + local_54[1] = 4; + local_58 = 1; + iVar3 = Ordinal_134(&local_58); + if (iVar3 != 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread") + ; + } + local_58 = 1; + } + if (local_58 == 0) { + LVar4 = RegGetValueW((HKEY)&DAT_2, + L"SYSTEM\\CurrentControlSet\\Services\\TermServLicensing\\Parameters" + ,L"DisableWorkgroupAuthEnforcement",0x10,(LPDWORD)0x0,local_54, + (LPDWORD)(local_54 + 1)); + if (LVar4 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x21, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids, + L"RPCServiceStartThread"); + } + uVar6 = (uint)(local_54[0] == 0); + } + else { + uVar6 = 1; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (uVar6 = 1, (*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x22, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread" + ); + } + } + local_58 = uVar6; + if (uVar6 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x24, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread" + ); + } + goto LAB_1; + } + } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x23, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread"); + } + iVar3 = RpcServerRegisterIf2 + (&DAT_0,(UUID *)0x0,(void *)0x0,8,0x4d2,0, + TLSRpcSecurityCallback); + } + if (iVar3 == 0) { RVar1 = RpcServerRegisterAuthInfoW ((RPC_WSTR)L"TermServLicensing",9,(RPC_AUTH_KEY_RETRIEVAL_FN)0x0, (void *)0x0); dwExitCode = 0; - if (RVar1 == 0) goto LAB_1; - uVar4 = 0xc0040007; + if (RVar1 == 0) goto LAB_3; + uVar6 = 0xc0040007; } else { - uVar4 = 0xc0040002; + uVar6 = 0xc0040002; } } else { - uVar4 = 0xc0040004; + uVar6 = 0xc0040004; } } else { - uVar4 = 0xc0040003; + uVar6 = 0xc0040003; } } } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1f, - &WPP_fe089017f47f33bb1a0a0b90bc308178_Traceguids,lVar2); + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,lVar2); } - uVar4 = 0x102e; - if (DAT_2 != '\0') { - local_48 = 0; - local_50 = 0; - local_58 = 0; - local_28.Id = 0; - local_28.Version = '\0'; - local_28.Channel = '\0'; - local_28.Level = '\0'; - local_28.Opcode = '\0'; - local_28.Task = 0; - local_28.Keyword = 0; - EtwEventWriteFull(DAT_3,&TLS_E_CVT_SECURITY_DESCRIPTOR,0,0); + uVar6 = 0x102e; + if (DAT_4 != '\0') { + local_38.Id = 0; + local_38.Version = '\0'; + local_38.Channel = '\0'; + local_38.Level = '\0'; + local_38.Opcode = '\0'; + local_38.Task = 0; + local_38.Keyword = 0; + EtwEventWriteFull(DAT_5,&TLS_E_CVT_SECURITY_DESCRIPTOR,0,0); } } - local_28.Id = 0x25; - local_28.Version = '\0'; - local_28.Channel = '\b'; - local_28.Level = '\x02'; - local_28.Opcode = '\0'; - local_28.Task = 0; - local_28.Keyword = 0x8000000000000000; - TLSLogEvent(&local_28,0xc001000f,(ulonglong)uVar4); + local_38.Id = 0x25; + local_38.Version = '\0'; + local_38.Channel = '\b'; + local_38.Level = '\x02'; + local_38.Opcode = '\0'; + local_38.Task = 0; + local_38.Keyword = 0x8000000000000000; + TLSLogEvent(&local_38,0xc001000f,(ulonglong)uVar6); dwExitCode = 0xc0010011; -LAB_1: +LAB_3: if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, - &WPP_fe089017f47f33bb1a0a0b90bc308178_Traceguids,L"RPCServiceStartThread"); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x25, + &WPP_31ae8bd089163bf2179b3b4378ff878d_Traceguids,L"RPCServiceStartThread"); } /* WARNING: Subroutine does not return */ ExitThread(dwExitCode); } ``` ## CTsCalPDUpgLicenseReqCtx::Process ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.51| |i_ratio|0.37| |m_ratio|0.94| |b_ratio|0.44| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|Process|Process| |fullname|CTsCalPDUpgLicenseReqCtx::Process|CTsCalPDUpgLicenseReqCtx::Process| |refcount|4|4| |`length`|3956|4429| |`called`|
Expand for full list:
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMLicenseRequest
CTLSPolicy::PMLicenseUpgrade
CTsCalPDUpgLicenseReqCtx::Validate
DumpLicensedProduct
KERNEL32.DLL::GetTickCount
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
LicAttr::compareVersion
LicCtx::LicCtxLicCtx::TypePostProcess
LicCtx::findAndExecFunc
LicCtx::processTwoLicenses
LogLicenseUnavailableEvent
MSVCRT.DLL::_wcsicmp
MSVCRT.DLL::wcscpy_s
NTDLL.DLL::EtwEventWriteFull
StringCbCopyW
StringCchCopyW
StringCchPrintfW
TLSFormDBRequest
TLSGetPolicyModule
TLSLogEvent
TLSMapReturnCode
TLSRequestNewLicense
TLSUpgradeLicenseRequestEx
TLSVerifyChallengeDataGetWantedLicenseLevel
TlsLicenseProductToPMLicenseProduct
TlsLicenseRequestToPMLicenseRequest
WPP_SF_
WPP_SF_S
WPP_SF_SDD
WPP_SF_SS
WPP_SF_SSS
WPP_SF_SSd
WPP_SF_Sd
WPP_SF_SdS
__chkstk
__security_check_cookie
_guard_dispatch_icall
memset
operator_new[]
|
Expand for full list:
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMLicenseRequest
CTLSPolicy::PMLicenseUpgrade
CTsCalPDUpgLicenseReqCtx::Validate
DumpLicensedProduct
EvaluateCurrentState
KERNEL32.DLL::GetTickCount
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
LicAttr::compareVersionLicCtx::LicCtx
LicCtx::TypePostProcess
LicCtx::findAndExecFunc
LicCtx::processTwoLicenses
LogLicenseUnavailableEvent
MSVCRT.DLL::_wcsicmp
MSVCRT.DLL::wcscpy_s
NTDLL.DLL::EtwEventWriteFull
StringCbCopyW
StringCchCopyW
StringCchPrintfW
TLSFormDBRequest
TLSGetPolicyModule
TLSLogEvent
TLSMapReturnCode
TLSRequestNewLicense
TLSUpgradeLicenseRequestEx
TLSVerifyChallengeDataGetWantedLicenseLevel
TlsLicenseProductToPMLicenseProduct
TlsLicenseRequestToPMLicenseRequest
WPP_SF_
WPP_SF_S
WPP_SF_SDD
WPP_SF_SS
WPP_SF_SSS
WPP_SF_SSd
WPP_SF_Sd
WPP_SF_SdS
__chkstk
__security_check_cookie
_guard_dispatch_icall
memset
operator_new[]
| |calling||| |paramcount|1|1| |`address`|180067550|180067e30| |sig|long __thiscall Process(CTsCalPDUpgLicenseReqCtx * this)|long __thiscall Process(CTsCalPDUpgLicenseReqCtx * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CTsCalPDUpgLicenseReqCtx::Process Called Diff ```diff --- CTsCalPDUpgLicenseReqCtx::Process called +++ CTsCalPDUpgLicenseReqCtx::Process called @@ -5,0 +6 @@ +EvaluateCurrentState ``` ### CTsCalPDUpgLicenseReqCtx::Process Diff ```diff --- CTsCalPDUpgLicenseReqCtx::Process +++ CTsCalPDUpgLicenseReqCtx::Process @@ -1,577 +1,669 @@ /* WARNING: Function: __chkstk replaced with injection: alloca_probe */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ /* public: virtual long __cdecl CTsCalPDUpgLicenseReqCtx::Process(void) __ptr64 */ long __thiscall CTsCalPDUpgLicenseReqCtx::Process(CTsCalPDUpgLicenseReqCtx *this) { + ushort uVar1; + ulong uVar2; LicAttr *this_00; - _LicensedProduct *p_Var1; - ulong uVar2; - uint uVar3; + _LicensedProduct *p_Var3; ulong uVar4; - int iVar5; + uint uVar5; int iVar6; int iVar7; - undefined8 *puVar8; - LicCtx *pLVar9; - ushort *hMem; - undefined **ppuVar10; - ulonglong uVar11; - undefined *puVar12; - IRdlsDBConnection *pIVar13; - CTLSPolicy *pCVar14; - undefined4 *puVar15; - wchar_t *pwVar16; - longlong lVar17; + int iVar8; + undefined8 *puVar9; + LicCtx *pLVar10; + ushort *puVar11; + undefined **ppuVar12; + ushort *puVar13; + undefined *puVar14; + undefined2 uVar15; + IRdlsDBConnection *pIVar16; + wchar_t *pwVar17; + void *pvVar18; + undefined4 *puVar19; + ulonglong uVar20; wchar_t *in_R9; - void *pvVar18; + longlong lVar21; + int *piVar22; + CTLSPolicy *pCVar23; CTLSPolicy *this_01; undefined1 auStackY_14c8 [32]; - ulong uVar19; + ulong uVar24; undefined4 *local_1440; - int local_1438; - void *local_1430; - DWORD local_1428; - ulong local_1424; + void *local_1438; + int local_1430; + DWORD local_142c; + ulong local_1428 [2]; __PMLICENSEDPRODUCT *local_1420; uint local_1418; undefined4 local_1414; uint local_1410; LicReqVerState local_140c; undefined8 local_1408; undefined4 local_1400; ulong local_13fc; __PMLICENSEDPRODUCT *local_13f8; undefined4 *local_13f0; undefined8 local_13e8; undefined4 local_13e0; undefined4 local_13dc; undefined8 local_13d8; undefined4 local_13d0; undefined8 local_13c8; undefined8 local_13c0; LicCtx *local_13b8; undefined4 local_13a8; undefined4 uStack_13a4; undefined4 uStack_13a0; undefined4 uStack_139c; _EVENT_DESCRIPTOR local_1398; undefined4 local_1388 [8]; wchar_t *local_1368; CTLSPolicy *local_1338; void *local_1330; undefined4 local_1328; ushort *local_1318; uint local_1308; ushort local_10c0 [32]; undefined4 *local_1080; undefined4 *local_1078; undefined8 local_1068; undefined8 local_1060; undefined4 local_1058; undefined4 local_1054; undefined4 local_1050; uint local_104c; ushort local_1048 [256]; ushort local_e48 [256]; ushort local_c48 [256]; ushort local_a48 [256]; int local_848; ushort local_844 [518]; wchar_t local_438 [256]; wchar_t local_238 [256]; ulonglong local_38; undefined8 local_30; - local_30 = 0x18006756c; + local_30 = 0x180067e4c; local_13c0 = 0xfffffffffffffffe; local_38 = __security_cookie ^ (ulonglong)auStackY_14c8; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { in_R9 = L"CTsCalPDUpgLicenseReqCtx::Process"; WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1a, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process"); - } - pCVar14 = (CTLSPolicy *)0x0; - iVar5 = 0; + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process"); + } + pCVar23 = (CTLSPolicy *)0x0; + iVar8 = 0; local_1440 = (undefined4 *)0x0; local_1420 = (__PMLICENSEDPRODUCT *)0x0; - local_1430 = (void *)0x0; + local_1438 = (void *)0x0; this_01 = (CTLSPolicy *)0x0; - local_1438 = 0; - local_1428 = GetTickCount(); - puVar15 = (undefined4 *)0xc14; + local_1430 = 0; + local_142c = GetTickCount(); + puVar19 = (undefined4 *)0xc14; memset(&local_1058,0,0xc14); - puVar8 = *(undefined8 **)(this + 8); - if (puVar8 == (undefined8 *)0x0) { + puVar9 = *(undefined8 **)(this + 8); + if (puVar9 == (undefined8 *)0x0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1b, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process" + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process" ); } *(undefined4 *)(this + 0x14) = 0x57; iVar7 = -0x7ff8ffa9; StringCchPrintfW(local_844,0xff,(ushort *)L"Invalid lpContext. HR = %x",0x80070057); goto LAB_0; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { in_R9 = L"CTsCalPDUpgLicenseReqCtx::Process"; - puVar15 = (undefined4 *)&WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids; + puVar19 = (undefined4 *)&WPP_f813ad69531038f9b2527a4905dfea43_Traceguids; WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1c, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process", - (wchar_t *)*puVar8); - puVar8 = *(undefined8 **)(this + 8); + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process", + (wchar_t *)*puVar9); + puVar9 = *(undefined8 **)(this + 8); } LOCK(); - *(int *)(puVar8 + 1) = *(int *)(puVar8 + 1) + 1; + *(int *)(puVar9 + 1) = *(int *)(puVar9 + 1) + 1; UNLOCK(); - uVar2 = Validate(this); - pvVar18 = (void *)(ulonglong)uVar2; - pLVar9 = (LicCtx *)pCVar14; - if (uVar2 == 0) { + uVar4 = Validate(this); + pvVar18 = (void *)(ulonglong)uVar4; + pLVar10 = (LicCtx *)pCVar23; + if (uVar4 == 0) { + iVar8 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_54616378_50630366_FeatureDescriptorDetails); + if ((iVar8 != 0) && + ((((lVar21 = *(longlong *)(this + 0x20), *(uint *)(lVar21 + 0x1c) < 2 || + (*(uint *)(lVar21 + 0x28) < 2)) || (0x1fe < *(uint *)(lVar21 + 0x1c))) || + (0x1fe < *(uint *)(lVar21 + 0x28))))) { + pvVar18 = (void *)0xc0010020; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + uVar15 = 0x1e; + goto LAB_1; + } + goto LAB_2; + } if ((*(int *)(*(longlong *)(this + 8) + 0xc) == -1) || ((**(byte **)(this + 0x18) & 0x80) != 0)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { in_R9 = L"CTsCalPDUpgLicenseReqCtx::Process"; - puVar15 = (undefined4 *)&WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1e, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + puVar19 = (undefined4 *)&WPP_f813ad69531038f9b2527a4905dfea43_Traceguids; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1f, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } *(undefined4 *)(this + 0x70) = 0; } local_13b8 = operator_new__(0x250); if (local_13b8 != (LicCtx *)0x0) { if ((*(int *)(this + 0x74) == 0) && (*(int *)(*(longlong *)(this + 8) + 0xc) != -1)) { - uVar11 = (ulonglong)in_R9 & 0xffffffffffffff00; + uVar20 = (ulonglong)in_R9 & 0xffffffffffffff00; } else { - uVar11 = 1; + uVar20 = 1; } local_13a8 = *(undefined4 *)(this + 0x38); uStack_13a4 = *(undefined4 *)(this + 0x3c); uStack_13a0 = *(undefined4 *)(this + 0x40); uStack_139c = *(undefined4 *)(this + 0x44); - puVar15 = &local_13a8; - pLVar9 = (LicCtx *)LicCtx::LicCtx(local_13b8,*(undefined8 *)(this + 0x20),puVar15,uVar11); - } - if ((pLVar9 == (LicCtx *)0x0) || (pLVar9[8] == (LicCtx)0x0)) { + puVar19 = &local_13a8; + pLVar10 = (LicCtx *)LicCtx::LicCtx(local_13b8,*(undefined8 *)(this + 0x20),puVar19,uVar20); + } + if ((pLVar10 == (LicCtx *)0x0) || (pLVar10[8] == (LicCtx)0x0)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1f, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - StringCchCopyW(local_844,0xff,(ushort *)L"pLicCtx creation failed"); - } - else if (*(int *)(pLVar9 + 0x38) == 0) { - if (*(int *)(pLVar9 + 0x1c0) == 0) { - pwVar16 = L"License to return is zero, it should never happen in upgrade path"; - } - else { - wcscpy_s(local_238,0xff,*(wchar_t **)(pLVar9 + 0xb0)); - wcscpy_s(local_438,0xff,*(wchar_t **)(pLVar9 + 0xb8)); - local_1438 = 1; - pwVar16 = L"No Upgrade, But Request Issue a new CAL"; - } - StringCchCopyW(local_844,0xff,(ushort *)pwVar16); - this_01 = pCVar14; + pwVar17 = L"pLicCtx creation failed"; +LAB_3: + StringCchCopyW(local_844,0xff,(ushort *)pwVar17); + this_01 = pCVar23; } else { - *(uint *)(this + 0x74) = (uint)(pLVar9[9] != (LicCtx)0x0); + if (*(int *)(pLVar10 + 0x38) == 0) { + if (*(int *)(pLVar10 + 0x1c0) == 0) { + pwVar17 = L"License to return is zero, it should never happen in upgrade path"; + } + else { + wcscpy_s(local_238,0xff,*(wchar_t **)(pLVar10 + 0xb0)); + wcscpy_s(local_438,0xff,*(wchar_t **)(pLVar10 + 0xb8)); + local_1430 = 1; + pwVar17 = L"No Upgrade, But Request Issue a new CAL"; + } + goto LAB_3; + } + *(uint *)(this + 0x74) = (uint)(pLVar10[9] != (LicCtx)0x0); if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) { if ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0) { - puVar15 = (undefined4 *)&WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + puVar19 = (undefined4 *)&WPP_f813ad69531038f9b2527a4905dfea43_Traceguids; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x21, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - puVar15 = (undefined4 *)&WPP_2e4b3ee256053b2e7b2ad3f0ceec4fab_Traceguids; + puVar19 = (undefined4 *)&WPP_2e4b3ee256053b2e7b2ad3f0ceec4fab_Traceguids; WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x20, &WPP_2e4b3ee256053b2e7b2ad3f0ceec4fab_Traceguids); } } - if (*(int *)(pLVar9 + 0x38) == 1) { - this_00 = *(LicAttr **)(pLVar9 + 0x1d0); + if (*(int *)(pLVar10 + 0x38) == 1) { + this_00 = *(LicAttr **)(pLVar10 + 0x1d0); local_1418 = (uint)(this_00[0x18] == (LicAttr)0x0); local_1414 = *(undefined4 *)(this_00 + 0x1c); local_1410 = (uint)(this_00[0x19] != (LicAttr)0x0); - local_140c = LicAttr::compareVersion(this_00,*(ulong *)(pLVar9 + 0x18)); - uVar3 = LicCtx::findAndExecFunc(pLVar9,(LicLookupKey *)&local_1418); + local_140c = LicAttr::compareVersion(this_00,*(ulong *)(pLVar10 + 0x18)); + uVar5 = LicCtx::findAndExecFunc(pLVar10,(LicLookupKey *)&local_1418); } else { - uVar3 = LicCtx::processTwoLicenses(pLVar9); - } - pvVar18 = (void *)(ulonglong)uVar3; - if (uVar3 == 0) { + uVar5 = LicCtx::processTwoLicenses(pLVar10); + } + pvVar18 = (void *)(ulonglong)uVar5; + if (uVar5 == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - puVar15 = (undefined4 *)&WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x22, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + puVar19 = (undefined4 *)&WPP_f813ad69531038f9b2527a4905dfea43_Traceguids; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x23, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - p_Var1 = *(_LicensedProduct **)(pLVar9 + 0x30); - hMem = LocalAlloc(0x40,0x4000); - if (hMem != (ushort *)0x0) { - uVar3 = 0; - ppuVar10 = (undefined **)WPP_GLOBAL_Control; - if (*(int *)(pLVar9 + 0x38) != 0) { + p_Var3 = *(_LicensedProduct **)(pLVar10 + 0x30); + puVar11 = LocalAlloc(0x40,0x4000); + if (puVar11 != (ushort *)0x0) { + uVar5 = 0; + ppuVar12 = (undefined **)WPP_GLOBAL_Control; + if (*(int *)(pLVar10 + 0x38) != 0) { do { - if ((ppuVar10 != &WPP_GLOBAL_Control) && - ((*(uint *)((longlong)ppuVar10 + 0x1c) & 0x1000) != 0)) { - DumpLicensedProduct(p_Var1 + (ulonglong)uVar3 * 0xb8,hMem,(ulong)puVar15); + if ((ppuVar12 != &WPP_GLOBAL_Control) && + ((*(uint *)((longlong)ppuVar12 + 0x1c) & 0x1000) != 0)) { + DumpLicensedProduct(p_Var3 + (ulonglong)uVar5 * 0xb8,puVar11,(ulong)puVar19); WPP_SF_SdS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10)); - ppuVar10 = (undefined **)WPP_GLOBAL_Control; + ppuVar12 = (undefined **)WPP_GLOBAL_Control; } - uVar3 = uVar3 + 1; - } while (uVar3 < *(uint *)(pLVar9 + 0x38)); + uVar5 = uVar5 + 1; + } while (uVar5 < *(uint *)(pLVar10 + 0x38)); } - LocalFree(hMem); - } - lVar17 = *(longlong *)(this + 0x50); - if (lVar17 == 0) { - lVar17 = *(longlong *)(p_Var1 + 0x60); - } - puVar15 = local_1388; - pwVar16 = *(wchar_t **)(p_Var1 + 0x68); + LocalFree(puVar11); + } + lVar21 = *(longlong *)(this + 0x50); + if (lVar21 == 0) { + lVar21 = *(longlong *)(p_Var3 + 0x60); + } + puVar19 = local_1388; + pwVar17 = *(wchar_t **)(p_Var3 + 0x68); TlsLicenseRequestToPMLicenseRequest - (*(undefined4 **)(this + 0x18),*(longlong *)(this + 0x20),lVar17,pwVar16, - **(undefined4 **)(this + 0x18),*(undefined4 *)(pLVar9 + 0x248),puVar15); - uVar19 = (ulong)puVar15; - uVar2 = (ulong)lVar17; + (*(undefined4 **)(this + 0x18),*(longlong *)(this + 0x20),lVar21,pwVar17, + **(undefined4 **)(this + 0x18),*(undefined4 *)(pLVar10 + 0x248),puVar19); + uVar24 = (ulong)puVar19; + uVar4 = (ulong)lVar21; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - pwVar16 = L"CTsCalPDUpgLicenseReqCtx::Process"; - uVar2 = 0x800ba308; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x24, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + pwVar17 = L"CTsCalPDUpgLicenseReqCtx::Process"; + uVar4 = 0x800bb4b8; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x25, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - uVar4 = *(ulong *)(pLVar9 + 0x38); - uVar2 = TlsLicenseProductToPMLicenseProduct(p_Var1,uVar4,uVar2,(uchar *)pwVar16,&local_1420) + uVar2 = *(ulong *)(pLVar10 + 0x38); + uVar5 = TlsLicenseProductToPMLicenseProduct(p_Var3,uVar2,uVar4,(uchar *)pwVar17,&local_1420) ; - pvVar18 = (void *)(ulonglong)uVar2; - if (uVar2 == 0) { - uVar2 = 0x20; + if (uVar5 == 0) { + uVar4 = 0x20; memset(&local_1408,0,0x20); local_1408 = *(undefined8 *)(this + 0x40); local_1400 = *(undefined4 *)(this + 0x38); local_13f0 = local_1388; local_13f8 = local_1420; - local_13fc = uVar4; + local_13fc = uVar2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - uVar2 = 0x800ba308; - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x26, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + uVar4 = 0x800bb4b8; + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - if ((((*(longlong *)(pLVar9 + 0x230) == 0) || - (*(longlong *)(pLVar9 + 0x238) - *(longlong *)(pLVar9 + 0x230) >> 2 == 0)) && - (iVar5 = 0, *(longlong *)(pLVar9 + 0x1f0) != 0)) && - (iVar5 = 0, *(longlong *)(pLVar9 + 0x1f8) - *(longlong *)(pLVar9 + 0x1f0) >> 2 != 0)) { - iVar5 = 1; + if ((((*(longlong *)(pLVar10 + 0x230) == 0) || + (*(longlong *)(pLVar10 + 0x238) - *(longlong *)(pLVar10 + 0x230) >> 2 == 0)) && + (pCVar23 = (CTLSPolicy *)0x0, *(longlong *)(pLVar10 + 0x1f0) != 0)) && + (pCVar23 = (CTLSPolicy *)0x0, + *(longlong *)(pLVar10 + 0x1f8) - *(longlong *)(pLVar10 + 0x1f0) >> 2 != 0)) { + pCVar23 = (CTLSPolicy *)0x1; } this_01 = TLSGetPolicyModule(*(_TLSLicenseRequest **)(this + 0x20)); - if (this_01 == (CTLSPolicy *)0x0) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, - L"CTsCalPDUpgLicenseReqCtx::Process"); - } - pvVar18 = (void *)0x1000; - pwVar16 = L"TLSGetPolicyModule returned NULL. Status = %x"; - } - else { - uVar4 = CTLSPolicy::PMGenerateClientId(this_01,&local_1430); - pvVar18 = (void *)(ulonglong)uVar4; - if (uVar4 == 0) { - uVar2 = CTLSPolicy::PMLicenseUpgrade - (this_01,local_1430,uVar2,iVar5,&local_1408,&local_1440,uVar19); - pvVar18 = (void *)(ulonglong)uVar2; - if (uVar2 == 0) { + if (this_01 != (CTLSPolicy *)0x0) { + uVar5 = CTLSPolicy::PMGenerateClientId(this_01,&local_1438); + if (uVar5 == 0) { + uVar4 = CTLSPolicy::PMLicenseUpgrade + (this_01,local_1438,uVar4,(int)pCVar23,&local_1408,&local_1440, + uVar24); + pvVar18 = (void *)(ulonglong)uVar4; + if (uVar4 == 0) { if (local_1440 == (undefined4 *)0x0) { local_1440 = local_1388; } else { - iVar5 = _wcsicmp(local_1368,*(wchar_t **)(local_1440 + 8)); - if (iVar5 != 0) { + iVar8 = _wcsicmp(local_1368,*(wchar_t **)(local_1440 + 8)); + if (iVar8 != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2a, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2b, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process",local_1368, *(wchar_t **)(local_1440 + 8)); } StringCchCopyW(local_844,0xff,(ushort *)L"Requested Mismatched company name"); pvVar18 = (void *)0xc800000f; local_1398.Id = 0x2a; local_1398.Version = '\0'; local_1398.Channel = '\b'; local_1398.Level = '\x02'; local_1398.Opcode = '\0'; local_1398.Task = 0; local_1398.Keyword._0_4_ = 0; local_1398.Keyword._4_4_ = 0x80000000; TLSLogEvent(&local_1398,0xc800000f,this_01 + 0x58,this_01 + 600); - goto LAB_1; + goto LAB_4; } } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2b, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - puVar15 = local_1440; + puVar19 = local_1440; memset(&local_1338,0,0x2c8); - uVar11 = TLSFormDBRequest(*(undefined8 **)(*(uint **)(this + 0x20) + 2), - **(uint **)(this + 0x20),puVar15[1], - *(undefined8 *)(puVar15 + 8), - **(undefined8 **)(puVar15 + 2),puVar15[10],puVar15[0xb], - *(wchar_t **)(puVar15 + 0xc),*(wchar_t **)(puVar15 + 0xe), + uVar20 = TLSFormDBRequest(*(undefined8 **)(*(uint **)(this + 0x20) + 2), + **(uint **)(this + 0x20),puVar19[1], + *(undefined8 *)(puVar19 + 8), + **(undefined8 **)(puVar19 + 2),puVar19[10],puVar19[0xb], + *(wchar_t **)(puVar19 + 0xc),*(wchar_t **)(puVar19 + 0xe), &local_1338); - pvVar18 = (void *)(uVar11 & 0xffffffff); - if ((int)uVar11 == 0) { - local_1330 = local_1430; + pvVar18 = (void *)(uVar20 & 0xffffffff); + if ((int)uVar20 == 0) { + local_1330 = local_1438; local_1078 = local_1440; local_1080 = local_1388; - puVar12 = WPP_GLOBAL_Control; + puVar14 = WPP_GLOBAL_Control; local_1338 = this_01; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - puVar12 = *(undefined **)(WPP_GLOBAL_Control + 0x10); - WPP_SF_S(puVar12,0x2d,&WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + puVar14 = *(undefined **)(WPP_GLOBAL_Control + 0x10); + WPP_SF_S(puVar14,0x2e,&WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - uVar2 = TLSVerifyChallengeDataGetWantedLicenseLevel - ((ulong)puVar12,*(ulong *)(this + 0x2c),*(uchar **)(this + 0x30) + uVar4 = TLSVerifyChallengeDataGetWantedLicenseLevel + ((ulong)puVar14,*(ulong *)(this + 0x2c),*(uchar **)(this + 0x30) ,local_10c0); - pvVar18 = (void *)(ulonglong)uVar2; - if (uVar2 == 0) { + pvVar18 = (void *)(ulonglong)uVar4; + if (uVar4 == 0) { local_13e8 = *(undefined8 *)(this + 0x20); local_13e0 = *(undefined4 *)(this + 0x28); local_13dc = *(undefined4 *)(this + 0x2c); local_13d8 = *(undefined8 *)(this + 0x30); local_13d0 = *(undefined4 *)(this + 0x38); local_13c8 = *(undefined8 *)(this + 0x40); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2f, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x30, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } local_1050 = local_1328; if (local_1318 == (ushort *)0x0) { if (local_1440[4] == 0) { pvVar18 = (void *)0x1028; StringCchCopyW(local_a48,0xff,(ushort *)L"UnSupported"); StringCchPrintfW(local_844,0xff, (ushort *) L"GetAdjustedRequest Wrong LS version. Status = %x",0x1028) ; - if (DAT_2 != '\0') { + if (DAT_5 != '\0') { local_1068 = 0; local_1060 = 0; - EtwEventWriteFull(DAT_3,&TLS_E_INCOMPATIBLEVERSION,0,0); + EtwEventWriteFull(DAT_6,&TLS_E_INCOMPATIBLEVERSION,0,0); } - goto LAB_1; + goto LAB_4; } } else { StringCchCopyW(local_a48,0xff,local_1318); } - uVar3 = TLSUpgradeLicenseRequestEx + uVar5 = TLSUpgradeLicenseRequestEx (*(int *)(this + 0x70),(__ForwardUpgradeRequest *)&local_13e8, *(ulong **)(this + 0x18),(_DbLicensedProduct *)&local_1338, - pLVar9,*(_DbLicensedProduct **)(this + 0x58), + pLVar10,*(_DbLicensedProduct **)(this + 0x58), *(uchar ***)(this + 0x60)); - pvVar18 = (void *)(ulonglong)uVar3; - if (uVar3 == 0xc0080008 || uVar3 == 0xc0080009) { + pvVar18 = (void *)(ulonglong)uVar5; + if (uVar5 == 0xc0080008 || uVar5 == 0xc0080009) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x30, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x31, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } LogLicenseUnavailableEvent - (uVar3,(ushort *)**(undefined8 **)(local_1440 + 2),this_01, - local_1430); + (uVar5,(ushort *)**(undefined8 **)(local_1440 + 2),this_01, + local_1438); } - if (uVar3 == 0) { + if (uVar5 == 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x31, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x32, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } } else { StringCchPrintfW(local_844,0xff, (ushort *)L"Failed TLSUpgradeLicenseRequestEx. Status = %x", - (ulonglong)uVar3); + (ulonglong)uVar5); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x32, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x33, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } } - goto LAB_1; + goto LAB_4; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2e, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2f, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - pwVar16 = L"Failed TLSVerifyChallengeDataGetWantedLicenseLevel. Status = %x"; + pwVar17 = L"Failed TLSVerifyChallengeDataGetWantedLicenseLevel. Status = %x"; } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2d, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - pwVar16 = L"Failed TLSFormDBRequest. Status = %x"; + pwVar17 = L"Failed TLSFormDBRequest. Status = %x"; } } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x29, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2a, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - pwVar16 = L"Failed pPolicy->PMLicenseUpgrade. Status = %x"; + pwVar17 = L"Failed pPolicy->PMLicenseUpgrade. Status = %x"; } + StringCchPrintfW(local_844,0xff,(ushort *)pwVar17,pvVar18); + goto LAB_4; } - else { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, - L"CTsCalPDUpgLicenseReqCtx::Process"); - } - pwVar16 = L"FAIL pPolicy->PMGenerateClientId. Status = %x"; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x29, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, + L"CTsCalPDUpgLicenseReqCtx::Process"); } + pwVar17 = L"FAIL pPolicy->PMGenerateClientId. Status = %x"; + goto LAB_7; } + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, + L"CTsCalPDUpgLicenseReqCtx::Process"); + } + pvVar18 = (void *)0x1000; + pwVar17 = L"TLSGetPolicyModule returned NULL. Status = %x"; } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x25, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x26, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - pwVar16 = L"TlsLicenseProductToPMLicenseProduct. Status = %x"; - } + pwVar17 = L"TlsLicenseProductToPMLicenseProduct. Status = %x"; + this_01 = pCVar23; +LAB_7: + pvVar18 = (void *)(ulonglong)uVar5; + } + StringCchPrintfW(local_844,0xff,(ushort *)pwVar17,pvVar18); } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x21, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x22, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - pwVar16 = L"GetLicensesToRequest. Status = %x"; - this_01 = pCVar14; - } - StringCchPrintfW(local_844,0xff,(ushort *)pwVar16,pvVar18); - } -LAB_1: - if (pLVar9 != (LicCtx *)0x0) { - local_104c = ((uint)(byte)pLVar9[9] << 4 | (uint)(byte)pLVar9[0x1c7]) << 0x18 | - (uint)(byte)pLVar9[0x1c6] << 0x10 | - (uint)(byte)pLVar9[0x28] << 8 | local_104c & 0xff; + StringCchPrintfW(local_844,0xff,(ushort *)L"GetLicensesToRequest. Status = %x",pvVar18); + } + } +LAB_4: + if (pLVar10 != (LicCtx *)0x0) { + local_104c = ((uint)(byte)pLVar10[9] << 4 | (uint)(byte)pLVar10[0x1c7]) << 0x18 | + (uint)(byte)pLVar10[0x1c6] << 0x10 | + (uint)(byte)pLVar10[0x28] << 8 | local_104c & 0xff; } } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1d, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + uVar15 = 0x1d; +LAB_1: + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar15, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, L"CTsCalPDUpgLicenseReqCtx::Process"); } - StringCchPrintfW(local_844,0xff,(ushort *)L"Failed Request Validation. Status = %x", - (ulonglong)uVar2); - this_01 = pCVar14; +LAB_2: + StringCchPrintfW(local_844,0xff,(ushort *)L"Failed Request Validation. Status = %x",pvVar18); + this_01 = pCVar23; } iVar7 = 0; - pIVar13 = (IRdlsDBConnection *)0xff; + pIVar16 = (IRdlsDBConnection *)0xff; StringCchPrintfW(local_1048,0xff,(ushort *)L"%x-%x-%x-%x-%x",(ulonglong)local_1308); - iVar5 = (int)pvVar18; - if (iVar5 == 0) { - LicCtx::TypePostProcess(pLVar9,pIVar13); + iVar8 = (int)pvVar18; + if ((iVar8 == 0) && + ((iVar6 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_54616378_50630366_FeatureDescriptorDetails), iVar6 == 0 || + (pLVar10 != (LicCtx *)0x0)))) { + LicCtx::TypePostProcess(pLVar10,pIVar16); } if (local_1420 != (__PMLICENSEDPRODUCT *)0x0) { LocalFree(local_1420); } - *(int *)(*(longlong *)(this + 8) + 0x10) = iVar5; + *(int *)(*(longlong *)(this + 8) + 0x10) = iVar8; LOCK(); *(int *)(*(longlong *)(this + 8) + 8) = *(int *)(*(longlong *)(this + 8) + 8) + -1; UNLOCK(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { GetTickCount(); - WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x33, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids, + WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x34, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids, (wchar_t *)**(undefined8 **)(this + 8),L"CTsCalPDUpgLicenseReqCtx::Process"); } - iVar6 = TLSMapReturnCode(iVar5); - **(int **)(this + 0x68) = iVar6; - if (((**(int **)(this + 0x68) == 0x1393) && - ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x34, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process"); + iVar6 = EvaluateCurrentState + ((reg_FeatureDescriptor *)&g_Feature_54616378_50630366_FeatureDescriptorDetails) + ; + if (iVar6 == 0) { + iVar6 = TLSMapReturnCode(iVar8); + **(int **)(this + 0x68) = iVar6; + if (((**(int **)(this + 0x68) == 0x1393) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + uVar15 = 0x36; +LAB_8: + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar15, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process" + ); + } + } + else { + piVar22 = *(int **)(this + 0x68); + if (piVar22 != (int *)0x0) { + iVar6 = TLSMapReturnCode(iVar8); + *piVar22 = iVar6; + if (((**(int **)(this + 0x68) == 0x1393) && + ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + uVar15 = 0x35; + goto LAB_8; + } + } } if (this_01 != (CTLSPolicy *)0x0) { - CTLSPolicy::PMLicenseRequest(this_01,local_1430,7,pvVar18,(void **)0x0,(uint)(iVar5 != 0)); + iVar6 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_54616378_50630366_FeatureDescriptorDetails); + if ((iVar6 == 0) || (local_1438 != (void *)0x0)) { + CTLSPolicy::PMLicenseRequest(this_01,local_1438,7,pvVar18,(void **)0x0,(uint)(iVar8 != 0)); + } LOCK(); *(int *)this_01 = *(int *)this_01 + -1; UNLOCK(); } - local_1424 = 1; - if (local_1438 != 0) { + local_1428[0] = 1; + if (local_1430 != 0) { iVar7 = TLSRequestNewLicense (*(void **)(this + 8),*(ulong **)(this + 0x18),*(ulong *)(this + 0x28), *(_TLSLicenseRequest **)(this + 0x20),(ushort *)local_238,(ushort *)local_438 - ,*(ulong *)(this + 0x2c),*(uchar **)(this + 0x30),1,0,&local_1424, + ,*(ulong *)(this + 0x2c),*(uchar **)(this + 0x30),1,0,local_1428, *(ulong **)(this + 0x58),*(uchar ***)(this + 0x60),*(ulong **)(this + 0x68), - *(ulong *)(pLVar9 + 0x248)); - } - if (pLVar9 != (LicCtx *)0x0) { - (**(code **)(*(longlong *)pLVar9 + 0x48))(pLVar9,1); + *(ulong *)(pLVar10 + 0x248)); + } + if (pLVar10 != (LicCtx *)0x0) { + (**(code **)(*(longlong *)pLVar10 + 0x48))(pLVar10,1); } LAB_0: local_848 = iVar7; if (iVar7 == 0) { - local_848 = iVar5; - } - lVar17 = *(longlong *)(this + 0x20); - local_1058 = *(undefined4 *)(lVar17 + 0x14); - local_1054 = *(undefined4 *)(lVar17 + 0x18); - StringCbCopyW(local_c48,(ulonglong)*(uint *)(lVar17 + 0x28),*(ushort **)(lVar17 + 0x30)); + local_848 = iVar8; + } + iVar8 = EvaluateCurrentState + ((reg_FeatureDescriptor *)&g_Feature_54616378_50630366_FeatureDescriptorDetails) + ; + if (iVar8 == 0) { + lVar21 = *(longlong *)(this + 0x20); + local_1058 = *(undefined4 *)(lVar21 + 0x14); + local_1054 = *(undefined4 *)(lVar21 + 0x18); + StringCbCopyW(local_c48,(ulonglong)*(uint *)(lVar21 + 0x28),*(ushort **)(lVar21 + 0x30)); + } + else { + lVar21 = *(longlong *)(this + 0x20); + if (lVar21 != 0) { + local_1058 = *(undefined4 *)(lVar21 + 0x14); + local_1054 = *(undefined4 *)(lVar21 + 0x18); + pwVar17 = *(wchar_t **)(lVar21 + 0x30); + uVar20 = (ulonglong)(*(uint *)(lVar21 + 0x28) >> 1); + if (uVar20 < 0x7fffffff) { + if (pwVar17 == (wchar_t *)0x0) { + pwVar17 = L""; + uVar20 = 0; + } + lVar21 = 0x100; + puVar11 = local_c48; + do { + if (((uVar20 - 0x100) + lVar21 == 0) || + (uVar1 = *(ushort *)(((longlong)pwVar17 - (longlong)local_c48) + (longlong)puVar11), + uVar1 == 0)) break; + *puVar11 = uVar1; + puVar11 = puVar11 + 1; + lVar21 = lVar21 + -1; + } while (lVar21 != 0); + puVar13 = puVar11 + -1; + if (lVar21 != 0) { + puVar13 = puVar11; + } + *puVar13 = 0; + } + else { + local_c48[0] = 0; + } + } + } StringCchCopyW(local_e48,0xff,(ushort *)L"PDU"); LogTSLSTelemetryEvent(1,4,0,&local_1058); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x35, - &WPP_13fcc072f74f3f1e33fbc23d275e9760_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process" + WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x37, + &WPP_f813ad69531038f9b2527a4905dfea43_Traceguids,L"CTsCalPDUpgLicenseReqCtx::Process" ); } return iVar7; } ``` ## CTsCalPDNewLicenseReqCtx::Process ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.56| |i_ratio|0.39| |m_ratio|0.92| |b_ratio|0.29| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|Process|Process| |fullname|CTsCalPDNewLicenseReqCtx::Process|CTsCalPDNewLicenseReqCtx::Process| |refcount|3|3| |`length`|2013|2317| |`called`|
Expand for full list:
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMLicenseRequest
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Validate
KERNEL32.DLL::GetTickCount
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
NTDLL.DLL::EtwEventWriteFull
StringCchCopyW
StringCchPrintfW
TLSGetPolicyModuleTLSMapReturnCode
TLSNewLicenseRequest
TlsLicenseRequestToPMLicenseRequest
WPP_SF_S
WPP_SF_SDD
WPP_SF_SSS
WPP_SF_SSd
WPP_SF_Sd
__security_check_cookie
memset
operator_delete[]
operator_new[]
|
Expand for full list:
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMLicenseRequest
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Validate
EvaluateCurrentState
KERNEL32.DLL::GetTickCount
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
NTDLL.DLL::EtwEventWriteFull
StringCchCopyW
StringCchPrintfWTLSGetPolicyModule
TLSMapReturnCode
TLSNewLicenseRequest
TlsLicenseRequestToPMLicenseRequest
WPP_SF_S
WPP_SF_SDD
WPP_SF_SSS
WPP_SF_SSd
WPP_SF_Sd
__security_check_cookie
memset
operator_delete[]
operator_new[]
| |calling||| |paramcount|1|1| |`address`|1800667a0|180066f50| |sig|long __thiscall Process(CTsCalPDNewLicenseReqCtx * this)|long __thiscall Process(CTsCalPDNewLicenseReqCtx * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CTsCalPDNewLicenseReqCtx::Process Called Diff ```diff --- CTsCalPDNewLicenseReqCtx::Process called +++ CTsCalPDNewLicenseReqCtx::Process called @@ -5,0 +6 @@ +EvaluateCurrentState ``` ### CTsCalPDNewLicenseReqCtx::Process Diff ```diff --- CTsCalPDNewLicenseReqCtx::Process +++ CTsCalPDNewLicenseReqCtx::Process @@ -1,287 +1,350 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: virtual long __cdecl CTsCalPDNewLicenseReqCtx::Process(void) __ptr64 */ long __thiscall CTsCalPDNewLicenseReqCtx::Process(CTsCalPDNewLicenseReqCtx *this) { - longlong lVar1; + ushort uVar1; ulong uVar2; DWORD DVar3; int iVar4; - undefined8 *puVar5; - __PMLICENSEREQUEST *p_Var6; + int iVar5; + undefined8 *puVar6; + __PMLICENSEREQUEST *p_Var7; CTLSPolicy *this_00; __TLSDbLicenseRequest *_Dst; - int iVar7; - void *pvVar8; - ulong uVar9; + ushort *puVar8; + ushort *puVar9; + undefined2 uVar10; + wchar_t *pwVar11; + void *pvVar12; + ulong uVar13; __TLSDbLicenseRequest *_Dst_00; - wchar_t *pwVar10; - int *piVar11; - CTLSPolicy *pCVar12; - __PMLICENSEREQUEST *p_Var13; + ulonglong uVar14; + longlong lVar15; + int *piVar16; + __PMLICENSEREQUEST *p_Var17; undefined1 auStackY_d28 [32]; __PMLICENSEREQUEST *local_cc8; int local_cc0; void *local_cb8; DWORD local_cb0; ulong *local_ca8; ulong local_ca0 [2]; undefined8 local_c98; undefined8 local_c90; undefined8 local_c88; undefined4 local_c80; undefined8 local_c78; undefined8 local_c70; undefined8 local_c68; undefined4 local_c58; undefined4 local_c54; undefined4 local_c50; uint local_c4c; ushort local_c48 [256]; ushort local_a48 [256]; ushort local_848 [256]; ushort local_648 [256]; int local_448; ushort local_444 [518]; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_d28; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x22, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids,L"CTsCalPDNewLicenseReqCtx::Process"); + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids,L"CTsCalPDNewLicenseReqCtx::Process"); } _Dst_00 = (__TLSDbLicenseRequest *)0x0; - iVar7 = 0; - uVar9 = 0; + iVar5 = 0; + uVar13 = 0; local_cc0 = 0; local_cb8 = (void *)0x0; local_cc8 = (__PMLICENSEREQUEST *)0x0; local_ca8 = (ulong *)0x0; - pCVar12 = (CTLSPolicy *)0x0; local_cb0 = GetTickCount(); memset(&local_c58,0,0xc14); - puVar5 = *(undefined8 **)(this + 8); - if (puVar5 == (undefined8 *)0x0) { + puVar6 = *(undefined8 **)(this + 8); + if (puVar6 == (undefined8 *)0x0) { *(undefined4 *)(this + 0x14) = 0x57; StringCchPrintfW(local_444,0xff,(ushort *)L"Invalid lpContext. HR = %x",0x80070057); iVar4 = -0x7ff8ffa9; goto LAB_0; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x23, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids,(wchar_t *)*puVar5); - puVar5 = *(undefined8 **)(this + 8); + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids,(wchar_t *)*puVar6); + puVar6 = *(undefined8 **)(this + 8); } LOCK(); - *(int *)(puVar5 + 1) = *(int *)(puVar5 + 1) + 1; + *(int *)(puVar6 + 1) = *(int *)(puVar6 + 1) + 1; UNLOCK(); uVar2 = Validate(this); - pvVar8 = (void *)(ulonglong)uVar2; - p_Var13 = (__PMLICENSEREQUEST *)_Dst_00; + pvVar12 = (void *)(ulonglong)uVar2; + p_Var17 = (__PMLICENSEREQUEST *)_Dst_00; if (uVar2 == 0) { + iVar5 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_159217977_50463004_FeatureDescriptorDetails); + if ((iVar5 != 0) && + ((((lVar15 = *(longlong *)(this + 0x20), *(uint *)(lVar15 + 0x1c) < 2 || + (*(uint *)(lVar15 + 0x28) < 2)) || (0x1fe < *(uint *)(lVar15 + 0x1c))) || + (0x1fe < *(uint *)(lVar15 + 0x28))))) { + pvVar12 = (void *)0xc0010020; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + uVar10 = 0x25; + goto LAB_1; + } + goto LAB_2; + } if ((*(int *)(*(longlong *)(this + 8) + 0xc) != -1) && ((**(byte **)(this + 0x18) & 0x80) == 0)) { local_ca0[0] = *(ulong *)(this + 0x28); local_c98 = *(undefined8 *)(this + 0x20); local_c90 = *(undefined8 *)(this + 0x38); local_c88 = *(undefined8 *)(this + 0x40); local_c80 = *(undefined4 *)(this + 0x2c); local_c78 = *(undefined8 *)(this + 0x30); local_ca8 = local_ca0; - uVar9 = 1; - } - p_Var6 = operator_new__(0x48); - if (p_Var6 != (__PMLICENSEREQUEST *)0x0) { - memset(p_Var6,0,0x48); - p_Var13 = p_Var6; - } - memset(p_Var13,0,0x48); - p_Var6 = p_Var13; + uVar13 = 1; + } + p_Var7 = operator_new__(0x48); + if (p_Var7 != (__PMLICENSEREQUEST *)0x0) { + memset(p_Var7,0,0x48); + p_Var17 = p_Var7; + } + memset(p_Var17,0,0x48); + p_Var7 = p_Var17; TlsLicenseRequestToPMLicenseRequest (*(undefined4 **)(this + 0x18),*(longlong *)(this + 0x20),*(undefined8 *)(this + 0x38) ,*(undefined8 *)(this + 0x40),**(undefined4 **)(this + 0x18), - *(undefined4 *)(this + 0x70),(undefined4 *)p_Var13); + *(undefined4 *)(this + 0x70),(undefined4 *)p_Var17); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x25, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, - L"CTsCalPDNewLicenseReqCtx::Process",*(wchar_t **)(p_Var13 + 0x30), - *(wchar_t **)(p_Var13 + 0x38)); + WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x26, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, + L"CTsCalPDNewLicenseReqCtx::Process",*(wchar_t **)(p_Var17 + 0x30), + *(wchar_t **)(p_Var17 + 0x38)); } this_00 = TLSGetPolicyModule(*(_TLSLicenseRequest **)(this + 0x20)); if (this_00 == (CTLSPolicy *)0x0) { - pvVar8 = (void *)0x1000; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x26, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"TLSGetPolicyModule returned NULL. Status = %x"; - goto LAB_1; + pvVar12 = (void *)0x1000; + pwVar11 = L"TLSGetPolicyModule returned NULL. Status = %x"; + goto LAB_3; } uVar2 = CTLSPolicy::PMGenerateClientId(this_00,&local_cb8); - pvVar8 = (void *)(ulonglong)uVar2; + pvVar12 = (void *)(ulonglong)uVar2; if (uVar2 != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x27, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"FAIL pPolicy->PMGenerateClientId. Status = %x"; - goto LAB_1; + pwVar11 = L"FAIL pPolicy->PMGenerateClientId. Status = %x"; + _Dst_00 = (__TLSDbLicenseRequest *)(CTLSPolicy *)0x0; + goto LAB_3; } local_cc8 = (__PMLICENSEREQUEST *)0x0; - uVar2 = GetAdjustedRequest(this,p_Var13,this_00,local_cb8,&local_cc8); - pvVar8 = (void *)(ulonglong)uVar2; + uVar2 = GetAdjustedRequest(this,p_Var17,this_00,local_cb8,&local_cc8); + pvVar12 = (void *)(ulonglong)uVar2; if ((uVar2 != 0) || (local_cc8 == (__PMLICENSEREQUEST *)0x0)) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x28, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x29, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"FAIL GetAdjustedRequest. Status = %x"; - goto LAB_1; + pwVar11 = L"FAIL GetAdjustedRequest. Status = %x"; + _Dst_00 = (__TLSDbLicenseRequest *)(CTLSPolicy *)0x0; + goto LAB_3; } _Dst = operator_new__(0x2c8); if (_Dst != (__TLSDbLicenseRequest *)0x0) { memset(_Dst,0,0x2c8); _Dst_00 = _Dst; } memset(_Dst_00,0,0x2c8); - uVar2 = CreateDbLicenseRequest(this,_Dst_00,p_Var13,local_cc8,this_00,local_cb8); - pvVar8 = (void *)(ulonglong)uVar2; - pCVar12 = (CTLSPolicy *)_Dst_00; + uVar2 = CreateDbLicenseRequest(this,_Dst_00,p_Var17,local_cc8,this_00,local_cb8); + pvVar12 = (void *)(ulonglong)uVar2; if (uVar2 != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x29, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2a, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"FAIL CreateDbLicenseRequest. Status = %x"; - goto LAB_1; + pwVar11 = L"FAIL CreateDbLicenseRequest. Status = %x"; + goto LAB_3; } if (_Dst_00 == (__TLSDbLicenseRequest *)0x0) { -LAB_2: - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2a, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, +LAB_4: + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_SSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2b, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process",(wchar_t *)(_Dst_00 + 0x76), (wchar_t *)(_Dst_00 + 0x54)); } DVar3 = TLSNewLicenseRequest - (uVar9,*(ulong **)(this + 0x18),local_ca8,_Dst_00,*(int *)(this + 0x48), - *(uint *)(local_cc8 + 0x40),p_Var6,*(uint *)(this + 0x4c), + (uVar13,*(ulong **)(this + 0x18),local_ca8,_Dst_00,*(int *)(this + 0x48), + *(uint *)(local_cc8 + 0x40),p_Var7,*(uint *)(this + 0x4c), *(ulong **)(this + 0x50),*(ulong **)(this + 0x58),*(uchar ***)(this + 0x60) ); - pvVar8 = (void *)(ulonglong)DVar3; + pvVar12 = (void *)(ulonglong)DVar3; if (DVar3 != 0) { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2b, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"FAIL TLSNewLicenseRequest. Status = %x"; - goto LAB_1; + StringCchPrintfW(local_444,0xff,(ushort *)L"FAIL TLSNewLicenseRequest. Status = %x",pvVar12) + ; } } else { - p_Var6 = (__PMLICENSEREQUEST *) - CONCAT44((int)((ulonglong)p_Var6 >> 0x20),*(undefined4 *)(_Dst_00 + 0x3c)); + p_Var7 = (__PMLICENSEREQUEST *) + CONCAT44((int)((ulonglong)p_Var7 >> 0x20),*(undefined4 *)(_Dst_00 + 0x3c)); StringCchPrintfW(local_c48,0xff,(ushort *)L"%x-%x-%x-%x-%x", (ulonglong)*(uint *)(_Dst_00 + 0x30)); local_c50 = *(undefined4 *)(_Dst_00 + 0x10); if (*(ushort **)(_Dst_00 + 0x20) != (ushort *)0x0) { StringCchCopyW(local_648,0xff,*(ushort **)(_Dst_00 + 0x20)); - goto LAB_2; - } - if (*(int *)(local_cc8 + 0x10) != 0) goto LAB_2; - pvVar8 = (void *)0x1028; + goto LAB_4; + } + if (*(int *)(local_cc8 + 0x10) != 0) goto LAB_4; + pvVar12 = (void *)0x1028; StringCchCopyW(local_648,0xff,(ushort *)L"UnSupported"); StringCchPrintfW(local_444,0xff,(ushort *)L"GetAdjustedRequest Wrong LS version. Status = %x", 0x1028); - if (DAT_3 != '\0') { + if (DAT_5 != '\0') { local_c70 = 0; local_c68 = 0; - EtwEventWriteFull(DAT_4,&TLS_E_INCOMPATIBLEVERSION,0,0); + EtwEventWriteFull(DAT_6,&TLS_E_INCOMPATIBLEVERSION,0,0); } } } else { if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x24, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + uVar10 = 0x24; +LAB_1: + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar10, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, L"CTsCalPDNewLicenseReqCtx::Process"); } - pwVar10 = L"Failed Request Validation. Status = %x"; +LAB_2: + pwVar11 = L"Failed Request Validation. Status = %x"; this_00 = (CTLSPolicy *)_Dst_00; - pCVar12 = (CTLSPolicy *)_Dst_00; -LAB_1: - StringCchPrintfW(local_444,0xff,(ushort *)pwVar10,pvVar8); - _Dst_00 = (__TLSDbLicenseRequest *)pCVar12; - } - iVar7 = (int)pvVar8; - *(int *)(*(longlong *)(this + 8) + 0x10) = iVar7; +LAB_3: + StringCchPrintfW(local_444,0xff,(ushort *)pwVar11,pvVar12); + } + iVar5 = (int)pvVar12; + *(int *)(*(longlong *)(this + 8) + 0x10) = iVar5; LOCK(); *(int *)(*(longlong *)(this + 8) + 8) = *(int *)(*(longlong *)(this + 8) + 8) + -1; UNLOCK(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { GetTickCount(); - WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2c, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids, + WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2d, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids, (wchar_t *)**(undefined8 **)(this + 8),L"CTsCalPDNewLicenseReqCtx::Process"); } - piVar11 = *(int **)(this + 0x68); - if (piVar11 != (int *)0x0) { - iVar4 = TLSMapReturnCode(iVar7); - *piVar11 = iVar4; + piVar16 = *(int **)(this + 0x68); + if (piVar16 != (int *)0x0) { + iVar4 = TLSMapReturnCode(iVar5); + *piVar16 = iVar4; } if (local_cc8 != (__PMLICENSEREQUEST *)0x0) { local_c4c = *(int *)(local_cc8 + 0x40) << 0x18 | local_c4c & 0xffffff; } if (this_00 != (CTLSPolicy *)0x0) { - CTLSPolicy::PMLicenseRequest(this_00,local_cb8,7,pvVar8,(void **)0x0,1); + iVar4 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_159217977_50463004_FeatureDescriptorDetails); + if ((iVar4 == 0) || (local_cb8 != (void *)0x0)) { + CTLSPolicy::PMLicenseRequest(this_00,local_cb8,7,pvVar12,(void **)0x0,1); + } LOCK(); *(int *)this_00 = *(int *)this_00 + -1; UNLOCK(); } - if (p_Var13 != (__PMLICENSEREQUEST *)0x0) { - operator_delete__(p_Var13); + if (p_Var17 != (__PMLICENSEREQUEST *)0x0) { + operator_delete__(p_Var17); } iVar4 = local_cc0; if (_Dst_00 != (__TLSDbLicenseRequest *)0x0) { operator_delete__(_Dst_00); iVar4 = local_cc0; } LAB_0: - lVar1 = *(longlong *)(this + 0x20); local_448 = iVar4; if (iVar4 == 0) { - local_448 = iVar7; - } - local_c58 = *(undefined4 *)(lVar1 + 0x14); - local_c54 = *(undefined4 *)(lVar1 + 0x18); - StringCchCopyW(local_848,0xff,*(ushort **)(lVar1 + 0x30)); + local_448 = iVar5; + } + iVar5 = EvaluateCurrentState + ((reg_FeatureDescriptor *)&g_Feature_159217977_50463004_FeatureDescriptorDetails + ); + if (iVar5 == 0) { + lVar15 = *(longlong *)(this + 0x20); + local_c58 = *(undefined4 *)(lVar15 + 0x14); + local_c54 = *(undefined4 *)(lVar15 + 0x18); + StringCchCopyW(local_848,0xff,*(ushort **)(lVar15 + 0x30)); + } + else { + lVar15 = *(longlong *)(this + 0x20); + if (lVar15 != 0) { + local_c58 = *(undefined4 *)(lVar15 + 0x14); + local_c54 = *(undefined4 *)(lVar15 + 0x18); + pwVar11 = *(wchar_t **)(lVar15 + 0x30); + uVar14 = (ulonglong)(*(uint *)(lVar15 + 0x28) >> 1); + if (uVar14 < 0x7fffffff) { + if (pwVar11 == (wchar_t *)0x0) { + pwVar11 = L""; + uVar14 = 0; + } + lVar15 = 0x100; + puVar9 = local_848; + do { + if ((lVar15 + -0x100 + uVar14 == 0) || + (uVar1 = *(ushort *)(((longlong)pwVar11 - (longlong)local_848) + (longlong)puVar9), + uVar1 == 0)) break; + *puVar9 = uVar1; + puVar9 = puVar9 + 1; + lVar15 = lVar15 + -1; + } while (lVar15 != 0); + puVar8 = puVar9 + -1; + if (lVar15 != 0) { + puVar8 = puVar9; + } + *puVar8 = 0; + } + else { + local_848[0] = 0; + } + } + } StringCchCopyW(local_a48,0xff,(ushort *)L"PDN"); local_c4c = local_c4c & 0xff0000ff; LogTSLSTelemetryEvent(1,4,0,&local_c58); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2d, - &WPP_faa09bd14f8e3ff8339c8037ab73ee9b_Traceguids,L"CTsCalPDNewLicenseReqCtx::Process" + WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x2e, + &WPP_2c136ed4139530b91c84ccbda3a05d3c_Traceguids,L"CTsCalPDNewLicenseReqCtx::Process" ); } return iVar4; } ``` ## TLSRpcKeyPackEnumBegin ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.9| |i_ratio|0.63| |m_ratio|1.0| |b_ratio|0.99| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|TLSRpcKeyPackEnumBegin|TLSRpcKeyPackEnumBegin| |fullname|TLSRpcKeyPackEnumBegin|TLSRpcKeyPackEnumBegin| |refcount|3|3| |`length`|356|358| |called|KERNEL32.DLL::GetLastError
KERNEL32.DLL::SetLastError
TLSDBLicenseKeyPackEnumBegin
TLSMapReturnCode
WPP_SF_S|KERNEL32.DLL::GetLastError
KERNEL32.DLL::SetLastError
TLSDBLicenseKeyPackEnumBegin
TLSMapReturnCode
WPP_SF_S| |calling||| |paramcount|5|5| |`address`|180009370|180009900| |sig|undefined8 __fastcall TLSRpcKeyPackEnumBegin(undefined8 * param_1, uint param_2, uint param_3, longlong param_4, int * param_5)|undefined8 __fastcall TLSRpcKeyPackEnumBegin(undefined8 * param_1, uint param_2, uint param_3, longlong param_4, int * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TLSRpcKeyPackEnumBegin Diff ```diff --- TLSRpcKeyPackEnumBegin +++ TLSRpcKeyPackEnumBegin @@ -1,62 +1,62 @@ undefined8 TLSRpcKeyPackEnumBegin(undefined8 *param_1,uint param_2,uint param_3,longlong param_4,int *param_5) { DWORD DVar1; int iVar2; undefined8 uVar3; longlong *plVar4; DVar1 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7a, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,L"TLSRpcKeyPackEnumBegin"); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x81, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcKeyPackEnumBegin"); } if ((param_1 == (undefined8 *)0x0) || (param_5 == (int *)0x0)) { uVar3 = 0x57; } else if ((*(byte *)((longlong)param_1 + 0xc) & 3) == 0) { *param_5 = 0x138b; uVar3 = 5; } else { LOCK(); *(int *)(param_1 + 1) = *(int *)(param_1 + 1) + 1; UNLOCK(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7b, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,(wchar_t *)*param_1); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x82, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,(wchar_t *)*param_1); } if (*(int *)((longlong)param_1 + 0x14) == 0) { plVar4 = TLSDBLicenseKeyPackEnumBegin(param_3,param_2,param_4); if (plVar4 == (longlong *)0x0) { DVar1 = GetLastError(); } else { *(undefined4 *)((longlong)param_1 + 0x14) = 1; param_1[3] = plVar4; } } else { DVar1 = 0xc001001e; SetLastError(0xc001001e); } *(DWORD *)(param_1 + 2) = DVar1; LOCK(); *(int *)(param_1 + 1) = *(int *)(param_1 + 1) + -1; UNLOCK(); iVar2 = TLSMapReturnCode(DVar1); *param_5 = iVar2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x7c, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,L"TLSRpcKeyPackEnumBegin"); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x83, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcKeyPackEnumBegin"); } uVar3 = 0; } return uVar3; } ``` ## TLSRpcChallengeServer ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.52| |i_ratio|0.33| |m_ratio|0.97| |b_ratio|0.79| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|TLSRpcChallengeServer|TLSRpcChallengeServer| |fullname|TLSRpcChallengeServer|TLSRpcChallengeServer| |refcount|3|3| |`length`|879|926| |`called`|
Expand for full list:
ADVAPI32.DLL::CryptAcquireContextW
ADVAPI32.DLL::CryptGenRandom
ADVAPI32.DLL::CryptReleaseContext
HashChallengeData
KERNEL32.DLL::GetLastError
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
TLSGenerateRandomChallengeData
TLSMapReturnCode
WPP_SF_S
memcpy
|
Expand for full list:
ADVAPI32.DLL::CryptAcquireContextW
ADVAPI32.DLL::CryptGenRandom
ADVAPI32.DLL::CryptReleaseContext
EvaluateCurrentState
HashChallengeData
KERNEL32.DLL::GetLastError
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
TLSGenerateRandomChallengeData
TLSMapReturnCode
WPP_SF_Smemcpy
| |calling||| |paramcount|6|6| |`address`|18000ce60|18000d3f0| |sig|undefined8 __fastcall TLSRpcChallengeServer(undefined8 * param_1, ulong param_2, int * param_3, undefined8 * param_4, longlong * param_5, int * param_6)|undefined8 __fastcall TLSRpcChallengeServer(undefined8 * param_1, ulong param_2, int * param_3, undefined8 * param_4, longlong * param_5, int * param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TLSRpcChallengeServer Called Diff ```diff --- TLSRpcChallengeServer called +++ TLSRpcChallengeServer called @@ -3,0 +4 @@ +EvaluateCurrentState ``` ### TLSRpcChallengeServer Diff ```diff --- TLSRpcChallengeServer +++ TLSRpcChallengeServer @@ -1,139 +1,148 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ undefined8 TLSRpcChallengeServer (undefined8 *param_1,ulong param_2,int *param_3,undefined8 *param_4,longlong *param_5, int *param_6) { uint *pbBuffer; uint *puVar1; DWORD DVar2; ulong uVar3; BOOL BVar4; int iVar5; - HLOCAL hMem; - undefined4 *hMem_00; + undefined4 *hMem; HLOCAL pvVar6; + HLOCAL hMem_00; HCRYPTPROV local_res8; ulong local_res10; uchar *in_stack_ffffffffffffffa0; ulong in_stack_ffffffffffffffa8; local_res10 = param_2; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd1, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,L"TLSRpcChallengeServer"); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd8, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcChallengeServer"); } if ((param_1 == (undefined8 *)0x0) || (param_6 == (int *)0x0)) { return 0x57; } - hMem_00 = (undefined4 *)0x0; - hMem = (HLOCAL)0x0; + hMem = (undefined4 *)0x0; + hMem_00 = (HLOCAL)0x0; local_res8 = 0; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((WPP_GLOBAL_Control[0x1c] & 0x20) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd2, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,(wchar_t *)*param_1); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd9, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,(wchar_t *)*param_1); } LOCK(); *(int *)(param_1 + 1) = *(int *)(param_1 + 1) + 1; UNLOCK(); if (*(int *)((longlong)param_1 + 0x14) != 0) { DVar2 = 0xc001001e; goto LAB_0; } if (((param_3 == (int *)0x0) || (param_4 == (undefined8 *)0x0)) || (param_5 == (longlong *)0x0)) { DVar2 = 0xc0010020; + goto LAB_1; + } + if (((*param_3 != 0x10000) || (param_3[2] == 0)) || (*(longlong *)(param_3 + 4) == 0)) { + DVar2 = 0xc0010020; + goto LAB_0; + } + hMem_00 = LocalAlloc(0x40,0x20); + if ((hMem_00 == (HLOCAL)0x0) || (hMem = LocalAlloc(0x40,0x28), hMem == (undefined4 *)0x0)) { +LAB_2: + DVar2 = GetLastError(); LAB_1: if (DVar2 == 0) goto LAB_0; } else { - if (((*param_3 != 0x10000) || (param_3[2] == 0)) || (*(longlong *)(param_3 + 4) == 0)) { - DVar2 = 0xc0010020; - goto LAB_0; - } - hMem = LocalAlloc(0x40,0x20); - if ((hMem == (HLOCAL)0x0) || (hMem_00 = LocalAlloc(0x40,0x28), hMem_00 == (undefined4 *)0x0)) { -LAB_2: - DVar2 = GetLastError(); - goto LAB_1; - } pvVar6 = LocalAlloc(0x40,0x28); *param_5 = (longlong)pvVar6; if (pvVar6 == (HLOCAL)0x0) goto LAB_2; uVar3 = HashChallengeData(_g_RdlsCryptProv,param_2,param_3[1],*(uchar **)(param_3 + 4), param_3[2],in_stack_ffffffffffffffa0,in_stack_ffffffffffffffa8, - (uchar **)((longlong)hMem + 8),(ulong *)((longlong)hMem + 4)); - *param_4 = hMem; + (uchar **)((longlong)hMem_00 + 8),(ulong *)((longlong)hMem_00 + 4)); + iVar5 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1434286394_50463179_FeatureDescriptorDetails); + if (iVar5 == 0) { + *param_4 = hMem_00; + } if (uVar3 == 0) { - *hMem_00 = 0x10000; + *hMem = 0x10000; BVar4 = CryptAcquireContextW (&local_res8,(LPCWSTR)0x0,L"Microsoft Strong Cryptographic Provider",1, 0xf0000000); - if (BVar4 != 0) { - pbBuffer = hMem_00 + 1; - BVar4 = CryptGenRandom(local_res8,4,(BYTE *)pbBuffer); - if (BVar4 != 0) { - puVar1 = hMem_00 + 2; - *pbBuffer = (*pbBuffer & 0x1f) + 1; - DVar2 = TLSGenerateRandomChallengeData - (_g_RdlsCryptProv,(undefined8 *)(hMem_00 + 4),puVar1); - *(uint *)((longlong)param_1 + 0x14) = 7 - (uint)(local_res10 != 2); - pvVar6 = LocalAlloc(0x40,(ulonglong)*puVar1); - *(HLOCAL *)(*param_5 + 0x10) = pvVar6; - if (*(longlong *)((undefined4 *)*param_5 + 4) != 0) { - *(undefined4 *)*param_5 = 0x10000; - *(uint *)(*param_5 + 4) = *pbBuffer; - *(uint *)(*param_5 + 8) = *puVar1; - memcpy(*(void **)(*param_5 + 0x10),*(void **)(hMem_00 + 4),(ulonglong)*puVar1); - param_1[3] = hMem_00; - goto LAB_1; - } - goto LAB_2; - } + if (BVar4 == 0) { +LAB_3: + DVar2 = 0x1000; + goto LAB_4; } - DVar2 = 0x1000; + pbBuffer = hMem + 1; + BVar4 = CryptGenRandom(local_res8,4,(BYTE *)pbBuffer); + if (BVar4 == 0) goto LAB_3; + puVar1 = hMem + 2; + *pbBuffer = (*pbBuffer & 0x1f) + 1; + DVar2 = TLSGenerateRandomChallengeData(_g_RdlsCryptProv,(undefined8 *)(hMem + 4),puVar1); + *(uint *)((longlong)param_1 + 0x14) = 7 - (uint)(local_res10 != 2); + pvVar6 = LocalAlloc(0x40,(ulonglong)*puVar1); + *(HLOCAL *)(*param_5 + 0x10) = pvVar6; + if (*(longlong *)((undefined4 *)*param_5 + 4) == 0) goto LAB_2; + *(undefined4 *)*param_5 = 0x10000; + *(uint *)(*param_5 + 4) = *pbBuffer; + *(uint *)(*param_5 + 8) = *puVar1; + memcpy(*(void **)(*param_5 + 0x10),*(void **)(hMem + 4),(ulonglong)*puVar1); + param_1[3] = hMem; + iVar5 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1434286394_50463179_FeatureDescriptorDetails); + if (iVar5 != 0) { + if (DVar2 != 0) goto LAB_4; + *param_4 = hMem_00; + } + goto LAB_1; } - else { - DVar2 = 0xc0010020; + DVar2 = 0xc0010020; + } +LAB_4: + if (hMem != (undefined4 *)0x0) { + if (*(HLOCAL *)(hMem + 4) != (HLOCAL)0x0) { + LocalFree(*(HLOCAL *)(hMem + 4)); } + if (*(HLOCAL *)(hMem + 8) != (HLOCAL)0x0) { + LocalFree(*(HLOCAL *)(hMem + 8)); + } + LocalFree(hMem); } - if (hMem_00 != (undefined4 *)0x0) { - if (*(HLOCAL *)(hMem_00 + 4) != (HLOCAL)0x0) { - LocalFree(*(HLOCAL *)(hMem_00 + 4)); + if (hMem_00 != (HLOCAL)0x0) { + if (*(HLOCAL *)((longlong)hMem_00 + 8) != (HLOCAL)0x0) { + LocalFree(*(HLOCAL *)((longlong)hMem_00 + 8)); } - if (*(HLOCAL *)(hMem_00 + 8) != (HLOCAL)0x0) { - LocalFree(*(HLOCAL *)(hMem_00 + 8)); + if (*(HLOCAL *)((longlong)hMem_00 + 0x18) != (HLOCAL)0x0) { + LocalFree(*(HLOCAL *)((longlong)hMem_00 + 0x18)); } LocalFree(hMem_00); - } - if (hMem != (HLOCAL)0x0) { - if (*(HLOCAL *)((longlong)hMem + 8) != (HLOCAL)0x0) { - LocalFree(*(HLOCAL *)((longlong)hMem + 8)); - } - if (*(HLOCAL *)((longlong)hMem + 0x18) != (HLOCAL)0x0) { - LocalFree(*(HLOCAL *)((longlong)hMem + 0x18)); - } - LocalFree(hMem); } LAB_0: if (local_res8 != 0) { CryptReleaseContext(local_res8,0); } *(DWORD *)(param_1 + 2) = DVar2; LOCK(); *(int *)(param_1 + 1) = *(int *)(param_1 + 1) + -1; UNLOCK(); iVar5 = TLSMapReturnCode(DVar2); *param_6 = iVar5; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xd3, - &WPP_4bdd7ac2d3a83bc416734f81a2a1a754_Traceguids,L"TLSRpcChallengeServer"); + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0xda, + &WPP_f0b6106f55cb3123459b8849552e5dd5_Traceguids,L"TLSRpcChallengeServer"); } return 0; } ``` ## CTsCalPUNewLicenseReqCtx::Process ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.21| |i_ratio|0.23| |m_ratio|0.79| |b_ratio|0.48| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|Process|Process| |fullname|CTsCalPUNewLicenseReqCtx::Process|CTsCalPUNewLicenseReqCtx::Process| |refcount|3|3| |`length`|1248|1929| |`called`|
