# nl_7623.dll-nl_8521.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [NlpValidateNTLMTargetInfoOld](#nlpvalidatentlmtargetinfoold) * [Added](#added) * [NlInitChangeLogServiceStart](#nlinitchangelogservicestart) * [wil_details_AreDependenciesEnabled](#wil_details_aredependenciesenabled) * [EnableMitigations](#enablemitigations) * [wil::details::EnabledStateManager::ProcessShutdown](#wildetailsenabledstatemanagerprocessshutdown) * [NetpLogonPutDomainSID](#netplogonputdomainsid) * [RtlStringCbCopyExW](#rtlstringcbcopyexw) * [RtlStringCopyWorkerW](#rtlstringcopyworkerw) * [API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL::SetProcessMitigationPolicy](#api-ms-win-core-processthreads-l1-1-1dllsetprocessmitigationpolicy) * [Modified](#modified) * [NetpLogonPutUnicodeString](#netplogonputunicodestring) * [NlDnsAddDomainRecords](#nldnsadddomainrecords) * [wil::details::EnabledStateManager::~EnabledStateManager](#wildetailsenabledstatemanagerenabledstatemanager) * [NlChangePassword](#nlchangepassword) * [NlNetlogonMain](#nlnetlogonmain) * [NlDnsUpdateRequestWorker](#nldnsupdaterequestworker) * [wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl](#wildetailsenabledstatemanagerensuresubscribedtofeatureconfigurationchangesimpl) * [NetpDcBuildPing](#netpdcbuildping) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingheaderinternalapi) * [wil::details::WilApiImpl_RecordFeatureUsage](#wildetailswilapiimpl_recordfeatureusage) * [NlDnsUpdate](#nldnsupdate) * [wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure](#wildetailsthreadfailurecallbackholdergetcontextandnotifyfailure) * [NlpLogonSamLogon](#nlplogonsamlogon) * [PrimaryQueryHandler](#primaryqueryhandler) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [NlGetLocalPingResponse](#nlgetlocalpingresponse) * [NlpUserValidate](#nlpuservalidate) * [wil::details::EnabledStateManager::OnStateChange](#wildetailsenabledstatemanageronstatechange) * [wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''](#wildetailsdynamic_atexit_destructor_for_g_enabledstatemanager) * [BuildSamLogonResponse](#buildsamlogonresponse) * [NetpLogonPutBytes](#netplogonputbytes) * [Modified (No Code Changes)](#modified-no-code-changes) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [LSASRV.DLL::LsaIFilterInboundNamespace](#lsasrvdlllsaifilterinboundnamespace) * [LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult](#lsasrvdlllsaifreefilterinboundnamespaceresult) * [NlFindNetbiosDomain](#nlfindnetbiosdomain) * [~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__tp_timer___ptr64void___cdeclstruct__tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64struct_wistdintegral_constantunsigned___int640struct__tp_timer___ptr64struct__tp_timer___ptr640stdnullptr_t_) * [destroy](#destroy) * [NlpMapSecureChannelTypeToString](#nlpmapsecurechanneltypetostring) * [WilApi_RecordFeatureUsage](#wilapi_recordfeatureusage) * [NetpULongPtrRoundUp](#netpulongptrroundup) * [NetpIpAddressToWStr](#netpipaddresstowstr) * [LSASRV.DLL::LsaIFreeHeap](#lsasrvdlllsaifreeheap) * [reset](#reset) * [NTDLL.DLL::RtlLeaveCriticalSection](#ntdlldllrtlleavecriticalsection) * [NlpRemoveBadPasswordCacheEntry](#nlpremovebadpasswordcacheentry) * [API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError](#api-ms-win-core-errorhandling-l1-1-0dllgetlasterror) * [LSASRV.DLL::LsaIExtractTargetInfo](#lsasrvdlllsaiextracttargetinfo) * [NlpGetClientAddress](#nlpgetclientaddress) * [NTDLL.DLL::RtlEnterCriticalSection](#ntdlldllrtlentercriticalsection) * [__GSHandlerCheck](#__gshandlercheck) * [NlPrintRoutine](#nlprintroutine) * [NlpZeroBadPasswordCountLocally](#nlpzerobadpasswordcountlocally) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [NTDLL.DLL::RtlInitUnicodeString](#ntdlldllrtlinitunicodestring) * [__security_check_cookie](#__security_check_cookie) * [RtlStringCchCopyW](#rtlstringcchcopyw) * [~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [NlpLogFilterInboundNamespaceBlockEvent](#nlplogfilterinboundnamespaceblockevent) * [FreeValidationInformation](#freevalidationinformation) * [DNSAPI.DLL::DnsNameCompare_UTF8](#dnsapidlldnsnamecompare_utf8) * [NlPrintCsRoutine](#nlprintcsroutine) * [NlFindDnsDomain](#nlfinddnsdomain) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc](#api-ms-win-core-heap-l2-1-0dlllocalalloc) * [NlpMapFilterInboundNamespaceReasonToString](#nlpmapfilterinboundnamespacereasontostring) # Visual Chart Diff ```mermaid flowchart LR NetpLogonPutUnicodeString-3-old<--Match 41%-->NetpLogonPutUnicodeString-3-new NlDnsAddDomainRecords-4-old<--Match 32%-->NlDnsAddDomainRecords-4-new wildetailsEnabledStateManagerEnabledStateManager-1-old<--Match 53%-->wildetailsEnabledStateManagerEnabledStateManager-1-new NlChangePassword-4-old<--Match 71%-->NlChangePassword-4-new NlNetlogonMain-0-old<--Match 90%-->NlNetlogonMain-0-new NlDnsUpdateRequestWorker-0-old<--Match 61%-->NlDnsUpdateRequestWorker-0-new wildetailsEnabledStateManagerEnsureSubscribedToFeatureConfigurationChangesImpl-1-old<--Match 97%-->wildetailsEnabledStateManagerEnsureSubscribedToFeatureConfigurationChangesImpl-1-new NetpDcBuildPing-10-old<--Match 54%-->NetpDcBuildPing-10-new wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-old<--Match 92%-->wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-new wildetailsWilApiImpl_RecordFeatureUsage-4-old<--Match 88%-->wildetailsWilApiImpl_RecordFeatureUsage-4-new NlDnsUpdate-4-old<--Match 41%-->NlDnsUpdate-4-new wildetailsThreadFailureCallbackHolderGetContextAndNotifyFailure-3-old<--Match 94%-->wildetailsThreadFailureCallbackHolderGetContextAndNotifyFailure-3-new NlpLogonSamLogon-12-old<--Match 54%-->NlpLogonSamLogon-12-new PrimaryQueryHandler-11-old<--Match 92%-->PrimaryQueryHandler-11-new wil_details_GetCurrentFeatureEnabledState-2-old<--Match 56%-->wil_details_GetCurrentFeatureEnabledState-2-new NlGetLocalPingResponse-16-old<--Match 12%-->NlGetLocalPingResponse-16-new NlpUserValidate-18-old<--Match 74%-->NlpUserValidate-18-new wildetailsEnabledStateManagerOnStateChange-1-old<--Match 96%-->wildetailsEnabledStateManagerOnStateChange-1-new wildetailsdynamic_atexit_destructor_for_g_enabledStateManager-0-old<--Match 33%-->wildetailsdynamic_atexit_destructor_for_g_enabledStateManager-0-new BuildSamLogonResponse-10-old<--Match 15%-->BuildSamLogonResponse-10-new NetpLogonPutBytes-3-old<--Match 28%-->NetpLogonPutUnicodeStringOld-3-new subgraph nl_8521.dll NetpLogonPutUnicodeString-3-new NlDnsAddDomainRecords-4-new wildetailsEnabledStateManagerEnabledStateManager-1-new NlChangePassword-4-new NlNetlogonMain-0-new NlDnsUpdateRequestWorker-0-new wildetailsEnabledStateManagerEnsureSubscribedToFeatureConfigurationChangesImpl-1-new NetpDcBuildPing-10-new wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-new wildetailsWilApiImpl_RecordFeatureUsage-4-new NlDnsUpdate-4-new wildetailsThreadFailureCallbackHolderGetContextAndNotifyFailure-3-new NlpLogonSamLogon-12-new PrimaryQueryHandler-11-new wil_details_GetCurrentFeatureEnabledState-2-new NlGetLocalPingResponse-16-new NlpUserValidate-18-new wildetailsEnabledStateManagerOnStateChange-1-new wildetailsdynamic_atexit_destructor_for_g_enabledStateManager-0-new BuildSamLogonResponse-10-new NetpLogonPutUnicodeStringOld-3-new subgraph Added direction LR NlInitChangeLogServiceStart wil_details_AreDependenciesEnabled EnableMitigations wil-details-EnabledStateManager-ProcessShutdown NetpLogonPutDomainSID RtlStringCbCopyExW RtlStringCopyWorkerW API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1DLL-SetProcessMitigationPolicy end end subgraph nl_7623.dll NetpLogonPutUnicodeString-3-old NlDnsAddDomainRecords-4-old wildetailsEnabledStateManagerEnabledStateManager-1-old NlChangePassword-4-old NlNetlogonMain-0-old NlDnsUpdateRequestWorker-0-old wildetailsEnabledStateManagerEnsureSubscribedToFeatureConfigurationChangesImpl-1-old NetpDcBuildPing-10-old wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-old wildetailsWilApiImpl_RecordFeatureUsage-4-old NlDnsUpdate-4-old wildetailsThreadFailureCallbackHolderGetContextAndNotifyFailure-3-old NlpLogonSamLogon-12-old PrimaryQueryHandler-11-old wil_details_GetCurrentFeatureEnabledState-2-old NlGetLocalPingResponse-16-old NlpUserValidate-18-old wildetailsEnabledStateManagerOnStateChange-1-old wildetailsdynamic_atexit_destructor_for_g_enabledStateManager-0-old BuildSamLogonResponse-10-old NetpLogonPutBytes-3-old subgraph Deleted direction LR NlpValidateNTLMTargetInfoOld end end ``` ```mermaid pie showData title Function Matches - 99.7998% "unmatched_funcs_len" : 9 "matched_funcs_len" : 4486 ``` ```mermaid pie showData title Matched Function Similarity - 98.4396% "matched_funcs_with_code_changes_len" : 21 "matched_funcs_with_non_code_changes_len" : 49 "matched_funcs_no_changes_len" : 4416 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 nl_7623.dll nl_8521.dll ``` #### Verbose Args
``` --old ['nl_7623.dll'] --new [['nl_8521.dll']] --engine VersionTrackingDiff --output-path nl_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/NetLogon.DLL/EEFC3DCC101000/NetLogon.DLL -O netlogon.dll.x64.10.0.26100.7623 wget https://msdl.microsoft.com/download/symbols/NetLogon.DLL/AD512EF1101000/NetLogon.DLL -O netlogon.dll.x64.10.0.26100.8521 ``` ## Binary Metadata Diff ```diff --- nl_7623.dll Meta +++ nl_8521.dll Meta @@ -1,44 +1,44 @@ -Program Name: nl_7623.dll +Program Name: nl_8521.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 1058160 +# of Bytes: 1058088 # of Memory Blocks: 10 -# of Instructions: 134669 -# of Defined Data: 10459 -# of Functions: 2243 -# of Symbols: 26056 +# of Instructions: 134769 +# of Defined Data: 10423 +# of Functions: 2252 +# of Symbols: 26058 # of Data Types: 933 # of Data Type Categories: 48 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Tue Aug 18 23:49:52 SGT 2026 +Date Created: Tue Aug 18 23:49:56 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/nl/nl_7623.dll -Executable MD5: 747cae783db0c3061ca67587e937107e -Executable SHA256: bc121ba6fbdf7a9dcd5a17e5f9101a65f88c267271026a468f116fd189fc327d -FSRL: file:///tmp/nl/nl_7623.dll?MD5=747cae783db0c3061ca67587e937107e +Executable Location: /tmp/nl/nl_8521.dll +Executable MD5: fa719067a8057c89c49d4a224983e1c5 +Executable SHA256: 412f24dd12b61370a24df5859fe5872b5144425de67eaa9c24a1922e02d5a168 +FSRL: file:///tmp/nl/nl_8521.dll?MD5=fa719067a8057c89c49d4a224983e1c5 PDB Age: 1 PDB File: netlogon.pdb -PDB GUID: 8a309b38-dcf7-e33a-b7e2-77b7ea9e2846 +PDB GUID: 7b98a3f6-3113-b6f2-0061-35ca2178c053 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Net Logon Services DLL -PE Property[FileVersion]: 10.0.26100.7623 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) PE Property[InternalName]: NetLogon.DLL PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: NetLogon.DLL PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7623 +PE Property[ProductVersion]: 10.0.26100.8521 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra nl_7623.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra nl_7623.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra nl_7623.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra nl_8521.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra nl_8521.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra nl_8521.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|8| |deleted_funcs_len|1| |modified_funcs_len|70| |added_symbols_len|55| |deleted_symbols_len|65| |diff_time|13.338533401489258| |deleted_strings_len|0| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 2209, 'ExternalsName': 627, 'BulkBasicBlockMnemonicHash': 12, 'SigCallingCalledHasher': 6, 'ExactInstructionsFunctionHasher': 5, 'ExactBytesFunctionHasher': 1, 'BSIM': 1, 'Implied Match': 1})| |items_to_process|199| |diff_types|Counter({'address': 67, 'refcount': 52, 'calling': 37, 'code': 21, 'length': 21, 'called': 18, 'sig': 16, 'name': 10, 'fullname': 10})| |unmatched_funcs_len|9| |total_funcs_len|4495| |matched_funcs_len|4486| |matched_funcs_with_code_changes_len|21| |matched_funcs_with_non_code_changes_len|49| |matched_funcs_no_changes_len|4416| |match_func_similarity_percent|98.4396%| |func_match_overall_percent|99.7998%| |first_matches|Counter({'SymbolsHash': 2209, 'BulkBasicBlockMnemonicHash': 12, 'SigCallingCalledHasher': 6, 'ExactInstructionsFunctionHasher': 5, 'ExactBytesFunctionHasher': 1, 'BSIM': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 2209 "ExternalsName" : 627 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 5 "BSIM" : 1 "SigCallingCalledHasher" : 6 "BulkBasicBlockMnemonicHash" : 12 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2209 "ExactBytesFunctionHasher" : 1 "ExactInstructionsFunctionHasher" : 5 "BSIM" : 1 "SigCallingCalledHasher" : 6 "BulkBasicBlockMnemonicHash" : 12 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 8 "deleted_funcs_len" : 1 "modified_funcs_len" : 70 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 55 "deleted_symbols_len" : 65 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 1 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1 @@ +u_ERROR:Failed_to ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_ERROR:Failed_to|1|EnableMitigations| # Deleted ## NlpValidateNTLMTargetInfoOld ### Function Meta |Key|nl_7623.dll| | :---: | :---: | |name|NlpValidateNTLMTargetInfoOld| |fullname|NlpValidateNTLMTargetInfoOld| |refcount|2| |length|944| |called|
Expand for full list:
LSASRV.DLL::LsaIExtractTargetInfo
LSASRV.DLL::LsaIFilterInboundNamespace
LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult
LSASRV.DLL::LsaIFreeHeap
NTDLL.DLL::RtlInitUnicodeString
NlPrintRoutine
NlpGetClientAddress
NlpLogFilterInboundNamespaceBlockEvent
NlpMapFilterInboundNamespaceReasonToString
NlpMapSecureChannelTypeToString
NlpVerifyTargetServerRODCCachabilityRtlStringCchCopyW
__security_check_cookie
memset
| |calling|NlpLogonSamLogon| |paramcount|4| |address|18003b528| |sig|uint __fastcall NlpValidateNTLMTargetInfoOld(int param_1, longlong param_2, longlong param_3, longlong param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- NlpValidateNTLMTargetInfoOld +++ NlpValidateNTLMTargetInfoOld @@ -1,150 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -uint NlpValidateNTLMTargetInfoOld(int param_1,longlong param_2,longlong param_3,longlong param_4) - -{ - uint uVar1; - long lVar2; - undefined8 *puVar3; - wchar_t *pwVar4; - wchar_t *pwVar5; - wchar_t **ppwVar6; - undefined1 auStackY_1b8 [32]; - wchar_t *local_148; - int *local_140; - int local_138 [2]; - undefined8 local_130; - wchar_t *pwStack_128; - undefined8 local_120; - undefined8 uStack_118; - short *local_110; - ulonglong local_108; - longlong local_100; - undefined8 local_f8; - undefined8 uStack_f0; - short local_e8 [72]; - ulonglong local_58; - - local_58 = __security_cookie ^ (ulonglong)auStackY_1b8; - local_108 = (ulonglong)(uint)local_108; - local_138[1] = 0; - local_148 = (wchar_t *)0x0; - local_140 = (int *)0x0; - local_110 = (short *)((ulonglong)local_110 & 0xffffffff00000000); - local_f8 = 0; - uStack_f0 = 0; - local_130 = 0; - pwStack_128 = (wchar_t *)0x0; - local_120 = 0; - uStack_118 = 0; - memset(local_e8,0,0x82); - RtlInitUnicodeString(&local_f8,L"NTLM"); - local_108 = 2; - ppwVar6 = &local_148; - pwVar4 = (wchar_t *)0x10; - local_100 = param_3; - uVar1 = LsaIExtractTargetInfo(&local_f8,&local_108); - if ((int)uVar1 < 0) { - pwVar4 = L"LsaIExtractTargetInfo failed for Status:0x%x\n"; -LAB_18003b5ef: - NlPrintRoutine(4,pwVar4,(ulonglong)uVar1,ppwVar6); - goto LAB_18003b894; - } - if (local_148 == (wchar_t *)0x0) { - pwVar5 = - L"LsaIExtractTargetInfo succeeded but returned NULL target info; assuming NTLMv1 - no filtering will be done\n" - ; - } - else { - if ((*(short **)(local_148 + 8) != (short *)0x0) && (**(short **)(local_148 + 8) != 0)) { - local_130 = 0x28; - if (param_1 - 3U < 2) { - pwStack_128 = (wchar_t *)(param_2 + 0x80); - } - else { - pwStack_128 = (wchar_t *)0x0; - } - local_120 = 0; - uStack_118 = *(undefined8 *)(local_148 + 8); - local_110 = *(short **)(local_148 + 0x10); - if ((local_110 != (short *)0x0) && (*local_110 == 0)) { - local_110 = (short *)0x0; - } - ppwVar6 = (wchar_t **)0x0; - pwVar4 = pwStack_128; - NlPrintRoutine(4, - L"Calling LsaIFilterInboundNamespace for TrustName:\'%wZ\' Flags:0x%x MsvAvNbDomainName:\'%ws\' MsvAvDnsDomainName:\'%ws\'\n" - ,pwStack_128,0); - puVar3 = &local_130; - uVar1 = LsaIFilterInboundNamespace(puVar3,&local_140); - if ((int)uVar1 < 0) { - pwVar4 = L"LsaIFilterInboundNamespace failed Status:0x%x\n"; - goto LAB_18003b5ef; - } - if (local_140 == (int *)0x0) { - pwVar5 = L"LsaIFilterInboundNamespace LSADB extension did not exist or not supported.\n"; - goto LAB_18003b88f; - } - if (*local_140 == 0) { - NlPrintRoutine(4,L"LsaIFilterInboundNamespace succeeded - FilterInboundNamespaceSucceeded\n" - ,pwVar4,ppwVar6); -LAB_18003b6f3: - if (param_1 != 7) goto LAB_18003b894; - ppwVar6 = (wchar_t **)local_138; - local_138[0] = 0; - pwVar4 = local_148; - uVar1 = NlpVerifyTargetServerRODCCachability - (param_4,param_2,(longlong)local_148,(undefined4 *)ppwVar6); - if ((int)uVar1 < 0) { - pwVar4 = L"NlpVerifyTargetServerRODCCachability failed Status:0x%x\n"; - goto LAB_18003b5ef; - } - if (local_138[0] != 0) { - pwVar5 = L"Resource server is verified as cachable on the RODC\n"; - goto LAB_18003b88f; - } - lVar2 = NlpGetClientAddress(param_4,local_e8); - if (lVar2 < 0) { - pwVar4 = L"Unknown IP"; - RtlStringCchCopyW(local_e8,0x41,0x1800a5390); - } - NlPrintRoutine(4,L"Resource server is not cachable on the RODC - rejecting request\n",pwVar4 - ,ppwVar6); - NlpLogFilterInboundNamespaceBlockEvent - (*(LPCWSTR *)(param_3 + 0x28),param_2,local_e8,7,0,(longlong)local_148); - } - else { - uVar1 = NlpGetClientAddress(puVar3,local_e8); - if ((int)uVar1 < 0) { - RtlStringCchCopyW(local_e8,0x41,0x1800a5390); - } - NlpMapSecureChannelTypeToString(param_1); - pwVar4 = L"TRUE"; - if (local_140[1] == 0) { - pwVar4 = L"FALSE"; - } - pwVar5 = NlpMapFilterInboundNamespaceReasonToString(*local_140); - NlPrintRoutine(4, - L"LsaIFilterInboundNamespace rejected the request Reason:\'%ws\' AdminOverride:%ws TrustName:\'%wZ\' Account:\'%wZ\' SCType:%ws Flags:0x%x MsvAvNbDomainName:\'%ws\' MsvAvDnsDomainName:\'%ws\' ClientIP:\'%ws\' MsvAvNbComputerName:\'%ws\' MsvAvDnsComputerName:\'%ws\'\n" - ,pwVar5,pwVar4); - NlpLogFilterInboundNamespaceBlockEvent - (*(LPCWSTR *)(param_3 + 0x28),param_2,local_e8,*local_140,local_140[1], - (longlong)local_148); - if (local_140[1] != 0) goto LAB_18003b6f3; - } - uVar1 = 0xc0000022; - goto LAB_18003b894; - } - pwVar5 = - L"LsaIExtractTargetInfo did not return a Netbios resource server domain name for - no filtering will be done\n" - ; - } -LAB_18003b88f: - NlPrintRoutine(4,pwVar5,pwVar4,ppwVar6); -LAB_18003b894: - LsaIFreeHeap(local_148); - LsaIFreeFilterInboundNamespaceResult(local_140); - return uVar1; -} - ``` # Added ## NlInitChangeLogServiceStart ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|NlInitChangeLogServiceStart| |fullname|NlInitChangeLogServiceStart| |refcount|2| |length|106| |called|LSASRV.DLL::LsaIRegisterPolicyChangeNotificationCallback
NlPrintRoutine| |calling|NlNetlogonMain| |paramcount|4| |address|180027178| |sig|uint __fastcall NlInitChangeLogServiceStart(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- NlInitChangeLogServiceStart +++ NlInitChangeLogServiceStart @@ -0,0 +1,27 @@ + +uint NlInitChangeLogServiceStart + (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4) + +{ + uint uVar1; + + if (NlGlobalChangeLogPolicyNotificationRegistered == 0) { + uVar1 = LsaIRegisterPolicyChangeNotificationCallback(I_NetNotifyLsaPolicyChange,4); + if ((int)uVar1 < 0) { + NlPrintRoutine(0x100, + L"NlInitChangeLogServiceInit: LsaIRegisterPolicyChangeNotificationCallback failed Status:%lX\n" + ,(ulonglong)uVar1,param_4); + } + else { + NlGlobalChangeLogPolicyNotificationRegistered = 1; + } + } + else { + NlPrintRoutine(1, + L"NlInitChangeLogServiceInit: policy notification registered on previous service start, nothing to do\n" + ,param_3,param_4); + uVar1 = 0; + } + return uVar1; +} + ``` ## wil_details_AreDependenciesEnabled ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|wil_details_AreDependenciesEnabled| |fullname|wil_details_AreDependenciesEnabled| |refcount|2| |length|150| |called|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|1| |address|18002e708| |sig|int __fastcall wil_details_AreDependenciesEnabled(longlong param_1)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_AreDependenciesEnabled +++ wil_details_AreDependenciesEnabled @@ -0,0 +1,48 @@ + +int wil_details_AreDependenciesEnabled(longlong param_1) + +{ + uint uVar1; + undefined8 *puVar2; + int iVar3; + int iVar4; + longlong *plVar5; + ulonglong local_res8; + + plVar5 = *(longlong **)(param_1 + 0x20); + iVar3 = 1; + iVar4 = iVar3; + if (plVar5 != (longlong *)0x0) { + do { + while( true ) { + puVar2 = (undefined8 *)*plVar5; + if (puVar2 == (undefined8 *)0x0) { + return iVar3; + } + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) break; + if ((iVar3 == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + return 0; + } + iVar3 = 1; + plVar5 = plVar5 + 1; + } + uVar1 = *(uint *)*puVar2; + local_res8 = (ulonglong)uVar1; + if ((uVar1 & 2) == 0) { + local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState + ((uint *)*puVar2,local_res8,(longlong)puVar2); + } + if ((iVar3 == 0) || ((local_res8 & 1) == 0)) { + iVar3 = 0; + } + else { + iVar3 = 1; + } + plVar5 = plVar5 + 1; + iVar4 = 0; + } while (iVar3 != 0); + } + return iVar4; +} + ``` ## EnableMitigations ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|EnableMitigations| |fullname|EnableMitigations| |refcount|2| |length|80| |called|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL::SetProcessMitigationPolicy
NlPrintRoutine| |calling|NlNetlogonMain| |paramcount|0| |address|18006bb84| |sig|undefined __fastcall EnableMitigations(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- EnableMitigations +++ EnableMitigations @@ -0,0 +1,19 @@ + +void EnableMitigations(void) + +{ + int iVar1; + DWORD DVar2; + undefined8 in_R9; + undefined4 local_res8 [8]; + + local_res8[0] = 1; + iVar1 = SetProcessMitigationPolicy(0x10,local_res8); + if (iVar1 == 0) { + DVar2 = GetLastError(); + NlPrintRoutine(0x100,L"ERROR:Failed to set EnforceRedirectionTrust with error %d\n", + (ulonglong)DVar2,in_R9); + } + return; +} + ``` ## wil::details::EnabledStateManager::ProcessShutdown ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|ProcessShutdown| |fullname|wil::details::EnabledStateManager::ProcessShutdown| |refcount|3| |length|175| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::WilApi_RecordFeatureUsage
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>
wil_details_RecordCachedUsage| |calling|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|1800744d8| |sig|void __thiscall ProcessShutdown(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::ProcessShutdown +++ wil::details::EnabledStateManager::ProcessShutdown @@ -0,0 +1,44 @@ + +/* public: void __cdecl wil::details::EnabledStateManager::ProcessShutdown(void) __ptr64 */ + +void __thiscall wil::details::EnabledStateManager::ProcessShutdown(EnabledStateManager *this) + +{ + EnabledStateManager *SRWLock; + undefined4 *puVar1; + undefined4 *puVar2; + char *in_R9; + undefined8 local_res8; + EnabledStateManager *local_res10; + + *(undefined4 *)this = 0; + SRWLock = this + 8; + local_res8 = *(undefined8 *)(this + 0x10); + *(undefined8 *)(this + 0x10) = 0; + AcquireSRWLockExclusive((PSRWLOCK)SRWLock); + puVar1 = *(undefined4 **)(this + 0x28); + puVar2 = *(undefined4 **)(this + 0x20); + local_res10 = SRWLock; + if (0xf < (ulonglong)((longlong)puVar1 - (longlong)puVar2)) { + for (; puVar2 != puVar1; puVar2 = puVar2 + 4) { + wil_details_RecordCachedUsage(*puVar2,*(uint **)(puVar2 + 2)); + } + *(undefined8 *)(this + 0x28) = *(undefined8 *)(this + 0x20); + WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res10); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)&local_res8,(_TP_TIMER *)0x0); + unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> + *)&local_res8); + return; +} + ``` ## NetpLogonPutDomainSID ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|NetpLogonPutDomainSID| |fullname|NetpLogonPutDomainSID| |refcount|2| |length|114| |called|NetpULongPtrRoundUp
memmove| |calling|NetpDcBuildPing| |paramcount|3| |address|180088e84| |sig|undefined __fastcall NetpLogonPutDomainSID(void * param_1, uint param_2, ulonglong * param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- NetpLogonPutDomainSID +++ NetpLogonPutDomainSID @@ -0,0 +1,21 @@ + +void NetpLogonPutDomainSID(void *param_1,uint param_2,ulonglong *param_3) + +{ + undefined1 *_Dst; + size_t _Size; + undefined1 *local_res20; + + if (param_2 != 0) { + local_res20 = (undefined1 *)0x0; + _Size = (size_t)param_2; + NetpULongPtrRoundUp(*param_3,4,(ulonglong *)&local_res20); + for (_Dst = (undefined1 *)*param_3; _Dst < local_res20; _Dst = _Dst + 1) { + *_Dst = 0; + } + memmove(_Dst,param_1,_Size); + *param_3 = (ulonglong)(_Dst + _Size); + } + return; +} + ``` ## RtlStringCbCopyExW ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|RtlStringCbCopyExW| |fullname|RtlStringCbCopyExW| |refcount|2| |length|115| |called|RtlStringCopyWorkerW| |calling|NetpLogonPutUnicodeString| |paramcount|4| |address|180089104| |sig|uint __fastcall RtlStringCbCopyExW(short * param_1, ulonglong param_2, longlong param_3, longlong * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RtlStringCbCopyExW +++ RtlStringCbCopyExW @@ -0,0 +1,25 @@ + +uint RtlStringCbCopyExW(short *param_1,ulonglong param_2,longlong param_3,longlong *param_4) + +{ + uint uVar1; + ulonglong uVar2; + longlong local_res10; + + uVar2 = param_2 >> 1; + if (uVar2 - 1 < 0x7fffffff) { + local_res10 = 0; + uVar1 = RtlStringCopyWorkerW(param_1,uVar2,&local_res10,param_3); + if (((-1 < (int)uVar1) || (uVar1 == 0x80000005)) && (param_4 != (longlong *)0x0)) { + *param_4 = (longlong)(param_1 + local_res10); + } + } + else { + uVar1 = 0xc000000d; + if (uVar2 != 0) { + *param_1 = 0; + } + } + return uVar1; +} + ``` ## RtlStringCopyWorkerW ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|RtlStringCopyWorkerW| |fullname|RtlStringCopyWorkerW| |refcount|2| |length|115| |called|| |calling|RtlStringCbCopyExW| |paramcount|4| |address|180089180| |sig|uint __fastcall RtlStringCopyWorkerW(short * param_1, longlong param_2, longlong * param_3, longlong param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- RtlStringCopyWorkerW +++ RtlStringCopyWorkerW @@ -0,0 +1,38 @@ + +uint RtlStringCopyWorkerW(short *param_1,longlong param_2,longlong *param_3,longlong param_4) + +{ + short sVar1; + longlong lVar2; + short *psVar3; + longlong lVar4; + longlong lVar5; + + lVar5 = 0; + if (param_2 != 0) { + lVar2 = 0x7ffffffe; + lVar4 = param_4 - (longlong)param_1; + do { + if ((lVar2 == 0) || (sVar1 = *(short *)(lVar4 + (longlong)param_1), sVar1 == 0)) break; + *param_1 = sVar1; + lVar2 = lVar2 + -1; + param_1 = param_1 + 1; + lVar5 = lVar5 + 1; + param_2 = param_2 + -1; + } while (param_2 != 0); + } + psVar3 = param_1 + -1; + if (param_2 != 0) { + psVar3 = param_1; + } + *psVar3 = 0; + if (param_3 != (longlong *)0x0) { + lVar2 = lVar5 + -1; + if (param_2 != 0) { + lVar2 = lVar5; + } + *param_3 = lVar2; + } + return ~-(uint)(param_2 != 0) & 0x80000005; +} + ``` ## API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL::SetProcessMitigationPolicy ### Function Meta |Key|nl_8521.dll| | :---: | :---: | |name|SetProcessMitigationPolicy| |fullname|API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL::SetProcessMitigationPolicy| |refcount|2| |length|0| |called|| |calling|EnableMitigations| |paramcount|0| |address|EXTERNAL:000000ef| |sig|undefined SetProcessMitigationPolicy(void)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1.DLL::SetProcessMitigationPolicy* # Modified *Modified functions contain code changes* ## NetpLogonPutUnicodeString ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.14| |i_ratio|0.2| |m_ratio|0.99| |b_ratio|0.41| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NetpLogonPutUnicodeString|NetpLogonPutUnicodeString| |fullname|NetpLogonPutUnicodeString|NetpLogonPutUnicodeString| |refcount|9|9| |`length`|129|136| |`called`|NetpULongPtrRoundUp|NetpULongPtrRoundUp
RtlStringCbCopyExW| |calling|BuildSamLogonResponse
NetpDcBuildPing
PrimaryQueryHandler|BuildSamLogonResponse
NetpDcBuildPing
PrimaryQueryHandler| |paramcount|3|3| |`address`|180088f4c|180088f38| |`sig`|undefined __fastcall NetpLogonPutUnicodeString(wchar_t * param_1, uint param_2, ulonglong * param_3)|undefined8 __fastcall NetpLogonPutUnicodeString(wchar_t * param_1, uint param_2, ulonglong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NetpLogonPutUnicodeString Called Diff ```diff --- NetpLogonPutUnicodeString called +++ NetpLogonPutUnicodeString called @@ -1,0 +2 @@ +RtlStringCbCopyExW ``` ### NetpLogonPutUnicodeString Diff ```diff --- NetpLogonPutUnicodeString +++ NetpLogonPutUnicodeString @@ -1,38 +1,38 @@ -void NetpLogonPutUnicodeString(wchar_t *param_1,uint param_2,ulonglong *param_3) +undefined8 NetpLogonPutUnicodeString(wchar_t *param_1,uint param_2,ulonglong *param_3) { - wchar_t wVar1; - wchar_t *pwVar2; - longlong lVar3; - int iVar4; - ulonglong uVar5; - wchar_t *local_res8; + short *psVar1; + uint uVar2; + ulonglong uVar3; + wchar_t *pwVar4; + short *local_res20; + longlong local_18 [2]; - local_res8 = (wchar_t *)0x0; - uVar5 = (ulonglong)param_2; - pwVar2 = L""; - if (param_1 != (wchar_t *)0x0) { - pwVar2 = param_1; + local_res20 = (short *)0x0; + uVar3 = (ulonglong)param_2; + local_18[0] = 0; + if (1 < param_2) { + pwVar4 = L""; + if (param_1 != (wchar_t *)0x0) { + pwVar4 = param_1; + } + NetpULongPtrRoundUp(*param_3,2,(ulonglong *)&local_res20); + psVar1 = (short *)*param_3; + if (local_res20 != psVar1) { + *(undefined1 *)psVar1 = 0; + uVar2 = (int)local_res20 - (int)psVar1; + if ((uint)uVar3 < uVar2) { + return 0x57; + } + uVar3 = (ulonglong)((uint)uVar3 - uVar2); + } + uVar2 = RtlStringCbCopyExW(local_res20,uVar3 & 0xffffffff,(longlong)pwVar4,local_18); + if (-1 < (int)uVar2) { + *param_3 = local_18[0] + 2; + return 0; + } } - NetpULongPtrRoundUp(*param_3,2,(ulonglong *)&local_res8); - if (local_res8 != (wchar_t *)*param_3) { - *(undefined1 *)*param_3 = 0; - } - wVar1 = *pwVar2; - if (wVar1 != L'\0') { - lVar3 = (longlong)pwVar2 - (longlong)local_res8; - do { - iVar4 = (int)uVar5; - uVar5 = (ulonglong)(iVar4 - 1); - if (iVar4 == 0) break; - *local_res8 = wVar1; - local_res8 = local_res8 + 1; - wVar1 = *(wchar_t *)((longlong)local_res8 + lVar3); - } while (wVar1 != L'\0'); - } - *local_res8 = L'\0'; - *param_3 = (ulonglong)(local_res8 + 1); - return; + return 0x57; } ``` ## NlDnsAddDomainRecords ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.16| |i_ratio|0.36| |m_ratio|0.97| |b_ratio|0.32| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlDnsAddDomainRecords|NlDnsAddDomainRecords| |fullname|NlDnsAddDomainRecords|NlDnsAddDomainRecords| |refcount|4|4| |`length`|1595|1499| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
DNSAPI.DLL::DnsScreenLocalAddrsForRegistration
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpSockAddrToStr
NlDnsAddName
NlDnsGetIpAddress
NlDnsSetStateNlGetDomainFlags
NlPrintDnsRoutine
NlPrintDomRoutine
NlSitesGetCloseSites
__security_check_cookie
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
DNSAPI.DLL::DnsScreenLocalAddrsForRegistration
Feature_5977_1413__private_IsEnabledDeviceUsageNoInline
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpSockAddrToStr
NlDnsAddName
NlDnsGetIpAddressNlDnsSetState
NlGetDomainFlags
NlPrintDnsRoutine
NlPrintDomRoutine
NlSitesGetCloseSites
__security_check_cookie
| |calling|NlDereferenceDomain
NlDnsAddDomainRecordsWithSiteRefresh
NlUpdateRole|NlDereferenceDomain
NlDnsAddDomainRecordsWithSiteRefresh
NlUpdateRole| |paramcount|4|4| |`address`|180027fbc|180028114| |sig|uint __fastcall NlDnsAddDomainRecords(longlong param_1, uint param_2, undefined8 param_3, undefined8 * param_4)|uint __fastcall NlDnsAddDomainRecords(longlong param_1, uint param_2, undefined8 param_3, undefined8 * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlDnsAddDomainRecords Called Diff ```diff --- NlDnsAddDomainRecords called +++ NlDnsAddDomainRecords called @@ -4,0 +5 @@ +Feature_5977_1413__private_IsEnabledDeviceUsageNoInline ``` ### NlDnsAddDomainRecords Diff ```diff --- NlDnsAddDomainRecords +++ NlDnsAddDomainRecords @@ -1,236 +1,250 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ uint NlDnsAddDomainRecords(longlong param_1,uint param_2,undefined8 param_3,undefined8 *param_4) { - bool bVar1; + uint uVar1; uint uVar2; - int iVar3; - uint *hMem; - longlong lVar4; - ulonglong uVar5; + uint uVar3; + int iVar4; + longlong lVar5; ulonglong uVar6; - uint uVar7; - ulonglong uVar8; - uint unaff_EBX; - short *psVar9; - uint *puVar10; - HLOCAL hMem_00; - undefined8 *puVar11; - uint *puVar12; - longlong lVar13; + uint *puVar7; + short *psVar8; + longlong lVar9; + undefined8 *puVar10; + uint uVar11; + undefined **ppuVar12; + undefined8 *hMem; + uint uVar13; + int *piVar14; + uint *puVar15; + ulonglong uVar16; + uint *puVar17; undefined1 auStackY_108 [32]; - uint local_c4; + uint uVar18; uint local_c0; int local_bc; uint local_b8; - HLOCAL local_b0; + uint local_b4; + undefined8 *local_b0; uint *local_a8; uint *local_a0; - uint local_98; - uint *local_90; + int *local_98; undefined1 local_88 [80]; ulonglong local_38; local_38 = __security_cookie ^ (ulonglong)auStackY_108; - puVar10 = (uint *)0x0; + puVar7 = (uint *)0x0; local_c0 = 0; - local_b0 = (HLOCAL)0x0; - local_90 = (uint *)0x0; + local_b0 = (undefined8 *)0x0; + local_a0 = (uint *)0x0; local_a8 = (uint *)0x0; - local_a0 = (uint *)0x0; - local_b8 = 0; + local_98 = (int *)0x0; + local_b4 = 0; local_bc = DAT_0; uVar2 = NlDnsGetIpAddress(&local_c0,&local_b0); + uVar18 = 0; if (uVar2 != 0) { param_4 = (undefined8 *)(ulonglong)uVar2; NlPrintDomRoutine(0x100,param_1, L"NlDnsAddDomainRecords: Failed to get ip addresses that need to be registered %ld.\n" ,param_4); - } - hMem_00 = local_b0; + uVar18 = uVar2; + } + uVar3 = Feature_5977_1413__private_IsEnabledDeviceUsageNoInline(); + hMem = local_b0; uVar2 = local_c0; - hMem = puVar10; - if (local_c0 != 0) { - hMem = LocalAlloc(0x40,(ulonglong)local_c0 << 2); - local_a0 = hMem; - if (hMem == (uint *)0x0) { - if (hMem_00 == (HLOCAL)0x0) { - return unaff_EBX; + if ((uVar3 == 0) && (local_c0 != 0)) { + local_98 = LocalAlloc(0x40,(ulonglong)local_c0 << 2); + if (local_98 == (int *)0x0) { + if (hMem == (undefined8 *)0x0) { + return uVar18; } - LocalFree(hMem_00); - return unaff_EBX; - } - local_b8 = DnsScreenLocalAddrsForRegistration(hMem,hMem_00,uVar2); - if (local_b8 != 0) { - param_4 = (undefined8 *)(ulonglong)local_b8; + LocalFree(hMem); + return uVar18; + } + local_b4 = DnsScreenLocalAddrsForRegistration(local_98,hMem,uVar2); + if (local_b4 != 0) { + param_4 = (undefined8 *)(ulonglong)local_b4; NlPrintDomRoutine(1,param_1,L"Couldn\'t DnsScreenLocalAddrsForRegistration %ld 0x%lx.\n", param_4); } } RtlEnterCriticalSection(&NlGlobalDnsCritSect); - puVar11 = NlGlobalDnsList; + for (puVar10 = NlGlobalDnsList; (undefined8 **)puVar10 != &NlGlobalDnsList; + puVar10 = (undefined8 *)*puVar10) { + if (((puVar10[3] == param_1) && + (*(uint *)((longlong)puVar10 + 0x24) = *(uint *)((longlong)puVar10 + 0x24) | 1, + (param_2 & 4) != 0)) && (*(int *)(puVar10 + 0x1e) == 1)) { + NlDnsSetState((longlong)puVar10,0); + } + } + puVar15 = puVar7; + puVar17 = puVar7; + if ((*(byte *)(param_1 + 0x250) & 0x80) == 0) { + uVar3 = NlGetDomainFlags(param_1); + uVar2 = uVar3 | 0x10; + if ((*(uint *)(param_1 + 0x250) & 0x2000) == 0) { + uVar2 = uVar3; + } + uVar3 = NlSitesGetCloseSites(param_1,0x6000,(longlong *)&local_a0,param_4); + if (uVar3 != 0) { + param_4 = (undefined8 *)(ulonglong)uVar3; + NlPrintDomRoutine(1,param_1,L"Couldn\'t NlSitesGetCloseSites %ld 0x%lx.\n",param_4); + uVar18 = uVar3; + } + uVar3 = NlSitesGetCloseSites(param_1,0x8000,(longlong *)&local_a8,param_4); + if (uVar3 != 0) { + param_4 = (undefined8 *)(ulonglong)uVar3; + NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlSitesGetCloseSites (GcAtSite) %ld 0x%lx.\n", + param_4); + uVar18 = uVar3; + } + local_b8 = 0; + ppuVar12 = &NlDcDnsNameTypeDesc; + puVar10 = hMem; + do { + lVar9 = 0; + uVar3 = (uint)puVar7; + hMem = puVar10; + if ((*(uint *)((longlong)ppuVar12 + 0x14) & uVar2) != 0) { + uVar13 = 0; + RtlEnterCriticalSection(&NlGlobalParametersCritSect); + psVar8 = DAT_1; + uVar11 = uVar13; + if (DAT_1 != (short *)0x0) { + for (; *psVar8 != 0; psVar8 = psVar8 + ((int)lVar5 + 1)) { + iVar4 = _o__wcsicmp(psVar8,*ppuVar12 + 10); + if (iVar4 == 0) { + uVar11 = 1; + break; + } + lVar5 = -1; + do { + lVar5 = lVar5 + 1; + } while (psVar8[lVar5] != 0); + } + } + RtlLeaveCriticalSection(&NlGlobalParametersCritSect); + uVar1 = local_b8; + iVar4 = local_bc; + if (uVar11 == 0) { + if (*(short *)(ppuVar12 + 3) == 1) { + if (((DAT_2 != 0) && (DAT_1800f5208 == 0)) && (local_c0 != 0)) { + uVar16 = (ulonglong)local_c0; + piVar14 = local_98; + do { + if (((*(short *)*puVar10 == 2) || (*(short *)*puVar10 == 0x17)) && + ((uVar3 = Feature_5977_1413__private_IsEnabledDeviceUsageNoInline(), uVar3 != 0 + || ((local_b4 != 0 || (*piVar14 != 0)))))) { + param_4 = puVar10; + uVar6 = NlDnsAddName(param_1,uVar1,(LPCWSTR)0x0,puVar10,local_bc); + if ((uint)uVar6 != 0) { + local_88[0] = 0; + NetpSockAddrToStr(*puVar10,(ulonglong)*(uint *)(puVar10 + 1),local_88); + param_4 = (undefined8 *)*ppuVar12; + NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlDnsAddName (%ws %hs) %ld 0x%lx.\n" + ,param_4); + uVar18 = (uint)uVar6; + } + } + piVar14 = piVar14 + 1; + puVar10 = puVar10 + 2; + uVar16 = uVar16 - 1; + hMem = local_b0; + uVar3 = local_b8; + } while (uVar16 != 0); + } + } + else if (*(char *)((longlong)ppuVar12 + 0x1a) == '\0') { + if ((*(short *)(ppuVar12 + 3) == 5) || (DAT_3 == 0)) { + param_4 = (undefined8 *)0x0; + uVar16 = NlDnsAddName(param_1,uVar3,(LPCWSTR)0x0,(undefined8 *)0x0,local_bc); + if ((uint)uVar16 != 0) { + param_4 = (undefined8 *)*ppuVar12; + NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlDnsAddName (%ws) %ld 0x%lx.\n",param_4 + ); + uVar18 = (uint)uVar16; + } + } + } + else if (*(int *)((longlong)ppuVar12 + 0x14) == 4) { + puVar7 = local_a8; + if (local_a8 != (uint *)0x0) { +LAB_4: + lVar9 = *(longlong *)(puVar7 + 2); + uVar13 = *puVar7; + } + if (uVar13 != 0) { + puVar10 = (undefined8 *)(lVar9 + 8); + uVar16 = (ulonglong)uVar13; + do { + param_4 = (undefined8 *)0x0; + uVar6 = NlDnsAddName(param_1,uVar3,(LPCWSTR)*puVar10,(undefined8 *)0x0,iVar4); + if ((uint)uVar6 != 0) { + param_4 = (undefined8 *)*ppuVar12; + NlPrintDomRoutine(1,param_1,L"Couldn\'t NlDnsAddName (%ws %ws) %ld 0x%lx.\n", + param_4); + uVar18 = (uint)uVar6; + } + puVar10 = puVar10 + 2; + uVar16 = uVar16 - 1; + hMem = local_b0; + } while (uVar16 != 0); + } + } + else { + puVar7 = local_a0; + if (local_a0 != (uint *)0x0) goto LAB_4; + } + } + else { + param_4 = (undefined8 *)*ppuVar12; + NlPrintDomRoutine(0x4000,param_1, + L"NlDnsAddDomainRecords: Skipping name %ws (per registry)\n",param_4); + } + } + local_b8 = uVar3 + 1; + puVar7 = (uint *)(ulonglong)local_b8; + ppuVar12 = ppuVar12 + 4; + puVar10 = hMem; + puVar15 = local_a8; + puVar17 = local_a0; + } while (local_b8 < 0x28); + } + puVar10 = NlGlobalDnsList; if ((undefined8 **)NlGlobalDnsList != &NlGlobalDnsList) { do { - if (((puVar11[3] == param_1) && - (*(uint *)((longlong)puVar11 + 0x24) = *(uint *)((longlong)puVar11 + 0x24) | 1, - (param_2 & 4) != 0)) && (*(int *)(puVar11 + 0x1e) == 1)) { - NlDnsSetState((longlong)puVar11,0); + if ((*(int *)(puVar10 + 0x1e) != 4) && (puVar10[3] == param_1)) { + if ((*(byte *)((longlong)puVar10 + 0x24) & 1) != 0) { + NlPrintDnsRoutine(0x4000,(longlong)puVar10,L"NlDnsAddDomainRecords: marked for deregister" + ,param_4); + NlDnsSetState((longlong)puVar10,2); + } + if ((*(byte *)(param_1 + 0x250) & 0x80) != 0) { + puVar10[3] = 0; + } } - puVar11 = (undefined8 *)*puVar11; - hMem_00 = local_b0; - } while ((undefined8 **)puVar11 != &NlGlobalDnsList); - } - puVar12 = puVar10; - if ((*(byte *)(param_1 + 0x250) & 0x80) == 0) { - uVar2 = NlGetDomainFlags(param_1); - local_98 = uVar2 | 0x10; - if ((*(uint *)(param_1 + 0x250) & 0x2000) == 0) { - local_98 = uVar2; - } - uVar2 = NlSitesGetCloseSites(param_1,0x6000,(longlong *)&local_90,param_4); - if (uVar2 != 0) { - param_4 = (undefined8 *)(ulonglong)uVar2; - NlPrintDomRoutine(1,param_1,L"Couldn\'t NlSitesGetCloseSites %ld 0x%lx.\n",param_4); - } - uVar2 = NlSitesGetCloseSites(param_1,0x8000,(longlong *)&local_a8,param_4); - if (uVar2 != 0) { - param_4 = (undefined8 *)(ulonglong)uVar2; - NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlSitesGetCloseSites (GcAtSite) %ld 0x%lx.\n", - param_4); - } - local_c4 = 0; - uVar8 = 0; - puVar10 = local_a8; - while (uVar2 = (uint)uVar8, puVar12 = local_90, hMem = local_a0, uVar2 < 0x28) { - lVar13 = uVar8 * 0x20; - if ((*(uint *)(&DAT_1 + lVar13) & local_98) != 0) { - bVar1 = false; - RtlEnterCriticalSection(); - psVar9 = DAT_2; - if (DAT_2 != (short *)0x0) { - for (; *psVar9 != 0; psVar9 = psVar9 + ((int)lVar4 + 1)) { - iVar3 = _o__wcsicmp(); - if (iVar3 == 0) { - bVar1 = true; - break; - } - lVar4 = -1; - do { - lVar4 = lVar4 + 1; - } while (psVar9[lVar4] != 0); - } - } - RtlLeaveCriticalSection(&NlGlobalParametersCritSect); - iVar3 = local_bc; - uVar6 = 0; - if (bVar1) { - param_4 = (undefined8 *)(&NlDcDnsNameTypeDesc)[uVar8 * 4]; - NlPrintDomRoutine(0x4000,param_1, - L"NlDnsAddDomainRecords: Skipping name %ws (per registry)\n",param_4); - } - else { - uVar7 = 0; - if (*(short *)(&DAT_3 + uVar8 * 4) == 1) { - if ((DAT_4 != 0) && (DAT_1800f5268 == 0)) { - for (; uVar2 = local_c4, (uint)uVar6 < local_c0; uVar6 = (ulonglong)((uint)uVar6 + 1)) - { - puVar11 = (undefined8 *)(uVar6 * 0x10 + (longlong)hMem_00); - if ((((*(short *)*puVar11 == 2) || (*(short *)*puVar11 == 0x17)) && - ((local_b8 != 0 || (local_a0[uVar6] != 0)))) && - (param_4 = puVar11, - uVar5 = NlDnsAddName(param_1,local_c4,(LPCWSTR)0x0,puVar11,local_bc), - (int)uVar5 != 0)) { - local_88[0] = 0; - NetpSockAddrToStr(*puVar11,(ulonglong)*(uint *)(puVar11 + 1),local_88); - param_4 = (undefined8 *)(&NlDcDnsNameTypeDesc)[uVar8 * 4]; - NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlDnsAddName (%ws %hs) %ld 0x%lx.\n", - param_4); - } - } - } - } - else if (*(char *)((longlong)&DAT_3 + lVar13 + 2) == '\0') { - if ((*(short *)(&DAT_3 + uVar8 * 4) == 5) || (DAT_1800f5268 == 0)) { - param_4 = (undefined8 *)0x0; - uVar6 = NlDnsAddName(param_1,uVar2,(LPCWSTR)0x0,(undefined8 *)0x0,local_bc); - if ((int)uVar6 != 0) { - param_4 = (undefined8 *)(&NlDcDnsNameTypeDesc)[uVar8 * 4]; - NlPrintDomRoutine(0x100,param_1,L"Couldn\'t NlDnsAddName (%ws) %ld 0x%lx.\n",param_4 - ); - } - } - } - else { - if (*(int *)(&DAT_1 + lVar13) == 4) { - if (puVar10 != (uint *)0x0) { - uVar6 = *(ulonglong *)(puVar10 + 2); - uVar7 = *puVar10; - } - } - else { - if (local_90 == (uint *)0x0) goto LAB_5; - uVar6 = *(ulonglong *)(local_90 + 2); - uVar7 = *local_90; - } - if (uVar7 != 0) { - puVar11 = (undefined8 *)(uVar6 + 8); - uVar6 = (ulonglong)uVar7; - do { - param_4 = (undefined8 *)0x0; - uVar5 = NlDnsAddName(param_1,local_c4,(LPCWSTR)*puVar11,(undefined8 *)0x0,iVar3); - if ((int)uVar5 != 0) { - param_4 = (undefined8 *)(&NlDcDnsNameTypeDesc)[uVar8 * 4]; - NlPrintDomRoutine(1,param_1,L"Couldn\'t NlDnsAddName (%ws %ws) %ld 0x%lx.\n", - param_4); - } - puVar11 = puVar11 + 2; - uVar6 = uVar6 - 1; - hMem_00 = local_b0; - puVar10 = local_a8; - uVar2 = local_c4; - } while (uVar6 != 0); - } - } - } - } -LAB_5: - local_c4 = uVar2 + 1; - uVar8 = (ulonglong)local_c4; - } - } - puVar11 = NlGlobalDnsList; - if ((undefined8 **)NlGlobalDnsList != &NlGlobalDnsList) { - do { - if ((*(int *)(puVar11 + 0x1e) != 4) && (puVar11[3] == param_1)) { - if ((*(byte *)((longlong)puVar11 + 0x24) & 1) != 0) { - NlPrintDnsRoutine(0x4000,(longlong)puVar11,L"NlDnsAddDomainRecords: marked for deregister" - ,param_4); - NlDnsSetState((longlong)puVar11,2); - } - if ((*(byte *)(param_1 + 0x250) & 0x80) != 0) { - puVar11[3] = 0; - } - } - puVar11 = (undefined8 *)*puVar11; - puVar10 = local_a8; - hMem = local_a0; - } while ((undefined8 **)puVar11 != &NlGlobalDnsList); + puVar10 = (undefined8 *)*puVar10; + puVar15 = local_a8; + } while ((undefined8 **)puVar10 != &NlGlobalDnsList); } RtlLeaveCriticalSection(&NlGlobalDnsCritSect); - if (hMem_00 != (HLOCAL)0x0) { - LocalFree(hMem_00); - } - if (puVar12 != (uint *)0x0) { - NetApiBufferFree(puVar12); - } - if (puVar10 != (uint *)0x0) { - NetApiBufferFree(puVar10); - } - if (hMem != (uint *)0x0) { + if (hMem != (undefined8 *)0x0) { LocalFree(hMem); } - return unaff_EBX; + if (puVar17 != (uint *)0x0) { + NetApiBufferFree(puVar17); + } + if (puVar15 != (uint *)0x0) { + NetApiBufferFree(puVar15); + } + uVar2 = Feature_5977_1413__private_IsEnabledDeviceUsageNoInline(); + if ((uVar2 == 0) && (local_98 != (int *)0x0)) { + LocalFree(local_98); + } + return uVar18; } ``` ## wil::details::EnabledStateManager::~EnabledStateManager ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.5| |i_ratio|0.25| |m_ratio|0.72| |b_ratio|0.53| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|~EnabledStateManager|~EnabledStateManager| |fullname|wil::details::EnabledStateManager::~EnabledStateManager|wil::details::EnabledStateManager::~EnabledStateManager| |refcount|2|2| |`length`|190|113| |`called`|wil::details::FreeProcessHeap
wil::details::WilApi_RecordFeatureUsage
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>
wil_details_RecordCachedUsage|wil::details::EnabledStateManager::ProcessShutdown
wil::details::FreeProcessHeap
wil::details::unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1|1| |`address`|180071f14|180071de4| |sig|void __thiscall ~EnabledStateManager(EnabledStateManager * this)|void __thiscall ~EnabledStateManager(EnabledStateManager * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::EnabledStateManager::~EnabledStateManager Called Diff ```diff --- wil::details::EnabledStateManager::~EnabledStateManager called +++ wil::details::EnabledStateManager::~EnabledStateManager called @@ -0,0 +1 @@ +wil::details::EnabledStateManager::ProcessShutdown @@ -2 +2,0 @@ -wil::details::WilApi_RecordFeatureUsage @@ -6 +5,0 @@ -wil_details_RecordCachedUsage ``` ### wil::details::EnabledStateManager::~EnabledStateManager Diff ```diff --- wil::details::EnabledStateManager::~EnabledStateManager +++ wil::details::EnabledStateManager::~EnabledStateManager @@ -1,53 +1,41 @@ /* public: __cdecl wil::details::EnabledStateManager::~EnabledStateManager(void) __ptr64 */ void __thiscall wil::details::EnabledStateManager::~EnabledStateManager(EnabledStateManager *this) { - undefined4 *puVar1; - void *pvVar2; - undefined4 *puVar3; - char *in_R9; + void *pvVar1; - *this = (EnabledStateManager)0x0; + *(undefined4 *)this = 0; unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> *)(this + 0x10),(_TP_TIMER *)0x0); - *this = (EnabledStateManager)0x0; - puVar1 = *(undefined4 **)(this + 0x38); - puVar3 = *(undefined4 **)(this + 0x30); - if (0xf < (ulonglong)((longlong)puVar1 - (longlong)puVar3)) { - for (; puVar3 != puVar1; puVar3 = puVar3 + 4) { - wil_details_RecordCachedUsage(*puVar3,*(uint **)(puVar3 + 2)); - } - *(undefined8 *)(this + 0x38) = *(undefined8 *)(this + 0x30); - WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); - } - pvVar2 = *(void **)(this + 0x68); - *(undefined8 *)(this + 0x68) = 0; - if (pvVar2 != (void *)0x0) { - FreeProcessHeap(pvVar2); - } - pvVar2 = *(void **)(this + 0x48); - *(undefined8 *)(this + 0x48) = 0; - if (pvVar2 != (void *)0x0) { - FreeProcessHeap(pvVar2); - } + ProcessShutdown(this); unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - *)(this + 0x28)); + *)(this + 0x68)); unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,struct_FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - *)(this + 0x20)); + *)(this + 0x60)); + pvVar1 = *(void **)(this + 0x58); + *(undefined8 *)(this + 0x58) = 0; + if (pvVar1 != (void *)0x0) { + FreeProcessHeap(pvVar1); + } + pvVar1 = *(void **)(this + 0x38); + *(undefined8 *)(this + 0x38) = 0; + if (pvVar1 != (void *)0x0) { + FreeProcessHeap(pvVar1); + } unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> :: ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> *)(this + 0x10)); return; } ``` ## NlChangePassword ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.36| |i_ratio|0.39| |m_ratio|0.99| |b_ratio|0.71| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlChangePassword|NlChangePassword| |fullname|NlChangePassword|NlChangePassword| |refcount|6|6| |`length`|3926|3872| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetSystemTimeAsFileTime
