# rp-1586.sys-rp-1706.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [ReferenceRefCount](#referencerefcount)
	* [NTOSKRNL.EXE::ExAcquireRundownProtection](#ntoskrnlexeexacquirerundownprotection)
	* [NTOSKRNL.EXE::ExReleaseRundownProtection](#ntoskrnlexeexreleaserundownprotection)
	* [NTOSKRNL.EXE::ExWaitForRundownProtectionRelease](#ntoskrnlexeexwaitforrundownprotectionrelease)
	* [NTOSKRNL.EXE::ExInitializeRundownProtection](#ntoskrnlexeexinitializerundownprotection)
	* [NTOSKRNL.EXE::ExRundownCompleted](#ntoskrnlexeexrundowncompleted)
* [Modified](#modified)
	* [CtlReceiveCallback](#ctlreceivecallback)
	* [CtlpEngine](#ctlpengine)
	* [CtlpDeathTimeout](#ctlpdeathtimeout)
	* [CallReceiveDatagramCallback](#callreceivedatagramcallback)
	* [CallGetCall](#callgetcall)
	* [CtlAlloc](#ctlalloc)
	* [CtlpCleanup](#ctlpcleanup)
	* [ReceiveDataComplete](#receivedatacomplete)
	* [FreeSockContextCommon](#freesockcontextcommon)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [WPP_SF_](#wpp_sf_)
	* [_guard_dispatch_icall](#_guard_dispatch_icall)
	* [WPP_SF_q](#wpp_sf_q)
	* [WskConnDisconnectEvent](#wskconndisconnectevent)
	* [DereferenceRefCount](#dereferencerefcount)

# Visual Chart Diff



```mermaid

flowchart LR

CtlReceiveCallback-3-old<--Match 39%-->CtlReceiveCallback-3-new
CtlpEngine-3-old<--Match 96%-->CtlpEngine-3-new
CtlpDeathTimeout-1-old<--Match 71%-->CtlpDeathTimeout-1-new
CallReceiveDatagramCallback-3-old<--Match 97%-->CallReceiveDatagramCallback-3-new
CallGetCall-2-old<--Match 91%-->CallGetCall-2-new
CtlAlloc-1-old<--Match 99%-->CtlAlloc-1-new
CtlpCleanup-1-old<--Match 95%-->CtlpCleanup-1-new
ReceiveDataComplete-2-old<--Match 95%-->ReceiveDataComplete-2-new
FreeSockContextCommon-1-old<--Match 99%-->FreeSockContextCommon-1-new

subgraph rp-1706.sys
    CtlReceiveCallback-3-new
CtlpEngine-3-new
CtlpDeathTimeout-1-new
CallReceiveDatagramCallback-3-new
CallGetCall-2-new
CtlAlloc-1-new
CtlpCleanup-1-new
ReceiveDataComplete-2-new
FreeSockContextCommon-1-new
    subgraph Added
direction LR
ReferenceRefCount
    NTOSKRNLEXE-ExAcquireRundownProtection
    NTOSKRNLEXE-ExReleaseRundownProtection
    NTOSKRNLEXE-ExWaitForRundownProtectionRelease
    NTOSKRNLEXE-ExInitializeRundownProtection
    NTOSKRNLEXE-ExRundownCompleted
end
end

subgraph rp-1586.sys
    CtlReceiveCallback-3-old
CtlpEngine-3-old
CtlpDeathTimeout-1-old
CallReceiveDatagramCallback-3-old
CallGetCall-2-old
CtlAlloc-1-old
CtlpCleanup-1-old
ReceiveDataComplete-2-old
FreeSockContextCommon-1-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.1124%
"unmatched_funcs_len" : 6
"matched_funcs_len" : 670
```



```mermaid
pie showData
    title Matched Function Similarity - 97.9104%
"matched_funcs_with_code_changes_len" : 9
"matched_funcs_with_non_code_changes_len" : 5
"matched_funcs_no_changes_len" : 656
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ./proj --project-name raspptp --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 rp-1586.sys rp-1706.sys
```


#### Verbose Args


<details>

```
--old ['rp-1586.sys'] --new [['rp-1706.sys']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name raspptp --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/RASPPTP.SYS/9ECA9F2221000/RASPPTP.SYS -O raspptp.sys.x64.10.0.19041.1682
wget https://msdl.microsoft.com/download/symbols/RASPPTP.SYS/19E78C4C21000/RASPPTP.SYS -O raspptp.sys.x64.10.0.19041.1940
```


## Binary Metadata Diff


```diff
--- rp-1586.sys Meta
+++ rp-1706.sys Meta
@@ -1,44 +1,44 @@
-Program Name: rp-1586.sys
+Program Name: rp-1706.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 1c0000000
 Maximum Address: ff0000184f
-# of Bytes: 108384
+# of Bytes: 109408
 # of Memory Blocks: 14
-# of Instructions: 18296
-# of Defined Data: 904
-# of Functions: 335
-# of Symbols: 2481
+# of Instructions: 18434
+# of Defined Data: 925
+# of Functions: 341
+# of Symbols: 2495
 # of Data Types: 218
 # of Data Type Categories: 25
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Sun Aug 16 15:40:50 SGT 2026
+Date Created: Sun Aug 16 15:40:54 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/raspptp-pptp/rp-1586.sys
-Executable MD5: 655579a1857549cec1e14f06fa244767
-Executable SHA256: e2792fc0ea333c8d2afa3030bc344a3438f79d0520f5b0c8411f2c7e1863a2f5
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/raspptp-pptp/rp-1586.sys?MD5=655579a1857549cec1e14f06fa244767
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/raspptp-pptp/rp-1706.sys
+Executable MD5: da869aa999e29f98997537f017152295
+Executable SHA256: 49106033d9b81a5c413d2f4e4547a0f2071a1e95b4d9226c6c7290c7163c01ff
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/raspptp-pptp/rp-1706.sys?MD5=da869aa999e29f98997537f017152295
 PDB Age: 1
 PDB File: raspptp.pdb
-PDB GUID: 17025778-3c8b-2f01-fcf9-705391a5d51a
+PDB GUID: 7fd8d433-9b4f-fcd6-132d-1ceccafc0238
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Peer-to-Peer Tunneling Protocol
-PE Property[FileVersion]: 10.0.19041.1682 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.19041.1940 (WinBuild.160101.0800)
 PE Property[InternalName]: RASPPTP.SYS
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: RASPPTP.SYS
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.19041.1682
+PE Property[ProductVersion]: 10.0.19041.1940
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra rp-1586.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra rp-1586.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra rp-1586.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra rp-1706.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra rp-1706.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra rp-1706.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|6|
|deleted_funcs_len|0|
|modified_funcs_len|14|
|added_symbols_len|7|
|deleted_symbols_len|2|
|diff_time|2.666261911392212|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 335, 'ExternalsName': 97})|
|items_to_process|29|
|diff_types|Counter({'code': 9, 'length': 9, 'address': 8, 'called': 6, 'refcount': 6, 'calling': 5, 'sig': 1})|
|unmatched_funcs_len|6|
|total_funcs_len|676|
|matched_funcs_len|670|
|matched_funcs_with_code_changes_len|9|
|matched_funcs_with_non_code_changes_len|5|
|matched_funcs_no_changes_len|656|
|match_func_similarity_percent|97.9104%|
|func_match_overall_percent|99.1124%|
|first_matches|Counter({'SymbolsHash': 335})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 335
"ExternalsName" : 97
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 335
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 6
"deleted_funcs_len" : 0
"modified_funcs_len" : 14
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 7
"deleted_symbols_len" : 2
```

