# npfs-267.sys-npfs-2094.sys Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Modified](#modified) * [NpTranslateContainerLocalAlias](#nptranslatecontainerlocalalias) * [Modified (No Code Changes)](#modified-no-code-changes) # Visual Chart Diff ```mermaid flowchart LR NpTranslateContainerLocalAlias-3-old<--Match 95%-->NpTranslateContainerLocalAlias-3-new subgraph npfs-2094.sys NpTranslateContainerLocalAlias-3-new end subgraph npfs-267.sys NpTranslateContainerLocalAlias-3-old end ``` ```mermaid pie showData title Function Matches - 100.0000% "unmatched_funcs_len" : 0 "matched_funcs_len" : 500 ``` ```mermaid pie showData title Matched Function Similarity - 99.8000% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 0 "matched_funcs_no_changes_len" : 499 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ./proj --project-name npfs-22715 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 npfs-267.sys npfs-2094.sys ``` #### Verbose Args

``` --old ['npfs-267.sys'] --new [['npfs-2094.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name npfs-22715 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/npfs.sys/B03ECFD31C000/npfs.sys -O npfs.sys.x64.10.0.18362.267 wget https://msdl.microsoft.com/download/symbols/npfs.sys/04C793EA1C000/npfs.sys -O npfs.sys.x64.10.0.18362.2337 ``` ## Binary Metadata Diff ```diff --- npfs-267.sys Meta +++ npfs-2094.sys Meta @@ -1,44 +1,44 @@ -Program Name: npfs-267.sys +Program Name: npfs-2094.sys Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 1c0000000 Maximum Address: ff0000184f # of Bytes: 84568 # of Memory Blocks: 14 -# of Instructions: 13478 +# of Instructions: 13486 # of Defined Data: 941 # of Functions: 250 # of Symbols: 1685 # of Data Types: 134 # of Data Type Categories: 11 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 09:59:50 SGT 2026 +Date Created: Sun Aug 16 09:59:53 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/npfs-22715/npfs-267.sys -Executable MD5: 744de5f3e878fa12739c0bd98a972153 -Executable SHA256: d0179a8b31eb86b2c677c0aa3390f61510ae2f6ce48e42801f3b1352b4a291ed -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/npfs-22715/npfs-267.sys?MD5=744de5f3e878fa12739c0bd98a972153 +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/npfs-22715/npfs-2094.sys +Executable MD5: 6f4afa7e9151f380a8ea3920b156eb3e +Executable SHA256: 28a29817b30798072d2e72df5fc403fdc63c480b3ef0bdae71a73bd16bcf309a +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/npfs-22715/npfs-2094.sys?MD5=6f4afa7e9151f380a8ea3920b156eb3e PDB Age: 1 PDB File: npfs.pdb -PDB GUID: d55ec1d1-5c78-bd2e-15ac-b3e1d6a1a111 +PDB GUID: ef2dc6fb-c290-f831-1be5-d8ed766c0843 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: NPFS Driver -PE Property[FileVersion]: 10.0.18362.267 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.18362.2337 (WinBuild.160101.0800) PE Property[InternalName]: npfs.sys PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: npfs.sys PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.18362.267 +PE Property[ProductVersion]: 10.0.18362.2337 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra npfs-267.sys Decompiler Options

Ghidra npfs-267.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra npfs-267.sys Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra npfs-2094.sys Decompiler Options