CRYPTSP.DLL::CryptGenRandom
CRYPTSP.DLL::SystemFunction007
Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline
Feature_NetlogonLongPassword__private_IsEnabledDeviceUsageNoInline
LSASRV.DLL::LsaICallPackage
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlEqualComputerNameNTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection
NetpEventlogWriteEx3
NlChangeCachedPasswords
NlChangePasswordHigher
NlConfirmCapabilities
NlDereferenceDomain
NlEndNetlogonCall
NlFindDomainByServerName
NlGetOutgoingPassword
NlPrintCsRoutine
NlPrintRoutine
NlResetWriterClientSession
NlSamChangePasswordNamedUser
NlSessionSetupEx
NlSetOutgoingPassword
NlSetStatusClientSession
NlTimeToReauthenticate
NlTimeoutSetWriterClientSession
NlpDumpBuffer
SAMSRV.DLL::SamIMixedDomain
SSPICLI.DLL::LsaFreeReturnBuffer
__report_rangecheckfailure
__security_check_cookie
memcpy
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetSystemTimeAsFileTime
CRYPTSP.DLL::CryptGenRandom
CRYPTSP.DLL::SystemFunction007
Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline
LSASRV.DLL::LsaICallPackage
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlEqualComputerName
NTDLL.DLL::RtlInitUnicodeStringNTDLL.DLL::RtlLeaveCriticalSection
NetpEventlogWriteEx3
NlChangeCachedPasswords
NlChangePasswordHigher
NlConfirmCapabilities
NlDereferenceDomain
NlEndNetlogonCall
NlFindDomainByServerName
NlGetOutgoingPassword
NlPrintCsRoutine
NlPrintRoutine
NlResetWriterClientSession
NlSamChangePasswordNamedUser
NlSessionSetupEx
NlSetOutgoingPassword
NlSetStatusClientSession
NlTimeToReauthenticate
NlTimeoutSetWriterClientSession
NlpDumpBuffer
SAMSRV.DLL::SamIMixedDomain
SSPICLI.DLL::LsaFreeReturnBuffer
__report_rangecheckfailure
__security_check_cookie
memcpy
| |calling|NetrLogonControl2Ex
NlDomainScavenger
NlMainLoop
NlServiceScavenger|NetrLogonControl2Ex
NlDomainScavenger
NlMainLoop
NlServiceScavenger| |paramcount|4|4| |`address`|180021030|1800208e0| |`sig`|uint __fastcall NlChangePassword(HKEY param_1, wchar_t * param_2, wchar_t * param_3, char * param_4)|uint __fastcall NlChangePassword(HKEY param_1, wchar_t * param_2, _FILETIME param_3, char * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlChangePassword Called Diff ```diff --- NlChangePassword called +++ NlChangePassword called @@ -8 +7,0 @@ -Feature_NetlogonLongPassword__private_IsEnabledDeviceUsageNoInline ``` ### NlChangePassword Diff ```diff --- NlChangePassword +++ NlChangePassword @@ -1,681 +1,708 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Type propagation algorithm not settling */ -uint NlChangePassword(HKEY param_1,wchar_t *param_2,wchar_t *param_3,char *param_4) +uint NlChangePassword(HKEY param_1,wchar_t *param_2,_FILETIME param_3,char *param_4) { ushort uVar1; - undefined1 auVar2 [16]; + uint uVar2; undefined1 auVar3 [16]; - bool bVar4; + undefined1 auVar4 [16]; undefined4 uVar5; bool bVar6; char cVar7; - byte bVar8; - ushort uVar9; - uint uVar10; + bool bVar8; + byte bVar9; + ushort uVar10; uint uVar11; - BOOL BVar12; - DWORD DVar13; + uint uVar12; + BOOL BVar13; + DWORD DVar14; uint extraout_EAX; uint extraout_EAX_00; uint extraout_EAX_01; + uint uVar15; HKEY hMem; undefined7 extraout_var; - HANDLE *ppvVar14; - HLOCAL pvVar15; - longlong lVar16; - ulonglong uVar17; - char cVar18; - PRTL_CRITICAL_SECTION_DEBUG p_Var19; - HANDLE *pbBuffer; - undefined1 *puVar20; - _RTL_CRITICAL_SECTION *p_Var21; - char *pcVar22; - wchar_t *pwVar23; - undefined8 uVar24; - uint uVar25; - ushort *puVar26; - undefined1 auStackY_248 [32]; - ULONG_PTR *pUVar27; - undefined4 uVar28; + wchar_t *pwVar16; + HANDLE *ppvVar17; + HLOCAL pvVar18; + longlong lVar19; + ulonglong uVar20; + char cVar21; + _FILETIME _Var22; + uint uVar23; + _RTL_CRITICAL_SECTION *p_Var24; + undefined1 *puVar25; + char *pcVar26; + wchar_t *pwVar27; + undefined8 uVar28; uint uVar29; - uint *puVar30; - uint local_1f8; - char local_1f4; - undefined1 local_1f0 [8]; - wchar_t *local_1e8; - undefined4 local_1e0; - _RTL_CRITICAL_SECTION local_1d8; - undefined8 uStack_1b0; - undefined8 local_1a8; - HLOCAL pvStack_1a0; - undefined8 local_198; - HLOCAL pvStack_190; - ULONG_PTR local_188; - wchar_t *local_180; - ulonglong local_178; - void *pvStack_170; - undefined8 local_168; - undefined8 uStack_160; + int iVar30; + ushort *puVar31; + _FILETIME *p_Var32; + undefined1 auStackY_238 [32]; + ushort *puVar33; + undefined4 uVar34; + uint local_1e8; + char local_1e4; + undefined1 local_1e0 [12]; + uint local_1d4; + int local_1d0; + undefined4 local_1cc; + _FILETIME local_1c8; + ULONG_PTR UStack_1c0; + HKEY local_1b8; + wchar_t *local_1b0; + _FILETIME local_1a8; + undefined8 local_1a0; + undefined8 uStack_198; + undefined8 local_190; + HLOCAL pvStack_188; + undefined8 local_180; + HLOCAL pvStack_178; + longlong local_170; + ulonglong local_168; + void *pvStack_160; _RTL_CRITICAL_SECTION local_158; undefined2 auStack_12c [114]; ulonglong local_48; - pbBuffer = &local_158.OwningThread; - local_48 = __security_cookie ^ (ulonglong)auStackY_248; - uVar29 = 0; - uVar11 = 0; - cVar18 = (char)param_2; - bVar4 = false; - local_188 = 0; - local_1d8.OwningThread = (HKEY)0x0; - local_1d8.LockSemaphore = (PRTL_CRITICAL_SECTION_DEBUG)0x0; - local_1f0._0_4_ = 0; + local_48 = __security_cookie ^ (ulonglong)auStackY_238; + uVar23 = 0; + iVar30 = 0; + cVar21 = (char)param_2; + local_170 = 0; + local_1b8 = (HKEY)0x0; + uVar15 = 0; + local_1a8.dwLowDateTime = 0; + local_1a8.dwHighDateTime = 0; + local_1e0._8_4_ = 0; local_158.DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)0x0; local_158.LockCount = 0; local_158.RecursionCount = 0; - local_1f0._4_4_ = 0; - local_1d8.SpinCount = 0; - uStack_1b0 = 0; - local_1e8 = (wchar_t *)0x0; - local_198 = 0; - pvStack_190 = (HLOCAL)0x0; - local_1f4 = '\0'; - local_1a8 = 0; - pvStack_1a0 = (HLOCAL)0x0; - local_178 = 0; - pvStack_170 = (void *)0x0; - local_180 = param_3; + local_1d4 = 0; + local_1a0 = 0; + uStack_198 = 0; + local_1b0 = (wchar_t *)0x0; + local_180 = 0; + pvStack_178 = (HLOCAL)0x0; + local_1e4 = '\0'; + local_190 = 0; + pvStack_188 = (HLOCAL)0x0; + local_168 = 0; + pvStack_160 = (void *)0x0; + pwVar27 = (wchar_t *)param_3; + local_1e0._0_8_ = param_3; if (param_1[0x52].unused == 0) { param_4 = "ClientSession->CsReferenceCount > 0"; - pcVar22 = ""; + pcVar26 = ""; param_2 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "ClientSession->CsReferenceCount > 0"); - param_3 = (wchar_t *)pcVar22; + pwVar27 = (wchar_t *)pcVar26; } RtlEnterCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - uVar10 = param_1[0x49].unused; - if ((uVar10 >> 0x12 & 1) != 0) { - uVar10 = uVar10 | 2; - param_1[0x49].unused = uVar10; - } - if ((uVar10 & 2) != 0) { + uVar11 = param_1[0x49].unused; + if ((uVar11 >> 0x12 & 1) != 0) { + uVar11 = uVar11 | 2; + param_1[0x49].unused = uVar11; + } + if ((uVar11 & 2) != 0) { RtlLeaveCriticalSection(); - local_1f8 = 0; + local_1e8 = 0; uVar11 = 0xffffffff; goto LAB_0; } RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - uVar10 = Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline(); - if ((uVar10 != 0) && (1 < param_1[0x46].unused - 3U)) { - param_3 = L"NlChangePassword: Calling into Kerberos.\n"; + uVar12 = Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline(); + uVar11 = uVar15; + if ((uVar12 != 0) && (1 < param_1[0x46].unused - 3U)) { + pwVar27 = L"NlChangePassword: Calling into Kerberos.\n"; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: Calling into Kerberos.\n",param_4); - local_1d8.DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)0x0; - local_1e0 = 0; - local_1f0._4_4_ = 0; - local_168 = 0; - uStack_160 = 0; - RtlInitUnicodeString(&local_168,L"Kerberos"); + local_1e0._0_4_ = 0; + local_1e0._4_4_ = 0; + local_1cc = 0; + local_1d4 = 0; + local_1c8.dwLowDateTime = 0; + local_1c8.dwHighDateTime = 0; + UStack_1c0 = 0; + RtlInitUnicodeString(&local_1c8,L"Kerberos"); param_2 = (wchar_t *)0x8; hMem = LocalAlloc(0x40,8); if (hMem == (HKEY)0x0) { - local_1f8 = 0xc0000017; + local_1e8 = 0xc0000017; } else { hMem->unused = 0x26; - param_4 = (char *)&local_1d8; - *(char *)&hMem[1].unused = cVar18; - param_3 = (wchar_t *)0x8; + param_4 = local_1e0; + *(char *)&hMem[1].unused = cVar21; + pwVar27._0_4_ = 8; + pwVar27._4_4_ = 0; param_2 = (wchar_t *)hMem; - local_1f8 = LsaICallPackage(&local_168); - if ((-1 < (int)local_1f8) && ((int)local_1f0._4_4_ < 0)) { - local_1f8 = local_1f0._4_4_; - } - } - if (local_1d8.DebugInfo != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { - LsaFreeReturnBuffer(local_1d8.DebugInfo); + local_1e8 = LsaICallPackage(&local_1c8); + if ((-1 < (int)local_1e8) && ((int)local_1d4 < 0)) { + local_1e8 = local_1d4; + } + } + if ((_FILETIME)local_1e0._0_8_ != (_FILETIME)0x0) { + LsaFreeReturnBuffer((PVOID)local_1e0._0_8_); } if (hMem != (HKEY)0x0) { LocalFree(hMem); } goto LAB_0; } bVar6 = NlTimeoutSetWriterClientSession((longlong)param_1,DAT_1); param_2 = (wchar_t *)param_1; - uVar11 = 0; if ((int)CONCAT71(extraout_var,bVar6) == 0) { - param_3 = L"NlChangePassword: Can\'t become writer of client session.\n"; + pwVar27 = L"NlChangePassword: Can\'t become writer of client session.\n"; NlPrintCsRoutine(0x100,(longlong)param_1, L"NlChangePassword: Can\'t become writer of client session.\n",param_4); - local_1f8 = 0xc000005e; + local_1e8 = 0xc000005e; goto LAB_0; } - pUVar27 = &local_188; - local_1f4 = '\x01'; - param_4 = local_1f0; - pwVar23 = (wchar_t *)&local_1d8.LockSemaphore; - uVar17 = NlGetOutgoingPassword - ((longlong)param_1,&local_1d8.OwningThread,(undefined8 *)pwVar23, - (undefined4 *)param_4,pUVar27); - local_1f8 = (uint)uVar17; - if ((int)local_1f8 < 0) { - param_4 = (char *)(uVar17 & 0xffffffff); - param_3 = L"NlChangePassword: Cannot NlGetOutgoingPassword %lX\n"; + puVar33 = (ushort *)&local_170; + local_1e4 = '\x01'; + param_4 = local_1e0 + 8; + pwVar27 = (wchar_t *)&local_1a8; + uVar20 = NlGetOutgoingPassword + ((longlong)param_1,&local_1b8,(undefined8 *)pwVar27,(undefined4 *)param_4, + (undefined8 *)puVar33); + local_1e8 = (uint)uVar20; + if ((int)local_1e8 < 0) { + param_4 = (char *)(uVar20 & 0xffffffff); + pwVar27 = L"NlChangePassword: Cannot NlGetOutgoingPassword %lX\n"; NlPrintCsRoutine(0x100,(longlong)param_1,L"NlChangePassword: Cannot NlGetOutgoingPassword %lX\n" ,param_4); goto LAB_0; } - if (((local_1d8.OwningThread == (HKEY)0x0) || ((short)*(int *)local_1d8.OwningThread == 0)) || + if (((local_1b8 == (HKEY)0x0) || ((short)local_1b8->unused == 0)) || (cVar7 = RtlEqualComputerName(*(longlong *)(param_1 + 0x44) + 0x100), cVar7 != '\0')) { - pwVar23 = L"NlChangePassword: New LsaSecret is default value.\n"; - local_1f0._4_4_ = 1; + pwVar27 = L"NlChangePassword: New LsaSecret is default value.\n"; + local_1d4 = 1; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: New LsaSecret is default value.\n", param_4); } - if (((local_1d8.LockSemaphore == (PRTL_CRITICAL_SECTION_DEBUG)0x0) || - (*(WORD *)local_1d8.LockSemaphore == 0)) || - (cVar7 = RtlEqualComputerName(*(longlong *)(param_1 + 0x44) + 0x100), bVar6 = bVar4, + if (((local_1a8 == (_FILETIME)0x0) || (*(ushort *)local_1a8 == 0)) || + (cVar7 = RtlEqualComputerName(*(longlong *)(param_1 + 0x44) + 0x100), uVar12 = uVar15, cVar7 != '\0')) { - pwVar23 = L"NlChangePassword: Old LsaSecret is default value.\n"; - bVar6 = true; + pwVar27 = L"NlChangePassword: Old LsaSecret is default value.\n"; + uVar12 = 1; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: Old LsaSecret is default value.\n", param_4); } RtlEnterCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - local_188 = local_188 + *(longlong *)(param_1 + 0x7c); + uVar29 = 0xfffffffe; + local_170 = local_170 + *(longlong *)(param_1 + 0x7c); if ((param_1[0x49].unused & 1) == 0) { - local_1d8.DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)0x0; - GetSystemTimeAsFileTime((LPFILETIME)&local_1d8); - lVar16 = (longlong)local_1d8.DebugInfo - local_188; - if (lVar16 < 0) goto LAB_2; - if (DAT_3 < lVar16) { - param_3 = (wchar_t *)0x1; - uVar17 = lVar16 - DAT_3; + local_1c8.dwLowDateTime = 0; + local_1c8.dwHighDateTime = 0; + GetSystemTimeAsFileTime(&local_1c8); + lVar19 = (longlong)local_1c8 - local_170; + if (lVar19 < 0) goto LAB_2; + if (DAT_3 < lVar19) { + pwVar27._0_4_ = 1; + pwVar27._4_4_ = 0; + uVar20 = lVar19 - DAT_3; } else { - param_3 = (wchar_t *)((ulonglong)pwVar23 & 0xffffffffffffff00); - uVar17 = DAT_3 - lVar16; - } - if ((longlong)uVar17 < 0) { + pwVar27 = (wchar_t *)((ulonglong)pwVar27 & 0xffffffffffffff00); + uVar20 = DAT_3 - lVar19; + } + if ((longlong)uVar20 < 0) { + auVar4._8_8_ = 0; + auVar4._0_8_ = -uVar20; + param_2 = SUB168(ZEXT816(0xd1b71758e219652c) * auVar4,8); + local_1c8 = (_FILETIME)(-uVar20 / 10000); + uVar20 = -(longlong)local_1c8; + } + else { auVar3._8_8_ = 0; - auVar3._0_8_ = -uVar17; + auVar3._0_8_ = uVar20; param_2 = SUB168(ZEXT816(0xd1b71758e219652c) * auVar3,8); - local_1d8.DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)(-uVar17 / 10000); - uVar17 = -(longlong)local_1d8.DebugInfo; - } - else { - auVar2._8_8_ = 0; - auVar2._0_8_ = uVar17; - param_2 = SUB168(ZEXT816(0xd1b71758e219652c) * auVar2,8); - uVar17 = uVar17 / 10000; - } - if (((int)(uVar17 >> 0x20) != 0) || ((int)uVar17 == -1)) { - uVar17 = 0xfffffffe; - } - uVar11 = (uint)uVar17; - if (((((char)param_3 != '\0') || (local_1f0._4_4_ != 0)) || (bVar6)) || (cVar18 != '\0')) + uVar20 = uVar20 / 10000; + } + if (((int)(uVar20 >> 0x20) != 0) || ((int)uVar20 == -1)) { + uVar20 = 0xfffffffe; + } + uVar11 = (uint)uVar20; + if (((((char)pwVar27 != '\0') || (local_1d4 != 0)) || (uVar12 != 0)) || (cVar21 != '\0')) goto LAB_2; LAB_4: RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - local_1f8 = 0; + local_1e8 = 0; + param_3 = (_FILETIME)local_1e0._0_8_; goto LAB_0; } LAB_2: *(undefined8 *)(param_1 + 0x7c) = 0; RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - param_3 = L"NlChangePassword: Doing it.\n"; + pwVar27 = L"NlChangePassword: Doing it.\n"; + uVar12 = 0; uVar11 = 0; param_2 = (wchar_t *)param_1; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: Doing it.\n",param_4); + bVar6 = false; if ((param_1[0x49].unused & 0x20000U) == 0) { - pwVar23 = (wchar_t *)0x0; + pwVar16 = (wchar_t *)0x0; LAB_5: if ((param_1[0x46].unused != 6) || (*(int *)(*(longlong *)(param_1 + 0x44) + 0x24c) != 1)) { if (param_1[0x47].unused == 2) { - local_1f8 = NlConfirmCapabilities((wchar_t *)param_1); + local_1e8 = NlConfirmCapabilities((wchar_t *)param_1); param_4 = *(char **)(param_1 + 0x7e); - if ((int)local_1f8 < 0) { - param_3 = L"NlChangePassword: Unsuccessful response from DC %ws 0x%lx\n"; - pUVar27 = (ULONG_PTR *)CONCAT44((int)((ulonglong)pUVar27 >> 0x20),local_1f8); + if ((int)local_1e8 < 0) { + pwVar27 = L"NlChangePassword: Unsuccessful response from DC %ws 0x%lx\n"; + puVar33 = (ushort *)CONCAT44((int)((ulonglong)puVar33 >> 0x20),local_1e8); NlPrintCsRoutine(0x100,(longlong)param_1, L"NlChangePassword: Unsuccessful response from DC %ws 0x%lx\n",param_4); param_2 = (wchar_t *)0xc000005e; NlSetStatusClientSession((longlong)param_1,0xc000005e); } else { - param_3 = L"NlChangePassword: Successful response from DC %ws\n"; + pwVar27 = L"NlChangePassword: Successful response from DC %ws\n"; param_2 = (wchar_t *)param_1; NlPrintCsRoutine(0x200,(longlong)param_1, L"NlChangePassword: Successful response from DC %ws\n",param_4); } } if (param_1[0x48].unused < 0) { - bVar6 = NlTimeToReauthenticate((longlong)param_1); - if (!bVar6) { - local_1f8 = param_1[0x48].unused; + bVar8 = NlTimeToReauthenticate((longlong)param_1); + if (!bVar8) { + local_1e8 = param_1[0x48].unused; + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = 0; goto LAB_0; } - local_1f8 = NlSessionSetupEx(param_1,param_2,(ulonglong)param_3,(_FILETIME *)param_4); - if ((int)local_1f8 < 0) goto LAB_0; + local_1e8 = NlSessionSetupEx(param_1,param_2,(ulonglong)pwVar27,(_FILETIME *)param_4); + param_3 = (_FILETIME)local_1e0._0_8_; + if ((int)local_1e8 < 0) goto LAB_0; } } } else { - pwVar23 = (wchar_t *)NlFindDomainByServerName((short *)0x0,param_2,param_3,param_4); - local_1e8 = pwVar23; - if ((pwVar23 == (wchar_t *)0x0) || (1 < *(int *)(pwVar23 + 0x126) - 1U)) goto LAB_5; - bVar4 = true; + pwVar16 = (wchar_t *)NlFindDomainByServerName((short *)0x0,param_2,pwVar27,param_4); + local_1b0 = pwVar16; + if ((pwVar16 == (wchar_t *)0x0) || (1 < *(int *)(pwVar16 + 0x126) - 1U)) goto LAB_5; + iVar30 = 1; } RtlEnterCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - uVar11 = Feature_NetlogonLongPassword__private_IsEnabledDeviceUsageNoInline(); - if (((uVar11 != 0) && (local_1e8 = pwVar23, local_1d8.OwningThread != (HKEY)0x0)) && - (0xef < (ushort)*(int *)local_1d8.OwningThread)) { + if ((local_1b8 != (HKEY)0x0) && (0xef < (ushort)local_1b8->unused)) { param_1[0x49].unused = param_1[0x49].unused & 0xfffffffe; } - pwVar23 = local_1e8; if ((param_1[0x49].unused & 1) == 0) { RtlEnterCriticalSection(&NlGlobalMsvCritSect); - uVar28 = (undefined4)((ulonglong)pUVar27 >> 0x20); + uVar34 = (undefined4)((ulonglong)puVar33 >> 0x20); if (NlGlobalMsvEnabled == 0) { RtlLeaveCriticalSection(); NlPrintRoutine(0x100, L"Falling back to short password because I_NetLogonMixedDomain failed with ntstatus 0x%x.\n" ,0xc0000192,param_4); - uVar10 = 0xe; - local_1e8 = pwVar23; + uVar12 = 0xe; + local_1b0 = pwVar16; } else { NlGlobalMsvThreadCount = NlGlobalMsvThreadCount + 1; RtlLeaveCriticalSection(&NlGlobalMsvCritSect); uVar11 = NlGlobalWorkstationMixedModeDomain; - local_1e8 = pwVar23; + local_1d0 = iVar30; + local_1b0 = pwVar16; if (NlGlobalMemberWorkstation == 0) { - bVar8 = SamIMixedDomain(*(undefined8 *)(NlGlobalDomainInfo + 0x170)); - uVar11 = (uint)bVar8; + bVar9 = SamIMixedDomain(*(undefined8 *)(NlGlobalDomainInfo + 0x170)); + uVar11 = (uint)bVar9; } NlEndNetlogonCall(); - uVar10 = 0x78; + uVar12 = 0x78; + iVar30 = local_1d0; if (uVar11 != 0) { - uVar10 = 0xe; - } - } - BVar12 = CryptGenRandom(NlGlobalCryptProvider,uVar10 * 2,(BYTE *)pbBuffer); - if (BVar12 == 0) { - DVar13 = GetLastError(); - uVar17 = (ulonglong)DVar13; - NlPrintRoutine(0x100,L"CryptGenRandom failed with %lu\n",uVar17,param_4); - NlPrintRoutine(0x100,L"Can\'t NlGenerateRandomBits for clear password\n",uVar17,param_4); - } - uVar17 = (ulonglong)uVar10; - ppvVar14 = pbBuffer; + uVar12 = 0xe; + } + } + BVar13 = CryptGenRandom(NlGlobalCryptProvider,uVar12 * 2,(BYTE *)&local_158.OwningThread); + if (BVar13 == 0) { + DVar14 = GetLastError(); + uVar20 = (ulonglong)DVar14; + NlPrintRoutine(0x100,L"CryptGenRandom failed with %lu\n",uVar20,param_4); + NlPrintRoutine(0x100,L"Can\'t NlGenerateRandomBits for clear password\n",uVar20,param_4); + } + ppvVar17 = &local_158.OwningThread; + uVar20 = (ulonglong)uVar12; do { - if (*(short *)ppvVar14 == 0) { - *(short *)ppvVar14 = 1; - } - ppvVar14 = (HANDLE *)((longlong)ppvVar14 + 2); - uVar17 = uVar17 - 1; - } while (uVar17 != 0); - if (0xf1 < (ulonglong)uVar10 * 2) { + if (*(short *)ppvVar17 == 0) { + *(short *)ppvVar17 = 1; + } + ppvVar17 = (HANDLE *)((longlong)ppvVar17 + 2); + uVar20 = uVar20 - 1; + } while (uVar20 != 0); + if (0xf1 < (ulonglong)uVar12 * 2) { /* WARNING: Subroutine does not return */ __report_rangecheckfailure(); } - *(undefined2 *)((longlong)pbBuffer + (ulonglong)uVar10 * 2) = 0; - RtlInitUnicodeString(&local_1d8.SpinCount,pbBuffer); - uVar5 = local_1f0._0_4_; - uVar17 = (ulonglong)(local_1f0._0_4_ + 1); - pUVar27 = (ULONG_PTR *)CONCAT44(uVar28,local_1f0._0_4_); - local_1f0._0_4_ = local_1f0._0_4_ + 1; - uVar11 = NlSetOutgoingPassword - ((longlong)param_1,(ushort *)&local_1d8.SpinCount,local_1d8.OwningThread, - uVar17,uVar5); - local_1f8 = extraout_EAX; + *(undefined2 *)((longlong)&local_158.OwningThread + (ulonglong)uVar12 * 2) = 0; + RtlInitUnicodeString(&local_1a0,&local_158.OwningThread); + uVar5 = local_1e0._8_4_; + uVar20 = (ulonglong)(local_1e0._8_4_ + 1); + puVar33 = (ushort *)CONCAT44(uVar34,local_1e0._8_4_); + local_1e0._8_4_ = local_1e0._8_4_ + 1; + uVar12 = NlSetOutgoingPassword + ((longlong)param_1,(ushort *)&local_1a0,(ushort *)local_1b8,uVar20,uVar5); + local_1e8 = extraout_EAX; if ((int)extraout_EAX < 0) { param_4 = (char *)(ulonglong)extraout_EAX; - param_3 = L"NlChangePassword: Cannot NlSetOutgoingPassword %lX\n"; + pwVar27 = L"NlChangePassword: Cannot NlSetOutgoingPassword %lX\n"; param_2 = (wchar_t *)param_1; NlPrintCsRoutine(0x100,(longlong)param_1, L"NlChangePassword: Cannot NlSetOutgoingPassword %lX\n",param_4); RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = uVar12; goto LAB_0; } param_1[0x49].unused = param_1[0x49].unused | 1; - uVar10 = 1; + bVar6 = true; NlPrintCsRoutine(0x200,(longlong)param_1, - L"NlChangePassword: Flag password changed in LsaSecret\n",uVar17); + L"NlChangePassword: Flag password changed in LsaSecret\n",uVar20); } else { NlPrintCsRoutine(0x200,(longlong)param_1, L"NlChangePassword: Password already updated in secret\n",param_4); - if (local_1d8.OwningThread == (HKEY)0x0) { - RtlInitUnicodeString(&local_1d8.SpinCount,0); - uVar10 = 0; - uVar11 = uVar29; + if (local_1b8 == (HKEY)0x0) { + RtlInitUnicodeString(&local_1a0,0); + uVar12 = uVar23; } else { - local_1d8.SpinCount = *(ULONG_PTR *)local_1d8.OwningThread; - uStack_1b0 = *(undefined8 *)((longlong)local_1d8.OwningThread + 8); - uVar10 = 0; - uVar11 = 0; + local_1a0 = *(undefined8 *)local_1b8; + uStack_198 = *(undefined8 *)(local_1b8 + 2); + bVar6 = false; } } RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - local_1f8 = SystemFunction007(&local_1d8.SpinCount,&local_158); - if ((int)local_1f8 < 0) { - param_4 = (char *)(ulonglong)local_1f8; - param_3 = L"NlChangePassword: Cannot RtlCalculateNtOwfPassword %lX\n"; + local_1e8 = SystemFunction007(&local_1a0,&local_158); + uVar11 = uVar12; + if ((int)local_1e8 < 0) { + param_4 = (char *)(ulonglong)local_1e8; + pwVar27 = L"NlChangePassword: Cannot RtlCalculateNtOwfPassword %lX\n"; param_2 = (wchar_t *)param_1; NlPrintCsRoutine(0x100,(longlong)param_1, L"NlChangePassword: Cannot RtlCalculateNtOwfPassword %lX\n",param_4); + param_3 = (_FILETIME)local_1e0._0_8_; goto LAB_0; } - uVar25 = param_1[0x46].unused; - param_3 = (wchar_t *)(ulonglong)uVar25; - if ((uVar25 == 6) && (*(int *)(*(longlong *)(param_1 + 0x44) + 0x24c) == 1)) { + uVar2 = param_1[0x46].unused; + pwVar27._4_4_ = 0; + pwVar27._0_4_ = uVar2; + if ((uVar2 == 6) && (*(int *)(*(longlong *)(param_1 + 0x44) + 0x24c) == 1)) { param_2 = *(wchar_t **)(param_1 + 0x32); param_4 = (char *)&local_158; - param_3 = (wchar_t *)&local_1d8.SpinCount; - local_1f8 = NlSamChangePasswordNamedUser - (*(longlong *)(param_1 + 0x44),param_2,(longlong)param_3, + pwVar27 = (wchar_t *)&local_1a0; + local_1e8 = NlSamChangePasswordNamedUser + (*(longlong *)(param_1 + 0x44),param_2,(longlong)pwVar27, (undefined4 *)param_4); - if ((int)local_1f8 < 0) { - param_3 = L"NlChangePassword: Cannot change password on PDC local user account 0x%lx\n"; + if ((int)local_1e8 < 0) { + pwVar27 = L"NlChangePassword: Cannot change password on PDC local user account 0x%lx\n"; LAB_6: - param_4 = (char *)(ulonglong)local_1f8; + param_4 = (char *)(ulonglong)local_1e8; param_2 = (wchar_t *)param_1; - NlPrintCsRoutine(0x100,(longlong)param_1,param_3,param_4); - uVar10 = uVar29; + NlPrintCsRoutine(0x100,(longlong)param_1,pwVar27,param_4); + uVar15 = uVar23; } else { - uVar10 = 1; + uVar15 = 1; } LAB_7: - if (uVar10 == 0) goto LAB_0; + param_3 = (_FILETIME)local_1e0._0_8_; + if (uVar15 == 0) goto LAB_0; } else { param_2 = *(wchar_t **)(param_1 + 0x32); param_4 = (char *)&local_158; - if (bVar4) { - param_3 = (wchar_t *)&local_1d8.SpinCount; - local_1f8 = NlSamChangePasswordNamedUser - ((longlong)pwVar23,param_2,(longlong)param_3,(undefined4 *)param_4); - if ((int)local_1f8 < 0) { - param_3 = L"NlChangePassword: Cannot change password on PDC managed service account 0x%lx\n" + if (iVar30 != 0) { + pwVar27 = (wchar_t *)&local_1a0; + local_1e8 = NlSamChangePasswordNamedUser + ((longlong)local_1b0,param_2,(longlong)pwVar27,(undefined4 *)param_4); + if ((int)local_1e8 < 0) { + pwVar27 = L"NlChangePassword: Cannot change password on PDC managed service account 0x%lx\n" ; goto LAB_6; } - uVar10 = 1; + uVar15 = 1; goto LAB_7; } - pUVar27 = &local_1d8.SpinCount; - local_1f8 = NlChangePasswordHigher - ((wchar_t *****)param_1,param_2,uVar25,(undefined8 *)param_4, - (ushort *)pUVar27,(undefined4 *)local_1f0); - if ((local_1f8 == 0xc0000022) || (local_1f8 == 0xc00002a5)) goto LAB_0; - if (local_1f8 == 0xc000006a) { - param_3 = L"NlChangePassword: DC refused to change password\n"; + puVar33 = (ushort *)&local_1a0; + local_1e8 = NlChangePasswordHigher + ((wchar_t *****)param_1,param_2,uVar2,(undefined8 *)param_4,puVar33, + (undefined4 *)(local_1e0 + 8)); + param_3 = (_FILETIME)local_1e0._0_8_; + if ((local_1e8 == 0xc0000022) || (local_1e8 == 0xc00002a5)) goto LAB_0; + if (local_1e8 == 0xc000006a) { + pwVar27 = L"NlChangePassword: DC refused to change password\n"; param_2 = (wchar_t *)param_1; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: DC refused to change password\n", param_4); - uVar28 = (undefined4)((ulonglong)pUVar27 >> 0x20); + uVar34 = (undefined4)((ulonglong)puVar33 >> 0x20); RtlEnterCriticalSection(*(longlong *)(param_1 + 0x44) + 400); - if (uVar10 != 0) { + if (bVar6) { NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: undoing LSA secret change.\n", param_4); - uVar10 = local_1f0._0_4_ - 1; - param_4 = (char *)(ulonglong)uVar10; - uVar11 = local_1f0._0_4_ - 2; - if (uVar10 == 0) { - uVar11 = 0; - } - pUVar27 = (ULONG_PTR *)CONCAT44(uVar28,uVar11); - param_2 = local_1d8.OwningThread; - param_3 = local_1d8.LockSemaphore; - local_1f0._0_4_ = uVar10; - uVar11 = NlSetOutgoingPassword - ((longlong)param_1,local_1d8.OwningThread,local_1d8.LockSemaphore,param_4 - ,uVar11); - local_1f8 = extraout_EAX_01; - if ((int)extraout_EAX_01 < 0) { - param_4 = (char *)(ulonglong)extraout_EAX_01; - param_3 = L"NlChangePassword: Cannot undo NlSetOutgoingPassword %lX\n"; - NlPrintCsRoutine(0x100,(longlong)param_1, - L"NlChangePassword: Cannot undo NlSetOutgoingPassword %lX\n",param_4); - RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); + uVar12 = local_1e0._8_4_ - 1; + param_4 = (char *)(ulonglong)uVar12; + uVar11 = local_1e0._8_4_ - 2; + if (uVar12 == 0) { + uVar11 = uVar15; + } + puVar33 = (ushort *)CONCAT44(uVar34,uVar11); + param_2 = (wchar_t *)local_1b8; + pwVar27 = (wchar_t *)local_1a8; + local_1e0._8_4_ = uVar12; + uVar12 = NlSetOutgoingPassword + ((longlong)param_1,(ushort *)local_1b8,(ushort *)local_1a8,param_4,uVar11 + ); + local_1e8 = extraout_EAX_00; + if ((int)extraout_EAX_00 < 0) { + pwVar27 = L"NlChangePassword: Cannot undo NlSetOutgoingPassword %lX\n"; goto LAB_8; } param_1[0x49].unused = param_1[0x49].unused & 0xfffffffe; } param_1[0x49].unused = param_1[0x49].unused | 2; uVar11 = 0xffffffff; goto LAB_4; } } -LAB_8: while( true ) { - local_1d8.DebugInfo = (PRTL_CRITICAL_SECTION_DEBUG)0x0; - local_1d8.LockCount = 0; - local_1d8.RecursionCount = 0; - if ((int)local_1f8 < (int)uVar11) break; + local_1c8.dwLowDateTime = 0; + local_1c8.dwHighDateTime = 0; + UStack_1c0 = 0; + if ((int)local_1e8 < (int)uVar12) break; RtlEnterCriticalSection(*(longlong *)(param_1 + 0x44) + 400); param_1[0x49].unused = param_1[0x49].unused & 0xfffffffe; - param_3 = L"NlChangePassword: Flag password updated on DC\n"; + pwVar27 = L"NlChangePassword: Flag password updated on DC\n"; NlPrintCsRoutine(0x200,(longlong)param_1,L"NlChangePassword: Flag password updated on DC\n", param_4); - if (local_1f0._4_4_ == uVar11) { + if (local_1d4 == uVar12) { LAB_9: - uVar17 = local_1a8; - lVar16 = *(longlong *)(param_1 + 0x44); - local_1a8 = local_1a8 & 0xffffffff00000000; - pvStack_1a0 = (HLOCAL)0x0; - puVar26 = (ushort *)(lVar16 + 0x38); - if (puVar26 != (ushort *)0x0) { - uVar1 = *puVar26; - p_Var19 = (PRTL_CRITICAL_SECTION_DEBUG)(ulonglong)uVar1; - if ((uVar1 != 0) && (uVar9 = uVar1 + 2, uVar1 <= uVar9)) { - local_1a8._4_4_ = SUB84(uVar17,4); - local_1a8._0_4_ = CONCAT22(uVar9,uVar1); - pvVar15 = LocalAlloc(0x40,(ulonglong)uVar9); - pvStack_1a0 = pvVar15; - if (pvVar15 == (HLOCAL)0x0) { - local_1a8 = local_1a8 & 0xffffffff00000000; + uVar20 = local_190; + lVar19 = *(longlong *)(param_1 + 0x44); + local_190 = local_190 & 0xffffffff00000000; + pvStack_188 = (HLOCAL)0x0; + puVar31 = (ushort *)(lVar19 + 0x38); + if (puVar31 != (ushort *)0x0) { + uVar1 = *puVar31; + _Var22._2_6_ = 0; + _Var22.dwLowDateTime._0_2_ = uVar1; + if ((uVar1 != 0) && (uVar10 = uVar1 + 2, uVar1 <= uVar10)) { + local_190._4_4_ = SUB84(uVar20,4); + local_190._0_4_ = CONCAT22(uVar10,uVar1); + pvVar18 = LocalAlloc(0x40,(ulonglong)uVar10); + pvStack_188 = pvVar18; + if (pvVar18 == (HLOCAL)0x0) { + local_190 = local_190 & 0xffffffff00000000; } else { - memcpy(pvVar15,*(void **)(lVar16 + 0x40),(size_t)p_Var19); - *(undefined2 *)((longlong)pvVar15 + (ulonglong)(uVar1 >> 1) * 2) = 0; - param_3 = (wchar_t *)p_Var19; + memcpy(pvVar18,*(void **)(lVar19 + 0x40),(size_t)_Var22); + *(undefined2 *)((longlong)pvVar18 + (ulonglong)(uVar1 >> 1) * 2) = 0; + pwVar27 = (wchar_t *)_Var22; } } } - uVar11 = 0xfffffffe; - RtlInitUnicodeString(&local_178,*(undefined8 *)(param_1 + 0x32)); - uVar17 = local_198; - uVar1 = (ushort)local_178; - p_Var19 = (PRTL_CRITICAL_SECTION_DEBUG)(local_178 & 0xffff); - local_198 = local_198 & 0xffffffff00000000; - pvStack_190 = (HLOCAL)0x0; - if (((ushort)local_178 != 0) && (uVar9 = (ushort)local_178 + 2, (ushort)local_178 <= uVar9)) { - local_198._4_4_ = SUB84(uVar17,4); - local_198._0_4_ = CONCAT22(uVar9,(ushort)local_178); - pvVar15 = LocalAlloc(0x40,(ulonglong)uVar9); - pvStack_190 = pvVar15; - if (pvVar15 == (HLOCAL)0x0) { - local_198 = local_198 & 0xffffffff00000000; + RtlInitUnicodeString(&local_168,*(undefined8 *)(param_1 + 0x32)); + uVar20 = local_180; + uVar1 = (ushort)local_168; + _Var22 = (_FILETIME)(local_168 & 0xffff); + local_180 = local_180 & 0xffffffff00000000; + pvStack_178 = (HLOCAL)0x0; + if (((ushort)local_168 != 0) && (uVar10 = (ushort)local_168 + 2, (ushort)local_168 <= uVar10)) + { + local_180._4_4_ = SUB84(uVar20,4); + local_180._0_4_ = CONCAT22(uVar10,(ushort)local_168); + pvVar18 = LocalAlloc(0x40,(ulonglong)uVar10); + pvStack_178 = pvVar18; + if (pvVar18 == (HLOCAL)0x0) { + local_180 = local_180 & 0xffffffff00000000; } else { - memcpy(pvVar15,pvStack_170,(size_t)p_Var19); - *(undefined2 *)((longlong)pvVar15 + (ulonglong)(uVar1 >> 1) * 2) = 0; - param_3 = (wchar_t *)p_Var19; + memcpy(pvVar18,pvStack_160,(size_t)_Var22); + *(undefined2 *)((longlong)pvVar18 + (ulonglong)(uVar1 >> 1) * 2) = 0; + pwVar27 = (wchar_t *)_Var22; } } RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); if (DAT_10 < 0x32) { - uVar11 = DAT_10 * 86400000; + uVar29 = DAT_10 * 86400000; } if ((param_1[0x49].unused & 0x20000U) == 0) { - local_1d8.DebugInfo = *(PRTL_CRITICAL_SECTION_DEBUG *)(param_1 + 0x7e); + local_1c8 = *(_FILETIME *)(param_1 + 0x7e); if (((byte)NlGlobalParameters & 2) != 0) { - uVar24 = 4; + uVar28 = 4; NlPrintRoutine(2,L"Eventlog: %ld (%ld) ",0x16bf,4); - param_3 = (wchar_t *)local_1d8.DebugInfo; - NlPrintRoutine(2,L"\"%ws\" ",local_1d8.DebugInfo,uVar24); - NlPrintRoutine(2,L"\n",param_3,uVar24); - } - puVar30 = (uint *)0x0; - param_2 = (wchar_t *)0x4; - uVar29 = 0; + pwVar27 = (wchar_t *)local_1c8; + NlPrintRoutine(2,L"\"%ws\" ",local_1c8,uVar28); + NlPrintRoutine(2,L"\n",pwVar27,uVar28); + } param_4 = (char *)0x16bf; - uVar25 = 1; + uVar15 = 1; } else { - param_3 = (wchar_t *)&local_1d8.SpinCount; - NlChangeCachedPasswords((ushort *)&local_1a8,(ushort *)&local_198,(ushort *)param_3,param_4) + pwVar27 = (wchar_t *)&local_1a0; + NlChangeCachedPasswords((ushort *)&local_190,(ushort *)&local_180,(ushort *)pwVar27,param_4) ; - local_1d8.DebugInfo = *(PRTL_CRITICAL_SECTION_DEBUG *)(param_1 + 0x32); - local_1d8._8_8_ = *(undefined8 *)(param_1 + 0x7e); + local_1c8 = *(_FILETIME *)(param_1 + 0x32); + UStack_1c0 = *(ULONG_PTR *)(param_1 + 0x7e); if (((byte)NlGlobalParameters & 2) != 0) { - uVar24 = 4; + uVar28 = 4; NlPrintRoutine(2,L"Eventlog: %ld (%ld) ",0x16c0,4); - p_Var21 = &local_1d8; - lVar16 = 2; + p_Var32 = &local_1c8; + lVar19 = 2; do { - param_3 = (wchar_t *)p_Var21->DebugInfo; - NlPrintRoutine(2,L"\"%ws\" ",param_3,uVar24); - p_Var21 = (_RTL_CRITICAL_SECTION *)&p_Var21->LockCount; - lVar16 = lVar16 + -1; - } while (lVar16 != 0); - NlPrintRoutine(2,L"\n",param_3,uVar24); - } - puVar30 = (uint *)0x0; - param_2 = (wchar_t *)0x4; - uVar29 = 0; + pwVar27 = *(wchar_t **)p_Var32; + NlPrintRoutine(2,L"\"%ws\" ",pwVar27,uVar28); + p_Var32 = p_Var32 + 1; + lVar19 = lVar19 + -1; + } while (lVar19 != 0); + NlPrintRoutine(2,L"\n",pwVar27,uVar28); + } param_4 = (char *)0x16c0; - uVar25 = 2; - } - goto LAB_11; + uVar15 = 2; + } + param_2 = (wchar_t *)0x4; + uVar20 = NetpEventlogWriteEx3 + (NlGlobalEventlogHandle,4,pwVar27,(LPCRITICAL_SECTION)param_4,puVar33, + uVar15,0xffffffff,0,(LPCWSTR *)&local_1c8,(void *)0x0); + uVar15 = (uint)uVar20; + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = uVar29; + if (uVar15 == 0) goto LAB_0; + uVar12 = uVar29; + if (uVar15 != 0xb7) goto LAB_11; + goto LAB_12; } NlPrintCsRoutine(0x200,(longlong)param_1, L"NlChangePassword: Setting LsaSecret old password to same as new password\n", param_4); - param_4 = (char *)(ulonglong)(uint)local_1f0._0_4_; - param_3 = (wchar_t *)&local_1d8.SpinCount; - pUVar27 = (ULONG_PTR *)CONCAT44((int)((ulonglong)pUVar27 >> 0x20),local_1f0._0_4_); - uVar11 = NlSetOutgoingPassword - ((longlong)param_1,(ushort *)&local_1d8.SpinCount,(ushort *)param_3,param_4, - local_1f0._0_4_); - local_1f8 = extraout_EAX_00; - if (-1 < (int)extraout_EAX_00) goto LAB_9; - param_4 = (char *)(ulonglong)extraout_EAX_00; - param_3 = L"NlChangePassword: Cannot LsarSetSecret to set old password %lX\n"; - NlPrintCsRoutine(0x100,(longlong)param_1, - L"NlChangePassword: Cannot LsarSetSecret to set old password %lX\n",param_4); + param_4 = (char *)(ulonglong)(uint)local_1e0._8_4_; + pwVar27 = (wchar_t *)&local_1a0; + puVar33 = (ushort *)CONCAT44((int)((ulonglong)puVar33 >> 0x20),local_1e0._8_4_); + uVar12 = NlSetOutgoingPassword + ((longlong)param_1,(ushort *)&local_1a0,(ushort *)pwVar27,param_4, + local_1e0._8_4_); + local_1e8 = extraout_EAX_01; + if (-1 < (int)extraout_EAX_01) goto LAB_9; + pwVar27 = L"NlChangePassword: Cannot LsarSetSecret to set old password %lX\n"; +LAB_8: + param_4 = (char *)(ulonglong)local_1e8; + NlPrintCsRoutine(0x100,(longlong)param_1,pwVar27,param_4); RtlLeaveCriticalSection(*(longlong *)(param_1 + 0x44) + 400); } - NlSetStatusClientSession((longlong)param_1,local_1f8); - uVar10 = local_1f8; - local_1d8._8_8_ = SEXT48((int)local_1f8); - local_1d8.DebugInfo = *(PRTL_CRITICAL_SECTION_DEBUG *)(param_1 + 0x32); - if (local_1f8 == 0xc0000134) { - local_1d8.LockCount = 0x8c9; - local_1d8.RecursionCount = 0; - } - uVar25 = 0x40000002; - if (local_1f8 != 0xc0000134) { - uVar25 = 0x80000002; + NlSetStatusClientSession((longlong)param_1,local_1e8); + uVar15 = local_1e8; + UStack_1c0 = (ULONG_PTR)(int)local_1e8; + local_1c8 = *(_FILETIME *)(param_1 + 0x32); + if (local_1e8 == 0xc0000134) { + UStack_1c0 = 0x8c9; + } + uVar11 = 0x40000002; + if (local_1e8 != 0xc0000134) { + uVar11 = 0x80000002; } if (((byte)NlGlobalParameters & 2) != 0) { - uVar24 = 1; + uVar28 = 1; NlPrintRoutine(2,L"Eventlog: %ld (%ld) ",0xc98,1); - p_Var21 = &local_1d8; + p_Var32 = &local_1c8; do { - if (uVar29 == 1) { - if (uVar10 == 0xc0000134) { - if ((uVar25 >> 0x1e & 1) == 0) { - NlPrintRoutine(2,L"\"%ws\" ",p_Var21->DebugInfo,uVar24); + if (uVar23 == 1) { + if (uVar15 == 0xc0000134) { + if ((uVar11 >> 0x1e & 1) == 0) { + NlPrintRoutine(2,L"\"%ws\" ",*p_Var32,uVar28); } else { - NlPrintRoutine(2,L"%ld ",(ulonglong)*(uint *)&p_Var21->DebugInfo,uVar24); + NlPrintRoutine(2,L"%ld ",(ulonglong)p_Var32->dwLowDateTime,uVar28); } } else { - NlPrintRoutine(2,L"0x%lx ",(ulonglong)*(uint *)&p_Var21->DebugInfo,uVar24); + NlPrintRoutine(2,L"0x%lx ",(ulonglong)p_Var32->dwLowDateTime,uVar28); } break; } - NlPrintRoutine(2,L"\"%ws\" ",p_Var21->DebugInfo,uVar24); - uVar29 = uVar29 + 1; - p_Var21 = (_RTL_CRITICAL_SECTION *)&p_Var21->LockCount; - } while (uVar29 < 2); - param_3 = (wchar_t *)0x4; - NlpDumpBuffer(2,&local_1f8,4,uVar24); - } - puVar30 = &local_1f8; + NlPrintRoutine(2,L"\"%ws\" ",*p_Var32,uVar28); + uVar23 = uVar23 + 1; + p_Var32 = p_Var32 + 1; + } while (uVar23 < 2); + pwVar27._0_4_ = 4; + pwVar27._4_4_ = 0; + NlpDumpBuffer(2,&local_1e8,4,uVar28); + } + param_2 = (wchar_t *)0x1; param_4 = (char *)0xc98; - param_2 = (wchar_t *)0x1; - uVar29 = 4; + uVar20 = NetpEventlogWriteEx3 + (NlGlobalEventlogHandle,1,pwVar27,(LPCRITICAL_SECTION)0xc98,puVar33,uVar11, + 0xffffffff,4,(LPCWSTR *)&local_1c8,&local_1e8); + uVar15 = (uint)uVar20; + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = uVar12; + if (uVar15 != 0) { + if (uVar15 == 0xb7) { +LAB_12: + param_2 = L"Didn\'t log event since it was already logged.\n"; + NlPrintRoutine(2,L"Didn\'t log event since it was already logged.\n",pwVar27,param_4); + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = uVar12; + } + else { LAB_11: - uVar17 = NetpEventlogWriteEx3 - (NlGlobalEventlogHandle,(int)param_2,param_3,(LPCRITICAL_SECTION)param_4, - pUVar27,uVar25,0xffffffff,uVar29,(LPCWSTR *)&local_1d8,puVar30); - if ((int)uVar17 != 0) { - if ((int)uVar17 == 0xb7) { - param_2 = L"Didn\'t log event since it was already logged.\n"; - NlPrintRoutine(2,L"Didn\'t log event since it was already logged.\n",param_3,param_4); - } - else { - param_3 = (wchar_t *)(uVar17 & 0xffffffff); + pwVar27._4_4_ = 0; + pwVar27._0_4_ = uVar15; param_2 = L"Error writing this event in the eventlog, Status = %ld\n"; - NlPrintRoutine(0x100,L"Error writing this event in the eventlog, Status = %ld\n",param_3, + NlPrintRoutine(0x100,L"Error writing this event in the eventlog, Status = %ld\n",pwVar27, param_4); + param_3 = (_FILETIME)local_1e0._0_8_; + uVar11 = uVar12; } } LAB_0: - p_Var21 = &local_158; - for (lVar16 = 0x10; lVar16 != 0; lVar16 = lVar16 + -1) { - *(undefined1 *)&p_Var21->DebugInfo = 0; - p_Var21 = (_RTL_CRITICAL_SECTION *)((longlong)&p_Var21->DebugInfo + 1); - } - for (lVar16 = 0xf2; lVar16 != 0; lVar16 = lVar16 + -1) { - *(undefined1 *)pbBuffer = 0; - pbBuffer = (HANDLE *)((longlong)pbBuffer + 1); - } - if (local_1e8 != (wchar_t *)0x0) { - NlDereferenceDomain(local_1e8,param_2,param_3,(undefined8 *)param_4); - } - if (local_1d8.OwningThread != (HKEY)0x0) { - puVar20 = *(undefined1 **)((longlong)local_1d8.OwningThread + 8); - for (uVar17 = (ulonglong)(ushort)*(int *)local_1d8.OwningThread; uVar17 != 0; - uVar17 = uVar17 - 1) { - *puVar20 = 0; - puVar20 = puVar20 + 1; - } - LocalFree(local_1d8.OwningThread); - } - if (local_1d8.LockSemaphore != (PRTL_CRITICAL_SECTION_DEBUG)0x0) { - p_Var21 = *(_RTL_CRITICAL_SECTION **)((longlong)local_1d8.LockSemaphore + 8); - for (uVar17 = (ulonglong)*(ushort *)local_1d8.LockSemaphore; uVar17 != 0; uVar17 = uVar17 - 1) { - *(undefined1 *)&p_Var21->DebugInfo = 0; - p_Var21 = (_RTL_CRITICAL_SECTION *)((longlong)&p_Var21->DebugInfo + 1); - } - LocalFree(local_1d8.LockSemaphore); - } - if (local_1f4 != '\0') { + p_Var24 = &local_158; + for (lVar19 = 0x10; lVar19 != 0; lVar19 = lVar19 + -1) { + *(undefined1 *)&p_Var24->DebugInfo = 0; + p_Var24 = (_RTL_CRITICAL_SECTION *)((longlong)&p_Var24->DebugInfo + 1); + } + ppvVar17 = &local_158.OwningThread; + for (lVar19 = 0xf2; lVar19 != 0; lVar19 = lVar19 + -1) { + *(undefined1 *)ppvVar17 = 0; + ppvVar17 = (HANDLE *)((longlong)ppvVar17 + 1); + } + if (local_1b0 != (wchar_t *)0x0) { + NlDereferenceDomain(local_1b0,param_2,pwVar27,(undefined8 *)param_4); + } + if (local_1b8 != (HKEY)0x0) { + puVar25 = *(undefined1 **)(local_1b8 + 2); + for (uVar20 = (ulonglong)(ushort)local_1b8->unused; uVar20 != 0; uVar20 = uVar20 - 1) { + *puVar25 = 0; + puVar25 = puVar25 + 1; + } + LocalFree(local_1b8); + } + if (local_1a8 != (_FILETIME)0x0) { + puVar25 = *(undefined1 **)((longlong)local_1a8 + 8); + for (uVar20 = (ulonglong)*(ushort *)local_1a8; uVar20 != 0; uVar20 = uVar20 - 1) { + *puVar25 = 0; + puVar25 = puVar25 + 1; + } + LocalFree((HLOCAL)local_1a8); + } + if (local_1e4 != '\0') { if ((-1 < param_1[0x48].unused) && ((param_1[0x49].unused & 0x20000U) != 0)) { NlSetStatusClientSession((longlong)param_1,0xc000005e); } NlResetWriterClientSession((longlong)param_1); } - if (pvStack_1a0 != (HLOCAL)0x0) { - LocalFree(pvStack_1a0); - } - if (pvStack_190 != (HLOCAL)0x0) { - LocalFree(pvStack_190); - } - if (local_180 != (wchar_t *)0x0) { - *(uint *)local_180 = uVar11; - } - return local_1f8; + if (pvStack_188 != (HLOCAL)0x0) { + LocalFree(pvStack_188); + } + if (pvStack_178 != (HLOCAL)0x0) { + LocalFree(pvStack_178); + } + if (param_3 != (_FILETIME)0x0) { + *(uint *)param_3 = uVar11; + } + return local_1e8; } ``` ## NlNetlogonMain ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.69| |i_ratio|0.19| |m_ratio|0.97| |b_ratio|0.9| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlNetlogonMain|NlNetlogonMain| |fullname|NlNetlogonMain|NlNetlogonMain| |refcount|4|4| |`length`|1704|1641| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeSRWLock
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetSystemTimeAsFileTime
API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL::RegisterServiceCtrlHandlerW
GiveInstallHints
LSASRV.DLL::LsaIInitializeNetlogonFuncPtrs
LSASRV.DLL::LsaIOpenPolicyTrusted
LSASRV.DLL::LsaIRegisterPolicyChangeNotificationCallback
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitUnicodeStringNTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlInitializeResource
NTDLL.DLL::RtlLeaveCriticalSection
NlCleanup
NlInit
NlInitializeDomainNameMapper
NlInitializeLocatorConnectionCache
NlLoadStrings
NlMainLoop
NlOpenDebugFile
NlPrintRoutine
NlpWriteEventlogEx
NlparseAllSections
SAMSRV.DLL::SamIQueryCapabilities
memset
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::CreateEventW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::InitializeSRWLock
API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetSystemTimeAsFileTime
API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL::RegisterServiceCtrlHandlerW
EnableMitigations
Feature_Servicing_RedirectionGuard_Netlogon__private_IsEnabledDeviceUsageNoInline
GiveInstallHints
LSASRV.DLL::LsaIInitializeNetlogonFuncPtrs
LSASRV.DLL::LsaIOpenPolicyTrusted
NTDLL.DLL::RtlEnterCriticalSectionNTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlInitializeCriticalSection
NTDLL.DLL::RtlInitializeResource
NTDLL.DLL::RtlLeaveCriticalSection
NlCleanup
NlInit
NlInitChangeLogServiceStart
NlInitializeDomainNameMapper
NlInitializeLocatorConnectionCache
NlLoadStrings
NlMainLoop
NlOpenDebugFile
NlPrintRoutine
NlpWriteEventlogEx
NlparseAllSections
SAMSRV.DLL::SamIQueryCapabilities
memset