## Strings


*No string differences found*

# Deleted

# Added

## ReferenceRefCount

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ReferenceRefCount|
|fullname|ReferenceRefCount|
|refcount|2|
|length|10|
|called||
|calling|CallGetCall|
|paramcount|1|
|address|1c0003364|
|sig|int __fastcall ReferenceRefCount(int * param_1)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- ReferenceRefCount
+++ ReferenceRefCount
@@ -0,0 +1,13 @@
+
+int ReferenceRefCount(int *param_1)
+
+{
+  int iVar1;
+  
+  LOCK();
+  iVar1 = *param_1;
+  *param_1 = *param_1 + 1;
+  UNLOCK();
+  return iVar1;
+}
+

```


## NTOSKRNL.EXE::ExAcquireRundownProtection

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ExAcquireRundownProtection|
|fullname|NTOSKRNL.EXE::ExAcquireRundownProtection|
|refcount|2|
|length|0|
|called||
|calling|CtlReceiveCallback|
|paramcount|0|
|address|EXTERNAL:0000000d|
|sig|undefined ExAcquireRundownProtection(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTOSKRNL.EXE::ExAcquireRundownProtection*
## NTOSKRNL.EXE::ExReleaseRundownProtection

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ExReleaseRundownProtection|
|fullname|NTOSKRNL.EXE::ExReleaseRundownProtection|
|refcount|2|
|length|0|
|called||
|calling|CtlReceiveCallback|
|paramcount|0|
|address|EXTERNAL:0000000a|
|sig|undefined ExReleaseRundownProtection(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTOSKRNL.EXE::ExReleaseRundownProtection*
## NTOSKRNL.EXE::ExWaitForRundownProtectionRelease

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ExWaitForRundownProtectionRelease|
|fullname|NTOSKRNL.EXE::ExWaitForRundownProtectionRelease|
|refcount|2|
|length|0|
|called||
|calling|CtlpCleanup|
|paramcount|0|
|address|EXTERNAL:00000010|
|sig|undefined ExWaitForRundownProtectionRelease(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTOSKRNL.EXE::ExWaitForRundownProtectionRelease*
## NTOSKRNL.EXE::ExInitializeRundownProtection

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ExInitializeRundownProtection|
|fullname|NTOSKRNL.EXE::ExInitializeRundownProtection|
|refcount|2|
|length|0|
|called||
|calling|CtlAlloc|
|paramcount|0|
|address|EXTERNAL:0000000f|
|sig|undefined ExInitializeRundownProtection(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTOSKRNL.EXE::ExInitializeRundownProtection*
## NTOSKRNL.EXE::ExRundownCompleted

### Function Meta



|Key|rp-1706.sys|
| :---: | :---: |
|name|ExRundownCompleted|
|fullname|NTOSKRNL.EXE::ExRundownCompleted|
|refcount|2|
|length|0|
|called||
|calling|CtlpCleanup|
|paramcount|0|
|address|EXTERNAL:00000013|
|sig|undefined ExRundownCompleted(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTOSKRNL.EXE::ExRundownCompleted*
# Modified


*Modified functions contain code changes*
## CtlReceiveCallback

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.15|
|i_ratio|0.3|
|m_ratio|0.52|
|b_ratio|0.39|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CtlReceiveCallback|CtlReceiveCallback|
|fullname|CtlReceiveCallback|CtlReceiveCallback|
|refcount|6|6|
|`length`|108|323|
|`called`|CtlpEngine<br>NDIS.SYS::NdisGetDataBuffer<br>ReceiveDataComplete|CtlpEngine<br>NDIS.SYS::NdisGetDataBuffer<br>NTOSKRNL.EXE::ExAcquireRundownProtection<br>NTOSKRNL.EXE::ExReleaseRundownProtection<br>ReceiveDataComplete<br>WPP_SF_<br>WPP_SF_q<br>_guard_dispatch_icall|
|calling|||
|paramcount|3|3|
|`address`|1c0013350|1c0013380|
|sig|undefined8 __fastcall CtlReceiveCallback(undefined * * param_1, undefined8 param_2, longlong param_3)|undefined8 __fastcall CtlReceiveCallback(undefined * * param_1, undefined8 param_2, longlong param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CtlReceiveCallback Called Diff


```diff
--- CtlReceiveCallback called
+++ CtlReceiveCallback called
@@ -2,0 +3,2 @@
+NTOSKRNL.EXE::ExAcquireRundownProtection
+NTOSKRNL.EXE::ExReleaseRundownProtection
@@ -3,0 +6,3 @@
+WPP_SF_
+WPP_SF_q
+_guard_dispatch_icall
```


### CtlReceiveCallback Diff