Expand for full list:
KERNEL32.DLL::GetTickCount
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
LogSecurityErrorForLicenseIssue
SecureModeCheck
StringCbCopyW
StringCchCopyW
StringCchPrintfW
TLSMapReturnCode
TLSUpdateUserObject
WPP_SF_S
WPP_SF_SDDWPP_SF_SS
WPP_SF_SSSS
WPP_SF_SSd
WPP_SF_Sd
__security_check_cookie
memset
rc4
rc4_key
|
Expand for full list:
EvaluateCurrentState
KERNEL32.DLL::GetTickCount
LSTELEMETRY.DLL::LogTSLSTelemetryEvent
LogSecurityErrorForLicenseIssue
SecureModeCheck
StringCbCopyW
StringCchCopyW
StringCchPrintfW
TLSMapReturnCode
TLSUpdateUserObject
WPP_SF_SWPP_SF_SDD
WPP_SF_SS
WPP_SF_SSSS
WPP_SF_SSd
WPP_SF_Sd
__security_check_cookie
memset
rc4
rc4_key
| |calling||| |paramcount|1|1| |`address`|1800688e0|180069390| |sig|long __thiscall Process(CTsCalPUNewLicenseReqCtx * this)|long __thiscall Process(CTsCalPUNewLicenseReqCtx * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CTsCalPUNewLicenseReqCtx::Process Called Diff ```diff --- CTsCalPUNewLicenseReqCtx::Process called +++ CTsCalPUNewLicenseReqCtx::Process called @@ -0,0 +1 @@ +EvaluateCurrentState ``` ### CTsCalPUNewLicenseReqCtx::Process Diff ```diff --- CTsCalPUNewLicenseReqCtx::Process +++ CTsCalPUNewLicenseReqCtx::Process @@ -1,176 +1,276 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: virtual long __cdecl CTsCalPUNewLicenseReqCtx::Process(void) __ptr64 */ long __thiscall CTsCalPUNewLicenseReqCtx::Process(CTsCalPUNewLicenseReqCtx *this) { - ulonglong *puVar1; - uchar *puVar2; - ulong uVar3; - long lVar4; - int iVar5; - void **ppvVar6; - undefined2 uVar7; - int iVar8; - undefined8 uVar9; - ulong uVar11; - wchar_t *pwVar12; - uint *puVar13; - int *piVar14; - undefined1 auStackY_dc8 [32]; - ulonglong local_d78; - ulonglong uStack_d70; - undefined4 local_d68; + ushort uVar1; + ulonglong *puVar2; + uchar *puVar3; + int iVar4; + ulong uVar5; + long lVar6; + int iVar7; + ushort *puVar8; + void **ppvVar9; + uint *puVar10; + ushort *puVar11; + undefined2 uVar12; + int iVar13; + ulong uVar14; + wchar_t *pwVar15; + ulonglong uVar16; + undefined8 uVar17; + longlong lVar18; + int *piVar19; + undefined1 auStackY_ee8 [32]; + ulonglong local_e98; + ulonglong uStack_e90; + undefined4 local_e88; + ulonglong local_e80; + ulonglong uStack_e78; + undefined4 local_e70; + char local_e68 [264]; char local_d60 [264]; uint local_c58; uint local_c54; ushort local_c48 [256]; ushort local_a48 [256]; ushort local_848 [512]; - int local_448; + long local_448; ushort local_444 [518]; ulonglong local_38; - undefined8 uVar10; - local_38 = __security_cookie ^ (ulonglong)auStackY_dc8; + local_38 = __security_cookie ^ (ulonglong)auStackY_ee8; if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x10, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process"); + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process"); } GetTickCount(); - uVar11 = 0xc14; - uVar10 = 0; - iVar8 = 0; - uVar9 = 0; - lVar4 = 0; + iVar7 = 0; + uVar14 = 0xc14; + iVar13 = 0; memset(&local_c58,0,0xc14); - if (*(longlong *)(this + 8) == 0) { + iVar4 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1299020091_50464141_FeatureDescriptorDetails); + if (iVar4 == 0) { +LAB_0: + if (*(longlong *)(this + 8) == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x14, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + lVar6 = -0x7ff8ffa9; + *(undefined4 *)(this + 0x14) = 0x57; + StringCchPrintfW(local_444,0xff,(ushort *)L"Invalid lpContext. HR = %x",0x80070057); + goto LAB_1; + } + LOCK(); + piVar19 = (int *)(*(longlong *)(this + 8) + 8); + *piVar19 = *piVar19 + 1; + UNLOCK(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process" - ); - } - lVar4 = -0x7ff8ffa9; - *(undefined4 *)(this + 0x14) = 0x57; - StringCchPrintfW(local_444,0xff,(ushort *)L"Invalid lpContext. HR = %x",0x80070057); - goto LAB_0; - } - LOCK(); - piVar14 = (int *)(*(longlong *)(this + 8) + 8); - *piVar14 = *piVar14 + 1; - UNLOCK(); - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - uVar11 = 0x800ba4e0; - WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x12, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process", - (wchar_t *)**(undefined8 **)(this + 8)); - } - if (((*(longlong *)(this + 0x18) == 0) || (*(longlong *)(this + 0x20) == 0)) || - (*(longlong *)(this + 0x70) == 0)) { - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x13, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process" - ); - } - uVar9 = 0xc0010020; - pwVar12 = L"Invalid Data. Status = %x"; -LAB_1: - StringCchPrintfW(local_444,0xff,(ushort *)pwVar12,uVar9); - } - else { - uVar3 = SecureModeCheck(); - if (uVar3 != 0) { - ppvVar6 = (void **)WPP_GLOBAL_Control; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - ppvVar6 = *(void ***)(WPP_GLOBAL_Control + 0x10); - WPP_SF_S(ppvVar6,0x14,&WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids, - L"CTsCalPUNewLicenseReqCtx::Process"); - } - LogSecurityErrorForLicenseIssue(ppvVar6); - pwVar12 = L"SecureModeCheck Access Denied. Status = %x"; - uVar9 = 0xc001001f; - goto LAB_1; + uVar14 = 0x800bb750; + WPP_SF_SS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x15, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process",(wchar_t *)**(undefined8 **)(this + 8)); + } + if (((*(longlong *)(this + 0x18) == 0) || (*(longlong *)(this + 0x20) == 0)) || + (*(longlong *)(this + 0x70) == 0)) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x16, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + pwVar15 = L"Invalid Data. Status = %x"; + goto LAB_2; + } + uVar5 = SecureModeCheck(); + if (uVar5 != 0) { + ppvVar9 = (void **)WPP_GLOBAL_Control; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + ppvVar9 = *(void ***)(WPP_GLOBAL_Control + 0x10); + WPP_SF_S(ppvVar9,0x17,&WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + LogSecurityErrorForLicenseIssue(ppvVar9); + iVar4 = -0x3ffeffe1; + pwVar15 = L"SecureModeCheck Access Denied. Status = %x"; + uVar17 = 0xc001001f; + goto LAB_3; } if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { WPP_SF_SSSS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10)); } - lVar4 = TLSUpdateUserObject(*(int *)(this + 0x50),(CTsCalLicenseBlob *)(this + 0x28),uVar11, + lVar6 = TLSUpdateUserObject(*(int *)(this + 0x50),(CTsCalLicenseBlob *)(this + 0x28),uVar14, (CTsCalLicenseBlobOut *)(this + 0x40),*(ushort **)(this + 0x60), *(ushort **)(this + 0x68),*(_TLSLicenseRequest **)(this + 0x20), *(ushort **)(this + 0x58),(_RDLSTelemetryData *)&local_c58); - if (lVar4 < 0) { - uVar9 = uVar10; - if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && - ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - uVar7 = 0x16; -LAB_2: - WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids, + iVar7 = iVar13; + if (lVar6 < 0) { + iVar7 = 0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + (iVar7 = iVar13, (*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + uVar12 = 0x19; +LAB_4: + WPP_SF_Sd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar12, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, L"CTsCalPUNewLicenseReqCtx::Process"); - uVar9 = uVar10; + iVar7 = iVar13; } } else if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - uVar7 = 0x17; - goto LAB_2; - } - } - iVar8 = (int)uVar9; - *(int *)(*(longlong *)(this + 8) + 0x10) = iVar8; + uVar12 = 0x1a; + goto LAB_4; + } + } + else { + lVar18 = *(longlong *)(this + 0x20); + if (lVar18 == 0) { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x11, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + pwVar15 = L"Invalid input. Status = %x"; + } + else if ((*(int *)(lVar18 + 0x28) - 2U < 0x1fd) && (*(longlong *)(lVar18 + 0x30) != 0)) { + if ((*(int *)(lVar18 + 0x1c) - 2U < 0x1fd) && (*(longlong *)(lVar18 + 0x20) != 0)) + goto LAB_0; + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x13, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + pwVar15 = L"Invalid company name. Status = %x"; + } + else { + if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && + ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { + WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x12, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, + L"CTsCalPUNewLicenseReqCtx::Process"); + } + pwVar15 = L"Invalid product id. Status = %x"; + } +LAB_2: + uVar17 = 0xc0010020; + iVar4 = -0x3ffeffe0; +LAB_3: + StringCchPrintfW(local_444,0xff,(ushort *)pwVar15,uVar17); + lVar6 = iVar7; + iVar7 = iVar4; + } + *(int *)(*(longlong *)(this + 8) + 0x10) = iVar7; LOCK(); *(int *)(*(longlong *)(this + 8) + 8) = *(int *)(*(longlong *)(this + 8) + 8) + -1; UNLOCK(); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { GetTickCount(); - WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x18, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids, + WPP_SF_SSd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1b, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids, (wchar_t *)**(undefined8 **)(this + 8),L"CTsCalPUNewLicenseReqCtx::Process"); } - piVar14 = *(int **)(this + 0x70); - if (piVar14 != (int *)0x0) { - iVar5 = TLSMapReturnCode(iVar8); - *piVar14 = iVar5; - } -LAB_0: - puVar2 = g_pbSecretKey; - puVar13 = *(uint **)(this + 0x20); - local_448 = lVar4; - if (lVar4 == 0) { - local_448 = iVar8; - } - puVar1 = *(ulonglong **)(puVar13 + 2); - if ((((puVar1 != (ulonglong *)0x0) && (0x13 < *puVar13)) && (g_cbSecretKey == 0x10)) && - (g_pbSecretKey != (uchar *)0x0)) { - uVar9 = 0; - memset(local_d60,0,0x108); - rc4_key(local_d60,uVar9,(longlong)puVar2); - local_d78 = *puVar1; - uStack_d70 = puVar1[1]; - local_d68 = (undefined4)puVar1[2]; - rc4((longlong)local_d60,0x14,(longlong)&local_d78); - StringCchPrintfW(local_c48,0xff,(ushort *)L"%x-%x-%x-%x-%x",local_d78 & 0xffffffff); - puVar13 = *(uint **)(this + 0x20); - } - local_c58 = puVar13[5]; - local_c54 = puVar13[6]; - StringCbCopyW(local_848,(ulonglong)puVar13[10],*(ushort **)(puVar13 + 0xc)); + piVar19 = *(int **)(this + 0x70); + if (piVar19 != (int *)0x0) { + iVar4 = TLSMapReturnCode(iVar7); + *piVar19 = iVar4; + } +LAB_1: + local_448 = lVar6; + if (lVar6 == 0) { + local_448 = iVar7; + } + iVar7 = EvaluateCurrentState + ((reg_FeatureDescriptor *)&g_Feature_256205112_50630493_FeatureDescriptorDetails + ); + puVar3 = g_pbSecretKey; + if (iVar7 == 0) { + puVar10 = *(uint **)(this + 0x20); + puVar2 = *(ulonglong **)(puVar10 + 2); + if ((((puVar2 != (ulonglong *)0x0) && (0x13 < *puVar10)) && (g_cbSecretKey == 0x10)) && + (g_pbSecretKey != (uchar *)0x0)) { + uVar17 = 0; + memset(local_d60,0,0x108); + rc4_key(local_d60,uVar17,(longlong)puVar3); + local_e80 = *puVar2; + uStack_e78 = puVar2[1]; + local_e70 = (undefined4)puVar2[2]; + rc4((longlong)local_d60,0x14,(longlong)&local_e80); + StringCchPrintfW(local_c48,0xff,(ushort *)L"%x-%x-%x-%x-%x",local_e80 & 0xffffffff); + puVar10 = *(uint **)(this + 0x20); + } + local_c58 = puVar10[5]; + local_c54 = puVar10[6]; + StringCbCopyW(local_848,(ulonglong)puVar10[10],*(ushort **)(puVar10 + 0xc)); + } + else { + puVar10 = *(uint **)(this + 0x20); + if (puVar10 != (uint *)0x0) { + puVar2 = *(ulonglong **)(puVar10 + 2); + if (((puVar2 != (ulonglong *)0x0) && (0x13 < *puVar10)) && + ((g_cbSecretKey == 0x10 && (g_pbSecretKey != (uchar *)0x0)))) { + uVar17 = 0; + memset(local_e68,0,0x108); + rc4_key(local_e68,uVar17,(longlong)puVar3); + local_e98 = *puVar2; + uStack_e90 = puVar2[1]; + local_e88 = (undefined4)puVar2[2]; + rc4((longlong)local_e68,0x14,(longlong)&local_e98); + StringCchPrintfW(local_c48,0xff,(ushort *)L"%x-%x-%x-%x-%x",local_e98 & 0xffffffff); + puVar10 = *(uint **)(this + 0x20); + } + local_c58 = puVar10[5]; + local_c54 = puVar10[6]; + pwVar15 = *(wchar_t **)(puVar10 + 0xc); + if ((ulonglong)(puVar10[10] >> 1) < 0x7fffffff) { + uVar16 = (ulonglong)(puVar10[10] >> 1); + if (pwVar15 == (wchar_t *)0x0) { + pwVar15 = L""; + uVar16 = 0; + } + lVar18 = 0x100; + puVar11 = local_848; + do { + if (((uVar16 - 0x100) + lVar18 == 0) || + (uVar1 = *(ushort *)((longlong)puVar11 + ((longlong)pwVar15 - (longlong)local_848)), + uVar1 == 0)) break; + *puVar11 = uVar1; + puVar11 = puVar11 + 1; + lVar18 = lVar18 + -1; + } while (lVar18 != 0); + puVar8 = puVar11 + -1; + if (lVar18 != 0) { + puVar8 = puVar11; + } + *puVar8 = 0; + } + else { + local_848[0] = 0; + } + } + } StringCchCopyW(local_a48,0xff,(ushort *)L"PUN"); LogTSLSTelemetryEvent(1,4,0,&local_c58); if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) && ((*(uint *)(WPP_GLOBAL_Control + 0x1c) & 0x1000) != 0)) { - WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x19, - &WPP_fedc93d6f95d3b7d906c67e87f8b3df9_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process" + WPP_SF_SDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x1c, + &WPP_4ff382af554a363b7c46670f2994fea1_Traceguids,L"CTsCalPUNewLicenseReqCtx::Process" ); } - return lVar4; + return lVar6; } ``` ## TLSDBTelephoneRegisterLicenseKeyPack ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.66| |i_ratio|0.51| |m_ratio|0.98| |b_ratio|0.82| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|TLSDBTelephoneRegisterLicenseKeyPack|TLSDBTelephoneRegisterLicenseKeyPack| |fullname|TLSDBTelephoneRegisterLicenseKeyPack|TLSDBTelephoneRegisterLicenseKeyPack| |refcount|3|3| |`length`|1629|1703| |`called`|
Expand for full list:
AcquirePolicyModule
B24DecodeMSID
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMRegisterLicensePack
CTLSPolicyMgr::TranslateCHCodeToTlsCode
EncryptDecryptData
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::GetSystemTime
KERNEL32.DLL::GetSystemTimeAsFileTime
KERNEL32.DLL::HeapFreeKERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetLastError
KERNEL32.DLL::SystemTimeToFileTime
LKPLiteVerifyLKP
MSVCRT.DLL::_wcsicmp
MSVCRT.DLL::gmtime
MSVCRT.DLL::mktime
MSVCRT.DLL::time
MSVCRT.DLL::wcscpy_s
StringCbCopyNW
StringCchPrintfW
TLSDBInstallKeyPack
TLSResetLogLowLicenseWarning
__chkstk
__security_check_cookie
memset
|
Expand for full list:
AcquirePolicyModule
B24DecodeMSID
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMRegisterLicensePack
CTLSPolicyMgr::TranslateCHCodeToTlsCode
EncryptDecryptData
EvaluateCurrentState
KERNEL32.DLL::GetLastError
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::GetSystemTime
KERNEL32.DLL::GetSystemTimeAsFileTimeKERNEL32.DLL::HeapFree
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree
KERNEL32.DLL::SetLastError
KERNEL32.DLL::SystemTimeToFileTime
LKPLiteVerifyLKP
MSVCRT.DLL::_wcsicmp
MSVCRT.DLL::gmtime
MSVCRT.DLL::mktime
MSVCRT.DLL::time
MSVCRT.DLL::wcscpy_s
StringCbCopyNW
StringCchPrintfW
TLSDBInstallKeyPack
TLSResetLogLowLicenseWarning
__chkstk
__security_check_cookie
memset
| |calling|TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx|TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx| |paramcount|5|5| |`address`|18003be10|18003c4b0| |sig|uint __fastcall TLSDBTelephoneRegisterLicenseKeyPack(undefined8 param_1, ushort * param_2, ushort * param_3, uint param_4, __LSKeyPack * param_5)|uint __fastcall TLSDBTelephoneRegisterLicenseKeyPack(undefined8 param_1, ushort * param_2, ushort * param_3, uint param_4, __LSKeyPack * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TLSDBTelephoneRegisterLicenseKeyPack Called Diff ```diff --- TLSDBTelephoneRegisterLicenseKeyPack called +++ TLSDBTelephoneRegisterLicenseKeyPack called @@ -6,0 +7 @@ +EvaluateCurrentState ``` ### TLSDBTelephoneRegisterLicenseKeyPack Diff ```diff --- TLSDBTelephoneRegisterLicenseKeyPack +++ TLSDBTelephoneRegisterLicenseKeyPack @@ -1,264 +1,272 @@ /* WARNING: Function: __chkstk replaced with injection: alloca_probe */ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint TLSDBTelephoneRegisterLicenseKeyPack (undefined8 param_1,ushort *param_2,ushort *param_3,uint param_4,__LSKeyPack *param_5 ) { IRdlsDBConnection *pIVar1; uint uVar2; uint *lpMem; - DWORD DVar3; - ulong uVar4; - int iVar5; + int iVar3; + uint uVar4; + ulong uVar5; longlong lVar6; HANDLE hHeap; tm *ptVar7; time_t tVar8; CTLSPolicyMgr *this; - uint uVar9; CTLSPolicy *this_00; - ulonglong uVar10; - longlong lVar11; + ulonglong uVar9; + longlong lVar10; ushort *hMem; undefined1 auStackY_1a08 [32]; ushort local_19d8 [4]; undefined8 local_19d0; ulong local_19c8; ulong local_19c4; uint local_19c0; uint local_19bc; uint local_19b8; uint local_19b4; uint local_19b0; ulong local_19ac; - uint local_19a8; + ulonglong local_19a8; ulonglong local_19a0; ulonglong local_1998; - ulonglong local_1990; - void *local_1988; - uint *local_1980; - time_t local_1978; - ushort *local_1970; - __LSKeyPack *local_1968; - IRdlsDBConnection *local_1960; + void *local_1990; + uint *local_1988; + time_t local_1980; + ushort *local_1978; + __LSKeyPack *local_1970; + IRdlsDBConnection *local_1968; undefined4 local_1958; undefined4 local_1954; undefined4 local_1950; _FILETIME local_194c; _FILETIME local_1944; _FILETIME local_193c; undefined4 local_1934; undefined4 local_1930; wchar_t local_192c [256]; wchar_t local_172c [256]; _Tree,class_std::allocator_>,0>_> local_152c [512]; uint local_132c; undefined4 local_1328; undefined4 local_1324; undefined4 local_1310; ushort *local_1300; uint local_12f8; _SYSTEMTIME local_12e8; tm local_12d8; __PMLSKEYPACK local_12a8 [3168]; wchar_t local_648 [256]; wchar_t local_448 [256]; wchar_t local_248 [256]; ulonglong local_48; undefined8 uStack_40; pIVar1 = g_RdlsDBWorkSpace; - uStack_40 = 0x18003be32; + uStack_40 = 0x18003c4d2; local_48 = __security_cookie ^ (ulonglong)auStackY_1a08; - uVar10 = (ulonglong)param_4; - local_1968 = param_5; - local_1960 = g_RdlsDBWorkSpace; + local_1970 = param_5; + local_1968 = g_RdlsDBWorkSpace; + local_1990 = (void *)0x0; this_00 = (CTLSPolicy *)0x0; - local_1988 = (void *)0x0; + uVar9 = (ulonglong)param_4; hMem = (ushort *)0x0; - local_19a8 = param_4; - local_1970 = param_3; + local_1978 = param_3; memset(local_448,0,0x200); memset(local_248,0,0x200); + local_19ac = 0x100; local_19d8[0] = 0; - local_19ac = 0x100; if ((((pIVar1 == (IRdlsDBConnection *)0x0) || (param_2 == (ushort *)0x0)) || (param_3 == (ushort *)0x0)) || (param_4 == 0)) { - DVar3 = 0x57; + iVar3 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1932091707_50631810_FeatureDescriptorDetails); + if (iVar3 != 0) { + return 0xc0010020; + } + uVar4 = 0x57; goto LAB_0; } - hMem = LocalAlloc(0x40,uVar10 + 2); + iVar3 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1932091707_50631810_FeatureDescriptorDetails); + if ((iVar3 != 0) && ((param_5 == (__LSKeyPack *)0x0 || (param_4 < 2)))) { + return 0xc0010020; + } + hMem = LocalAlloc(0x40,uVar9 + 2); if (hMem == (ushort *)0x0) { return 0x1015; } - StringCbCopyNW(hMem,uVar10 + 2,param_3,uVar10); + StringCbCopyNW(hMem,uVar9 + 2,param_3,uVar9); local_19c8 = 2; - DVar3 = LKPLiteVerifyLKP(param_2,hMem,&local_19c8); - if ((DVar3 != 0) || (local_19c8 != 2)) { + uVar4 = LKPLiteVerifyLKP(param_2,hMem,&local_19c8); + if ((uVar4 != 0) || (local_19c8 != 2)) { if (local_19c8 == 1) { - DVar3 = 0xc0200004; + uVar4 = 0xc0200004; } else if (local_19c8 == 3) { - DVar3 = 0xc0200005; + uVar4 = 0xc0200005; } goto LAB_0; } - local_1980 = (uint *)0x0; + local_1988 = (uint *)0x0; local_19c4 = 0; local_19d0 = 0; local_648[0] = L'\0'; - uVar4 = B24DecodeMSID(hMem,(uchar **)&local_1980,&local_19c4); - lpMem = local_1980; - if (uVar4 == 0) { + uVar5 = B24DecodeMSID(hMem,(uchar **)&local_1988,&local_19c4); + lpMem = local_1988; + if (uVar5 == 0) { lVar6 = -1; do { lVar6 = lVar6 + 1; } while (param_2[lVar6] != 0); - uVar4 = EncryptDecryptData((uchar *)param_2,(int)lVar6 * 2,(uchar *)local_1980,local_19c4); - if (uVar4 != 0) goto LAB_1; + uVar5 = EncryptDecryptData((uchar *)param_2,(int)lVar6 * 2,(uchar *)local_1988,local_19c4); + if (uVar5 != 0) goto LAB_1; local_19d0 = CONCAT17(*(undefined1 *)((longlong)lpMem + 6), CONCAT25((short)lpMem[1],CONCAT41(*lpMem,(undefined1)local_19d0))); - local_1998 = (ulonglong)((uint)((longlong)local_19d0 >> 0x28) & 0x3fff); - lVar11 = (longlong)local_19d0 >> 0x1a; + local_19a0 = (ulonglong)((uint)((longlong)local_19d0 >> 0x28) & 0x3fff); + lVar10 = (longlong)local_19d0 >> 0x1a; lVar6 = (longlong)local_19d0 >> 0xb; - local_19a0 = (ulonglong)((uint)((longlong)local_19d0 >> 0x1c) & 0xfff); - local_1990 = (ulonglong)(*lpMem & 7); - uVar10 = (longlong)local_19d0 >> 0x12 & 0xff; - local_12e8._0_8_ = uVar10; + local_19a8 = (ulonglong)((uint)((longlong)local_19d0 >> 0x1c) & 0xfff); + local_1998 = (ulonglong)(*lpMem & 7); + local_12e8._0_8_ = (longlong)local_19d0 >> 0x12 & 0xff; StringCchPrintfW((ushort *)local_648,0x100,(ushort *)L"%03I64d",(longlong)local_19d0 >> 0x36); - local_19d0 = CONCAT44(local_19d0._4_4_,(int)local_1998); - local_19b0 = (uint)local_19a0; - local_19bc = (uint)local_1990; - local_19b4 = (uint)uVar10; - local_19c0 = (uint)lVar11 & 3; + local_19d0 = CONCAT44(local_19d0._4_4_,(int)local_19a0); + local_19b0 = (uint)local_19a8; + local_19b4 = local_12e8._0_4_; + local_19bc = (uint)local_1998; + local_19c0 = (uint)lVar10 & 3; local_19b8 = (uint)lVar6 & 0x7f; } else { LAB_1: - local_1990 = (ulonglong)local_19bc; + local_1998 = (ulonglong)local_19bc; local_12e8._0_8_ = ZEXT48(local_19b4); - local_19a0 = (ulonglong)local_19b0; - local_1998 = local_19d0 & 0xffffffff; + local_19a8 = (ulonglong)local_19b0; + local_19a0 = local_19d0 & 0xffffffff; } uVar2 = local_19b8; - uVar9 = local_19c0; + uVar4 = local_19c0; if (lpMem != (uint *)0x0) { hHeap = GetProcessHeap(); HeapFree(hHeap,0,lpMem); } - if (uVar4 == 0) { - iVar5 = _wcsicmp(local_648,L"007"); - if (iVar5 == 0) { + if (uVar5 == 0) { + iVar3 = _wcsicmp(local_648,L"007"); + if (iVar3 == 0) { wcscpy_s(local_648,0x100,L"005"); } this = (CTLSPolicyMgr *)local_648; - iVar5 = _wcsicmp((wchar_t *)this,L"008"); - if (iVar5 == 0) { + iVar3 = _wcsicmp((wchar_t *)this,L"008"); + if (iVar3 == 0) { this = (CTLSPolicyMgr *)local_648; wcscpy_s((wchar_t *)this,0x100,L"006"); } - iVar5 = CTLSPolicyMgr::TranslateCHCodeToTlsCode + iVar3 = CTLSPolicyMgr::TranslateCHCodeToTlsCode (this,(ushort *)L"Microsoft Corporation",(ushort *)local_648, (ushort *)local_448,(ushort *)local_248,&local_19ac); - if (iVar5 == 0) { + if (iVar3 == 0) { StringCbCopyNW((ushort *)local_448,0x200,(ushort *)local_648,0x200); StringCbCopyNW((ushort *)local_248,0x200,local_19d8,2); } this_00 = AcquirePolicyModule((CTLSPolicyMgr *)L"Microsoft Corporation",(ushort *)local_448,1); if (this_00 == (CTLSPolicy *)0x0) { - DVar3 = GetLastError(); + uVar4 = GetLastError(); } else { memset(&local_1958,0,0x668); local_1958 = 2; - if (uVar9 == 0) { + if (uVar4 == 0) { local_1954 = 1; } - else if (uVar9 == 1) { + else if (uVar4 == 1) { local_1954 = 2; } else { - if (uVar9 != 2) { - DVar3 = 0xc0010020; + if (uVar4 != 2) { + uVar4 = 0xc0010020; SetLastError(0xc0010020); goto LAB_0; } local_1954 = 3; } local_1950 = 2; GetSystemTimeAsFileTime(&local_194c); local_1944 = local_194c; - uVar9 = local_12e8._0_4_; - if (uVar9 < 0x90) { - local_1978 = time((time_t *)0x0); - ptVar7 = gmtime(&local_1978); + uVar4 = local_12e8._0_4_; + if (uVar4 < 0x90) { + local_1980 = time((time_t *)0x0); + ptVar7 = gmtime(&local_1980); local_12d8.tm_sec = ptVar7->tm_sec; local_12d8.tm_min = ptVar7->tm_min; local_12d8.tm_hour = ptVar7->tm_hour; local_12d8.tm_mday = ptVar7->tm_mday; local_12d8.tm_year = ptVar7->tm_year; local_12d8.tm_wday = ptVar7->tm_wday; local_12d8.tm_yday = ptVar7->tm_yday; local_12d8.tm_isdst = ptVar7->tm_isdst; - local_12d8.tm_mon = ptVar7->tm_mon + uVar9; + local_12d8.tm_mon = ptVar7->tm_mon + uVar4; tVar8 = mktime(&local_12d8); if (tVar8 != -1) { local_193c = (_FILETIME)(((longlong)(int)tVar8 + 0x2b6109100) * 10000000); } } else { GetSystemTime(&local_12e8); local_12e8._0_4_ = 0x107f6; local_12e8.wDay = 1; SystemTimeToFileTime(&local_12e8,&local_193c); } - local_1310 = (undefined4)local_19a0; - local_1930 = (undefined4)local_1998; - uVar9 = 0; + local_1310 = (undefined4)local_19a8; + local_1930 = (undefined4)local_19a0; + uVar4 = 0; local_1934 = 0; wcscpy_s(local_192c,0x100,local_448); wcscpy_s(local_172c,0x100,local_248); wcscpy_s((wchar_t *)local_152c,0x100,L"Microsoft Corporation"); if (uVar2 == 1) { local_132c = 0x50000; } else { if ((uVar2 >> 3 != 6) || (((byte)uVar2 & 7) != 1)) { - uVar9 = uVar2 & 7; + uVar4 = uVar2 & 7; } - local_132c = uVar9 | (uVar2 >> 3) << 0x10; - } - local_1328 = (undefined4)local_1990; - local_1300 = local_1970; - local_12f8 = local_19a8; + local_132c = uVar4 | (uVar2 >> 3) << 0x10; + } + local_1328 = (undefined4)local_1998; + local_1300 = local_1978; local_1324 = 0; - DVar3 = CTLSPolicy::PMGenerateClientId(this_00,&local_1988); - if (((DVar3 == 0) && - (DVar3 = CTLSPolicy::PMRegisterLicensePack(this_00,local_1988,1,&local_1958,local_12a8), - DVar3 == 0)) && - (DVar3 = TLSDBInstallKeyPack(local_1960,local_12a8,local_1968), DVar3 == 0)) { + local_12f8 = param_4; + uVar4 = CTLSPolicy::PMGenerateClientId(this_00,&local_1990); + if (((uVar4 == 0) && + (uVar4 = CTLSPolicy::PMRegisterLicensePack(this_00,local_1990,1,&local_1958,local_12a8), + uVar4 == 0)) && + (uVar4 = TLSDBInstallKeyPack(local_1968,local_12a8,local_1970), uVar4 == 0)) { TLSResetLogLowLicenseWarning(local_152c); } } } else { - DVar3 = 0xc0120001; + uVar4 = 0xc0120001; this_00 = (CTLSPolicy *)0x0; } LAB_0: if (hMem != (ushort *)0x0) { LocalFree(hMem); } - if ((this_00 != (CTLSPolicy *)0x0) && (local_1988 != (void *)0x0)) { - CTLSPolicy::PMRegisterLicensePack(this_00,local_1988,2,(void *)(ulonglong)DVar3,(void *)0x0); + if ((this_00 != (CTLSPolicy *)0x0) && (local_1990 != (void *)0x0)) { + CTLSPolicy::PMRegisterLicensePack(this_00,local_1990,2,(void *)(ulonglong)uVar4,(void *)0x0); LOCK(); *(int *)this_00 = *(int *)this_00 + -1; UNLOCK(); } - return DVar3; + return uVar4; } ``` ## UnpackHydraServerCertificate ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.32| |i_ratio|0.61| |m_ratio|0.93| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|UnpackHydraServerCertificate|UnpackHydraServerCertificate| |fullname|UnpackHydraServerCertificate|UnpackHydraServerCertificate| |refcount|2|2| |`length`|428|488| |`called`|free
malloc
memcpy
memset|EvaluateCurrentState
free
malloc
memcpy
memset| |calling|TLSVerifyHydraCertificate|TLSVerifyHydraCertificate| |paramcount|3|3| |`address`|180059d94|18005a504| |`sig`|undefined8 __fastcall UnpackHydraServerCertificate(undefined4 * param_1, int param_2, undefined4 * param_3)|undefined8 __fastcall UnpackHydraServerCertificate(undefined4 * param_1, uint param_2, undefined4 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### UnpackHydraServerCertificate Called Diff ```diff --- UnpackHydraServerCertificate called +++ UnpackHydraServerCertificate called @@ -0,0 +1 @@ +EvaluateCurrentState ``` ### UnpackHydraServerCertificate Diff ```diff --- UnpackHydraServerCertificate +++ UnpackHydraServerCertificate @@ -1,79 +1,94 @@ -undefined8 UnpackHydraServerCertificate(undefined4 *param_1,int param_2,undefined4 *param_3) +undefined8 UnpackHydraServerCertificate(undefined4 *param_1,uint param_2,undefined4 *param_3) { short sVar1; ushort uVar2; - void *pvVar3; - undefined8 uVar4; - int iVar5; + int iVar3; + void *pvVar4; + uint uVar5; + undefined8 uVar6; short *_Src; ulonglong _Size; if (((param_1 != (undefined4 *)0x0) && (param_3 != (undefined4 *)0x0)) && (param_2 != 0)) { - *param_3 = *param_1; - if (((-1 < param_2 + -4) && (param_3[1] = param_1[1], -1 < param_2 + -8)) && - (param_3[2] = param_1[2], -1 < param_2 + -0xc)) { - sVar1 = *(short *)(param_1 + 3); - *(short *)(param_3 + 3) = sVar1; - if ((-1 < param_2 + -0xe) && (sVar1 == 6)) { - uVar2 = *(ushort *)((longlong)param_1 + 0xe); - _Src = (short *)(param_1 + 4); - iVar5 = param_2 + -0x10; - *(ushort *)((longlong)param_3 + 0xe) = uVar2; - if (-1 < iVar5) { - if (uVar2 != 0) { - _Size = (ulonglong)uVar2; - pvVar3 = malloc(_Size); - *(void **)(param_3 + 4) = pvVar3; - if (pvVar3 != (void *)0x0) { - memset(pvVar3,0,_Size); - memcpy(pvVar3,_Src,_Size); - _Src = (short *)((longlong)_Src + _Size); - iVar5 = iVar5 - (uint)uVar2; - if (iVar5 < 0) goto LAB_0; - goto LAB_1; + iVar3 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_3058005305_50450227_FeatureDescriptorDetails); + if (iVar3 == 0) { +LAB_0: + *param_3 = *param_1; + if ((-1 < (int)(param_2 - 4)) && + ((param_3[1] = param_1[1], -1 < (int)(param_2 - 8) && + (param_3[2] = param_1[2], -1 < (int)(param_2 - 0xc))))) { + sVar1 = *(short *)(param_1 + 3); + *(short *)(param_3 + 3) = sVar1; + if ((-1 < (int)(param_2 - 0xe)) && (sVar1 == 6)) { + uVar2 = *(ushort *)((longlong)param_1 + 0xe); + _Src = (short *)(param_1 + 4); + iVar3 = param_2 - 0x10; + *(ushort *)((longlong)param_3 + 0xe) = uVar2; + if (-1 < iVar3) { + if (uVar2 != 0) { + _Size = (ulonglong)uVar2; + pvVar4 = malloc(_Size); + *(void **)(param_3 + 4) = pvVar4; + if (pvVar4 != (void *)0x0) { + memset(pvVar4,0,_Size); + memcpy(pvVar4,_Src,_Size); + _Src = (short *)((longlong)_Src + _Size); + iVar3 = iVar3 - (uint)uVar2; + if (iVar3 < 0) goto LAB_1; + goto LAB_2; + } +LAB_3: + uVar6 = 1; + goto LAB_4; } LAB_2: - uVar4 = 1; - goto LAB_3; - } -LAB_1: - sVar1 = *_Src; - *(short *)(param_3 + 6) = sVar1; - if ((-1 < iVar5 + -2) && (sVar1 == 8)) { - uVar2 = _Src[1]; - *(ushort *)((longlong)param_3 + 0x1a) = uVar2; - if (-1 < iVar5 + -4) { - if (uVar2 == 0) { - return 0; - } - pvVar3 = malloc((ulonglong)uVar2); - *(void **)(param_3 + 7) = pvVar3; - if (pvVar3 == (void *)0x0) goto LAB_2; - memset(pvVar3,0,(ulonglong)uVar2); - memcpy(pvVar3,_Src + 2,(ulonglong)uVar2); - if (-1 < (int)((iVar5 + -4) - (uint)uVar2)) { - return 0; + sVar1 = *_Src; + *(short *)(param_3 + 6) = sVar1; + if ((-1 < iVar3 + -2) && (sVar1 == 8)) { + uVar2 = _Src[1]; + *(ushort *)((longlong)param_3 + 0x1a) = uVar2; + if (-1 < iVar3 + -4) { + if (uVar2 == 0) { + return 0; + } + pvVar4 = malloc((ulonglong)uVar2); + *(void **)(param_3 + 7) = pvVar4; + if (pvVar4 == (void *)0x0) goto LAB_3; + memset(pvVar4,0,(ulonglong)uVar2); + memcpy(pvVar4,_Src + 2,(ulonglong)uVar2); + if (-1 < (int)((iVar3 + -4) - (uint)uVar2)) { + return 0; + } } } } } } } + else if (1 < param_2 - 0xe) { + uVar5 = *(ushort *)((longlong)param_1 + 0xe) + 4; + if ((1 < (param_2 - 0xe) - uVar5) && + (*(ushort *)((longlong)param_1 + 0xe) + 0x14 + + (uint)*(ushort *)((ulonglong)uVar5 + 0xe + (longlong)param_1) <= param_2)) + goto LAB_0; + } } -LAB_0: - uVar4 = 3; -LAB_3: +LAB_1: + uVar6 = 3; +LAB_4: if (*(void **)(param_3 + 4) != (void *)0x0) { free(*(void **)(param_3 + 4)); *(undefined8 *)(param_3 + 4) = 0; } if (*(void **)(param_3 + 7) != (void *)0x0) { free(*(void **)(param_3 + 7)); *(undefined8 *)(param_3 + 7) = 0; } memset(param_3,0,0x24); - return uVar4; + return uVar6; } ``` ## HashChallengeData ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.41| |i_ratio|0.37| |m_ratio|0.93| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|HashChallengeData|HashChallengeData| |fullname|HashChallengeData|HashChallengeData| |refcount|4|4| |`length`|398|454| |`called`|ADVAPI32.DLL::CryptCreateHash
ADVAPI32.DLL::CryptDestroyHash
ADVAPI32.DLL::CryptGetHashParam
ADVAPI32.DLL::CryptHashData
KERNEL32.DLL::GetLastError
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree|ADVAPI32.DLL::CryptCreateHash
ADVAPI32.DLL::CryptDestroyHash
ADVAPI32.DLL::CryptGetHashParam
ADVAPI32.DLL::CryptHashData
EvaluateCurrentState
KERNEL32.DLL::GetLastError
KERNEL32.DLL::LocalAlloc
KERNEL32.DLL::LocalFree| |calling|TLSEstablishTrustWithServer
TLSRpcChallengeServer
TLSVerifyChallengeResponse|TLSEstablishTrustWithServer
TLSRpcChallengeServer
TLSVerifyChallengeResponse| |paramcount|9|9| |`address`|18005588c|180055f7c| |sig|ulong __cdecl HashChallengeData(__uint64 param_1, ulong param_2, ulong param_3, uchar * param_4, ulong param_5, uchar * param_6, ulong param_7, uchar * * param_8, ulong * param_9)|ulong __cdecl HashChallengeData(__uint64 param_1, ulong param_2, ulong param_3, uchar * param_4, ulong param_5, uchar * param_6, ulong param_7, uchar * * param_8, ulong * param_9)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### HashChallengeData Called Diff ```diff --- HashChallengeData called +++ HashChallengeData called @@ -4,0 +5 @@ +EvaluateCurrentState ``` ### HashChallengeData Diff ```diff --- HashChallengeData +++ HashChallengeData @@ -1,58 +1,68 @@ /* unsigned long __cdecl HashChallengeData(unsigned __int64,unsigned long,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64) */ ulong __cdecl HashChallengeData(__uint64 param_1,ulong param_2,ulong param_3,uchar *param_4,ulong param_5, uchar *param_6,ulong param_7,uchar **param_8,ulong *param_9) { - BOOL BVar1; - DWORD DVar2; + int iVar1; + BOOL BVar2; + DWORD DVar3; + DWORD DVar4; BYTE *pbData; wchar_t *pbData_00; - DWORD DVar3; - DVar3 = 0; param_6 = (uchar *)0x0; + DVar4 = 0; param_7 = 0; pbData = (BYTE *)0x0; - BVar1 = CryptCreateHash(param_1,0x8003,0,0,(HCRYPTHASH *)¶m_6); - if ((BVar1 != 0) && (BVar1 = CryptHashData((HCRYPTHASH)param_6,param_4,param_3,0), BVar1 != 0)) { - pbData_00 = L"d46b4bf2-686d-11d2-96ae-00c04fa3080d"; - if (param_2 != 2) { - pbData_00 = L"d63a773e-6799-11d2-96ae-00c04fa3080d"; + iVar1 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1434286394_50463179_FeatureDescriptorDetails); + if ((iVar1 == 0) || + ((((param_1 != 0 && (param_4 != (uchar *)0x0)) && (param_5 - 1 < 0x40)) && (param_3 <= param_5) + ))) { + BVar2 = CryptCreateHash(param_1,0x8003,0,0,(HCRYPTHASH *)¶m_6); + if ((BVar2 != 0) && (BVar2 = CryptHashData((HCRYPTHASH)param_6,param_4,param_3,0), BVar2 != 0)) + { + pbData_00 = L"d46b4bf2-686d-11d2-96ae-00c04fa3080d"; + if (param_2 != 2) { + pbData_00 = L"d63a773e-6799-11d2-96ae-00c04fa3080d"; + } + BVar2 = CryptHashData((HCRYPTHASH)param_6,(BYTE *)pbData_00,0x48,0); + if (BVar2 != 0) { + if (param_5 < param_3) goto LAB_0; + BVar2 = CryptHashData((HCRYPTHASH)param_6,param_4 + param_3,param_5 - param_3,0); + pbData = (BYTE *)0x0; + if ((((BVar2 != 0) && + ((BVar2 = CryptGetHashParam((HCRYPTHASH)param_6,2,(BYTE *)0x0,¶m_7,0), BVar2 != 0 + || (DVar3 = GetLastError(), DVar3 == 0xea)))) && + (pbData = LocalAlloc(0x40,(ulonglong)param_7), pbData != (BYTE *)0x0)) && + (BVar2 = CryptGetHashParam((HCRYPTHASH)param_6,2,pbData,¶m_7,0), BVar2 != 0)) + goto LAB_1; + } } - BVar1 = CryptHashData((HCRYPTHASH)param_6,(BYTE *)pbData_00,0x48,0); - if (BVar1 != 0) { - if (param_5 < param_3) { - DVar3 = 0x57; - goto LAB_0; - } - BVar1 = CryptHashData((HCRYPTHASH)param_6,param_4 + param_3,param_5 - param_3,0); - pbData = (BYTE *)0x0; - if (((BVar1 != 0) && - (((BVar1 = CryptGetHashParam((HCRYPTHASH)param_6,2,(BYTE *)0x0,¶m_7,0), BVar1 != 0 || - (DVar2 = GetLastError(), DVar2 == 0xea)) && - (pbData = LocalAlloc(0x40,(ulonglong)param_7), pbData != (BYTE *)0x0)))) && - (BVar1 = CryptGetHashParam((HCRYPTHASH)param_6,2,pbData,¶m_7,0), BVar1 != 0)) - goto LAB_0; - } + DVar4 = GetLastError(); } - DVar3 = GetLastError(); + else { LAB_0: + DVar4 = 0x57; + } +LAB_1: if (param_6 != (uchar *)0x0) { CryptDestroyHash((HCRYPTHASH)param_6); } - if (DVar3 == 0) { + if (DVar4 == 0) { *param_8 = pbData; pbData = (BYTE *)0x0; *param_9 = param_7; } if (pbData != (BYTE *)0x0) { LocalFree(pbData); } - return DVar3; + return DVar4; } ``` ## CDataCoding::DecodeData ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.4| |i_ratio|0.24| |m_ratio|0.9| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|DecodeData|DecodeData| |fullname|CDataCoding::DecodeData|CDataCoding::DecodeData| |refcount|2|2| |`length`|284|361| |`called`|KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::HeapFree
memset
wcschr|EvaluateCurrentState
KERNEL32.DLL::GetProcessHeap
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::HeapFree
memset
wcschr| |calling|B24DecodeMSID|B24DecodeMSID| |paramcount|4|4| |`address`|180057db0|1800584d8| |sig|ulong __thiscall DecodeData(CDataCoding * this, ushort * param_1, uchar * * param_2, ulong * param_3)|ulong __thiscall DecodeData(CDataCoding * this, ushort * param_1, uchar * * param_2, ulong * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CDataCoding::DecodeData Called Diff ```diff --- CDataCoding::DecodeData called +++ CDataCoding::DecodeData called @@ -0,0 +1 @@ +EvaluateCurrentState ``` ### CDataCoding::DecodeData Diff ```diff --- CDataCoding::DecodeData +++ CDataCoding::DecodeData @@ -1,65 +1,75 @@ /* public: unsigned long __cdecl CDataCoding::DecodeData(unsigned short const * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64 */ ulong __thiscall CDataCoding::DecodeData(CDataCoding *this,ushort *param_1,uchar **param_2,ulong *param_3) { uint uVar1; - HANDLE pvVar2; + int iVar2; + HANDLE pvVar3; byte *_Dst; - wchar_t *pwVar3; - uint uVar4; - ulonglong uVar5; - byte *pbVar6; - ulonglong uVar7; - ulong uVar8; - ulonglong uVar9; + wchar_t *pwVar4; + uint uVar5; + ulonglong uVar6; + uint uVar7; + ulong uVar9; + byte *pbVar10; + ulonglong uVar8; - uVar1 = DAT_0; - uVar7 = 0; - uVar8 = 0; + uVar5 = DAT_0; + uVar9 = 0; + uVar1 = 0; if (param_2 == (uchar **)0x0) { - uVar8 = 0x57; + uVar9 = 0x57; } else { *param_2 = (uchar *)0x0; *param_3 = 0; - pvVar2 = GetProcessHeap(); - _Dst = HeapAlloc(pvVar2,8,(ulonglong)uVar1); + pvVar3 = GetProcessHeap(); + _Dst = HeapAlloc(pvVar3,8,(ulonglong)uVar5); if (_Dst == (byte *)0x0) { - uVar8 = 8; + uVar9 = 8; } else { memset(_Dst,0,(ulonglong)DAT_0); for (; *param_1 != L'\0'; param_1 = param_1 + 1) { - pwVar3 = wcschr((wchar_t *)PTR_u_BCDFGHJKMPQRTVWXY2346789_1800e6240,*param_1); - if (pwVar3 == (wchar_t *)0x0) { - pvVar2 = GetProcessHeap(); - HeapFree(pvVar2,0,_Dst); + pwVar4 = wcschr((wchar_t *)PTR_u_BCDFGHJKMPQRTVWXY2346789_1800e7240,*param_1); + if (pwVar4 == (wchar_t *)0x0) { +LAB_1: + pvVar3 = GetProcessHeap(); + HeapFree(pvVar3,0,_Dst); return 0xd; } - uVar1 = (int)uVar7 + 1; - uVar5 = (longlong)pwVar3 - (longlong)PTR_u_BCDFGHJKMPQRTVWXY2346789_1800e6240 >> 1; - uVar9 = (ulonglong)uVar1; - pbVar6 = _Dst; + uVar6 = (longlong)pwVar4 - (longlong)PTR_u_BCDFGHJKMPQRTVWXY2346789_1800e7240 >> 1; + uVar8 = 0; + pbVar10 = _Dst; do { - uVar4 = (int)uVar5 + (uint)*pbVar6 * DAT_1; - *pbVar6 = (byte)uVar4; - pbVar6 = pbVar6 + 1; - uVar5 = (ulonglong)(uVar4 >> 8); - uVar9 = uVar9 - 1; - } while (uVar9 != 0); - if (uVar4 >> 8 != 0) { - _Dst[uVar1] = (byte)(uVar4 >> 8); - uVar7 = (ulonglong)uVar1; + iVar2 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1932091707_50631810_FeatureDescriptorDetails); + if ((iVar2 != 0) && (DAT_0 <= (uint)uVar8)) goto LAB_180058626; + uVar7 = (uint)uVar8 + 1; + uVar8 = (ulonglong)uVar7; + uVar5 = (int)uVar6 + (uint)*pbVar10 * DAT_2; + *pbVar10 = (byte)uVar5; + pbVar10 = pbVar10 + 1; + uVar6 = (ulonglong)(uVar5 >> 8); + } while (uVar7 <= uVar1); + if (uVar5 >> 8 != 0) { + iVar2 = EvaluateCurrentState + ((reg_FeatureDescriptor *) + &g_Feature_1932091707_50631810_FeatureDescriptorDetails); + if ((iVar2 != 0) && (DAT_0 <= uVar7)) goto LAB_180058626; + _Dst[uVar8] = (byte)(uVar5 >> 8); + uVar1 = uVar7; } } *param_3 = DAT_0; *param_2 = _Dst; } } - return uVar8; + return uVar9; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## StringCchPrintfW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|StringCchPrintfW|StringCchPrintfW| |fullname|StringCchPrintfW|StringCchPrintfW| |`refcount`|136|141| |length|119|119| |called|MSVCRT.DLL::_vsnwprintf|MSVCRT.DLL::_vsnwprintf| |`calling`|
Expand for full list:
ADHasLicensingAttrs
AddFailedLicensesToReport
AddHeaderToReport
AddLicensesToReport
AddSuccessFullPerUserLicensesToReport
COdbcStatement::ExecuteProcedure
CTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::ProcessCTsCalPUNewLicenseReqCtx::Process
CreateUniqueReportFile
DeleteFilesInDirectory
DumpLSKeyPack
DumpLicensedClient
DumpLicensedProduct
FetchReportBegin
FileTimeText
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
GetLicenseSettingsObjectP
GetMachineFQDN
IsLocalDomain
KeypackLib_LogErrorEvent
LicenseTimeToDate
LogEventFailure
LogEventSuccess
LogFailedPUIssuanceInDB
LogReportingEvents
LogSuccessFullPUIssuanceInDB
ReportDelete
ReportEnumBegin
ReportEnumNext
ReportGenerateBegin
ServiceStart
SetSecurityDescriptorOnNamedPipe
TLSDBTelephoneRegisterLicenseKeyPack
TLSGeneratePid
TLSLicenseRevoke
TLSRpcCanLSUpdateAD
TLSUpdateUserObject
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsGenerateLSDBBackupFileName
UpdateProductIDs