| |calling||| |paramcount|0|0| |`address`|18006e900|18006e7e0| |sig|DWORD __fastcall NlNetlogonMain(void)|DWORD __fastcall NlNetlogonMain(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlNetlogonMain Called Diff ```diff --- NlNetlogonMain called +++ NlNetlogonMain called @@ -5,0 +6,2 @@ +EnableMitigations +Feature_Servicing_RedirectionGuard_Netlogon__private_IsEnabledDeviceUsageNoInline @@ -9 +10,0 @@ -LSASRV.DLL::LsaIRegisterPolicyChangeNotificationCallback @@ -16,0 +18 @@ +NlInitChangeLogServiceStart ``` ### NlNetlogonMain Diff ```diff --- NlNetlogonMain +++ NlNetlogonMain @@ -1,231 +1,209 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ DWORD NlNetlogonMain(void) { uint uVar1; - uint uVar2; - int iVar3; - undefined8 uVar4; - undefined8 *puVar5; - code *pcVar6; - wchar_t *pwVar7; + int iVar2; + undefined8 uVar3; + undefined8 *puVar4; + code *pcVar5; + wchar_t *pwVar6; + code *pcVar7; code *pcVar8; - code *pcVar9; - uchar auVar10 [8]; + uchar auVar9 [8]; DWORD local_res18 [2]; LPCWSTR local_res20; - /* 0x6e900 24 NlNetlogonMain */ + /* 0x6e7e0 24 NlNetlogonMain */ + uVar1 = Feature_Servicing_RedirectionGuard_Netlogon__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 != 0) { + EnableMitigations(); + } memset(&NlGlobalParameters,0,0x228); NlGlobalMailslotHandle = 0; NlGlobalRpcServerStarted = 0; NlGlobalRemoteAccessCheckStarted = 0; NlGlobalServerSupportsAuthRpc = 1; NlGlobalResourceManagerNoCAP = 0; NlGlobalResourceManagerWithCAP = 0; NlGlobalUnicodeComputerName = 0; NlGlobalNetlogonSecurityDescriptor = 0; - uVar2 = 0; NlGlobalServerSupportsKerberosAuthRpc = 0; RtlInitializeCriticalSection(&NlGlobalChallengeCritSect); DAT_0 = &NlGlobalChallengeList; NlGlobalChallengeList = &NlGlobalChallengeList; NlGlobalChallengeCount = 0; _DAT_1 = &NlGlobalServiceAccountList; NlGlobalServiceAccountList = &NlGlobalServiceAccountList; NlGlobalServiceAccountInitialized = 0; NlGlobalWinSockInitialized = 0; _NlGlobalIpTransportCount = 0; DAT_2 = &NlGlobalTransportList; NlGlobalTransportList = &NlGlobalTransportList; DAT_3 = &NlGlobalDnsList; NlGlobalDnsList = &NlGlobalDnsList; DAT_4 = &NlGlobalDnsUpdateRequestList; NlGlobalDnsUpdateRequestList = &NlGlobalDnsUpdateRequestList; NlGlobalUnicodeDnsForestName = 0; RtlInitUnicodeString(&NlGlobalUnicodeDnsForestNameString,0); NlGlobalUtf8DnsForestName = 0; NlGlobalUtf8DnsForestNameAlias = 0; NlGlobalWinsockPnpSocket = 0xffffffffffffffff; NlGlobalWinsockPnpEvent = 0; NlGlobalWinsockPnpAddresses = 0; NlGlobalWinsockPnpAddressSize = 0; NlGlobalV6WinsockPnpSocket = 0xffffffffffffffff; NlGlobalV6WinsockPnpEvent = 0; NlGlobalV6WinsockPnpAddresses = 0; NlGlobalV6WinsockPnpAddressSize = 0; _DAT_5 = &NlGlobalPendingBdcList; NlGlobalPendingBdcList = &NlGlobalPendingBdcList; NlGlobalTerminateEvent = (HANDLE)0x0; NlGlobalStartedEvent = 0; NlGlobalTimerEvent = 0; NlGlobalServiceHandle = (SERVICE_STATUS_HANDLE)0x0; _NlGlobalServiceStatus = 0x30; _DAT_6 = 2; _DAT_7 = 1; _DAT_8 = 60000; _DAT_9 = 0; NlGlobalDomainInfo = 0; NlGlobalServicedDomainCount = 0; NlGlobalTrustedDomainList = 0; DAT_10 = 0; NlGlobalTrustedDomainCount = 0; NlGlobalTrustedDomainListTime = 0; NlGlobalSiteNameSetTime = 0; NlGlobalNoClientSiteCount = 0; GetSystemTimeAsFileTime((LPFILETIME)&NlGlobalNoClientSiteEventTime); NlGlobalPartialClientSiteMappingCount = 0; GetSystemTimeAsFileTime((LPFILETIME)&NlGlobalPartialClientSiteMappingEventTime); NlGlobalBindingHandleCount = 0; DAT_11 = 0xffffffff; DAT_12 = 0xffffffff; NlGlobalNetlogonUnloaded = NlGlobalChangeLogDllUnloaded; NlGlobalDsRunningUnknown = 1; _NlGlobalZeroGuid = 0; _DAT_13 = 0; NlGlobalJoinLogicDone = 0; NlGlobalCDC = 0; NlGlobalNextClosestSiteRetrieved = 0; NlGlobalVulnerableChannelAllowList = 0; InitializeSRWLock((PSRWLOCK)&DAT_14); NlGlobalScavengerTimer = 0; - DAT_15 = DAT_1800f5118 * 1000; + DAT_15 = DAT_1800f50b8 * 1000; NlGlobalParameters = 0; NlGlobalLogFile = 0xffffffffffffffff; NlGlobalDebugSharePath = 0; NlGlobalPartialDisable = 0; NlGlobalDsPaused = 1; NlGlobalDsPausedEvent = 0; NlGlobalDsPausedWaitHandle = 0; NlGlobalDcDemotionInProgress = 0; NlGlobalDcScavengerIsRunning = 0; _DAT_16 = NlDcScavenger; _DAT_17 = 0; DAT_18 = 0; NlGlobalTerminate = 0; NlGlobalUnloadNetlogon = 0; - auVar10[0] = '\0'; - auVar10[1] = '\0'; - auVar10[2] = '\0'; - auVar10[3] = '\0'; - auVar10[4] = '\0'; - auVar10[5] = '\0'; - auVar10[6] = '\0'; - auVar10[7] = '\0'; - pcVar9 = (code *)0x0; + auVar9[0] = '\0'; + auVar9[1] = '\0'; + auVar9[2] = '\0'; + auVar9[3] = '\0'; + auVar9[4] = '\0'; + auVar9[5] = '\0'; + auVar9[6] = '\0'; + auVar9[7] = '\0'; + pcVar8 = (code *)0x0; NlGlobalTerminateEvent = CreateEventW((LPSECURITY_ATTRIBUTES)0x0,1,0,(LPCWSTR)0x0); if (NlGlobalTerminateEvent == (HANDLE)0x0) { local_res18[0] = GetLastError(); - NlPrintRoutine(0x100,L"Cannot create termination Event %lu\n",(ulonglong)local_res18[0],auVar10) - ; + NlPrintRoutine(0x100,L"Cannot create termination Event %lu\n",(ulonglong)local_res18[0],auVar9); } else { RtlInitializeCriticalSection(&NlGlobalDcDiscoveryCritSect); RtlInitializeCriticalSection(&NlGlobalScavengerCritSect); RtlInitializeCriticalSection(&NlGlobalEventLoggerCritSect); RtlInitializeCriticalSection(&NlGlobalTransportCritSect); RtlInitializeCriticalSection(&NlGlobalDnsCritSect); RtlInitializeCriticalSection(&NlGlobalDnsUpdateRequestCritSect); RtlInitializeCriticalSection(&NlGlobalDnsForestNameCritSect); RtlInitializeCriticalSection(&NlGlobalServiceAccountCritSect); RtlInitializeResource(&NlGlobalRpcSecurityDescriptorLock); RtlInitializeResource(&NlGlobalRemoteAccessCheckSecurityDescriptorLock); RtlInitializeResource(&NlGlobalNtlmAllowedServersLock); RtlInitializeResource(&NlGlobalCompoundIdLock); RtlInitializeResource(&NlPcGlobalLock); RtlInitializeResource(&NlGlobalGMSADPAPILock); DAT_19 = 0xffffffff; RtlInitializeCriticalSection(&NlGlobalParametersCritSect); uVar1 = LsaIOpenPolicyTrusted(&NlGlobalLsaPolicyHandle); if ((int)uVar1 < 0) { - pcVar9 = (code *)(ulonglong)uVar1; - pwVar7 = L"Cannot open the LSA policy handle 0x%08x\n"; - pcVar6 = (code *)0x100; - NlPrintRoutine(0x100,L"Cannot open the LSA policy handle 0x%08x\n",pcVar9,auVar10); + pcVar8 = (code *)(ulonglong)uVar1; + pwVar6 = L"Cannot open the LSA policy handle 0x%08x\n"; + pcVar5 = (code *)0x100; + NlPrintRoutine(0x100,L"Cannot open the LSA policy handle 0x%08x\n",pcVar8,auVar9); } else { - NlPrintRoutine(1,L"Calling RegisterServiceCtrlHandler\n",pcVar9,auVar10); - pcVar8 = NlControlHandler; + NlPrintRoutine(1,L"Calling RegisterServiceCtrlHandler\n",pcVar8,auVar9); + pcVar7 = NlControlHandler; NlGlobalServiceHandle = RegisterServiceCtrlHandlerW(L"NETLOGON",NlControlHandler); if (NlGlobalServiceHandle == (SERVICE_STATUS_HANDLE)0x0) { local_res18[0] = GetLastError(); NlPrintRoutine(0x100,L"RegisterServiceCtrlHandler failed %lu\n",(ulonglong)local_res18[0], - auVar10); + auVar9); local_res20 = (LPCWSTR)(ulonglong)local_res18[0]; NlpWriteEventlogEx(0x1648,1,(LPCWSTR)local_res18,4,&local_res20,0x40000001,0xffffffff); return local_res18[0]; } - pcVar6 = (code *)0x0; - uVar4 = GiveInstallHints(0,pcVar8,pcVar9,(ulonglong)auVar10); - pwVar7 = (wchar_t *)pcVar8; - if ((int)uVar4 != 0) { + pcVar5 = (code *)0x0; + uVar3 = GiveInstallHints(0,pcVar7,pcVar8,(ulonglong)auVar9); + pwVar6 = (wchar_t *)pcVar7; + if ((int)uVar3 != 0) { NlOpenDebugFile(0); NlLoadStrings(); - pwVar7 = (wchar_t *)0x0; - pcVar6 = (code *)&NlGlobalParameters; - puVar5 = NlparseAllSections((undefined8 *)&NlGlobalParameters,'\0',pcVar9,auVar10); - if ((int)puVar5 != 0) { - NlPrintRoutine(1,L"Command line parsed successfully ...\n",pcVar9,auVar10); + pwVar6 = (wchar_t *)0x0; + pcVar5 = (code *)&NlGlobalParameters; + puVar4 = NlparseAllSections((undefined8 *)&NlGlobalParameters,'\0',pcVar8,auVar9); + if ((int)puVar4 != 0) { + pwVar6 = L"Command line parsed successfully ...\n"; + NlPrintRoutine(1,L"Command line parsed successfully ...\n",pcVar8,auVar9); if (NlGlobalNetlogonUnloaded != 0) { - NlPrintRoutine(1,L"Netlogon.dll has been unloaded (recover from it).\n",pcVar9,auVar10); + pwVar6 = L"Netlogon.dll has been unloaded (recover from it).\n"; + NlPrintRoutine(1,L"Netlogon.dll has been unloaded (recover from it).\n",pcVar8,auVar9); } NlInitializeLocatorConnectionCache(); NlInitializeDomainNameMapper(); uVar1 = SamIQueryCapabilities(); NlGlobalCDC = uVar1 & 1; RtlEnterCriticalSection(&NlGlobalEventLoggerCritSect); - DAT_20 = DAT_1800f511c * 1000; + DAT_20 = DAT_1800f50bc * 1000; GetSystemTimeAsFileTime((LPFILETIME)&NlGlobalEventLoggerTimer); - RtlLeaveCriticalSection(&NlGlobalEventLoggerCritSect); + pcVar5 = (code *)&NlGlobalEventLoggerCritSect; + RtlLeaveCriticalSection(); _DAT_21 = NlDcUserValReqEventsLogger; _DAT_22 = 0; DAT_23 = 0; - if (NlGlobalChangeLogPolicyNotificationRegistered == 0) { - pwVar7 = (wchar_t *)0x4; - pcVar6 = I_NetNotifyLsaPolicyChange; - uVar2 = LsaIRegisterPolicyChangeNotificationCallback(); - if ((int)uVar2 < 0) { - pcVar9 = (code *)(ulonglong)uVar2; - pwVar7 = - L"NlInitChangeLogServiceInit: LsaIRegisterPolicyChangeNotificationCallback failed Status:%lX\n" - ; - pcVar6 = (code *)0x100; - NlPrintRoutine(0x100, - L"NlInitChangeLogServiceInit: LsaIRegisterPolicyChangeNotificationCallback failed Status:%lX\n" - ,pcVar9,auVar10); - } - else { - NlGlobalChangeLogPolicyNotificationRegistered = 1; - } - } - else { - pwVar7 = - L"NlInitChangeLogServiceInit: policy notification registered on previous service start, nothing to do\n" - ; - pcVar6 = (code *)0x1; - NlPrintRoutine(1, - L"NlInitChangeLogServiceInit: policy notification registered on previous service start, nothing to do\n" - ,pcVar9,auVar10); - } - if ((-1 < (int)uVar2) && (uVar2 = NlInit(), uVar2 != 0)) { - pcVar9 = NetpGetGroupMSAPassword; - pcVar8 = I_NetLogonFree; - pcVar6 = I_NetLogonGetAuthDataEx; - iVar3 = LsaIInitializeNetlogonFuncPtrs(); - pwVar7 = (wchar_t *)pcVar8; - if (-1 < iVar3) { + uVar1 = NlInitChangeLogServiceStart(pcVar5,pwVar6,pcVar8,auVar9); + if ((-1 < (int)uVar1) && (uVar1 = NlInit(), uVar1 != 0)) { + pcVar8 = NetpGetGroupMSAPassword; + pcVar7 = I_NetLogonFree; + pcVar5 = I_NetLogonGetAuthDataEx; + iVar2 = LsaIInitializeNetlogonFuncPtrs(); + pwVar6 = (wchar_t *)pcVar7; + if (-1 < iVar2) { NlGlobalNetlogonUnloaded = 0; - NlMainLoop(pcVar6,pcVar8,(wchar_t *)pcVar9,auVar10); - pwVar7 = (wchar_t *)pcVar8; + NlMainLoop(pcVar5,pcVar7,(wchar_t *)pcVar8,auVar9); + pwVar6 = (wchar_t *)pcVar7; } } } } } - local_res18[0] = NlCleanup(pcVar6,pwVar7,(wchar_t *)pcVar9,(undefined8 *)auVar10); + local_res18[0] = NlCleanup(pcVar5,pwVar6,(wchar_t *)pcVar8,(undefined8 *)auVar9); } return local_res18[0]; } ``` ## NlDnsUpdateRequestWorker ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.17| |i_ratio|0.35| |m_ratio|0.95| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlDnsUpdateRequestWorker|NlDnsUpdateRequestWorker| |fullname|NlDnsUpdateRequestWorker|NlDnsUpdateRequestWorker| |refcount|3|3| |`length`|1851|2016| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcscpy_s
DNSAPI.DLL::DnsModifyRecordsInSet_UTF8
DNSAPI.DLL::DnsReplaceRecordSetUTF8
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpAllocWStrFromUtf8StrAsRequired
NetpCreateUtf8StrFromWStr
NetpDcBuildDnsName
NetpIpAddressToWStrNlPrintDnsNameInfoRoutine
NlPrintRoutine
NlpWriteEventlogEx
WS2_32.DLL::GetNameInfoW
__security_check_cookie
memset
swprintf_s
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcscpy_s
DNSAPI.DLL::DnsModifyRecordsInSet_UTF8
DNSAPI.DLL::DnsReplaceRecordSetUTF8
Feature_6086_9425__private_IsEnabledDeviceUsageNoInline
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpAllocWStrFromUtf8StrAsRequired
NetpCreateUtf8StrFromWStr
NetpDcBuildDnsNameNetpIpAddressToWStr
NlPrintDnsNameInfoRoutine
NlPrintRoutine
NlpWriteEventlogEx
WS2_32.DLL::GetNameInfoW
__security_check_cookie
memset
swprintf_s
| |calling||| |paramcount|0|0| |`address`|18002d180|18002d310| |sig|undefined __fastcall NlDnsUpdateRequestWorker(void)|undefined __fastcall NlDnsUpdateRequestWorker(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlDnsUpdateRequestWorker Called Diff ```diff --- NlDnsUpdateRequestWorker called +++ NlDnsUpdateRequestWorker called @@ -4,0 +5 @@ +Feature_6086_9425__private_IsEnabledDeviceUsageNoInline ``` ### NlDnsUpdateRequestWorker Diff ```diff --- NlDnsUpdateRequestWorker +++ NlDnsUpdateRequestWorker @@ -1,296 +1,324 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void NlDnsUpdateRequestWorker(void) { int iVar1; longlong *plVar2; code *pcVar3; - wchar_t *hMem; undefined1 *puVar4; uint uVar5; - int iVar6; - wchar_t *pwVar7; + uint uVar6; + int iVar7; undefined8 uVar8; LPSTR pCVar9; - wchar_t *hMem_00; - undefined4 uVar10; - longlong lVar11; - wchar_t *pwVar12; - undefined1 *puVar13; - wchar_t *pwVar14; - longlong lVar15; - wchar_t *pwVar16; - undefined1 auStackY_398 [8]; - undefined1 auStackY_390 [24]; - uint local_358; - UUID *local_350; - uint local_348; - undefined4 local_338 [4]; - undefined4 local_328; - WCHAR local_31c [2]; - uint local_318; - undefined4 local_310; - undefined4 uStack_30c; - undefined4 uStack_308; - undefined4 uStack_304; + longlong lVar10; + longlong *hMem; + undefined4 uVar11; + short *psVar12; + int *piVar13; + longlong *hMem_00; + undefined1 *puVar14; + wchar_t *pwVar15; + undefined4 *puVar16; + UUID *pUVar17; + longlong lVar18; + UUID *pUVar19; + UUID *pUVar20; + uint uVar21; + undefined1 auStackY_378 [8]; + undefined1 auStackY_370 [24]; + uint local_338; + uint local_334; + LPCWSTR local_330; + UUID *local_328; + undefined4 local_318; + undefined1 local_314 [12]; + int local_308; + WCHAR local_2fc; + short local_2fa; + undefined2 local_2f8; + undefined2 uStack_2f6; + undefined2 uStack_2f4; + undefined4 local_2f0; + undefined4 uStack_2ec; + undefined4 uStack_2e8; + undefined4 uStack_2e4; undefined1 local_2b8 [8]; uchar *local_2b0; undefined4 local_2a8; undefined4 local_2a0; longlong local_298; undefined2 local_290; undefined2 local_28e; undefined2 local_28c; - undefined2 local_258; - undefined4 local_256; - undefined2 local_252; + short local_258 [4]; undefined4 local_250; undefined4 uStack_24c; undefined4 uStack_248; undefined4 uStack_244; undefined4 local_240; - UUID *local_238; + LPCWSTR local_238; ulonglong local_230; - UUID *pUStack_228; + LPCWSTR pWStack_228; undefined2 *local_220; wchar_t *pwStack_218; wchar_t *local_210; wchar_t local_208 [16]; wchar_t local_1e8 [16]; - uchar local_1c8 [256]; - undefined2 local_c8 [72]; + undefined2 local_1c8 [72]; + uchar local_138 [256]; ulonglong local_38; - puVar13 = auStackY_398; - local_38 = __security_cookie ^ (ulonglong)auStackY_398; - memset(local_1c8,0,0x100); - pwVar7 = (wchar_t *)0x0; + puVar14 = auStackY_378; + local_38 = __security_cookie ^ (ulonglong)auStackY_378; + memset(local_138,0,0x100); + uVar21 = 0; + local_328 = (UUID *)0x0; memset(local_2b8,0,0x58); - local_358 = 0; - memset(local_338,0,0x78); + local_338 = 0; + memset(&local_318,0,0x60); builtin_wcsncpy(local_208 + 8,L"ABLE>",6); - builtin_wcsncpy(local_1e8 + 8,L"ABLE>",6); - builtin_wcsncpy(local_208,L"",0xe); local_230 = 0; - pUStack_228 = (UUID *)0x0; + pWStack_228 = (LPCWSTR)0x0; + local_238 = (LPCWSTR)0x0; local_220 = (undefined2 *)0x0; pwStack_218 = (wchar_t *)0x0; - pwVar16 = pwVar7; - do { - hMem_00 = (wchar_t *)0x0; + local_210 = (wchar_t *)0x0; + builtin_wcsncpy(local_208,L""); + } + } + else { + NetpIpAddressToWStr((ulonglong)CONCAT22(uStack_2f6,local_2f8),local_1c8); + } + } + else { + if (local_2fa != 2) { + psVar12 = &local_2fa; + goto LAB_7; + } + NetpIpAddressToWStr((ulonglong)CONCAT22(uStack_2f4,uStack_2f6),local_1c8); + } + swprintf_s(local_208,0xe,L"%lu",(ulonglong)(ushort)local_2fc); + swprintf_s(local_1e8,0xe,L"%lu"); + local_330 = (LPCWSTR)0x0; + uVar8 = NetpAllocWStrFromUtf8StrAsRequired + ((LPCSTR)local_138,-1,0,(LPWSTR)0x0,(longlong *)&local_330); + local_238 = (LPCWSTR)0x0; + if ((int)uVar8 == 0) { + local_238 = local_330; + } + local_330 = (LPCWSTR)0x0; + uVar8 = NetpAllocWStrFromUtf8StrAsRequired + ((LPCSTR)hMem_00[2],-1,0,(LPWSTR)0x0,(longlong *)&local_330); + pWStack_228 = (LPCWSTR)0x0; + if ((int)uVar8 == 0) { + pWStack_228 = local_330; + } + if ((local_238 != (LPCWSTR)0x0) && (pWStack_228 != (LPCWSTR)0x0)) { + local_230 = (ulonglong)uVar5; + local_220 = local_1c8; + pwStack_218 = local_208; + local_210 = local_1e8; + Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + NlpWriteEventlogEx(0x16b4 - (*(char *)(hMem_00[10] + 0x20 + (longlong)hMem * 0x28) + != '\0'),1,&local_2fc,2,&local_238,0x40000006,1); + } + NetApiBufferFree(local_238); + NetApiBufferFree(pWStack_228); + } + if (NlGlobalTerminate != 0) { + RtlEnterCriticalSection(&NlGlobalDnsUpdateRequestCritSect); + goto LAB_8; + } + } + else { + *(int *)(hMem_00[10] + 0x24 + (longlong)hMem * 0x28) = (int)uVar8; + NlPrintRoutine(0x100, + L"NlDnsUpdateRequestWorker: %hs: %ws: NetpDcBuildDnsName failed. %ld\n", + hMem_00[2],(&NlDcDnsNameTypeDesc)[lVar18 * 4]); + } } else { - pwVar14 = NlGlobalUtf8DnsForestName; - if (((iVar1 != 2) && (pwVar14 = NlGlobalUtf8DnsForestNameAlias, iVar1 != 3)) && - (pwVar14 = pwVar12, iVar1 == 4)) { - if (pwVar7 != (wchar_t *)0x0) { - NetApiBufferFree(pwVar7); - } - pwVar7 = (wchar_t *) - NetpCreateUtf8StrFromWStr - (*(LPCWSTR *) - (*(longlong *)(hMem + 0x28) + 8 + (longlong)hMem_00 * 0x28), - (LPSTR)0x0,0); - pwVar14 = pwVar7; - } + pCVar9 = NetpCreateUtf8StrFromWStr + (*(LPCWSTR *)(lVar10 + 8 + (longlong)hMem * 0x28),(LPSTR)local_138,0xff + ); + pUVar20 = pUVar17; + if (pCVar9 != (LPSTR)0x0) goto LAB_2; + *(undefined4 *)(hMem_00[10] + 0x24 + (longlong)hMem * 0x28) = 8; } - uVar8 = NetpDcBuildDnsName(iVar6,local_350,*(LPCWSTR *)(hMem + 0x1c),pwVar14,local_1c8); - if ((int)uVar8 == 0) { - pwVar16 = (wchar_t *)(ulonglong)local_358; - pwVar12 = pwVar14; -LAB_4: - memset(local_2b8,0,0x58); - local_2b0 = local_1c8; - local_2a0 = *(undefined4 *)(hMem + 0x20); - if (*(short *)(&DAT_3 + lVar15 * 4) == 5) { - local_2a8 = 0x80005; - local_358 = (uint)pwVar16 | 0x4000; - pwVar16 = (wchar_t *)(ulonglong)local_358; - local_298 = *(longlong *)(hMem + 8); - } - else { - local_2a8 = 0x100021; - local_298 = *(longlong *)(hMem + 8); - local_290 = *(undefined2 *) - (*(longlong *)(hMem + 0x28) + 0x14 + (longlong)hMem_00 * 0x28); - local_28e = *(undefined2 *) - (*(longlong *)(hMem + 0x28) + 0x18 + (longlong)hMem_00 * 0x28); - local_28c = *(undefined2 *) - (*(longlong *)(hMem + 0x28) + 0x1c + (longlong)hMem_00 * 0x28); - } - memset(local_338,0,0x78); - local_338[0] = 0x80000001; - local_328 = 1; - if (*(char *)(*(longlong *)(hMem + 0x28) + 0x20 + (longlong)hMem_00 * 0x28) == '\0') { - uVar5 = DnsModifyRecordsInSet_UTF8(0,local_2b8,pwVar16); - uVar10 = *(undefined4 *)(hMem + 0x20); - lVar11 = *(longlong *)(hMem + 0x28); - lVar15 = *(longlong *)(hMem + 8); - if (uVar5 == 0) { - pwVar14 = L"NlDnsUpdateRequestWorker: Deregistered (success)"; - goto LAB_5; - } - pwVar14 = L"NlDnsUpdateRequestWorker: Failed to deregister (%ld)"; -LAB_6: - NlPrintDnsNameInfoRoutine - (0x20000,(int *)(lVar11 + (longlong)hMem_00 * 0x28),pwVar12,local_1c8,lVar15, - uVar10,pwVar14); - *(uint *)(*(longlong *)(hMem + 0x28) + 0x24 + (longlong)hMem_00 * 0x28) = uVar5; - if (local_318 == 0) { - local_256 = 0; - local_252 = 0; - local_240 = 0; - local_258 = 0x17; - local_250 = local_310; - uStack_24c = uStack_30c; - uStack_248 = uStack_308; - uStack_244 = uStack_304; - iVar6 = GetNameInfoW(&local_258,0x1c,local_c8,0x42); - if (iVar6 != 0) { - _o_wcscpy_s(local_c8,0x42,L""); - } - } - else { - NetpIpAddressToWStr((ulonglong)local_318,local_c8); - } - swprintf_s(local_208,0xe,L"%lu",(ulonglong)(ushort)local_31c[0]); - swprintf_s(local_1e8,0xe,L"%lu"); - local_350 = (UUID *)0x0; - uVar8 = NetpAllocWStrFromUtf8StrAsRequired - ((LPCSTR)local_1c8,-1,0,(LPWSTR)0x0,(longlong *)&local_350); - local_238 = (UUID *)0x0; - if ((int)uVar8 == 0) { - local_238 = local_350; - } - local_350 = (UUID *)0x0; - uVar8 = NetpAllocWStrFromUtf8StrAsRequired - (*(LPCSTR *)(hMem + 8),-1,0,(LPWSTR)0x0,(longlong *)&local_350); - pUStack_228 = (UUID *)0x0; - if ((int)uVar8 == 0) { - pUStack_228 = local_350; - } - if ((local_238 != (UUID *)0x0) && (pUStack_228 != (UUID *)0x0)) { - local_230 = (ulonglong)uVar5; - local_220 = local_c8; - pwStack_218 = local_208; - local_210 = local_1e8; - NlpWriteEventlogEx(0x16b4 - (*(char *)(*(longlong *)(hMem + 0x28) + 0x20 + - (longlong)hMem_00 * 0x28) != '\0'),1,local_31c,2 - ,(LPCWSTR *)&local_238,0x40000006,1); - } - NetApiBufferFree(local_238); - NetApiBufferFree(pUStack_228); - } - else { - if (*(short *)(&DAT_3 + lVar15 * 4) == 5) { - uVar5 = DnsReplaceRecordSetUTF8(local_2b8,pwVar16,0); - } - else { - uVar5 = DnsModifyRecordsInSet_UTF8(local_2b8,0,pwVar16); - } - uVar10 = *(undefined4 *)(hMem + 0x20); - lVar11 = *(longlong *)(hMem + 0x28); - lVar15 = *(longlong *)(hMem + 8); - if (uVar5 != 0) { - pwVar14 = L"NlDnsUpdateRequestWorker: Failed to register (%ld)"; - goto LAB_6; - } - pwVar14 = L"NlDnsUpdateRequestWorker: Registered (success)"; -LAB_5: - NlPrintDnsNameInfoRoutine - (0x4000,(int *)(lVar11 + (longlong)hMem_00 * 0x28),pwVar12,local_1c8,lVar15, - uVar10,pwVar14); - } - pwVar12 = hMem; - if (NlGlobalTerminate != 0) goto LAB_7; - } - else { - *(int *)(*(longlong *)(hMem + 0x28) + 0x24 + (longlong)hMem_00 * 0x28) = (int)uVar8; - NlPrintRoutine(0x100, - L"NlDnsUpdateRequestWorker: %hs: %ws: NetpDcBuildDnsName failed. %ld\n", - *(longlong *)(hMem + 8),(&NlDcDnsNameTypeDesc)[lVar15 * 4]); - pwVar16 = (wchar_t *)(ulonglong)local_358; - } - } - else { - pCVar9 = NetpCreateUtf8StrFromWStr - (*(LPCWSTR *)(lVar11 + 8 + (longlong)hMem_00 * 0x28),(LPSTR)local_1c8, - 0xff); - if (pCVar9 != (LPSTR)0x0) goto LAB_4; - *(undefined4 *)(*(longlong *)(hMem + 0x28) + 0x24 + (longlong)hMem_00 * 0x28) = 8; - } - hMem_00 = (wchar_t *)(ulonglong)(local_348 + 1); + local_334 = local_334 + 1; + hMem = (longlong *)(ulonglong)local_334; + } while (local_334 < *(uint *)(hMem_00 + 9)); } + LocalFree(hMem_00); + if (NlGlobalTerminate != 0) goto code_r0x00018002da30; + } + puVar14 = puVar4; + NlGlobalDnsUpdateRequestInProgress = 0; + *(undefined8 *)(puVar14 + -8) = 0x18002da8b; + RtlLeaveCriticalSection(&NlGlobalDnsUpdateRequestCritSect); +LAB_9: + if (*(longlong *)(puVar14 + 0x50) != 0) { + *(undefined8 *)(puVar14 + -8) = 0x18002daa7; + NetApiBufferFree(*(longlong *)(puVar14 + 0x50)); + } + if (hMem != (longlong *)0x0) { + *(undefined8 *)(puVar14 + -8) = 0x18002dabb; LocalFree(hMem); - } while (NlGlobalTerminate == 0); -LAB_7: + } + *(undefined8 *)(puVar14 + -8) = 0x18002dacf; + return; +code_r0x00018002da30: RtlEnterCriticalSection(&NlGlobalDnsUpdateRequestCritSect); + hMem_00 = (longlong *)0x0; +LAB_8: NlGlobalDnsUpdateRequestInProgress = 0; RtlLeaveCriticalSection(&NlGlobalDnsUpdateRequestCritSect); - hMem_00 = pwVar12; -LAB_1: - if (pwVar7 != (wchar_t *)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x18002d872; - NetApiBufferFree(pwVar7); - } - if (hMem_00 != (wchar_t *)0x0) { - *(undefined8 *)(puVar13 + -8) = 0x18002d886; - LocalFree(hMem_00); - } - *(undefined8 *)(puVar13 + -8) = 0x18002d89a; - return; + hMem = hMem_00; + goto LAB_9; } ``` ## wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.72| |i_ratio|0.65| |m_ratio|0.99| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChangesImpl|EnsureSubscribedToFeatureConfigurationChangesImpl| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |refcount|2|2| |`length`|150|151| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |paramcount|1|1| |`address`|1800729c8|180072848| |sig|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl Diff ```diff --- wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl +++ wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl @@ -1,54 +1,54 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* private: unsigned int __cdecl wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl(void) __ptr64 */ uint __thiscall wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl (EnabledStateManager *this) { EnabledStateManager *SRWLock; EnabledStateManager *pEVar1; - code *pcVar2; - uint uVar3; + uint uVar2; + code *pcVar3; EnabledStateManager *local_res8; - if (*this == (EnabledStateManager)0x0) { - uVar3 = 0; + if (*(int *)this == 0) { + uVar2 = 0; } else { SRWLock = this + 8; AcquireSRWLockExclusive((PSRWLOCK)SRWLock); - pEVar1 = this + 0x20; + pEVar1 = this + 0x60; local_res8 = SRWLock; if (*(longlong *)pEVar1 == 0) { *(longlong *)pEVar1 = 0; - pcVar2 = g_wil_details_internalSubscribeFeatureStateChangeNotification; + pcVar3 = g_wil_details_internalSubscribeFeatureStateChangeNotification; if ((g_wil_details_internalSubscribeFeatureStateChangeNotification != (code *)0x0) || - (pcVar2 = g_wil_details_apiSubscribeFeatureStateChangeNotification, + (pcVar3 = g_wil_details_apiSubscribeFeatureStateChangeNotification, g_wil_details_apiSubscribeFeatureStateChangeNotification != (code *)0x0)) { - (*pcVar2)(pEVar1,::,this); + (*pcVar3)(pEVar1,::,this); } if (*(longlong *)pEVar1 == 0) { - uVar3 = 0; + uVar2 = 0; } else { - uVar3 = 1; + uVar2 = 1; *(undefined4 *)(this + 0x1c) = 1; } } else { - uVar3 = *(uint *)(this + 0x1c); + uVar2 = *(uint *)(this + 0x1c); } unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> *)&local_res8); } - return uVar3; + return uVar2; } ``` ## NetpDcBuildPing ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.26| |i_ratio|0.3| |m_ratio|0.98| |b_ratio|0.54| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NetpDcBuildPing|NetpDcBuildPing| |fullname|NetpDcBuildPing|NetpDcBuildPing| |refcount|3|3| |`length`|500|527| |`called`|NTDLL.DLL::RtlLengthSid
NetpLogonPutBytes
NetpLogonPutOemString
NetpLogonPutUnicodeString
NetpLogonUnicodeToOem
NetpMemoryAllocate
NetpMemoryFree
NetpULongPtrRoundUp
memmove
memset|Feature_740537659__private_IsEnabledDeviceUsageNoInline
NTDLL.DLL::RtlLengthSid
NetpLogonPutBytes
NetpLogonPutDomainSID
NetpLogonPutOemString
NetpLogonPutUnicodeString
NetpLogonPutUnicodeStringOld
NetpLogonUnicodeToOem
NetpMemoryAllocate
NetpMemoryFree| |calling|NetpDcInitializeContext|NetpDcInitializeContext| |paramcount|10|10| |`address`|18007f6c4|18007f614| |`sig`|uint __fastcall NetpDcBuildPing(int param_1, uint param_2, wchar_t * param_3, wchar_t * param_4, char * param_5, undefined8 param_6, void * param_7, uint param_8, undefined8 * param_9, int * param_10)|int __fastcall NetpDcBuildPing(int param_1, uint param_2, wchar_t * param_3, wchar_t * param_4, char * param_5, undefined8 param_6, void * param_7, uint param_8, undefined8 * param_9, int * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NetpDcBuildPing Called Diff ```diff --- NetpDcBuildPing called +++ NetpDcBuildPing called @@ -0,0 +1 @@ +Feature_740537659__private_IsEnabledDeviceUsageNoInline @@ -2,0 +4 @@ +NetpLogonPutDomainSID @@ -4,0 +7 @@ +NetpLogonPutUnicodeStringOld @@ -8,3 +10,0 @@ -NetpULongPtrRoundUp -memmove -memset ``` ### NetpDcBuildPing Diff ```diff --- NetpDcBuildPing +++ NetpDcBuildPing @@ -1,87 +1,92 @@ -uint NetpDcBuildPing(int param_1,uint param_2,wchar_t *param_3,wchar_t *param_4,char *param_5, - undefined8 param_6,void *param_7,uint param_8,undefined8 *param_9,int *param_10) +int NetpDcBuildPing(int param_1,uint param_2,wchar_t *param_3,wchar_t *param_4,char *param_5, + undefined8 param_6,void *param_7,uint param_8,undefined8 *param_9,int *param_10) { - uint uVar1; - uint *puVar2; - uint *puVar3; - size_t _Size; - uint *puVar4; - uint *puVar5; + int iVar1; + uint uVar2; + uint uVar3; + undefined4 *puVar4; + undefined8 uVar5; + char *pcVar6; uint local_res10 [2]; uint *local_38; - uint *local_30; + char *local_30; - puVar4 = (uint *)0x0; - local_30 = (uint *)0x0; + local_30 = (char *)0x0; + pcVar6 = (char *)0x0; local_res10[0] = param_2; if (param_1 == 0) { - uVar1 = 0; - if (param_7 != (void *)0x0) { - uVar1 = RtlLengthSid(param_7); + if (param_7 == (void *)0x0) { + uVar2 = 0; } - local_res10[0] = uVar1; - puVar3 = NetpMemoryAllocate(uVar1 + 0x1c0); - puVar2 = (uint *)0x0; - if (puVar3 != (uint *)0x0) { - *puVar3 = 0x12; - local_38 = puVar3 + 1; - NetpLogonPutUnicodeString(param_3,0x20,(ulonglong *)&local_38); - NetpLogonPutUnicodeString(param_4,0x82,(ulonglong *)&local_38); + else { + uVar2 = RtlLengthSid(param_7); + } + local_res10[0] = uVar2; + puVar4 = NetpMemoryAllocate(uVar2 + 0x1c0); + if (puVar4 != (undefined4 *)0x0) { + *puVar4 = 0x12; + local_38 = puVar4 + 1; + uVar3 = Feature_740537659__private_IsEnabledDeviceUsageNoInline(); + if (uVar3 == 0) { + NetpLogonPutUnicodeStringOld(param_3,0x20,(ulonglong *)&local_38); + NetpLogonPutUnicodeStringOld(param_4,0x82,(ulonglong *)&local_38); + } + else { + uVar5 = NetpLogonPutUnicodeString(param_3,0x20,(ulonglong *)&local_38); + iVar1 = (int)uVar5; + if (iVar1 != 0) goto LAB_0; + uVar5 = NetpLogonPutUnicodeString(param_4,0x82,(ulonglong *)&local_38); + iVar1 = (int)uVar5; + if (iVar1 != 0) goto LAB_0; + } NetpLogonPutOemString(param_5,0x101,&local_38); NetpLogonPutBytes((undefined1 *)¶m_6,4,(longlong *)&local_38); NetpLogonPutBytes((undefined1 *)local_res10,4,(longlong *)&local_38); - puVar2 = local_38; - local_30 = (uint *)0x0; - puVar5 = puVar4; - if (uVar1 != 0) { - NetpULongPtrRoundUp((ulonglong)local_38,4,(ulonglong *)&local_30); - if (puVar2 < local_30) { - _Size = (longlong)local_30 - (longlong)puVar2; - memset(puVar2,0,_Size); - puVar2 = (uint *)((longlong)puVar2 + _Size); - } - memmove(puVar2,param_7,(ulonglong)uVar1); - puVar2 = (uint *)((longlong)puVar2 + (ulonglong)uVar1); - } -LAB_0: - *puVar2 = param_8 | 1; - puVar2[1] = 0xffffffff; - *param_9 = puVar3; - *param_10 = ((int)puVar2 + 8) - (int)puVar3; - puVar2 = puVar4; - uVar1 = 0; + NetpLogonPutDomainSID(param_7,uVar2,(ulonglong *)&local_38); goto LAB_1; } } else { - puVar2 = NetpMemoryAllocate(0x13c); - if (puVar2 != (uint *)0x0) { - uVar1 = NetpLogonUnicodeToOem(param_3,&local_30); - puVar5 = local_30; - if (uVar1 == 0) { - local_38 = (uint *)((longlong)puVar2 + 2); - *(undefined2 *)puVar2 = 7; - NetpLogonPutOemString((char *)local_30,0x10,&local_38); + puVar4 = NetpMemoryAllocate(0x13c); + if (puVar4 != (undefined4 *)0x0) { + iVar1 = NetpLogonUnicodeToOem(param_3,&local_30); + pcVar6 = local_30; + if (iVar1 == 0) { + local_38 = (uint *)((longlong)puVar4 + 2); + *(undefined2 *)puVar4 = 7; + NetpLogonPutOemString(local_30,0x10,&local_38); NetpLogonPutOemString(param_5,0x100,&local_38); - NetpLogonPutUnicodeString(param_3,0x20,(ulonglong *)&local_38); - puVar3 = puVar2; - puVar2 = local_38; - goto LAB_0; + uVar2 = Feature_740537659__private_IsEnabledDeviceUsageNoInline(); + if (uVar2 == 0) { + NetpLogonPutUnicodeStringOld(param_3,0x20,(ulonglong *)&local_38); + } + else { + uVar5 = NetpLogonPutUnicodeString(param_3,0x20,(ulonglong *)&local_38); + iVar1 = (int)uVar5; + if (iVar1 != 0) goto LAB_2; + } +LAB_1: + iVar1 = 0; + *local_38 = param_8 | 1; + local_38[1] = 0xffffffff; + *param_9 = puVar4; + *param_10 = ((int)local_38 + 8) - (int)puVar4; + puVar4 = (undefined4 *)0x0; } -LAB_1: - if (puVar5 != (uint *)0x0) { - NetpMemoryFree(puVar5); +LAB_2: + if (pcVar6 != (char *)0x0) { + NetpMemoryFree(pcVar6); } - goto LAB_2; + goto LAB_0; } } - uVar1 = 8; -LAB_2: - if (puVar2 != (uint *)0x0) { - NetpMemoryFree(puVar2); + iVar1 = 8; +LAB_0: + if (puVar4 != (undefined4 *)0x0) { + NetpMemoryFree(puVar4); } - return uVar1; + return iVar1; } ``` ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length| |ratio|0.87| |i_ratio|0.33| |m_ratio|0.92| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |refcount|2|2| |`length`|71|85| |called||| |calling||| |paramcount|0|0| |address|180001710|180001710| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' Diff ```diff --- wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' +++ wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' @@ -1,17 +1,23 @@ + +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void wil::details::_dynamic_initializer_for__g_header_init_InitializeStagingHeaderInternalApi__ (void) { g_wil_details_ensureSubscribedToFeatureConfigurationChanges = EnsureSubscribedToFeatureConfigurationChanges; g_wil_details_subscribeFeatureStateCacheToConfigurationChanges = SubscribeFeatureStateCacheToConfigurationChanges; g_wil_details_internalRecordFeatureUsage = WilApiImpl_RecordFeatureUsage; g_wil_details_internalSubscribeFeatureStateChangeNotification = WilApiImpl_SubscribeFeatureStateChangeNotification; g_wil_details_internalUnsubscribeFeatureStateChangeNotification = WilApiImpl_UnsubscribeFeatureStateChangeNotification; + _g_wil_details_featureProcessUsageHook = + wistd::__function:: + __func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> + ::destroy; return; } ``` ## wil::details::WilApiImpl_RecordFeatureUsage ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,refcount,length,address| |ratio|0.58| |i_ratio|0.59| |m_ratio|0.91| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|WilApiImpl_RecordFeatureUsage|WilApiImpl_RecordFeatureUsage| |fullname|wil::details::WilApiImpl_RecordFeatureUsage|wil::details::WilApiImpl_RecordFeatureUsage| |`refcount`|2|3| |`length`|102|117| |called|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil_RtlStagingConfig_RecordFeatureUsage|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil_RtlStagingConfig_RecordFeatureUsage| |calling||| |paramcount|4|4| |`address`|180077820|180077760| |sig|void __cdecl WilApiImpl_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)|void __cdecl WilApiImpl_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::WilApiImpl_RecordFeatureUsage Diff ```diff --- wil::details::WilApiImpl_RecordFeatureUsage +++ wil::details::WilApiImpl_RecordFeatureUsage @@ -1,29 +1,30 @@ /* void __cdecl wil::details::WilApiImpl_RecordFeatureUsage(unsigned int,unsigned int,unsigned int,char const * __ptr64) */ void __cdecl wil::details::WilApiImpl_RecordFeatureUsage(uint param_1,uint param_2,uint param_3,char *param_4) { wil_details_ServiceReportingKind wVar1; wVar1 = param_2 & 0x7fffffff; if (((param_1 == 0) && (param_3 == 0)) && (wVar1 == 0)) { FeatureStateManager::FlushUsage((FeatureStateManager *)&g_featureStateManager); - return; } - if (wVar1 >> 0x1e != 0) { + else if (wVar1 >> 0x1e == 0) { + if ((param_3 == 0) && (wVar1 != 0xfe)) { + wil_RtlStagingConfig_RecordFeatureUsage(param_1,(ushort)wVar1,param_2 >> 0x1f); + } + else { + FeatureStateManager::RecordFeatureUsage + ((FeatureStateManager *)&g_featureStateManager,param_1,wVar1,(ulonglong)param_3); + } + } + else { FeatureStateManager::QueueBackgroundSRUMUsageReporting ((FeatureStateManager *)&g_featureStateManager,param_1,(ushort)wVar1,param_3); - return; } - if ((param_3 == 0) && (wVar1 != 0xfe)) { - wil_RtlStagingConfig_RecordFeatureUsage(param_1,(ushort)wVar1,param_2 >> 0x1f); - return; - } - FeatureStateManager::RecordFeatureUsage - ((FeatureStateManager *)&g_featureStateManager,param_1,wVar1,(ulonglong)param_3); return; } ``` ## NlDnsUpdate ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.17| |i_ratio|0.31| |m_ratio|0.93| |b_ratio|0.41| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlDnsUpdate|NlDnsUpdate| |fullname|NlDnsUpdate|NlDnsUpdate| |refcount|3|3| |`length`|1332|1489| |`called`|
Expand for full list:
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcscpy_s
DNSAPI.DLL::DnsModifyRecordsInSet_UTF8
DNSAPI.DLL::DnsReplaceRecordSetUTF8
GiveInstallHints
NETUTILS.DLL::NetApiBufferFree
NetpIpAddressToWStr
NlDnsNameToDomainName
NlDnsNameToWStr
NlpWriteEventlogEx
WS2_32.DLL::GetNameInfoW
__security_check_cookiememset
swprintf_s
|
Expand for full list:
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcscpy_s
DNSAPI.DLL::DnsModifyRecordsInSet_UTF8
DNSAPI.DLL::DnsReplaceRecordSetUTF8
Feature_6086_9425__private_IsEnabledDeviceUsageNoInline
GiveInstallHints
NETUTILS.DLL::NetApiBufferFree
NetpIpAddressToWStr
NlDnsNameToDomainName
NlDnsNameToWStr
NlpWriteEventlogEx
WS2_32.DLL::GetNameInfoW__security_check_cookie
memset
swprintf_s
| |calling|NlDnsDeregisterOne
NlDnsRegisterOne|NlDnsDeregisterOne
NlDnsRegisterOne| |paramcount|4|4| |`address`|18002cc38|18002cd38| |sig|ulonglong __fastcall NlDnsUpdate(longlong param_1, char param_2, undefined8 param_3, ulonglong param_4)|ulonglong __fastcall NlDnsUpdate(longlong param_1, char param_2, undefined8 param_3, ulonglong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlDnsUpdate Called Diff ```diff --- NlDnsUpdate called +++ NlDnsUpdate called @@ -3,0 +4 @@ +Feature_6086_9425__private_IsEnabledDeviceUsageNoInline ``` ### NlDnsUpdate Diff ```diff --- NlDnsUpdate +++ NlDnsUpdate @@ -1,206 +1,243 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ ulonglong NlDnsUpdate(longlong param_1,char param_2,undefined8 param_3,ulonglong param_4) { short sVar1; - int iVar2; - undefined8 uVar3; - ulonglong uVar4; - LPCWSTR pWVar5; - uint uVar6; + uint uVar2; + int iVar3; + undefined8 uVar4; + ulonglong uVar5; + LPCWSTR pWVar6; undefined1 *puVar7; - undefined1 *puVar8; - undefined8 uVar9; - wchar_t *pwVar10; - uint uVar11; - undefined1 auStackY_288 [32]; - uint local_248 [4]; - undefined4 local_238 [4]; - undefined4 local_228; - uint local_220; - WCHAR local_21c [2]; - uint local_218; - undefined4 local_210; - undefined4 uStack_20c; - undefined4 uStack_208; - undefined4 uStack_204; + short *psVar8; + undefined1 *puVar9; + uint uVar10; + undefined8 uVar11; + wchar_t *pwVar12; + undefined4 *puVar13; + undefined1 auStackY_268 [32]; + uint local_228 [4]; + undefined4 local_218 [4]; + int local_208; + uint local_200; + WCHAR local_1fc; + short local_1fa; + undefined2 uStack_1f8; + undefined2 local_1f6; + undefined2 uStack_1f4; + undefined4 local_1f0; + undefined4 uStack_1ec; + undefined4 uStack_1e8; + undefined4 uStack_1e4; undefined1 local_1b8 [8]; undefined8 local_1b0; undefined4 local_1a8; undefined4 local_1a0; undefined8 local_198; undefined8 uStack_190; - undefined2 local_158; - undefined4 local_156; - undefined2 local_152; + short local_158 [4]; undefined4 local_150; undefined4 uStack_14c; undefined4 uStack_148; undefined4 uStack_144; undefined4 local_140; LPCWSTR local_138; wchar_t *local_130; wchar_t *pwStack_128; wchar_t *local_120; wchar_t *pwStack_118; wchar_t local_110 [16]; wchar_t local_f0 [20]; WCHAR local_c8 [72]; ulonglong local_38; - local_38 = __security_cookie ^ (ulonglong)auStackY_288; + local_38 = __security_cookie ^ (ulonglong)auStackY_268; local_138 = (LPCWSTR)0x0; - uVar3 = 0; - uVar9 = 0x78; + uVar4 = 0; + uVar11 = 0x60; local_130 = (wchar_t *)0x0; pwStack_128 = (wchar_t *)0x0; local_120 = (wchar_t *)0x0; pwStack_118 = (wchar_t *)0x0; - memset(local_238,0,0x78); + memset(local_218,0,0x60); builtin_wcsncpy(local_110,L"",0xe); builtin_wcsncpy(local_f0,L"",0xe); - uVar3 = GiveInstallHints(0,uVar3,uVar9,param_4); - if ((int)uVar3 == 0) { -LAB_0: - uVar4 = 0x267b; + uVar4 = GiveInstallHints(0,uVar4,uVar11,param_4); + if ((int)uVar4 == 0) { + return 0x267b; + } + uVar2 = 0; + if (DAT_0 == 0) { + local_228[0] = 0x232c; + if (NlGlobalNoDynamicDnsLogged != 0) { + return 0x232c; + } + NlpWriteEventlogEx(0x16ae,2,(LPCWSTR)0x0,0,(LPCWSTR *)0x0,0,0xffffffff); + NlGlobalNoDynamicDnsLogged = 1; + goto LAB_1; + } + NlGlobalNoDynamicDnsLogged = 0; + memset(local_1b8,0,0x58); + uVar4 = uStack_190; + local_1b0 = *(undefined8 *)(param_1 + 0x40); + local_1a0 = DAT_2; + sVar1 = (&DAT_3)[(longlong)*(int *)(param_1 + 0x10) * 0x10]; + if (sVar1 == 1) { + if (*(short *)(param_1 + 0x70) == 2) { + local_1a8 = 0x40001; + local_198 = CONCAT44(local_198._4_4_,*(undefined4 *)(*(longlong *)(param_1 + 0x60) + 4)); + } + else if (*(short *)(param_1 + 0x70) == 0x17) { + local_1a8 = 0x10001c; + local_198 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 8); + uStack_190 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 0x10); + } } else { - uVar11 = 0; - if (DAT_1 == 0) { - local_248[0] = 0x232c; - if (NlGlobalNoDynamicDnsLogged != 0) { - return 0x232c; - } - NlpWriteEventlogEx(0x16ae,2,(LPCWSTR)0x0,0,(LPCWSTR *)0x0,0,0xffffffff); - NlGlobalNoDynamicDnsLogged = 1; + local_198 = *(undefined8 *)(param_1 + 0x58); + if (sVar1 == 5) { + local_1a8 = 0x80005; } else { - NlGlobalNoDynamicDnsLogged = 0; - memset(local_1b8,0,0x58); - uVar3 = uStack_190; - local_1b0 = *(undefined8 *)(param_1 + 0x40); - local_1a0 = DAT_2; - sVar1 = *(short *)(&DAT_3 + (longlong)*(int *)(param_1 + 0x10) * 4); - if (sVar1 == 1) { - if (*(short *)(param_1 + 0x70) == 2) { - local_1a8 = 0x40001; - local_198 = CONCAT44(local_198._4_4_,*(undefined4 *)(*(longlong *)(param_1 + 0x60) + 4)); - } - else if (*(short *)(param_1 + 0x70) == 0x17) { - local_1a8 = 0x10001c; - local_198 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 8); - uStack_190 = *(undefined8 *)(*(longlong *)(param_1 + 0x60) + 0x10); - } - } - else { - local_198 = *(undefined8 *)(param_1 + 0x58); - if (sVar1 == 5) { - local_1a8 = 0x80005; - } - else { - uStack_190._6_2_ = SUB82(uVar3,6); - uStack_190._0_6_ = - CONCAT24(*(undefined2 *)(param_1 + 0x54), - CONCAT22(*(undefined2 *)(param_1 + 0x50),*(undefined2 *)(param_1 + 0x4c))); - local_1a8 = 0x100021; - } - } - local_238[0] = 0x80000001; - if (DAT_4 == 0) { - uVar11 = 0x2000; - } - local_228 = 1; - uVar6 = uVar11 | 0x4000; - if (sVar1 != 5) { - uVar6 = uVar11; - } - if (param_2 == '\0') { - if (NlGlobalDcDemotionInProgress != '\0') { - uVar6 = uVar6 | 0x4000; - } - puVar8 = local_1b8; - puVar7 = (undefined1 *)0x0; -LAB_5: - uVar4 = DnsModifyRecordsInSet_UTF8(puVar7,puVar8,uVar6,0); - } - else { - if ((sVar1 != 5) && - (*(int *)(&DAT_6 + (longlong)*(int *)(param_1 + 0x10) * 0x20) != 1)) { - puVar8 = (undefined1 *)0x0; - puVar7 = local_1b8; - goto LAB_5; - } - uVar4 = DnsReplaceRecordSetUTF8(local_1b8,uVar6,0,0); - } - local_248[0] = (uint)uVar4; - if (local_248[0] == 0) { - *(undefined4 *)(param_1 + 0xf4) = 0; - return uVar4; - } - if ((local_248[0] == 0x5b4) || (local_248[0] == 0x232a)) { - if (NlDnsWriteServerFailureEventLog != 0) { - *(uint *)(param_1 + 0xf4) = local_248[0]; - pWVar5 = NlDnsNameToDomainName(param_1); - if (pWVar5 != (LPCWSTR)0x0) { - local_138 = pWVar5; - NlpWriteEventlogEx(0x1695,2,(LPCWSTR)local_248,4,&local_138,1,0xffffffff); - NetApiBufferFree(pWVar5); - } - } - return 0x232a; - } - if (((local_248[0] == 0x267b) || (local_248[0] == 0x267c)) || (local_248[0] == 0x273f)) { - *(uint *)(param_1 + 0xf4) = local_248[0]; - local_138 = (LPCWSTR)(uVar4 & 0xffffffff); - NlpWriteEventlogEx(0x1696,2,(LPCWSTR)local_248,4,&local_138,0x40000001,0xffffffff); - goto LAB_0; - } - *(uint *)(param_1 + 0xf4) = local_248[0]; - if (local_218 == 0) { - local_156 = 0; - local_152 = 0; - local_140 = 0; - local_158 = 0x17; - local_150 = local_210; - uStack_14c = uStack_20c; - uStack_148 = uStack_208; - uStack_144 = uStack_204; - iVar2 = GetNameInfoW(&local_158,0x1c,local_c8,0x42); - if (iVar2 != 0) { - _o_wcscpy_s(local_c8,0x42,L""); - } - } - else { - NetpIpAddressToWStr((ulonglong)local_218,local_c8); - } - swprintf_s(local_110,0xe,L"%lu",(ulonglong)(ushort)local_21c[0]); - uVar4 = (ulonglong)local_220; - pwVar10 = L"%lu"; - swprintf_s(local_f0,0xe,L"%lu"); - if (local_248[0] == 0x232c) { - local_138 = local_c8; - local_130 = local_110; - pwStack_128 = local_f0; - NlpWriteEventlogEx(0x168d,2,local_21c,2,&local_138,3,0xffffffff); - return 0x232c; - } - if (*(int *)(param_1 + 0x48) != 0) { - return (ulonglong)local_248[0]; - } - local_138 = (LPCWSTR)NlDnsNameToWStr(param_1,DAT_2,pwVar10,uVar4); - if (local_138 != (LPCWSTR)0x0) { - local_130 = (wchar_t *)(ulonglong)local_248[0]; - pwStack_128 = local_c8; - local_120 = local_110; - pwStack_118 = local_f0; - NlpWriteEventlogEx(0x168f - (param_2 != '\0'),1,local_21c,2,&local_138,0x40000005,1); - NetApiBufferFree(local_138); - } - } - uVar4 = (ulonglong)local_248[0]; - } - return uVar4; + uStack_190._6_2_ = SUB82(uVar4,6); + uStack_190._0_6_ = + CONCAT24(*(undefined2 *)(param_1 + 0x54), + CONCAT22(*(undefined2 *)(param_1 + 0x50),*(undefined2 *)(param_1 + 0x4c))); + local_1a8 = 0x100021; + } + } + local_218[0] = 0x80000001; + if (DAT_4 == 0) { + uVar2 = 0x2000; + } + uVar10 = uVar2 | 0x4000; + if (sVar1 != 5) { + uVar10 = uVar2; + } + uVar2 = Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + local_208 = (uVar2 != 0) + 1; + uVar2 = Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + if (uVar2 == 0) { + if (param_2 == '\0') { + if (NlGlobalDcDemotionInProgress != '\0') { + uVar10 = uVar10 | 0x4000; + } + puVar9 = local_1b8; + puVar7 = (undefined1 *)0x0; + } + else { + if (((&DAT_3)[(longlong)*(int *)(param_1 + 0x10) * 0x10] == 5) || + (*(int *)(&DAT_5 + (longlong)*(int *)(param_1 + 0x10) * 0x20) == 1)) { + puVar13 = (undefined4 *)0x0; + goto LAB_6; + } + puVar9 = (undefined1 *)0x0; + puVar7 = local_1b8; + } +LAB_7: + uVar5 = DnsModifyRecordsInSet_UTF8(puVar7,puVar9,uVar10,0); + } + else { + if (param_2 == '\0') { + if (NlGlobalDcDemotionInProgress != '\0') { + uVar10 = uVar10 | 0x4000; + } + puVar9 = local_1b8; + puVar7 = (undefined1 *)0x0; + goto LAB_7; + } + if (((&DAT_3)[(longlong)*(int *)(param_1 + 0x10) * 0x10] != 5) && + (*(int *)(&DAT_5 + (longlong)*(int *)(param_1 + 0x10) * 0x20) != 1)) { + puVar9 = (undefined1 *)0x0; + puVar7 = local_1b8; + goto LAB_7; + } + puVar13 = local_218; +LAB_6: + uVar5 = DnsReplaceRecordSetUTF8(local_1b8,uVar10,0,puVar13); + } + local_228[0] = (uint)uVar5; + if (local_228[0] == 0) { + *(undefined4 *)(param_1 + 0xf4) = 0; + return uVar5; + } + if ((local_228[0] == 0x5b4) || (local_228[0] == 0x232a)) { + if (NlDnsWriteServerFailureEventLog != 0) { + *(uint *)(param_1 + 0xf4) = local_228[0]; + pWVar6 = NlDnsNameToDomainName(param_1); + if (pWVar6 != (LPCWSTR)0x0) { + local_138 = pWVar6; + NlpWriteEventlogEx(0x1695,2,(LPCWSTR)local_228,4,&local_138,1,0xffffffff); + NetApiBufferFree(pWVar6); + } + } + return 0x232a; + } + if (((local_228[0] == 0x267b) || (local_228[0] == 0x267c)) || (local_228[0] == 0x273f)) { + *(uint *)(param_1 + 0xf4) = local_228[0]; + local_138 = (LPCWSTR)(uVar5 & 0xffffffff); + NlpWriteEventlogEx(0x1696,2,(LPCWSTR)local_228,4,&local_138,0x40000001,0xffffffff); + return 0x267b; + } + *(uint *)(param_1 + 0xf4) = local_228[0]; + uVar2 = Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + if (uVar2 == 0) { + uVar2 = CONCAT22(local_1f6,uStack_1f8); + if (uVar2 != 0) goto LAB_8; + local_158[1] = 0; + local_158[2] = 0; + local_158[3] = 0; + psVar8 = local_158; + local_150 = local_1f0; + uStack_14c = uStack_1ec; + uStack_148 = uStack_1e8; + uStack_144 = uStack_1e4; + local_140 = 0; + local_158[0] = 0x17; +LAB_9: + iVar3 = GetNameInfoW(psVar8,0x1c,local_c8,0x42); + if (iVar3 != 0) { + _o_wcscpy_s(local_c8,0x42,L""); + } + } + else { + if (local_1fa != 2) { + psVar8 = &local_1fa; + goto LAB_9; + } + uVar2 = CONCAT22(uStack_1f4,local_1f6); +LAB_8: + NetpIpAddressToWStr((ulonglong)uVar2,local_c8); + } + Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + swprintf_s(local_110,0xe,L"%lu",(ulonglong)(ushort)local_1fc); + uVar5 = (ulonglong)local_200; + pwVar12 = L"%lu"; + swprintf_s(local_f0,0xe,L"%lu"); + if (local_228[0] == 0x232c) { + local_138 = local_c8; + local_130 = local_110; + pwStack_128 = local_f0; + Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + NlpWriteEventlogEx(0x168d,2,&local_1fc,2,&local_138,3,0xffffffff); + return 0x232c; + } + if (*(int *)(param_1 + 0x48) != 0) { + return (ulonglong)local_228[0]; + } + local_138 = (LPCWSTR)NlDnsNameToWStr(param_1,DAT_2,pwVar12,uVar5); + if (local_138 != (LPCWSTR)0x0) { + local_130 = (wchar_t *)(ulonglong)local_228[0]; + pwStack_128 = local_c8; + local_120 = local_110; + pwStack_118 = local_f0; + Feature_6086_9425__private_IsEnabledDeviceUsageNoInline(); + NlpWriteEventlogEx(0x168f - (param_2 != '\0'),1,&local_1fc,2,&local_138,0x40000005,1); + NetApiBufferFree(local_138); + } +LAB_1: + return (ulonglong)local_228[0]; } ``` ## wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.44| |i_ratio|0.59| |m_ratio|0.96| |b_ratio|0.94| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|GetContextAndNotifyFailure|GetContextAndNotifyFailure| |fullname|wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure|wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure| |refcount|2|2| |`length`|188|202| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details_abi::ThreadLocalStorage::GetLocal|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ThreadFailureCallbackHolder::GetThreadContext
wil::details_abi::ThreadLocalStorage::GetLocal| |calling|wil::details::GetContextAndNotifyFailure|wil::details::GetContextAndNotifyFailure| |paramcount|3|3| |`address`|180072e64|180072ce4| |sig|void __cdecl GetContextAndNotifyFailure(FailureInfo * param_1, char * param_2, __uint64 param_3)|void __cdecl GetContextAndNotifyFailure(FailureInfo * param_1, char * param_2, __uint64 param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure Diff ```diff --- wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure +++ wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure @@ -1,53 +1,59 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: static void __cdecl wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure(struct wil::FailureInfo * __ptr64,char * __ptr64,unsigned __int64) */ void __cdecl wil::details::ThreadFailureCallbackHolder::GetContextAndNotifyFailure (FailureInfo *param_1,char *param_2,__uint64 param_3) { - bool bVar1; - byte bVar2; - ThreadFailureCallbackHolder **ppTVar3; - bool bVar4; - byte bVar5; - ThreadFailureCallbackHolder *pTVar6; + ThreadFailureCallbackHolder TVar1; + bool bVar2; + byte bVar3; + ThreadFailureCallbackHolder **ppTVar4; + bool bVar5; + byte bVar6; + ThreadFailureCallbackHolder *pTVar7; - bVar4 = false; - bVar5 = 0; + bVar5 = false; + bVar6 = 0; *param_2 = '\0'; if (g_pThreadFailureCallbacks != (ThreadLocalStorage *)0x0) { - ppTVar3 = details_abi:: + ppTVar4 = details_abi:: ThreadLocalStorage::GetLocal ((ThreadLocalStorage *)param_1,SUB81(param_2,0)); - if ((ppTVar3 != (ThreadFailureCallbackHolder **)0x0) && - (*ppTVar3 != (ThreadFailureCallbackHolder *)0x0)) { + if ((ppTVar4 != (ThreadFailureCallbackHolder **)0x0) && + (*ppTVar4 != (ThreadFailureCallbackHolder *)0x0)) { *param_2 = '\0'; - bVar1 = GetThreadContext(param_1,*ppTVar3,param_2,param_3); - if (bVar1) { + bVar2 = GetThreadContext(param_1,*ppTVar4,param_2,param_3); + if (bVar2) { *(char **)(param_1 + 0x48) = param_2; } - pTVar6 = *ppTVar3; - bVar5 = 0; + pTVar7 = *ppTVar4; + bVar6 = 0; do { - bVar2 = (**(code **)**(undefined8 **)(pTVar6 + 8))(*(undefined8 **)(pTVar6 + 8),param_1); - pTVar6 = *(ThreadFailureCallbackHolder **)(pTVar6 + 0x10); - bVar5 = bVar5 | bVar2; - } while (pTVar6 != (ThreadFailureCallbackHolder *)0x0); + TVar1 = pTVar7[0x28]; + pTVar7[0x28] = (ThreadFailureCallbackHolder)0x1; + if (TVar1 == (ThreadFailureCallbackHolder)0x0) { + bVar3 = (**(code **)**(undefined8 **)(pTVar7 + 8))(*(undefined8 **)(pTVar7 + 8),param_1); + bVar6 = bVar6 | bVar3; + pTVar7[0x28] = (ThreadFailureCallbackHolder)0x0; + } + pTVar7 = *(ThreadFailureCallbackHolder **)(pTVar7 + 0x10); + } while (pTVar7 != (ThreadFailureCallbackHolder *)0x0); } } if (g_pfnTelemetryCallback != (_func_void_bool_FailureInfo_ptr *)0x0) { - if ((bVar5 != 0) || (((byte)param_1[4] & 2) != 0)) { - bVar4 = true; + if ((bVar6 != 0) || (((byte)param_1[4] & 2) != 0)) { + bVar5 = true; } - (*g_pfnTelemetryCallback)(bVar4,param_1); + (*g_pfnTelemetryCallback)(bVar5,param_1); } return; } ``` ## NlpLogonSamLogon ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.08| |i_ratio|0.25| |m_ratio|0.98| |b_ratio|0.54| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpLogonSamLogon|NlpLogonSamLogon| |fullname|NlpLogonSamLogon|NlpLogonSamLogon| |refcount|5|5| |`length`|2991|2889| |`called`|
Expand for full list:
API-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceCounter
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcsncpy_s
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::FreeSid
Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline
FreeValidationInformation
IsTicketLogonRequestSupported
LSASRV.DLL::LsaIFreeHeap
LSASRV.DLL::LsaIValidateTargetInfo
NTDLL.DLL::RtlAcquireResourceShared
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitUnicodeStringNTDLL.DLL::RtlInitUnicodeStringEx