```diff
--- CtlReceiveCallback
+++ CtlReceiveCallback
@@ -1,16 +1,57 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 
 undefined8 CtlReceiveCallback(undefined **param_1,undefined8 param_2,longlong param_3)
 
 {
-  uint uVar1;
-  undefined **ppuVar2;
+  int iVar1;
+  uint uVar2;
+  char cVar3;
+  undefined8 uVar4;
+  undefined **ppuVar5;
   
-  uVar1 = *(uint *)(*(longlong *)(param_3 + 8) + 0x18);
-  ppuVar2 = (undefined **)NdisGetDataBuffer(*(longlong *)(param_3 + 8),uVar1,0,1,0);
-  if (ppuVar2 != (undefined **)0x0) {
-    CtlpEngine(param_1,ppuVar2,uVar1);
+  if (param_1 == (undefined **)0x0) {
+    if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+        ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) {
+      WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4d,
+              &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
+    }
+    ReceiveDataComplete(0,param_3);
+    uVar4 = 0xc000000d;
   }
-  ReceiveDataComplete((longlong)param_1[0x10],param_3);
-  return 0;
+  else {
+    cVar3 = ExAcquireRundownProtection(param_1 + 0xb);
+    if (cVar3 == '\0') {
+      if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+          ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29])
+         ) {
+        WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4e,
+                 &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,param_1);
+      }
+      ReceiveDataComplete((longlong)param_1[0x11],param_3);
+    }
+    else {
+      LOCK();
+      *(int *)(param_1 + 2) = *(int *)(param_1 + 2) + 1;
+      UNLOCK();
+      ExReleaseRundownProtection(param_1 + 0xb);
+      uVar2 = *(uint *)(*(longlong *)(param_3 + 8) + 0x18);
+      ppuVar5 = (undefined **)NdisGetDataBuffer(*(longlong *)(param_3 + 8),uVar2,0,1,0);
+      if (ppuVar5 != (undefined **)0x0) {
+        CtlpEngine(param_1,ppuVar5,uVar2);
+      }
+      ReceiveDataComplete((longlong)param_1[0x11],param_3);
+      LOCK();
+      ppuVar5 = param_1 + 2;
+      iVar1 = *(int *)ppuVar5;
+      *(int *)ppuVar5 = *(int *)ppuVar5 + -1;
+      UNLOCK();
+      if (iVar1 == 1) {
+        (*(code *)param_1[3])(param_1);
+      }
+    }
+    uVar4 = 0;
+  }
+  return uVar4;
 }
 

```


## CtlpEngine

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address|
|ratio|0.7|
|i_ratio|0.49|
|m_ratio|0.99|
|b_ratio|0.96|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CtlpEngine|CtlpEngine|
|fullname|CtlpEngine|CtlpEngine|
|refcount|2|2|
|`length`|4146|4235|
|called|<details><summary>Expand for full list:<br>CallEventCallClearRequest<br>CallEventCallDisconnectNotify<br>CallEventCallInConnect<br>CallEventCallInRequest<br>CallEventCallOutReply<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallGetCall<br>CtlAllocPacket<br>CtlCleanup<br>CtlSend</summary>CtlSetState<br>DereferenceRefCount<br>EnumComplete<br>EnumListEntry<br>GetLocalAddress<br>GetStringFromSockAddr<br>NDIS.SYS::NdisCancelTimerObject<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeSetEvent<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_ds<br>WPP_SF_qdddddd<br>WPP_SF_s<br>WPP_SF_sdDdd<br>WPP_SF_sq<br>WPP_SF_sqd<br>WPP_SF_sqdd<br>WPP_SF_sqddd<br>WPP_SF_sqdddd<br>__security_check_cookie<br>_guard_dispatch_icall<br>memcpy<br>memset</details>|<details><summary>Expand for full list:<br>CallEventCallClearRequest<br>CallEventCallDisconnectNotify<br>CallEventCallInConnect<br>CallEventCallInRequest<br>CallEventCallOutReply<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallGetCall<br>CtlAllocPacket<br>CtlCleanup<br>CtlSend</summary>CtlSetState<br>DereferenceRefCount<br>EnumComplete<br>EnumListEntry<br>GetLocalAddress<br>GetStringFromSockAddr<br>NDIS.SYS::NdisCancelTimerObject<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeSetEvent<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_ds<br>WPP_SF_qdddddd<br>WPP_SF_s<br>WPP_SF_sdDdd<br>WPP_SF_sq<br>WPP_SF_sqd<br>WPP_SF_sqdd<br>WPP_SF_sqddd<br>WPP_SF_sqdddd<br>__security_check_cookie<br>_guard_dispatch_icall<br>memcpy<br>memset</details>|
|calling|CtlReceiveCallback|CtlReceiveCallback|
|paramcount|3|3|
|`address`|1c0013b60|1c0013d10|
|sig|undefined __fastcall CtlpEngine(undefined * * param_1, undefined * * param_2, uint param_3)|undefined __fastcall CtlpEngine(undefined * * param_1, undefined * * param_2, uint param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CtlpEngine Diff


```diff
--- CtlpEngine
+++ CtlpEngine
@@ -1,594 +1,612 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 
 void CtlpEngine(undefined **param_1,undefined **param_2,uint param_3)
 