UpdateUserLicenseAttributes
queryUser
queryUserADsPath
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
|
Expand for full list:
ADHasLicensingAttrs
AddFailedLicensesToReport
AddHeaderToReport
AddLicensesToReport
AddSuccessFullPerUserLicensesToReport
COdbcStatement::ExecuteProcedure
CTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::ProcessCTsCalPUNewLicenseReqCtx::Process
CreateUniqueReportFile
DeleteFilesInDirectory
DumpLSKeyPack
DumpLicensedClient
DumpLicensedProduct
EvaluateCurrentStateFromRegistry
FetchReportBegin
FileTimeText
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
GetLicenseSettingsObjectP
GetMachineFQDN
IsLocalDomain
KeypackLib_LogErrorEvent
LicenseTimeToDate
LogEventFailure
LogEventSuccess
LogFailedPUIssuanceInDB
LogReportingEvents
LogSuccessFullPUIssuanceInDB
ReportDelete
ReportEnumBegin
ReportEnumNext
ReportGenerateBegin
ServiceStart
SetSecurityDescriptorOnNamedPipe
TLSDBTelephoneRegisterLicenseKeyPack
TLSGeneratePid
TLSLicenseRevoke
TLSRpcCanLSUpdateAD
TLSUpdateUserObject
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsGenerateLSDBBackupFileName
UpdateProductIDs
UpdateUserLicenseAttributes
queryUser
queryUserADsPath
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
| |paramcount|3|3| |`address`|180012120|1800126e0| |sig|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)|long __cdecl StringCchPrintfW(ushort * param_1, __uint64 param_2, ushort * param_3, ...)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### StringCchPrintfW Calling Diff ```diff --- StringCchPrintfW calling +++ StringCchPrintfW calling @@ -17,0 +18 @@ +EvaluateCurrentStateFromRegistry ``` ## RPCRT4.DLL::RpcStringBindingParseW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RpcStringBindingParseW|RpcStringBindingParseW| |fullname|RPCRT4.DLL::RpcStringBindingParseW|RPCRT4.DLL::RpcStringBindingParseW| |`refcount`|3|4| |length|0|0| |called||| |`calling`|LogLicenseUnavailableEvent
LogSecurityErrorForLicenseIssue|LogLicenseUnavailableEvent
LogSecurityErrorForLicenseIssue
TLSRpcSecurityCallback| |paramcount|6|6| |`address`|EXTERNAL:000000e6|EXTERNAL:000000e5| |sig|RPC_STATUS __stdcall RpcStringBindingParseW(RPC_WSTR StringBinding, RPC_WSTR * ObjUuid, RPC_WSTR * Protseq, RPC_WSTR * NetworkAddr, RPC_WSTR * Endpoint, RPC_WSTR * NetworkOptions)|RPC_STATUS __stdcall RpcStringBindingParseW(RPC_WSTR StringBinding, RPC_WSTR * ObjUuid, RPC_WSTR * Protseq, RPC_WSTR * NetworkAddr, RPC_WSTR * Endpoint, RPC_WSTR * NetworkOptions)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### RPCRT4.DLL::RpcStringBindingParseW Calling Diff ```diff --- RPCRT4.DLL::RpcStringBindingParseW calling +++ RPCRT4.DLL::RpcStringBindingParseW calling @@ -2,0 +3 @@ +TLSRpcSecurityCallback ``` ## No_P_Err ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.67| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|No_P_Err|No_P_Err| |fullname|LRFMap::No_P_Err|LRFMap::No_P_Err| |`refcount`|46|36| |length|14|14| |called||| |calling||| |paramcount|1|1| |`address`|1800643a0|180064b50| |sig|void __cdecl No_P_Err(ICALUpgOps * param_1)|void __cdecl No_P_Err(ICALUpgOps * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## KERNEL32.DLL::WaitForSingleObject ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|WaitForSingleObject|WaitForSingleObject| |fullname|KERNEL32.DLL::WaitForSingleObject|KERNEL32.DLL::WaitForSingleObject| |`refcount`|81|82| |length|0|0| |called||| |calling|
Expand for full list:
COdbcExecutionContext::CreateInstance
CTLSPolicyMgr::AcquireProductPolicyModule
CTLSPolicyMgr::InitProductPolicyModule
CTLSPolicyMgr::InsertProductPolicyModule
CTLSPolicyMgr::LoadPolicyModule
CTLSPolicyMgr::TranslateCHCodeToTlsCode
CTLSPolicyMgr::~CTLSPolicyMgr
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJobCTLServerMgr::AddServerToList
CTLServerMgr::LookupByServerName
CTLServerMgr::LookupBySetupId
CTSScpRegister::RegisterSCP
CTSScpRegister::StaticSCPWorkerThread
CTSScpRegister::Terminate
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CWorkManager::AddJobIntoMemoryQueue
CWorkManager::GetNumberJobInMemoryQueue
CWorkManager::GetTimeToNextJob
CWorkManager::ProcessInMemoryScheduledJob
CWorkManager::ProcessInStorageScheduledJob
CWorkManager::ScheduleJob
CWorkManager::Shutdown
CWorkManager::WorkManagerThread
ExpirePermanentThread
IsServiceShuttingdown
ServerEnumCallBack
ServiceStart
TLSBeginEnumKnownServerList
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
`dynamic_atexit_destructor_for_'g_ServerMgr''
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
|
Expand for full list:
COdbcExecutionContext::CreateInstance
CTLSPolicyMgr::AcquireProductPolicyModule
CTLSPolicyMgr::InitProductPolicyModule
CTLSPolicyMgr::InsertProductPolicyModule
CTLSPolicyMgr::LoadPolicyModule
CTLSPolicyMgr::TranslateCHCodeToTlsCode
CTLSPolicyMgr::~CTLSPolicyMgr
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJobCTLServerMgr::AddServerToList
CTLServerMgr::LookupByServerName
CTLServerMgr::LookupBySetupId
CTSScpRegister::RegisterSCP
CTSScpRegister::StaticSCPWorkerThread
CTSScpRegister::Terminate
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CWorkManager::AddJobIntoMemoryQueue
CWorkManager::GetNumberJobInMemoryQueue
CWorkManager::GetTimeToNextJob
CWorkManager::ProcessInMemoryScheduledJob
CWorkManager::ProcessInStorageScheduledJob
CWorkManager::ScheduleJob
CWorkManager::Shutdown
CWorkManager::WorkManagerThread
ExpirePermanentThread
IsServiceShuttingdown
ServerEnumCallBack
ServiceStart
TLSBeginEnumKnownServerList
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
`dynamic_atexit_destructor_for_'g_ServerMgr''
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
| |paramcount|2|2| |`address`|EXTERNAL:0000016d|EXTERNAL:00000171| |sig|DWORD __stdcall WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds)|DWORD __stdcall WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## StringCchCopyW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.82| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|StringCchCopyW|StringCchCopyW| |fullname|StringCchCopyW|StringCchCopyW| |`refcount`|208|207| |length|130|130| |called||| |calling|
Expand for full list:
AddFailedLicensesToReport
AddOtherPULKPs
CConversion::SetConvertibleStatus
CConversion::SetDestLKPDesc
CConversion::SetLKPAttribs
COdbcConnection::ReadConnString
COdbcStatement::BindPropertyTVPParameter
CRdlsDBJet::CreateInstance
CRdlsDBManager::ReadDatabasePaths
CRdlsDBSQL::CRdlsDBSQL
CTLSPolicyMgr::InsertProductPolicyModuleCTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTLSWorkObject::ExecuteJob
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
ConvertKeyPackToLsKeyPack
ConvertLicenseToLSLicense
ConvertLicenseToLSLicenseEx
ConvertLsKeyPackToKeyPack
CopyDbLicensedProduct
CreateUniqueReportFile
DBFindLostLicensePU
DecodeLicense20
DeleteLicensesToDomain
DeleteUserLicenses
FetchReportCALInfoNext
FetchReportFailedPUSummaryEntries
FetchReportNext
FetchReportNext_PD
FileTimeText
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
GetCALType
GetDestID
GetDomainandUsersInfo
GetLicenseSettingsObjectP
GetProductDescFromPid
IsLocalDomain
IsMachineNameInTSCGrp
JBDatabase::CreateDatabase
JBDatabase::OpenDatabase
JBTable::OpenTable
LicensedProductToDbLicensedProduct
LogFailedPUIssuanceInDB
LogLicenseUnavailableEvent
LogSuccessFullPUIssuanceInDB
MergeFirstOverUsedWithUnderUsedLKPs
MergeNewOverIssuedWithExistingOverUsedLKP
MergeNewUnderIssuedLKPWithOverUsedLKP
MoveLicensesANDDeleteBuiltInPULKP
RdCentralDbUtils::GetDbConnectionStringWithPassword
RdCentralDbUtils::ReplacePasswordInDbConnectionString
ReportEnumNext
TLSAddTermServCertificatePack
TLSAnnounceLKPToAllRemoteServer
TLSDBIssueLicense
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBIssuePermanentLicense
TLSDBIssueTemporaryLicense
TLSDBReissueFoundPermanentLicense
TLSDBReissueFoundTemporaryLicense
TLSFormDBRequest
TLSGeneratePid
TLSLicenseRevoke
TLSLogRemoveLicenseEvent
TLSLookupServerById
TLSPostReturnClientLicenseJob
TLSPushSyncLocalLkpToServer
TLSRpcAllocateInternetLicenseEx
TLSRpcConnect
TLSRpcDatabasePath
TLSRpcGetLastError
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcGetServerScope
TLSRpcGetServerScopeFixed
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRetrieveTermServCert
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSStartAnnounceLicenseServerJob
TLSStartAnnounceResponseJob
TLSStartAnnounceToEServerJob
TLSUpdateUserObject
UpdateProductIDs
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
queryUser
updatePUCalAvailMap
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
|
Expand for full list:
AddFailedLicensesToReport
AddOtherPULKPs
CConversion::SetConvertibleStatus
CConversion::SetDestLKPDesc
CConversion::SetLKPAttribs
COdbcConnection::ReadConnString
COdbcStatement::BindPropertyTVPParameter
CRdlsDBJet::CreateInstance
CRdlsDBManager::ReadDatabasePaths
CRdlsDBSQL::CRdlsDBSQL
CTLSPolicyMgr::InsertProductPolicyModuleCTLSWorkObject::GetJobDescription
CTLSWorkObject::GetJobDescription
CTLSWorkObject::ExecuteJob
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
ConvertKeyPackToLsKeyPack
ConvertLicenseToLSLicense
ConvertLicenseToLSLicenseEx
ConvertLsKeyPackToKeyPack
CopyDbLicensedProduct
CreateUniqueReportFile
DBFindLostLicensePU
DecodeLicense20
DeleteLicensesToDomain
DeleteUserLicenses
FetchReportCALInfoNext
FetchReportFailedPUSummaryEntries
FetchReportNext
FetchReportNext_PD
FileTimeText
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
GetCALType
GetDestID
GetDomainandUsersInfo
GetLicenseSettingsObjectP
GetProductDescFromPid
IsLocalDomain
IsMachineNameInTSCGrp
JBDatabase::CreateDatabase
JBDatabase::OpenDatabase
JBTable::OpenTable
LicensedProductToDbLicensedProduct
LogFailedPUIssuanceInDB
LogLicenseUnavailableEvent
LogSuccessFullPUIssuanceInDB
MergeFirstOverUsedWithUnderUsedLKPs
MergeNewOverIssuedWithExistingOverUsedLKP
MergeNewUnderIssuedLKPWithOverUsedLKP
MoveLicensesANDDeleteBuiltInPULKP
RdCentralDbUtils::GetDbConnectionStringWithPassword
RdCentralDbUtils::ReplacePasswordInDbConnectionString
ReportEnumNext
TLSAddTermServCertificatePack
TLSAnnounceLKPToAllRemoteServer
TLSDBIssueLicense
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBIssuePermanentLicense
TLSDBIssueTemporaryLicense
TLSDBReissueFoundPermanentLicense
TLSDBReissueFoundTemporaryLicense
TLSFormDBRequest
TLSGeneratePid
TLSLicenseRevoke
TLSLogRemoveLicenseEvent
TLSLookupServerById
TLSPostReturnClientLicenseJob
TLSPushSyncLocalLkpToServer
TLSRpcAllocateInternetLicenseEx
TLSRpcConnect
TLSRpcDatabasePath
TLSRpcGetLastError
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcGetServerScope
TLSRpcGetServerScopeFixed
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRetrieveTermServCert
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSStartAnnounceLicenseServerJob
TLSStartAnnounceResponseJob
TLSStartAnnounceToEServerJob
TLSUpdateUserObject
UpdateProductIDs
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
queryUser
updatePUCalAvailMap
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
| |paramcount|3|3| |`address`|180012098|180012658| |sig|long __cdecl StringCchCopyW(ushort * param_1, __uint64 param_2, ushort * param_3)|long __cdecl StringCchCopyW(ushort * param_1, __uint64 param_2, ushort * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## ADVAPI32.DLL::RegGetValueW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RegGetValueW|RegGetValueW| |fullname|ADVAPI32.DLL::RegGetValueW|ADVAPI32.DLL::RegGetValueW| |`refcount`|3|4| |length|0|0| |called||| |`calling`|ExpireInDays
TestModeCheck|ExpireInDays
RPCServiceStartThread
TestModeCheck| |paramcount|7|7| |`address`|EXTERNAL:00000198|EXTERNAL:0000019d| |sig|LSTATUS __stdcall RegGetValueW(HKEY hkey, LPCWSTR lpSubKey, LPCWSTR lpValue, DWORD dwFlags, LPDWORD pdwType, PVOID pvData, LPDWORD pcbData)|LSTATUS __stdcall RegGetValueW(HKEY hkey, LPCWSTR lpSubKey, LPCWSTR lpValue, DWORD dwFlags, LPDWORD pdwType, PVOID pvData, LPDWORD pcbData)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegGetValueW Calling Diff ```diff --- ADVAPI32.DLL::RegGetValueW calling +++ ADVAPI32.DLL::RegGetValueW calling @@ -1,0 +2 @@ +RPCServiceStartThread ``` ## NC ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.67| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|NC|NC| |fullname|LRFMap::NC|LRFMap::NC| |`refcount`|22|12| |length|14|14| |called||| |calling||| |paramcount|1|1| |`address`|180064380|180064b30| |sig|void __cdecl NC(ICALUpgOps * param_1)|void __cdecl NC(ICALUpgOps * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## rc4 ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.91| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|rc4|rc4| |fullname|rc4|rc4| |`refcount`|7|8| |length|85|85| |called||| |calling|CTsCalPUNewLicenseReqCtx::Process
EncryptDecryptData
LicenseDecryptHwid
TLSEncryptBase64EncodeHWID
TLSReturnClientLicensedProduct
TLSRpcRetrieveTermServCert|CTsCalPUNewLicenseReqCtx::Process
EncryptDecryptData
LicenseDecryptHwid
TLSEncryptBase64EncodeHWID
TLSReturnClientLicensedProduct
TLSRpcRetrieveTermServCert| |paramcount|3|3| |`address`|18009be50|18009cbb0| |sig|undefined __fastcall rc4(longlong param_1, uint param_2, longlong param_3)|undefined __fastcall rc4(longlong param_1, uint param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## ADVAPI32.DLL::RegQueryValueExW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RegQueryValueExW|RegQueryValueExW| |fullname|ADVAPI32.DLL::RegQueryValueExW|ADVAPI32.DLL::RegQueryValueExW| |`refcount`|62|63| |length|0|0| |called||| |`calling`|
Expand for full list:
COdbcEnvironment::ReadConnPoolingProperty
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::Initialize
CRdlsDBManager::ReadDatabasePaths
CTSRegEntry::GetNumber
CTSRegEntry::GetString
DeleteExpiredTemporaryLicenses
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
MsRdlsDBFactory::GetSQLDBInstance
RdCentralDbUtils::DecryptCredsDataRdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
ReadRegDWORD
RetrieveKey
ServiceLoadPolicyModule
TLSLoadRuntimeParameters
TLSReadRegistryValue
|
Expand for full list:
COdbcEnvironment::ReadConnPoolingProperty
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::Initialize
CRdlsDBManager::ReadDatabasePaths
CTSRegEntry::GetNumber
CTSRegEntry::GetString
DeleteExpiredTemporaryLicenses
EvaluateCurrentStateFromRegistry
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
MsRdlsDBFactory::GetSQLDBInstanceRdCentralDbUtils::DecryptCredsData
RdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
ReadRegDWORD
RetrieveKey
ServiceLoadPolicyModule
TLSLoadRuntimeParameters
TLSReadRegistryValue
| |paramcount|6|6| |`address`|EXTERNAL:000001a0|EXTERNAL:0000019b| |sig|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegQueryValueExW Calling Diff ```diff --- ADVAPI32.DLL::RegQueryValueExW calling +++ ADVAPI32.DLL::RegQueryValueExW calling @@ -7,0 +8 @@ +EvaluateCurrentStateFromRegistry ``` ## __GSHandlerCheck ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|215|217| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18009bb20|18009c880| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## RPCRT4.DLL::RpcBindingToStringBindingW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RpcBindingToStringBindingW|RpcBindingToStringBindingW| |fullname|RPCRT4.DLL::RpcBindingToStringBindingW|RPCRT4.DLL::RpcBindingToStringBindingW| |`refcount`|4|5| |length|0|0| |called||| |`calling`|LogLicenseUnavailableEvent
LogSecurityErrorForLicenseIssue
TLSRpcConnect|LogLicenseUnavailableEvent
LogSecurityErrorForLicenseIssue
TLSRpcConnect
TLSRpcSecurityCallback| |paramcount|2|2| |`address`|EXTERNAL:000000e5|EXTERNAL:000000e4| |sig|RPC_STATUS __stdcall RpcBindingToStringBindingW(RPC_BINDING_HANDLE Binding, RPC_WSTR * StringBinding)|RPC_STATUS __stdcall RpcBindingToStringBindingW(RPC_BINDING_HANDLE Binding, RPC_WSTR * StringBinding)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### RPCRT4.DLL::RpcBindingToStringBindingW Calling Diff ```diff --- RPCRT4.DLL::RpcBindingToStringBindingW calling +++ RPCRT4.DLL::RpcBindingToStringBindingW calling @@ -3,0 +4 @@ +TLSRpcSecurityCallback ``` ## RPCRT4.DLL::RpcStringFreeW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RpcStringFreeW|RpcStringFreeW| |fullname|RPCRT4.DLL::RpcStringFreeW|RPCRT4.DLL::RpcStringFreeW| |`refcount`|5|7| |length|0|0| |called||| |`calling`|LogLicenseUnavailableEvent
ServerShutdown
TLSRpcConnect|LogLicenseUnavailableEvent
ServerShutdown
TLSRpcConnect
TLSRpcSecurityCallback| |paramcount|1|1| |`address`|EXTERNAL:000000ec|EXTERNAL:000000fe| |sig|RPC_STATUS __stdcall RpcStringFreeW(RPC_WSTR * String)|RPC_STATUS __stdcall RpcStringFreeW(RPC_WSTR * String)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### RPCRT4.DLL::RpcStringFreeW Calling Diff ```diff --- RPCRT4.DLL::RpcStringFreeW calling +++ RPCRT4.DLL::RpcStringFreeW calling @@ -3,0 +4 @@ +TLSRpcSecurityCallback ``` ## ADVAPI32.DLL::RegCloseKey ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RegCloseKey|RegCloseKey| |fullname|ADVAPI32.DLL::RegCloseKey|ADVAPI32.DLL::RegCloseKey| |`refcount`|38|39| |length|0|0| |called||| |`calling`|
Expand for full list:
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::PerformPostRdlsDBInit
CTSRegEntry::~CTSRegEntry
DeleteExpiredTemporaryLicenses
ExpireInDays
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
RdCentralDbUtils::DecryptCredsData
RdlsSecretsRegCache::CopyRegistryKeyRecursively
RdlsSecretsRegCache::DeleteRegistryKeyRecursively
RdlsSecretsRegCache::IsCertStoreExistsRdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
RdlsSecretsRegCache::RdlsCertOpenStore
RdlsSecretsRegCache::SaveCHRootCertToStore
RdlsSecretsRegCache::SaveCHX509CertsToStore
RdlsSecretsRegCache::StoreCHEndorsedRdlsCertificates
RdlsSecretsRegCache::UninstallCHX509Certs
RdlsSecretsRegCache::`vector_deleting_destructor'
ReadRegDWORD
RetrieveKey
SaveScpGUIDToRegistry
ServiceLoadAllPolicyModule
StoreKey
TLSDBInstallKeyPack
TLSLoadRuntimeParameters
TLSReadRegistryValue
TLSRpcChangeRole
TestModeCheck
VerifyCertValidity
VerifyCertificateChain
|
Expand for full list:
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::PerformPostRdlsDBInit
CTSRegEntry::~CTSRegEntry
DeleteExpiredTemporaryLicenses
EvaluateCurrentStateFromRegistry
ExpireInDays
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
RdCentralDbUtils::DecryptCredsData
RdlsSecretsRegCache::CopyRegistryKeyRecursively
RdlsSecretsRegCache::DeleteRegistryKeyRecursivelyRdlsSecretsRegCache::IsCertStoreExists
RdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
RdlsSecretsRegCache::RdlsCertOpenStore
RdlsSecretsRegCache::SaveCHRootCertToStore
RdlsSecretsRegCache::SaveCHX509CertsToStore
RdlsSecretsRegCache::StoreCHEndorsedRdlsCertificates
RdlsSecretsRegCache::UninstallCHX509Certs
RdlsSecretsRegCache::`vector_deleting_destructor'
ReadRegDWORD
RetrieveKey
SaveScpGUIDToRegistry
ServiceLoadAllPolicyModule
StoreKey
TLSDBInstallKeyPack
TLSLoadRuntimeParameters
TLSReadRegistryValue
TLSRpcChangeRole
TestModeCheck
VerifyCertValidity
VerifyCertificateChain
| |paramcount|1|1| |`address`|EXTERNAL:00000199|EXTERNAL:0000019c| |sig|LSTATUS __stdcall RegCloseKey(HKEY hKey)|LSTATUS __stdcall RegCloseKey(HKEY hKey)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegCloseKey Calling Diff ```diff --- ADVAPI32.DLL::RegCloseKey calling +++ ADVAPI32.DLL::RegCloseKey calling @@ -4,0 +5 @@ +EvaluateCurrentStateFromRegistry ``` ## WPP_SF_Sd ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|WPP_SF_Sd|WPP_SF_Sd| |fullname|WPP_SF_Sd|WPP_SF_Sd| |`refcount`|101|104| |length|118|118| |called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |`calling`|
Expand for full list:
AddAceToAcl
CPersistentWorkStorage::AddJob
CPersistentWorkStorage::EndProcessingJob
CTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::GetScpAttributes
CTSScpRegister::Initialize
CTSScpRegister::IsSCPRegistered
CTSScpRegister::RegisterSCP
CTSScpRegister::StaticSCPWorkerThread
CTSScpRegister::TryRegisterSCP
CTSScpRegister::TryUnRegisterSCPCTSScpRegister::TryUpdateScpAttributes
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDNewLicenseReqCtx::Validate
CTsCalPDRevokeLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Validate
CTsCalPUNewLicenseReqCtx::Process
CTsCalPerDeviceProvider::CreateHandler
CTsCalPerDeviceRevokeLicenseHandler::HandleRequest
CTsCalPerUserNewLicenseHandler::HandleRequest
CTsCalPerUserProvider::CreateHandler
CWorkManager::ScheduleJob
CreateAcesForScpObject
CreateScpAce
DecodeLicenseKeyPack
DecodeLicenseKeyPackEx
ExecuteGCSearch
GetCertVerificationResult
GetDomainMachineNameOnDC
GetEnvelopedData
GetGCSearchPointer
GetLocalComputerObject
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
HandleDiscovery
KeyPackDecryptData
LogLicenseUnavailableEvent
PostServiceInit
RdlsJetDBConnection::LogOpenTableFailedEvent
SaveScpGUIDToRegistry
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBReturnLicense
TLSNewLicenseRequest
TLSRpcConvertLicenses
TLSRpcGetOSVersion
TLSRpcGetVersion
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcUnRegisterLicenses
TLSUpgradeLicenseRequestEx
UnpackEnvelopedData
VerifyAndGetLicenseKeyPack
VerifyCertificateChain
calUpgIssueLicense
processCalUpgResult
updateCalAvailMap
|
Expand for full list:
AddAceToAcl
CPersistentWorkStorage::AddJob
CPersistentWorkStorage::EndProcessingJob
CTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::GetScpAttributes
CTSScpRegister::Initialize
CTSScpRegister::IsSCPRegistered
CTSScpRegister::RegisterSCP
CTSScpRegister::StaticSCPWorkerThread
CTSScpRegister::TryRegisterSCP
CTSScpRegister::TryUnRegisterSCPCTSScpRegister::TryUpdateScpAttributes
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDNewLicenseReqCtx::Validate
CTsCalPDRevokeLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Validate
CTsCalPUNewLicenseReqCtx::Process
CTsCalPerDeviceProvider::CreateHandler
CTsCalPerDeviceRevokeLicenseHandler::HandleRequest
CTsCalPerUserNewLicenseHandler::HandleRequest
CTsCalPerUserProvider::CreateHandler
CWorkManager::ScheduleJob
CreateAcesForScpObject
CreateScpAce
DecodeLicenseKeyPack
DecodeLicenseKeyPackEx
ExecuteGCSearch
GetCertVerificationResult
GetDomainMachineNameOnDC
GetEnvelopedData
GetGCSearchPointer
GetLocalComputerObject
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
HandleDiscovery
KeyPackDecryptData
LogLicenseUnavailableEvent
PostServiceInit
RPCServiceStartThread
RdlsJetDBConnection::LogOpenTableFailedEvent
SaveScpGUIDToRegistry
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBReturnLicense
TLSNewLicenseRequest
TLSRpcConvertLicenses
TLSRpcGetOSVersion
TLSRpcGetVersion
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcSecurityCallback
TLSRpcUnRegisterLicenses
TLSUpgradeLicenseRequestEx
UnpackEnvelopedData
VerifyAndGetLicenseKeyPack
VerifyCertificateChain
calUpgIssueLicense
processCalUpgResult
updateCalAvailMap
| |paramcount|4|4| |address|180005d98|180005d98| |sig|undefined __fastcall WPP_SF_Sd(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)|undefined __fastcall WPP_SF_Sd(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_Sd Calling Diff ```diff --- WPP_SF_Sd calling +++ WPP_SF_Sd calling @@ -41,0 +42 @@ +RPCServiceStartThread @@ -51,0 +53 @@ +TLSRpcSecurityCallback ``` ## WPP_SF_SS ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.84| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|WPP_SF_SS|WPP_SF_SS| |fullname|WPP_SF_SS|WPP_SF_SS| |`refcount`|25|26| |length|175|175| |called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |`calling`|
Expand for full list:
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMInitProduct
CTLSPolicy::PMLicenseRequest
CTLSPolicy::PMLicenseUpgrade
CTLSPolicy::PMRegisterLicensePack
CTLSPolicy::PMReturnLicense
CTLSPolicyMgr::InitProductPolicyModule
CTLSWorkObject::ExecuteJob
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDRevokeLicenseReqCtx::ProcessCTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
ForwardNewLicenseRequest
ForwardUpgradeLicenseRequest
HandleDiscovery
IsIssuingLicenseServer
ServerEnumCallBack
TLSLicenseRevoke
TLSUpdateUserObject
updateCalAvailMap
|
Expand for full list:
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CTLSPolicy::PMGenerateClientId
CTLSPolicy::PMInitProduct
CTLSPolicy::PMLicenseRequest
CTLSPolicy::PMLicenseUpgrade
CTLSPolicy::PMRegisterLicensePack
CTLSPolicy::PMReturnLicense
CTLSPolicyMgr::InitProductPolicyModule
CTLSWorkObject::ExecuteJob
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDRevokeLicenseReqCtx::ProcessCTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
ForwardNewLicenseRequest
ForwardUpgradeLicenseRequest
HandleDiscovery
IsIssuingLicenseServer
ServerEnumCallBack
TLSLicenseRevoke
TLSRpcSecurityCallback
TLSUpdateUserObject
updateCalAvailMap
| |paramcount|5|5| |`address`|18001e044|180005f10| |sig|undefined __fastcall WPP_SF_SS(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4, wchar_t * param_5)|undefined __fastcall WPP_SF_SS(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4, wchar_t * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_SS Calling Diff ```diff --- WPP_SF_SS calling +++ WPP_SF_SS calling @@ -19,0 +20 @@ +TLSRpcSecurityCallback ``` ## __security_check_cookie ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|375|377| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
ADHasLicensingAttrs
A_SHAFinal
AddFailedLicensesToReport
AddHeaderToReport
AddLicensesToReport
AddOtherPULKPs
AddSuccessFullPerUserLicensesToReport
AllocateLicensesFromDB
BSafeEncPublic
CConversion::AddLicensesToDestination
CConversion::SetLKPAttribsCOdbcStatement::BindPropertyTVPParameter
COdbcStatement::ExecuteProcedure
COdbcStatement::GetDateTimeCol
COdbcStatement::GetVarcharMaxCol
CRdlsDBJet::CreateOrUpgradeDatabase
CRdlsDBManager::Initialize
CRdlsDBManager::PerformPostRdlsDBInit
CRdlsDBManager::ReadDatabasePaths
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CRdlsDBManager::UpdateMaxKeyPackAndLicenseId
CRdlsDBWID::InstallRdlsDatabase
CRdlsDBWID::IsDatabaseInstalled
CRdlsSqlTableBackupSource::ReadData
CRdlsSqlTableIssuedLicenses::ReadData
CRdlsSqlTableKeyPack::ReadData
CRdlsSqlTableKeyPackDesc::ReadData
CRdlsSqlTableRdlsSecrets::ReadData
CRdlsSqlTableVersion::ReadData
CRdlsSqlTableWorkStorage::ReadData
CTLSPolicyMgr::CTLSPolicyMgr
CTLSPolicyMgr::FindProductPolicyModule
CTLSPolicyMgr::FindProductTransation
CTLSPolicyMgr::InsertProductPolicyModule
CTLSPolicyMgr::InsertProductTransation
CTLSPolicyMgr::LoadPolicyModule
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::IsSCPRegistered
CTSScpRegister::TryUnRegisterSCP
CTSScpRegister::TryUpdateScpAttributes
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
CreateUniqueReportFile
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
DBFindLostLicenseExact
DBFindLostLicensePU
DecodeLicenseKeyPackEx
DeleteExpiredTemporaryLicenses
DeleteFilesInDirectory
DeleteLicensesToDomain
DeleteUserLicenses
DumpLicensedClient
DumpLicensedProduct
EnableSinglePrivilege
EncryptDecryptData
EnumIssuerLicense20
EnumSubjectLicense20
ExpirePermanentThread
FetchReportBegin
FetchReportCALInfoNext
FetchReportEntriesDetail
FetchReportFailedPUSummaryEntries
FetchReportNext
FetchReportNext_PD
FileExists
FileTimeText
FileTimeToLicenseDate
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
ForwardNewLicenseRequest
ForwardUpgradeLicenseRequest
GetCALType
GetDomainMachineNameOnDC
GetDomainandUsersInfo
GetFailedPerUserDetailsFromDB
GetLicenseSettingsObjectP
GetLocalComputerObject
GetMachineFQDN
GetPerDeviceLicensingInfoFromDB
GetPerUserDetailsFromDB
GetProductDescFromPid
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
GetTSLSGroupNameAndDomainInfo
GetUserDefinedErrorFromMsg
HandleDiscovery
InitCryptoProv
IsAdmin
IsLicenseExpired
IsLocalDomain
IsPerUserKeyPack
IsRequestFromLocalMachine
JBColumn::LoadJetColumnInfoFromJet
JBInstance::JBInitJetInstance
JBInstance::JBTerminate
JBTable::AddColumn
JBTable::EndUpdate
JBTable::LoadTableInfo
KeypackLib_LogErrorEvent
LKPLiteVerifySPK
LSDecodeClientHWID
LicCtx::InitLicctx
LicCtx::Tr_NC
LicCtx::TypePostProcess
LicCtx::TypePreProcess
LicenseDecryptHwid
LicenseTimeToDate
LicenseVerifyServerCert
LicensedTable::UpgradeTable
LoadPolicyModule
LogEventFailure
LogEventSuccess
LogFailedPUIssuanceInDB
LogLicenseAdjustmentEvent
LogLicenseUnavailableEvent
LogReportingEvents
LogSuccessFullPUIssuanceInDB
LsaServerIdToServerIds
MergeFirstOverUsedWithUnderUsedLKPs
MergeNewOverIssuedWithExistingOverUsedLKP
MergeNewUnderIssuedLKPWithOverUsedLKP
Mod
MoveLicensesANDDeleteBuiltInPULKP
MoveLicensesToKeypack
MsRdlsDBFactory::GetSQLDBInstance
NamedPipeThread
NumberOfLicensesInstalled
OdbcErrorToHresult
PostServiceInit
ProcessExpiredKeyPacks
ProcessStaleKeypacks
RdCentralDbUtils::DecryptCredsData
RdCentralDbUtils::GetDbConnectionStringWithPassword
RdCentralDbUtils::ReplacePasswordInDbConnectionString
RdlsJetDBConnection::GetLicense
RdlsJetDBConnection::InitDatabaseEngine
RdlsJetDBConnection::ReadRdlsSecrets
RdlsSecretsDBCache::FindInsertOrUpdateRdlsSecrets
RdlsSecretsDBCache::ReadOrSetupInitalSecrets
RdpWppGetCurrentThreadActivityIdPrefix
RdpX_GetActivityIdPrefix
ReportDelete
ReportEnumBegin
ReportEnumNext
ReportGenerateBegin
ReportStatusToSCMgr
SaveScpGUIDToRegistry
SecureModeCheck
ServerEnumCallBack
ServerShutdown
ServiceContinue
ServiceLoadAllPolicyModule
ServiceLoadPolicyModule
ServiceMain
ServicePause
ServiceStart
ServiceStop
SetSecurityDescriptorOnNamedPipe
ShortSigHash
ShortSigVerifySig
StartServerInitThread
TLSAddTermServCertificatePack
TLSAnnounceLKPToAllRemoteServer
TLSAnnounceServerToRemoteServer
TLSCheckLicenseMarkRequest
TLSColumn::InsertColumnValue
TLSConnectToServerWithServerId
TLSCreateSelfSignCertificate
TLSCreateUpgradeDatabase
TLSCryptGenerateNewKeys
TLSDBAddTemporaryKeyPack
TLSDBFindLostLicense
TLSDBGetMaxLicenseId
TLSDBGetPermanentLicense
TLSDBInstallKeyPack
TLSDBIssueLicense
TLSDBIssueNewLicenseFromLocal
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBIssuePermanentLicense
TLSDBIssueTemporaryLicense
TLSDBKeyPackAdd
TLSDBKeyPackAddEntry
TLSDBKeyPackDescFind
TLSDBKeyPackGetAvailableLicenses
TLSDBKeyPackSetValues
TLSDBKeyPackUpdateEntry
TLSDBLicenseKeyPackAdd
TLSDBLicenseKeyPackEnumBegin
TLSDBLicenseKeyPackEnumNext
TLSDBLicenseKeyPackSetStatus
TLSDBRegisterLicenseKeyPack
TLSDBReissueFoundPermanentLicense
TLSDBReissueFoundTemporaryLicense
TLSDBRemoteKeyPackAdd
TLSDBReturnLicense
TLSDBReturnLicenseToAnyKeyPack
TLSDBReturnLicenseToKeyPack
TLSDBTelephoneRegisterLicenseKeyPack
TLSDBUnRegisterLicenses
TLSDBValidateLicense
TLSEncryptBase64EncodeHWID
TLSFindAnyLicenseKeyPack
TLSFindLicense
TLSFindLicenseKeyPack
TLSFindLicenseKeyPackwithProductID
TLSFindORDeleteLKPBuiltInPU
TLSForwardLicenseRequest
TLSForwardUpgradeRequest
TLSGenerateSingleCertificate
TLSGetESEError
TLSGetPolicyModule
TLSLicenseRevoke
TLSLogRemoveLicenseEvent
TLSLookupServerById
TLSMarkLicenseRequest
TLSNewLicenseRequest
TLSPostReturnClientLicenseJob
TLSPushSyncLocalLkpToServer
TLSReGenKeysAndReloadServerCert
TLSRegisterServerWithName
TLSRemoveLicenses
TLSRemoveLicensesFromInvalidDatabase
TLSResolveServerIdToServer
TLSReturnClientLicensedProduct
TLSRpcAddLStoTSLSofDC
TLSRpcAnnounceLicensePack
TLSRpcCanLSUpdateAD
TLSRpcChangeRole
TLSRpcCheckLicenseMark
TLSRpcGetAvailableLicenses
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcInstallCertificate
TLSRpcIsFreeKeyPackInstalled
TLSRpcIsGPEnabled
TLSRpcIsPreventUpgGPEnabled
TLSRpcKeyPackAdd
TLSRpcLicenseEnumBegin
TLSRpcLicenseEnumNext
TLSRpcLicenseEnumNextEx
TLSRpcLogEvent
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcPublishLS
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRegisterToSCP
TLSRpcRemoveLSFromTSLSOfAD
TLSRpcRetrieveTermServCert
TLSRpcReturnInternetLicenseEx
TLSRpcSetTlsPrivateData
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSRpcUnRegisterFromSCP
TLSRpcUnpublishLS
TLSSetCertRdn
TLSSetPerUserExpTime
TLSStartAnnounceLicenseServerJob
TLSStartAnnounceResponseJob
TLSStartAnnounceToEServerJob
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::EnumerateNext
TLSUpdateUserObject
TLSUpgradeDatabase
TLSUpgradeLicenseRequestEx
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsGenerateLSDBBackupFileName
TlsLicenseRequestToPMLicenseRequest
UpdateConvStatus
UpdatePUExpirationDate
UpdateProductIDs
UpdateUserLicenseAttributes
Upgrade236LicensePack
UpgradeKeyPackVersion
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
__GSHandlerCheckCommon
__LicensedIndexOnMatchHwid::operator=
_invoke_watson
calUpgRenewLicense
findIssuerCertContext
queryUser
queryUserADsPath
reclaimTempLicense
std::_Tree,class_std::allocator_>,1>_>::_Insert
std::_Tree,class_std::allocator_>,1>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,struct_std::less,class_std::allocator_>_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,1>_>::_Insert
std::_Tree,class_std::allocator_>,1>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator,0>_>::_Insert
std::basic_filebuf_>::_Endwrite
std::basic_filebuf_>::overflow
std::basic_filebuf_>::uflow
std::codecvt::codecvt
std::ctype::_Getcat
std::ios_base::clear
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
updateCalAvailMap
updatePUCalAvailMap
wil::GetFailureLogString
wil::ResultException::what
wil::details::FeatureStateManager::EnsureSubscribedToStateChangesUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure
wil::details::WilApiImpl_RecordFeatureUsage
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_details_StagingConfig_FireNotification
wil_details_StagingConfig_Load
wil_details_WriteSRUMWnfUsageBuffer
|
Expand for full list:
ADHasLicensingAttrs
A_SHAFinal
AddFailedLicensesToReport
AddHeaderToReport
AddLicensesToReport
AddOtherPULKPs
AddSuccessFullPerUserLicensesToReport
AllocateLicensesFromDB
BSafeEncPublic
CConversion::AddLicensesToDestination
CConversion::SetLKPAttribsCOdbcStatement::BindPropertyTVPParameter
COdbcStatement::ExecuteProcedure
COdbcStatement::GetDateTimeCol
COdbcStatement::GetVarcharMaxCol
CRdlsDBJet::CreateOrUpgradeDatabase
CRdlsDBManager::Initialize
CRdlsDBManager::PerformPostRdlsDBInit
CRdlsDBManager::ReadDatabasePaths
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CRdlsDBManager::UpdateMaxKeyPackAndLicenseId
CRdlsDBWID::InstallRdlsDatabase
CRdlsDBWID::IsDatabaseInstalled
CRdlsSqlTableBackupSource::ReadData
CRdlsSqlTableIssuedLicenses::ReadData
CRdlsSqlTableKeyPack::ReadData
CRdlsSqlTableKeyPackDesc::ReadData
CRdlsSqlTableRdlsSecrets::ReadData
CRdlsSqlTableVersion::ReadData
CRdlsSqlTableWorkStorage::ReadData
CTLSPolicyMgr::CTLSPolicyMgr
CTLSPolicyMgr::FindProductPolicyModule
CTLSPolicyMgr::FindProductTransation
CTLSPolicyMgr::InsertProductPolicyModule
CTLSPolicyMgr::InsertProductTransation
CTLSPolicyMgr::LoadPolicyModule
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::IsSCPRegistered
CTSScpRegister::TryUnRegisterSCP
CTSScpRegister::TryUpdateScpAttributes
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::Process
CreateUniqueReportFile
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
CrimsonHelper::RaiseEvent
DBFindLostLicenseExact
DBFindLostLicensePU
DecodeLicenseKeyPackEx
DeleteExpiredTemporaryLicenses
DeleteFilesInDirectory
DeleteLicensesToDomain
DeleteUserLicenses
DumpLicensedClient
DumpLicensedProduct
EnableSinglePrivilege
EncryptDecryptData
EnumIssuerLicense20
EnumSubjectLicense20
EvaluateCurrentStateFromRegistry
ExpirePermanentThread
FetchReportBegin
FetchReportCALInfoNext
FetchReportEntriesDetail
FetchReportFailedPUSummaryEntries
FetchReportNext
FetchReportNext_PD
FileExists
FileTimeText
FileTimeToLicenseDate
FillLSSCPAttributes
FindUser
FindUserADsPath
FineTuneUserLicAttrs
ForwardNewLicenseRequest
ForwardUpgradeLicenseRequest
GetCALType
GetDomainMachineNameOnDC
GetDomainandUsersInfo
GetFailedPerUserDetailsFromDB
GetLicenseSettingsObjectP
GetLocalComputerObject
GetMachineFQDN
GetPerDeviceLicensingInfoFromDB
GetPerUserDetailsFromDB
GetProductDescFromPid
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
GetTSLSGroupNameAndDomainInfo
GetUserDefinedErrorFromMsg
HandleDiscovery
InitCryptoProv
IsAdmin
IsLicenseExpired
IsLocalDomain
IsPerUserKeyPack
IsRequestFromLocalMachine
JBColumn::LoadJetColumnInfoFromJet
JBInstance::JBInitJetInstance
JBInstance::JBTerminate
JBTable::AddColumn
JBTable::EndUpdate
JBTable::LoadTableInfo
KeypackLib_LogErrorEvent
LKPLiteVerifySPK
LSDecodeClientHWID
LicCtx::InitLicctx
LicCtx::Tr_NC
LicCtx::TypePostProcess
LicCtx::TypePreProcess
LicenseDecryptHwid
LicenseTimeToDate
LicenseVerifyServerCert
LicensedTable::UpgradeTable
LoadPolicyModule
LogEventFailure
LogEventSuccess
LogFailedPUIssuanceInDB
LogLicenseAdjustmentEvent
LogLicenseUnavailableEvent
LogReportingEvents
LogSuccessFullPUIssuanceInDB
LsaServerIdToServerIds
MergeFirstOverUsedWithUnderUsedLKPs
MergeNewOverIssuedWithExistingOverUsedLKP
MergeNewUnderIssuedLKPWithOverUsedLKP
Mod
MoveLicensesANDDeleteBuiltInPULKP
MoveLicensesToKeypack
MsRdlsDBFactory::GetSQLDBInstance
NamedPipeThread
NumberOfLicensesInstalled
OdbcErrorToHresult
PostServiceInit
ProcessExpiredKeyPacks
ProcessStaleKeypacks
RdCentralDbUtils::DecryptCredsData
RdCentralDbUtils::GetDbConnectionStringWithPassword
RdCentralDbUtils::ReplacePasswordInDbConnectionString
RdlsJetDBConnection::GetLicense
RdlsJetDBConnection::InitDatabaseEngine
RdlsJetDBConnection::ReadRdlsSecrets
RdlsSecretsDBCache::FindInsertOrUpdateRdlsSecrets
RdlsSecretsDBCache::ReadOrSetupInitalSecrets
RdpWppGetCurrentThreadActivityIdPrefix
RdpX_GetActivityIdPrefix
ReportDelete
ReportEnumBegin
ReportEnumNext
ReportGenerateBegin
ReportStatusToSCMgr
SaveScpGUIDToRegistry
SecureModeCheck
ServerEnumCallBack
ServerShutdown
ServiceContinue
ServiceLoadAllPolicyModule
ServiceLoadPolicyModule
ServiceMain
ServicePause
ServiceStart
ServiceStop
SetSecurityDescriptorOnNamedPipe
ShortSigHash
ShortSigVerifySig
StartServerInitThread
TLSAddTermServCertificatePack
TLSAnnounceLKPToAllRemoteServer
TLSAnnounceServerToRemoteServer
TLSCheckLicenseMarkRequest
TLSColumn::InsertColumnValue
TLSConnectToServerWithServerId
TLSCreateSelfSignCertificate
TLSCreateUpgradeDatabase
TLSCryptGenerateNewKeys
TLSDBAddTemporaryKeyPack
TLSDBFindLostLicense
TLSDBGetMaxLicenseId
TLSDBGetPermanentLicense
TLSDBInstallKeyPack
TLSDBIssueLicense
TLSDBIssueNewLicenseFromLocal
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBIssuePermanentLicense
TLSDBIssueTemporaryLicense
TLSDBKeyPackAdd
TLSDBKeyPackAddEntry
TLSDBKeyPackDescFind
TLSDBKeyPackGetAvailableLicenses
TLSDBKeyPackSetValues
TLSDBKeyPackUpdateEntry
TLSDBLicenseKeyPackAdd
TLSDBLicenseKeyPackEnumBegin
TLSDBLicenseKeyPackEnumNext
TLSDBLicenseKeyPackSetStatus
TLSDBRegisterLicenseKeyPack
TLSDBReissueFoundPermanentLicense
TLSDBReissueFoundTemporaryLicense
TLSDBRemoteKeyPackAdd
TLSDBReturnLicense
TLSDBReturnLicenseToAnyKeyPack
TLSDBReturnLicenseToKeyPack
TLSDBTelephoneRegisterLicenseKeyPack
TLSDBUnRegisterLicenses
TLSDBValidateLicense
TLSEncryptBase64EncodeHWID
TLSFindAnyLicenseKeyPack
TLSFindLicense
TLSFindLicenseKeyPack
TLSFindLicenseKeyPackwithProductID
TLSFindORDeleteLKPBuiltInPU
TLSForwardLicenseRequest
TLSForwardUpgradeRequest
TLSGenerateSingleCertificate
TLSGetESEError
TLSGetPolicyModule
TLSLicenseRevoke
TLSLogRemoveLicenseEvent
TLSLookupServerById
TLSMarkLicenseRequest
TLSNewLicenseRequest
TLSPostReturnClientLicenseJob
TLSPushSyncLocalLkpToServer
TLSReGenKeysAndReloadServerCert
TLSRegisterServerWithName
TLSRemoveLicenses
TLSRemoveLicensesFromInvalidDatabase
TLSResolveServerIdToServer
TLSReturnClientLicensedProduct
TLSRpcAddLStoTSLSofDC
TLSRpcAnnounceLicensePack
TLSRpcCanLSUpdateAD
TLSRpcChangeRole
TLSRpcCheckLicenseMark
TLSRpcGetAvailableLicenses
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcInstallCertificate
TLSRpcIsFreeKeyPackInstalled
TLSRpcIsGPEnabled
TLSRpcIsPreventUpgGPEnabled
TLSRpcKeyPackAdd
TLSRpcLicenseEnumBegin
TLSRpcLicenseEnumNext
TLSRpcLicenseEnumNextEx
TLSRpcLogEvent
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcPublishLS
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRegisterToSCP
TLSRpcRemoveLSFromTSLSOfAD
TLSRpcRetrieveTermServCert
TLSRpcReturnInternetLicenseEx
TLSRpcSecurityCallback
TLSRpcSetTlsPrivateData
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSRpcUnRegisterFromSCP
TLSRpcUnpublishLS
TLSSetCertRdn
TLSSetPerUserExpTime
TLSStartAnnounceLicenseServerJob
TLSStartAnnounceResponseJob