NTDLL.DLL::RtlLeaveCriticalSection
NTDLL.DLL::RtlReleaseResource
NlAssertFailed
NlCheckAuthenticator
NlDereferenceDomain
NlEndNetlogonCall
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNamedServerSession
NlIsTargetAllowed
NlPcIncrement32
NlPcIncrement64
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutine
NlStartNetlogonCall
NlUnrefClientSession
NlVerifyRpcIsSecured
NlpCopySid
NlpDecryptLogonInformation
NlpEncryptValidationInformation
NlpExtractNtlmTargetInfo
NlpLogonTypeToText
NlpNtlmlessLogServerDomain
NlpUserValidate
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld
SAMSRV.DLL::SamIMixedDomain
__security_check_cookie
|
Expand for full list:
API-MS-WIN-CORE-PROFILE-L1-1-0.DLL::QueryPerformanceCounter
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o_wcsncpy_s
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::FreeSid
FreeValidationInformation
IsTicketLogonRequestSupported
LSASRV.DLL::LsaIFreeHeap
LSASRV.DLL::LsaIValidateTargetInfo
NTDLL.DLL::RtlAcquireResourceShared
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlInitUnicodeStringExNTDLL.DLL::RtlLeaveCriticalSection
NTDLL.DLL::RtlReleaseResource
NlAssertFailed
NlCheckAuthenticator
NlDereferenceDomain
NlEndNetlogonCall
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNamedServerSession
NlIsTargetAllowed
NlPcIncrement32
NlPcIncrement64
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutine
NlStartNetlogonCall
NlUnrefClientSession
NlVerifyRpcIsSecured
NlpCopySid
NlpDecryptLogonInformation
NlpEncryptValidationInformation
NlpExtractNtlmTargetInfo
NlpLogonTypeToText
NlpNtlmlessLogServerDomain
NlpUserValidate
NlpValidateNTLMTargetInfo
SAMSRV.DLL::SamIMixedDomain
__security_check_cookie
| |calling|NetILogonSamLogon
NetrLogonSamLogon
NetrLogonSamLogonEx
NetrLogonSamLogonWithFlags|NetILogonSamLogon
NetrLogonSamLogon
NetrLogonSamLogonEx
NetrLogonSamLogonWithFlags| |paramcount|12|12| |`address`|1800387e4|180039454| |`sig`|uint __fastcall NlpLogonSamLogon(RPC_BINDING_HANDLE param_1, short * param_2, _FILETIME param_3, wchar_t * param_4, _FILETIME param_5, uint param_6, wchar_t * param_7, uint param_8, _FILETIME param_9, byte * param_10, uint * param_11, int param_12)|uint __fastcall NlpLogonSamLogon(RPC_BINDING_HANDLE param_1, short * param_2, _FILETIME param_3, longlong * param_4, _FILETIME param_5, uint param_6, wchar_t * param_7, uint param_8, char * param_9, byte * param_10, uint * param_11, int param_12)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpLogonSamLogon Called Diff ```diff --- NlpLogonSamLogon called +++ NlpLogonSamLogon called @@ -4 +3,0 @@ -Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline @@ -39 +37,0 @@ -NlpValidateNTLMTargetInfoOld ``` ### NlpLogonSamLogon Diff ```diff --- NlpLogonSamLogon +++ NlpLogonSamLogon @@ -1,636 +1,565 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -uint NlpLogonSamLogon(RPC_BINDING_HANDLE param_1,short *param_2,_FILETIME param_3,wchar_t *param_4, - _FILETIME param_5,uint param_6,wchar_t *param_7,uint param_8,_FILETIME param_9, +uint NlpLogonSamLogon(RPC_BINDING_HANDLE param_1,short *param_2,_FILETIME param_3,longlong *param_4, + _FILETIME param_5,uint param_6,wchar_t *param_7,uint param_8,char *param_9, byte *param_10,uint *param_11,int param_12) { bool bVar1; uint *puVar2; - RPC_BINDING_HANDLE pvVar3; + _FILETIME *p_Var3; char cVar4; - uint uVar5; + BOOL BVar5; uint uVar6; - BOOL BVar7; - undefined8 uVar8; - _FILETIME _Var9; + undefined8 uVar7; + _FILETIME _Var8; + undefined8 *puVar9; undefined8 *puVar10; longlong lVar11; - _FILETIME _Var12; - _FILETIME _Var13; - char *pcVar14; - DWORD DVar15; - wchar_t *pwVar16; - _FILETIME _Var17; - _FILETIME _Var18; - _FILETIME _Var19; - DWORD DVar20; - bool bVar21; - undefined1 auStackY_1e8 [32]; - _FILETIME local_158; - _FILETIME local_150; - _FILETIME local_148; - char local_140; - DWORD local_13c; + wchar_t *pwVar12; + PUCHAR pUVar13; + _FILETIME _Var14; + _FILETIME _Var15; + uint uVar16; + bool bVar17; + undefined1 auStackY_1d8 [32]; + uint local_148; + char local_144; + _FILETIME local_140; _FILETIME local_138; uint local_130 [2]; - uint *local_128; - uint local_120; + undefined8 *local_128; + uint *local_120; _FILETIME local_118; uint local_110; undefined4 local_10c; - RPC_BINDING_HANDLE local_108; - _FILETIME local_100; - LARGE_INTEGER local_f8; - _FILETIME local_f0; - uint local_e8; - uint local_e4; - undefined8 *local_e0; - HLOCAL local_d8; - LARGE_INTEGER local_d0; - _FILETIME local_c8; - uint local_c0 [2]; - _FILETIME local_b8; - undefined8 local_b0; - undefined8 uStack_a8; - undefined8 local_a0; - undefined8 uStack_98; - undefined8 local_90; - undefined8 uStack_88; - uint local_80; - undefined8 local_78; - undefined8 uStack_70; - undefined8 local_68; - undefined8 uStack_60; - ulonglong local_58; + _FILETIME local_108; + uint local_100; + _FILETIME local_f8; + LARGE_INTEGER local_f0; + _FILETIME *local_e8; + uint local_e0; + uint local_dc; + undefined8 *local_d8; + HLOCAL local_d0; + LARGE_INTEGER local_c8; + _FILETIME local_c0; + uint local_b8 [2]; + _FILETIME local_b0; + undefined8 local_a8; + undefined8 uStack_a0; + undefined8 local_98; + undefined8 uStack_90; + undefined8 local_88; + undefined8 uStack_80; + uint local_78; + undefined8 local_70; + undefined8 uStack_68; + undefined8 local_60; + undefined8 uStack_58; + ulonglong local_50; - local_58 = __security_cookie ^ (ulonglong)auStackY_1e8; - _Var18.dwLowDateTime = 0; - _Var18.dwHighDateTime = 0; - local_150 = param_5; - local_80 = 0; - _Var17.dwLowDateTime = 0; - _Var17.dwHighDateTime = 0; - local_e8 = *param_11; - *param_11 = local_e8 & 0xffffcfff; + local_50 = __security_cookie ^ (ulonglong)auStackY_1d8; + _Var8.dwLowDateTime = 0; + _Var8.dwHighDateTime = 0; + local_108 = param_5; + local_78 = 0; + local_e0 = *param_11; + *param_11 = local_e0 & 0xffffcfff; *param_10 = 1; - *(undefined8 *)param_9 = 0; - _Var12 = *(_FILETIME *)param_7; - local_120 = param_6; - local_c8 = (_FILETIME)param_7; - local_f0 = param_9; - local_128 = param_11; - local_158.dwLowDateTime = 0; - local_158.dwHighDateTime = 0; + param_9[0] = '\0'; + param_9[1] = '\0'; + param_9[2] = '\0'; + param_9[3] = '\0'; + param_9[4] = '\0'; + param_9[5] = '\0'; + param_9[6] = '\0'; + param_9[7] = '\0'; + _Var14 = *(_FILETIME *)param_7; + local_100 = param_6; + local_c0 = (_FILETIME)param_7; + local_e8 = (_FILETIME *)param_9; + local_120 = param_11; + local_128 = (undefined8 *)0x0; local_10c = 0; local_110 = 0; - local_d8 = (HLOCAL)0x0; - local_b0 = 0; - uStack_a8 = 0; - local_e0 = (undefined8 *)0x0; - local_90 = 0; - uStack_88 = 0; - local_e4 = param_6; - local_78 = 0; - uStack_70 = 0; - local_f8.QuadPart = 0; - local_68 = 0; - uStack_60 = 0; - local_d0.QuadPart = 0; - local_100.dwLowDateTime = 0; - local_100.dwHighDateTime = 0; + local_d0 = (HLOCAL)0x0; + local_a8 = 0; + uStack_a0 = 0; + local_d8 = (undefined8 *)0x0; + local_88 = 0; + uStack_80 = 0; + local_dc = param_6; + local_70 = 0; + uStack_68 = 0; + local_f0.QuadPart = 0; + local_60 = 0; + uStack_58 = 0; + local_c8.QuadPart = 0; + local_f8.dwLowDateTime = 0; + local_f8.dwHighDateTime = 0; local_130[0] = 0; - local_13c = 0; - _Var19 = _Var18; - local_148 = _Var12; + _Var15 = _Var8; + local_138 = _Var14; local_118 = param_3; - local_108 = param_1; - uVar8 = NlStartNetlogonCall(); - if ((int)uVar8 == 0) { + uVar7 = NlStartNetlogonCall(); + if ((int)uVar7 == 0) { return 0xc0000192; } - _Var9 = _Var18; - if (_Var12 == (_FILETIME)0x0) { -LAB_0: - local_158.dwLowDateTime = 0; - local_158.dwHighDateTime = 0; + if (_Var14 == (_FILETIME)0x0) { uVar6 = 0xc000000d; - param_4 = (wchar_t *)param_9; - _Var17 = _Var18; + local_148 = uVar6; + goto LAB_0; + } + _Var8 = (_FILETIME)NlFindDomainByServerName(param_2,param_9,param_7,_Var15); + local_140 = _Var8; + if ((NlGlobalParameters & 4) != 0) { + param_7._4_4_ = 0; + param_7._0_4_ = param_6; + param_9 = (char *)local_118; + _Var15 = local_c0; + NlPrintLogonParameters + ((longlong)_Var8,(longlong)local_118,param_6,(longlong *)local_c0,*local_120, + (uint *)0x0); + } + if (_Var8 == (_FILETIME)0x0) { + uVar6 = 0xc0000122; + local_148 = uVar6; + goto LAB_0; + } + param_9._4_4_ = 0; + param_9._0_4_ = param_8; + if ((((param_8 != 2) && (param_8 != 3)) && (param_8 != 4)) && + (((param_8 != 5 && (param_8 != 6)) && (param_8 != 7)))) { +LAB_1: + uVar6 = 0xc0000003; + *param_10 = 1; + local_148 = 0xc0000003; + goto LAB_0; + } + if (((param_6 == 1) || (param_6 == 2)) || (param_6 == 3)) { +LAB_2: + if ((param_8 != 2) && (param_8 != 3)) { + bVar17 = param_8 == 6; + goto LAB_3; + } } else { - _Var9 = (_FILETIME)NlFindDomainByServerName(param_2,param_9,param_7,_Var19); - local_138 = _Var9; - if ((NlGlobalParameters & 4) != 0) { - param_7._4_4_ = 0; - param_7._0_4_ = param_6; - param_9 = local_118; - _Var19 = local_c8; - NlPrintLogonParameters - ((longlong)_Var9,(longlong)local_118,param_6,(longlong *)local_c8,*local_128, - (uint *)0x0); - } - if (_Var9 == (_FILETIME)0x0) { - uVar6 = 0xc0000122; - param_4 = (wchar_t *)param_9; - local_158 = _Var18; + if (param_6 == 4) { + if (param_8 == 4) goto LAB_4; + bVar17 = param_8 == 5; } else { - _Var12.dwHighDateTime = 0; - _Var12.dwLowDateTime = param_8; - if ((((param_8 == 2) || (param_8 == 3)) || (param_8 == 4)) || - (((param_8 == 5 || (param_8 == 6)) || (param_8 == 7)))) { - if (((param_6 == 1) || (param_6 == 2)) || (param_6 == 3)) { -LAB_1: - if ((param_8 != 2) && (param_8 != 3)) { - bVar21 = param_8 == 6; - goto LAB_2; + if (((param_6 == 5) || (param_6 == 6)) || (param_6 == 7)) goto LAB_2; + if (param_6 != 8) goto LAB_1; + bVar17 = param_8 == 7; + } +LAB_3: + if (!bVar17) goto LAB_1; + } +LAB_4: + BVar5 = QueryPerformanceCounter(&local_f0); + param_9._0_4_ = 0; + param_9._4_4_ = 0; + if (BVar5 == 0) { + local_f0.QuadPart = 0; + } + bVar17 = false; + if ((param_6 - 2 & 0xfffffffb) == 0) { + bVar1 = true; + if (param_6 != 6) goto LAB_5; +LAB_6: + bVar17 = true; + } + else { + bVar1 = false; +LAB_5: + if ((param_6 - 5 & 0xfffffffd) == 0) goto LAB_6; + } + local_144 = param_6 - 1 < 3; + if ((bVar17) || (bVar17 = false, (bool)local_144)) { + bVar17 = true; + } + _Var8 = local_140; + _Var14 = local_138; + if (((!bVar17) && (param_6 != 4)) && (param_6 != 8)) { + *param_10 = 1; + uVar6 = 0xc0000003; + local_148 = uVar6; + goto LAB_0; + } + if (param_12 == 0) { + if (NlGlobalMemberWorkstation != 0) { + uVar6 = 0xc00000bb; + local_148 = uVar6; + goto LAB_0; + } + if (((param_2 != (short *)0x0) && (local_118 != (_FILETIME)0x0)) && + (((param_4 != (longlong *)0x0 && (local_108 != (_FILETIME)0x0)) || + (param_1 != (RPC_BINDING_HANDLE)0x0)))) { + pUVar13 = (PUCHAR)((longlong)local_140 + 0x1f8); + RtlEnterCriticalSection(pUVar13); + param_9 = (char *)local_118; + puVar10 = NlFindNamedServerSession((longlong)local_140,(longlong)local_118); + local_128 = puVar10; + if (puVar10 == (undefined8 *)0x0) { + RtlLeaveCriticalSection(pUVar13); + *param_10 = 0; + _Var8 = local_140; + _Var14 = local_138; +LAB_7: + uVar6 = 0xc0000022; + local_148 = 0xc0000022; + goto LAB_0; + } + if (param_4 != (longlong *)0x0) { + param_7 = (wchar_t *)local_108; + uVar6 = NlCheckAuthenticator((longlong)puVar10,param_4,(PUCHAR)local_108,(ulonglong)_Var15); + puVar10 = local_128; + local_148 = uVar6; + if (-1 < (int)uVar6) goto LAB_8; + RtlLeaveCriticalSection(pUVar13); + goto LAB_9; + } + uVar7 = NlVerifyRpcIsSecured(param_1,(longlong)puVar10,(int *)0x0,(ulonglong)_Var15); + if ((char)uVar7 == '\0') { + RtlLeaveCriticalSection(pUVar13); + _Var14 = local_138; + _Var15 = (_FILETIME)NlpLogonTypeToText(param_6); + _Var8 = local_140; + param_7 = L"SamLogon: %hs logon of %wZ\\%wZ from %wZ: failed RPC Security checks\n"; + param_9 = (char *)local_140; + NlPrintDomRoutine(0x100,(longlong)local_140, + L"SamLogon: %hs logon of %wZ\\%wZ from %wZ: failed RPC Security checks\n", + _Var15); + goto LAB_7; + } +LAB_8: + local_88 = puVar10[0xc]; + uStack_80 = puVar10[0xd]; + uVar16 = *(uint *)(puVar10 + 4); + local_78 = *(uint *)(puVar10 + 9); + local_108.dwLowDateTime = *(DWORD *)((longlong)puVar10 + 0x34); + local_10c = *(undefined4 *)(puVar10 + 0x12); + local_110 = *(uint *)((longlong)puVar10 + 0x94); + if (puVar10[0x13] != 0) { + local_d0 = NlpCopySid(puVar10[0x13]); + } + puVar9 = (undefined8 *)0x0; + if (*(short *)((longlong)puVar10 + 0x82) == 0) { + RtlInitUnicodeStringEx(&local_a8,puVar10[0x11]); + puVar9 = &local_a8; + } + local_d8 = puVar9; + if (uVar16 == 2) { + _Var15._2_6_ = 0; + _Var15.dwLowDateTime._0_2_ = *(ushort *)(puVar10 + 0x14) >> 1; + _o_wcsncpy_s(&local_70,0x10,puVar10[0x15]); + } + if (((*local_120 & 2) == 0) || ((*(byte *)((longlong)puVar10 + 0x94) & 8) != 0)) { + RtlLeaveCriticalSection(pUVar13); + _Var14 = local_138; + param_7 = (wchar_t *)&local_88; + NlpDecryptLogonInformation(param_6,(longlong)local_138,(PUCHAR)param_7,_Var15); + if (uVar16 != 2) goto LAB_10; + goto LAB_11; + } + RtlLeaveCriticalSection(pUVar13); + _Var8 = local_140; + param_7 = L"NlpLogonSamLogon: %ws failed because F bit isn\'t set on the TDO\n"; + param_9 = (char *)local_140; + _Var15 = local_118; + NlPrintDomRoutine(0x200,(longlong)local_140, + L"NlpLogonSamLogon: %ws failed because F bit isn\'t set on the TDO\n", + local_118); + *param_10 = 1; + uVar6 = 0xc0000064; + local_148 = uVar6; + goto LAB_12; + } + uVar6 = 0xc000000d; + *param_10 = 1; + local_148 = 0xc000000d; +LAB_13: + _Var8 = local_140; + if (local_f8 != (_FILETIME)0x0) { + LsaIFreeHeap(local_f8); + _Var8 = local_140; + } +LAB_14: + param_9._0_4_ = 0; + param_9._4_4_ = 0; + if (((-1 < (int)uVar6) && (local_f0.QuadPart != 0)) && + (BVar5 = QueryPerformanceCounter(&local_c8), BVar5 != 0)) { + param_7 = (wchar_t *)(local_c8.QuadPart - (longlong)local_f0); + lVar11 = *(longlong *)((longlong)_Var8 + 0x160); + RtlEnterCriticalSection(&NlGlobalDomainCritSect); + _Var15.dwLowDateTime = 0; + _Var15.dwHighDateTime = 0; + puVar10 = NlFindNamedClientSession + (NlGlobalDomainInfo,(ushort *)((longlong)_Var8 + 0x80),4,(undefined1 *)0x0 + ); + RtlAcquireResourceShared(&NlPcGlobalLock,1); + if (puVar10 != (undefined8 *)0x0) { + _Var14 = (_FILETIME)param_7; + NlPcIncrement64(puVar10[0x54],6,param_7); + NlPcIncrement32(puVar10[0x54],7,_Var14,_Var15); + } + NlPcIncrement64(lVar11,6,param_7); + NlPcIncrement64(NlPcGlobalTotalInstance,6,param_7); + NlPcIncrement32(lVar11,7,param_7,_Var15); + param_9._0_4_ = 7; + param_9._4_4_ = 0; + NlPcIncrement32(NlPcGlobalTotalInstance,7,param_7,_Var15); + RtlReleaseResource(&NlPcGlobalLock); + if (puVar10 != (undefined8 *)0x0) { + NlUnrefClientSession(puVar10); + } + RtlLeaveCriticalSection(&NlGlobalDomainCritSect); + } + } + else { + uVar16 = 1; + local_78 = 0x12f8fff; + local_108.dwLowDateTime = *(DWORD *)((longlong)local_140 + 0x168); +LAB_10: + if ((NlGlobalMemberWorkstation == 0) && (uVar16 == 1)) { +LAB_11: + *local_120 = *local_120 | 0x2000; + } + if (param_6 == 8) { + uVar7 = IsTicketLogonRequestSupported + ((longlong)_Var14,(byte)(*local_120 >> 0xd) & 1,(ulonglong)param_7,_Var15); + uVar6 = (uint)uVar7; + local_148 = uVar6; + if (-1 < (int)uVar6) goto LAB_15; +LAB_9: + *param_10 = 0; + _Var8 = local_140; + goto LAB_14; + } +LAB_15: + if ((((uVar16 == 2) && (bVar17)) && + ((((byte)DAT_16 & 5) != 0 || (((byte)DAT_1800f5140 & 5) != 0)))) && + (uVar7 = NlIsTargetAllowed((short *)local_118), (int)uVar7 != 0)) { + *local_120 = *local_120 | 0x1000; + } + _Var8 = local_140; + param_9._0_4_ = 0; + param_9._4_4_ = 0; + if ((((DAT_17 != 7) && (DAT_1800f51cc != 0)) && (NlGlobalDsPaused == 0)) || + ((uVar16 == 1 || (uVar16 == 6)))) { + if (local_144 != '\0') { + if (uVar16 - 1 < 2) { + cVar4 = SamIMixedDomain(*(undefined8 *)((longlong)local_140 + 0x170)); + if ((cVar4 == '\0') || ((local_78 & 0xbffffe00) != 0)) { + if (param_6 == 1) { + param_6 = 5; + } + else if (param_6 == 2) { + param_6 = 6; + } + else { + if (param_6 != 3) { + param_7._0_4_ = 0x1e15; + param_7._4_4_ = 0; + NlAssertFailed("FALSE"); + param_9._0_4_ = 0; + param_9._4_4_ = 0; + uVar6 = 0xc0000003; + *param_10 = 0; + local_148 = uVar6; + goto LAB_12; + } + param_6 = 7; + } + } + goto LAB_18; + } +LAB_19: + if (bVar1) { +LAB_20: + if (((NlGlobalMemberWorkstation != 0) || (local_128 == (undefined8 *)0x0)) || + (uVar16 != 2)) goto LAB_21; + bVar1 = true; +LAB_22: + bVar17 = bVar1; + puVar10 = local_128; + _Var14 = local_138; + uVar6 = NlpExtractNtlmTargetInfo((longlong)local_138,(longlong *)&local_f8,local_130); + if ((int)uVar6 < 0) { + pwVar12 = L"NlpExtractNtlmTargetInfo failed Status:0x%x\n"; + } + else { + _Var15 = local_140; + local_148 = uVar6; + uVar6 = NlpValidateNTLMTargetInfo + (uVar16,(longlong)puVar10,(longlong)_Var14,(int *)local_140, + (wchar_t *)local_f8,local_130[0]); + local_148 = uVar6; + if (-1 < (int)uVar6) goto LAB_23; + pwVar12 = L"NlpValidateNTLMTargetInfo failed Status:0x%x\n"; + } + param_7._4_4_ = 0; + param_7._0_4_ = uVar6; + local_148 = uVar6; + NlPrintRoutine(4,pwVar12,param_7,_Var15); + } + else { +LAB_21: + bVar17 = false; + puVar10 = local_128; + _Var14 = local_138; + if (((NlGlobalMemberWorkstation == 0) && (bVar1)) && + (((bVar1 = bVar17, uVar16 == 2 || + ((bVar1 = false, uVar16 == 7 || (bVar1 = false, uVar16 == 3)))) || (uVar16 == 4)))) + goto LAB_22; +LAB_23: + _Var15.dwHighDateTime = 0; + _Var15.dwLowDateTime = param_6; + param_7 = (wchar_t *)((ulonglong)local_108 & 0xffffffff); + uVar6 = NlpUserValidate(local_140,uVar16,local_108.dwLowDateTime,param_6,_Var14,param_8, + (longlong *)local_e8,param_10,local_120,'\0',local_118, + (ulonglong)local_d8,local_10c,local_110,local_d0,(longlong)puVar10 + ,(longlong)local_f8,local_130[0]); + local_148 = uVar6; + if ((int)uVar6 < 0) { + if ((local_78 & 1) == 0) { + if (uVar6 == 0xc0000224) { + uVar6 = 0xc0000071; + local_148 = uVar6; + } + else { + if (uVar6 != 0xc0000234) goto LAB_24; + uVar6 = 0xc0000072; + local_148 = uVar6; + } + } + else { +LAB_24: + if ((uVar6 == 0xc0000413) && (local_78 == 0)) { + uVar6 = 0xc0000064; + local_148 = uVar6; + } + } + } + else { + if (uVar6 != 0) { + param_7._0_4_ = 0x1eea; + param_7._4_4_ = 0; + NlAssertFailed("!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"); + } + if (*local_e8 == (_FILETIME)0x0) { + param_7._0_4_ = 0x1eeb; + param_7._4_4_ = 0; + NlAssertFailed("!NT_SUCCESS(Status) || ValidationInformation->ValidationSam != NULL"); + } + if (uVar16 != 1) { + param_7 = *(wchar_t **)local_e8; + _Var15 = (_FILETIME)&local_88; + NlpEncryptValidationInformation(param_6,param_8,(uint *)param_7,(PUCHAR)_Var15); + } + uVar6 = 0; + local_148 = 0; } } - else { - if (param_6 == 4) { - if (param_8 == 4) goto LAB_3; - bVar21 = param_8 == 5; + if (bVar17) { + _Var15.dwHighDateTime = 0; + _Var15.dwLowDateTime = local_130[0]; + param_7 = (wchar_t *)local_f8; + NlpNtlmlessLogServerDomain + ((ushort *)_Var14,(longlong)puVar10,(longlong)local_f8,local_130[0]); + } + goto LAB_13; + } +LAB_18: + if (uVar16 != 2) goto LAB_19; + if (!bVar1) { + if (local_100 == 4) { + _Var15 = *(_FILETIME *)((longlong)_Var8 + 0xb8); + uVar6 = LsaIValidateTargetInfo + ((longlong)_Var14 + 0x40,*(undefined8 *)((longlong)_Var14 + 0x58), + *(undefined4 *)((longlong)_Var14 + 0x50)); + local_148 = uVar6; + if ((int)uVar6 < 0) { + _Var15 = (_FILETIME)&local_70; + param_7._4_4_ = 0; + param_7._0_4_ = uVar6; + NlPrintRoutine(0x100, + L"Failed to validate the passthrough target %#x for computer name %ws\n", + param_7,_Var15); + goto LAB_14; } - else { - if (((param_6 == 5) || (param_6 == 6)) || (param_6 == 7)) goto LAB_1; - if (param_6 != 8) goto LAB_4; - bVar21 = param_8 == 7; - } -LAB_2: - if (!bVar21) goto LAB_4; } -LAB_3: - BVar7 = QueryPerformanceCounter(&local_f8); - pvVar3 = local_108; - param_9.dwLowDateTime = 0; - param_9.dwHighDateTime = 0; - if (BVar7 == 0) { - local_f8.QuadPart = 0; - } - bVar21 = false; - if ((param_6 - 2 & 0xfffffffb) == 0) { - bVar1 = true; - if (param_6 != 6) goto LAB_5; -LAB_6: - bVar21 = true; - } - else { - bVar1 = false; -LAB_5: - if ((param_6 - 5 & 0xfffffffd) == 0) goto LAB_6; - } - local_140 = param_6 - 1 < 3; - if ((bVar21) || (bVar21 = false, (bool)local_140)) { - bVar21 = true; - } - _Var9 = local_138; - if (((bVar21) || (param_6 == 4)) || (param_6 == 8)) { - if (param_12 == 0) { - if (NlGlobalMemberWorkstation != 0) { - uVar6 = 0xc00000bb; - goto LAB_7; - } - if (((param_2 == (short *)0x0) || (local_118 == (_FILETIME)0x0)) || - (((param_4 == (wchar_t *)0x0 || (local_150 == (_FILETIME)0x0)) && - (local_108 == (RPC_BINDING_HANDLE)0x0)))) { - *param_10 = 1; - goto LAB_0; - } - pwVar16 = (wchar_t *)((longlong)local_138 + 0x1f8); - RtlEnterCriticalSection(pwVar16); - _Var13 = local_118; - local_158 = (_FILETIME)NlFindNamedServerSession((longlong)local_138,(longlong)local_118) - ; - if (local_158 == (_FILETIME)0x0) { - RtlLeaveCriticalSection(pwVar16); - *param_10 = 0; - goto LAB_8; - } - if (param_4 == (wchar_t *)0x0) { - uVar8 = NlVerifyRpcIsSecured(pvVar3,(longlong)local_158,(int *)0x0,(ulonglong)_Var19); - if ((char)uVar8 == '\0') { - RtlLeaveCriticalSection(pwVar16); - _Var12 = local_148; - _Var19 = (_FILETIME)NlpLogonTypeToText(param_6); - _Var9 = local_138; - param_7 = L"SamLogon: %hs logon of %wZ\\%wZ from %wZ: failed RPC Security checks\n"; - param_4 = (wchar_t *)local_138; - NlPrintDomRoutine(0x100,(longlong)local_138, - L"SamLogon: %hs logon of %wZ\\%wZ from %wZ: failed RPC Security checks\n" - ,_Var19); - uVar6 = 0xc0000022; - local_150.dwLowDateTime = 0xc0000022; - DVar15 = local_13c; - goto LAB_9; - } - } - else { - param_7 = (wchar_t *)local_150; - uVar6 = NlCheckAuthenticator - ((longlong)local_158,(longlong *)param_4,(PUCHAR)local_150, - (ulonglong)_Var19); - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - RtlLeaveCriticalSection(pwVar16); - *param_10 = 0; - DVar15 = 0; - _Var12 = local_148; - _Var9 = local_138; - goto LAB_9; - } - } - local_90 = *(undefined8 *)((longlong)local_158 + 0x60); - uStack_88 = *(undefined8 *)((longlong)local_158 + 0x68); - uVar5 = *(uint *)((longlong)local_158 + 0x20); - local_80 = *(uint *)((longlong)local_158 + 0x48); - local_108 = (RPC_BINDING_HANDLE) - CONCAT44(local_108._4_4_,*(undefined4 *)((longlong)local_158 + 0x34)); - local_10c = *(undefined4 *)((longlong)local_158 + 0x90); - local_110 = *(uint *)((longlong)local_158 + 0x94); - if (*(longlong *)((longlong)local_158 + 0x98) != 0) { - local_d8 = NlpCopySid(*(longlong *)((longlong)local_158 + 0x98)); - } - puVar10 = (undefined8 *)0x0; - if (*(wchar_t *)((longlong)local_158 + 0x82) == L'\0') { - RtlInitUnicodeStringEx(&local_b0,*(undefined8 *)((longlong)local_158 + 0x88)); - puVar10 = &local_b0; - } - local_e0 = puVar10; - if (uVar5 == 2) { - _Var19._2_6_ = 0; - _Var19.dwLowDateTime._0_2_ = (ushort)*(wchar_t *)((longlong)local_158 + 0xa0) >> 1; - _o_wcsncpy_s(&local_78,0x10,*(undefined8 *)((longlong)local_158 + 0xa8)); - } - if (((*local_128 & 2) == 0) || ((*(byte *)((longlong)local_158 + 0x94) & 8) != 0)) { - RtlLeaveCriticalSection(pwVar16); - _Var12 = local_148; - param_7 = (wchar_t *)&local_90; - NlpDecryptLogonInformation(param_6,(longlong)local_148,(PUCHAR)param_7,_Var19); - if (uVar5 != 2) goto LAB_10; - goto LAB_11; - } - RtlLeaveCriticalSection(pwVar16); - _Var9 = local_138; - param_7 = L"NlpLogonSamLogon: %ws failed because F bit isn\'t set on the TDO\n"; - _Var13 = local_138; - _Var19 = local_118; - NlPrintDomRoutine(0x200,(longlong)local_138, - L"NlpLogonSamLogon: %ws failed because F bit isn\'t set on the TDO\n", - local_118); - *param_10 = 1; - uVar6 = 0xc0000064; - } - else { - uVar5 = 1; - local_80 = 0x12f8fff; - local_108 = (RPC_BINDING_HANDLE) - CONCAT44(local_108._4_4_,*(undefined4 *)((longlong)local_138 + 0x168)); - _Var12 = local_148; -LAB_10: - if ((NlGlobalMemberWorkstation == 0) && (uVar5 == 1)) { -LAB_11: - *local_128 = *local_128 | 0x2000; - } - if (param_6 == 8) { - uVar8 = IsTicketLogonRequestSupported - ((longlong)_Var12,(byte)(*local_128 >> 0xd) & 1,(ulonglong)param_7, - _Var19); - param_4._0_4_ = 0; - param_4._4_4_ = 0; - DVar15 = 0; - uVar6 = (uint)uVar8; - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - *param_10 = 0; - _Var12 = local_148; - _Var9 = local_138; - goto LAB_9; - } - } - if ((((uVar5 == 2) && (bVar21)) && - ((((byte)DAT_12 & 5) != 0 || (((byte)DAT_1800f51a0 & 5) != 0)))) && - (uVar8 = NlIsTargetAllowed((short *)local_118), (int)uVar8 != 0)) { - *local_128 = *local_128 | 0x1000; - } - _Var9 = local_138; - _Var13.dwLowDateTime = 0; - _Var13.dwHighDateTime = 0; - if ((((DAT_13 != 7) && (DAT_1800f522c != 0)) && (NlGlobalDsPaused == 0)) || - ((uVar5 == 1 || (uVar5 == 6)))) { - if (local_140 == '\0') { -LAB_14: - if (uVar5 == 2) { - if (bVar1) { - local_c0[1] = 0; - local_a0 = 0; - uStack_98 = 0; - RtlInitUnicodeString(&local_a0,L"NTLM"); - _Var19 = *(_FILETIME *)((longlong)_Var9 + 0xb8); - local_c0[0] = uVar5; - local_b8 = _Var12; - uVar6 = LsaIValidateTargetInfo(&local_a0,local_c0,0x10); - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - _Var19 = (_FILETIME)&local_78; - param_7._4_4_ = 0; - param_7._0_4_ = uVar6; - param_4 = - L"Failed to validate the passthrough target %#x for computer name %ws\n"; - NlPrintRoutine(0x100, - L"Failed to validate the passthrough target %#x for computer name %ws\n" - ,param_7,_Var19); - *param_10 = 1; - _Var12 = local_148; - DVar15 = local_13c; - goto LAB_9; - } - } - else if (local_120 == 4) { - _Var19 = *(_FILETIME *)((longlong)_Var9 + 0xb8); - uVar6 = LsaIValidateTargetInfo - ((ushort *)((longlong)_Var12 + 0x40), - *(undefined8 *)((longlong)_Var12 + 0x58), - *(undefined4 *)((longlong)_Var12 + 0x50)); - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - _Var19 = (_FILETIME)&local_78; - param_7._4_4_ = 0; - param_7._0_4_ = uVar6; - param_4 = - L"Failed to validate the passthrough target %#x for computer name %ws\n"; - NlPrintRoutine(0x100, - L"Failed to validate the passthrough target %#x for computer name %ws\n" - ,param_7,_Var19); - _Var12 = local_148; - DVar15 = local_13c; - goto LAB_9; - } - } - } - } - else if (uVar5 - 1 < 2) { - cVar4 = SamIMixedDomain(*(undefined8 *)((longlong)local_138 + 0x170)); - if ((cVar4 == '\0') || ((local_80 & 0xbffffe00) != 0)) { - if (param_6 == 1) { - param_6 = 5; - } - else if (param_6 == 2) { - param_6 = 6; - } - else { - if (param_6 != 3) { - param_7._0_4_ = 0x1e68; - param_7._4_4_ = 0; - pcVar14 = "onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"; - NlAssertFailed("FALSE"); - uVar6 = 0xc0000003; - *param_10 = 0; - _Var17.dwLowDateTime = 0; - _Var17.dwHighDateTime = 0; - param_4 = (wchar_t *)pcVar14; - goto LAB_15; - } - param_6 = 7; - } - } - goto LAB_14; - } - uVar6 = Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline(); - DVar20 = 0; - DVar15 = 0; - if ((((uVar6 == 0) || (!bVar1)) || (NlGlobalMemberWorkstation != 0)) || - ((local_158 == (_FILETIME)0x0 || (uVar5 != 2)))) { - _Var9 = local_138; - if (((NlGlobalMemberWorkstation == 0) && (bVar1)) && - ((((uVar5 == 2 || (uVar5 == 7)) || (uVar5 == 3)) || (uVar5 == 4)))) - goto LAB_16; - } - else { - DVar20 = 1; -LAB_16: - DVar15 = DVar20; - uVar6 = Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline(); - _Var9 = local_138; - _Var12 = local_148; - if (uVar6 == 0) { - _Var19 = local_138; - uVar6 = NlpValidateNTLMTargetInfoOld - (uVar5,(longlong)local_158,(longlong)local_148, - (longlong)local_138); - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - param_7._4_4_ = 0; - param_7._0_4_ = uVar6; - param_4 = L"NlpValidateNTLMTargetInfo failed Status:0x%x\n"; - NlPrintRoutine(4,L"NlpValidateNTLMTargetInfo failed Status:0x%x\n",param_7, - _Var19); - _Var12 = local_148; - goto LAB_9; - } - } - else { - uVar6 = NlpExtractNtlmTargetInfo - ((longlong)local_148,(longlong *)&local_100,local_130); - _Var9 = local_138; - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - param_7._4_4_ = 0; - param_7._0_4_ = uVar6; - param_4 = L"NlpExtractNtlmTargetInfo failed Status:0x%x\n"; - NlPrintRoutine(4,L"NlpExtractNtlmTargetInfo failed Status:0x%x\n",param_7,_Var19 - ); - _Var12 = local_148; - _Var9 = local_138; - goto LAB_9; - } - _Var19 = local_138; - uVar6 = NlpValidateNTLMTargetInfo - (uVar5,(longlong)local_158,(longlong)_Var12,(int *)local_138, - (wchar_t *)local_100,local_130[0]); - local_150.dwLowDateTime = uVar6; - if ((int)uVar6 < 0) { - param_7._4_4_ = 0; - param_7._0_4_ = uVar6; - param_4 = L"NlpValidateNTLMTargetInfo failed Status:0x%x\n"; - NlPrintRoutine(4,L"NlpValidateNTLMTargetInfo failed Status:0x%x\n",param_7, - _Var19); - _Var12 = local_148; - goto LAB_9; - } - } - } - _Var12 = local_148; - _Var19.dwHighDateTime = 0; - _Var19.dwLowDateTime = param_6; - param_7 = (wchar_t *)((ulonglong)local_108 & 0xffffffff); - uVar6 = NlpUserValidate(_Var9,uVar5,(int)local_108,param_6,local_148,param_8, - (longlong *)local_f0,param_10,local_128,'\0',local_118, - (ulonglong)local_e0,local_10c,local_110,local_d8, - (longlong)local_158,(longlong)local_100,local_130[0]); - param_4._0_4_ = 0; - param_4._4_4_ = 0; - local_150.dwLowDateTime = uVar6; - if (-1 < (int)uVar6) { - if (uVar6 != 0) { - param_7._0_4_ = 0x1f53; - param_7._4_4_ = 0; - NlAssertFailed("!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"); - } - param_4._0_4_ = 0; - param_4._4_4_ = 0; - if (*(_FILETIME *)local_f0 == (_FILETIME)0x0) { - param_7._0_4_ = 0x1f54; - param_7._4_4_ = 0; - pcVar14 = "onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"; - NlAssertFailed( - "!NT_SUCCESS(Status) || ValidationInformation->ValidationSam != NULL" - ); - param_4 = (wchar_t *)pcVar14; - } - if (uVar5 != 1) { - param_7 = *(wchar_t **)local_f0; - _Var19 = (_FILETIME)&local_90; - param_4._4_4_ = 0; - param_4._0_4_ = param_8; - NlpEncryptValidationInformation(param_6,param_8,(uint *)param_7,(PUCHAR)_Var19); - } - uVar6 = 0; - local_150 = (_FILETIME)((ulonglong)local_150 & 0xffffffff00000000); - goto LAB_9; - } - if ((local_80 & 1) == 0) { - if (uVar6 == 0xc0000224) { - uVar6 = 0xc0000071; - } - else { - if (uVar6 != 0xc0000234) goto LAB_17; - uVar6 = 0xc0000072; - } - } - else { -LAB_17: - if ((uVar6 != 0xc0000413) || (local_80 != 0)) goto LAB_9; - uVar6 = 0xc0000064; - } - local_150.dwLowDateTime = uVar6; - goto LAB_9; - } - *param_10 = 0; -LAB_8: - uVar6 = 0xc0000022; - _Var9 = local_138; - } - _Var17.dwHighDateTime = 0; - _Var17.dwLowDateTime = local_13c; - param_4 = (wchar_t *)_Var13; - } - else { - *param_10 = 1; - uVar6 = 0xc0000003; -LAB_7: - local_158.dwLowDateTime = 0; - local_158.dwHighDateTime = 0; - param_4 = (wchar_t *)param_9; - } - } - else { -LAB_4: - *param_10 = 1; - uVar6 = 0xc0000003; - param_4 = (wchar_t *)_Var12; - local_158 = _Var18; - } - } - } -LAB_15: - local_150.dwLowDateTime = uVar6; - _Var12 = local_148; - DVar15 = _Var17.dwLowDateTime; -LAB_9: - uVar5 = Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline(); - pcVar14 = (char *)param_4; - if (uVar5 != 0) { - pcVar14 = (char *)(_FILETIME)param_4; - if (DVar15 != 0) { - _Var19.dwHighDateTime = 0; - _Var19.dwLowDateTime = local_130[0]; - param_7 = (wchar_t *)local_100; - NlpNtlmlessLogServerDomain - ((ushort *)_Var12,(longlong)local_158,(longlong)local_100,local_130[0]); - pcVar14 = (char *)local_158; - } - if (local_100 != (_FILETIME)0x0) { - LsaIFreeHeap(local_100); - } - } - if (((-1 < (int)uVar6) && (local_f8.QuadPart != 0)) && - (BVar7 = QueryPerformanceCounter(&local_d0), BVar7 != 0)) { - param_7 = (wchar_t *)(local_d0.QuadPart - (longlong)local_f8); - lVar11 = *(longlong *)((longlong)_Var9 + 0x160); - RtlEnterCriticalSection(&NlGlobalDomainCritSect); - _Var19.dwLowDateTime = 0; - _Var19.dwHighDateTime = 0; - puVar10 = NlFindNamedClientSession - (NlGlobalDomainInfo,(ushort *)((longlong)_Var9 + 0x80),4,(undefined1 *)0x0); - RtlAcquireResourceShared(&NlPcGlobalLock,1); - if (puVar10 != (undefined8 *)0x0) { - _Var17 = (_FILETIME)param_7; - NlPcIncrement64(puVar10[0x54],6,param_7); - NlPcIncrement32(puVar10[0x54],7,_Var17,_Var19); - } - NlPcIncrement64(lVar11,6,param_7); - NlPcIncrement64(NlPcGlobalTotalInstance,6,param_7); - NlPcIncrement32(lVar11,7,param_7,_Var19); - pcVar14._0_4_ = 7; - pcVar14._4_4_ = 0; - NlPcIncrement32(NlPcGlobalTotalInstance,7,param_7,_Var19); - RtlReleaseResource(&NlPcGlobalLock); - if (puVar10 != (undefined8 *)0x0) { - NlUnrefClientSession(puVar10); - } - RtlLeaveCriticalSection(&NlGlobalDomainCritSect); - } - if (local_d8 != (PSID)0x0) { - FreeSid(local_d8); - } - uVar5 = local_e8; - puVar2 = local_128; - if (((local_e8 ^ *local_128) & 0xffffcfff) != 0) { - param_7._0_4_ = 0x1fbb; + goto LAB_21; + } + local_b8[1] = 0; + local_98 = 0; + uStack_90 = 0; + RtlInitUnicodeString(&local_98,L"NTLM"); + _Var15 = *(_FILETIME *)((longlong)_Var8 + 0xb8); + local_b8[0] = uVar16; + local_b0 = _Var14; + uVar6 = LsaIValidateTargetInfo(&local_98,local_b8,0x10); + local_148 = uVar6; + if (-1 < (int)uVar6) goto LAB_20; + _Var15 = (_FILETIME)&local_70; + param_7._4_4_ = 0; + param_7._0_4_ = uVar6; + NlPrintRoutine(0x100,L"Failed to validate the passthrough target %#x for computer name %ws\n", + param_7,_Var15); + *param_10 = 1; + goto LAB_14; + } + uVar6 = 0xc0000022; + *param_10 = 0; + local_148 = uVar6; + } +LAB_12: + _Var14 = local_138; + if (local_d0 != (PSID)0x0) { + FreeSid(local_d0); + _Var14 = local_138; + } +LAB_0: + uVar16 = local_e0; + puVar2 = local_120; + if (((local_e0 ^ *local_120) & 0xffffcfff) != 0) { + param_7._0_4_ = 0x1f4f; param_7._4_4_ = 0; - pcVar14 = "onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"; + param_9 = "onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"; NlAssertFailed( "(*ExtraFlags & ~NL_EXFLAGS_INTERNAL_FLAGS) == (OriginalExtraFlags & ~NL_EXFLAGS_INTERNAL_FLAGS)" ); } - _Var17 = local_f0; - *puVar2 = *puVar2 ^ (*puVar2 ^ uVar5) & 0x3000; - puVar10 = &local_90; + p_Var3 = local_e8; + *puVar2 = *puVar2 ^ (*puVar2 ^ uVar16) & 0x3000; + puVar10 = &local_88; for (lVar11 = 0x10; lVar11 != 0; lVar11 = lVar11 + -1) { *(undefined1 *)puVar10 = 0; puVar10 = (undefined8 *)((longlong)puVar10 + 1); } if ((int)uVar6 < 0) { - pcVar14._4_4_ = 0; - pcVar14._0_4_ = param_8; - FreeValidationInformation((HLOCAL)*(_FILETIME *)local_f0,param_8); - *(_FILETIME *)_Var17 = (_FILETIME)0x0; - } - if (_Var9 != (_FILETIME)0x0) { - if (((NlGlobalParameters & 4) != 0) && (_Var12 != (_FILETIME)0x0)) { + param_9._4_4_ = 0; + param_9._0_4_ = param_8; + FreeValidationInformation((HLOCAL)*local_e8,param_8); + p_Var3->dwLowDateTime = 0; + p_Var3->dwHighDateTime = 0; + } + if (_Var8 != (_FILETIME)0x0) { + if (((NlGlobalParameters & 4) != 0) && (_Var14 != (_FILETIME)0x0)) { param_7._4_4_ = 0; - param_7._0_4_ = local_e4; - pcVar14 = (char *)local_118; - _Var19 = local_c8; + param_7._0_4_ = local_dc; + param_9 = (char *)local_118; + _Var15 = local_c0; NlPrintLogonParameters - ((longlong)_Var9,(longlong)local_118,local_e4,(longlong *)local_c8,*puVar2, - &local_150.dwLowDateTime); - } - NlDereferenceDomain((wchar_t *)_Var9,pcVar14,param_7,(undefined8 *)_Var19); + ((longlong)_Var8,(longlong)local_118,local_dc,(longlong *)local_c0,*puVar2, + &local_148); + } + NlDereferenceDomain((wchar_t *)_Var8,param_9,param_7,(undefined8 *)_Var15); } NlEndNetlogonCall(); return uVar6; } ``` ## PrimaryQueryHandler ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.83| |i_ratio|0.61| |m_ratio|0.95| |b_ratio|0.92| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|PrimaryQueryHandler|PrimaryQueryHandler| |fullname|PrimaryQueryHandler|PrimaryQueryHandler| |refcount|3|3| |`length`|545|599| |`called`|BuildSamLogonResponse
BuildSamLogonResponseEx
NetpLogonPutOemString
NetpLogonPutUnicodeString
NlPrintDomRoutine|BuildSamLogonResponse
BuildSamLogonResponseEx
Feature_740537659__private_IsEnabledDeviceUsageNoInline
NetpLogonPutOemString
NetpLogonPutUnicodeString
NetpLogonPutUnicodeStringOld
NlPrintDomRoutine| |calling|NlGetLocalPingResponse
NlMainLoop|NlGetLocalPingResponse
NlMainLoop| |paramcount|11|11| |`address`|180070850|1800706f0| |sig|undefined8 __fastcall PrimaryQueryHandler(undefined8 param_1, longlong param_2, char param_3, int param_4, uint param_5, longlong * * param_6, longlong * * param_7, int param_8, short * param_9, short * param_10, int * param_11)|undefined8 __fastcall PrimaryQueryHandler(undefined8 param_1, longlong param_2, char param_3, int param_4, uint param_5, longlong * * param_6, longlong * * param_7, int param_8, short * param_9, short * param_10, int * param_11)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### PrimaryQueryHandler Called Diff ```diff --- PrimaryQueryHandler called +++ PrimaryQueryHandler called @@ -2,0 +3 @@ +Feature_740537659__private_IsEnabledDeviceUsageNoInline @@ -4,0 +6 @@ +NetpLogonPutUnicodeStringOld ``` ### PrimaryQueryHandler Diff ```diff --- PrimaryQueryHandler +++ PrimaryQueryHandler @@ -1,69 +1,78 @@ ulonglong PrimaryQueryHandler(undefined8 param_1,longlong param_2,char param_3,int param_4, uint param_5,longlong **param_6,longlong **param_7,int param_8, short *param_9,short *param_10,int *param_11) { uint uVar1; ulonglong in_RAX; undefined4 extraout_var; - undefined4 extraout_var_00; ulonglong uVar2; int iVar3; char *pcVar4; short *local_18 [2]; if ((DAT_0 != 0) && ((param_5 >> 0x18 & 1) == 0)) { param_5 = param_5 & 1; } if (((NlGlobalDsPaused == 0) && (NlGlobalPartialDisable == 0)) && (*(int *)(param_2 + 0x24c) == 1) ) { if ((param_5 & 0xc) == 0) { if ((param_5 & 2) != 0) { - uVar1 = BuildSamLogonResponse - (param_2,param_3,0x13,(wchar_t *)0x0,param_1,param_6,1,param_8,param_10, - param_11); - in_RAX = CONCAT44(extraout_var_00,uVar1); + in_RAX = BuildSamLogonResponse + (param_2,param_3,0x13,(wchar_t *)0x0,param_1,param_6,1,param_8,param_10, + param_11); goto LAB_1; } *param_10 = 0xc; local_18[0] = param_10 + 1; NetpLogonPutOemString((char *)(param_2 + 0x138),0x10,local_18); if (param_4 == 2) { - NetpLogonPutUnicodeString(*(wchar_t **)(param_2 + 0x108),0x20,(ulonglong *)local_18); - NetpLogonPutUnicodeString((wchar_t *)(param_2 + 0x48),0x20,(ulonglong *)local_18); + uVar1 = Feature_740537659__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 == 0) { + NetpLogonPutUnicodeStringOld(*(wchar_t **)(param_2 + 0x108),0x20,(ulonglong *)local_18); + NetpLogonPutUnicodeStringOld((wchar_t *)(param_2 + 0x48),0x20,(ulonglong *)local_18); + } + else { + in_RAX = NetpLogonPutUnicodeString + (*(wchar_t **)(param_2 + 0x108),0x20,(ulonglong *)local_18); + if (((int)in_RAX != 0) || + (in_RAX = NetpLogonPutUnicodeString + ((wchar_t *)(param_2 + 0x48),0x20,(ulonglong *)local_18), + (int)in_RAX != 0)) goto LAB_2; + } local_18[0][0] = 1; local_18[0][1] = 0; iVar3 = (int)local_18[0] + 8; local_18[0][2] = -1; local_18[0][3] = -1; } else { iVar3 = (int)local_18[0]; } pcVar4 = "Sam"; *param_11 = iVar3 - (int)param_10; if (param_4 != 2) { pcVar4 = "Uas"; } in_RAX = NlPrintDomRoutine(0x10,param_2, L"%hs Primary Query mailslot message from %ws. Response %ws on %ws\n" ,pcVar4); } else { uVar1 = BuildSamLogonResponseEx (param_2,param_3,0x17,(LPCWSTR)0x0,0,param_1,param_6,param_7,param_9,param_5 ,param_8,param_10,param_11); in_RAX = CONCAT44(extraout_var,uVar1); LAB_1: if ((int)in_RAX != 0) goto LAB_2; } uVar2 = CONCAT71((int7)(in_RAX >> 8),1); } else { LAB_2: uVar2 = in_RAX & 0xffffffffffffff00; } return uVar2; } ``` ## wil_details_GetCurrentFeatureEnabledState ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.23| |i_ratio|0.25| |m_ratio|0.93| |b_ratio|0.57| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState|wil_details_GetCurrentFeatureEnabledState| |refcount|2|2| |`length`|343|269| |`called`|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_RtlStagingConfig_QueryFeatureState
wil_details_AreDependenciesEnabled| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2|2| |`address`|18003c518|18002ed64| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_GetCurrentFeatureEnabledState Called Diff ```diff --- wil_details_GetCurrentFeatureEnabledState called +++ wil_details_GetCurrentFeatureEnabledState called @@ -2 +2 @@ -wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +wil_details_AreDependenciesEnabled ``` ### wil_details_GetCurrentFeatureEnabledState Diff ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -1,73 +1,57 @@ uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) { char cVar1; - undefined8 *puVar2; - uint uVar3; - undefined8 uVar4; - ulonglong uVar5; + uint uVar2; + undefined8 uVar3; + uint uVar4; + uint uVar5; uint uVar6; - longlong *plVar7; - uint local_res8; - ulonglong local_res10; - uint local_28 [8]; + uint uVar7; + uint uVar8; + uint uVar9; + uint local_38 [8]; cVar1 = *(char *)(param_1 + 0x1c); + local_38[0] = 0; + local_38[1] = 0; + local_38[2] = 0; + local_38[3] = 0; + uVar7 = 1; *param_2 = 1; - local_28[4] = 0; - local_28[5] = 0; - local_28[0] = 0; - local_28[1] = 0; - local_28[2] = 0; - local_28[3] = 0; - uVar4 = wil_RtlStagingConfig_QueryFeatureState - (local_28,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2), + local_38[4] = 0; + local_38[5] = 0; + uVar3 = wil_RtlStagingConfig_QueryFeatureState + (local_38,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2), (uint *)0x0); - uVar3 = -(uint)((int)uVar4 != 0) & local_28[0] & 3; - if (uVar3 == 0) { - uVar6 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + uVar5 = -(uint)(local_38[5] != 0) & 0x800; + uVar8 = -(uint)(local_38[4] != 0) & 0x400 | uVar5; + uVar2 = -(uint)((int)uVar3 != 0) & local_38[0] & 3; + uVar4 = uVar2 << 7; + if (uVar2 == 0) { + uVar2 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; } else { - uVar6 = 0; - if (local_28[0] == 2) { - uVar6 = 0x40; + uVar2 = 0; + if (local_38[0] == 2) { + uVar2 = 0x40; } } - local_res8 = uVar6 >> 6 ^ - (uVar3 << 7 | -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400 | - uVar6); - if ((uVar6 != 0) && (plVar7 = *(longlong **)(param_1 + 0x20), plVar7 != (longlong *)0x0)) { - do { - puVar2 = (undefined8 *)*plVar7; - if (puVar2 == (undefined8 *)0x0) { - return local_res8; - } - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) { - uVar6 = *(uint *)*puVar2; - local_res10 = (ulonglong)uVar6; - if ((uVar6 & 2) == 0) { - uVar5 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*puVar2,local_res10,(longlong)puVar2); - uVar6 = (uint)uVar5; - } - uVar3 = local_res8 & 0xfffffffe; - local_res8 = (uint)((uVar6 & local_res8 & 1) != 0); - } - else { - if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar3 = 0; - } - else { - uVar3 = 1; - } - local_res8 = local_res8 & 0xfffffffe; - } - local_res8 = local_res8 | uVar3; - plVar7 = plVar7 + 1; - } while ((local_res8 & 1) != 0); + uVar6 = uVar2 | uVar4 | uVar8; + uVar9 = uVar7; + if ((uVar8 == 0xc00) || (uVar9 = 0, uVar2 != 0)) { + uVar8 = uVar7; + if (*(longlong *)(param_1 + 0x20) != 0) { + uVar8 = wil_details_AreDependenciesEnabled(param_1); + } + if ((uVar9 != 0) && (uVar8 == 0)) { + uVar6 = uVar2 | uVar4 | uVar5; + } + if (((uVar6 & 0x40) != 0) && (uVar8 != 0)) goto LAB_0; } - return local_res8; + uVar7 = 0; +LAB_0: + return uVar6 | uVar7; } ``` ## NlGetLocalPingResponse ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.17| |i_ratio|0.09| |m_ratio|0.83| |b_ratio|0.12| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlGetLocalPingResponse|NlGetLocalPingResponse| |fullname|NlGetLocalPingResponse|NlGetLocalPingResponse| |refcount|3|3| |`length`|1414|1982| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-STRING-L1-1-0.DLL::MultiByteToWideChar
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenEventW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForMultipleObjectsEx
LogonRequestHandler
NETUTILS.DLL::NetApiBufferAllocate
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpMemoryAllocateNlDereferenceDomain
NlEqualDnsNameUtf8
NlFindDnsDomain
NlFindNetbiosDomain
NlPrintRoutine
PrimaryQueryHandler
WS2_32.DLL::Ordinal_8
__security_check_cookie
memcpy
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-STRING-L1-1-0.DLL::MultiByteToWideChar
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::OpenEventW
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::WaitForMultipleObjectsEx
DNSAPI.DLL::DnsNameCompare_UTF8
Feature_740537659__private_IsEnabledDeviceUsageNoInline
LogonRequestHandler
NETUTILS.DLL::NetApiBufferAllocate
NETUTILS.DLL::NetApiBufferFreeNTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlDereferenceDomain
NlEqualDnsNameUtf8
NlFindNetbiosDomain
NlPrintRoutine
PrimaryQueryHandler
WS2_32.DLL::Ordinal_8
__security_check_cookie
memcpy
memset
| |calling|I_NetLogonLdapLookupEx
NetpDcGetName|I_NetLogonLdapLookupEx