 {
   int iVar1;
   undefined4 uVar2;
   undefined4 uVar3;
   bool bVar4;
   bool bVar5;
   char cVar6;
   undefined1 uVar7;
   ushort uVar8;
   ushort uVar9;
   uint uVar10;
   undefined4 uVar11;
   char *pcVar12;
   ushort *puVar13;
   longlong *plVar14;
   int *piVar15;
   longlong *plVar16;
   undefined2 uVar17;
   ulonglong uVar18;
   undefined *puVar19;
   undefined8 uVar20;
   undefined1 *puVar21;
   uint uVar22;
   byte bVar23;
   ulonglong _Size;
   undefined **ppuVar24;
   undefined **ppuVar25;
   undefined1 auStackY_138 [32];
   longlong local_e0 [2];
   undefined8 local_d0;
   longlong local_c8 [6];
   undefined1 local_98 [80];
   ulonglong local_48;
   
   local_48 = __security_cookie ^ (ulonglong)auStackY_138;
   bVar5 = false;
   ppuVar24 = (undefined **)0x0;
   memset(local_98,0,0x41);
   do {
     if (param_3 == 0) {
       return;
     }
-    uVar10 = *(uint *)((longlong)param_1 + 0x164);
+    uVar10 = *(uint *)((longlong)param_1 + 0x16c);
     ppuVar24 = (undefined **)CONCAT71((int7)((ulonglong)ppuVar24 >> 8),2);
     if (uVar10 == 0) {
       if (param_3 < 0xc) {
-        memcpy(param_1 + 0x11,param_2,(ulonglong)param_3);
-        *(uint *)((longlong)param_1 + 0x164) = param_3;
+        memcpy(param_1 + 0x12,param_2,(ulonglong)param_3);
+        *(uint *)((longlong)param_1 + 0x16c) = param_3;
         return;
       }
       uVar18 = 0;
       ppuVar25 = param_2;
     }
     else {
       for (; uVar18 = (ulonglong)uVar10, param_3 != 0; param_3 = param_3 - 1) {
         if (0xb < uVar10) goto LAB_0;
         uVar7 = *(undefined1 *)param_2;
         param_2 = (undefined **)((longlong)param_2 + 1);
-        *(undefined1 *)((ulonglong)uVar10 + 0x88 + (longlong)param_1) = uVar7;
-        uVar10 = *(int *)((longlong)param_1 + 0x164) + 1;
-        *(uint *)((longlong)param_1 + 0x164) = uVar10;
+        *(undefined1 *)((ulonglong)uVar10 + 0x90 + (longlong)param_1) = uVar7;
+        uVar10 = *(int *)((longlong)param_1 + 0x16c) + 1;
+        *(uint *)((longlong)param_1 + 0x16c) = uVar10;
       }
       if (uVar10 < 0xc) {
         return;
       }
 LAB_0:
-      ppuVar25 = param_1 + 0x11;
+      ppuVar25 = param_1 + 0x12;
     }
     uVar8 = *(ushort *)ppuVar25 >> 8 | *(ushort *)ppuVar25 << 8;
     uVar9 = *(ushort *)(ppuVar25 + 1) >> 8 | *(ushort *)(ppuVar25 + 1) << 8;
     uVar10 = (uint)uVar8;
     if ((((uVar8 < 0xdd) && (*(int *)((longlong)ppuVar25 + 4) == 0x4d3c2b1a)) &&
         (*(ushort *)((longlong)ppuVar25 + 2) == 0x100)) &&
-       ((uVar9 - 1 < 0xf && ((uint)uVar8 == *(uint *)(param_1[0x46] + (ulonglong)uVar9 * 4))))) {
+       ((uVar9 - 1 < 0xf && ((uint)uVar8 == *(uint *)(param_1[0x47] + (ulonglong)uVar9 * 4))))) {
       iVar1 = (int)uVar18;
       if (param_3 + iVar1 < uVar10) {
-        memcpy((void *)((longlong)param_1 + uVar18 + 0x88),param_2,(ulonglong)param_3);
-        *(int *)((longlong)param_1 + 0x164) = *(int *)((longlong)param_1 + 0x164) + param_3;
+        memcpy((void *)((longlong)param_1 + uVar18 + 0x90),param_2,(ulonglong)param_3);
+        *(int *)((longlong)param_1 + 0x16c) = *(int *)((longlong)param_1 + 0x16c) + param_3;
         return;
       }
       ppuVar25 = param_2;
       if (iVar1 != 0) {
         uVar10 = uVar10 - iVar1;
         _Size = (ulonglong)uVar10;
-        memcpy((void *)((longlong)param_1 + uVar18 + 0x88),param_2,_Size);
-        *(undefined4 *)((longlong)param_1 + 0x164) = 0;
+        memcpy((void *)((longlong)param_1 + uVar18 + 0x90),param_2,_Size);
+        *(undefined4 *)((longlong)param_1 + 0x16c) = 0;
         ppuVar24 = (undefined **)CONCAT71((int7)(_Size >> 8),2);
-        ppuVar25 = param_1 + 0x11;
+        ppuVar25 = param_1 + 0x12;
       }
       param_3 = param_3 - uVar10;
       param_2 = (undefined **)((longlong)param_2 + (ulonglong)uVar10);
       uVar8 = *(ushort *)(ppuVar25 + 1) >> 8 | *(ushort *)(ppuVar25 + 1) << 8;
       bVar23 = (byte)ppuVar24;
       if (uVar8 < 9) {
         if (uVar8 == 8) {
           uVar22 = (uint)(ushort)(*(ushort *)((longlong)ppuVar25 + 0xe) >> 8 |
                                  *(ushort *)((longlong)ppuVar25 + 0xe) << 8);
           uVar10 = uVar22;
           if (PptpClientSide != '\0') {
             uVar10 = uVar22 & 0x3fff;
           }
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
             ppuVar24 = (undefined **)(ulonglong)*(byte *)((longlong)ppuVar25 + 0x11);
             WPP_SF_qdddddd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),
                            (ulonglong)
                            (ushort)(*(ushort *)((longlong)ppuVar25 + 0xc) >> 8 |
                                    *(ushort *)((longlong)ppuVar25 + 0xc) << 8),ppuVar24,param_1);
           }
           if (*(int *)(param_1 + 6) == 5) {
-            piVar15 = (int *)CallGetCall((longlong)param_1[5],(ulonglong)uVar10);
-            if (piVar15 == (int *)0x0) {
-              ppuVar24 = &WPP_GLOBAL_Control;
-              if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
-                  ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
-                 (WPP_GLOBAL_Control[0x29] != '\0')) {
-                ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-                WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2d,
-                         &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,uVar22);
+            piVar15 = CallGetCall((longlong)param_1[5],(ulonglong)uVar10);
+            if (piVar15 != (int *)0x0) {
+              if ((piVar15[0xc] == 0x43505450) && (*(undefined ***)(piVar15 + 0x14) == param_1)) {
+                CallEventCallOutReply(piVar15,(longlong)ppuVar25);
               }
-            }
-            else {
-              CallEventCallOutReply(piVar15,(longlong)ppuVar25);
+              else {
+                ppuVar24 = &WPP_GLOBAL_Control;
+                if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+                   (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0 &&
+                    (WPP_GLOBAL_Control[0x29] != '\0')))) {
+                  uVar17 = 0x2e;
+LAB_1:
+                  ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+                  WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar17,
+                           &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,uVar22);
+                }
+              }
+LAB_2:
+              DereferenceRefCount(piVar15);
             }
           }