Ghidra npfs-2094.sys Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra npfs-2094.sys Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|0| |modified_funcs_len|1| |added_symbols_len|0| |deleted_symbols_len|0| |diff_time|2.887287139892578| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 233, 'ExternalsName': 106, 'ExactBytesFunctionHasher': 13, 'ExactInstructionsFunctionHasher': 2, 'BSIM': 1})| |items_to_process|1| |diff_types|Counter({'code': 1, 'length': 1})| |unmatched_funcs_len|0| |total_funcs_len|500| |matched_funcs_len|500| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|0| |matched_funcs_no_changes_len|499| |match_func_similarity_percent|99.8000%| |func_match_overall_percent|100.0000%| |first_matches|Counter({'SymbolsHash': 233, 'ExactBytesFunctionHasher': 13, 'ExactInstructionsFunctionHasher': 2, 'BSIM': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 233 "ExternalsName" : 106 "ExactBytesFunctionHasher" : 13 "ExactInstructionsFunctionHasher" : 2 "BSIM" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 233 "ExactBytesFunctionHasher" : 13 "ExactInstructionsFunctionHasher" : 2 "BSIM" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 0 "modified_funcs_len" : 1 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 0 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added # Modified *Modified functions contain code changes* ## NpTranslateContainerLocalAlias ### Match Info |Key|npfs-267.sys - npfs-2094.sys| | :---: | :---: | |diff_type|code,length| |ratio|0.63| |i_ratio|0.78| |m_ratio|0.99| |b_ratio|0.95| |match_types|SymbolsHash| ### Function Meta Diff |Key|npfs-267.sys|npfs-2094.sys| | :---: | :---: | :---: | |name|NpTranslateContainerLocalAlias|NpTranslateContainerLocalAlias| |fullname|NpTranslateContainerLocalAlias|NpTranslateContainerLocalAlias| |refcount|2|2| |`length`|1330|1357| |called|

Expand for full list:
NTOSKRNL.EXE::ExAllocatePoolWithTag
NTOSKRNL.EXE::ExFreePoolWithTag
NTOSKRNL.EXE::RtlConvertSidToUnicodeString
NTOSKRNL.EXE::RtlFreeUnicodeString
NTOSKRNL.EXE::RtlGetAppContainerParent
NTOSKRNL.EXE::RtlGetAppContainerSidType
NTOSKRNL.EXE::RtlSubAuthoritySid
NTOSKRNL.EXE::SeQueryInformationToken
RtlUnicodeStringPrintf
__security_check_cookie
memset

| |calling|NpTranslateAlias|NpTranslateAlias| |paramcount|3|3| |address|1c0012978|1c0012978| |sig|undefined8 __fastcall NpTranslateContainerLocalAlias(undefined8 * param_1, undefined8 param_2, undefined4 * param_3)|undefined8 __fastcall NpTranslateContainerLocalAlias(undefined8 * param_1, undefined8 param_2, undefined4 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### NpTranslateContainerLocalAlias Diff ```diff --- NpTranslateContainerLocalAlias +++ NpTranslateContainerLocalAlias @@ -1,208 +1,218 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Type propagation algorithm not settling */ undefined8 NpTranslateContainerLocalAlias(undefined8 *param_1,undefined8 param_2,undefined4 *param_3) { undefined4 uVar1; undefined4 uVar2; undefined4 uVar3; bool bVar4; - short sVar5; - int iVar6; + int iVar5; + uint uVar6; undefined8 uVar7; undefined4 *puVar8; uint *puVar9; - short sVar10; + int iVar10; wchar_t *pwVar11; - undefined8 *puVar12; - bool bVar13; + ushort uVar12; + undefined8 *puVar13; + bool bVar14; undefined1 auStack_318 [32]; undefined8 *local_2f8; undefined8 *local_2f0; undefined4 local_2e8; undefined8 *local_2d8; undefined8 local_2d0; undefined2 *puStack_2c8; int local_2c0 [2]; longlong local_2b8; longlong local_2b0; undefined8 local_2a8; short *psStack_2a0; undefined8 local_298; undefined1 *local_290; ulonglong local_288; undefined8 local_280; longlong local_278; undefined8 *local_270; longlong local_268 [4]; undefined1 local_248 [512]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStack_318; local_268[1] = 0; local_298 = 0; local_290 = (undefined1 *)0x0; local_2d8 = (undefined8 *)0x0; local_2d0 = 0; puStack_2c8 = (undefined2 *)0x0; local_2a8 = 0; bVar4 = false; psStack_2a0 = (short *)0x0; local_2c0[0] = 0; local_268[0] = 0; local_268[2] = 0; memset(local_248,0,0x200); local_2b8 = 0; local_280 = 0; local_278 = 0; local_270 = (undefined8 *)0x0; *param_3 = 0; local_2b0 = 0; local_288 = 0; uVar7 = SeQueryInformationToken(param_2,0x1d,&local_2b0); if ((int)uVar7 < 0) { return uVar7; } uVar7 = SeQueryInformationToken(param_2,0x2a,&local_2b8); if ((int)uVar7 < 0) { return uVar7; } if ((local_2b0 == 0) && (local_2b8 == 0)) { return 0; } uVar7 = SeQueryInformationToken(param_2,0xc,&local_288); if ((int)uVar7 < 0) { return uVar7; } if (local_2b0 != 0) { - iVar6 = SeQueryInformationToken(param_2,0x1f,&local_2d8); - if ((iVar6 < 0) || (iVar6 = RtlGetAppContainerSidType(*local_2d8,local_2c0), iVar6 < 0)) + iVar5 = SeQueryInformationToken(param_2,0x1f,&local_2d8); + if ((iVar5 < 0) || (iVar5 = RtlGetAppContainerSidType(*local_2d8,local_2c0), iVar5 < 0)) goto LAB_0; if (local_2c0[0] == 1) { - iVar6 = RtlGetAppContainerParent(*local_2d8,local_268); - if ((iVar6 < 0) || - (iVar6 = RtlConvertSidToUnicodeString(local_268 + 1,local_268[0],1), iVar6 < 0)) + iVar5 = RtlGetAppContainerParent(*local_2d8,local_268); + if ((iVar5 < 0) || + (iVar5 = RtlConvertSidToUnicodeString(local_268 + 1,local_268[0],1), iVar5 < 0)) goto LAB_0; local_290 = local_248; local_298 = CONCAT44(local_298._4_4_,0x2000000); puVar8 = (undefined4 *)RtlSubAuthoritySid(*local_2d8,0xb); uVar1 = *puVar8; puVar8 = (undefined4 *)RtlSubAuthoritySid(*local_2d8,10); uVar2 = *puVar8; puVar8 = (undefined4 *)RtlSubAuthoritySid(*local_2d8,9); uVar3 = *puVar8; puVar9 = (uint *)RtlSubAuthoritySid(*local_2d8,8); local_2f0 = (undefined8 *)CONCAT44(local_2f0._4_4_,uVar2); local_2f8 = (undefined8 *)CONCAT44(local_2f8._4_4_,uVar3); local_2e8 = uVar1; - iVar6 = RtlUnicodeStringPrintf + iVar5 = RtlUnicodeStringPrintf ((ushort *)&local_298,L"%wZ\\%lu-%lu-%lu-%lu",local_268 + 1, (ulonglong)*puVar9); - if (iVar6 < 0) goto LAB_0; + if (iVar5 < 0) goto LAB_0; } else { - iVar6 = RtlConvertSidToUnicodeString(&local_298,*local_2d8,1); - if (iVar6 < 0) goto LAB_0; + iVar5 = RtlConvertSidToUnicodeString(&local_298,*local_2d8,1); + if (iVar5 < 0) goto LAB_0; bVar4 = true; } } if ((local_2b8 == 0) || - ((iVar6 = SeQueryInformationToken(param_2,1,&local_270), -1 < iVar6 && - (iVar6 = RtlConvertSidToUnicodeString(&local_280,*local_270,1), -1 < iVar6)))) { + ((iVar5 = SeQueryInformationToken(param_2,1,&local_270), -1 < iVar5 && + (iVar5 = RtlConvertSidToUnicodeString(&local_280,*local_270,1), -1 < iVar5)))) { psStack_2a0 = (short *)param_1[1]; local_2a8._0_2_ = (short)*param_1; - bVar13 = *psStack_2a0 == 0x5c; - sVar10 = (short)local_2a8; - if (bVar13) { + bVar14 = *psStack_2a0 == 0x5c; + if (bVar14) { psStack_2a0 = psStack_2a0 + 1; - sVar10 = (short)local_2a8 + -2; - } + local_2a8._0_2_ = (short)local_2a8 + -2; + } + uVar12 = (short)local_2a8 - 0xc; local_2a8._4_4_ = (undefined4)((ulonglong)*param_1 >> 0x20); - local_2a8._0_4_ = CONCAT22(sVar10 + -0xc,sVar10 + -0xc); + local_2a8._0_4_ = CONCAT22(uVar12,uVar12); psStack_2a0 = psStack_2a0 + 6; if (local_2b8 == 0) { - sVar5 = (ushort)local_298 + 0x5c; + iVar5 = (ushort)local_298 + 0x70; + iVar10 = (ushort)local_298 + 0x72; } else if (local_2b0 == 0) { - sVar5 = (short)local_280 + 0x4c; + iVar5 = (ushort)local_280 + 0x60; + iVar10 = (ushort)local_280 + 0x62; } else { - sVar5 = (short)local_280 + 100 + (ushort)local_298; - } - sVar5 = sVar10 + 8 + sVar5; - if (bVar13) { - sVar5 = sVar5 + 2; - } - local_2d0 = CONCAT44(local_2d0._4_4_,CONCAT22(sVar5,(ushort)local_2d0)); - puStack_2c8 = (undefined2 *)ExAllocatePoolWithTag(1,sVar5,0x6e46704e); - if (puStack_2c8 == (undefined2 *)0x0) { - iVar6 = -0x3fffff66; - } - else { - if (bVar13) { - puStack_2c8 = puStack_2c8 + 1; - local_2d0._0_4_ = CONCAT22(local_2d0._2_2_ + -2,(ushort)local_2d0); - } - local_2f8 = &local_2a8; - if (local_2b8 == 0) { - puVar12 = &local_298; - pwVar11 = L"Sessions\\%ld\\AppContainerNamedObjects\\%wZ\\%wZ"; -LAB_1: - iVar6 = RtlUnicodeStringPrintf((ushort *)&local_2d0,pwVar11,local_288 & 0xffffffff,puVar12); + iVar5 = (uint)(ushort)local_280 + (uint)(ushort)local_298 + 0x78; + iVar10 = (uint)(ushort)local_280 + (uint)(ushort)local_298 + 0x7a; + } + uVar6 = (uint)uVar12 + iVar5; + if (bVar14) { + uVar6 = iVar10 + (uint)uVar12; + } + if (uVar6 < 0xffff) { + local_2d0._0_4_ = CONCAT22((short)uVar6,(ushort)local_2d0); + puStack_2c8 = (undefined2 *)ExAllocatePoolWithTag(1,uVar6 & 0xffff,0x6e46704e); + if (puStack_2c8 == (undefined2 *)0x0) { + iVar5 = -0x3fffff66; } else { - puVar12 = &local_280; - if (local_2b0 == 0) { - pwVar11 = L"Sessions\\%ld\\BaseNamedObjects\\%wZ\\%wZ"; - goto LAB_1; - } - local_2f0 = local_2f8; - local_2f8 = &local_298; - iVar6 = RtlUnicodeStringPrintf - ((ushort *)&local_2d0, - L"Sessions\\%ld\\AppContainerNamedObjects\\%wZ\\%wZ\\%wZ", - local_288 & 0xffffffff,puVar12); + if (bVar14) { + puStack_2c8 = puStack_2c8 + 1; + local_2d0._0_4_ = CONCAT22(local_2d0._2_2_ + -2,(ushort)local_2d0); + } + local_2f8 = &local_2a8; + if (local_2b8 == 0) { + puVar13 = &local_298; + pwVar11 = L"Sessions\\%ld\\AppContainerNamedObjects\\%wZ\\%wZ"; +LAB_1: + iVar5 = RtlUnicodeStringPrintf + ((ushort *)&local_2d0,pwVar11,local_288 & 0xffffffff,puVar13); + } + else { + puVar13 = &local_280; + if (local_2b0 == 0) { + pwVar11 = L"Sessions\\%ld\\BaseNamedObjects\\%wZ\\%wZ"; + goto LAB_1; + } + local_2f0 = local_2f8; + local_2f8 = &local_298; + iVar5 = RtlUnicodeStringPrintf + ((ushort *)&local_2d0, + L"Sessions\\%ld\\AppContainerNamedObjects\\%wZ\\%wZ\\%wZ", + local_288 & 0xffffffff,puVar13); + } + if (bVar14) { + puStack_2c8 = puStack_2c8 + -1; + local_2d0._0_4_ = CONCAT22(local_2d0._2_2_ + 2,(ushort)local_2d0); + } + if (-1 < iVar5) { + if (bVar14) { + *puStack_2c8 = 0x5c; + local_2d0 = CONCAT62(local_2d0._2_6_,(ushort)local_2d0 + 2); + } + *param_1 = local_2d0; + param_1[1] = puStack_2c8; + *param_3 = 1; + } } - if (bVar13) { - puStack_2c8 = puStack_2c8 + -1; - local_2d0._0_4_ = CONCAT22(local_2d0._2_2_ + 2,(ushort)local_2d0); - } - if (-1 < iVar6) { - if (bVar13) { - *puStack_2c8 = 0x5c; - local_2d0 = CONCAT62(local_2d0._2_6_,(ushort)local_2d0 + 2); - } - *param_1 = local_2d0; - param_1[1] = puStack_2c8; - *param_3 = 1; - } + } + else { + iVar5 = -0x3ffffefa; } } if (bVar4) { RtlFreeUnicodeString(&local_298); } LAB_0: if (local_278 != 0) { RtlFreeUnicodeString(&local_280); } - if (iVar6 < 0) { + if (iVar5 < 0) { RtlFreeUnicodeString(&local_2d0); } if (local_2d8 != (undefined8 *)0x0) { ExFreePoolWithTag(local_2d8,0); } if (local_270 != (undefined8 *)0x0) { ExFreePoolWithTag(local_270,0); } if (local_268[0] != 0) { ExFreePoolWithTag(local_268[0],0); } if (local_268[2] != 0) { RtlFreeUnicodeString(local_268 + 1); } return 0; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T10:00:16}