NetpDcGetName| |paramcount|16|16| |`address`|180010a50|180021b80| |`sig`|ulonglong __fastcall NlGetLocalPingResponse(undefined8 param_1, int param_2, longlong param_3, LPCSTR param_4, void * param_5, undefined8 * param_6, int param_7, longlong * * param_8, longlong * * param_9, LPCWSTR param_10, uint param_11, undefined8 param_12, uint param_13, short * param_14, undefined8 * param_15, uint * param_16)|wchar_t * __fastcall NlGetLocalPingResponse(undefined8 param_1, int param_2, longlong param_3, LPCSTR param_4, longlong * param_5, undefined8 * param_6, int param_7, longlong * * param_8, longlong * * param_9, LPCWSTR param_10, uint param_11, undefined8 param_12, uint param_13, short * param_14, undefined8 * param_15, uint * param_16)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlGetLocalPingResponse Called Diff ```diff --- NlGetLocalPingResponse called +++ NlGetLocalPingResponse called @@ -2,0 +3 @@ +API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc @@ -5,0 +7,2 @@ +DNSAPI.DLL::DnsNameCompare_UTF8 +Feature_740537659__private_IsEnabledDeviceUsageNoInline @@ -11 +13,0 @@ -NetpMemoryAllocate @@ -14 +15,0 @@ -NlFindDnsDomain @@ -20,0 +22 @@ +memset ``` ### NlGetLocalPingResponse Diff ```diff --- NlGetLocalPingResponse +++ NlGetLocalPingResponse @@ -1,186 +1,274 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -ulonglong NlGetLocalPingResponse - (undefined8 param_1,int param_2,longlong param_3,LPCSTR param_4,void *param_5, - undefined8 *param_6,int param_7,longlong **param_8,longlong **param_9, - LPCWSTR param_10,uint param_11,undefined8 param_12,uint param_13,short *param_14 - ,undefined8 *param_15,uint *param_16) +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ + +wchar_t * NlGetLocalPingResponse + (undefined8 param_1,int param_2,longlong param_3,LPCSTR param_4, + longlong *param_5,undefined8 *param_6,int param_7,longlong **param_8, + longlong **param_9,LPCWSTR param_10,uint param_11,undefined8 param_12, + uint param_13,short *param_14,undefined8 *param_15,uint *param_16) { - char cVar1; - int iVar2; - DWORD DVar3; - wchar_t *pwVar4; - ulonglong uVar5; - undefined8 uVar6; - HLOCAL _Dst; - int *piVar7; - longlong lVar8; + longlong *plVar1; + char cVar2; + uint uVar3; + int iVar4; + int iVar5; + DWORD DVar6; + longlong lVar7; + ulonglong uVar8; wchar_t *pwVar9; undefined8 uVar10; - undefined8 *puVar11; - ulonglong local_res8; + wchar_t *pwVar11; + HLOCAL _Dst; + int *piVar12; + wchar_t *pwVar13; + undefined8 uVar14; + undefined8 *puVar15; + wchar_t *local_res8; undefined1 auStackY_338 [32]; - byte local_2b8 [4]; + byte local_2b8; uint local_2b4; - uint local_2b0; - undefined8 *local_2a8; - LPWSTR local_2a0; + LPCWSTR local_2b0; + LPWSTR local_2a8; + longlong **local_2a0; longlong **local_298; - longlong **local_290; + undefined8 local_290; short *local_288; undefined8 *local_280; - uint *local_278; - HANDLE local_270; - undefined8 local_268; + undefined8 *local_278; + uint *local_270; + HANDLE local_268; + undefined8 local_260; wchar_t local_258 [264]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_338; - lVar8 = 0; - local_2a8 = param_6; + pwVar13 = (wchar_t *)0x0; + local_280 = param_6; + local_2a0 = param_9; + local_288 = param_14; + local_278 = param_15; + local_270 = param_16; local_298 = param_8; - local_290 = param_9; - local_288 = param_14; - local_280 = param_15; - local_278 = param_16; + local_2b0 = param_10; local_2b4 = 0; - local_2b8[0] = 0; - local_2a0 = (LPWSTR)0x0; + local_2b8 = 0; + local_2a8 = (LPWSTR)0x0; if (NlGlobalMemberWorkstation != 0) { return local_res8; } - if (((DAT_0 != 0) && (param_2 != 0)) && ((param_13 >> 0x18 & 1) == 0)) { + local_290 = param_1; + uVar3 = Feature_740537659__private_IsEnabledDeviceUsageNoInline(); + if (uVar3 != 0) { + memset(local_258,0,0x208); + } + if (((DAT_0 != 0) && (param_2 != 0)) && ((param_13 & 0x1000000) == 0)) { return local_res8; } if (param_4 != (LPCSTR)0x0) { - local_2b0 = MultiByteToWideChar(0xfde9,0,param_4,-1,(LPWSTR)0x0,0); - iVar2 = NetApiBufferAllocate(local_2b0 * 2,&local_2a0); - if (iVar2 == 0) { - MultiByteToWideChar(0xfde9,0,param_4,-1,local_2a0,local_2b0); - } - } - NlPrintRoutine(0x10,L"Received ping from %ws(%ws) %ws %ws on %ws\n",local_298,local_290); + iVar4 = MultiByteToWideChar(0xfde9,0,param_4,-1,local_2a8,0); + iVar5 = NetApiBufferAllocate(iVar4 * 2,&local_2a8); + if (iVar5 == 0) { + MultiByteToWideChar(0xfde9,0,param_4,-1,local_2a8,iVar4); + } + } + NlPrintRoutine(0x10,L"Received ping from %ws(%ws) %ws %ws on %ws\n",param_8,local_2a0); if (NlGlobalDsRunningUnknown != '\0') { - local_270 = OpenEventW(0x100000,0,L"NtdsDelayedStartupCompletedEvent"); - if (local_270 == (HANDLE)0x0) { - DVar3 = GetLastError(); + local_268 = OpenEventW(0x100000,0,L"NtdsDelayedStartupCompletedEvent"); + if (local_268 == (HANDLE)0x0) { + DVar6 = GetLastError(); NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Cannot OpenEvent %ws %ld\n", - L"NtdsDelayedStartupCompletedEvent",(ulonglong)DVar3); + L"NtdsDelayedStartupCompletedEvent",(ulonglong)DVar6); goto LAB_1; } - uVar6 = 0; - local_268 = NlGlobalTerminateEvent; - uVar10 = 1200000; - local_2b0 = WaitForMultipleObjectsEx(2,&local_270,0,1200000,0); - CloseHandle(local_270); - if (local_2b0 != 0) { - if (local_2b0 == 1) { - NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Netlogon shut down.\n",uVar6,uVar10); - } - else if (local_2b0 == 0x102) { - NlPrintRoutine(0x100,L"NlGetLocalPingResponse: DS took too long to start.\n",uVar6,uVar10); - } - else if (local_2b0 == 0xffffffff) { - DVar3 = GetLastError(); - NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Wait for DS failed %ld.\n",(ulonglong)DVar3, - uVar10); + uVar10 = 0; + local_260 = NlGlobalTerminateEvent; + uVar14 = 1200000; + DVar6 = WaitForMultipleObjectsEx(2,&local_268,0,1200000,0); + CloseHandle(local_268); + if (DVar6 != 0) { + if (DVar6 == 1) { + NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Netlogon shut down.\n",uVar10,uVar14); + } + else if (DVar6 == 0x102) { + NlPrintRoutine(0x100,L"NlGetLocalPingResponse: DS took too long to start.\n",uVar10,uVar14); + } + else if (DVar6 == 0xffffffff) { + DVar6 = GetLastError(); + NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Wait for DS failed %ld.\n",(ulonglong)DVar6, + uVar14); } else { NlPrintRoutine(0x100,L"NlGetLocalPingResponse: Unknown status from Wait %ld.\n", - (ulonglong)local_2b0,uVar10); + (ulonglong)DVar6,uVar14); } goto LAB_1; } NlGlobalDsRunningUnknown = '\0'; } - if ((param_4 == (LPCSTR)0x0) && (param_5 == (void *)0x0)) { - puVar11 = local_2a8; - if (param_3 == 0) { -LAB_2: - pwVar4 = (wchar_t *)NlFindNetbiosDomain(0,'\x01'); - if (pwVar4 == (wchar_t *)0x0) goto LAB_3; + pwVar9 = pwVar13; + if ((param_4 != (LPCSTR)0x0) || (param_5 != (longlong *)0x0)) { + local_2b8 = 0; + if (param_5 != (longlong *)0x0) { + lVar7 = *param_5 - _NlGlobalZeroGuid; + if (lVar7 == 0) { + lVar7 = param_5[1] - _DAT_2; + } + if (lVar7 == 0) { + param_5 = (longlong *)0x0; + } + } + RtlEnterCriticalSection(&NlGlobalDomainCritSect); + if (((param_4 != (LPCSTR)0x0) || (param_5 != (longlong *)0x0)) && + (pwVar11 = NlGlobalServicedDomains, + (wchar_t **)NlGlobalServicedDomains != &NlGlobalServicedDomains)) { + do { + pwVar9 = pwVar11; + if ((pwVar9[0x128] & L'\x80') == L'\0') { + if (((*(longlong *)(pwVar9 + 0x4c) == 0) || (param_4 == (LPCSTR)0x0)) || + (iVar4 = DnsNameCompare_UTF8(), iVar4 == 0)) { + if (((*(longlong *)(pwVar9 + 0x50) == 0) || (param_4 == (LPCSTR)0x0)) || + (iVar4 = DnsNameCompare_UTF8(), iVar4 == 0)) { + if (((param_5 == (longlong *)0x0) || + (plVar1 = *(longlong **)(pwVar9 + 0x68), plVar1 == (longlong *)0x0)) || + ((*plVar1 != *param_5 || (plVar1[1] != param_5[1])))) goto LAB_3; + } + else { + local_2b8 = 1; + } + } + if (pwVar9 != (wchar_t *)0x0) goto LAB_4; + break; + } +LAB_3: + pwVar11 = *(wchar_t **)pwVar9; + pwVar9 = (wchar_t *)0x0; + } while ((wchar_t **)pwVar11 != &NlGlobalServicedDomains); + } + pwVar11 = NlGlobalServicedNdncs; + if ((wchar_t **)NlGlobalServicedNdncs == &NlGlobalServicedNdncs) goto LAB_5; + do { + pwVar9 = pwVar11; + if (((((pwVar9[0x128] & L'\x80') == L'\0') && (*(longlong *)(pwVar9 + 0x4c) != 0)) && + (param_4 != (LPCSTR)0x0)) && (iVar4 = DnsNameCompare_UTF8(), iVar4 != 0)) + goto LAB_4; + pwVar11 = *(wchar_t **)pwVar9; + } while ((wchar_t **)*(wchar_t **)pwVar9 != &NlGlobalServicedNdncs); + RtlLeaveCriticalSection(&NlGlobalDomainCritSect); + goto LAB_6; + } + if (param_3 != 0) goto LAB_7; + RtlEnterCriticalSection(&NlGlobalDomainCritSect); + pwVar11 = NlGlobalServicedDomains; + if (((wchar_t **)NlGlobalServicedDomains != &NlGlobalServicedDomains) && + (pwVar9 = pwVar11, NlGlobalServicedDomains != (wchar_t *)0x0)) { + *(int *)(NlGlobalServicedDomains + 0x124) = *(int *)(NlGlobalServicedDomains + 0x124) + 1; + } + RtlLeaveCriticalSection(&NlGlobalDomainCritSect); + param_10 = local_2b0; +LAB_8: + if (pwVar9 == (wchar_t *)0x0) goto LAB_9; +LAB_10: + iVar4 = Ordinal_8(0x7f000001); + RtlEnterCriticalSection(&NlGlobalTransportCritSect); + if ((NlGlobalWinsockPnpAddresses != (int *)0x0) && (0 < (longlong)*NlGlobalWinsockPnpAddresses)) { + piVar12 = NlGlobalWinsockPnpAddresses + 2; + do { + if (**(short **)piVar12 == 2) { + iVar4 = *(int *)(*(short **)piVar12 + 2); + break; + } + pwVar13 = (wchar_t *)((longlong)pwVar13 + 1); + piVar12 = piVar12 + 4; + } while ((longlong)pwVar13 < (longlong)*NlGlobalWinsockPnpAddresses); + } + RtlLeaveCriticalSection(&NlGlobalTransportCritSect); + uVar8 = (ulonglong)local_2b8; + pwVar13 = pwVar9; + if (param_7 == 0) { + puVar15 = local_280; + uVar10 = LogonRequestHandler(local_290,(longlong)pwVar9,local_2b8,(longlong)local_280,2,param_13 + ,param_10,0,local_298,local_2a0,param_11,iVar4,local_288,local_258, + (int *)&local_2b4); + cVar2 = (char)uVar10; + } + else { + puVar15 = (undefined8 *)0x2; + uVar10 = PrimaryQueryHandler(local_290,(longlong)pwVar9,local_2b8,2,param_13,local_298,local_2a0 + ,iVar4,local_288,local_258,(int *)&local_2b4); + cVar2 = (char)uVar10; + } + pwVar11 = pwVar13; + if (cVar2 != '\0') { + pwVar11 = (wchar_t *)(ulonglong)local_2b4; + if (local_2b4 == 0) { + *local_278 = 0; + pwVar11 = pwVar13; } else { + _Dst = LocalAlloc(0,(SIZE_T)pwVar11); + *local_278 = _Dst; + if (_Dst != (HLOCAL)0x0) { + uVar8 = (ulonglong)local_2b4; + pwVar11 = local_258; + memcpy(_Dst,pwVar11,uVar8); + *local_270 = local_2b4; + } + } + } + if (pwVar9 != (wchar_t *)0x0) { + NlDereferenceDomain(pwVar9,pwVar11,uVar8,puVar15); + } +LAB_1: + if (local_2a8 != (LPWSTR)0x0) { + NetApiBufferFree(); + } + return local_res8; LAB_4: - pwVar4 = (wchar_t *)NlFindNetbiosDomain(param_3,'\0'); - if (pwVar4 == (wchar_t *)0x0) goto LAB_5; - } - } - else { - pwVar4 = (wchar_t *)NlFindDnsDomain((longlong)param_4,param_5,'\x01','\x01',local_2b8); - puVar11 = local_2a8; - if (pwVar4 == (wchar_t *)0x0) { - if ((((int)param_13 < 0) && (local_2a8 == (undefined8 *)0x0)) && - ((param_10 == (LPCWSTR)0x0 && ((param_11 == 0 && (param_4 != (LPCSTR)0x0)))))) { - RtlEnterCriticalSection(&NlGlobalDnsForestNameCritSect); - if ((NlGlobalUtf8DnsForestName == 0) || - (uVar5 = NlEqualDnsNameUtf8((longlong)param_4,NlGlobalUtf8DnsForestName), (int)uVar5 == 0 - )) { - if ((NlGlobalUtf8DnsForestNameAlias == 0) || - (uVar5 = NlEqualDnsNameUtf8((longlong)param_4,NlGlobalUtf8DnsForestNameAlias), - (int)uVar5 == 0)) { - RtlLeaveCriticalSection(&NlGlobalDnsForestNameCritSect); - goto LAB_3; - } - local_2b8[0] = 1; + *(int *)(pwVar9 + 0x124) = *(int *)(pwVar9 + 0x124) + 1; +LAB_5: + RtlLeaveCriticalSection(&NlGlobalDomainCritSect); + param_10 = local_2b0; + if (pwVar9 == (wchar_t *)0x0) { +LAB_6: + param_10 = local_2b0; + if ((((int)param_13 < 0) && (local_280 == (undefined8 *)0x0)) && + ((local_2b0 == (LPCWSTR)0x0 && ((param_11 == 0 && (param_4 != (LPCSTR)0x0)))))) { + RtlEnterCriticalSection(&NlGlobalDnsForestNameCritSect); + if ((NlGlobalUtf8DnsForestName == 0) || + (uVar8 = NlEqualDnsNameUtf8((longlong)param_4,NlGlobalUtf8DnsForestName), (int)uVar8 == 0)) + { + if ((NlGlobalUtf8DnsForestNameAlias == 0) || + (uVar8 = NlEqualDnsNameUtf8((longlong)param_4,NlGlobalUtf8DnsForestNameAlias), + (int)uVar8 == 0)) { + RtlLeaveCriticalSection(&NlGlobalDnsForestNameCritSect); + goto LAB_9; } - RtlLeaveCriticalSection(&NlGlobalDnsForestNameCritSect); - goto LAB_2; - } -LAB_3: - if (param_3 != 0) goto LAB_4; -LAB_5: - NlPrintRoutine(0x100, - L"Ping from %ws for domain %ws %ws for %ws on %ws is invalid since we don\'t host the named domain.\n" - ,local_298,local_2a0); - goto LAB_1; - } - } - iVar2 = Ordinal_8(0x7f000001); - RtlEnterCriticalSection(&NlGlobalTransportCritSect); - if (NlGlobalWinsockPnpAddresses != (int *)0x0) { - piVar7 = NlGlobalWinsockPnpAddresses + 2; - for (; lVar8 < *NlGlobalWinsockPnpAddresses; lVar8 = lVar8 + 1) { - if (**(short **)piVar7 == 2) { - iVar2 = *(int *)(*(short **)piVar7 + 2); - break; - } - piVar7 = piVar7 + 4; - } - } - RtlLeaveCriticalSection(&NlGlobalTransportCritSect); - uVar5 = (ulonglong)local_2b8[0]; - pwVar9 = pwVar4; - if (param_7 == 0) { - cVar1 = LogonRequestHandler(param_1,(longlong)pwVar4,local_2b8[0],(longlong)puVar11,2,param_13, - param_10,0,local_298,local_290,param_11,iVar2,local_288,local_258, - (int *)&local_2b4); - } - else { - puVar11 = (undefined8 *)0x2; - uVar6 = PrimaryQueryHandler(param_1,(longlong)pwVar4,local_2b8[0],2,param_13,local_298,local_290 - ,iVar2,local_288,local_258,(int *)&local_2b4); - cVar1 = (char)uVar6; - } - if (cVar1 != '\0') { - _Dst = NetpMemoryAllocate(local_2b4); - *local_280 = _Dst; - if (_Dst != (HLOCAL)0x0) { - uVar5 = (ulonglong)local_2b4; - pwVar9 = local_258; - memcpy(_Dst,pwVar9,uVar5); - *local_278 = local_2b4; - } - } - if (pwVar4 != (wchar_t *)0x0) { - NlDereferenceDomain(pwVar4,pwVar9,uVar5,puVar11); - } -LAB_1: - if (local_2a0 != (LPWSTR)0x0) { - NetApiBufferFree(); - } - return local_res8; + local_2b8 = 1; + } + RtlLeaveCriticalSection(&NlGlobalDnsForestNameCritSect); + RtlEnterCriticalSection(&NlGlobalDomainCritSect); + pwVar11 = NlGlobalServicedDomains; + pwVar9 = pwVar13; + if (((wchar_t **)NlGlobalServicedDomains != &NlGlobalServicedDomains) && + (pwVar9 = pwVar11, NlGlobalServicedDomains != (wchar_t *)0x0)) { + *(int *)(NlGlobalServicedDomains + 0x124) = *(int *)(NlGlobalServicedDomains + 0x124) + 1; + } + RtlLeaveCriticalSection(&NlGlobalDomainCritSect); + goto LAB_8; + } +LAB_9: + if (param_3 != 0) { +LAB_7: + pwVar9 = (wchar_t *)NlFindNetbiosDomain(param_3,'\0'); + if (pwVar9 != (wchar_t *)0x0) goto LAB_10; + } + NlPrintRoutine(0x100, + L"Ping from %ws for domain %ws %ws for %ws on %ws is invalid since we don\'t host the named domain.\n" + ,local_298,local_2a8); + goto LAB_1; + } + goto LAB_10; } ``` ## NlpUserValidate ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,refcount,length,address,called| |ratio|0.33| |i_ratio|0.5| |m_ratio|0.98| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpUserValidate|NlpUserValidate| |fullname|NlpUserValidate|NlpUserValidate| |`refcount`|5|4| |`length`|10673|10204| |`called`|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
DNSAPI.DLL::DnsNameCompare_UTF8
Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_PostRelPACValidationFailsOnRODC__private_IsEnabledDeviceUsageNoInline
FreeTicketValidationInformation
FreeValidationInformation
LSASRV.DLL::LsaICallPackagePassthrough
LSASRV.DLL::LsaIFreeReturnBuffer
LSASRV.DLL::LsaINoMoreWin2KDomain
McTemplateU0zzzzq_EtwEventWriteTransferNETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlEqualDomainName
NTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection
NetpAllocUtf8StrFromUnicodeString
NlDereferenceDomain
NlEqualDnsNameU
NlFindNamedClientSession
NlLocalAllocWStrFromString
NlPickDomainWithAccount
NlPrintCsRoutine
NlPrintDomRoutine
NlPrintRoutine
NlRefDomClientSession
NlRefDomParentClientSession
NlUnrefClientSession
NlpCopyUnicodeString
NlpExpandResourceGroupMembership
NlpLogonTypeToText
NlpNtlmlessLogAccountDomain
NlpRemoveBadPasswordCacheEntry
NlpSamValidate
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyAllowedToAuthenticate
NlpZeroBadPasswordCountLocally
NlpZeroBadPasswordCountOnPdc
TransformKerberosTicketLogonOutbound
memcpy
|
Expand for full list:
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
DNSAPI.DLL::DnsNameCompare_UTF8
FreeTicketValidationInformation
FreeValidationInformation
LSASRV.DLL::LsaICallPackagePassthrough
LSASRV.DLL::LsaIFreeReturnBuffer
LSASRV.DLL::LsaINoMoreWin2KDomain
McTemplateU0zzzzq_EtwEventWriteTransfer
NETUTILS.DLL::NetApiBufferFree
NTDLL.DLL::RtlEnterCriticalSectionNTDLL.DLL::RtlEqualDomainName
NTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection
NetpAllocUtf8StrFromUnicodeString
NlDereferenceDomain
NlEqualDnsNameU
NlFindNamedClientSession
NlLocalAllocWStrFromString
NlPickDomainWithAccount
NlPrintCsRoutine
NlPrintDomRoutine
NlPrintRoutine
NlRefDomClientSession
NlRefDomParentClientSession
NlUnrefClientSession
NlpCopyUnicodeString
NlpExpandResourceGroupMembership
NlpLogonTypeToText
NlpNtlmlessLogAccountDomain
NlpRemoveBadPasswordCacheEntry
NlpSamValidate
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyAllowedToAuthenticate
NlpZeroBadPasswordCountLocally
NlpZeroBadPasswordCountOnPdc
TransformKerberosTicketLogonOutbound
memcpy
| |calling|NlpLogonSamLogon
NlpUserValidate|NlpLogonSamLogon
NlpUserValidate| |paramcount|18|18| |`address`|18001e650|18001e0d0| |sig|uint __fastcall NlpUserValidate(_FILETIME param_1, uint param_2, int param_3, uint param_4, _FILETIME param_5, uint param_6, longlong * param_7, byte * param_8, uint * param_9, char param_10, _FILETIME param_11, ulonglong param_12, undefined4 param_13, uint param_14, undefined8 param_15, longlong param_16, longlong param_17, uint param_18)|uint __fastcall NlpUserValidate(_FILETIME param_1, uint param_2, int param_3, uint param_4, _FILETIME param_5, uint param_6, longlong * param_7, byte * param_8, uint * param_9, char param_10, _FILETIME param_11, ulonglong param_12, undefined4 param_13, uint param_14, undefined8 param_15, longlong param_16, longlong param_17, uint param_18)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpUserValidate Called Diff ```diff --- NlpUserValidate called +++ NlpUserValidate called @@ -4,2 +3,0 @@ -Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline -Feature_Servicing_PostRelPACValidationFailsOnRODC__private_IsEnabledDeviceUsageNoInline ``` ### NlpUserValidate Diff ```diff --- NlpUserValidate +++ NlpUserValidate @@ -1,1540 +1,1510 @@ uint NlpUserValidate(_FILETIME param_1,uint param_2,int param_3,uint param_4,_FILETIME param_5, uint param_6,longlong *param_7,byte *param_8,uint *param_9,char param_10, _FILETIME param_11,ulonglong param_12,undefined4 param_13,uint param_14, undefined8 param_15,longlong param_16,longlong param_17,uint param_18) { ushort uVar1; HLOCAL pvVar2; - bool bVar3; - longlong lVar4; - char cVar5; - char cVar6; - uint uVar7; - int iVar8; - wchar_t *pwVar9; - undefined8 uVar10; - ulonglong uVar11; - wchar_t *pwVar12; - int *piVar13; - wchar_t *****pppppwVar14; - _FILETIME *p_Var15; - LPSTR pCVar16; - _FILETIME _Var17; + byte *pbVar3; + bool bVar4; + bool bVar5; + longlong lVar6; + char cVar7; + char cVar8; + int iVar9; + wchar_t *pwVar10; + wchar_t *pwVar11; + undefined8 uVar12; + ulonglong uVar13; + wchar_t *pwVar14; + wchar_t *****pppppwVar15; + int *piVar16; + _FILETIME *p_Var17; + LPSTR pCVar18; + _FILETIME _Var19; _FILETIME _Dst; - uint uVar18; - uint uVar19; - wchar_t *pwVar20; - ushort *puVar21; + uint uVar20; + uint uVar21; + wchar_t *pwVar22; + ushort *puVar23; _FILETIME uBytes; - _FILETIME _Var22; - _FILETIME _Var23; - wchar_t *pwVar24; - uint uVar25; + _FILETIME _Var24; + _FILETIME _Var25; char *pcVar26; - char *pcVar27; - byte *pbVar28; + uint uVar27; + char *pcVar28; uint uVar29; byte bVar30; byte bVar31; - _FILETIME hMem; wchar_t *pwVar32; bool bVar33; byte local_138; char local_137; - byte local_136; + char local_136; char local_135; byte local_134; - char local_133; - char local_132 [2]; + char local_133 [3]; _FILETIME local_130; char local_128; uint local_124; - uint local_120; - wchar_t *local_118; - char local_110; - byte local_10f; + wchar_t *local_120; + char local_118; + char local_117; + uint local_114; + byte local_110; uint local_10c; uint local_108 [2]; ulonglong local_100; _FILETIME _Stack_f8; - uint local_f0 [2]; - longlong local_e8; - ulonglong local_e0; - _FILETIME _Stack_d8; - ulonglong local_d0; - _FILETIME local_c8; - ulonglong local_c0; - _FILETIME _Stack_b8; - undefined4 local_b0 [2]; + longlong local_f0; + ulonglong local_e8; + _FILETIME _Stack_e0; + ulonglong local_d8; + _FILETIME local_d0; + ulonglong local_c8; + _FILETIME _Stack_c0; + undefined4 local_b8 [2]; + _FILETIME local_b0; _FILETIME local_a8; - _FILETIME local_a0; - ushort local_98 [8]; - undefined8 local_88; - wchar_t *local_80; - undefined8 local_78; - _FILETIME local_70; - undefined8 local_68; - undefined8 uStack_60; - undefined8 local_58; - undefined8 uStack_50; + ushort local_a0 [8]; + undefined8 local_90; + wchar_t *local_88; + undefined8 local_80; + _FILETIME local_78; + undefined8 local_70; + undefined8 uStack_68; + undefined8 local_60; + undefined8 uStack_58; - uVar7 = 0xc0000064; - local_120 = 3; - local_a0.dwLowDateTime = 0; - local_a0.dwHighDateTime = 0; + local_a8.dwLowDateTime = 0; + local_a8.dwHighDateTime = 0; local_130.dwLowDateTime = 0; local_130.dwHighDateTime = 0; - local_132[0] = '\0'; - local_a8.dwLowDateTime = 0; - local_a8.dwHighDateTime = 0; - local_e8 = 0; + local_133[0] = '\0'; + local_b0.dwLowDateTime = 0; + local_b0.dwHighDateTime = 0; + local_f0 = 0; local_10c = 0; - local_110 = '\0'; - local_134 = 0; - uVar25 = *param_9; - bVar30 = (byte)uVar25 & 1; - local_124 = uVar25 & 2; - local_10f = local_124 != 0; - if (((uVar25 & 4) == 0) || (NlGlobalCDC != 0)) { - cVar6 = '\0'; + local_118 = '\0'; + local_124 = 3; + local_135 = '\0'; + uVar27 = *param_9; + bVar30 = (byte)uVar27 & 1; + local_114 = uVar27 & 2; + local_110 = local_114 != 0; + if (((uVar27 & 4) == 0) || (NlGlobalCDC != 0)) { + cVar8 = '\0'; } else { - cVar6 = '\x01'; + cVar8 = '\x01'; } - if (((uVar25 & 8) == 0) || (local_128 = '\x01', NlGlobalCDC != 0)) { + if (((uVar27 & 8) == 0) || (local_128 = '\x01', NlGlobalCDC != 0)) { local_128 = '\0'; } - uVar29 = uVar25 & 0x1000; + uVar29 = uVar27 & 0x1000; if ((param_4 - 2 & 0xfffffffb) == 0) { - bVar3 = true; + bVar4 = true; if (param_4 != 6) goto LAB_0; LAB_1: bVar33 = true; } else { - bVar3 = false; + bVar4 = false; LAB_0: if ((param_4 - 5 & 0xfffffffd) == 0) goto LAB_1; bVar33 = false; } bVar31 = param_4 - 1 < 3; if ((bVar33) || ((bool)bVar31)) { local_137 = '\x01'; } else { local_137 = '\0'; } - local_133 = '\0'; - pcVar27 = "onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"; + local_117 = '\0'; local_138 = bVar31; - local_136 = bVar30; - local_135 = cVar6; + local_136 = cVar8; + local_134 = bVar30; if (((local_137 == '\0') && (param_4 != 4)) && (param_4 != 8)) { - uVar7 = 0xc0000003; + uVar21 = 0xc0000003; *param_8 = 1; - pwVar20 = (wchar_t *)param_1; - uVar25 = 3; + pwVar22 = (wchar_t *)param_1; + uVar27 = 3; } else { - local_a0 = param_5; + local_a8 = param_5; *param_8 = 0; if ((param_4 == 8) && (*(short *)param_5 == 0)) { - pwVar20 = + pwVar22 = L"LogonDomainName is mandatory for Kerberos network ticket logon; the unencrypted part of the ticket always provides the fully qualified name of the issuing realm." ; NlPrintRoutine(0x100, L"LogonDomainName is mandatory for Kerberos network ticket logon; the unencrypted part of the ticket always provides the fully qualified name of the issuing realm." - ,3,"onecore\\ds\\netapi\\svcdlls\\logonsrv\\server\\logonapi.c"); - uVar7 = 0xc000000d; + ,(ulonglong)param_2,3); + uVar21 = 0xc000000d; *param_8 = 1; - uVar25 = 3; + uVar27 = 3; } else { - cVar5 = RtlEqualDomainName(param_5,(longlong)param_1 + 0xa8); - if ((cVar5 == '\0') && + cVar7 = RtlEqualDomainName(param_5,(longlong)param_1 + 0xa8); + if ((cVar7 == '\0') && ((*(int *)((longlong)param_1 + 0x24c) == 3 || - (uVar11 = NlEqualDnsNameU((ushort *)param_5,(ushort *)((longlong)param_1 + 0x80)), - (int)uVar11 == 0)))) { - pbVar28 = (byte *)((ulonglong)pcVar27 & 0xffffffffffffff00); + (uVar13 = NlEqualDnsNameU((ushort *)param_5,(ushort *)((longlong)param_1 + 0x80)), + (int)uVar13 == 0)))) { + local_135 = '\0'; } else { - pbVar28 = (byte *)CONCAT71((int7)((ulonglong)pcVar27 >> 8),1); + local_135 = '\x01'; } - local_134 = (byte)pbVar28; if (1 < param_2 - 6) { - cVar6 = '\0'; - local_135 = '\0'; + cVar8 = '\0'; + local_136 = '\0'; local_128 = '\0'; } if ((NlGlobalMemberWorkstation == 0) || (*(short *)param_5 != 0)) { -LAB_2: - uVar11 = 0; + uVar13 = 0; } else { - uVar11 = 0; - uVar19 = (uint)(*(ushort *)((longlong)param_5 + 0x20) >> 1); - if (uVar19 != 0) { + uVar13 = 0; + uVar21 = (uint)(*(ushort *)((longlong)param_5 + 0x20) >> 1); + if (uVar21 != 0) { do { - if (*(short *)(*(longlong *)((longlong)param_5 + 0x28) + uVar11 * 2) == 0x40) { - uVar11 = 1; - local_110 = '\x01'; - goto LAB_3; - } - uVar18 = (int)uVar11 + 1; - uVar11 = (ulonglong)uVar18; - } while (uVar18 < uVar19); - goto LAB_2; + if (*(short *)(*(longlong *)((longlong)param_5 + 0x28) + uVar13 * 2) == 0x40) { + uVar13 = 1; + local_118 = '\x01'; + goto LAB_2; + } + uVar20 = (int)uVar13 + 1; + uVar13 = (ulonglong)uVar20; + } while (uVar20 < uVar21); + uVar13 = 0; } } -LAB_3: - pwVar20._0_4_ = 0x10; - pwVar20._4_4_ = 0; - uVar19 = 0xc0000064; - if (((uVar25 & 1) == 0) && (uVar19 = 0xc0000064, cVar6 == '\0')) { - if (((*(short *)param_5 != 0) || (local_124 != 0)) && - ((local_134 == 0 && (uVar19 = 0xc0000064, 1 < param_2 - 6)))) goto LAB_4; +LAB_2: + pcVar28 = (char *)0x0; + pwVar22._0_4_ = 0x10; + pwVar22._4_4_ = 0; + uVar21 = 0xc0000064; + if (((uVar27 & 1) == 0) && (uVar21 = 0xc0000064, cVar8 == '\0')) { + if (((*(short *)param_5 != 0) || (local_114 != 0)) && + ((local_135 == '\0' && (uVar27 = 0xc0000064, 1 < param_2 - 6)))) goto LAB_3; if (local_137 == '\0') { if (param_4 == 8) { - local_70 = param_5; - pcVar27 = (char *)0x10; + local_78 = param_5; local_108[0] = 0; - pwVar20._0_4_ = 0; - pwVar20._4_4_ = 0; - local_80 = L"Kerberos"; - local_b0[0] = 0; - local_88 = 0x120010; - local_78 = 0x25; - uVar7 = LsaICallPackagePassthrough - (&local_88,0,&local_78,0x10,param_7,local_b0,local_108); - if ((int)uVar7 < 0) { + local_b8[0] = 0; + pcVar28 = (char *)0x10; + local_88 = L"Kerberos"; + pwVar22._0_4_ = 0; + pwVar22._4_4_ = 0; + local_90 = 0x120010; + local_80 = 0x25; + uVar27 = LsaICallPackagePassthrough + (&local_90,0,&local_80,0x10,param_7,local_b8,local_108); + uVar13 = (ulonglong)uVar27; + if ((int)uVar27 < 0) { NlPrintRoutine(0x100, L"Failed LsaICallPackagePassthrough for network ticket validation. 0x%08x\n" - ,(ulonglong)uVar7,pcVar27); + ,(ulonglong)uVar27,pcVar28); if (*param_7 != 0) { - pcVar27 = "*ValidationInformation == NULL"; + pcVar28 = "*ValidationInformation == NULL"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "*ValidationInformation == NULL"); } *param_8 = 0; } else { *param_8 = 1; - pbVar28 = (byte *)*param_7; - if (pbVar28 == (byte *)0x0) { - pcVar27 = "TicketLogonValidation"; - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pbVar3 = (byte *)*param_7; + if (pbVar3 == (byte *)0x0) { + pcVar28 = "TicketLogonValidation"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "TicketLogonValidation"); } + uVar13 = (ulonglong)local_108[0]; if ((int)local_108[0] < 0) { - pwVar20 = + pwVar22 = L"NlpUserValidate: Kerberos passthrough ticket logon failed. ProtocolStatus = 0x%08x\n" ; NlPrintRoutine(4, L"NlpUserValidate: Kerberos passthrough ticket logon failed. ProtocolStatus = 0x%08x\n" - ,(ulonglong)local_108[0],pcVar27); - if ((pbVar28 == (byte *)0x0) || ((*pbVar28 & 1) == 0)) { - pwVar20 = + ,(ulonglong)local_108[0],pcVar28); + if ((pbVar3 == (byte *)0x0) || ((*pbVar3 & 1) == 0)) { + pwVar22 = L"NlpUserValidate: Kerberos reported unsuccessful protocol status but didn\'t mark ticket invalid. ProtocolStatus = 0x%08x\n" ; NlPrintRoutine(0x100, L"NlpUserValidate: Kerberos reported unsuccessful protocol status but didn\'t mark ticket invalid. ProtocolStatus = 0x%08x\n" - ,(ulonglong)local_108[0],pcVar27); + ,(ulonglong)local_108[0],pcVar28); } else { + uVar13 = (ulonglong)local_108[0]; +LAB_4: + if ((*pbVar3 & 1) == 0) goto LAB_5; + NlPrintRoutine(4,L"Kerberos ticket logon failed. KerberosStatus = 0x%08x\n", + (ulonglong)*(uint *)(pbVar3 + 8),pcVar28); + pwVar22 = (wchar_t *)((longlong)pbVar3 + 0x10); + NlpCopyUnicodeString((ushort *)(NlGlobalDomainInfo + 0x110),(undefined4 *)pwVar22) + ; + } + uVar13 = (ulonglong)local_108[0]; + } + else if (pbVar3 != (byte *)0x0) goto LAB_4; LAB_5: - if ((*pbVar28 & 1) != 0) { - NlPrintRoutine(4,L"Kerberos ticket logon failed. KerberosStatus = 0x%08x\n", - (ulonglong)*(uint *)(pbVar28 + 8),pcVar27); - pwVar20 = (wchar_t *)((longlong)pbVar28 + 0x10); - NlpCopyUnicodeString - ((ushort *)(NlGlobalDomainInfo + 0x110),(undefined4 *)pwVar20); - } - } - } - else if (pbVar28 != (byte *)0x0) goto LAB_5; - uVar7 = local_108[0]; - if (-1 < (int)local_108[0]) { - pbVar28 = (byte *)(ulonglong)local_134; - goto LAB_6; - } - } - pwVar20 = L"Kerberos ticket logon failed with 0x%08X"; - NlPrintRoutine(4,L"Kerberos ticket logon failed with 0x%08X",(ulonglong)uVar7,pcVar27); - uVar25 = 3; + uVar21 = (uint)uVar13; + if (-1 < (int)uVar21) goto LAB_6; + } + uVar21 = (uint)uVar13; + pwVar22 = L"Kerberos ticket logon failed with 0x%08X"; + NlPrintRoutine(4,L"Kerberos ticket logon failed with 0x%08X",uVar13,pcVar28); + uVar27 = 3; goto LAB_7; } if (param_4 != 4) { NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "GenericPassthrough"); } - _Var23.dwLowDateTime = 0; - _Var23.dwHighDateTime = 0; - local_d0 = 0; - pwVar20._0_4_ = 0; - pwVar20._4_4_ = 0; - local_124 = 0; - local_c8.dwLowDateTime = 0; - local_c8.dwHighDateTime = 0; - uVar7 = LsaICallPackagePassthrough - ((longlong)param_5 + 0x40,0,*(undefined8 *)((longlong)param_5 + 0x58), - *(undefined4 *)((longlong)param_5 + 0x50),&local_c8,&local_d0, - &local_124); - if (-1 < (int)uVar7) { - uVar7 = local_124; + local_d8 = 0; + pwVar22._0_4_ = 0; + pwVar22._4_4_ = 0; + local_114 = 0; + local_d0.dwLowDateTime = 0; + local_d0.dwHighDateTime = 0; + uVar21 = LsaICallPackagePassthrough + ((longlong)param_5 + 0x40,0,*(undefined8 *)((longlong)param_5 + 0x58), + *(undefined4 *)((longlong)param_5 + 0x50),&local_d0,&local_d8, + &local_114); + if (-1 < (int)uVar21) { + uVar21 = local_114; } *param_8 = 1; - if ((int)uVar7 < 0) { - if ((NlGlobalCDC != 0) && (uVar7 == 0xc0000371)) { - local_118 = (wchar_t *)((ulonglong)local_118 & 0xffffffff00000000); + if ((int)uVar21 < 0) { + if ((NlGlobalCDC != 0) && (uVar21 == 0xc0000371)) { + local_120 = (wchar_t *)((ulonglong)local_120 & 0xffffffff00000000); if (*(int *)((longlong)param_1 + 0x24c) == 2) { - pppppwVar14 = (wchar_t *****)NlRefDomClientSession((longlong)param_1); - if (pppppwVar14 == (wchar_t *****)0x0) { - uVar7 = 0xc00000de; - *param_8 = 1; - _Var23.dwLowDateTime = 0; - _Var23.dwHighDateTime = 0; - } - else { - pwVar20._0_4_ = 0; - pwVar20._4_4_ = 0; - p_Var15 = NlpUserValidateHigher - (pppppwVar14,'\0',param_4,(_FILETIME *)param_5,param_6,param_7 - ,param_8,(uint *)&local_118); - uVar7 = (uint)p_Var15; - if ((-1 < (int)uVar7) && (((byte)NlGlobalParameters & 4) != 0)) { - pcVar27 = NlpLogonTypeToText(param_4); - pwVar20 = (wchar_t *)param_1; + pppppwVar15 = (wchar_t *****)NlRefDomClientSession((longlong)param_1); + if (pppppwVar15 != (wchar_t *****)0x0) { + pwVar22._0_4_ = 0; + pwVar22._4_4_ = 0; + p_Var17 = NlpUserValidateHigher + (pppppwVar15,'\0',param_4,(_FILETIME *)param_5,param_6,param_7 + ,param_8,(uint *)&local_120); + uVar21 = (uint)p_Var17; + if ((-1 < (int)uVar21) && (((byte)NlGlobalParameters & 4) != 0)) { + pcVar28 = NlpLogonTypeToText(param_4); + pwVar22 = (wchar_t *)param_1; NlPrintDomRoutine(4,(longlong)param_1, L"SamLogon: %hs logon of %wZ\\%wZ from %wZ successfully handled on DC(UseHub is %hs).\n" - ,pcVar27); - } - NlUnrefClientSession(pppppwVar14); + ,pcVar28); + } + NlUnrefClientSession(pppppwVar15); *param_8 = 1; - } + goto LAB_8; + } + uVar21 = 0xc00000de; + *param_8 = 1; + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; } else { - uVar7 = 0xc00000de; + uVar21 = 0xc00000de; *param_8 = 1; - } + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; + } + goto LAB_9; } } else { - pwVar20._0_4_ = (int)local_d0 + 0x10; - pwVar20._4_4_ = 0; - piVar13 = LocalAlloc(0x40,(SIZE_T)pwVar20); - if (piVar13 == (int *)0x0) { - uVar7 = 0xc000009a; - } - else if (((int)local_d0 == 0) || (local_c8 == (_FILETIME)0x0)) { - *piVar13 = 0; - piVar13[2] = 0; - piVar13[3] = 0; - *param_7 = (longlong)piVar13; + pwVar22._0_4_ = (int)local_d8 + 0x10; + pwVar22._4_4_ = 0; + piVar16 = LocalAlloc(0x40,(SIZE_T)pwVar22); + if (piVar16 == (int *)0x0) { + uVar21 = 0xc000009a; + } + else if (((int)local_d8 == 0) || (local_d0 == (_FILETIME)0x0)) { + *piVar16 = 0; + piVar16[2] = 0; + piVar16[3] = 0; + *param_7 = (longlong)piVar16; } else { - *piVar13 = (int)local_d0; - *(int **)(piVar13 + 2) = piVar13 + 4; - pwVar20 = (wchar_t *)local_c8; - memcpy(piVar13 + 4,(void *)local_c8,local_d0 & 0xffffffff); - *param_7 = (longlong)piVar13; - } - if (local_c8 != (_FILETIME)0x0) { + *piVar16 = (int)local_d8; + *(int **)(piVar16 + 2) = piVar16 + 4; + pwVar22 = (wchar_t *)local_d0; + memcpy(piVar16 + 4,(void *)local_d0,local_d8 & 0xffffffff); + *param_7 = (longlong)piVar16; + } + if (local_d0 != (_FILETIME)0x0) { LsaIFreeReturnBuffer(); - } - } + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; + goto LAB_9; + } + } +LAB_8: + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; } else { - local_120 = 2; - if ((char)uVar11 == '\0') { - uVar25 = Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline(); - local_133 = uVar25 != 0; - if (((((DAT_8 & 1) != 0) && (param_2 == 2)) && (uVar29 == 0)) || - (((DAT_8 & 2) != 0 && (param_2 - 3 < 2)))) { - local_c0 = 0; - _Stack_b8.dwLowDateTime = 0; - _Stack_b8.dwHighDateTime = 0; - RtlInitUnicodeString(&local_c0); - pwVar12 = (wchar_t *)0x0; - pwVar24 = (wchar_t *)0x0; - local_130.dwLowDateTime = 0; - local_130.dwHighDateTime = 0; - hMem.dwLowDateTime = 0; - hMem.dwHighDateTime = 0; - _Var17.dwLowDateTime = 0; - _Var17.dwHighDateTime = 0; - pwVar9 = (wchar_t *)0x0; - puVar21 = (ushort *)((longlong)param_5 + 0x20); - pwVar20 = pwVar12; + local_124 = 2; + uVar21 = 0xc0000064; + if ((char)uVar13 == '\0') { + local_117 = '\x01'; + if (((((DAT_10 & 1) != 0) && (param_2 == 2)) && (uVar29 == 0)) || + (((DAT_10 & 2) != 0 && (param_2 - 3 < 2)))) { + local_c8 = 0; + _Stack_c0.dwLowDateTime = 0; + _Stack_c0.dwHighDateTime = 0; + RtlInitUnicodeString(&local_c8); + puVar23 = (ushort *)((longlong)param_5 + 0x20); if (param_2 != 2) { - if ((ushort)local_c0 != 0) { - if ((ushort)local_c0 <= (ushort)((ushort)local_c0 + 2)) { + pwVar22 = (wchar_t *)0x0; + local_130.dwLowDateTime = 0; + local_130.dwHighDateTime = 0; + pwVar11 = (wchar_t *)0x0; + _Var24.dwLowDateTime = 0; + _Var24.dwHighDateTime = 0; + pwVar10 = pwVar22; + if ((ushort)local_c8 != 0) { + if ((ushort)local_c8 <= (ushort)((ushort)local_c8 + 2)) { param_11._2_6_ = 0; - param_11.dwLowDateTime._0_2_ = (ushort)local_c0 + 2; - pwVar9 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar9 != (wchar_t *)0x0) { - param_11 = _Stack_b8; - memcpy(pwVar9,(void *)_Stack_b8,local_c0 & 0xffff); - pwVar9[local_c0 >> 1 & 0x7fff] = L'\0'; - goto LAB_9; + param_11.dwLowDateTime._0_2_ = (ushort)local_c8 + 2; + pwVar10 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar10 != (wchar_t *)0x0) { + param_11 = _Stack_c0; + memcpy(pwVar10,(void *)_Stack_c0,local_c8 & 0xffff); + pwVar10[local_c8 >> 1 & 0x7fff] = L'\0'; + goto LAB_11; } } - goto LAB_10; - } -LAB_9: - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { + goto LAB_12; + } LAB_11: + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { +LAB_13: uVar1 = *(ushort *)param_5; + pwVar11 = (wchar_t *)0x0; + pwVar32 = (wchar_t *)0x0; if (uVar1 == 0) { -LAB_12: - pwVar24 = pwVar12; - puVar21 = (ushort *)((longlong)param_5 + 0x30); +LAB_14: + pwVar11 = pwVar32; + puVar23 = (ushort *)((longlong)param_5 + 0x30); param_11 = (_FILETIME)&local_130; - uVar10 = NlLocalAllocWStrFromString(puVar21,(undefined8 *)param_11); - _Var17 = local_130; - if (((char)uVar10 != '\0') && + uVar12 = NlLocalAllocWStrFromString(puVar23,(undefined8 *)param_11); + _Var24 = local_130; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 1) != 0)) { param_11 = (_FILETIME)&NTLMDCBlockedFSLA; McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCBlockedFSLA,pwVar9,pwVar20,pwVar24, + (puVar23,&NTLMDCBlockedFSLA,pwVar10,pwVar22,pwVar11, (wchar_t *)local_130); } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar24 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar24 != (wchar_t *)0x0) { - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 + pwVar11 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar11 != (wchar_t *)0x0) { + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 ); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - pwVar12 = pwVar24; - goto LAB_12; + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + pwVar32 = pwVar11; + goto LAB_14; } } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar20 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar20 != (wchar_t *)0x0) { + pwVar22 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar22 != (wchar_t *)0x0) { param_11 = *(_FILETIME *)((longlong)param_5 + 0x28); - memcpy(pwVar20,(void *)param_11,(ulonglong)*puVar21); - pwVar20[*puVar21 >> 1] = L'\0'; - goto LAB_11; - } - } - goto LAB_13; - } - if ((ushort)local_c0 == 0) { -LAB_14: - _Var17 = hMem; - pwVar24 = pwVar12; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { -LAB_15: + memcpy(pwVar22,(void *)param_11,(ulonglong)*puVar23); + pwVar22[*puVar23 >> 1] = L'\0'; + goto LAB_13; + } + } + goto LAB_15; + } + pwVar11 = (wchar_t *)0x0; + local_130.dwLowDateTime = 0; + local_130.dwHighDateTime = 0; + _Var24.dwLowDateTime = 0; + _Var24.dwHighDateTime = 0; + pwVar10 = (wchar_t *)0x0; + if ((ushort)local_c8 == 0) { +LAB_16: + pwVar22 = pwVar11; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { +LAB_17: uVar1 = *(ushort *)param_5; if (uVar1 == 0) { -LAB_16: - puVar21 = (ushort *)((longlong)param_5 + 0x30); +LAB_18: + puVar23 = (ushort *)((longlong)param_5 + 0x30); param_11 = (_FILETIME)&local_130; - uVar10 = NlLocalAllocWStrFromString(puVar21,(undefined8 *)param_11); - _Var17 = local_130; - if (((char)uVar10 != '\0') && + uVar12 = NlLocalAllocWStrFromString(puVar23,(undefined8 *)param_11); + _Var24 = local_130; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 1) != 0)) { param_11 = (_FILETIME)&NTLMDCBlockedLSLA; McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCBlockedLSLA,pwVar9,pwVar20,pwVar24, + (puVar23,&NTLMDCBlockedLSLA,pwVar10,pwVar22,pwVar11, (wchar_t *)local_130); } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar24 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar24 != (wchar_t *)0x0) { - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 + pwVar11 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar11 != (wchar_t *)0x0) { + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 ); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - goto LAB_16; + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + goto LAB_18; } } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar20 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar20 != (wchar_t *)0x0) { + pwVar22 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar22 != (wchar_t *)0x0) { param_11 = *(_FILETIME *)((longlong)param_5 + 0x28); - memcpy(pwVar20,(void *)param_11,(ulonglong)*puVar21); - pwVar20[*puVar21 >> 1] = L'\0'; - goto LAB_15; - } - } -LAB_13: - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } - if (pwVar20 != (wchar_t *)0x0) { - LocalFree(pwVar20); - } - hMem = _Var17; - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); - } - } - else if ((ushort)local_c0 <= (ushort)((ushort)local_c0 + 2)) { + memcpy(pwVar22,(void *)param_11,(ulonglong)*puVar23); + pwVar22[*puVar23 >> 1] = L'\0'; + goto LAB_17; + } + } +LAB_15: + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + if (pwVar22 != (wchar_t *)0x0) { + LocalFree(pwVar22); + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); + } + } + else if ((ushort)local_c8 <= (ushort)((ushort)local_c8 + 2)) { param_11._2_6_ = 0; - param_11.dwLowDateTime._0_2_ = (ushort)local_c0 + 2; - pwVar9 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar9 != (wchar_t *)0x0) { - param_11 = _Stack_b8; - memcpy(pwVar9,(void *)_Stack_b8,local_c0 & 0xffff); - pwVar9[local_c0 >> 1 & 0x7fff] = L'\0'; - goto LAB_14; - } - } -LAB_10: - pwVar20 = (wchar_t *)param_11; - if (hMem != (_FILETIME)0x0) { - LocalFree((HLOCAL)hMem); - pwVar20 = (wchar_t *)param_11; - } - uVar7 = 0xc0000418; + param_11.dwLowDateTime._0_2_ = (ushort)local_c8 + 2; + pwVar10 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar10 != (wchar_t *)0x0) { + param_11 = _Stack_c0; + memcpy(pwVar10,(void *)_Stack_c0,local_c8 & 0xffff); + pwVar10[local_c8 >> 1 & 0x7fff] = L'\0'; + goto LAB_16; + } + } +LAB_12: + pwVar22 = (wchar_t *)param_11; + if (_Var24 != (_FILETIME)0x0) { + LocalFree((HLOCAL)_Var24); + pwVar22 = (wchar_t *)param_11; + } + uVar21 = 0xc0000418; *param_8 = 1; - uVar25 = local_120; + uVar27 = local_124; goto LAB_7; } - if ((((DAT_17 & 1) == 0) || (param_2 != 2)) || (uVar29 != 0)) { - if (((DAT_17 & 2) != 0) && (param_2 - 3 < 2)) { + if ((((DAT_19 & 1) == 0) || (param_2 != 2)) || (uVar29 != 0)) { + if (((DAT_19 & 2) != 0) && (param_2 - 3 < 2)) { local_100 = 0; _Stack_f8.dwLowDateTime = 0; _Stack_f8.dwHighDateTime = 0; RtlInitUnicodeString(&local_100,param_11); - pwVar12 = (wchar_t *)0x0; - puVar21 = (ushort *)((longlong)param_5 + 0x20); - local_118 = (wchar_t *)0x0; - pwVar24 = (wchar_t *)0x0; - pwVar20 = (wchar_t *)0x0; + pwVar32 = (wchar_t *)0x0; + puVar23 = (ushort *)((longlong)param_5 + 0x20); + local_120 = (wchar_t *)0x0; + pwVar11 = (wchar_t *)0x0; + pwVar22 = (wchar_t *)0x0; + pwVar10 = pwVar32; if ((ushort)local_100 != 0) { if (((ushort)((ushort)local_100 + 2) < (ushort)local_100) || - (pwVar12 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), - pwVar12 == (wchar_t *)0x0)) goto LAB_18; - memcpy(pwVar12,(void *)_Stack_f8,local_100 & 0xffff); - pwVar12[local_100 >> 1 & 0x7fff] = L'\0'; - } - pwVar9 = (wchar_t *)0x0; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { -LAB_19: - pwVar24 = (wchar_t *)0x0; + (pwVar10 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), + pwVar10 == (wchar_t *)0x0)) goto LAB_20; + memcpy(pwVar10,(void *)_Stack_f8,local_100 & 0xffff); + pwVar10[local_100 >> 1 & 0x7fff] = L'\0'; + } + pwVar14 = pwVar32; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { +LAB_21: uVar1 = *(ushort *)param_5; - pwVar32 = (wchar_t *)0x0; if (uVar1 != 0) { if (((ushort)(uVar1 + 2) < uVar1) || - (pwVar24 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar24 == (wchar_t *)0x0)) goto LAB_20; - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - pwVar32 = pwVar24; - } - pwVar24 = pwVar32; - puVar21 = (ushort *)((longlong)param_5 + 0x30); - uVar10 = NlLocalAllocWStrFromString(puVar21,&local_118); - pwVar20 = local_118; - if (((char)uVar10 != '\0') && + (pwVar11 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar11 == (wchar_t *)0x0)) goto LAB_22; + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + pwVar32 = pwVar11; + } + pwVar11 = pwVar32; + puVar23 = (ushort *)((longlong)param_5 + 0x30); + uVar12 = NlLocalAllocWStrFromString(puVar23,&local_120); + pwVar22 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 2) != 0)) { McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCAuditFSLA,pwVar12,pwVar9,pwVar24,local_118); + (puVar23,&NTLMDCAuditFSLA,pwVar10,pwVar14,pwVar11,local_120); } } else if ((uVar1 <= (ushort)(uVar1 + 2)) && - (pwVar9 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar9 != (wchar_t *)0x0)) { - memcpy(pwVar9,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar21); - pwVar9[*puVar21 >> 1] = L'\0'; - goto LAB_19; - } - goto LAB_20; + (pwVar14 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar14 != (wchar_t *)0x0)) { + memcpy(pwVar14,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar23); + pwVar14[*puVar23 >> 1] = L'\0'; + goto LAB_21; + } + goto LAB_22; } } else { local_100 = 0; _Stack_f8.dwLowDateTime = 0; _Stack_f8.dwHighDateTime = 0; RtlInitUnicodeString(&local_100,param_11); - pwVar24 = (wchar_t *)0x0; - puVar21 = (ushort *)((longlong)param_5 + 0x20); - local_118 = (wchar_t *)0x0; + pwVar14 = (wchar_t *)0x0; + puVar23 = (ushort *)((longlong)param_5 + 0x20); + local_120 = (wchar_t *)0x0; pwVar32 = (wchar_t *)0x0; - pwVar12 = pwVar24; + pwVar10 = pwVar14; if ((ushort)local_100 == 0) { -LAB_21: - pwVar9 = (wchar_t *)0x0; - if ((puVar21 != (ushort *)0x0) && (uVar1 = *puVar21, uVar1 != 0)) { - pwVar20 = pwVar24; +LAB_23: + if ((puVar23 != (ushort *)0x0) && (uVar1 = *puVar23, uVar1 != 0)) { + pwVar11 = pwVar14; + pwVar22 = pwVar14; if (((ushort)(uVar1 + 2) < uVar1) || - (pwVar9 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar24 = (wchar_t *)0x0, pwVar20 = pwVar32, pwVar9 == (wchar_t *)0x0)) - goto LAB_20; - memcpy(pwVar9,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar21); - pwVar9[*puVar21 >> 1] = L'\0'; - } - pwVar24 = (wchar_t *)0x0; + (pwVar14 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar11 = (wchar_t *)0x0, pwVar22 = pwVar32, pwVar14 == (wchar_t *)0x0)) + goto LAB_22; + memcpy(pwVar14,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar23); + pwVar14[*puVar23 >> 1] = L'\0'; + } + pwVar11 = (wchar_t *)0x0; uVar1 = *(ushort *)param_5; - pwVar20 = (wchar_t *)0x0; if (uVar1 != 0) { - pwVar20 = pwVar32; + pwVar22 = pwVar32; if (((ushort)(uVar1 + 2) < uVar1) || - (pwVar24 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar24 == (wchar_t *)0x0)) goto LAB_20; - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - pwVar20 = pwVar24; - } - pwVar24 = pwVar20; - puVar21 = (ushort *)((longlong)param_5 + 0x30); - uVar10 = NlLocalAllocWStrFromString(puVar21,&local_118); - pwVar20 = local_118; - if (((char)uVar10 != '\0') && + (pwVar11 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar11 == (wchar_t *)0x0)) goto LAB_22; + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + } + puVar23 = (ushort *)((longlong)param_5 + 0x30); + uVar12 = NlLocalAllocWStrFromString(puVar23,&local_120); + pwVar22 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 2) != 0)) { McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCAuditLSLA,pwVar12,pwVar9,pwVar24,local_118); - } + (puVar23,&NTLMDCAuditLSLA,pwVar10,pwVar14,pwVar11,local_120); + } +LAB_22: + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + if (pwVar14 != (wchar_t *)0x0) { + LocalFree(pwVar14); + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); + } + } + else { + pwVar22 = pwVar14; + if (((ushort)local_100 <= (ushort)((ushort)local_100 + 2)) && + (pwVar10 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), + pwVar22 = pwVar32, pwVar10 != (wchar_t *)0x0)) { + memcpy(pwVar10,(void *)_Stack_f8,local_100 & 0xffff); + pwVar10[local_100 >> 1 & 0x7fff] = L'\0'; + goto LAB_23; + } + } LAB_20: - if (pwVar12 != (wchar_t *)0x0) { - LocalFree(pwVar12); - } - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } - cVar6 = local_135; - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); - cVar6 = local_135; - } - } - else { - pwVar20 = pwVar24; - if (((ushort)local_100 <= (ushort)((ushort)local_100 + 2)) && - (pwVar12 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), - pwVar20 = pwVar32, pwVar12 != (wchar_t *)0x0)) { - memcpy(pwVar12,(void *)_Stack_f8,local_100 & 0xffff); - pwVar12[local_100 >> 1 & 0x7fff] = L'\0'; - goto LAB_21; - } - } -LAB_18: - bVar30 = local_136; + bVar30 = local_134; + cVar8 = local_136; bVar31 = local_138; - if (pwVar20 != (wchar_t *)0x0) { - LocalFree(pwVar20); - bVar30 = local_136; + if (pwVar22 != (wchar_t *)0x0) { + LocalFree(pwVar22); + bVar30 = local_134; + cVar8 = local_136; bVar31 = local_138; } } - pwVar20 = (wchar_t *)param_1; - uVar7 = NlpSamValidate(*(undefined8 *)((longlong)param_1 + 0x178),param_1,param_2, - (longlong)param_1 + 0x100,(longlong)param_1 + 0xa8, - *(undefined8 *)((longlong)param_1 + 0xb8),param_4, - (undefined8 *)param_5,param_6,param_7,(char *)param_8,local_132,1 - ); - if (local_132[0] != '\0') { - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_4; + pcVar28 = (char *)((longlong)param_1 + 0x100); + pwVar22 = (wchar_t *)param_1; + uVar21 = NlpSamValidate(*(undefined8 *)((longlong)param_1 + 0x178),param_1,param_2, + pcVar28,(longlong)param_1 + 0xa8, + *(undefined8 *)((longlong)param_1 + 0xb8),param_4, + (undefined8 *)param_5,param_6,param_7,(char *)param_8,local_133, + 1); + if (local_133[0] != '\0') { + pwVar22._4_4_ = 0; + pwVar22._0_4_ = param_4; NlpZeroBadPasswordCountOnPdc((longlong *)param_1,param_4,(_FILETIME *)param_5); } - pbVar28 = (byte *)(ulonglong)local_134; - } - if ((((char)pbVar28 != '\0') && (uVar7 == 0xc0000064)) || (uVar7 == 0xc0000371)) { + } + if (((local_135 != '\0') && (uVar21 == 0xc0000064)) || (uVar21 == 0xc0000371)) { *param_8 = 1; } - _Var23 = local_130; + _Var19 = local_130; if (param_2 != 6) { LAB_6: - uVar19 = uVar7; - if (*param_8 == 0) goto LAB_22; - uVar25 = Feature_Servicing_PostRelPACValidationFailsOnRODC__private_IsEnabledDeviceUsageNoInline - (); - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_4; - if (uVar25 == 0) { - if ((((((param_4 == 8) && (*param_7 != 0)) && ((*(byte *)(*param_7 + 4) & 1) != 0)) || - ((uVar7 == 0xc000006a || (uVar7 == 0xc0000071)))) || (uVar7 == 0xc0000224)) || - ((uVar7 == 0xc0000234 || (uVar7 == 0xc0000371)))) { - pvVar2 = (HLOCAL)*param_7; - bVar33 = uVar7 == 0xc0000371; - local_138 = 0; - uVar11 = NlpUserValidateOnDc((longlong *)param_1,param_4,(_FILETIME *)param_5, - (ulonglong)param_6,1,(uint)bVar33,param_7,&local_138); - uVar25 = (uint)uVar11; - if (((uVar7 == 0xc0000371) || - (((-1 < (int)uVar25 || (uVar25 == 0xc000006a)) || (uVar25 == 0xc0000071)))) || - ((uVar25 == 0xc0000224 || (uVar25 == 0xc0000234)))) { - *param_8 = local_138; - if (pvVar2 != (HLOCAL)*param_7) { - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_6; - FreeValidationInformation(pvVar2,param_6); - } - uVar7 = uVar25; - if ((((-1 < (int)uVar25) || (uVar25 == 0xc0000071)) || (uVar25 == 0xc0000224)) && - ((param_4 != 8 && (NlGlobalMemberWorkstation == 0)))) { - pwVar20 = (wchar_t *)((longlong)param_5 + 0x20); - uVar7 = NlpZeroBadPasswordCountLocally((longlong)param_1,pwVar20,bVar33); - } - } - else if (pvVar2 != (HLOCAL)*param_7) { - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_6; + if (*param_8 == 0) goto LAB_24; + pwVar22._4_4_ = 0; + pwVar22._0_4_ = param_4; + if ((param_4 == 8) && (*param_7 != 0)) { + bVar30 = *(byte *)(*param_7 + 4) & 1; + if (*(int *)(*param_7 + 8) != -0x3ffffc8f) goto LAB_25; + bVar33 = true; + } + else { + bVar30 = 0; +LAB_25: + bVar33 = false; + } + if ((((bVar30 != 0) || (bVar33)) || (uVar21 == 0xc000006a)) || + (((uVar21 == 0xc0000071 || (uVar21 == 0xc0000224)) || + ((uVar21 == 0xc0000234 || (uVar21 == 0xc0000371)))))) { + pvVar2 = (HLOCAL)*param_7; + local_138 = 0; + if (uVar21 == 0xc0000371) { + cVar8 = '\x01'; +LAB_26: + iVar9 = 1; + } + else { + cVar8 = '\0'; + if (bVar33) goto LAB_26; + iVar9 = 0; + } + uVar13 = NlpUserValidateOnDc((longlong *)param_1,param_4,(_FILETIME *)param_5, + (ulonglong)param_6,1,iVar9,param_7,&local_138); + uVar27 = (uint)uVar13; + if (((cVar8 == '\0') && ((int)uVar27 < 0)) && + ((uVar27 != 0xc000006a && + (((uVar27 != 0xc0000071 && (uVar27 != 0xc0000224)) && (uVar27 != 0xc0000234)))))) + { + if (pvVar2 != (HLOCAL)*param_7) { + pwVar22._4_4_ = 0; + pwVar22._0_4_ = param_6; FreeValidationInformation((HLOCAL)*param_7,param_6); *param_7 = (longlong)pvVar2; } - goto LAB_23; + } + else { + *param_8 = local_138; + if (pvVar2 != (HLOCAL)*param_7) { + pwVar22._4_4_ = 0; + pwVar22._0_4_ = param_6; + FreeValidationInformation(pvVar2,param_6); + } + uVar21 = uVar27; + if ((((-1 < (int)uVar27) || (uVar27 == 0xc0000071)) || (uVar27 == 0xc0000224)) && + ((param_4 != 8 && (NlGlobalMemberWorkstation == 0)))) { + pwVar22 = (wchar_t *)((longlong)param_5 + 0x20); + uVar21 = NlpZeroBadPasswordCountLocally((longlong)param_1,pwVar22,cVar8); + } + } + _Var19 = local_130; + if ((((uVar21 != 0xc000006a) && (uVar21 != 0xc0000071)) && (uVar21 != 0xc0000224)) && + (uVar21 != 0xc0000234)) { + pwVar22 = (wchar_t *)param_5; + NlpRemoveBadPasswordCacheEntry((longlong)param_1,(longlong)param_5); + _Var19 = local_130; } } else { - if ((param_4 == 8) && (*param_7 != 0)) { - bVar30 = *(byte *)(*param_7 + 4) & 1; - if (*(int *)(*param_7 + 8) != -0x3ffffc8f) goto LAB_24; - bVar33 = true; - } - else { - bVar30 = 0; -LAB_24: - bVar33 = false; - } - if ((((bVar30 == 0) && (!bVar33)) && (uVar7 != 0xc000006a)) && - (((uVar7 != 0xc0000071 && (uVar7 != 0xc0000224)) && - ((uVar7 != 0xc0000234 && (uVar7 != 0xc0000371)))))) goto LAB_25; - local_136 = 0; - pvVar2 = (HLOCAL)*param_7; - if (uVar7 == 0xc0000371) { - cVar6 = '\x01'; -LAB_26: - iVar8 = 1; - } - else { - cVar6 = '\0'; - if (bVar33) goto LAB_26; - iVar8 = 0; - } - uVar11 = NlpUserValidateOnDc((longlong *)param_1,param_4,(_FILETIME *)param_5, - (ulonglong)param_6,1,iVar8,param_7,&local_136); - uVar25 = (uint)uVar11; - if (((cVar6 == '\0') && ((int)uVar25 < 0)) && - ((uVar25 != 0xc000006a && - (((uVar25 != 0xc0000071 && (uVar25 != 0xc0000224)) && (uVar25 != 0xc0000234)))))) - { - if (pvVar2 != (HLOCAL)*param_7) { - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_6; - FreeValidationInformation((HLOCAL)*param_7,param_6); - *param_7 = (longlong)pvVar2; - } - } - else { - *param_8 = local_136; - if (pvVar2 != (HLOCAL)*param_7) { - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_6; - FreeValidationInformation(pvVar2,param_6); - } - uVar7 = uVar25; - if ((((-1 < (int)uVar25) || (uVar25 == 0xc0000071)) || (uVar25 == 0xc0000224)) && - ((param_4 != 8 && (NlGlobalMemberWorkstation == 0)))) { - pwVar20 = (wchar_t *)((longlong)param_5 + 0x20); - uVar7 = NlpZeroBadPasswordCountLocally((longlong)param_1,pwVar20,cVar6); - } - } -LAB_23: - _Var23 = local_130; - if ((((uVar7 == 0xc000006a) || (uVar7 == 0xc0000071)) || (uVar7 == 0xc0000224)) || - (uVar7 == 0xc0000234)) goto LAB_27; - } -LAB_25: - pwVar20 = (wchar_t *)param_5; - NlpRemoveBadPasswordCacheEntry((longlong)param_1,(longlong)param_5); - _Var23 = local_130; - } - } -LAB_27: - if (-1 < (int)uVar7) { - if (uVar7 != 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = (wchar_t *)param_5; + NlpRemoveBadPasswordCacheEntry((longlong)param_1,(longlong)param_5); + _Var19 = local_130; + } + } + } +LAB_9: + if (-1 < (int)uVar21) { + if (uVar21 != 0) { + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(DefaultStatus) || DefaultStatus == STATUS_SUCCESS"); } if (*param_7 == 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(DefaultStatus) || *ValidationInformation != NULL"); } } } else { -LAB_22: - if ((((char)pbVar28 != '\0') && (*(short *)param_5 != 0)) && - ((bVar30 == 0 && (_Var22 = local_130, cVar6 == '\0')))) goto LAB_28; -LAB_4: - uVar25 = local_124; +LAB_24: + uVar27 = uVar21; + if (((local_135 != '\0') && (*(short *)param_5 != 0)) && + ((bVar30 == 0 && (_Var19 = local_130, cVar8 == '\0')))) goto LAB_27; +LAB_3: + uVar20 = local_114; + uVar21 = uVar27; if (NlGlobalMemberWorkstation != 0) { if (bVar30 != 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!ExpediteToRoot"); } - if (local_124 != 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + if (local_114 != 0) { + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!CrossForestHop"); } - pppppwVar14 = (wchar_t *****)NlRefDomClientSession((longlong)param_1); - if (pppppwVar14 == (wchar_t *****)0x0) { + pppppwVar15 = (wchar_t *****)NlRefDomClientSession((longlong)param_1); + if (pppppwVar15 == (wchar_t *****)0x0) { *param_8 = 0; - _Var23.dwLowDateTime = 0; - _Var23.dwHighDateTime = 0; - uVar7 = uVar19; + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; } else { pcVar26 = (char *)(ulonglong)param_4; - pwVar20._0_4_ = 0; - pwVar20._4_4_ = 0; - pcVar27 = (char *)param_5; - p_Var15 = NlpUserValidateHigher - (pppppwVar14,'\0',param_4,(_FILETIME *)param_5,param_6,param_7, + pwVar22._0_4_ = 0; + pwVar22._4_4_ = 0; + pcVar28 = (char *)param_5; + p_Var17 = NlpUserValidateHigher + (pppppwVar15,'\0',param_4,(_FILETIME *)param_5,param_6,param_7, param_8,&local_10c); - uVar7 = (uint)p_Var15; - NlUnrefClientSession(pppppwVar14); - _Var22.dwLowDateTime = 0; - _Var22.dwHighDateTime = 0; + uVar29 = (uint)p_Var17; + NlUnrefClientSession(pppppwVar15); + _Var19.dwLowDateTime = 0; + _Var19.dwHighDateTime = 0; local_130.dwLowDateTime = 0; local_130.dwHighDateTime = 0; - _Var23.dwLowDateTime = 0; - _Var23.dwHighDateTime = 0; - if ((int)uVar7 < 0) { - if ((uVar7 == 0xc000018b) || (uVar7 == 0xc0000022)) { - uVar7 = 0xc000018d; + _Var25.dwLowDateTime = 0; + _Var25.dwHighDateTime = 0; + if ((int)uVar29 < 0) { + if ((uVar29 == 0xc000018b) || (uVar29 == 0xc0000022)) { + uVar29 = 0xc000018d; } } else { - if (uVar7 != 0) { - pcVar27 = "!