           else if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                    ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                   (WPP_GLOBAL_Control[0x29] != '\0')) {
-            uVar17 = 0x2e;
-LAB_1:
-            ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
+            uVar17 = 0x2f;
+LAB_3:
+            ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
             WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar17,
-                    &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+                    &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
           }
         }
         else if (uVar8 == 1) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24,ppuVar24,pcVar12);
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25,ppuVar24,pcVar12);
           }
           if (*(int *)(param_1 + 6) == 3) {
-            *(uint *)((longlong)param_1 + 0x184) =
+            *(uint *)((longlong)param_1 + 0x18c) =
                  (uint)(ushort)(*(ushort *)((longlong)ppuVar25 + 0xc) >> 8 |
                                *(ushort *)((longlong)ppuVar25 + 0xc) << 8);
             uVar10 = *(uint *)(ppuVar25 + 2);
-            *(uint *)(param_1 + 0x31) =
+            *(uint *)(param_1 + 0x32) =
                  uVar10 >> 0x18 | (uVar10 & 0xff0000) >> 8 | (uVar10 & 0xff00) << 8 | uVar10 << 0x18
             ;
             uVar10 = *(uint *)((longlong)ppuVar25 + 0x14);
-            *(uint *)((longlong)param_1 + 0x18c) =
+            *(uint *)((longlong)param_1 + 0x194) =
                  uVar10 >> 0x18 | (uVar10 & 0xff0000) >> 8 | (uVar10 & 0xff00) << 8 | uVar10 << 0x18
             ;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x24);
-            param_1[0x32] = *(undefined **)((longlong)ppuVar25 + 0x1c);
-            param_1[0x33] = puVar19;
+            param_1[0x33] = *(undefined **)((longlong)ppuVar25 + 0x1c);
+            param_1[0x34] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x34);
-            param_1[0x34] = *(undefined **)((longlong)ppuVar25 + 0x2c);
-            param_1[0x35] = puVar19;
+            param_1[0x35] = *(undefined **)((longlong)ppuVar25 + 0x2c);
+            param_1[0x36] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x44);
-            param_1[0x36] = *(undefined **)((longlong)ppuVar25 + 0x3c);
-            param_1[0x37] = puVar19;
+            param_1[0x37] = *(undefined **)((longlong)ppuVar25 + 0x3c);
+            param_1[0x38] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x54);
-            param_1[0x38] = *(undefined **)((longlong)ppuVar25 + 0x4c);
-            param_1[0x39] = puVar19;
-            *(undefined1 *)((longlong)param_1 + 0x1cf) = 0;
+            param_1[0x39] = *(undefined **)((longlong)ppuVar25 + 0x4c);
+            param_1[0x3a] = puVar19;
+            *(undefined1 *)((longlong)param_1 + 0x1d7) = 0;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 100);
-            param_1[0x3a] = *(undefined **)((longlong)ppuVar25 + 0x5c);
-            param_1[0x3b] = puVar19;
+            param_1[0x3b] = *(undefined **)((longlong)ppuVar25 + 0x5c);
+            param_1[0x3c] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x74);
-            param_1[0x3c] = *(undefined **)((longlong)ppuVar25 + 0x6c);
-            param_1[0x3d] = puVar19;
+            param_1[0x3d] = *(undefined **)((longlong)ppuVar25 + 0x6c);
+            param_1[0x3e] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x84);
-            param_1[0x3e] = *(undefined **)((longlong)ppuVar25 + 0x7c);
-            param_1[0x3f] = puVar19;
+            param_1[0x3f] = *(undefined **)((longlong)ppuVar25 + 0x7c);
+            param_1[0x40] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x94);
-            param_1[0x40] = *(undefined **)((longlong)ppuVar25 + 0x8c);
-            param_1[0x41] = puVar19;
-            *(undefined1 *)((longlong)param_1 + 0x20f) = 0;
+            param_1[0x41] = *(undefined **)((longlong)ppuVar25 + 0x8c);
+            param_1[0x42] = puVar19;
+            *(undefined1 *)((longlong)param_1 + 0x217) = 0;
             if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                 ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                (WPP_GLOBAL_Control[0x29] != '\0')) {
-              WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25,
-                      &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+              WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x26,
+                      &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
             }
             LOCK();
             *(int *)(param_1 + 2) = *(int *)(param_1 + 2) + 1;
             UNLOCK();
-            uVar11 = GetLocalAddress((longlong)param_1[0x10],param_1 + 0x42);
+            uVar11 = GetLocalAddress((longlong)param_1[0x11],param_1 + 0x43);
             ppuVar24 = &WPP_GLOBAL_Control;
             if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                 ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                (WPP_GLOBAL_Control[0x29] != '\0')) {
-              ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-              WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x26,
-                       &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,uVar11);
+              ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+              WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x27,
+                       &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,uVar11);
             }
           }
           else if (*(int *)(param_1 + 6) == 7) {
             if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                 ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                (WPP_GLOBAL_Control[0x29] != '\0')) {
-              uVar17 = 0x27;
-              goto LAB_1;
+              uVar17 = 0x28;
+              goto LAB_3;
             }
           }
           else {
             if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                 ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                (WPP_GLOBAL_Control[0x29] != '\0')) {
-              ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-              WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x28,
-                      &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
-            }
-LAB_2:
+              ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+              WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x29,