TLSStartAnnounceToEServerJob
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::DeleteAllRecord
TLSTable::DeleteRecord
TLSTable::EnumerateNext
TLSTable::GetCount
TLSTable::EnumerateNext
TLSUpdateUserObject
TLSUpgradeDatabase
TLSUpgradeLicenseRequestEx
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsGenerateLSDBBackupFileName
TlsLicenseRequestToPMLicenseRequest
UpdateConvStatus
UpdatePUExpirationDate
UpdateProductIDs
UpdateUserLicenseAttributes
Upgrade236LicensePack
UpgradeKeyPackVersion
_AnnounceLicensePackToServers
_SsyncAllLocalLicensePack
_SsyncOneLocalLicensePack
__GSHandlerCheckCommon
__LicensedIndexOnMatchHwid::operator=
_invoke_watson
calUpgRenewLicense
findIssuerCertContext
queryUser
queryUserADsPath
reclaimTempLicense
std::_Tree,class_std::allocator_>,1>_>::_Insert
std::_Tree,class_std::allocator_>,1>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,struct_std::less,class_std::allocator_>_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,1>_>::_Insert
std::_Tree,class_std::allocator_>,1>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::_Insert
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator_>,0>_>::erase
std::_Tree,class_std::allocator,0>_>::_Insert
std::basic_filebuf_>::_Endwrite
std::basic_filebuf_>::overflow
std::basic_filebuf_>::uflow
std::codecvt::codecvt
std::ctype::_Getcat
std::ios_base::clear
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
std::map,class_std::allocator_>_>::operator[]
updateCalAvailMap
updatePUCalAvailMap
wil::GetFailureLogString
wil::ResultException::what
wil::details::FeatureStateManager::EnsureSubscribedToStateChangesUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure
wil::details::WilApiImpl_RecordFeatureUsage
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromPointer
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_details_StagingConfig_FireNotification
wil_details_StagingConfig_Load
wil_details_WriteSRUMWnfUsageBuffer
| |paramcount|1|1| |`address`|18009b480|18009c1e0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -69,0 +70 @@ +EvaluateCurrentStateFromRegistry @@ -265,0 +267 @@ +TLSRpcSecurityCallback ``` ## ADVAPI32.DLL::RegOpenKeyExW ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|RegOpenKeyExW|RegOpenKeyExW| |fullname|ADVAPI32.DLL::RegOpenKeyExW|ADVAPI32.DLL::RegOpenKeyExW| |`refcount`|25|26| |length|0|0| |called||| |`calling`|
Expand for full list:
CRdlsDBManager::ConfigRdlsHighAvailability
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::PerformPostRdlsDBInit
CTSRegEntry::CTSRegEntry
ExpireInDays
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
RdCentralDbUtils::DecryptCredsData
RdlsSecretsRegCache::CopyRegistryKeyRecursively
RdlsSecretsRegCache::DeleteRegistryKeyRecursively
RdlsSecretsRegCache::IsCertStoreExistsRdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
RdlsSecretsRegCache::RdlsCertOpenStore
RdlsSecretsRegCache::UninstallCHX509Certs
ReadRegDWORD
RetrieveKey
ServiceLoadAllPolicyModule
TLSDBInstallKeyPack
TLSReadRegistryValue
TestModeCheck
VerifyCertValidity
VerifyCertificateChain
|
Expand for full list:
CRdlsDBManager::ConfigRdlsHighAvailability
CRdlsDBManager::CreateRdlsSecretsCache
CRdlsDBManager::PerformPostRdlsDBInit
CTSRegEntry::CTSRegEntry
EvaluateCurrentStateFromRegistry
ExpireInDays
GetScpLdapBindPathFromRegistry
MsRdlsDBFactory::CreateRdlsDBInstance
RdCentralDbUtils::DecryptCredsData
RdlsSecretsRegCache::CopyRegistryKeyRecursively
RdlsSecretsRegCache::DeleteRegistryKeyRecursivelyRdlsSecretsRegCache::IsCertStoreExists
RdlsSecretsRegCache::LoadVerifyLicenseServerCertificates
RdlsSecretsRegCache::RdlsCertOpenStore
RdlsSecretsRegCache::UninstallCHX509Certs
ReadRegDWORD
RetrieveKey
ServiceLoadAllPolicyModule
TLSDBInstallKeyPack
TLSReadRegistryValue
TestModeCheck
VerifyCertValidity
VerifyCertificateChain
| |paramcount|5|5| |`address`|EXTERNAL:00000197|EXTERNAL:0000019a| |sig|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::RegOpenKeyExW Calling Diff ```diff --- ADVAPI32.DLL::RegOpenKeyExW calling +++ ADVAPI32.DLL::RegOpenKeyExW calling @@ -4,0 +5 @@ +EvaluateCurrentStateFromRegistry ``` ## rc4_key ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.99| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|rc4_key|rc4_key| |fullname|rc4_key|rc4_key| |`refcount`|7|8| |length|616|616| |called||| |calling|CTsCalPUNewLicenseReqCtx::Process
EncryptDecryptData
LicenseDecryptHwid
TLSEncryptBase64EncodeHWID
TLSReturnClientLicensedProduct
TLSRpcRetrieveTermServCert|CTsCalPUNewLicenseReqCtx::Process
EncryptDecryptData
LicenseDecryptHwid
TLSEncryptBase64EncodeHWID
TLSReturnClientLicensedProduct
TLSRpcRetrieveTermServCert| |paramcount|3|3| |`address`|180061bd0|180062380| |sig|undefined __fastcall rc4_key(char * param_1, undefined8 param_2, longlong param_3)|undefined __fastcall rc4_key(char * param_1, undefined8 param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## ADVAPI32.DLL::TraceMessage ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|TraceMessage|TraceMessage| |fullname|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |`refcount`|37|38| |length|0|0| |called||| |`calling`|
Expand for full list:
WPP_SF_
WPP_SF_D
WPP_SF_DDD
WPP_SF_DDDDD
WPP_SF_DDDS
WPP_SF_DDS
WPP_SF_DL
WPP_SF_DS
WPP_SF_DSID
WPP_SF_DSS
WPP_SF_DSSidWPP_SF_DSd
WPP_SF_DSdS
WPP_SF_Dd
WPP_SF_DdL
WPP_SF_Ddd
WPP_SF_Dq
WPP_SF_Ds
WPP_SF_DsD
WPP_SF_DssD
WPP_SF_S
WPP_SF_SDD
WPP_SF_SS
WPP_SF_SSD
WPP_SF_SSS
WPP_SF_SSSS
WPP_SF_SSSdS
WPP_SF_SSd
WPP_SF_SSdddd
WPP_SF_Sd
WPP_SF_SdS
WPP_SF_Sdd
WPP_SF_q
WPP_SF_qD
WPP_SF_qS
WPP_SF_qd
|
Expand for full list:
WPP_SF_
WPP_SF_D
WPP_SF_DDD
WPP_SF_DDDDD
WPP_SF_DDDS
WPP_SF_DDS
WPP_SF_DL
WPP_SF_DS
WPP_SF_DSID
WPP_SF_DSS
WPP_SF_DSSidWPP_SF_DSd
WPP_SF_DSdS
WPP_SF_Dd
WPP_SF_DdL
WPP_SF_Ddd
WPP_SF_Dq
WPP_SF_Ds
WPP_SF_DsD
WPP_SF_DssD
WPP_SF_S
WPP_SF_SDD
WPP_SF_SL
WPP_SF_SS
WPP_SF_SSD
WPP_SF_SSS
WPP_SF_SSSS
WPP_SF_SSSdS
WPP_SF_SSd
WPP_SF_SSdddd
WPP_SF_Sd
WPP_SF_SdS
WPP_SF_Sdd
WPP_SF_q
WPP_SF_qD
WPP_SF_qS
WPP_SF_qd
| |paramcount|0|0| |`address`|EXTERNAL:000001b4|EXTERNAL:000001b7| |sig|undefined TraceMessage(void)|undefined TraceMessage(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### ADVAPI32.DLL::TraceMessage Calling Diff ```diff --- ADVAPI32.DLL::TraceMessage calling +++ ADVAPI32.DLL::TraceMessage calling @@ -22,0 +23 @@ +WPP_SF_SL ``` ## WPP_SF_S ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.92| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|WPP_SF_S|WPP_SF_S| |fullname|WPP_SF_S|WPP_SF_S| |`refcount`|511|518| |length|96|96| |called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage| |`calling`|
Expand for full list:
CALUpgradeNS::CALUpgradeCtx::upgradeCAL
CALUpgradeNS::LSState::calAvailMap
CPersistentWorkStorage::BeginProcessingJob
CPersistentWorkStorage::DeleteWorkObject
CPersistentWorkStorage::RescheduleJob
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJobCTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::GetScpAttributes
CTSScpRegister::Initialize
CTSScpRegister::RegisterSCP
CTSScpRegister::TryUpdateScpAttributes
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CTsCalNullHandler::HandleRequest
CTsCalPDNewLicenseReqCtx::CTsCalPDNewLicenseReqCtx
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDNewLicenseReqCtx::Validate
CTsCalPDNewLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPDRevokeLicenseReqCtx::CTsCalPDRevokeLicenseReqCtx
CTsCalPDRevokeLicenseReqCtx::Process
CTsCalPDRevokeLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPDUpgLicenseReqCtx::CTsCalPDUpgLicenseReqCtx
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Validate
CTsCalPDUpgLicenseReqCtx::`vector_deleting_destructor'
CTsCalPUNewLicenseReqCtx::CTsCalPUNewLicenseReqCtx
CTsCalPUNewLicenseReqCtx::CTsCalPUNewLicenseReqCtx
CTsCalPUNewLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPerDeviceNewLicenseHandler::HandleRequest
CTsCalPerDeviceNewLicenseHandler::`vector_deleting_destructor'
CTsCalPerDeviceProvider::CTsCalPerDeviceProvider
CTsCalPerDeviceProvider::CreateHandler
CTsCalPerDeviceProvider::CreatePDNewLicenseHandler
CTsCalPerDeviceProvider::CreatePDRevokeLicenseHandler
CTsCalPerDeviceProvider::CreatePDUpgLicenseHandler
CTsCalPerDeviceProvider::GetInstance
CTsCalPerDeviceRevokeLicenseHandler::HandleRequest
CTsCalPerDeviceRevokeLicenseHandler::`scalar_deleting_destructor'
CTsCalPerDeviceUpgradeLicenseHandler::HandleRequest
CTsCalPerDeviceUpgradeLicenseHandler::`vector_deleting_destructor'
CTsCalPerUserNewLicenseHandler::HandleRequest
CTsCalPerUserNewLicenseHandler::`scalar_deleting_destructor'
CTsCalPerUserProvider::CTsCalPerUserProvider
CTsCalPerUserProvider::CreateHandler
CTsCalPerUserProvider::CreatePUNewLicenseHandler
CTsCalPerUserProvider::GetInstance
CTsCalProviderFactory::GetInstance
CTsCalProviderFactory::MakeProvider
CWorkManager::AddJobToProcessingList
CWorkManager::RunJob
ComposeString
DecodeLicenseKeyPack
DecodeLicenseKeyPackEx
EnableSinglePrivilege
ExpirePermanentThread
GetCertVerificationResult
GetClientPrivilege
GetEnvelopedData
GetInstanceOfIScpRegister
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
ITsCalRequestHandler::~ITsCalRequestHandler
InitScpAttribsStructure
IsRequestFromLocalMachine
KeyPackDecryptData
LicAttr::LicAttr
LogLicenseUnavailableEvent
MailSlotThread
MyFreeLicenseKeyPack
PCONTEXT_HANDLE_rundown
RPCServiceStartThread
ReportStatusToSCMgr
SecureModeCheck
ServiceContinue
ServiceCtrl
ServiceMain
ServicePause
ServiceShutdownThread
ServiceStart
ServiceStop
SetSecurityDescriptorOnNamedPipe
TLSCreateUpgradeDatabase
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBReturnLicense
TLSDBReturnLicenseToAnyKeyPack
TLSDBReturnLicenseToKeyPack
TLSFormDBRequest
TLSGenerateChallengeData
TLSGenerateClientCertificate
TLSGetPolicyModule
TLSLicenseRevoke
TLSNewLicenseRequest
TLSRequestNewLicense
TLSRpcAddLStoTSLSofDC
TLSRpcAllocateInternetLicense
TLSRpcAllocateInternetLicenseEx
TLSRpcAnnounceLicensePack
TLSRpcAnnounceServer
TLSRpcCanLSUpdateAD
TLSRpcChallengeServer
TLSRpcChangeRole
TLSRpcCheckLicenseMark
TLSRpcConfigHighAvailability
TLSRpcConnect
TLSRpcConvertLicenses
TLSRpcCreateLocalGroupForGP
TLSRpcDatabasePath
TLSRpcDisconnect
TLSRpcFetchReportBegin
TLSRpcFetchReportCALInfoNextEx
TLSRpcFetchReportEnd
TLSRpcFetchReportEntriesDetail
TLSRpcFetchReportFailedPUSummaryEntries
TLSRpcFetchReportNextEx
TLSRpcFetchReportNext_PD
TLSRpcGenerateCustomerCert
TLSRpcGetAvailableLicenses
TLSRpcGetCHIDsForSupportedCALs
TLSRpcGetCHIDsForSupportedCALsDelimited
TLSRpcGetLastError
TLSRpcGetLastErrorFixed
TLSRpcGetOSVersion
TLSRpcGetServerCertificate
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcGetServerScope
TLSRpcGetServerScopeFixed
TLSRpcGetSupportFlags
TLSRpcGetSupportedFeatures
TLSRpcGetTlsPrivateData
TLSRpcGetVersion
TLSRpcInstallCertificate
TLSRpcIsFreeKeyPackInstalled
TLSRpcIsGPEnabled
TLSRpcIsLSPublished
TLSRpcIsLSonDC
TLSRpcIsPreventUpgGPEnabled
TLSRpcIsSCPRegistered
TLSRpcIsServerInDomain
TLSRpcIsUserAdmin
TLSRpcIssuePerUserLicense
TLSRpcIssuePerUserLicenseEx
TLSRpcIssuePlatformChallenge
TLSRpcKeyPackAdd
TLSRpcKeyPackEnumBegin
TLSRpcKeyPackEnumEnd
TLSRpcKeyPackEnumNext
TLSRpcKeyPackSetStatus
TLSRpcLicenseEnumBegin
TLSRpcLicenseEnumEnd
TLSRpcLicenseEnumNext
TLSRpcLicenseEnumNextEx
TLSRpcLocalGroupForGPPresent
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcMarkLicense
TLSRpcPublishLS
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRegisterToSCP
TLSRpcRemoveLSFromTSLSOfAD
TLSRpcRemoveLocalGroupForGP
TLSRpcReportDelete
TLSRpcReportEnumBegin
TLSRpcReportEnumEnd
TLSRpcReportEnumNext
TLSRpcReportGenerateBegin
TLSRpcRequestNewLicense
TLSRpcRequestNewLicenseEx
TLSRpcRequestNewLicenseExEx
TLSRpcRequestTermServCert
TLSRpcResponseServerChallenge
TLSRpcRetrieveTermServCert
TLSRpcReturnInternetLicense
TLSRpcReturnInternetLicenseEx
TLSRpcReturnLicensedProduct
TLSRpcRevokeLicense
TLSRpcSendServerCertificate
TLSRpcSetTlsPrivateData
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSRpcTriggerReGenKey
TLSRpcTriggerReGenKeyNoWarning
TLSRpcUnRegisterFromSCP
TLSRpcUnRegisterLicenses
TLSRpcUnpublishLS
TLSRpcUpgradeLicense
TLSRpcUpgradeLicenseEx
TLSRpcUpgradeLicenseV4
TLSRpcUpgradeLicenseWithMarkExEx
TLSUpdateUserObject
TLSUpgradeLicenseRequestEx
TLSVerifyChallengeDataGetWantedLicenseLevel
TLSVerifyHydraCertificate
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsLicenseProductToPMLicenseProduct
UnpackEnvelopedData
VerifyAndGetLicenseKeyPack
VerifyCertificateChain
VerifyLicenseRequest
WaitForMyTurnOrShutdown
isFreeKeypack
processCalUpgResult
updateCalAvailMap
|
Expand for full list:
CALUpgradeNS::CALUpgradeCtx::upgradeCAL
CALUpgradeNS::LSState::calAvailMap
CPersistentWorkStorage::BeginProcessingJob
CPersistentWorkStorage::DeleteWorkObject
CPersistentWorkStorage::RescheduleJob
CRdlsDBManager::StartRdlsDBWorkspaceEngine
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJob
CTLSWorkObject::ExecuteJobCTSScpRegister::GetMachinesWithInstalledRoles
CTSScpRegister::GetScpAttributes
CTSScpRegister::Initialize
CTSScpRegister::RegisterSCP
CTSScpRegister::TryUpdateScpAttributes
CTSScpRegister::UnRegisterSCP
CTSScpRegister::UpdateScpAttributes
CTsCalNullHandler::HandleRequest
CTsCalPDNewLicenseReqCtx::CTsCalPDNewLicenseReqCtx
CTsCalPDNewLicenseReqCtx::CreateDbLicenseRequest
CTsCalPDNewLicenseReqCtx::GetAdjustedRequest
CTsCalPDNewLicenseReqCtx::Process
CTsCalPDNewLicenseReqCtx::Validate
CTsCalPDNewLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPDRevokeLicenseReqCtx::CTsCalPDRevokeLicenseReqCtx
CTsCalPDRevokeLicenseReqCtx::Process
CTsCalPDRevokeLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPDUpgLicenseReqCtx::CTsCalPDUpgLicenseReqCtx
CTsCalPDUpgLicenseReqCtx::Process
CTsCalPDUpgLicenseReqCtx::Validate
CTsCalPDUpgLicenseReqCtx::`vector_deleting_destructor'
CTsCalPUNewLicenseReqCtx::CTsCalPUNewLicenseReqCtx
CTsCalPUNewLicenseReqCtx::CTsCalPUNewLicenseReqCtx
CTsCalPUNewLicenseReqCtx::Process
CTsCalPUNewLicenseReqCtx::`scalar_deleting_destructor'
CTsCalPerDeviceNewLicenseHandler::HandleRequest
CTsCalPerDeviceNewLicenseHandler::`vector_deleting_destructor'
CTsCalPerDeviceProvider::CTsCalPerDeviceProvider
CTsCalPerDeviceProvider::CreateHandler
CTsCalPerDeviceProvider::CreatePDNewLicenseHandler
CTsCalPerDeviceProvider::CreatePDRevokeLicenseHandler
CTsCalPerDeviceProvider::CreatePDUpgLicenseHandler
CTsCalPerDeviceProvider::GetInstance
CTsCalPerDeviceRevokeLicenseHandler::HandleRequest
CTsCalPerDeviceRevokeLicenseHandler::`scalar_deleting_destructor'
CTsCalPerDeviceUpgradeLicenseHandler::HandleRequest
CTsCalPerDeviceUpgradeLicenseHandler::`vector_deleting_destructor'
CTsCalPerUserNewLicenseHandler::HandleRequest
CTsCalPerUserNewLicenseHandler::`scalar_deleting_destructor'
CTsCalPerUserProvider::CTsCalPerUserProvider
CTsCalPerUserProvider::CreateHandler
CTsCalPerUserProvider::CreatePUNewLicenseHandler
CTsCalPerUserProvider::GetInstance
CTsCalProviderFactory::GetInstance
CTsCalProviderFactory::MakeProvider
CWorkManager::AddJobToProcessingList
CWorkManager::RunJob
ComposeString
DecodeLicenseKeyPack
DecodeLicenseKeyPackEx
EnableSinglePrivilege
ExpirePermanentThread
GetCertVerificationResult
GetClientPrivilege
GetEnvelopedData
GetInstanceOfIScpRegister
GetScpAttribsUsingGuidStr
GetScpLdapBindPathFromRegistry
ITsCalRequestHandler::~ITsCalRequestHandler
InitScpAttribsStructure
IsRequestFromLocalMachine
KeyPackDecryptData
LicAttr::LicAttr
LogLicenseUnavailableEvent
MailSlotThread
MyFreeLicenseKeyPack
PCONTEXT_HANDLE_rundown
RPCServiceStartThread
ReportStatusToSCMgr
SecureModeCheck
ServiceContinue
ServiceCtrl
ServiceMain
ServicePause
ServiceShutdownThread
ServiceStart
ServiceStop
SetSecurityDescriptorOnNamedPipe
TLSCreateUpgradeDatabase
TLSDBIssueNewLicenseFromLocalSpecific
TLSDBReturnLicense
TLSDBReturnLicenseToAnyKeyPack
TLSDBReturnLicenseToKeyPack
TLSFormDBRequest
TLSGenerateChallengeData
TLSGenerateClientCertificate
TLSGetPolicyModule
TLSLicenseRevoke
TLSNewLicenseRequest
TLSRequestNewLicense
TLSRpcAddLStoTSLSofDC
TLSRpcAllocateInternetLicense
TLSRpcAllocateInternetLicenseEx
TLSRpcAnnounceLicensePack
TLSRpcAnnounceServer
TLSRpcCanLSUpdateAD
TLSRpcChallengeServer
TLSRpcChangeRole
TLSRpcCheckLicenseMark
TLSRpcConfigHighAvailability
TLSRpcConnect
TLSRpcConvertLicenses
TLSRpcCreateLocalGroupForGP
TLSRpcDatabasePath
TLSRpcDisconnect
TLSRpcFetchReportBegin
TLSRpcFetchReportCALInfoNextEx
TLSRpcFetchReportEnd
TLSRpcFetchReportEntriesDetail
TLSRpcFetchReportFailedPUSummaryEntries
TLSRpcFetchReportNextEx
TLSRpcFetchReportNext_PD
TLSRpcGenerateCustomerCert
TLSRpcGetAvailableLicenses
TLSRpcGetCHIDsForSupportedCALs
TLSRpcGetCHIDsForSupportedCALsDelimited
TLSRpcGetLastError
TLSRpcGetLastErrorFixed
TLSRpcGetOSVersion
TLSRpcGetServerCertificate
TLSRpcGetServerName
TLSRpcGetServerNameEx
TLSRpcGetServerNameFixed
TLSRpcGetServerScope
TLSRpcGetServerScopeFixed
TLSRpcGetSupportFlags
TLSRpcGetSupportedFeatures
TLSRpcGetTlsPrivateData
TLSRpcGetVersion
TLSRpcInstallCertificate
TLSRpcIsFreeKeyPackInstalled
TLSRpcIsGPEnabled
TLSRpcIsLSPublished
TLSRpcIsLSonDC
TLSRpcIsPreventUpgGPEnabled
TLSRpcIsSCPRegistered
TLSRpcIsServerInDomain
TLSRpcIsUserAdmin
TLSRpcIssuePerUserLicense
TLSRpcIssuePerUserLicenseEx
TLSRpcIssuePlatformChallenge
TLSRpcKeyPackAdd
TLSRpcKeyPackEnumBegin
TLSRpcKeyPackEnumEnd
TLSRpcKeyPackEnumNext
TLSRpcKeyPackSetStatus
TLSRpcLicenseEnumBegin
TLSRpcLicenseEnumEnd
TLSRpcLicenseEnumNext
TLSRpcLicenseEnumNextEx
TLSRpcLocalGroupForGPPresent
TLSRpcLookupServer
TLSRpcLookupServerFixed
TLSRpcMarkLicense
TLSRpcPublishLS
TLSRpcRegisterLicenseKeyPack
TLSRpcRegisterLicenseKeyPackEx
TLSRpcRegisterToSCP
TLSRpcRemoveLSFromTSLSOfAD
TLSRpcRemoveLocalGroupForGP
TLSRpcReportDelete
TLSRpcReportEnumBegin
TLSRpcReportEnumEnd
TLSRpcReportEnumNext
TLSRpcReportGenerateBegin
TLSRpcRequestNewLicense
TLSRpcRequestNewLicenseEx
TLSRpcRequestNewLicenseExEx
TLSRpcRequestTermServCert
TLSRpcResponseServerChallenge
TLSRpcRetrieveTermServCert
TLSRpcReturnInternetLicense
TLSRpcReturnInternetLicenseEx
TLSRpcReturnLicensedProduct
TLSRpcRevokeLicense
TLSRpcSecurityCallback
TLSRpcSendServerCertificate
TLSRpcSetTlsPrivateData
TLSRpcTelephoneRegisterLKP
TLSRpcTelephoneRegisterLKPEx
TLSRpcTriggerReGenKey
TLSRpcTriggerReGenKeyNoWarning
TLSRpcUnRegisterFromSCP
TLSRpcUnRegisterLicenses
TLSRpcUnpublishLS
TLSRpcUpgradeLicense
TLSRpcUpgradeLicenseEx
TLSRpcUpgradeLicenseV4
TLSRpcUpgradeLicenseWithMarkExEx
TLSUpdateUserObject
TLSUpgradeLicenseRequestEx
TLSVerifyChallengeDataGetWantedLicenseLevel
TLSVerifyHydraCertificate
TSLSLoadLocalGroupSecDes
TSLSRPCAccessCheck
TlsLicenseProductToPMLicenseProduct
UnpackEnvelopedData
VerifyAndGetLicenseKeyPack
VerifyCertificateChain
VerifyLicenseRequest
WaitForMyTurnOrShutdown
isFreeKeypack
processCalUpgResult
updateCalAvailMap
| |paramcount|4|4| |address|180005d30|180005d30| |sig|undefined __fastcall WPP_SF_S(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)|undefined __fastcall WPP_SF_S(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### WPP_SF_S Calling Diff ```diff --- WPP_SF_S calling +++ WPP_SF_S calling @@ -186,0 +187 @@ +TLSRpcSecurityCallback ``` ## MSTLSAPI.DLL::Ordinal_134 ### Match Info |Key|lserver-5830.dll - lserver-6054.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|lserver-5830.dll|lserver-6054.dll| | :---: | :---: | :---: | |name|Ordinal_134|Ordinal_134| |fullname|MSTLSAPI.DLL::Ordinal_134|MSTLSAPI.DLL::Ordinal_134| |`refcount`|9|10| |length|0|0| |called||| |`calling`|PostServiceInit
SecureModeCheck
ServiceStart
StartServerInitThread
TLSRpcIsSCPRegistered
TLSRpcIsServerInDomain
TLSRpcRegisterToSCP
TLSRpcUnRegisterFromSCP|PostServiceInit
RPCServiceStartThread
SecureModeCheck
ServiceStart
StartServerInitThread
TLSRpcIsSCPRegistered
TLSRpcIsServerInDomain
TLSRpcRegisterToSCP
TLSRpcUnRegisterFromSCP| |paramcount|0|0| |address|EXTERNAL:00000067|EXTERNAL:00000067| |sig|undefined Ordinal_134(void)|undefined Ordinal_134(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### MSTLSAPI.DLL::Ordinal_134 Calling Diff ```diff --- MSTLSAPI.DLL::Ordinal_134 calling +++ MSTLSAPI.DLL::Ordinal_134 calling @@ -1,0 +2 @@ +RPCServiceStartThread ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-15T22:34:31