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"; + if (uVar29 != 0) { + pcVar28 = "!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"; pcVar26 = ""; - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"); } if (*param_7 == 0) { - pcVar27 = "!NT_SUCCESS(Status) || *ValidationInformation != NULL"; + pcVar28 = "!NT_SUCCESS(Status) || *ValidationInformation != NULL"; pcVar26 = ""; - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || *ValidationInformation != NULL"); } } if (*param_8 == 0) { - if (uVar7 != 0xc0000064) { - _Var22 = _Var23; - uVar19 = uVar7; - } - goto LAB_28; - } - if (uVar7 == 0xc000005e) { - if ((((local_137 != '\0') && (*(short *)param_5 == 0)) && (local_110 == '\x01')) || - (!bVar3)) { -LAB_29: - uVar7 = 0xc000005e; - uVar25 = local_120; + if (uVar29 != 0xc0000064) { + _Var19 = _Var25; + uVar21 = uVar29; + } + goto LAB_27; + } + uVar21 = uVar29; + if (uVar29 == 0xc000005e) { + if ((((local_137 != '\0') && (*(short *)param_5 == 0)) && (local_118 == '\x01')) || + (!bVar4)) { +LAB_28: + uVar21 = 0xc000005e; + uVar27 = local_124; goto LAB_7; } if ((param_5 != (_FILETIME)0x0) && (*(short *)param_5 != 0)) { RtlEnterCriticalSection(&NlGlobalDomainCritSect); - pwVar12 = NlGlobalServicedDomains; + pwVar10 = NlGlobalServicedDomains; if (((wchar_t **)NlGlobalServicedDomains != &NlGlobalServicedDomains) && (NlGlobalServicedDomains != (wchar_t *)0x0)) { *(int *)(NlGlobalServicedDomains + 0x124) = *(int *)(NlGlobalServicedDomains + 0x124) + 1; RtlLeaveCriticalSection(&NlGlobalDomainCritSect); - pCVar16 = NetpAllocUtf8StrFromUnicodeString((ushort *)param_5); - if (pCVar16 != (LPSTR)0x0) { + pCVar18 = NetpAllocUtf8StrFromUnicodeString((ushort *)param_5); + if (pCVar18 != (LPSTR)0x0) { RtlEnterCriticalSection(&NlGlobalDcDiscoveryCritSect); - uVar11 = 0; + uVar13 = 0; if (NlGlobalTrustedDomainCount != 0) { do { - local_58 = 0; - uStack_50 = 0; - RtlInitUnicodeString(&local_58,NlGlobalTrustedDomainList + uVar11 * 0x28); - pwVar20 = (wchar_t *)&local_58; - cVar6 = RtlEqualDomainName(param_5); - if ((cVar6 != '\0') || - ((pwVar20 = *(wchar_t **) - (NlGlobalTrustedDomainList + 0x20 + uVar11 * 0x28), - (_FILETIME)pwVar20 != (_FILETIME)0x0 && - (iVar8 = DnsNameCompare_UTF8(pCVar16), iVar8 != 0)))) { + local_60 = 0; + uStack_58 = 0; + RtlInitUnicodeString(&local_60,NlGlobalTrustedDomainList + uVar13 * 0x28); + pwVar22 = (wchar_t *)&local_60; + cVar8 = RtlEqualDomainName(param_5); + if ((cVar8 != '\0') || + ((pwVar22 = *(wchar_t **) + (NlGlobalTrustedDomainList + 0x20 + uVar13 * 0x28), + (_FILETIME)pwVar22 != (_FILETIME)0x0 && + (iVar9 = DnsNameCompare_UTF8(pCVar18), iVar9 != 0)))) { RtlLeaveCriticalSection(&NlGlobalDcDiscoveryCritSect); bVar33 = true; - goto LAB_30; + goto LAB_29; } - uVar25 = (int)uVar11 + 1; - uVar11 = (ulonglong)uVar25; - } while (uVar25 < NlGlobalTrustedDomainCount); + uVar29 = (int)uVar13 + 1; + uVar13 = (ulonglong)uVar29; + } while (uVar29 < NlGlobalTrustedDomainCount); } RtlLeaveCriticalSection(&NlGlobalDcDiscoveryCritSect); } bVar33 = false; -LAB_30: - NlDereferenceDomain(pwVar12,pwVar20,pcVar26,(undefined8 *)pcVar27); - if (pCVar16 != (LPSTR)0x0) { - NetApiBufferFree(pCVar16); +LAB_29: + NlDereferenceDomain(pwVar10,pwVar22,pcVar26,(undefined8 *)pcVar28); + if (pCVar18 != (LPSTR)0x0) { + NetApiBufferFree(pCVar18); } if (!bVar33) { *param_8 = 0; - _Var23 = local_130; - uVar7 = uVar19; - goto LAB_27; - } - goto LAB_29; + _Var19 = local_130; + uVar21 = uVar27; + goto LAB_9; + } + goto LAB_28; } RtlLeaveCriticalSection(&NlGlobalDomainCritSect); } *param_8 = 0; - _Var23 = _Var22; - uVar7 = uVar19; - } - } - goto LAB_27; + _Var19 = _Var25; + uVar21 = uVar27; + } + } + goto LAB_9; } local_138 = 0; if (NlGlobalCDC != 0) { - local_f0[0] = 4; + local_108[1] = 4; if (param_2 == 1) { - local_f0[0] = 0xc; + local_108[1] = 0xc; } local_130 = (_FILETIME)NlRefDomClientSession((longlong)param_1); if (local_130 == (_FILETIME)0x0) { - uVar7 = 0xc00000de; - uVar25 = local_120; + uVar21 = 0xc00000de; + uVar27 = local_124; } else { - if (((((DAT_8 & 4) == 0) || (param_2 != 2)) || (local_137 == '\0')) || + if (((((DAT_10 & 4) == 0) || (param_2 != 2)) || (local_137 == '\0')) || (uVar29 != 0)) { - if ((((DAT_17 & 4) != 0) && (param_2 == 2)) && + if ((((DAT_19 & 4) != 0) && (param_2 == 2)) && ((local_137 != '\0' && (uVar29 == 0)))) { - local_e0 = 0; - _Stack_d8.dwLowDateTime = 0; - _Stack_d8.dwHighDateTime = 0; - RtlInitUnicodeString(&local_e0); - puVar21 = (ushort *)((longlong)param_5 + 0x20); - pwVar24 = (wchar_t *)0x0; - local_118 = (wchar_t *)0x0; - pwVar20 = (wchar_t *)0x0; - pwVar12 = (wchar_t *)0x0; - if ((ushort)local_e0 == 0) { + local_e8 = 0; + _Stack_e0.dwLowDateTime = 0; + _Stack_e0.dwHighDateTime = 0; + RtlInitUnicodeString(&local_e8); + puVar23 = (ushort *)((longlong)param_5 + 0x20); + pwVar11 = (wchar_t *)0x0; + local_120 = (wchar_t *)0x0; + pwVar22 = (wchar_t *)0x0; + pwVar10 = (wchar_t *)0x0; + if ((ushort)local_e8 == 0) { +LAB_30: + pwVar32 = pwVar11; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { LAB_31: - pwVar9 = pwVar24; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { -LAB_32: if ((param_5 != (_FILETIME)0x0) && (uVar1 = *(ushort *)param_5, uVar1 != 0)) { if (((ushort)(uVar1 + 2) < uVar1) || - (pwVar24 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar24 == (wchar_t *)0x0)) goto LAB_33; - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 + (pwVar11 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar11 == (wchar_t *)0x0)) goto LAB_32; + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5 ); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; } - puVar21 = (ushort *)((longlong)param_5 + 0x30); - uVar10 = NlLocalAllocWStrFromString(puVar21,&local_118); - pwVar20 = local_118; - if (((char)uVar10 != '\0') && + puVar23 = (ushort *)((longlong)param_5 + 0x30); + uVar12 = NlLocalAllocWStrFromString(puVar23,&local_120); + pwVar22 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 2) != 0)) { McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCAuditLSFA,pwVar12,pwVar9,pwVar24,local_118); + (puVar23,&NTLMDCAuditLSFA,pwVar10,pwVar32,pwVar11,local_120); } } else if ((uVar1 <= (ushort)(uVar1 + 2)) && - (pwVar9 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar9 != (wchar_t *)0x0)) { - memcpy(pwVar9,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar21); - pwVar9[*puVar21 >> 1] = L'\0'; - goto LAB_32; - } + (pwVar32 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar32 != (wchar_t *)0x0)) { + memcpy(pwVar32,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar23); + pwVar32[*puVar23 >> 1] = L'\0'; + goto LAB_31; + } +LAB_32: + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + if (pwVar32 != (wchar_t *)0x0) { + LocalFree(pwVar32); + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); + } + } + else if (((ushort)local_e8 <= (ushort)((ushort)local_e8 + 2)) && + (pwVar10 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_e8 + 2)), + pwVar10 != (wchar_t *)0x0)) { + memcpy(pwVar10,(void *)_Stack_e0,local_e8 & 0xffff); + pwVar10[local_e8 >> 1 & 0x7fff] = L'\0'; + goto LAB_30; + } + if (pwVar22 != (wchar_t *)0x0) { + LocalFree(pwVar22); + } + } + _Var19 = local_130; + pwVar22._0_4_ = 0; + pwVar22._4_4_ = 0; + p_Var17 = NlpUserValidateHigher + ((wchar_t *****)local_130,'\0',param_4,(_FILETIME *)param_5, + param_6,param_7,param_8,local_108 + 1); + uVar21 = (uint)p_Var17; + goto LAB_9; + } + local_e8 = 0; + _Stack_e0.dwLowDateTime = 0; + _Stack_e0.dwHighDateTime = 0; + RtlInitUnicodeString(&local_e8); + puVar23 = (ushort *)((longlong)param_5 + 0x20); + pwVar11 = (wchar_t *)0x0; + local_120 = (wchar_t *)0x0; + pwVar22 = (wchar_t *)0x0; + pwVar10 = (wchar_t *)0x0; + if ((ushort)local_e8 == 0) { LAB_33: - if (pwVar12 != (wchar_t *)0x0) { - LocalFree(pwVar12); - } - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); - } - } - else if (((ushort)local_e0 <= (ushort)((ushort)local_e0 + 2)) && - (pwVar12 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_e0 + 2)), - pwVar12 != (wchar_t *)0x0)) { - memcpy(pwVar12,(void *)_Stack_d8,local_e0 & 0xffff); - pwVar12[local_e0 >> 1 & 0x7fff] = L'\0'; - goto LAB_31; - } - if (pwVar20 != (wchar_t *)0x0) { - LocalFree(pwVar20); - } - } - _Var23 = local_130; - pwVar20._0_4_ = 0; - pwVar20._4_4_ = 0; - p_Var15 = NlpUserValidateHigher - ((wchar_t *****)local_130,'\0',param_4,(_FILETIME *)param_5, - param_6,param_7,param_8,local_f0); - uVar7 = (uint)p_Var15; - goto LAB_27; - } - local_e0 = 0; - _Stack_d8.dwLowDateTime = 0; - _Stack_d8.dwHighDateTime = 0; - RtlInitUnicodeString(&local_e0); - puVar21 = (ushort *)((longlong)param_5 + 0x20); - pwVar24 = (wchar_t *)0x0; - local_118 = (wchar_t *)0x0; - pwVar20 = (wchar_t *)0x0; - pwVar12 = (wchar_t *)0x0; - if ((ushort)local_e0 == 0) { + pwVar32 = pwVar11; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { LAB_34: - pwVar9 = pwVar24; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { + if ((param_5 == (_FILETIME)0x0) || (uVar1 = *(ushort *)param_5, uVar1 == 0)) { LAB_35: - if ((param_5 == (_FILETIME)0x0) || (uVar1 = *(ushort *)param_5, uVar1 == 0)) { -LAB_36: - puVar21 = (ushort *)((longlong)param_5 + 0x30); - param_11 = (_FILETIME)&local_118; - uVar10 = NlLocalAllocWStrFromString(puVar21,(undefined8 *)param_11); - pwVar20 = local_118; - if (((char)uVar10 != '\0') && + puVar23 = (ushort *)((longlong)param_5 + 0x30); + param_11 = (_FILETIME)&local_120; + uVar12 = NlLocalAllocWStrFromString(puVar23,(undefined8 *)param_11); + pwVar22 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 1) != 0)) { param_11 = (_FILETIME)&NTLMDCBlockedLSFA; McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCBlockedLSFA,pwVar12,pwVar9,pwVar24,local_118); + (puVar23,&NTLMDCBlockedLSFA,pwVar10,pwVar32,pwVar11,local_120); } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar24 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar24 != (wchar_t *)0x0) { - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - goto LAB_36; + pwVar11 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar11 != (wchar_t *)0x0) { + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + goto LAB_35; } } } else if (uVar1 <= (ushort)(uVar1 + 2)) { param_11._2_6_ = 0; param_11.dwLowDateTime._0_2_ = uVar1 + 2; - pwVar9 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar9 != (wchar_t *)0x0) { + pwVar32 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar32 != (wchar_t *)0x0) { param_11 = *(_FILETIME *)((longlong)param_5 + 0x28); - memcpy(pwVar9,(void *)param_11,(ulonglong)*puVar21); - pwVar9[*puVar21 >> 1] = L'\0'; - goto LAB_35; - } - } - if (pwVar12 != (wchar_t *)0x0) { - LocalFree(pwVar12); - } - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); - } - } - else if ((ushort)local_e0 <= (ushort)((ushort)local_e0 + 2)) { + memcpy(pwVar32,(void *)param_11,(ulonglong)*puVar23); + pwVar32[*puVar23 >> 1] = L'\0'; + goto LAB_34; + } + } + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + if (pwVar32 != (wchar_t *)0x0) { + LocalFree(pwVar32); + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); + } + } + else if ((ushort)local_e8 <= (ushort)((ushort)local_e8 + 2)) { param_11._2_6_ = 0; - param_11.dwLowDateTime._0_2_ = (ushort)local_e0 + 2; - pwVar12 = LocalAlloc(0,(SIZE_T)param_11); - if (pwVar12 != (wchar_t *)0x0) { - param_11 = _Stack_d8; - memcpy(pwVar12,(void *)_Stack_d8,local_e0 & 0xffff); - pwVar12[local_e0 >> 1 & 0x7fff] = L'\0'; - goto LAB_34; - } - } - if (pwVar20 != (wchar_t *)0x0) { - LocalFree(pwVar20); - } - uVar7 = 0xc0000418; + param_11.dwLowDateTime._0_2_ = (ushort)local_e8 + 2; + pwVar10 = LocalAlloc(0,(SIZE_T)param_11); + if (pwVar10 != (wchar_t *)0x0) { + param_11 = _Stack_e0; + memcpy(pwVar10,(void *)_Stack_e0,local_e8 & 0xffff); + pwVar10[local_e8 >> 1 & 0x7fff] = L'\0'; + goto LAB_33; + } + } + if (pwVar22 != (wchar_t *)0x0) { + LocalFree(pwVar22); + } + uVar21 = 0xc0000418; *param_8 = 1; NlUnrefClientSession((HLOCAL)local_130); - pwVar20 = (wchar_t *)param_11; - uVar25 = local_120; + pwVar22 = (wchar_t *)param_11; + uVar27 = local_124; } goto LAB_7; } if ((param_2 - 3 < 2) && (bVar31 != 0)) { - uVar7 = 0xc0000064; - uVar25 = local_120; + uVar21 = 0xc0000064; + uVar27 = local_124; goto LAB_7; } if (bVar30 == 0) { if (*(short *)param_5 != 0) { - pbVar28 = &local_138; - uVar7 = 10; - if (local_124 == 0) { - uVar7 = 2; - } - pwVar20 = (wchar_t *)param_5; + pcVar28 = (char *)&local_138; + uVar27 = 10; + if (local_114 == 0) { + uVar27 = 2; + } + pwVar22 = (wchar_t *)param_5; local_130 = (_FILETIME) - NlFindNamedClientSession((longlong)param_1,(ushort *)param_5,uVar7,pbVar28); + NlFindNamedClientSession((longlong)param_1,(ushort *)param_5,uVar27,pcVar28) + ; } } else if ((*(uint *)((longlong)param_1 + 0x250) & 0x10000) == 0) { local_130 = (_FILETIME)NlRefDomParentClientSession((longlong)param_1); if (local_130 == (_FILETIME)0x0) { - pwVar20 = (wchar_t *)param_1; + pwVar22 = (wchar_t *)param_1; NlPrintDomRoutine(4,(longlong)param_1, L"NlpUserValidate: Can\'t find parent domain in forest \'%wZ\'\n", &NlGlobalUnicodeDnsForestNameString); - uVar7 = 0xc0000064; - uVar25 = local_120; + uVar21 = 0xc0000064; + uVar27 = local_124; goto LAB_7; } local_10c = local_10c | 1; - uVar25 = local_124; - } - _Var22 = local_130; - cVar6 = local_137; + uVar20 = local_114; + } + _Var19 = local_130; + cVar8 = local_137; if ((local_137 == '\0') && (param_4 != 8)) { - if (local_130 == (_FILETIME)0x0) goto LAB_28; + if (local_130 == (_FILETIME)0x0) goto LAB_27; } else if (local_130 == (_FILETIME)0x0) { - if ((((1 < param_2 - 3) || (bVar30 != 0)) || (uVar25 != 0)) && (param_10 == '\0')) { - pwVar20 = (wchar_t *)((longlong)param_5 + 0x20); - uVar25 = NlPickDomainWithAccount - ((HLOCAL *)param_1,(ushort *)pwVar20,(ushort *)param_5,0x10,param_2, - bVar30,local_10f,(longlong *)&local_a8,&local_e8,&local_10c); - if (-1 < (int)uVar25) { + if ((((1 < param_2 - 3) || (bVar30 != 0)) || (uVar20 != 0)) && (param_10 == '\0')) { + pwVar22 = (wchar_t *)((longlong)param_5 + 0x20); + uVar27 = NlPickDomainWithAccount + ((HLOCAL *)param_1,(ushort *)pwVar22,(ushort *)param_5,0x10,param_2, + bVar30,local_110,(longlong *)&local_b0,&local_f0,&local_10c); + if (-1 < (int)uVar27) { if ((local_10c & 2) == 0) { _Dst.dwLowDateTime = 0; _Dst.dwHighDateTime = 0; - _Var17 = param_5; - if (((local_a8 != (_FILETIME)0x0) && (local_e8 != 0)) && ((local_10c & 1) == 0)) { - local_68 = 0; - uStack_60 = 0; - RtlInitUnicodeString(&local_68); - pwVar20._0_4_ = 0x80000000; - pwVar20._4_4_ = 1; + _Var24 = param_5; + if (((local_b0 != (_FILETIME)0x0) && (local_f0 != 0)) && ((local_10c & 1) == 0)) { + local_70 = 0; + uStack_68 = 0; + RtlInitUnicodeString(&local_70); + pwVar22._0_4_ = 0x80000000; + pwVar22._4_4_ = 1; switch(param_4) { case 1: case 3: case 5: case 7: uBytes.dwLowDateTime = 0x60; uBytes.dwHighDateTime = 0; - uVar25 = 0; + uVar27 = 0; break; case 2: case 6: if (*(short *)param_5 == 0) { - local_68 = *(undefined8 *)((longlong)param_5 + 0x20); - uStack_60 = *(undefined8 *)((longlong)param_5 + 0x28); + local_70 = *(undefined8 *)((longlong)param_5 + 0x20); + uStack_68 = *(undefined8 *)((longlong)param_5 + 0x28); } uBytes.dwLowDateTime = 0x68; uBytes.dwHighDateTime = 0; - uVar25 = 0x8000; + uVar27 = 0x8000; if (*(short *)param_5 != 0) { - uVar25 = 0; + uVar27 = 0; } break; default: - uVar7 = 0xc000000d; + uVar21 = 0xc000000d; *param_8 = 0; - uVar25 = local_120; + uVar27 = local_124; goto LAB_7; } - pwVar20 = (wchar_t *)uBytes; + pwVar22 = (wchar_t *)uBytes; _Dst = (_FILETIME)LocalAlloc(0,(SIZE_T)uBytes); if (_Dst == (_FILETIME)0x0) { - uVar7 = 0xc000009a; + uVar21 = 0xc000009a; *param_8 = 0; - uVar25 = local_120; + uVar27 = local_124; goto LAB_7; } memcpy((void *)_Dst,(void *)param_5,(size_t)uBytes); - RtlInitUnicodeString(_Dst,local_e8); - *(uint *)((longlong)_Dst + 0x10) = *(uint *)((longlong)_Dst + 0x10) | uVar25; - *(undefined8 *)((longlong)_Dst + 0x20) = local_68; - *(undefined8 *)((longlong)_Dst + 0x28) = uStack_60; - _Var17 = _Dst; - _Var22 = local_130; - } - pwVar20._4_4_ = 0; - pwVar20._0_4_ = param_2; - uVar7 = NlpUserValidate(param_1,param_2,param_3,param_4,_Var17,param_6,param_7, - param_8,&local_10c,'\x01',param_11,param_12,param_13, - param_14,param_15,param_16,param_17,param_18); + RtlInitUnicodeString(_Dst,local_f0); + *(uint *)((longlong)_Dst + 0x10) = *(uint *)((longlong)_Dst + 0x10) | uVar27; + *(undefined8 *)((longlong)_Dst + 0x20) = local_70; + *(undefined8 *)((longlong)_Dst + 0x28) = uStack_68; + _Var24 = _Dst; + _Var19 = local_130; + } + pwVar22._4_4_ = 0; + pwVar22._0_4_ = param_2; + uVar21 = NlpUserValidate(param_1,param_2,param_3,param_4,_Var24,param_6,param_7, + param_8,&local_10c,'\x01',param_11,param_12,param_13, + param_14,param_15,param_16,param_17,param_18); if (_Dst != (_FILETIME)0x0) { LocalFree((HLOCAL)_Dst); } - local_120 = 0; - _Var23 = _Var22; - goto LAB_27; - } - local_98[0] = 0; - local_98[1] = 0; - local_98[2] = 0; - local_98[3] = 0; - local_98[4] = 0; - local_98[5] = 0; - local_98[6] = 0; - local_98[7] = 0; - RtlInitUnicodeString(local_98,local_e8); - pbVar28 = &local_138; - _Var17 = (_FILETIME)NlFindNamedClientSession((longlong)param_1,local_98,1,pbVar28); - local_130 = _Var17; - if (_Var17 == (_FILETIME)0x0) { - pwVar20 = (wchar_t *)param_1; + local_124 = 0; + goto LAB_9; + } + local_a0[0] = 0; + local_a0[1] = 0; + local_a0[2] = 0; + local_a0[3] = 0; + local_a0[4] = 0; + local_a0[5] = 0; + local_a0[6] = 0; + local_a0[7] = 0; + RtlInitUnicodeString(local_a0,local_f0); + pcVar28 = (char *)&local_138; + _Var19 = (_FILETIME)NlFindNamedClientSession((longlong)param_1,local_a0,1,pcVar28); + local_130 = _Var19; + if (_Var19 == (_FILETIME)0x0) { + pwVar22 = (wchar_t *)param_1; NlPrintDomRoutine(0x100,(longlong)param_1, L"NlpUserValidate: %wZ\\%wZ: Can\'t find trusted forest \'%wZ\'\n" ,param_5); - uVar7 = 0xc0000064; - uVar25 = local_120; + uVar21 = 0xc0000064; + uVar27 = local_124; } else { - if ((*(byte *)((longlong)_Var17 + 0x128) & 8) == 0) { - pwVar12 = + if ((*(byte *)((longlong)_Var19 + 0x128) & 8) == 0) { + pwVar10 = L"NlpUserValidate: %wZ\\%wZ: trusted forest \'%wZ\' doesn\'t have F bit set.\n"; } else { - if ((*(uint *)((longlong)_Var17 + 0x124) & 0x4000) == 0) goto LAB_37; - pwVar12 = L"NlpUserValidate: %wZ\\%wZ: trusted forest \'%wZ\' is in my forest\n"; - } - pwVar20 = (wchar_t *)_Var17; - NlPrintCsRoutine(0x100,(longlong)_Var17,pwVar12,param_5); - uVar7 = 0xc0000064; - NlUnrefClientSession((HLOCAL)_Var17); - uVar25 = local_120; + if ((*(uint *)((longlong)_Var19 + 0x124) & 0x4000) == 0) goto LAB_36; + pwVar10 = L"NlpUserValidate: %wZ\\%wZ: trusted forest \'%wZ\' is in my forest\n"; + } + pwVar22 = (wchar_t *)_Var19; + NlPrintCsRoutine(0x100,(longlong)_Var19,pwVar10,param_5); + uVar21 = 0xc0000064; + NlUnrefClientSession((HLOCAL)_Var19); + uVar27 = local_124; } goto LAB_7; } } -LAB_28: - _Var23 = _Var22; - uVar7 = uVar19; +LAB_27: if (*param_8 != 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "! *Authoritative"); } - goto LAB_27; - } -LAB_37: - _Var23 = local_130; + goto LAB_9; + } +LAB_36: + _Var19 = local_130; local_100 = 0; _Stack_f8.dwLowDateTime = 0; _Stack_f8.dwHighDateTime = 0; RtlInitUnicodeString(&local_100); - pwVar20 = (wchar_t *)param_11; + pwVar22 = (wchar_t *)param_11; if (param_2 - 3 < 2) { RtlEnterCriticalSection((longlong)param_1 + 400); - if ((*(byte *)((longlong)_Var23 + 0x124) & 4) != 0) { + if ((*(byte *)((longlong)_Var19 + 0x124) & 4) != 0) { RtlLeaveCriticalSection((longlong)param_1 + 400); - pwVar20 = (wchar_t *)param_11; - goto LAB_38; + pwVar22 = (wchar_t *)param_11; + goto LAB_37; } RtlLeaveCriticalSection(); - pwVar20 = (wchar_t *)_Var23; - NlPrintCsRoutine(4,(longlong)_Var23,L"SamLogon: Avoid transitive trust on NT 4 trust.", - pbVar28); - uVar7 = 0xc0000064; + pwVar22 = (wchar_t *)_Var19; + NlPrintCsRoutine(4,(longlong)_Var19,L"SamLogon: Avoid transitive trust on NT 4 trust.", + pcVar28); + uVar21 = 0xc0000064; } else { +LAB_37: + if ((((DAT_10 & 4) == 0) || (param_2 != 2)) || ((cVar8 == '\0' || (uVar29 != 0)))) + { + if (((((DAT_19 & 4) != 0) && (param_2 == 2)) && (cVar8 != '\0')) && (uVar29 == 0) + ) { + puVar23 = (ushort *)((longlong)param_5 + 0x20); + pwVar11 = (wchar_t *)0x0; + local_120 = (wchar_t *)0x0; + pwVar22 = (wchar_t *)0x0; + pwVar10 = (wchar_t *)0x0; + if ((ushort)local_100 == 0) { LAB_38: - if ((((DAT_8 & 4) == 0) || (param_2 != 2)) || ((cVar6 == '\0' || (uVar29 != 0)))) - { - if (((((DAT_17 & 4) != 0) && (param_2 == 2)) && (cVar6 != '\0')) && (uVar29 == 0) - ) { - puVar21 = (ushort *)((longlong)param_5 + 0x20); - pwVar24 = (wchar_t *)0x0; - local_118 = (wchar_t *)0x0; - pwVar20 = (wchar_t *)0x0; - pwVar12 = (wchar_t *)0x0; - if ((ushort)local_100 == 0) { + pwVar32 = pwVar11; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { LAB_39: - pwVar9 = pwVar24; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { -LAB_40: if ((param_5 != (_FILETIME)0x0) && (uVar1 = *(ushort *)param_5, uVar1 != 0)) { if (((ushort)(uVar1 + 2) < uVar1) || - (pwVar24 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar24 == (wchar_t *)0x0)) goto LAB_41; - memcpy(pwVar24,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); - pwVar24[*(ushort *)param_5 >> 1] = L'\0'; - } - puVar21 = (ushort *)((longlong)param_5 + 0x30); - uVar10 = NlLocalAllocWStrFromString(puVar21,&local_118); - pwVar20 = local_118; - if (((char)uVar10 != '\0') && + (pwVar11 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar11 == (wchar_t *)0x0)) goto LAB_40; + memcpy(pwVar11,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); + pwVar11[*(ushort *)param_5 >> 1] = L'\0'; + } + puVar23 = (ushort *)((longlong)param_5 + 0x30); + uVar12 = NlLocalAllocWStrFromString(puVar23,&local_120); + pwVar22 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 2) != 0)) { McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCAuditLSFA,pwVar12,pwVar9,pwVar24,local_118); + (puVar23,&NTLMDCAuditLSFA,pwVar10,pwVar32,pwVar11,local_120); } } else if ((uVar1 <= (ushort)(uVar1 + 2)) && - (pwVar9 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), - pwVar9 != (wchar_t *)0x0)) { - memcpy(pwVar9,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar21); - pwVar9[*puVar21 >> 1] = L'\0'; - goto LAB_40; - } -LAB_41: - if (pwVar12 != (wchar_t *)0x0) { - LocalFree(pwVar12); - } - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); + (pwVar32 = LocalAlloc(0,(ulonglong)(ushort)(uVar1 + 2)), + pwVar32 != (wchar_t *)0x0)) { + memcpy(pwVar32,*(void **)((longlong)param_5 + 0x28),(ulonglong)*puVar23); + pwVar32[*puVar23 >> 1] = L'\0'; + goto LAB_39; + } +LAB_40: + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + if (pwVar32 != (wchar_t *)0x0) { + LocalFree(pwVar32); + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); } } else if (((ushort)local_100 <= (ushort)((ushort)local_100 + 2)) && - (pwVar12 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), - pwVar12 != (wchar_t *)0x0)) { - memcpy(pwVar12,(void *)_Stack_f8,local_100 & 0xffff); - pwVar12[local_100 >> 1 & 0x7fff] = L'\0'; - goto LAB_39; - } - _Var23 = local_130; - if (pwVar20 != (wchar_t *)0x0) { - LocalFree(pwVar20); - _Var23 = local_130; - } - } - pwVar20._1_7_ = 0; - pwVar20._0_1_ = local_138; - p_Var15 = NlpUserValidateHigher - ((wchar_t *****)_Var23,local_138,param_4,(_FILETIME *)param_5, + (pwVar10 = LocalAlloc(0,(ulonglong)(ushort)((ushort)local_100 + 2)), + pwVar10 != (wchar_t *)0x0)) { + memcpy(pwVar10,(void *)_Stack_f8,local_100 & 0xffff); + pwVar10[local_100 >> 1 & 0x7fff] = L'\0'; + goto LAB_38; + } + _Var19 = local_130; + if (pwVar22 != (wchar_t *)0x0) { + LocalFree(pwVar22); + _Var19 = local_130; + } + } + pwVar22._1_7_ = 0; + pwVar22._0_1_ = local_138; + p_Var17 = NlpUserValidateHigher + ((wchar_t *****)_Var19,local_138,param_4,(_FILETIME *)param_5, param_6,param_7,param_8,&local_10c); - uVar7 = (uint)p_Var15; - if ((int)uVar7 < 0) { - if ((uVar7 + 0x3ffffe76 < 2) || (uVar7 == 0xc0000022)) { - uVar7 = 0xc000018c; - } - else if (uVar7 == 0xc0000064) { + uVar21 = (uint)p_Var17; + if ((int)uVar21 < 0) { + if ((uVar21 + 0x3ffffe76 < 2) || (uVar21 == 0xc0000022)) { + uVar21 = 0xc000018c; + } + else if (uVar21 == 0xc0000064) { *param_8 = 1; } } else { - if (uVar7 != 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + if (uVar21 != 0) { + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"); } if (*param_7 == 0) { - pwVar20 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; + pwVar22 = L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n"; NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || *ValidationInformation != NULL"); } } - goto LAB_27; - } - puVar21 = (ushort *)((longlong)param_5 + 0x20); - pwVar9 = (wchar_t *)0x0; - local_118 = (wchar_t *)0x0; - pwVar12 = (wchar_t *)0x0; - pwVar24 = (wchar_t *)0x0; + goto LAB_9; + } + puVar23 = (ushort *)((longlong)param_5 + 0x20); + pwVar32 = (wchar_t *)0x0; + local_120 = (wchar_t *)0x0; + pwVar10 = (wchar_t *)0x0; + pwVar11 = (wchar_t *)0x0; if ((ushort)local_100 == 0) { +LAB_41: + pwVar14 = pwVar32; + if ((puVar23 == (ushort *)0x0) || (uVar1 = *puVar23, uVar1 == 0)) { LAB_42: - pwVar32 = pwVar9; - if ((puVar21 == (ushort *)0x0) || (uVar1 = *puVar21, uVar1 == 0)) { + if ((param_5 == (_FILETIME)0x0) || (uVar1 = *(ushort *)param_5, uVar1 == 0)) { LAB_43: - if ((param_5 == (_FILETIME)0x0) || (uVar1 = *(ushort *)param_5, uVar1 == 0)) { -LAB_44: - puVar21 = (ushort *)((longlong)param_5 + 0x30); - pwVar20 = (wchar_t *)&local_118; - uVar10 = NlLocalAllocWStrFromString(puVar21,(undefined8 *)pwVar20); - pwVar12 = local_118; - if (((char)uVar10 != '\0') && + puVar23 = (ushort *)((longlong)param_5 + 0x30); + pwVar22 = (wchar_t *)&local_120; + uVar12 = NlLocalAllocWStrFromString(puVar23,(undefined8 *)pwVar22); + pwVar10 = local_120; + if (((char)uVar12 != '\0') && ((Microsoft_Windows_Security_NetlogonEnableBits & 1) != 0)) { - pwVar20 = (wchar_t *)&NTLMDCBlockedLSFA; + pwVar22 = (wchar_t *)&NTLMDCBlockedLSFA; McTemplateU0zzzzq_EtwEventWriteTransfer - (puVar21,&NTLMDCBlockedLSFA,pwVar24,pwVar32,pwVar9,local_118); + (puVar23,&NTLMDCBlockedLSFA,pwVar11,pwVar14,pwVar32,local_120); } } else if (uVar1 <= (ushort)(uVar1 + 2)) { - pwVar20._2_6_ = 0; - pwVar20._0_2_ = uVar1 + 2; - pwVar9 = LocalAlloc(0,(SIZE_T)pwVar20); - if (pwVar9 != (wchar_t *)0x0) { - memcpy(pwVar9,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); - pwVar9[*(ushort *)param_5 >> 1] = L'\0'; - goto LAB_44; + pwVar22._2_6_ = 0; + pwVar22._0_2_ = uVar1 + 2; + pwVar32 = LocalAlloc(0,(SIZE_T)pwVar22); + if (pwVar32 != (wchar_t *)0x0) { + memcpy(pwVar32,*(void **)((longlong)param_5 + 8),(ulonglong)*(ushort *)param_5); + pwVar32[*(ushort *)param_5 >> 1] = L'\0'; + goto LAB_43; } } } else if (uVar1 <= (ushort)(uVar1 + 2)) { - pwVar20._2_6_ = 0; - pwVar20._0_2_ = uVar1 + 2; - pwVar32 = LocalAlloc(0,(SIZE_T)pwVar20); - if (pwVar32 != (wchar_t *)0x0) { - pwVar20 = *(wchar_t **)((longlong)param_5 + 0x28); - memcpy(pwVar32,pwVar20,(ulonglong)*puVar21); - pwVar32[*puVar21 >> 1] = L'\0'; - goto LAB_43; - } - } - if (pwVar24 != (wchar_t *)0x0) { - LocalFree(pwVar24); + pwVar22._2_6_ = 0; + pwVar22._0_2_ = uVar1 + 2; + pwVar14 = LocalAlloc(0,(SIZE_T)pwVar22); + if (pwVar14 != (wchar_t *)0x0) { + pwVar22 = *(wchar_t **)((longlong)param_5 + 0x28); + memcpy(pwVar14,pwVar22,(ulonglong)*puVar23); + pwVar14[*puVar23 >> 1] = L'\0'; + goto LAB_42; + } + } + if (pwVar11 != (wchar_t *)0x0) { + LocalFree(pwVar11); + } + if (pwVar14 != (wchar_t *)0x0) { + LocalFree(pwVar14); } if (pwVar32 != (wchar_t *)0x0) { LocalFree(pwVar32); } - if (pwVar9 != (wchar_t *)0x0) { - LocalFree(pwVar9); - } } else if ((ushort)local_100 <= (ushort)((ushort)local_100 + 2)) { - pwVar20._2_6_ = 0; - pwVar20._0_2_ = (ushort)local_100 + 2; - pwVar24 = LocalAlloc(0,(SIZE_T)pwVar20); - if (pwVar24 != (wchar_t *)0x0) { - pwVar20 = (wchar_t *)_Stack_f8; - memcpy(pwVar24,(void *)_Stack_f8,local_100 & 0xffff); - pwVar24[local_100 >> 1 & 0x7fff] = L'\0'; - goto LAB_42; - } - } - if (pwVar12 != (wchar_t *)0x0) { - LocalFree(pwVar12); - } - uVar7 = 0xc0000418; + pwVar22._2_6_ = 0; + pwVar22._0_2_ = (ushort)local_100 + 2; + pwVar11 = LocalAlloc(0,(SIZE_T)pwVar22); + if (pwVar11 != (wchar_t *)0x0) { + pwVar22 = (wchar_t *)_Stack_f8; + memcpy(pwVar11,(void *)_Stack_f8,local_100 & 0xffff); + pwVar11[local_100 >> 1 & 0x7fff] = L'\0'; + goto LAB_41; + } + } + if (pwVar10 != (wchar_t *)0x0) { + LocalFree(pwVar10); + } + uVar21 = 0xc0000418; *param_8 = 1; - _Var23 = local_130; + _Var19 = local_130; } } - uVar25 = local_120; - if (_Var23 != (_FILETIME)0x0) { - NlUnrefClientSession((HLOCAL)_Var23); - uVar25 = local_120; + uVar27 = local_124; + if (_Var19 != (_FILETIME)0x0) { + NlUnrefClientSession((HLOCAL)_Var19); + uVar27 = local_124; } } } LAB_7: - if ((bVar3) && ((param_2 == 1 || (local_128 != '\0')))) { - if ((uVar7 != 0xc0000064) && (uVar7 != 0xc0000072)) { - uVar25 = uVar25 & 0xfffffffd; + if ((bVar4) && ((param_2 == 1 || (local_128 != '\0')))) { + if ((uVar21 != 0xc0000064) && (uVar21 != 0xc0000072)) { + uVar27 = uVar27 & 0xfffffffd; } - uVar29 = uVar25 & 0xfffffffe; + uVar29 = uVar27 & 0xfffffffe; if (*param_8 == 0) { - uVar29 = uVar25; + uVar29 = uVar27; } if (uVar29 != 0) { local_138 = 0; - uVar25 = NlpSamValidate(*(undefined8 *)((longlong)param_1 + 0x178),pwVar20,param_2, + uVar27 = NlpSamValidate(*(undefined8 *)((longlong)param_1 + 0x178),pwVar22,param_2, (longlong)param_1 + 0x100,(longlong)param_1 + 0xa8, *(undefined8 *)((longlong)param_1 + 0xb8),param_4, - (undefined8 *)param_5,param_6,param_7,(char *)&local_138,local_132, + (undefined8 *)param_5,param_6,param_7,(char *)&local_138,local_133, uVar29); - if (-1 < (int)uVar25) { - if (uVar25 != 0) { + if (-1 < (int)uVar27) { + if (uVar27 != 0) { NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || Status == STATUS_SUCCESS"); } if (*param_7 == 0) { NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "!NT_SUCCESS(Status) || *ValidationInformation != NULL"); } } - if (local_132[0] != '\0') { + if (local_133[0] != '\0') { NlpZeroBadPasswordCountOnPdc((longlong *)param_1,param_4,(_FILETIME *)param_5); } if (local_138 == 0) { - if (uVar7 == 0xc0000064) { - uVar7 = uVar25; + if (uVar21 == 0xc0000064) { + uVar21 = uVar27; } } else { *param_8 = 1; - if ((((uVar25 == 0xc000006a) || (uVar25 == 0xc0000071)) || (uVar25 == 0xc0000224)) || - ((uVar25 == 0xc0000234 || (uVar25 == 0xc0000371)))) { - bVar33 = uVar25 == 0xc0000371; - uVar11 = NlpUserValidateOnDc((longlong *)param_1,param_4,(_FILETIME *)param_5, + if ((((uVar27 == 0xc000006a) || (uVar27 == 0xc0000071)) || (uVar27 == 0xc0000224)) || + ((uVar27 == 0xc0000234 || (uVar27 == 0xc0000371)))) { + bVar33 = uVar27 == 0xc0000371; + uVar13 = NlpUserValidateOnDc((longlong *)param_1,param_4,(_FILETIME *)param_5, (ulonglong)param_6,1,(uint)bVar33,param_7,&local_138); - uVar7 = (uint)uVar11; - if ((((uVar25 == 0xc0000371) || ((-1 < (int)uVar7 || (uVar7 == 0xc000006a)))) || - ((uVar7 == 0xc0000071 || ((uVar7 == 0xc0000224 || (uVar7 == 0xc0000234)))))) && - (((*param_8 = local_138, uVar25 = uVar7, -1 < (int)uVar7 || - ((uVar7 == 0xc0000071 || (uVar7 == 0xc0000224)))) && (NlGlobalMemberWorkstation == 0) - ))) { - uVar25 = NlpZeroBadPasswordCountLocally - ((longlong)param_1,(longlong)local_a0 + 0x20,bVar33); - } - uVar7 = uVar25; - if ((((uVar25 == 0xc000006a) || (uVar25 == 0xc0000071)) || (uVar25 == 0xc0000224)) || - (uVar25 == 0xc0000234)) goto LAB_45; + uVar29 = (uint)uVar13; + if (((((uVar27 == 0xc0000371) || ((-1 < (int)uVar29 || (uVar29 == 0xc000006a)))) || + (uVar29 == 0xc0000071)) || ((uVar29 == 0xc0000224 || (uVar29 == 0xc0000234)))) && + (((*param_8 = local_138, uVar27 = uVar29, -1 < (int)uVar29 || + ((uVar29 == 0xc0000071 || (uVar29 == 0xc0000224)))) && + (NlGlobalMemberWorkstation == 0)))) { + uVar27 = NlpZeroBadPasswordCountLocally + ((longlong)param_1,(longlong)local_a8 + 0x20,bVar33); + } + uVar21 = uVar27; + if ((((uVar27 == 0xc000006a) || (uVar27 == 0xc0000071)) || (uVar27 == 0xc0000224)) || + (uVar27 == 0xc0000234)) goto LAB_44; } NlpRemoveBadPasswordCacheEntry((longlong)param_1,(longlong)param_5); - uVar7 = uVar25; + uVar21 = uVar27; } } } else if ((param_4 == 8) && - (((int)uVar7 < 0 && (pbVar28 = (byte *)*param_7, pbVar28 != (byte *)0x0)))) { - if ((*pbVar28 & 1) == 0) { + (((int)uVar21 < 0 && (pbVar3 = (byte *)*param_7, pbVar3 != (byte *)0x0)))) { + if ((*pbVar3 & 1) == 0) { NlPrintRoutine(0x100,L"Assertion failed: %hs%hs (Source File: %hs, line %ld)\n","", "TicketValidationInfo->LogonFailed == TRUE"); } - lVar4 = NlGlobalDomainInfo; - *pbVar28 = *pbVar28 | 1; - *(uint *)(pbVar28 + 0xc) = uVar7; - NlpCopyUnicodeString((ushort *)(lVar4 + 0x110),(undefined4 *)(pbVar28 + 0x10)); - uVar7 = 0; + lVar6 = NlGlobalDomainInfo; + *pbVar3 = *pbVar3 | 1; + *(uint *)(pbVar3 + 0xc) = uVar21; + NlpCopyUnicodeString((ushort *)(lVar6 + 0x110),(undefined4 *)(pbVar3 + 0x10)); + uVar21 = 0; } -LAB_45: - if (local_a8 != (_FILETIME)0x0) { +LAB_44: + if (local_b0 != (_FILETIME)0x0) { NetApiBufferFree(); } - if (local_e8 != 0) { + if (local_f0 != 0) { NetApiBufferFree(); } - if ((param_10 == '\0') && (-1 < (int)uVar7)) { - bVar33 = param_2 - 1 < 2; - if ((param_6 == 3) || (bVar30 = 0, param_6 == 6)) { - bVar30 = 1; - } - if (param_4 == 8) { - pbVar28 = (byte *)*param_7; - uVar11 = TransformKerberosTicketLogonOutbound - ((longlong)param_5,pbVar28,(longlong)param_1,param_8,bVar33,local_134, - param_3,param_12,param_13,param_14,param_15); - if ((int)(uint)uVar11 < 0) { - FreeTicketValidationInformation(pbVar28); - *param_7 = 0; - uVar7 = (uint)uVar11; + if (param_10 == '\0') { + if (-1 < (int)uVar21) { + bVar33 = param_2 - 1 < 2; + if ((param_6 == 3) || (param_6 == 6)) { + bVar5 = true; + } + else { + bVar5 = false; + } + if (param_4 == 8) { + pbVar3 = (byte *)*param_7; + uVar13 = TransformKerberosTicketLogonOutbound + ((longlong)param_5,pbVar3,(longlong)param_1,param_8,bVar33,local_135, + param_3,param_12,param_13,param_14,param_15); + if ((int)(uint)uVar13 < 0) { + FreeTicketValidationInformation(pbVar3); + *param_7 = 0; + uVar21 = (uint)uVar13; + } + } + else if (((bVar33) && (local_137 != '\0')) && (NlGlobalMemberWorkstation == 0)) { + if (bVar5) { + uVar13 = NlpExpandResourceGroupMembership(param_6,param_7,(longlong)param_1); + if ((int)(uint)uVar13 < 0) { + uVar21 = (uint)uVar13; + } + } + if ((param_3 != 0) && (cVar8 = LsaINoMoreWin2KDomain(), cVar8 != '\0')) { + uVar13 = NlpVerifyAllowedToAuthenticate + ((longlong)param_1,param_3,*param_7,(int *)0x0,0,(int *)0x0,bVar5 ^ 1); + if ((int)(uint)uVar13 < 0) { + uVar21 = (uint)uVar13; + } + } } } - else if (((bVar33) && (local_137 != '\0')) && (NlGlobalMemberWorkstation == 0)) { - if (bVar30 != 0) { - uVar11 = NlpExpandResourceGroupMembership(param_6,param_7,(longlong)param_1); - if ((int)(uint)uVar11 < 0) { - uVar7 = (uint)uVar11; - } - } - if ((param_3 != 0) && (cVar6 = LsaINoMoreWin2KDomain(), cVar6 != '\0')) { - uVar11 = NlpVerifyAllowedToAuthenticate - ((longlong)param_1,param_3,*param_7,(int *)0x0,0,(int *)0x0,bVar30 ^ 1); - if ((int)(uint)uVar11 < 0) { - uVar7 = (uint)uVar11; - } - } + if ((((bVar4) && (local_117 != '\0')) && (param_16 != 0)) && (*(int *)(param_16 + 0x20) != 2)) { + NlpNtlmlessLogAccountDomain((ushort *)local_a8,param_16,param_17,param_18); } } - uVar25 = Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline(); - if ((((uVar25 != 0) && (param_10 == '\0')) && (bVar3)) && - (((local_133 != '\0' && (param_16 != 0)) && (*(int *)(param_16 + 0x20) != 2)))) { - NlpNtlmlessLogAccountDomain((ushort *)local_a0,param_16,param_17,param_18); - } - return uVar7; + return uVar21; } ``` ## wil::details::EnabledStateManager::OnStateChange ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.87| |i_ratio|0.73| |m_ratio|0.99| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|OnStateChange|OnStateChange| |fullname|wil::details::EnabledStateManager::OnStateChange|wil::details::EnabledStateManager::OnStateChange| |refcount|2|2| |`length`|132|133| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling||| |paramcount|1|1| |`address`|1800744fc|18007438c| |sig|void __thiscall OnStateChange(EnabledStateManager * this)|void __thiscall OnStateChange(EnabledStateManager * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::EnabledStateManager::OnStateChange Diff ```diff --- wil::details::EnabledStateManager::OnStateChange +++ wil::details::EnabledStateManager::OnStateChange @@ -1,35 +1,35 @@ /* public: void __cdecl wil::details::EnabledStateManager::OnStateChange(void) __ptr64 */ void __thiscall wil::details::EnabledStateManager::OnStateChange(EnabledStateManager *this) { int *piVar1; int iVar2; int *piVar3; EnabledStateManager *local_res8; - if (*this != (EnabledStateManager)0x0) { + if (*(int *)this != 0) { AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); - piVar1 = *(int **)(this + 0x58); - for (piVar3 = *(int **)(this + 0x50); piVar3 != piVar1; piVar3 = piVar3 + 4) { + piVar1 = *(int **)(this + 0x48); + for (piVar3 = *(int **)(this + 0x40); piVar3 != piVar1; piVar3 = piVar3 + 4) { LOCK(); **(uint **)(piVar3 + 2) = **(uint **)(piVar3 + 2) & (-(uint)(*piVar3 != 0) & 0x83a) - 0x83f; UNLOCK(); } - *(undefined8 *)(this + 0x58) = *(undefined8 *)(this + 0x50); + *(undefined8 *)(this + 0x48) = *(undefined8 *)(this + 0x40); iVar2 = 1; if (*(int *)(this + 0x1c) + 1 != 0) { iVar2 = *(int *)(this + 0x1c) + 1; } *(int *)(this + 0x1c) = iVar2; local_res8 = this + 8; unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> *)&local_res8); } return; } ``` ## wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.32| |i_ratio|0.05| |m_ratio|0.43| |b_ratio|0.33| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|`dynamic_atexit_destructor_for_'g_enabledStateManager''|`dynamic_atexit_destructor_for_'g_enabledStateManager''| |fullname|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |refcount|3|3| |`length`|128|38| |`called`|wil::ProcessShutdownInProgress
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::WilApi_RecordFeatureUsage
wil_details_RecordCachedUsage|wil::ProcessShutdownInProgress
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::~EnabledStateManager| |calling||| |paramcount|0|0| |`address`|18008a910|18008aa90| |sig|undefined __fastcall `dynamic_atexit_destructor_for_'g_enabledStateManager''(void)|undefined __fastcall `dynamic_atexit_destructor_for_'g_enabledStateManager''(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' Called Diff ```diff --- wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' called +++ wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' called @@ -1,0 +2 @@ +wil::details::EnabledStateManager::ProcessShutdown @@ -3,2 +3,0 @@ -wil::details::WilApi_RecordFeatureUsage -wil_details_RecordCachedUsage ``` ### wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' Diff ```diff --- wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' +++ wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' @@ -1,28 +1,15 @@ void wil::details::_dynamic_atexit_destructor_for__g_enabledStateManager__(void) { - undefined4 *puVar1; - bool bVar2; - undefined4 *puVar3; - char *in_R9; + bool bVar1; - bVar2 = ProcessShutdownInProgress(); - puVar1 = DAT_0; - if (bVar2) { - g_enabledStateManager = (shutdown_aware_object)0x0; - puVar3 = DAT_1; - if (0xf < (ulonglong)((longlong)DAT_0 - (longlong)DAT_1800f35f8)) { - for (; puVar3 != puVar1; puVar3 = puVar3 + 4) { - wil_details_RecordCachedUsage(*puVar3,*(uint **)(puVar3 + 2)); - } - DAT_0 = DAT_1800f35f8; - WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); - } + bVar1 = ProcessShutdownInProgress(); + if (bVar1) { + EnabledStateManager::ProcessShutdown((EnabledStateManager *)&g_enabledStateManager); + return; } - else { - EnabledStateManager::~EnabledStateManager((EnabledStateManager *)&g_enabledStateManager); - } + EnabledStateManager::~EnabledStateManager((EnabledStateManager *)&g_enabledStateManager); return; } ``` ## BuildSamLogonResponse ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,length,sig,address,called| |ratio|0.59| |i_ratio|0.57| |m_ratio|0.96| |b_ratio|0.15| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|BuildSamLogonResponse|BuildSamLogonResponse| |fullname|BuildSamLogonResponse|BuildSamLogonResponse| |refcount|3|3| |`length`|832|918| |`called`|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpLogonPutBytes
NetpLogonPutUnicodeString
NlGetDomainFlags
NlMailslotOpcode
NlPrintDomRoutine
NlpUtf8ToCutf8
WS2_32.DLL::Ordinal_14
__security_check_cookie|
Expand for full list:
Feature_740537659__private_IsEnabledDeviceUsageNoInline
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NetpLogonPutBytes
NetpLogonPutUnicodeString
NetpLogonPutUnicodeStringOld
NlGetDomainFlags
NlMailslotOpcode
NlPrintDomRoutine
NlpUtf8ToCutf8
WS2_32.DLL::Ordinal_14__security_check_cookie
| |calling|LogonRequestHandler
PrimaryQueryHandler|LogonRequestHandler