+                      &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
+            }
+LAB_4:
             bVar5 = true;
           }
         }
         else if (uVar8 == 2) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
             puVar21 = local_98;
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),puVar21);
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),puVar21);
             WPP_SF_sqddd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),puVar21,ppuVar24,pcVar12);
           }
           if (*(int *)(param_1 + 6) == 4) {
             local_e0[0] = 0;
             local_e0[1] = 0;
             local_d0 = 0;
-            cVar6 = NdisCancelTimerObject(param_1[0x49]);
+            cVar6 = NdisCancelTimerObject(param_1[0x4a]);
             if (cVar6 != '\0') {
               ppuVar24 = (undefined **)0x0;
-              KeSetEvent(param_1 + 0x4b,0);
-            }
-            *(uint *)((longlong)param_1 + 0x184) =
+              KeSetEvent(param_1 + 0x4c,0);
+            }
+            *(uint *)((longlong)param_1 + 0x18c) =
                  (uint)(ushort)(*(ushort *)((longlong)ppuVar25 + 0xc) >> 8 |
                                *(ushort *)((longlong)ppuVar25 + 0xc) << 8);
             uVar10 = *(uint *)(ppuVar25 + 2);
-            *(uint *)(param_1 + 0x31) =
+            *(uint *)(param_1 + 0x32) =
                  uVar10 >> 0x18 | (uVar10 & 0xff0000) >> 8 | (uVar10 & 0xff00) << 8 | uVar10 << 0x18
             ;
             uVar10 = *(uint *)((longlong)ppuVar25 + 0x14);
-            *(uint *)((longlong)param_1 + 0x18c) =
+            *(uint *)((longlong)param_1 + 0x194) =
                  uVar10 >> 0x18 | (uVar10 & 0xff0000) >> 8 | (uVar10 & 0xff00) << 8 | uVar10 << 0x18
             ;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x24);
-            param_1[0x32] = *(undefined **)((longlong)ppuVar25 + 0x1c);
-            param_1[0x33] = puVar19;
+            param_1[0x33] = *(undefined **)((longlong)ppuVar25 + 0x1c);
+            param_1[0x34] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x34);
-            param_1[0x34] = *(undefined **)((longlong)ppuVar25 + 0x2c);
-            param_1[0x35] = puVar19;
+            param_1[0x35] = *(undefined **)((longlong)ppuVar25 + 0x2c);
+            param_1[0x36] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x44);
-            param_1[0x36] = *(undefined **)((longlong)ppuVar25 + 0x3c);
-            param_1[0x37] = puVar19;
+            param_1[0x37] = *(undefined **)((longlong)ppuVar25 + 0x3c);
+            param_1[0x38] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x54);
-            param_1[0x38] = *(undefined **)((longlong)ppuVar25 + 0x4c);
-            param_1[0x39] = puVar19;
-            *(undefined1 *)((longlong)param_1 + 0x1cf) = 0;
+            param_1[0x39] = *(undefined **)((longlong)ppuVar25 + 0x4c);
+            param_1[0x3a] = puVar19;
+            *(undefined1 *)((longlong)param_1 + 0x1d7) = 0;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 100);
-            param_1[0x3a] = *(undefined **)((longlong)ppuVar25 + 0x5c);
-            param_1[0x3b] = puVar19;
+            param_1[0x3b] = *(undefined **)((longlong)ppuVar25 + 0x5c);
+            param_1[0x3c] = puVar19;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x74);
-            param_1[0x3c] = *(undefined **)((longlong)ppuVar25 + 0x6c);
-            param_1[0x3d] = puVar19;
+            param_1[0x3d] = *(undefined **)((longlong)ppuVar25 + 0x6c);
+            param_1[0x3e] = puVar19;
             uVar11 = *(undefined4 *)(ppuVar25 + 0x10);
             uVar2 = *(undefined4 *)((longlong)ppuVar25 + 0x84);
             uVar3 = *(undefined4 *)(ppuVar25 + 0x11);
-            *(undefined4 *)(param_1 + 0x3e) = *(undefined4 *)((longlong)ppuVar25 + 0x7c);
-            *(undefined4 *)((longlong)param_1 + 500) = uVar11;
-            *(undefined4 *)(param_1 + 0x3f) = uVar2;
-            *(undefined4 *)((longlong)param_1 + 0x1fc) = uVar3;
+            *(undefined4 *)(param_1 + 0x3f) = *(undefined4 *)((longlong)ppuVar25 + 0x7c);
+            *(undefined4 *)((longlong)param_1 + 0x1fc) = uVar11;
+            *(undefined4 *)(param_1 + 0x40) = uVar2;
+            *(undefined4 *)((longlong)param_1 + 0x204) = uVar3;
             puVar19 = *(undefined **)((longlong)ppuVar25 + 0x94);
-            param_1[0x40] = *(undefined **)((longlong)ppuVar25 + 0x8c);
-            param_1[0x41] = puVar19;
-            *(undefined1 *)((longlong)param_1 + 0x20f) = 0;
-            if (((*(int *)((longlong)param_1 + 0x184) != 0x100) ||
+            param_1[0x41] = *(undefined **)((longlong)ppuVar25 + 0x8c);
+            param_1[0x42] = puVar19;
+            *(undefined1 *)((longlong)param_1 + 0x217) = 0;
+            if (((*(int *)((longlong)param_1 + 0x18c) != 0x100) ||
                 (*(char *)((longlong)ppuVar25 + 0xe) != '\x01')) ||
-               (*(char *)((longlong)ppuVar25 + 0xf) != '\0')) goto LAB_2;
+               (*(char *)((longlong)ppuVar25 + 0xf) != '\0')) goto LAB_4;
             CtlSetState((longlong)param_1,5,ppuVar24,'\0');
             LOCK();
             *(int *)(param_1 + 2) = *(int *)(param_1 + 2) + 1;
             UNLOCK();
             local_e0[1] = 0;
             local_e0[0] = 0;
             local_d0 = CONCAT44(local_d0._4_4_,0x4d554e45);
             while( true ) {
               ppuVar24 = (undefined **)(param_1[5] + 8);
               plVar14 = EnumListEntry((longlong *)(param_1 + 7),local_e0,(longlong)ppuVar24);
               if (plVar14 == (longlong *)0x0) break;
               if ((plVar14 + -2 != (longlong *)0x0) && ((int)plVar14[4] == 0x43505450)) {
                 CallEventOutboundTunnelEstablished((int *)(plVar14 + -2));
               }
             }
             plVar14 = local_e0;
-LAB_3:
+LAB_5:
             EnumComplete(plVar14,(longlong)(param_1[5] + 8));
-LAB_4:
+LAB_6:
             LOCK();
             ppuVar25 = param_1 + 2;
             iVar1 = *(int *)ppuVar25;
             *(int *)ppuVar25 = *(int *)ppuVar25 + -1;
             UNLOCK();
             if (iVar1 == 1) {
               (*(code *)param_1[3])(param_1);
             }
           }
         }
         else if (uVar8 == 3) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x31,ppuVar24,pcVar12);
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x32,ppuVar24,pcVar12);
           }
           iVar1 = *(int *)(param_1 + 6);
           if (3 < iVar1) {
             if (5 < iVar1) {
-              if (iVar1 != 6) goto LAB_5;
-              cVar6 = NdisCancelTimerObject(param_1[0x4a]);
+              if (iVar1 != 6) goto LAB_7;
+              cVar6 = NdisCancelTimerObject(param_1[0x4b]);
               if (cVar6 != '\0') {
                 ppuVar24 = (undefined **)0x0;
-                KeSetEvent(param_1 + 0x4e,0);
+                KeSetEvent(param_1 + 0x4f,0);
               }
             }
             puVar13 = (ushort *)CtlAllocPacket((longlong)param_1,4);
             if (puVar13 != (ushort *)0x0) {
               *(undefined1 *)(puVar13 + 6) = 1;
               ppuVar24 = &WPP_GLOBAL_Control;
               if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                   ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) &&
                  (1 < (byte)WPP_GLOBAL_Control[0x29])) {
-                pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-                ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-                WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x32,
-                         &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
+                pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+                ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+                WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x33,
+                         &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
               }
               CtlSend((longlong)param_1,puVar13,ppuVar24);
             }
-LAB_6:
+LAB_8:
             CtlSetState((longlong)param_1,7,ppuVar24,'\0');
             CtlCleanup((longlong)param_1,'\0');
           }
         }
         else if (uVar8 == 4) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x33,ppuVar24,pcVar12);
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x34,ppuVar24,pcVar12);
           }
           if (*(int *)(param_1 + 6) == 6) {
-            cVar6 = NdisCancelTimerObject(param_1[0x4a]);
+            cVar6 = NdisCancelTimerObject(param_1[0x4b]);
             if (cVar6 != '\0') {
               ppuVar24 = (undefined **)0x0;
-              KeSetEvent(param_1 + 0x4e,0);
-            }
-            goto LAB_6;
+              KeSetEvent(param_1 + 0x4f,0);
+            }
+            goto LAB_8;
           }
         }
         else if (uVar8 == 5) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (3 < (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-            WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2a,
-                     &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
-          }
-          *(undefined1 *)((longlong)param_1 + 0x244) = 0;
-          if ((*(int *)((longlong)param_1 + 0x184) == 0x100) &&
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+            WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2b,
+                     &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
+          }
+          *(undefined1 *)((longlong)param_1 + 0x24c) = 0;
+          if ((*(int *)((longlong)param_1 + 0x18c) == 0x100) &&
              (puVar13 = (ushort *)CtlAllocPacket((longlong)param_1,6), puVar13 != (ushort *)0x0)) {
             *(undefined4 *)(puVar13 + 6) = *(undefined4 *)((longlong)ppuVar25 + 0xc);
             *(undefined1 *)(puVar13 + 8) = 1;
             CtlSend((longlong)param_1,puVar13,ppuVar24);
           }
         }
         else if (uVar8 == 6) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (3 < (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            uVar17 = 0x38;
-            goto LAB_7;
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            uVar17 = 0x3a;
+            goto LAB_9;
           }
         }
         else {
-          if (uVar8 != 7) goto LAB_8;
+          if (uVar8 != 7) goto LAB_10;
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
              (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-            ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-            WPP_SF_sqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2b,
-                        &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
+            pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+            ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+            WPP_SF_sqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2c,
+                        &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
           }
           if (*(int *)(param_1 + 6) == 5) {
-            cVar6 = NdisCancelTimerObject(param_1[0x4a]);
+            cVar6 = NdisCancelTimerObject(param_1[0x4b]);
             if (cVar6 != '\0') {
-              KeSetEvent(param_1 + 0x4e,0,0);
+              KeSetEvent(param_1 + 0x4f,0,0);
             }
             CallEventCallOutRequest((undefined8 *)param_1[5],(int *)param_1,(longlong)ppuVar25);
             ppuVar24 = ppuVar25;
           }
         }
       }
       else if (uVar8 == 9) {
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x35,ppuVar24,pcVar12);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x36,ppuVar24,pcVar12);
         }
         if (*(int *)(param_1 + 6) == 5) {
-          cVar6 = NdisCancelTimerObject(param_1[0x4a]);
+          cVar6 = NdisCancelTimerObject(param_1[0x4b]);
           if (cVar6 != '\0') {
-            KeSetEvent(param_1 + 0x4e,0,0);
+            KeSetEvent(param_1 + 0x4f,0,0);
           }
           CallEventCallInRequest((undefined8 *)param_1[5],(int *)param_1,(longlong)ppuVar25);
           ppuVar24 = ppuVar25;
         }
       }
       else if (uVar8 == 10) {
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x36,ppuVar24,pcVar12);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x37,ppuVar24,pcVar12);
         }
       }
       else if (uVar8 == 0xb) {
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x37,ppuVar24,pcVar12);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          WPP_SF_sqd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x38,ppuVar24,pcVar12);
         }
         if (*(int *)(param_1 + 6) == 5) {
-          uVar8 = *(ushort *)((longlong)ppuVar25 + 0xc) >> 8 |
-                  *(ushort *)((longlong)ppuVar25 + 0xc) << 8;
-          uVar10 = (uint)uVar8;
+          uVar22 = (uint)(ushort)(*(ushort *)((longlong)ppuVar25 + 0xc) >> 8 |
+                                 *(ushort *)((longlong)ppuVar25 + 0xc) << 8);
+          uVar10 = uVar22;
           if (PptpClientSide != '\0') {
-            uVar10 = uVar8 & 0x3fff;