PrimaryQueryHandler| |paramcount|10|10| |`address`|18006aecc|18006ac6c| |`sig`|uint __fastcall BuildSamLogonResponse(longlong param_1, char param_2, short param_3, wchar_t * param_4, undefined8 param_5, undefined8 param_6, int param_7, int param_8, short * param_9, int * param_10)|ulonglong __fastcall BuildSamLogonResponse(longlong param_1, char param_2, short param_3, wchar_t * param_4, undefined8 param_5, undefined8 param_6, int param_7, int param_8, short * param_9, int * param_10)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### BuildSamLogonResponse Called Diff ```diff --- BuildSamLogonResponse called +++ BuildSamLogonResponse called @@ -0,0 +1 @@ +Feature_740537659__private_IsEnabledDeviceUsageNoInline @@ -4,0 +6 @@ +NetpLogonPutUnicodeStringOld ``` ### BuildSamLogonResponse Diff ```diff --- BuildSamLogonResponse +++ BuildSamLogonResponse @@ -1,107 +1,126 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -uint BuildSamLogonResponse - (longlong param_1,char param_2,short param_3,wchar_t *param_4,undefined8 param_5, - undefined8 param_6,int param_7,int param_8,short *param_9,int *param_10) +ulonglong BuildSamLogonResponse + (longlong param_1,char param_2,short param_3,wchar_t *param_4,undefined8 param_5 + ,undefined8 param_6,int param_7,int param_8,short *param_9,int *param_10) { uint uVar1; - uint *puVar2; - char *pcVar3; - short sVar4; - wchar_t *pwVar5; + ulonglong uVar2; + uint *puVar3; + char *pcVar4; + short sVar5; + uint uVar6; + wchar_t *pwVar7; undefined1 auStackY_d8 [32]; undefined1 local_98 [8]; uint *local_90; uint local_88 [2]; - undefined8 local_80; - int *local_78; + int *local_80; + undefined8 local_78; undefined8 local_70; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined1 local_50 [8]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStackY_d8; + local_78 = param_5; local_70 = param_6; - uVar1 = 0; - local_78 = param_10; + uVar6 = 0; + local_80 = param_10; local_90 = (uint *)(param_9 + 1); *param_9 = param_3; - local_80 = param_5; - NetpLogonPutUnicodeString((wchar_t *)(param_1 + 0xd8),0x24,(ulonglong *)&local_90); - NetpLogonPutUnicodeString(param_4,0x82,(ulonglong *)&local_90); - NetpLogonPutUnicodeString((wchar_t *)(param_1 + 0x48),0x20,(ulonglong *)&local_90); - puVar2 = local_90; + uVar1 = Feature_740537659__private_IsEnabledDeviceUsageNoInline(); + if (uVar1 == 0) { + NetpLogonPutUnicodeStringOld((wchar_t *)(param_1 + 0xd8),0x24,(ulonglong *)&local_90); + NetpLogonPutUnicodeStringOld(param_4,0x82,(ulonglong *)&local_90); + NetpLogonPutUnicodeStringOld((wchar_t *)(param_1 + 0x48),0x20,(ulonglong *)&local_90); + } + else { + uVar2 = NetpLogonPutUnicodeString((wchar_t *)(param_1 + 0xd8),0x24,(ulonglong *)&local_90); + if ((int)uVar2 != 0) { + return uVar2; + } + uVar2 = NetpLogonPutUnicodeString(param_4,0x82,(ulonglong *)&local_90); + if ((int)uVar2 != 0) { + return uVar2; + } + uVar2 = NetpLogonPutUnicodeString((wchar_t *)(param_1 + 0x48),0x20,(ulonglong *)&local_90); + if ((int)uVar2 != 0) { + return uVar2; + } + } + puVar3 = local_90; if (param_7 == 0) goto LAB_0; local_98[0] = 0; local_58 = 0; local_68 = 0; uStack_60 = 0; NetpLogonPutBytes((undefined1 *)(param_1 + 0xc0),0x10,(longlong *)&local_90); NetpLogonPutBytes(&NlGlobalZeroGuid,0x10,(longlong *)&local_90); if (param_8 == 0) { NetpLogonPutBytes(local_98,1,(longlong *)&local_90); NetpLogonPutBytes(local_98,1,(longlong *)&local_90); NetpLogonPutBytes(local_98,1,(longlong *)&local_90); LAB_1: uVar1 = Ordinal_14(param_8); - puVar2 = local_90; + puVar3 = local_90; *local_90 = uVar1; uVar1 = NlGetDomainFlags(param_1); - puVar2[1] = uVar1; - uVar1 = 2; - puVar2 = puVar2 + 2; + puVar3[1] = uVar1; + uVar6 = 2; + puVar3 = puVar3 + 2; LAB_0: - *puVar2 = uVar1 | 1; - puVar2[1] = 0xffffffff; - *local_78 = ((int)puVar2 + 8) - (int)param_9; - pcVar3 = NlMailslotOpcode(param_3); - NlPrintDomRoutine(0x10,param_1,L"Ping response \'%hs\' %ws to \\\\%ws on %ws\n",pcVar3); + *puVar3 = uVar6 | 1; + puVar3[1] = 0xffffffff; + *local_80 = ((int)puVar3 + 8) - (int)param_9; + pcVar4 = NlMailslotOpcode(param_3); + NlPrintDomRoutine(0x10,param_1,L"Ping response \'%hs\' %ws to \\\\%ws on %ws\n",pcVar4); return 0; } local_88[1] = 0x104; local_88[0] = 0; RtlEnterCriticalSection(&NlGlobalDnsForestNameCritSect); if ((param_2 == '\0') || - (pcVar3 = NlGlobalUtf8DnsForestNameAlias, NlGlobalUtf8DnsForestNameAlias == (char *)0x0)) { - pcVar3 = NlGlobalUtf8DnsForestName; + (pcVar4 = NlGlobalUtf8DnsForestNameAlias, NlGlobalUtf8DnsForestNameAlias == (char *)0x0)) { + pcVar4 = NlGlobalUtf8DnsForestName; } - sVar4 = (short)param_9; - uVar1 = NlpUtf8ToCutf8(sVar4,pcVar3,'\0',(longlong *)&local_90,local_88 + 1,local_88, + sVar5 = (short)param_9; + uVar1 = NlpUtf8ToCutf8(sVar5,pcVar4,'\0',(longlong *)&local_90,local_88 + 1,local_88, (longlong)local_50,(longlong)&local_68); RtlLeaveCriticalSection(&NlGlobalDnsForestNameCritSect); if (uVar1 != 0) { - pwVar5 = L"Cannot pack DnsForestName into message %ld\n"; + pwVar7 = L"Cannot pack DnsForestName into message %ld\n"; goto LAB_2; } if (local_88[0] < 3) { RtlEnterCriticalSection(&NlGlobalDomainCritSect); - if ((param_2 == '\0') || (pcVar3 = *(char **)(param_1 + 0xa0), pcVar3 == (char *)0x0)) { - pcVar3 = *(char **)(param_1 + 0x98); + if ((param_2 == '\0') || (pcVar4 = *(char **)(param_1 + 0xa0), pcVar4 == (char *)0x0)) { + pcVar4 = *(char **)(param_1 + 0x98); } - uVar1 = NlpUtf8ToCutf8(sVar4,pcVar3,'\0',(longlong *)&local_90,local_88 + 1,local_88, + uVar1 = NlpUtf8ToCutf8(sVar5,pcVar4,'\0',(longlong *)&local_90,local_88 + 1,local_88, (longlong)local_50,(longlong)&local_68); RtlLeaveCriticalSection(&NlGlobalDomainCritSect); if (uVar1 == 0) { if ((local_88[0] < 3) && - (uVar1 = NlpUtf8ToCutf8(sVar4,*(char **)(param_1 + 0x120),'\0',(longlong *)&local_90, + (uVar1 = NlpUtf8ToCutf8(sVar5,*(char **)(param_1 + 0x120),'\0',(longlong *)&local_90, local_88 + 1,local_88,(longlong)local_50,(longlong)&local_68), uVar1 != 0)) { - pwVar5 = L"Cannot pack HostName into message %ld\n"; + pwVar7 = L"Cannot pack HostName into message %ld\n"; goto LAB_2; } goto LAB_1; } } else { uVar1 = 0x7a; } - pwVar5 = L"Cannot pack DomainName into message %ld\n"; + pwVar7 = L"Cannot pack DomainName into message %ld\n"; LAB_2: - NlPrintDomRoutine(0x100,param_1,pwVar5,(ulonglong)uVar1); - return uVar1; + NlPrintDomRoutine(0x100,param_1,pwVar7,(ulonglong)uVar1); + return (ulonglong)uVar1; } ``` ## NetpLogonPutBytes ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called| |ratio|0.2| |i_ratio|0.04| |m_ratio|0.41| |b_ratio|0.29| |match_types|Implied Match| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |`name`|NetpLogonPutBytes|NetpLogonPutUnicodeStringOld| |`fullname`|NetpLogonPutBytes|NetpLogonPutUnicodeStringOld| |`refcount`|10|9| |`length`|28|129| |`called`||NetpULongPtrRoundUp| |`calling`|BuildSamLogonResponse
BuildSamLogonResponseEx
NetpDcBuildPing|BuildSamLogonResponse
NetpDcBuildPing
PrimaryQueryHandler| |paramcount|3|3| |`address`|18001c810|180088fc8| |`sig`|undefined __fastcall NetpLogonPutBytes(undefined1 * param_1, int param_2, longlong * param_3)|undefined __fastcall NetpLogonPutUnicodeStringOld(wchar_t * param_1, uint param_2, ulonglong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NetpLogonPutBytes Called Diff ```diff --- NetpLogonPutBytes called +++ NetpLogonPutUnicodeStringOld called @@ -0,0 +1 @@ +NetpULongPtrRoundUp ``` ### NetpLogonPutBytes Calling Diff ```diff --- NetpLogonPutBytes calling +++ NetpLogonPutUnicodeStringOld calling @@ -2 +1,0 @@ -BuildSamLogonResponseEx @@ -3,0 +3 @@ +PrimaryQueryHandler ``` ### NetpLogonPutBytes Diff ```diff --- NetpLogonPutBytes +++ NetpLogonPutUnicodeStringOld @@ -1,18 +1,38 @@ -void NetpLogonPutBytes(undefined1 *param_1,int param_2,longlong *param_3) +void NetpLogonPutUnicodeStringOld(wchar_t *param_1,uint param_2,ulonglong *param_3) { - undefined1 uVar1; - undefined1 *puVar2; + wchar_t wVar1; + wchar_t *pwVar2; + longlong lVar3; + int iVar4; + ulonglong uVar5; + wchar_t *local_res8; - do { - puVar2 = (undefined1 *)*param_3; - uVar1 = *param_1; - param_1 = param_1 + 1; - *puVar2 = uVar1; - *param_3 = (longlong)(puVar2 + 1); - param_2 = param_2 + -1; - } while (param_2 != 0); + local_res8 = (wchar_t *)0x0; + uVar5 = (ulonglong)param_2; + pwVar2 = L""; + if (param_1 != (wchar_t *)0x0) { + pwVar2 = param_1; + } + NetpULongPtrRoundUp(*param_3,2,(ulonglong *)&local_res8); + if (local_res8 != (wchar_t *)*param_3) { + *(undefined1 *)*param_3 = 0; + } + wVar1 = *pwVar2; + if (wVar1 != L'\0') { + lVar3 = (longlong)pwVar2 - (longlong)local_res8; + do { + iVar4 = (int)uVar5; + uVar5 = (ulonglong)(iVar4 - 1); + if (iVar4 == 0) break; + *local_res8 = wVar1; + local_res8 = local_res8 + 1; + wVar1 = *(wchar_t *)((longlong)local_res8 + lVar3); + } while (wVar1 != L'\0'); + } + *local_res8 = L'\0'; + *param_3 = (ulonglong)(local_res8 + 1); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## wil_details_RecordCachedUsage ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|wil_details_RecordCachedUsage|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage|wil_details_RecordCachedUsage| |`refcount`|3|2| |length|324|324| |called|__security_check_cookie
wil::details::WilApi_RecordFeatureUsageReports|__security_check_cookie
wil::details::WilApi_RecordFeatureUsageReports| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''|wil::details::EnabledStateManager::ProcessShutdown| |paramcount|2|2| |`address`|180078b10|180078a60| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_RecordCachedUsage Calling Diff ```diff --- wil_details_RecordCachedUsage calling +++ wil_details_RecordCachedUsage calling @@ -1,2 +1 @@ -wil::details::EnabledStateManager::~EnabledStateManager -wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' +wil::details::EnabledStateManager::ProcessShutdown ``` ## LSASRV.DLL::LsaIFilterInboundNamespace ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|LsaIFilterInboundNamespace|LsaIFilterInboundNamespace| |fullname|LSASRV.DLL::LsaIFilterInboundNamespace|LSASRV.DLL::LsaIFilterInboundNamespace| |`refcount`|3|2| |length|0|0| |called||| |`calling`|NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NlpValidateNTLMTargetInfo| |paramcount|0|0| |`address`|EXTERNAL:0000012c|EXTERNAL:0000012d| |sig|undefined LsaIFilterInboundNamespace(void)|undefined LsaIFilterInboundNamespace(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### LSASRV.DLL::LsaIFilterInboundNamespace Calling Diff ```diff --- LSASRV.DLL::LsaIFilterInboundNamespace calling +++ LSASRV.DLL::LsaIFilterInboundNamespace calling @@ -2 +1,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|LsaIFreeFilterInboundNamespaceResult|LsaIFreeFilterInboundNamespaceResult| |fullname|LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult|LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult| |`refcount`|3|2| |length|0|0| |called||| |`calling`|NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NlpValidateNTLMTargetInfo| |paramcount|0|0| |`address`|EXTERNAL:0000012e|EXTERNAL:0000012f| |sig|undefined LsaIFreeFilterInboundNamespaceResult(void)|undefined LsaIFreeFilterInboundNamespaceResult(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult Calling Diff ```diff --- LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult calling +++ LSASRV.DLL::LsaIFreeFilterInboundNamespaceResult calling @@ -2 +1,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## NlFindNetbiosDomain ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.68| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlFindNetbiosDomain|NlFindNetbiosDomain| |fullname|NlFindNetbiosDomain|NlFindNetbiosDomain| |`refcount`|19|18| |length|225|225| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlEqualDomainName
NTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlEqualDomainName
NTDLL.DLL::RtlInitUnicodeString
NTDLL.DLL::RtlLeaveCriticalSection| |calling|
Expand for full list:
AcceptSecurityContext
DsrEnumerateDomainTrusts
DsrGetDcNameEx2
DsrGetForestTrustInformation
NlBrowserSyncHostedDomains
NlCreateDomainPhase1
NlCreateSysvolShares
NlFindDomain
NlGetLocalPingResponse
NlMainLoop
NlPingJoinDCNlReadPersitantTrustedDomainList
NlUpdateCompoundIdentityEncTypes
NlVerifyNetworkUp
NlpLocateCurrentDomainDCNoCaching
|
Expand for full list:
AcceptSecurityContext
DsrEnumerateDomainTrusts
DsrGetDcNameEx2
DsrGetForestTrustInformation
NlBrowserSyncHostedDomains
NlCreateDomainPhase1
NlCreateSysvolShares
NlFindDomain
NlGetLocalPingResponse
NlMainLoop
NlPingJoinDCNlReadPersitantTrustedDomainList
NlUpdateCompoundIdentityEncTypes
NlVerifyNetworkUp
NlpLocateCurrentDomainDCNoCaching
| |paramcount|2|2| |`address`|18001bba0|18001b620| |sig|undefined8 * __fastcall NlFindNetbiosDomain(longlong param_1, char param_2)|undefined8 * __fastcall NlFindNetbiosDomain(longlong param_1, char param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>| |`refcount`|4|5| |length|22|22| |called|wil::details::DestroyThreadPoolTimer::Destroy|wil::details::DestroyThreadPoolTimer::Destroy| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager|wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1|1| |`address`|180071dc8|180071c98| |sig|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> calling @@ -0,0 +1 @@ +wil::details::EnabledStateManager::ProcessShutdown ``` ## destroy ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|destroy|destroy| |fullname|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::destroy|wistd::__function::__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)>::destroy| |`refcount`|3|4| |length|3|3| |called||| |calling||| |paramcount|1|1| |`address`|18004e140|18004dee0| |sig|void __thiscall destroy(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this)|void __thiscall destroy(__func,bool___cdecl(void*___ptr64,unsigned___int64,void*___ptr64,unsigned___int64,unsigned_int)> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## NlpMapSecureChannelTypeToString ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.41| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpMapSecureChannelTypeToString|NlpMapSecureChannelTypeToString| |fullname|NlpMapSecureChannelTypeToString|NlpMapSecureChannelTypeToString| |`refcount`|2|1| |length|111|111| |called||| |`calling`|NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NlpValidateNTLMTargetInfo| |paramcount|1|1| |`address`|1800394a8|18003a0b0| |sig|wchar_t * __fastcall NlpMapSecureChannelTypeToString(int param_1)|wchar_t * __fastcall NlpMapSecureChannelTypeToString(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpMapSecureChannelTypeToString Calling Diff ```diff --- NlpMapSecureChannelTypeToString calling +++ NlpMapSecureChannelTypeToString calling @@ -2 +1,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## WilApi_RecordFeatureUsage ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|WilApi_RecordFeatureUsage|WilApi_RecordFeatureUsage| |fullname|wil::details::WilApi_RecordFeatureUsage|wil::details::WilApi_RecordFeatureUsage| |`refcount`|4|3| |length|41|41| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::WilApi_RecordFeatureUsageReports
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''|wil::details::EnabledStateManager::ProcessShutdown
wil::details::WilApi_RecordFeatureUsageReports| |paramcount|4|4| |`address`|180077928|180077878| |sig|void __cdecl WilApi_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)|void __cdecl WilApi_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### WilApi_RecordFeatureUsage Calling Diff ```diff --- wil::details::WilApi_RecordFeatureUsage calling +++ wil::details::WilApi_RecordFeatureUsage calling @@ -1 +1 @@ -wil::details::EnabledStateManager::~EnabledStateManager +wil::details::EnabledStateManager::ProcessShutdown @@ -3 +2,0 @@ -wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' ``` ## NetpULongPtrRoundUp ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NetpULongPtrRoundUp|NetpULongPtrRoundUp| |fullname|NetpULongPtrRoundUp|NetpULongPtrRoundUp| |`refcount`|31|32| |length|44|44| |called||| |`calling`|
Expand for full list:
NetpCopyFtinfoContext2
NetpDcBuildPing
NetpLogonGetDomainSID
NetpLogonGetUnicodeString
NetpLogonPutUnicodeString
NetpMarshalFtinfoEntry2
NlBrowserOpen
NlCreateDomainPhase1
NlDnsInitialize
NlDnsWriteBinaryLog
NlMainLoopNlReadFileTrustedDomainList
NlSendChangeLogNotification
NlUpdateDomainInfo
NlWriteFileForestTrustListEx
NlpAddResourceGroupsToSamInfo
NlpEnumerateDomainTrusts
|
Expand for full list:
NetpCopyFtinfoContext2
NetpLogonGetDomainSID
NetpLogonGetUnicodeString
NetpLogonPutDomainSID
NetpLogonPutUnicodeString
NetpLogonPutUnicodeStringOld
NetpMarshalFtinfoEntry2
NlBrowserOpen
NlCreateDomainPhase1
NlDnsInitialize
NlDnsWriteBinaryLogNlMainLoop
NlReadFileTrustedDomainList
NlSendChangeLogNotification
NlUpdateDomainInfo
NlWriteFileForestTrustListEx
NlpAddResourceGroupsToSamInfo
NlpEnumerateDomainTrusts
| |paramcount|3|3| |`address`|18001d5c8|18001d048| |sig|undefined8 __fastcall NetpULongPtrRoundUp(ulonglong param_1, longlong param_2, ulonglong * param_3)|undefined8 __fastcall NetpULongPtrRoundUp(ulonglong param_1, longlong param_2, ulonglong * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NetpULongPtrRoundUp Calling Diff ```diff --- NetpULongPtrRoundUp calling +++ NetpULongPtrRoundUp calling @@ -2 +1,0 @@ -NetpDcBuildPing @@ -4,0 +4 @@ +NetpLogonPutDomainSID @@ -5,0 +6 @@ +NetpLogonPutUnicodeStringOld ``` ## NetpIpAddressToWStr ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NetpIpAddressToWStr|NetpIpAddressToWStr| |fullname|NetpIpAddressToWStr|NetpIpAddressToWStr| |`refcount`|3|4| |length|77|77| |called|NetpCopyStrToWStr
NetpIpAddressToStr
__security_check_cookie|NetpCopyStrToWStr
NetpIpAddressToStr
__security_check_cookie| |calling|NlDnsUpdate
NlDnsUpdateRequestWorker|NlDnsUpdate
NlDnsUpdateRequestWorker| |paramcount|2|2| |`address`|18008074c|1800806b8| |sig|undefined __fastcall NetpIpAddressToWStr(undefined8 param_1, undefined2 * param_2)|undefined __fastcall NetpIpAddressToWStr(undefined8 param_1, undefined2 * param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## LSASRV.DLL::LsaIFreeHeap ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|LsaIFreeHeap|LsaIFreeHeap| |fullname|LSASRV.DLL::LsaIFreeHeap|LSASRV.DLL::LsaIFreeHeap| |`refcount`|5|4| |length|0|0| |called||| |`calling`|NlQueryLogonSessions
NlpLogonSamLogon
NlpValidateNTLMTargetInfoOld|NlQueryLogonSessions
NlpLogonSamLogon| |paramcount|0|0| |`address`|EXTERNAL:0000012d|EXTERNAL:0000012e| |sig|undefined LsaIFreeHeap(void)|undefined LsaIFreeHeap(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### LSASRV.DLL::LsaIFreeHeap Calling Diff ```diff --- LSASRV.DLL::LsaIFreeHeap calling +++ LSASRV.DLL::LsaIFreeHeap calling @@ -3 +2,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## reset ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|reset|reset| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset| |`refcount`|6|7| |length|76|76| |called|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager|wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|2|2| |`address`|180077eb4|180077e04| |sig|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### reset Calling Diff ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset calling +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset calling @@ -0,0 +1 @@ +wil::details::EnabledStateManager::ProcessShutdown ``` ## NTDLL.DLL::RtlLeaveCriticalSection ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|RtlLeaveCriticalSection|RtlLeaveCriticalSection| |fullname|NTDLL.DLL::RtlLeaveCriticalSection|NTDLL.DLL::RtlLeaveCriticalSection| |`refcount`|421|424| |length|0|0| |called||| |calling|
Expand for full list:
AcceptSecurityContext
AllocateContext
AllocateCredential
BuildSamLogonResponse
BuildSamLogonResponseEx
DeleteCredential
DeleteSecurityContext
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecords
I_NetLogonSetServiceBitsI_NetNotifyLsaPolicyChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
InitializeSecurityContextW
LocateContext
LocateCredential
NetpAddServiceAccount
NetpCheckAccountSecret
NetpDcGetNameIp
NetpDcHandlePingResponse
NetpDeleteAccountSecret
NetpServerPasswordSet
NetpSetAccountSecret
NetrExtendMachinePasswordExpirationTimeout
NetrGetForestTrustInformation
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTimeServiceParentDomain
NetrLogonSamLogoff
NetrLogonSendToSam
NetrServerAuthenticate3
NetrServerGetTrustInfo
NetrServerPasswordGet
NlAddServiceAccount
NlAllocateClientApi
NlAllocateServiceAccount
NlBrowserAddName
NlBrowserDelName
NlBrowserSendDatagram
NlCaptureDomainInfo
NlCaptureServerClientSession
NlCaptureSiteName
NlChangeLogWorker
NlChangePassword
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCloseChangeLog
NlCreateDomainPhase1
NlCreateSysvolShares
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDcScavenger
NlDeleteDomClientSession
NlDeleteServiceAccount
NlDereferenceDomain
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsBuildName
NlDnsDeregisterOne
NlDnsInitialize
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsShutdown
NlDnsUpdateRequestWorker
NlDnsWriteBinaryLog
NlDnsWriteLog
NlDomainScavenger
NlDomainThread
NlEnsureSessionAuthenticated
NlEnumerateDomains
NlFindDnsDomain
NlFindDomain
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNetbiosDomain
NlFindSiteEntry
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFlushNetbiosCacheName
NlFreeClientApi
NlFreeDnsDomainDomainInfo
NlFreeServerSessionForAccount
NlGetAnyDCName
NlGetDomainFlags
NlGetLocalPingResponse
NlGetTrustedDomainNamePairs
NlGetTrustedDomainNames
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitTrustList
NlInitializeDomains
NlInitializeServiceAccounts
NlInsertChallenge
NlInsertServerSession
NlLogEventsForDomainTrusts
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPickTrustedDcForEntireTrustList
NlPingDcName
NlPreparePingContext
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintRoutine
NlPrintRoutineV
NlPrintRpcDebug
NlQueueWorkItem
NlQueueWorkItem$fin$0
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlRefDomClientSession
NlRefDomParentClientSession
NlRemoveChallengeForClient
NlReparse
NlResetWriterClientSession
NlScavengeOldChallenges
NlSearchClientAddrsForSiteMapping
NlSendChangeLogNotification
NlServiceScavenger
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetDnsForestName
NlSetDomainForestRoot
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDynamicSiteName
NlSetForestTrustList
NlSetServerClientSession
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlSetStatusClientSession
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesSetSiteCoverageParam
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartDomainThread
NlStartNetlogonCall
NlStopDomainThread
NlTimeToReauthenticate
NlTimeToRediscover
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlTransportAddTransportName
NlTransportDisableTransportName
NlTransportGetAllIpAddresses
NlTransportGetIpV4Addresses
NlTransportGetIpV6Addresses
NlTransportLookupTransportName
NlUninitializeDomains
NlUnrefClientSession
NlUpdateDnsRootAlias
NlUpdateRole
NlUpdateServicedNdncs
NlWorkerThread
NlpChainSetClientAttributes
NlpDumpBufferDirect
NlpEnumerateDomainTrusts
NlpFreeNetlogonDllHandles
NlpGetForestTrustInfoHigher
NlpLogonSamLogon
NlpRemoveBadPasswordCacheEntry
NlpSignOrSeal
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyOrUnseal
UnsealMessage
|
Expand for full list:
AcceptSecurityContext
AllocateContext
AllocateCredential
BuildSamLogonResponse
BuildSamLogonResponseEx
DeleteCredential
DeleteSecurityContext
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecords
I_NetLogonSetServiceBitsI_NetNotifyLsaPolicyChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
InitializeSecurityContextW
LocateContext
LocateCredential
NetpAddServiceAccount
NetpCheckAccountSecret
NetpDcGetNameIp
NetpDcHandlePingResponse
NetpDeleteAccountSecret
NetpServerPasswordSet
NetpSetAccountSecret
NetrExtendMachinePasswordExpirationTimeout
NetrGetForestTrustInformation
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTimeServiceParentDomain
NetrLogonSamLogoff
NetrLogonSendToSam
NetrServerAuthenticate3
NetrServerGetTrustInfo
NetrServerPasswordGet
NlAddServiceAccount
NlAllocateClientApi
NlAllocateServiceAccount
NlBrowserAddName
NlBrowserDelName
NlBrowserSendDatagram
NlCaptureDomainInfo
NlCaptureServerClientSession
NlCaptureSiteName
NlChangeLogWorker
NlChangePassword
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCloseChangeLog
NlCreateDomainPhase1
NlCreateSysvolShares
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDcScavenger
NlDeleteDomClientSession
NlDeleteServiceAccount
NlDereferenceDomain
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsBuildName
NlDnsDeregisterOne
NlDnsInitialize
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsShutdown
NlDnsUpdateRequestWorker
NlDnsWriteBinaryLog
NlDnsWriteLog
NlDomainScavenger
NlDomainThread
NlEnsureSessionAuthenticated
NlEnumerateDomains
NlFindDnsDomain
NlFindDomain
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNetbiosDomain
NlFindSiteEntry
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFlushNetbiosCacheName
NlFreeClientApi
NlFreeDnsDomainDomainInfo
NlFreeServerSessionForAccount
NlGetAnyDCName
NlGetDomainFlags
NlGetLocalPingResponse
NlGetTrustedDomainNamePairs
NlGetTrustedDomainNames
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitTrustList
NlInitializeDomains
NlInitializeServiceAccounts
NlInsertChallenge
NlInsertServerSession
NlLogEventsForDomainTrusts
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPickTrustedDcForEntireTrustList
NlPingDcName
NlPreparePingContext
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintRoutine
NlPrintRoutineV
NlPrintRpcDebug
NlQueueWorkItem
NlQueueWorkItem$fin$0
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlRefDomClientSession
NlRefDomParentClientSession
NlRemoveChallengeForClient
NlReparse
NlResetWriterClientSession
NlScavengeOldChallenges
NlSearchClientAddrsForSiteMapping
NlSendChangeLogNotification
NlServiceScavenger
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetDnsForestName
NlSetDomainForestRoot
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDynamicSiteName
NlSetForestTrustList
NlSetServerClientSession
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlSetStatusClientSession
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesSetSiteCoverageParam
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartDomainThread
NlStartNetlogonCall
NlStopDomainThread
NlTimeToReauthenticate
NlTimeToRediscover
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlTransportAddTransportName
NlTransportDisableTransportName
NlTransportGetAllIpAddresses
NlTransportGetIpV4Addresses
NlTransportGetIpV6Addresses
NlTransportLookupTransportName
NlUninitializeDomains
NlUnrefClientSession
NlUpdateDnsRootAlias
NlUpdateRole
NlUpdateServicedNdncs
NlWorkerThread
NlpChainSetClientAttributes
NlpDumpBufferDirect
NlpEnumerateDomainTrusts
NlpFreeNetlogonDllHandles
NlpGetForestTrustInfoHigher
NlpLogonSamLogon
NlpRemoveBadPasswordCacheEntry
NlpSignOrSeal
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyOrUnseal
UnsealMessage
| |paramcount|0|0| |`address`|EXTERNAL:000001a0|EXTERNAL:000001a1| |sig|undefined RtlLeaveCriticalSection(void)|undefined RtlLeaveCriticalSection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## NlpRemoveBadPasswordCacheEntry ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.8| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpRemoveBadPasswordCacheEntry|NlpRemoveBadPasswordCacheEntry| |fullname|NlpRemoveBadPasswordCacheEntry|NlpRemoveBadPasswordCacheEntry| |`refcount`|3|4| |length|280|280| |called|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
memcpy|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc
API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL::_o__wcsicmp
NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
memcpy| |calling|NlpUserValidate|NlpUserValidate| |paramcount|2|2| |`address`|180039528|18003a130| |sig|undefined __fastcall NlpRemoveBadPasswordCacheEntry(longlong param_1, longlong param_2)|undefined __fastcall NlpRemoveBadPasswordCacheEntry(longlong param_1, longlong param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|GetLastError|GetLastError| |fullname|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError| |`refcount`|170|171| |length|0|0| |called||| |`calling`|
Expand for full list:
AxbInitialize
DosGetMessage
DsrGetDcNameEx2
DsrGetSiteName
GiveInstallHints
I_ISMBind
I_NetNotifyDsChange
I_NetNotifyTrustedDomain
InitializeSecurityContextW
MyAllocUnicode
NetpAccessCheck2NetpAllocLowerCaseWStrFromWStr
NetpDcCreateDomainEntry
NetpDcGetPingResponse
NetpDcInitializeContext
NetpDcPingListIp
NetpExpandConfigString
NetpGetComputerNameEx2
NetpLogonCreateRandomMailslot
NetpSetDnsComputerNameAsRequired
NetpTriggerGlobalScavenger
NetpWriteEventlogEx
NlAddServiceAccount
NlAllocateClientApi
NlAllocateClientSession
NlBrowserCreateEvent
NlBrowserDeviceIoControl
NlBrowserOpen
NlBrowserSendDatagram
NlBrowserUpdate
NlChangePassword
NlCleanup
NlControlHandler
NlCreateDomainPhase1
NlCreateNetlogonInterfaceSD
NlCreateSysvolShares
NlDCLocInitializeGlobalPerformanceCounters
NlDCLocInitializePerformanceCounterStructure
NlDCPingsInitializePerformanceCounterStructure
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDeleteBinaryLog
NlDiscoverDc
NlDnsScavengeWorker
NlDnsServerFailureOutputCheck
NlDnsWriteLog
NlEndNetlogonCall
NlExit
NlFreeClientApi
NlGenerateRandomBits
NlGetDnsHostName
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlInit
NlInitChangeLog
NlInitTrustList
NlInitializeRemoteAccessCheck
NlInsertChallenge
NlMailslotOverlappedResult
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlParseOnePath
NlPrintRoutineV
NlQueueWorkItem
NlReadBinaryLog
NlRegisterAuthRpcServices
NlReparse
NlRequestLocatorNameMappingsUpdate
NlResetWriterClientSession
NlSendChangeLogNotification
NlSessionAuthenticationNetlogon
NlSetDomainNameInDomainInfo
NlSetDsSPNWorker
NlSetServerClientSession
NlSiteInitializationWrapper
NlStartApiClientSession
NlStartChangeLogWorkerThread
NlStartJoinDCPingThreadIfNecessary
NlStartOrRestartRemoteAccessCheck
NlTimeoutSetWriterClientSession
NlTransportGetIpAddress
NlTransportOpen
NlUpdateCompoundIdentityEncTypesForSession
NlUpdateRemoteAccessCheckSecurityDescriptor
NlUpdateRpcSecurityDescriptor
NlUpdateVulnerableChannelAllowList
NlWaitForSamService
NlWaitForService
NlWaitForSingleObject
NlWorkerKillThreads
NlWorkerThread
NlWriteBinaryLog
NlWriteBinaryLogEx
NlpAuthzAccessCheck
NlpCreateAuthzContext
NlpFreeNetlogonDllHandles
NlpGenerateIumBoundMachineAuthCert
NlpSignOrSeal
NlpStoreKeyInDS
NlpVerifyAllowedToAuthenticate
UpdateCallbackArgs::StaticCreate
wil::details::GetLastErrorFail
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::last_error_context::last_error_context
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create
|
Expand for full list:
AxbInitialize
DosGetMessage
DsrGetDcNameEx2
DsrGetSiteName
EnableMitigations
GiveInstallHints
I_ISMBind
I_NetNotifyDsChange
I_NetNotifyTrustedDomain
InitializeSecurityContextW
MyAllocUnicodeNetpAccessCheck2
NetpAllocLowerCaseWStrFromWStr
NetpDcCreateDomainEntry
NetpDcGetPingResponse
NetpDcInitializeContext
NetpDcPingListIp
NetpExpandConfigString
NetpGetComputerNameEx2
NetpLogonCreateRandomMailslot
NetpSetDnsComputerNameAsRequired
NetpTriggerGlobalScavenger
NetpWriteEventlogEx
NlAddServiceAccount
NlAllocateClientApi
NlAllocateClientSession
NlBrowserCreateEvent
NlBrowserDeviceIoControl
NlBrowserOpen
NlBrowserSendDatagram
NlBrowserUpdate
NlChangePassword
NlCleanup
NlControlHandler
NlCreateDomainPhase1
NlCreateNetlogonInterfaceSD
NlCreateSysvolShares
NlDCLocInitializeGlobalPerformanceCounters
NlDCLocInitializePerformanceCounterStructure
NlDCPingsInitializePerformanceCounterStructure
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDeleteBinaryLog
NlDiscoverDc
NlDnsScavengeWorker
NlDnsServerFailureOutputCheck
NlDnsWriteLog
NlEndNetlogonCall
NlExit
NlFreeClientApi
NlGenerateRandomBits
NlGetDnsHostName
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlInit
NlInitChangeLog
NlInitTrustList
NlInitializeRemoteAccessCheck
NlInsertChallenge
NlMailslotOverlappedResult
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlParseOnePath
NlPrintRoutineV
NlQueueWorkItem
NlReadBinaryLog
NlRegisterAuthRpcServices
NlReparse
NlRequestLocatorNameMappingsUpdate
NlResetWriterClientSession
NlSendChangeLogNotification
NlSessionAuthenticationNetlogon
NlSetDomainNameInDomainInfo
NlSetDsSPNWorker
NlSetServerClientSession
NlSiteInitializationWrapper
NlStartApiClientSession
NlStartChangeLogWorkerThread
NlStartJoinDCPingThreadIfNecessary
NlStartOrRestartRemoteAccessCheck
NlTimeoutSetWriterClientSession
NlTransportGetIpAddress
NlTransportOpen
NlUpdateCompoundIdentityEncTypesForSession
NlUpdateRemoteAccessCheckSecurityDescriptor
NlUpdateRpcSecurityDescriptor
NlUpdateVulnerableChannelAllowList
NlWaitForSamService
NlWaitForService
NlWaitForSingleObject
NlWorkerKillThreads
NlWorkerThread
NlWriteBinaryLog
NlWriteBinaryLogEx
NlpAuthzAccessCheck
NlpCreateAuthzContext
NlpFreeNetlogonDllHandles
NlpGenerateIumBoundMachineAuthCert
NlpSignOrSeal
NlpStoreKeyInDS
NlpVerifyAllowedToAuthenticate
UpdateCallbackArgs::StaticCreate
wil::details::GetLastErrorFail
wil::details_abi::SemaphoreValue::GetValueFromSemaphore
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::last_error_context::last_error_context
wil::semaphore_t,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>,struct_wil::err_returncode_policy>::create
| |paramcount|0|0| |address|EXTERNAL:0000004d|EXTERNAL:0000004d| |sig|DWORD __stdcall GetLastError(void)|DWORD __stdcall GetLastError(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError Calling Diff ```diff --- API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling +++ API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError calling @@ -4,0 +5 @@ +EnableMitigations ``` ## LSASRV.DLL::LsaIExtractTargetInfo ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|LsaIExtractTargetInfo|LsaIExtractTargetInfo| |fullname|LSASRV.DLL::LsaIExtractTargetInfo|LSASRV.DLL::LsaIExtractTargetInfo| |`refcount`|3|2| |length|0|0| |called||| |`calling`|NlpExtractNtlmTargetInfo
NlpValidateNTLMTargetInfoOld|NlpExtractNtlmTargetInfo| |paramcount|0|0| |`address`|EXTERNAL:0000012b|EXTERNAL:0000012c| |sig|undefined LsaIExtractTargetInfo(void)|undefined LsaIExtractTargetInfo(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### LSASRV.DLL::LsaIExtractTargetInfo Calling Diff ```diff --- LSASRV.DLL::LsaIExtractTargetInfo calling +++ LSASRV.DLL::LsaIExtractTargetInfo calling @@ -2 +1,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## NlpGetClientAddress ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpGetClientAddress|NlpGetClientAddress| |fullname|NlpGetClientAddress|NlpGetClientAddress| |`refcount`|13|11| |length|287|287| |called|NTDLL.DLL::RtlIpv4AddressToStringExW
NTDLL.DLL::RtlIpv6AddressToStringExW
NlPrintRoutine
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::I_RpcServerInqRemoteConnAddress
__security_check_cookie
memset|NTDLL.DLL::RtlIpv4AddressToStringExW
NTDLL.DLL::RtlIpv6AddressToStringExW
NlPrintRoutine
RPCRT4.DLL::I_RpcMapWin32Status
RPCRT4.DLL::I_RpcServerInqRemoteConnAddress
__security_check_cookie
memset| |`calling`|NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerReqChallenge
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld
NlpWriteDiscoveryTrustEvent|NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerReqChallenge
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpValidateNTLMTargetInfo
NlpWriteDiscoveryTrustEvent| |paramcount|2|2| |`address`|18005c39c|18005c13c| |sig|long __fastcall NlpGetClientAddress(undefined8 param_1, undefined8 param_2)|long __fastcall NlpGetClientAddress(undefined8 param_1, undefined8 param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpGetClientAddress Calling Diff ```diff --- NlpGetClientAddress calling +++ NlpGetClientAddress calling @@ -9 +8,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## NTDLL.DLL::RtlEnterCriticalSection ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|RtlEnterCriticalSection|RtlEnterCriticalSection| |fullname|NTDLL.DLL::RtlEnterCriticalSection|NTDLL.DLL::RtlEnterCriticalSection| |`refcount`|317|321| |length|0|0| |called||| |calling|
Expand for full list:
AcceptSecurityContext
AcquireHandleBuffers
AllocateContext
AllocateCredential
BuildSamLogonResponse
BuildSamLogonResponseEx
DeleteCredential
DeleteSecurityContext
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecordsI_NetLogonSetServiceBits
I_NetNotifyLsaPolicyChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
InitializeSecurityContextW
LocateContext
LocateCredential
NetpAddServiceAccount
NetpCheckAccountSecret
NetpDcGetNameIp
NetpDcHandlePingResponse
NetpDeleteAccountSecret
NetpServerPasswordSet
NetpSetAccountSecret
NetpTriggerGlobalScavenger
NetrExtendMachinePasswordExpirationTimeout
NetrGetForestTrustInformation
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTimeServiceParentDomain
NetrLogonSamLogoff
NetrLogonSendToSam
NetrServerAuthenticate3
NetrServerGetTrustInfo
NetrServerPasswordGet
NlAddServiceAccount
NlAllocateClientApi
NlAllocateServiceAccount
NlBrowserAddName
NlBrowserDelName
NlBrowserSendDatagram
NlCaptureDnsForestName
NlCaptureDomainInfo
NlCaptureServerClientSession
NlCaptureSiteName
NlChangeLogWorker
NlChangePassword
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCleanupServiceAccounts
NlCloseChangeLog
NlCreateDomainPhase1
NlCreateSysvolShares
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDcScavenger
NlDeleteDomClientSession
NlDeleteDomain
NlDeleteServiceAccount
NlDerefSiteEntry
NlDereferenceDomain
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsBuildName
NlDnsDeregisterOne
NlDnsInitialize
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsSetState
NlDnsShutdown
NlDnsUpdateRequestWorker
NlDnsWriteBinaryLog
NlDnsWriteLog
NlDomainScavenger
NlDomainThread
NlEndNetlogonCall
NlEnsureSessionAuthenticated
NlEnumerateDomains
NlFindDnsDomain
NlFindDomain
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNetbiosDomain
NlFindSiteEntry
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFlushNetbiosCacheName
NlFreeClientApi
NlFreeDnsDomainDomainInfo
NlFreeServerSessionForAccount
NlGetAnyDCName
NlGetDomainFlags
NlGetLocalPingResponse
NlGetTrustedDomainNamePairs
NlGetTrustedDomainNames
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitTrustList
NlInitializeDomains
NlInitializeServiceAccounts
NlInsertChallenge
NlInsertServerSession
NlLogEventsForDomainTrusts
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPickTrustedDcForEntireTrustList
NlPingDcName
NlPreparePingContext
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutine
NlPrintRoutineV
NlPrintRpcDebug
NlQueueWorkItem
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlRefDomClientSession
NlRefDomParentClientSession
NlRemoveChallengeForClient
NlReparse
NlResetWriterClientSession
NlScavengeOldChallenges
NlScavengeOldFailedLogons
NlSearchClientAddrsForSiteMapping
NlSendChangeLogNotification
NlServerSessionScavenger
NlServiceScavenger
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetDnsForestName
NlSetDomainForestRoot
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDynamicSiteName
NlSetForestTrustList
NlSetServerClientSession
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlSetStatusClientSession
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesSetSiteCoverageParam
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartDomainThread
NlStartNetlogonCall
NlStopDomainThread
NlTimeToReauthenticate
NlTimeToRediscover
NlTimeoutApiClientSession
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlTransportAddTransportName
NlTransportClose
NlTransportDisableTransportName
NlTransportGetAllIpAddresses
NlTransportGetIpV4Addresses
NlTransportGetIpV6Addresses
NlTransportLookupTransportName
NlUninitializeDomains
NlUnrefClientSession
NlUpdateDnsRootAlias
NlUpdateRole
NlUpdateServicedNdncs
NlWorkerThread
NlpChainSetClientAttributes
NlpDumpBufferDirect
NlpEnumerateDomainTrusts
NlpFreeNetlogonDllHandles
NlpGetForestTrustInfoHigher
NlpLogonSamLogon
NlpRemoveBadPasswordCacheEntry
NlpSignOrSeal
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyOrUnseal
UnsealMessage
|
Expand for full list:
AcceptSecurityContext
AcquireHandleBuffers
AllocateContext
AllocateCredential
BuildSamLogonResponse
BuildSamLogonResponseEx
DeleteCredential
DeleteSecurityContext
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecordsI_NetLogonSetServiceBits
I_NetNotifyLsaPolicyChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
InitializeSecurityContextW
LocateContext
LocateCredential
NetpAddServiceAccount
NetpCheckAccountSecret
NetpDcGetNameIp
NetpDcHandlePingResponse
NetpDeleteAccountSecret
NetpServerPasswordSet
NetpSetAccountSecret
NetpTriggerGlobalScavenger
NetrExtendMachinePasswordExpirationTimeout
NetrGetForestTrustInformation
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTimeServiceParentDomain
NetrLogonSamLogoff
NetrLogonSendToSam
NetrServerAuthenticate3
NetrServerGetTrustInfo
NetrServerPasswordGet
NlAddServiceAccount
NlAllocateClientApi
NlAllocateServiceAccount
NlBrowserAddName
NlBrowserDelName
NlBrowserSendDatagram
NlCaptureDnsForestName
NlCaptureDomainInfo
NlCaptureServerClientSession
NlCaptureSiteName
NlChangeLogWorker
NlChangePassword
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCleanupServiceAccounts
NlCloseChangeLog
NlCreateDomainPhase1
NlCreateSysvolShares
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDcScavenger
NlDeleteDomClientSession
NlDeleteDomain
NlDeleteServiceAccount
NlDerefSiteEntry
NlDereferenceDomain
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsBuildName
NlDnsDeregisterOne
NlDnsInitialize
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsSetState
NlDnsShutdown
NlDnsUpdateRequestWorker
NlDnsWriteBinaryLog
NlDnsWriteLog
NlDomainScavenger
NlDomainThread
NlEndNetlogonCall
NlEnsureSessionAuthenticated
NlEnumerateDomains
NlFindDnsDomain
NlFindDomain
NlFindDomainByServerName
NlFindNamedClientSession
NlFindNetbiosDomain
NlFindSiteEntry
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFlushNetbiosCacheName
NlFreeClientApi
NlFreeDnsDomainDomainInfo
NlFreeServerSessionForAccount
NlGetAnyDCName
NlGetDomainFlags
NlGetLocalPingResponse
NlGetTrustedDomainNamePairs
NlGetTrustedDomainNames
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitTrustList
NlInitializeDomains
NlInitializeServiceAccounts
NlInsertChallenge
NlInsertServerSession
NlLogEventsForDomainTrusts
NlMainLoop
NlNetlogonMain
NlOpenDebugFile
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPickTrustedDcForEntireTrustList
NlPingDcName
NlPreparePingContext
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutine
NlPrintRoutineV
NlPrintRpcDebug
NlQueueWorkItem
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlRefDomClientSession
NlRefDomParentClientSession
NlRemoveChallengeForClient
NlReparse
NlResetWriterClientSession
NlScavengeOldChallenges
NlScavengeOldFailedLogons
NlSearchClientAddrsForSiteMapping
NlSendChangeLogNotification
NlServerSessionScavenger
NlServiceScavenger
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetDnsForestName
NlSetDomainForestRoot
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDynamicSiteName
NlSetForestTrustList
NlSetServerClientSession
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlSetStatusClientSession
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesSetSiteCoverageParam
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartDomainThread
NlStartNetlogonCall
NlStopDomainThread
NlTimeToReauthenticate
NlTimeToRediscover
NlTimeoutApiClientSession
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlTransportAddTransportName
NlTransportClose
NlTransportDisableTransportName
NlTransportGetAllIpAddresses
NlTransportGetIpV4Addresses
NlTransportGetIpV6Addresses
NlTransportLookupTransportName
NlUninitializeDomains
NlUnrefClientSession
NlUpdateDnsRootAlias
NlUpdateRole
NlUpdateServicedNdncs
NlWorkerThread
NlpChainSetClientAttributes
NlpDumpBufferDirect
NlpEnumerateDomainTrusts
NlpFreeNetlogonDllHandles
NlpGetForestTrustInfoHigher
NlpLogonSamLogon
NlpRemoveBadPasswordCacheEntry
NlpSignOrSeal
NlpUserValidate
NlpUserValidateHigher
NlpUserValidateOnDc
NlpVerifyOrUnseal
UnsealMessage
| |paramcount|0|0| |`address`|EXTERNAL:000001a1|EXTERNAL:000001a2| |sig|undefined RtlEnterCriticalSection(void)|undefined RtlEnterCriticalSection(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## __GSHandlerCheck ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|207|206| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180024378|1800243c8| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NlPrintRoutine ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlPrintRoutine|NlPrintRoutine| |fullname|NlPrintRoutine|NlPrintRoutine| |`refcount`|1670|1663| |length|106|106| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlPrintRoutineV|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlPrintRoutineV| |`calling`|
Expand for full list:
AcceptSecurityContext
AcquireCredentialsHandleW
AllocateCredential
CheckDCLocatorRPCSecurityPolicyBypass
DeleteCredential
DeleteSecurityContext
DmsapParseAccountNames
DsIGetDcName
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
DsrDeregisterDnsHostRecordsDsrEnumerateDomainTrusts
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecords
FreeCredentialsHandle
GiveInstallHints
I_NetLogonAppendChangeLog
I_NetLogonCloseChangeLog
I_NetLogonGetAuthDataEx
I_NetLogonGetSerialNumber
I_NetLogonLdapLookupEx
I_NetLogonNewChangeLog
I_NetLogonReadChangeLog
I_NetNotifyDsChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
I_NetNotifyTrustedDomain
InitSecurityInterfaceW
InitializeSecurityContextW
IsTicketLogonReplySupported
IsTicketLogonRequestSupported
KerbMapNtStatusToSecStatus
MakeSignature
NetIGetEncTypes
NetpAddServiceAccount
NetpAllocLowerCaseWStrFromWStr
NetpAllocUtf8StrFromUnicodeString
NetpCancelOutstandingRequests
NetpComputeMessageSignatures
NetpComputeNtOwfPasswords
NetpCreateDCInfoFromCacheEntry
NetpDcAllocateCacheEntry
NetpDcBuildRelativeDnsName
NetpDcCheckSiteCovered
NetpDcCreateDomainEntry
NetpDcDerefCacheEntry
NetpDcFindCacheEntry
NetpDcFindCacheEntryForDC
NetpDcFindDomainEntry
NetpDcFreeCacheEntryList
NetpDcGetDcNext
NetpDcGetName
NetpDcGetNameIp
NetpDcGetNameNetbios
NetpDcGetNameSiteIp
NetpDcGetPingResponse
NetpDcHandlePingResponse
NetpDcInitializeContext
NetpDcInsertCacheEntry
NetpDcLogCache
NetpDcMatchResponse
NetpDcPackFilterBinary
NetpDcParsePingResponse
NetpDcPingListIp
NetpDcProcessAddressList
NetpDcUpdateDomainEntry
NetpDeleteGMSASecrets
NetpEnumerateServiceAccounts
NetpFetchLSASecretCredsEx
NetpGMSAAddWrapper
NetpGMSAGetPasswordWrapper
NetpGetAccountObject
NetpGetBetterDc
NetpGetGcUsingNetbios
NetpGetSecretName
NetpGetServiceAccountObject
NetpLdapBind
NetpLogLocatorDiscoveryOutcome
NetpLogonGetCutf8String
NetpProcessAccountName
NetpQueryDelegatedManagedServiceAccount
NetpQueryGroupManagedServiceAccount
NetpQueryServiceAccount
NetpQueryServiceAccount0
NetpQueryServiceAccountInfo0
NetpQueryServiceAccountInfo1
NetpRemoveServiceAccount
NetpServerPasswordSet
NetpSockAddrToStr
NetpSockAddrToWStr
NetpTriggerGlobalScavenger
NetpUpdateLSASecretCreds
NetpVerifyServiceAccount
NetrAddServiceAccount
NetrChainSetClientAttributes
NetrChainSetClientAttributes2
NetrEnumerateServiceAccounts
NetrEnumerateTrustedDomainsEx
NetrExtendMachinePasswordExpirationTimeout
NetrGetAnyDCName
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonComputeServerDigest
NetrLogonComputeServerSignature
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTrustRid
NetrLogonUasLogoff
NetrLogonUasLogon
NetrQuerySecureChannelDCInfo
NetrQueryServiceAccount
NetrRemoveServiceAccount
NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerQueryLocatorNameMappings
NetrServerReqChallenge
NetrServerRequestLocatorNameMappingsUpdate
NlAddServiceAccount
NlAesControl
NlAesInitialize
NlAllocateClientApi
NlAllocateClientSession
NlAssertFailed
NlBrowserClose
NlBrowserCreateEvent
NlBrowserDeviceIoControl
NlBrowserOpen
NlBrowserRenameDomain
NlBrowserSendDatagram
NlBrowserSyncHostedDomains
NlBrowserUpdate
NlBuildAuthData
NlBuildAuthenticator
NlCacheJoinDomainControllerInfo
NlChangeCachedPasswords
NlChangeLogWorker
NlChangePassword
NlChangePasswordHigher
NlCheckAuthenticator
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCloseChangeLog
NlComputeChallenge
NlComputeCredentials
NlComputeHMACMessageSignature
NlComputeMd5Digest
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlControlHandler
NlCrackSingleNameEx
NlCreateDomainPhase1
NlCreateNetlogonInterfaceSD
NlCreateShare
NlCreateSysvolShares
NlDecrypt
NlDecryptAes
NlDecryptRC4
NlDeleteBinaryLog
NlDnsAddUpdateRequest
NlDnsGetIpAddress
NlDnsHasDnsServers
NlDnsInitialize
NlDnsNameToStr
NlDnsNtdsDsaDeletion
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsSendRemoteUpdate
NlDnsServerFailureOutputCheck
NlDnsUpdateRequestWorker
NlDnsWriteLog
NlDoingSetup
NlEncrypt
NlEncryptAes
NlEncryptRC4
NlEndNetlogonCall
NlEnsureSessionAuthenticated
NlExit
NlFilterAndRegisterBindingHandles
NlFindDomainByServerName
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushNetbiosCacheName
NlFreeClientSession
NlGenerateRandomBits
NlGetDnsHostName
NlGetDomainName
NlGetIncomingPassword
NlGetKDFKey
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlGetMachineOs
NlGetNdncNames
NlGetNt4TrustedDomainList
NlGetOutgoingPassword
NlGetTrustedSideInfo
NlGetUserPriv
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInit
NlInitChangeLog
NlInitTcpRpc
NlInitTrustList
NlInitializeCNG
NlInitializeFallbackHandleScratchPad
NlInsertChallenge
NlInsertServerSession
NlJoinDCPingThread
NlMailslotOverlappedResult
NlMainLoop
NlMakeSessionKey
NlMatchDnsNamePrefix
NlNQMPowerStateChangeCallback
NlNetlogonMain
NlOpenDebugFile
NlOpenNetlogonKey
NlOpenSecret
NlParseSubnetString
NlPcDecrement32
NlPcIncrement32
NlPcIncrement64
NlPcReadCounter32
NlPcWriteCounter32
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPingDcNameWithContext
NlPingJoinDC
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutineV
NlPrintRpcDebug
NlPrintTrustedDomain
NlProvisionMachineAuthKey
NlQueryClientSiteFromAddressLookup
NlQueryClientSiteViaDNS
NlQueryClientSiteViaGetAddrInfo
NlQueueWorkItem
NlReadBinaryLog
NlReadDwordHklmRegValue
NlReadFileTrustedDomainList
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlReadPersitantTrustedDomainList
NlReadRegTrustedDomainList
NlRegisterAuthRpcServices
NlRegisterNQMNotifications
NlReparse
NlRpcGetClientIdentity
NlRpcGetClientInfo
NlRpcGetClientNetworkAddress
NlRpcSecurityCallback
NlSamChangePasswordNamedUser
NlSendChangeLogNotification
NlServerComputerNameAdd
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetClientAttributes
NlSetDnsForestName
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDsSPNWorker
NlSetDynamicSiteName
NlSetForestTrustList
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerClientSession
NlSetSiteName
NlSetStatusClientSession
NlSha256HmacInitializeEx
NlShouldFreeBindingHandle
NlSiteDeleteSubnetTree
NlSiteInitializationWrapper
NlSiteInitializeCallback
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesNeedPollISM
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartChangeLogWorkerThread
NlStartJoinDCPingThreadIfNecessary
NlTransportAddTransportName
NlTransportDisableTransportName
NlTransportGetIpAddress
NlTransportLookup
NlTransportOpen
NlUpdateCompoundIdentityEncTypes
NlUpdateCompoundIdentityEncTypesForSession
NlUpdateDnsRootAlias
NlUpdateDomainInfo
NlUpdatePrimaryDomainInfo
NlUpdateRemoteAccessCheckSecurityDescriptor
NlUpdateRpcSecurityDescriptor
NlUpdateSeed
NlUpdateServicedNdncs
NlUpdateVulnerableChannelAllowList
NlValidateAccountSidKerberos
NlValidateSiteName
NlVerifyNetworkUp
NlVerifyRpcIsSecured
NlVerifyRpcIsSecuredOld
NlWaitForSamService
NlWaitForService
NlWaitForSingleObject
NlWorkerKillThreads
NlWorkerThread
NlpAddResourceGroupsToSamInfo
NlpAuthzAccessCheck
NlpChainSetClientAttributes
NlpCreateAuthzContext
NlpDsNotPaused
NlpDumpBuffer
NlpDumpBufferDirect
NlpDumpGuid
NlpDumpPeriod
NlpDumpSid
NlpDumpTime
NlpEnumerateDomainTrusts
NlpExtractNtlmTargetInfo
NlpFreeNetlogonDllHandles
NlpGenerateIumBoundMachineAuthCert
NlpGenerateMachineKeyCertificateSubjectName
NlpGetAccountRid
NlpGetClientAddress
NlpGetForestTrustInfoHigher
NlpInitializeTrace
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpLogonSamLogon
NlpSignOrSeal
NlpStoreKeyInDS
NlpTraceEvent
NlpTraceServerAuthEvent
NlpUpdateFtinfo
NlpUserLogoffHigher
NlpUserValidate
NlpUserValidateHigher
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld
NlpVerifyAllowedToAuthenticate
NlpVerifyOrUnseal
NlpVerifyTargetServerRODCCachability
NlpWriteDiscoveryMachineEvent
NlpWriteDiscoveryTrustEvent
NlpWriteEventlogEx
NlpZeroBadPasswordCountLocally
Nlparse
NlparseAllSections
QueryContextAttributesW
QuerySecurityPackageInfoW
SealMessage
TransformKerberosTicketLogonInbound
TransformKerberosTicketLogonOutbound
TransformOneIdentityInbound
UnsealMessage
VerifySignature
|
Expand for full list:
AcceptSecurityContext
AcquireCredentialsHandleW
AllocateCredential
CheckDCLocatorRPCSecurityPolicyBypass
DeleteCredential
DeleteSecurityContext
DmsapParseAccountNames
DsIGetDcName
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
DsrDeregisterDnsHostRecordsDsrEnumerateDomainTrusts
DsrGetDcNameEx2
DsrGetSiteName
DsrUpdateReadOnlyServerDnsRecords
EnableMitigations
FreeCredentialsHandle
GiveInstallHints
I_NetLogonAppendChangeLog
I_NetLogonCloseChangeLog
I_NetLogonGetAuthDataEx
I_NetLogonGetSerialNumber
I_NetLogonLdapLookupEx
I_NetLogonNewChangeLog
I_NetLogonReadChangeLog
I_NetNotifyDsChange
I_NetNotifyNetlogonDllHandle
I_NetNotifyRole
I_NetNotifyTrustedDomain
InitSecurityInterfaceW
InitializeSecurityContextW
IsTicketLogonReplySupported
IsTicketLogonRequestSupported
KerbMapNtStatusToSecStatus
MakeSignature
NetIGetEncTypes
NetpAddServiceAccount
NetpAllocLowerCaseWStrFromWStr
NetpAllocUtf8StrFromUnicodeString
NetpCancelOutstandingRequests
NetpComputeMessageSignatures
NetpComputeNtOwfPasswords
NetpCreateDCInfoFromCacheEntry
NetpDcAllocateCacheEntry
NetpDcBuildRelativeDnsName
NetpDcCheckSiteCovered
NetpDcCreateDomainEntry
NetpDcDerefCacheEntry
NetpDcFindCacheEntry
NetpDcFindCacheEntryForDC
NetpDcFindDomainEntry
NetpDcFreeCacheEntryList
NetpDcGetDcNext
NetpDcGetName
NetpDcGetNameIp
NetpDcGetNameNetbios
NetpDcGetNameSiteIp
NetpDcGetPingResponse
NetpDcHandlePingResponse
NetpDcInitializeContext
NetpDcInsertCacheEntry
NetpDcLogCache
NetpDcMatchResponse
NetpDcPackFilterBinary
NetpDcParsePingResponse
NetpDcPingListIp
NetpDcProcessAddressList
NetpDcUpdateDomainEntry
NetpDeleteGMSASecrets
NetpEnumerateServiceAccounts
NetpFetchLSASecretCredsEx
NetpGMSAAddWrapper
NetpGMSAGetPasswordWrapper
NetpGetAccountObject
NetpGetBetterDc
NetpGetGcUsingNetbios
NetpGetSecretName
NetpGetServiceAccountObject
NetpLdapBind
NetpLogLocatorDiscoveryOutcome
NetpLogonGetCutf8String
NetpProcessAccountName
NetpQueryDelegatedManagedServiceAccount
NetpQueryGroupManagedServiceAccount
NetpQueryServiceAccount
NetpQueryServiceAccount0
NetpQueryServiceAccountInfo0
NetpQueryServiceAccountInfo1
NetpRemoveServiceAccount
NetpServerPasswordSet
NetpSockAddrToStr
NetpSockAddrToWStr
NetpTriggerGlobalScavenger
NetpUpdateLSASecretCreds
NetpVerifyServiceAccount
NetrAddServiceAccount
NetrChainSetClientAttributes
NetrChainSetClientAttributes2
NetrEnumerateServiceAccounts
NetrEnumerateTrustedDomainsEx
NetrExtendMachinePasswordExpirationTimeout
NetrGetAnyDCName
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonComputeServerDigest
NetrLogonComputeServerSignature
NetrLogonControl2Ex
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonGetTrustRid
NetrLogonUasLogoff
NetrLogonUasLogon
NetrQuerySecureChannelDCInfo
NetrQueryServiceAccount
NetrRemoveServiceAccount
NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerQueryLocatorNameMappings
NetrServerReqChallenge
NetrServerRequestLocatorNameMappingsUpdate
NlAddServiceAccount
NlAesControl
NlAesInitialize
NlAllocateClientApi
NlAllocateClientSession
NlAssertFailed
NlBrowserClose
NlBrowserCreateEvent
NlBrowserDeviceIoControl
NlBrowserOpen
NlBrowserRenameDomain
NlBrowserSendDatagram
NlBrowserSyncHostedDomains
NlBrowserUpdate
NlBuildAuthData
NlBuildAuthenticator
NlCacheJoinDomainControllerInfo
NlChangeCachedPasswords
NlChangeLogWorker
NlChangePassword
NlChangePasswordHigher
NlCheckAuthenticator
NlCheckPingedDcNextSiteCloseness
NlCleanup
NlCloseChangeLog
NlComputeChallenge
NlComputeCredentials
NlComputeHMACMessageSignature
NlComputeMd5Digest
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlControlHandler
NlCrackSingleNameEx
NlCreateDomainPhase1
NlCreateNetlogonInterfaceSD
NlCreateShare
NlCreateSysvolShares
NlDecrypt
NlDecryptAes
NlDecryptRC4
NlDeleteBinaryLog
NlDnsAddUpdateRequest
NlDnsGetIpAddress
NlDnsHasDnsServers
NlDnsInitialize
NlDnsNameToStr
NlDnsNtdsDsaDeletion
NlDnsRemoteScavenge
NlDnsScavenge
NlDnsScavengeWorker
NlDnsSendRemoteUpdate
NlDnsServerFailureOutputCheck
NlDnsUpdateRequestWorker
NlDnsWriteLog
NlDoingSetup
NlEncrypt
NlEncryptAes
NlEncryptRC4
NlEndNetlogonCall
NlEnsureSessionAuthenticated
NlExit
NlFilterAndRegisterBindingHandles
NlFindDomainByServerName
NlFindSiteEntryBySockAddrEx
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushNetbiosCacheName
NlFreeClientSession
NlGenerateRandomBits
NlGetDnsHostName
NlGetDomainName
NlGetIncomingPassword
NlGetKDFKey
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlGetMachineOs
NlGetNdncNames
NlGetNt4TrustedDomainList
NlGetOutgoingPassword
NlGetTrustedSideInfo
NlGetUserPriv
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInit
NlInitChangeLog
NlInitChangeLogServiceStart
NlInitTcpRpc
NlInitTrustList
NlInitializeCNG
NlInitializeFallbackHandleScratchPad
NlInsertChallenge
NlInsertServerSession
NlJoinDCPingThread
NlMailslotOverlappedResult
NlMainLoop
NlMakeSessionKey
NlMatchDnsNamePrefix
NlNQMPowerStateChangeCallback
NlNetlogonMain
NlOpenDebugFile
NlOpenNetlogonKey
NlOpenSecret
NlParseSubnetString
NlPcDecrement32
NlPcIncrement32
NlPcIncrement64
NlPcReadCounter32
NlPcWriteCounter32
NlPickDomainWithAccount
NlPickDomainWithAccountViaPing
NlPingDcNameWithContext
NlPingJoinDC
NlPrintCsRoutine
NlPrintDnsNameInfoRoutine
NlPrintDnsRoutine
NlPrintDomRoutine
NlPrintLogonParameters
NlPrintRoutineV
NlPrintRpcDebug
NlPrintTrustedDomain
NlProvisionMachineAuthKey
NlQueryClientSiteFromAddressLookup
NlQueryClientSiteViaDNS
NlQueryClientSiteViaGetAddrInfo
NlQueueWorkItem
NlReadBinaryLog
NlReadDwordHklmRegValue
NlReadFileTrustedDomainList
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlReadPersitantTrustedDomainList
NlReadRegTrustedDomainList
NlRegisterAuthRpcServices
NlRegisterNQMNotifications
NlReparse
NlRpcGetClientIdentity
NlRpcGetClientInfo
NlRpcGetClientNetworkAddress
NlRpcSecurityCallback
NlSamChangePasswordNamedUser
NlSendChangeLogNotification
NlServerComputerNameAdd
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetClientAttributes
NlSetDnsForestName
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDsSPNWorker
NlSetDynamicSiteName
NlSetForestTrustList
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerClientSession
NlSetSiteName
NlSetStatusClientSession
NlSha256HmacInitializeEx
NlShouldFreeBindingHandle
NlSiteDeleteSubnetTree
NlSiteInitializationWrapper
NlSiteInitializeCallback
NlSiteTerminate
NlSitesAddSubnet
NlSitesAddSubnetFromDs
NlSitesDerefSubnet
NlSitesEndSubnetEnum
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesNeedPollISM
NlSitesUpdateNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStartApiClientSession
NlStartChangeLogWorkerThread
NlStartJoinDCPingThreadIfNecessary
NlTransportAddTransportName
NlTransportDisableTransportName
NlTransportGetIpAddress
NlTransportLookup
NlTransportOpen
NlUpdateCompoundIdentityEncTypes
NlUpdateCompoundIdentityEncTypesForSession
NlUpdateDnsRootAlias
NlUpdateDomainInfo
NlUpdatePrimaryDomainInfo
NlUpdateRemoteAccessCheckSecurityDescriptor
NlUpdateRpcSecurityDescriptor
NlUpdateSeed
NlUpdateServicedNdncs
NlUpdateVulnerableChannelAllowList
NlValidateAccountSidKerberos
NlValidateSiteName
NlVerifyNetworkUp
NlVerifyRpcIsSecured
NlVerifyRpcIsSecuredOld
NlWaitForSamService
NlWaitForService
NlWaitForSingleObject
NlWorkerKillThreads
NlWorkerThread
NlpAddResourceGroupsToSamInfo
NlpAuthzAccessCheck
NlpChainSetClientAttributes
NlpCreateAuthzContext
NlpDsNotPaused
NlpDumpBuffer
NlpDumpBufferDirect
NlpDumpGuid
NlpDumpPeriod
NlpDumpSid
NlpDumpTime
NlpEnumerateDomainTrusts
NlpExtractNtlmTargetInfo
NlpFreeNetlogonDllHandles
NlpGenerateIumBoundMachineAuthCert
NlpGenerateMachineKeyCertificateSubjectName
NlpGetAccountRid
NlpGetClientAddress
NlpGetForestTrustInfoHigher
NlpInitializeTrace
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpLogonSamLogon
NlpSignOrSeal
NlpStoreKeyInDS
NlpTraceEvent
NlpTraceServerAuthEvent
NlpUpdateFtinfo
NlpUserLogoffHigher
NlpUserValidate
NlpUserValidateHigher
NlpValidateNTLMTargetInfo
NlpVerifyAllowedToAuthenticate
NlpVerifyOrUnseal
NlpVerifyTargetServerRODCCachability
NlpWriteDiscoveryMachineEvent
NlpWriteDiscoveryTrustEvent
NlpWriteEventlogEx
NlpZeroBadPasswordCountLocally
Nlparse
NlparseAllSections
QueryContextAttributesW
QuerySecurityPackageInfoW
SealMessage
TransformKerberosTicketLogonInbound
TransformKerberosTicketLogonOutbound
TransformOneIdentityInbound
UnsealMessage
VerifySignature
| |paramcount|4|4| |`address`|180005370|180005380| |sig|undefined __fastcall NlPrintRoutine(uint param_1, wchar_t * param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall NlPrintRoutine(uint param_1, wchar_t * param_2, undefined8 param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlPrintRoutine Calling Diff ```diff --- NlPrintRoutine calling +++ NlPrintRoutine calling @@ -15,0 +16 @@ +EnableMitigations @@ -204,0 +206 @@ +NlInitChangeLogServiceStart @@ -352 +353,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## NlpZeroBadPasswordCountLocally ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.86| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpZeroBadPasswordCountLocally|NlpZeroBadPasswordCountLocally| |fullname|NlpZeroBadPasswordCountLocally|NlpZeroBadPasswordCountLocally| |`refcount`|4|3| |length|359|359| |called|NlPrintRoutine
SAMSRV.DLL::SamIFreeSidAndAttributesList
SAMSRV.DLL::SamIFree_UserInternal6Information
SAMSRV.DLL::SamIGetUserLogonInformation2
SAMSRV.DLL::SamIUpdateLogonStatistics
SAMSRV.DLL::SamrCloseHandle
__security_check_cookie
memset|NlPrintRoutine
SAMSRV.DLL::SamIFreeSidAndAttributesList
SAMSRV.DLL::SamIFree_UserInternal6Information
SAMSRV.DLL::SamIGetUserLogonInformation2
SAMSRV.DLL::SamIUpdateLogonStatistics
SAMSRV.DLL::SamrCloseHandle
__security_check_cookie
memset| |calling|NlpUserValidate|NlpUserValidate| |paramcount|3|3| |`address`|18003bbcc|18003c41c| |sig|uint __fastcall NlpZeroBadPasswordCountLocally(longlong param_1, undefined8 param_2, char param_3)|uint __fastcall NlpZeroBadPasswordCountLocally(longlong param_1, undefined8 param_2, char param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|35|36| |length|0|0| |called||| |`calling`|
Expand for full list:
::
::
AdminConfiguredNameMappings::StaticSetCurrentMappings
DnsNetbiosNamePairTable::Insert
DnsNetbiosNamePairTable::~DnsNetbiosNamePairTable
FlushLookUpTableBucket
NetpDcGetName
NlCleanup
NlEndUpdateOperation
NlInitializeCacheInitOnceCallback
NlInitializeDomainNameMapperNlStartUpdateOperation
NlUninitializeDomainNameMapper
NlUninitializeLocatorConnectionCache
NlUpdateVulnerableChannelAllowList
NlpAuthzAccessCheck
NlpCreateAndAddCachedConnection
NlpReleaseCachedLocatorLdapConnectionWorker
ScannerInfoNameMappings::StaticSetCurrentMappings
TlgRegisterAggregateProviderEx
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
AdminConfiguredNameMappings::StaticSetCurrentMappings
DnsNetbiosNamePairTable::Insert
DnsNetbiosNamePairTable::~DnsNetbiosNamePairTable
FlushLookUpTableBucket
NetpDcGetName
NlCleanup
NlEndUpdateOperation
NlInitializeCacheInitOnceCallback
NlInitializeDomainNameMapperNlStartUpdateOperation
NlUninitializeDomainNameMapper
NlUninitializeLocatorConnectionCache
NlUpdateVulnerableChannelAllowList
NlpAuthzAccessCheck
NlpCreateAndAddCachedConnection
NlpReleaseCachedLocatorLdapConnectionWorker
ScannerInfoNameMappings::StaticSetCurrentMappings
TlgRegisterAggregateProviderEx
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|EXTERNAL:00000062|EXTERNAL:00000062| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -22,0 +23 @@ +wil::details::EnabledStateManager::ProcessShutdown ``` ## NTDLL.DLL::RtlInitUnicodeString ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|RtlInitUnicodeString|RtlInitUnicodeString| |fullname|NTDLL.DLL::RtlInitUnicodeString|NTDLL.DLL::RtlInitUnicodeString| |`refcount`|142|141| |length|0|0| |called||| |`calling`|
Expand for full list:
AvFlagsToString
DmsapParseAccountNames
DnsNetbiosNamePairAvlCompareByDnsDomainName
DnsNetbiosNamePairAvlCompareByNetbiosDomainName
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
DsrGetForestTrustInformation
DsrGetSiteName
I_NetLogonGetAuthDataEx
I_NetNotifyNtdsDsaDeletion
NetpCheckAccountSecretNetpComputeNtOwfPasswords
NetpCopyStrToWStr
NetpDeleteAccountSecret
NetpDeleteGMSASecrets
NetpFetchLSASecretCredsEx
NetpGenerateDefaultPassword
NetpGetSecretName
NetpLogonUnicodeToOem
NetpProcessAccountName
NetpQueryDelegatedManagedServiceAccount
NetpQueryServiceAccountInfo0
NetpQueryServiceAccountInfo1
NetpSetAccountSecret
NetpUpdateLSASecretCreds
NetrAddServiceAccount
NetrGetAnyDCName
NetrLogonControl2Ex
NetrLogonGetDomainInfo
NetrLogonUasLogon
NetrRemoveServiceAccount
NetrServerGetTrustInfo
NlAllocateForestTrustListEntry
NlBrowserAddDelName
NlBrowserClose
NlBrowserGetTransportList
NlBrowserOpen
NlBrowserOpenDriver
NlBrowserRenameDomain
NlBrowserSendDatagram
NlChangeCachedPasswords
NlChangePassword
NlCreateDomainPhase1
NlFindDomainByServerName
NlFindNetbiosDomain
NlFlushNetbiosCacheName
NlFreeComputerName
NlGetIncomingPassword
NlGetNt4TrustedDomainList
NlGetOutgoingPassword
NlInit
NlInsertServerSession
NlMainLoop
NlNetlogonMain
NlNotifyKerberosOfIpAddresses
NlOpenSecret
NlPickDomainWithAccount
NlQueryLogonSessions
NlSamChangePasswordNamedUser
NlSamOpenNamedUser
NlSamVerifyUserAccountEnabled
NlSendChangeLogNotification
NlServerComputerNameAdd
NlSetComputerName
NlSetDomainNameInDomainInfo
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlUpdateDomainInfo
NlUpdateForestTrustList
NlVerifyTrust
NlWaitForSamService
NlpCallNtLmPassthrough
NlpExtractNtlmTargetInfo
NlpInitNbDnsString
NlpLogonSamLogon
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpNtlmlessPrepNtlmSecuritySection
NlpPutString
NlpSamValidate
NlpUpdateFtinfo
NlpUserValidate
NlpValidateNTLMTargetInfoOld
NlpVerifyTargetServerRODCCachability
|
Expand for full list:
AvFlagsToString
DmsapParseAccountNames
DnsNetbiosNamePairAvlCompareByDnsDomainName
DnsNetbiosNamePairAvlCompareByNetbiosDomainName
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
DsrGetForestTrustInformation
DsrGetSiteName
I_NetLogonGetAuthDataEx
I_NetNotifyNtdsDsaDeletion
NetpCheckAccountSecretNetpComputeNtOwfPasswords
NetpCopyStrToWStr
NetpDeleteAccountSecret
NetpDeleteGMSASecrets
NetpFetchLSASecretCredsEx
NetpGenerateDefaultPassword
NetpGetSecretName
NetpLogonUnicodeToOem
NetpProcessAccountName
NetpQueryDelegatedManagedServiceAccount
NetpQueryServiceAccountInfo0
NetpQueryServiceAccountInfo1
NetpSetAccountSecret
NetpUpdateLSASecretCreds
NetrAddServiceAccount
NetrGetAnyDCName
NetrLogonControl2Ex
NetrLogonGetDomainInfo
NetrLogonUasLogon
NetrRemoveServiceAccount
NetrServerGetTrustInfo
NlAllocateForestTrustListEntry
NlBrowserAddDelName
NlBrowserClose
NlBrowserGetTransportList
NlBrowserOpen
NlBrowserOpenDriver
NlBrowserRenameDomain
NlBrowserSendDatagram
NlChangeCachedPasswords
NlChangePassword
NlCreateDomainPhase1
NlFindDomainByServerName
NlFindNetbiosDomain
NlFlushNetbiosCacheName
NlFreeComputerName
NlGetIncomingPassword
NlGetNt4TrustedDomainList
NlGetOutgoingPassword
NlInit
NlInsertServerSession
NlMainLoop
NlNetlogonMain
NlNotifyKerberosOfIpAddresses
NlOpenSecret
NlPickDomainWithAccount
NlQueryLogonSessions
NlSamChangePasswordNamedUser
NlSamOpenNamedUser
NlSamVerifyUserAccountEnabled
NlSendChangeLogNotification
NlServerComputerNameAdd
NlSetComputerName
NlSetDomainNameInDomainInfo
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerSessionAttributesByTdoName
NlSetSiteName
NlUpdateDomainInfo
NlUpdateForestTrustList
NlVerifyTrust
NlWaitForSamService
NlpCallNtLmPassthrough
NlpExtractNtlmTargetInfo
NlpInitNbDnsString
NlpLogonSamLogon
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpNtlmlessPrepNtlmSecuritySection
NlpPutString
NlpSamValidate
NlpUpdateFtinfo
NlpUserValidate
NlpVerifyTargetServerRODCCachability
| |paramcount|0|0| |`address`|EXTERNAL:000001a9|EXTERNAL:000001aa| |sig|undefined RtlInitUnicodeString(void)|undefined RtlInitUnicodeString(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### NTDLL.DLL::RtlInitUnicodeString Calling Diff ```diff --- NTDLL.DLL::RtlInitUnicodeString calling +++ NTDLL.DLL::RtlInitUnicodeString calling @@ -86 +85,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## __security_check_cookie ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|229|228| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
AcceptSecurityContext
AdminConfiguredNameMappings::StaticQueryHelper
AdminConfiguredNameMappings::StaticRefreshIfNecessary
AvFlagsToString
BuildSamLogonResponse
BuildSamLogonResponseEx
CheckDCLocatorRPCSecurityPolicyBypass
ComputeFlushPeriod
DosGetMessage
DsrAddressToSiteNamesExW
DsrGetDcNameEx2I_ISMBind
I_NetLogonLdapLookupEx
I_NetLogonSendToSamOnDc
I_NetNotifyMachineAccount
InitializeSecurityContextW
InternalVerifyStackAvailable
LogonRequestHandler
LookUpTableFlushComplete
McTemplateU0q_EtwEventWriteTransfer
McTemplateU0qz_EtwEventWriteTransfer
McTemplateU0sqzk_EtwEventWriteTransfer
McTemplateU0z_EtwEventWriteTransfer
McTemplateU0zq_EtwEventWriteTransfer
McTemplateU0zzq_EtwEventWriteTransfer
McTemplateU0zzz_EtwEventWriteTransfer
McTemplateU0zzzzq_EtwEventWriteTransfer
McTemplateU0zzzzzzzzzzzzzdzdq_EtwEventWriteTransfer
McTemplateU0zzzzzzzzzzzzzzzdzdq_EtwEventWriteTransfer
NetpAccessCheck2
NetpCreateDCInfoFromCacheEntry
NetpCreateServiceAccount
NetpDcGetDcNext
NetpDcGetNameIp
NetpDcGetNameSiteIp
NetpDcHandlePingResponse
NetpDcInitializeContext
NetpDcPackFilterBinary
NetpDcParsePingResponse
NetpEventlogWriteEx3
NetpGetAccountObject
NetpGetSecretName
NetpGetWinRegConfigMaxSizes
NetpIpAddressToWStr
NetpIsServiceStarted
NetpLogonCreateRandomMailslot
NetpLogonGetCutf8String
NetpServerPasswordSet
NetpSetAccountPassword
NetpSetAccountSecret
NetpSrvOpen
NetpUpdateLSASecretCreds
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonComputeServerDigest
NetrLogonComputeServerSignature
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonSendToSam
NetrLogonUasLogon
NetrQuerySecureChannelDCInfo
NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerGetTrustInfo
NetrServerPasswordGet
NetrServerReqChallenge
NlAesControl
NlBrowserAddName
NlBrowserClose
NlBrowserGetTransportList
NlBrowserOpen
NlBrowserRenameDomain
NlBrowserSendDatagram
NlBrowserSendDatagramA
NlBrowserSyncHostedDomains
NlChangeCachedPasswords
NlChangePassword
NlChangePasswordHigher
NlCheckAuthenticator
NlCheckPingedDcNextSiteCloseness
NlComputeCredentials
NlComputeHMACMessageSignature
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlCreateNetlogonInterfaceSD
NlCreateNetlogonObjects
NlCreateShare
NlDcScavenger
NlDeleteBinaryLog
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddDomainRecordsWithSiteRefresh
NlDnsAddName
NlDnsAllocateEntry
NlDnsBuildName
NlDnsNameToStr
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsNtdsDsaDeletion
NlDnsRemoteScavenge
NlDnsSendRemoteUpdate
NlDnsUpdate
NlDnsUpdateRequestWorker
NlDnsWriteLog
NlEqualDnsNameUtf8CaseSensitive
NlFilterAndRegisterBindingHandles
NlFindNamedServerSession
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushNetbiosCacheName
NlFreeServerSessionForAccount
NlGetDnsHostName
NlGetIncomingPassword
NlGetKDFKey
NlGetKnownDomainNamePairs
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInit
NlInitTcpRpc
NlInitializeDomainNameMapper
NlInitializeDomains
NlInsertServerSession
NlLogTimeoutRecurringEvents
NlMainLoop
NlMakeSessionKey
NlOpenDebugFile
NlParseOne
NlParseOnePath
NlParseSubnetString
NlParseTStr
NlPickDomainWithAccount
NlPingDcName
NlPrintRoutineV
NlPrintRpcDebug
NlQueryClientSiteViaDNS
NlReadBinaryLog
NlRemoveChallengeForClient
NlReparse
NlRpcSecurityCallback
NlSamChangePasswordNamedUser
NlScavengeOldChallenges
NlSearchClientAddrsForSiteMapping
NlServerComputerNameAdd
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSessionSetupEx
NlSetClientAttributes
NlSetDsSPN
NlSetDsSPNWorker
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSha256HmacFinalize
NlSitesDerefSubnet
NlSitesGetNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlTimeoutOneApiClientSession
NlTransportAddTransportName
NlTransportGetIpAddress
NlTransportLookup
NlUpdateDomainInfo
NlUpdatePrimaryDomainInfo
NlUpdateRole
NlUpdateSeed
NlUpdateTrustList
NlVerifyTrust
NlWaitForService
NlWriteRpcBacklogLimitEvent
NlpChainSetClientAttributes
NlpCompareUtf8
NlpCreateAndAddCachedConnection
NlpDecryptLogonInformation
NlpDecryptValidationInformation
NlpDumpBuffer
NlpDumpBufferDirect
NlpDumpTime
NlpEncryptLogonInformation
NlpEncryptValidationInformation
NlpGetAccountRid
NlpGetClientAddress
NlpGetForestTrustInfoHigher
NlpInitializeTrace
NlpLogFilterInboundNamespaceBlockEventWorker
NlpLogFilterInboundNamespaceSummaryEventsIfNecessary
NlpLogRc4Usage
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpLogonSamLogon
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpReleaseCachedLocatorLdapConnectionWorker
NlpSamValidate
NlpSignOrSeal
NlpStoreKeyInDS
NlpTraceServerAuthEvent
NlpUserLogoffHigher
NlpUserValidateHigher
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld
NlpVerifyOrUnseal
NlpVerifyTargetServerRODCCachability
NlpWriteDiscoveryMachineEvent
NlpWriteDiscoveryTrustEvent
NlpZeroBadPasswordCountLocally
Nlparse
ScannerInfoNameMappings::StaticQueryHelper
ScannerInfoNameMappings::StaticRefreshIfNecessary
TraceLoggingRegisterEx_EventRegister_EventSetInformation
__GSHandlerCheckCommon
_resetstkoflw_static
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil::GetFailureLogString
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
|
Expand for full list:
AcceptSecurityContext
AdminConfiguredNameMappings::StaticQueryHelper
AdminConfiguredNameMappings::StaticRefreshIfNecessary
AvFlagsToString
BuildSamLogonResponse
BuildSamLogonResponseEx
CheckDCLocatorRPCSecurityPolicyBypass
ComputeFlushPeriod
DosGetMessage
DsrAddressToSiteNamesExW
DsrGetDcNameEx2I_ISMBind
I_NetLogonLdapLookupEx
I_NetLogonSendToSamOnDc
I_NetNotifyMachineAccount
InitializeSecurityContextW
InternalVerifyStackAvailable
LogonRequestHandler
LookUpTableFlushComplete
McTemplateU0q_EtwEventWriteTransfer
McTemplateU0qz_EtwEventWriteTransfer
McTemplateU0sqzk_EtwEventWriteTransfer
McTemplateU0z_EtwEventWriteTransfer
McTemplateU0zq_EtwEventWriteTransfer
McTemplateU0zzq_EtwEventWriteTransfer
McTemplateU0zzz_EtwEventWriteTransfer
McTemplateU0zzzzq_EtwEventWriteTransfer
McTemplateU0zzzzzzzzzzzzzdzdq_EtwEventWriteTransfer
McTemplateU0zzzzzzzzzzzzzzzdzdq_EtwEventWriteTransfer
NetpAccessCheck2
NetpCreateDCInfoFromCacheEntry
NetpCreateServiceAccount
NetpDcGetDcNext
NetpDcGetNameIp
NetpDcGetNameSiteIp
NetpDcHandlePingResponse
NetpDcInitializeContext
NetpDcPackFilterBinary
NetpDcParsePingResponse
NetpEventlogWriteEx3
NetpGetAccountObject
NetpGetSecretName
NetpGetWinRegConfigMaxSizes
NetpIpAddressToWStr
NetpIsServiceStarted
NetpLogonCreateRandomMailslot
NetpLogonGetCutf8String
NetpServerPasswordSet
NetpSetAccountPassword
NetpSetAccountSecret
NetpSrvOpen
NetpUpdateLSASecretCreds
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonComputeServerDigest
NetrLogonComputeServerSignature
NetrLogonGetCapabilities
NetrLogonGetDomainInfo
NetrLogonSendToSam
NetrLogonUasLogon
NetrQuerySecureChannelDCInfo
NetrServerAuthenticate3
NetrServerAuthenticateKerberos
NetrServerGetTrustInfo
NetrServerPasswordGet
NetrServerReqChallenge
NlAesControl
NlBrowserAddName
NlBrowserClose
NlBrowserGetTransportList
NlBrowserOpen
NlBrowserRenameDomain
NlBrowserSendDatagram
NlBrowserSendDatagramA
NlBrowserSyncHostedDomains
NlChangeCachedPasswords
NlChangePassword
NlChangePasswordHigher
NlCheckAuthenticator
NlCheckPingedDcNextSiteCloseness
NlComputeCredentials
NlComputeHMACMessageSignature
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlCreateNetlogonInterfaceSD
NlCreateNetlogonObjects
NlCreateShare
NlDcScavenger
NlDeleteBinaryLog
NlDiscoverDc
NlDnsAddDomainRecords
NlDnsAddDomainRecordsWithSiteRefresh
NlDnsAddName
NlDnsAllocateEntry
NlDnsBuildName
NlDnsNameToStr
NlDnsNtdsDsaDeleteARecord
NlDnsNtdsDsaDeleteOne
NlDnsNtdsDsaDeletion
NlDnsRemoteScavenge
NlDnsSendRemoteUpdate
NlDnsUpdate
NlDnsUpdateRequestWorker
NlDnsWriteLog
NlEqualDnsNameUtf8CaseSensitive
NlFilterAndRegisterBindingHandles
NlFindNamedServerSession
NlFindSubnetEntry
NlFinishApiClientSession
NlFlushNetbiosCacheName
NlFreeServerSessionForAccount
NlGetDnsHostName
NlGetIncomingPassword
NlGetKDFKey
NlGetKnownDomainNamePairs
NlGetLocalPingResponse
NlGetLocatorLdapConnection
NlGetTrustedSideInfo
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInit
NlInitTcpRpc
NlInitializeDomainNameMapper
NlInitializeDomains
NlInsertServerSession
NlLogTimeoutRecurringEvents
NlMainLoop
NlMakeSessionKey
NlOpenDebugFile
NlParseOne
NlParseOnePath
NlParseSubnetString
NlParseTStr
NlPickDomainWithAccount
NlPingDcName
NlPrintRoutineV
NlPrintRpcDebug
NlQueryClientSiteViaDNS
NlReadBinaryLog
NlRemoveChallengeForClient
NlReparse
NlRpcSecurityCallback
NlSamChangePasswordNamedUser
NlScavengeOldChallenges
NlSearchClientAddrsForSiteMapping
NlServerComputerNameAdd
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSessionSetupEx
NlSetClientAttributes
NlSetDsSPN
NlSetDsSPNWorker
NlSetIncomingPassword
NlSetNamesClientSession
NlSetOutgoingPassword
NlSha256HmacFinalize
NlSitesDerefSubnet
NlSitesGetNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlTimeoutOneApiClientSession
NlTransportAddTransportName
NlTransportGetIpAddress
NlTransportLookup
NlUpdateDomainInfo
NlUpdatePrimaryDomainInfo
NlUpdateRole
NlUpdateSeed
NlUpdateTrustList
NlVerifyTrust
NlWaitForService
NlWriteRpcBacklogLimitEvent
NlpChainSetClientAttributes
NlpCompareUtf8
NlpCreateAndAddCachedConnection
NlpDecryptLogonInformation
NlpDecryptValidationInformation
NlpDumpBuffer
NlpDumpBufferDirect
NlpDumpTime
NlpEncryptLogonInformation
NlpEncryptValidationInformation
NlpGetAccountRid
NlpGetClientAddress
NlpGetForestTrustInfoHigher
NlpInitializeTrace
NlpLogFilterInboundNamespaceBlockEventWorker
NlpLogFilterInboundNamespaceSummaryEventsIfNecessary
NlpLogRc4Usage
NlpLogRpcSigningClient
NlpLogRpcSigningTrust
NlpLogonSamLogon
NlpNtlmlessLogAccountDomain
NlpNtlmlessLogServerDomain
NlpReleaseCachedLocatorLdapConnectionWorker
NlpSamValidate
NlpSignOrSeal
NlpStoreKeyInDS
NlpTraceServerAuthEvent
NlpUserLogoffHigher
NlpUserValidateHigher
NlpValidateNTLMTargetInfo
NlpVerifyOrUnseal
NlpVerifyTargetServerRODCCachability
NlpWriteDiscoveryMachineEvent
NlpWriteDiscoveryTrustEvent
NlpZeroBadPasswordCountLocally
Nlparse
ScannerInfoNameMappings::StaticQueryHelper
ScannerInfoNameMappings::StaticRefreshIfNecessary
TraceLoggingRegisterEx_EventRegister_EventSetInformation
__GSHandlerCheckCommon
_resetstkoflw_static
_tlgWriteTemplate::Write,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>_>
wil::GetFailureLogString
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
| |paramcount|1|1| |`address`|180023920|180023970| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -202 +201,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## RtlStringCchCopyW ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.85| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|RtlStringCchCopyW|RtlStringCchCopyW| |fullname|RtlStringCchCopyW|RtlStringCchCopyW| |`refcount`|5|3| |length|105|105| |called||| |`calling`|NetpDcCreateDomainEntry
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NetpDcCreateDomainEntry
NlpValidateNTLMTargetInfo| |paramcount|3|3| |`address`|18003bdd4|18003c624| |sig|uint __fastcall RtlStringCchCopyW(short * param_1, longlong param_2, longlong param_3)|uint __fastcall RtlStringCchCopyW(short * param_1, longlong param_2, longlong param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### RtlStringCchCopyW Calling Diff ```diff --- RtlStringCchCopyW calling +++ RtlStringCchCopyW calling @@ -3 +2,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|16|17| |length|29|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlushwil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChangeswil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|180071d80|180071c50| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -4,0 +5 @@ +wil::details::EnabledStateManager::ProcessShutdown ``` ## NlpLogFilterInboundNamespaceBlockEvent ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.79| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpLogFilterInboundNamespaceBlockEvent|NlpLogFilterInboundNamespaceBlockEvent| |fullname|NlpLogFilterInboundNamespaceBlockEvent|NlpLogFilterInboundNamespaceBlockEvent| |`refcount`|5|3| |length|130|130| |called|NlpLogFilterInboundNamespaceBlockEventWorker
NlpLogFilterInboundNamespaceSummaryEventsIfNecessary|NlpLogFilterInboundNamespaceBlockEventWorker
NlpLogFilterInboundNamespaceSummaryEventsIfNecessary| |`calling`|NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NlpValidateNTLMTargetInfo| |paramcount|6|6| |`address`|18003852c|18003919c| |sig|undefined __fastcall NlpLogFilterInboundNamespaceBlockEvent(LPCWSTR param_1, longlong param_2, undefined8 param_3, int param_4, int param_5, longlong param_6)|undefined __fastcall NlpLogFilterInboundNamespaceBlockEvent(LPCWSTR param_1, longlong param_2, undefined8 param_3, int param_4, int param_5, longlong param_6)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpLogFilterInboundNamespaceBlockEvent Calling Diff ```diff --- NlpLogFilterInboundNamespaceBlockEvent calling +++ NlpLogFilterInboundNamespaceBlockEvent calling @@ -2 +1,0 @@ -NlpValidateNTLMTargetInfoOld ``` ## FreeValidationInformation ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|FreeValidationInformation|FreeValidationInformation| |fullname|FreeValidationInformation|FreeValidationInformation| |`refcount`|6|4| |length|40|40| |called|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
FreeTicketValidationInformation|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalFree
FreeTicketValidationInformation| |calling|NlpLogonSamLogon
NlpUserValidate|NlpLogonSamLogon
NlpUserValidate| |paramcount|2|2| |`address`|180035b4c|1800367b4| |sig|undefined __fastcall FreeValidationInformation(HLOCAL param_1, int param_2)|undefined __fastcall FreeValidationInformation(HLOCAL param_1, int param_2)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## DNSAPI.DLL::DnsNameCompare_UTF8 ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|DnsNameCompare_UTF8|DnsNameCompare_UTF8| |fullname|DNSAPI.DLL::DnsNameCompare_UTF8|DNSAPI.DLL::DnsNameCompare_UTF8| |`refcount`|6|9| |length|0|0| |called||| |`calling`|NetpSrvProcessARecords
NlEqualDnsNameUtf8
NlGetTrustedDomainNames
NlpUserValidate|NetpSrvProcessARecords
NlEqualDnsNameUtf8
NlGetLocalPingResponse
NlGetTrustedDomainNames
NlpUserValidate| |paramcount|0|0| |`address`|EXTERNAL:000001c9|EXTERNAL:000001ca| |sig|undefined DnsNameCompare_UTF8(void)|undefined DnsNameCompare_UTF8(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### DNSAPI.DLL::DnsNameCompare_UTF8 Calling Diff ```diff --- DNSAPI.DLL::DnsNameCompare_UTF8 calling +++ DNSAPI.DLL::DnsNameCompare_UTF8 calling @@ -2,0 +3 @@ +NlGetLocalPingResponse ``` ## NlPrintCsRoutine ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.64| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlPrintCsRoutine|NlPrintCsRoutine| |fullname|NlPrintCsRoutine|NlPrintCsRoutine| |`refcount`|193|192| |length|186|186| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlPrintRoutine
NlPrintRoutineV|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlPrintRoutine
NlPrintRoutineV| |calling|
Expand for full list:
DsrEnumerateDomainTrusts
DsrGetForestTrustInformation
DsrGetSiteName
I_NetLogonGetAuthDataEx
I_NetLogonSendToSamOnDc
NetrGetAnyDCName
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonControl2Ex
NetrLogonGetTrustRid
NetrLogonSamLogoffNlAllocateClientApi
NlChangePassword
NlChangePasswordHigher
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDiscoverDc
NlDnsSendRemoteUpdate
NlDomainScavenger
NlEnsureSessionAuthenticated
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFreeClientApi
NlGetAnyDCName
NlGetOutgoingPassword
NlGetTrustedSideInfo
NlInitTrustList
NlPickDomainWithAccountViaPing
NlPingDcName
NlPreparePingContext
NlResetWriterClientSession
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetClientAttributes
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerClientSession
NlSetStatusClientSession
NlStartApiClientSession
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlUpdateDomainInfo
NlUpdateForestTrustList
NlUpdateTrustList
NlVerifyTrust
NlpGetForestTrustInfoHigher
NlpSecureChannelUnbind
NlpUserLogoffHigher
NlpUserValidate
NlpUserValidateHigher
|
Expand for full list:
DsrEnumerateDomainTrusts
DsrGetForestTrustInformation
DsrGetSiteName
I_NetLogonGetAuthDataEx
I_NetLogonSendToSamOnDc
NetrGetAnyDCName
NetrLogonComputeClientDigest
NetrLogonComputeClientSignature
NetrLogonControl2Ex
NetrLogonGetTrustRid
NetrLogonSamLogoffNlAllocateClientApi
NlChangePassword
NlChangePasswordHigher
NlConfirmNegotiatedCapabilities
NlConfirmRequestedCapabilities
NlDcDiscoveryWorker
NlDcQueueDiscovery
NlDiscoverDc
NlDnsSendRemoteUpdate
NlDomainScavenger
NlEnsureSessionAuthenticated
NlFinishApiClientSession
NlFlushCacheOnPnpWorker
NlFreeClientApi
NlGetAnyDCName
NlGetOutgoingPassword
NlGetTrustedSideInfo
NlInitTrustList
NlPickDomainWithAccountViaPing
NlPingDcName
NlPreparePingContext
NlResetWriterClientSession
NlSessionAuthenticationNetlogon
NlSessionSetup
NlSetClientAttributes
NlSetNamesClientSession
NlSetOutgoingPassword
NlSetServerClientSession
NlSetStatusClientSession
NlStartApiClientSession
NlTimeoutOneApiClientSession
NlTimeoutSetWriterClientSession
NlUpdateDomainInfo
NlUpdateForestTrustList
NlUpdateTrustList
NlVerifyTrust
NlpGetForestTrustInfoHigher
NlpSecureChannelUnbind
NlpUserLogoffHigher
NlpUserValidate
NlpUserValidateHigher
| |paramcount|4|4| |`address`|180014b1c|18001459c| |sig|undefined __fastcall NlPrintCsRoutine(uint param_1, longlong param_2, wchar_t * param_3, undefined8 param_4)|undefined __fastcall NlPrintCsRoutine(uint param_1, longlong param_2, wchar_t * param_3, undefined8 param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## NlFindDnsDomain ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.66| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlFindDnsDomain|NlFindDnsDomain| |fullname|NlFindDnsDomain|NlFindDnsDomain| |`refcount`|5|4| |length|400|400| |called|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlEqualDnsNameUtf8
memcmp|NTDLL.DLL::RtlEnterCriticalSection
NTDLL.DLL::RtlLeaveCriticalSection
NlEqualDnsNameUtf8
memcmp| |`calling`|AcceptSecurityContext
NlCreateDomainPhase1
NlFindDomain
NlGetLocalPingResponse|AcceptSecurityContext
NlCreateDomainPhase1
NlFindDomain| |paramcount|5|5| |`address`|18002ee84|18002fb74| |sig|undefined8 * __fastcall NlFindDnsDomain(longlong param_1, void * param_2, char param_3, char param_4, undefined1 * param_5)|undefined8 * __fastcall NlFindDnsDomain(longlong param_1, void * param_2, char param_3, char param_4, undefined1 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlFindDnsDomain Calling Diff ```diff --- NlFindDnsDomain calling +++ NlFindDnsDomain calling @@ -4 +3,0 @@ -NlGetLocalPingResponse ``` ## wil_details_IsEnabledFallback ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback| |`refcount`|7|8| |length|140|140| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |`calling`|Feature_32366904__private_IsEnabledDeviceUsageNoInline
Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline
Feature_NetlogonLongPassword__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_MSRC95894PolicyModeNeeded__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_PostRelPACValidationFailsOnRODC__private_IsEnabledDeviceUsageNoInline|Feature_32366904__private_IsEnabledDeviceUsageNoInline
Feature_5977_1413__private_IsEnabledDeviceUsageNoInline
Feature_6086_9425__private_IsEnabledDeviceUsageNoInline
Feature_740537659__private_IsEnabledDeviceUsageNoInline
Feature_ChangeMachinePasswordViaKerb__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_MSRC95894PolicyModeNeeded__private_IsEnabledDeviceUsageNoInline
Feature_Servicing_RedirectionGuard_Netlogon__private_IsEnabledDeviceUsageNoInline| |paramcount|3|3| |`address`|18003c6c4|18002eec4| |sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil_details_IsEnabledFallback Calling Diff ```diff --- wil_details_IsEnabledFallback calling +++ wil_details_IsEnabledFallback calling @@ -1,0 +2,3 @@ +Feature_5977_1413__private_IsEnabledDeviceUsageNoInline +Feature_6086_9425__private_IsEnabledDeviceUsageNoInline +Feature_740537659__private_IsEnabledDeviceUsageNoInline @@ -3 +5,0 @@ -Feature_NetlogonLongPassword__private_IsEnabledDeviceUsageNoInline @@ -5,2 +7 @@ -Feature_Servicing_NtlmlessAudit__private_IsEnabledDeviceUsageNoInline -Feature_Servicing_PostRelPACValidationFailsOnRODC__private_IsEnabledDeviceUsageNoInline +Feature_Servicing_RedirectionGuard_Netlogon__private_IsEnabledDeviceUsageNoInline ``` ## API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|LocalAlloc|LocalAlloc| |fullname|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc|API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc| |`refcount`|221|222| |length|0|0| |called||| |`calling`|
Expand for full list:
AllocateContext
AllocateCredential
AvFlagsToString
DmsapParseAccountNames
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
I_NetLogonAddressToSiteName
I_NetLogonSendToSamOnDc
NetpAllocateEnumBufferEx
NetpBuildRecordFromBinary
NetpComputeMessageSignaturesNetpConcatenate
NetpConvertUTF8ToUnicode
NetpCopyFtinfoContext2
NetpCreateUtf8StrFromWStr
NetpDcAllocateCacheEntry
NetpDcBuildLdapFilter
NetpDcCreateDomainEntry
NetpDcGetDcOpen
NetpDcGetName
NetpDcGetNameSiteIp
NetpDcInitializeContext
NetpDcPackFilterBinary
NetpDcPackFilterString
NetpDcProcessAddressList
NetpEventlogOpen
NetpEventlogWriteEx3
NetpGetSecretName
NetpGrowLdapMsgIdArrayIfNecessary
NetpLogonGetCutf8String
NetpProcessAccountName
NetpRetrieveNtOwfPasswordHashes
NetpSrvNextEx
NetpSrvOpen
NetpSrvProcessARecords
NetpSrvProcessAllRecords
NetpUnmarshalSid
NetpUnmarshalString
NetpUnmarshalUnicodeString
NetrLogonControl2Ex
NetrLogonGetDomainInfo
NetrLogonUasLogon
NlAesInitialize
NlAllocOneDomainInfo
NlAllocStringFromWStr
NlAllocateClientSession
NlBrowserDeviceControlGetInfo
NlBrowserSendDatagram
NlBuildAuthData
NlChangePassword
NlComputeCredentials
NlComputeHMACMessageSignature
NlCreateDomainPhase1
NlCreateSysvolShares
NlDnsAddDomainRecords
NlDnsAddDomainRecordsWithSiteRefresh
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsGetIpAddress
NlDnsNameToWStr
NlDnsNtdsDsaDeletion
NlDnsWriteBinaryLog
NlDuplicateUnicodeString
NlEqualDnsNameU
NlFindSiteEntry
NlFindSubnetEntry
NlGetDomainName
NlGetIncomingPassword
NlGetNdncNames
NlGetOutgoingPassword
NlGetTrustedDomainNames
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitializeFallbackHandleScratchPad
NlInsertChallenge
NlJoinDCPingThread
NlLocalAllocWStrFromString
NlMakeSessionKey
NlMatchDnsNamePrefix
NlMidlAllocateString
NlOpenSecret
NlParseSubnetString
NlPickDomainWithAccountViaPing
NlPingDcName
NlPrintRoutineV
NlReadBinaryLog
NlReadFileTrustedDomainList
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDsSPNWorker
NlSetNamesClientSession
NlSetStatusClientSession
NlSha256HmacInitializeEx
NlSitesAddSubnet
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStrArrayAppendStr
NlStrArrayToCommaList
NlTransportAddTransportName
NlUpdateDnsRootAlias
NlUpdateRpcSecurityDescriptor
NlUpdateServicedNdncs
NlUpdateTrustList
NlValidateAccountSidKerberos
NlVerifyTrust
NlWaitForService
NlWriteBinaryLog
NlWriteBinaryLogEx
NlWriteFileForestTrustListEx
NlpAddResourceGroupsToSamInfo
NlpBuildPacSidList
NlpChainSetClientAttributes
NlpCopySid
NlpCopyUnicodeString
NlpCreateAuthzContext
NlpEnumerateDomainTrusts
NlpRemoveBadPasswordCacheEntry
NlpResetBadPwdCountOnPdc
NlpUserValidate
NlpUserValidateOnDc
NlpUtf8ToCutf8
QueryContextAttributesW
QuerySecurityPackageInfoW
|
Expand for full list:
AllocateContext
AllocateCredential
AvFlagsToString
DmsapParseAccountNames
DsrAddressToSiteNamesExW
DsrAddressToSiteNamesW
I_NetLogonAddressToSiteName
I_NetLogonSendToSamOnDc
NetpAllocateEnumBufferEx
NetpBuildRecordFromBinary
NetpComputeMessageSignaturesNetpConcatenate
NetpConvertUTF8ToUnicode
NetpCopyFtinfoContext2
NetpCreateUtf8StrFromWStr
NetpDcAllocateCacheEntry
NetpDcBuildLdapFilter
NetpDcCreateDomainEntry
NetpDcGetDcOpen
NetpDcGetName
NetpDcGetNameSiteIp
NetpDcInitializeContext
NetpDcPackFilterBinary
NetpDcPackFilterString
NetpDcProcessAddressList
NetpEventlogOpen
NetpEventlogWriteEx3
NetpGetSecretName
NetpGrowLdapMsgIdArrayIfNecessary
NetpLogonGetCutf8String
NetpProcessAccountName
NetpRetrieveNtOwfPasswordHashes
NetpSrvNextEx
NetpSrvOpen
NetpSrvProcessARecords
NetpSrvProcessAllRecords
NetpUnmarshalSid
NetpUnmarshalString
NetpUnmarshalUnicodeString
NetrLogonControl2Ex
NetrLogonGetDomainInfo
NetrLogonUasLogon
NlAesInitialize
NlAllocOneDomainInfo
NlAllocStringFromWStr
NlAllocateClientSession
NlBrowserDeviceControlGetInfo
NlBrowserSendDatagram
NlBuildAuthData
NlChangePassword
NlComputeCredentials
NlComputeHMACMessageSignature
NlCreateDomainPhase1
NlCreateSysvolShares
NlDnsAddDomainRecords
NlDnsAddDomainRecordsWithSiteRefresh
NlDnsAddUpdateRequest
NlDnsAllocateEntry
NlDnsGetIpAddress
NlDnsNameToWStr
NlDnsNtdsDsaDeletion
NlDnsWriteBinaryLog
NlDuplicateUnicodeString
NlEqualDnsNameU
NlFindSiteEntry
NlFindSubnetEntry
NlGetDomainName
NlGetIncomingPassword
NlGetLocalPingResponse
NlGetNdncNames
NlGetOutgoingPassword
NlGetTrustedDomainNames
NlHandleV6WsaPnp
NlHandleWsaPnp
NlInitializeFallbackHandleScratchPad
NlInsertChallenge
NlJoinDCPingThread
NlLocalAllocWStrFromString
NlMakeSessionKey
NlMatchDnsNamePrefix
NlMidlAllocateString
NlOpenSecret
NlParseSubnetString
NlPickDomainWithAccountViaPing
NlPingDcName
NlPrintRoutineV
NlReadBinaryLog
NlReadFileTrustedDomainList
NlReadIPV4RegSocketAddressList
NlReadIPV6RegSocketAddressList
NlSetDomainNameInDomainInfo
NlSetDsSPN
NlSetDsSPNWorker
NlSetNamesClientSession
NlSetStatusClientSession
NlSha256HmacInitializeEx
NlSitesAddSubnet
NlSitesGetCloseSites
NlSitesGetIsmConnect
NlSitesGetNextClosestSites
NlSitesUpdateSiteCoverageForRole
NlStrArrayAppendStr
NlStrArrayToCommaList
NlTransportAddTransportName
NlUpdateDnsRootAlias
NlUpdateRpcSecurityDescriptor
NlUpdateServicedNdncs
NlUpdateTrustList
NlValidateAccountSidKerberos
NlVerifyTrust
NlWaitForService
NlWriteBinaryLog
NlWriteBinaryLogEx
NlWriteFileForestTrustListEx
NlpAddResourceGroupsToSamInfo
NlpBuildPacSidList
NlpChainSetClientAttributes
NlpCopySid
NlpCopyUnicodeString
NlpCreateAuthzContext
NlpEnumerateDomainTrusts
NlpRemoveBadPasswordCacheEntry
NlpResetBadPwdCountOnPdc
NlpUserValidate
NlpUserValidateOnDc
NlpUtf8ToCutf8
QueryContextAttributesW
QuerySecurityPackageInfoW
| |paramcount|2|2| |`address`|EXTERNAL:00000077|EXTERNAL:00000075| |sig|HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes)|HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc Calling Diff ```diff --- API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc calling +++ API-MS-WIN-CORE-HEAP-L2-1-0.DLL::LocalAlloc calling @@ -68,0 +69 @@ +NlGetLocalPingResponse ``` ## NlpMapFilterInboundNamespaceReasonToString ### Match Info |Key|nl_7623.dll - nl_8521.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|nl_7623.dll|nl_8521.dll| | :---: | :---: | :---: | |name|NlpMapFilterInboundNamespaceReasonToString|NlpMapFilterInboundNamespaceReasonToString| |fullname|NlpMapFilterInboundNamespaceReasonToString|NlpMapFilterInboundNamespaceReasonToString| |`refcount`|3|2| |length|124|124| |called||| |`calling`|NlpLogFilterInboundNamespaceBlockEventWorker
NlpValidateNTLMTargetInfo
NlpValidateNTLMTargetInfoOld|NlpLogFilterInboundNamespaceBlockEventWorker
NlpValidateNTLMTargetInfo| |paramcount|1|1| |`address`|18003941c|18003a024| |sig|wchar_t * __fastcall NlpMapFilterInboundNamespaceReasonToString(int param_1)|wchar_t * __fastcall NlpMapFilterInboundNamespaceReasonToString(int param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NlpMapFilterInboundNamespaceReasonToString Calling Diff ```diff --- NlpMapFilterInboundNamespaceReasonToString calling +++ NlpMapFilterInboundNamespaceReasonToString calling @@ -3 +2,0 @@ -NlpValidateNTLMTargetInfoOld ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-18T23:51:29