-          }
-          piVar15 = (int *)CallGetCall((longlong)param_1[5],(ulonglong)uVar10);
+            uVar10 = uVar22 & 0x3fff;
+          }
+          piVar15 = CallGetCall((longlong)param_1[5],(ulonglong)uVar10);
           if (piVar15 != (int *)0x0) {
-            CallEventCallInConnect(piVar15,(longlong)ppuVar25,ppuVar24);
+            if ((piVar15[0xc] == 0x43505450) && (*(undefined ***)(piVar15 + 0x14) == param_1)) {
+              CallEventCallInConnect(piVar15,(longlong)ppuVar25,ppuVar24);
+            }
+            else {
+              ppuVar24 = &WPP_GLOBAL_Control;
+              if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+                 (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0 &&
+                  (WPP_GLOBAL_Control[0x29] != '\0')))) {
+                uVar17 = 0x39;
+                goto LAB_1;
+              }
+            }
+            goto LAB_2;
           }
         }
       }
       else if (uVar8 == 0xc) {
         uVar8 = *(ushort *)((longlong)ppuVar25 + 0xc);
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-          WPP_SF_sqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2f,
-                      &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+          WPP_SF_sqdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x30,
+                      &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
         }
         if (*(int *)(param_1 + 6) == 5) {
           LOCK();
           *(int *)(param_1 + 2) = *(int *)(param_1 + 2) + 1;
           UNLOCK();
           local_c8[4] = 0;
           local_c8[3] = 0;
           local_c8[5] = 0x4d554e45;
           do {
             uVar7 = KeAcquireSpinLockRaiseToDpc(param_1[5] + 8);
             ppuVar24 = (undefined **)0x0;
             param_1[5][0x10] = uVar7;
             plVar14 = EnumListEntry((longlong *)(param_1 + 7),local_c8 + 3,0);
             if (((plVar14 != (longlong *)0x0) &&
                 (plVar16 = plVar14 + -2, plVar16 != (longlong *)0x0)) &&
                (((int)plVar14[4] == 0x43505450 &&
                 (((undefined **)plVar14[8] == param_1 &&
                  (*(ushort *)((longlong)plVar14 + 300) == (ushort)(uVar8 >> 8 | uVar8 << 8))))))) {
               LOCK();
               *(int *)plVar16 = (int)*plVar16 + 1;
               UNLOCK();
               puVar19 = param_1[5];
               uVar20 = CONCAT71((int7)((ulonglong)puVar19 >> 8),puVar19[0x10]);
               KeReleaseSpinLock(puVar19 + 8);
               ppuVar24 = param_1;
               CallEventCallClearRequest((int *)plVar16,uVar20,(longlong)param_1);
               DereferenceRefCount((int *)plVar16);
               break;
             }
             KeReleaseSpinLock(param_1[5] + 8,param_1[5][0x10]);
           } while (plVar14 != (longlong *)0x0);
           plVar14 = local_c8 + 3;
-          goto LAB_3;
+          goto LAB_5;
         }
       }
       else if (uVar8 == 0xd) {
         uVar8 = *(ushort *)((longlong)ppuVar25 + 0xc);
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
           puVar21 = local_98;
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),puVar21);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),puVar21);
           WPP_SF_sqdddd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),puVar21,ppuVar24,pcVar12);
         }
         if (*(int *)(param_1 + 6) == 5) {
           plVar14 = (longlong *)0x0;
           bVar4 = false;
           LOCK();
           *(int *)(param_1 + 2) = *(int *)(param_1 + 2) + 1;
           UNLOCK();
           local_c8[1] = 0;
           local_c8[0] = 0;
           local_c8[2] = 0x4d554e45;
           do {
             ppuVar24 = (undefined **)(param_1[5] + 8);
             plVar16 = EnumListEntry((longlong *)(param_1 + 7),local_c8,(longlong)ppuVar24);
-            if (plVar16 == (longlong *)0x0) goto LAB_9;
+            if (plVar16 == (longlong *)0x0) goto LAB_11;
             plVar14 = plVar16 + -2;
           } while (((plVar14 == (longlong *)0x0) || ((int)plVar16[4] != 0x43505450)) ||
                   (((undefined **)plVar16[8] != param_1 ||
                    (*(ushort *)((longlong)plVar16 + 300) != (ushort)(uVar8 >> 8 | uVar8 << 8)))));
           bVar4 = true;
-LAB_9:
+LAB_11:
           puVar19 = param_1[5] + 8;
           EnumComplete(local_c8,(longlong)puVar19);
           if (bVar4) {
             CallEventCallDisconnectNotify((int *)plVar14,puVar19,(undefined *)ppuVar24);
           }
-          goto LAB_4;
+          goto LAB_6;
         }
       }
       else if (uVar8 == 0xe) {
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (WPP_GLOBAL_Control[0x29] != '\0')) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          uVar17 = 0x39;
-LAB_7:
-          ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          uVar17 = 0x3b;
+LAB_9:
+          ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
           WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar17,
-                   &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
+                   &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
         }
       }
       else if (uVar8 == 0xf) {
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (bVar23 <= (byte)WPP_GLOBAL_Control[0x29])) {
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),local_98);
-          ppuVar24 = (undefined **)&WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-          WPP_SF_sq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x34,
-                    &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar12);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),local_98);
+          ppuVar24 = (undefined **)&WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+          WPP_SF_sq(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x35,
+                    &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar12);
         }
       }
       else {
-LAB_8:
+LAB_10:
         if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
             ((bVar23 & (byte)*(undefined4 *)(WPP_GLOBAL_Control + 0x2c)) != 0)) &&
            (WPP_GLOBAL_Control[0x29] != '\0')) {
           puVar21 = local_98;
-          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),puVar21);
+          pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),puVar21);
           WPP_SF_ds(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),puVar21,ppuVar24,
                     (uint)(ushort)(*(ushort *)(ppuVar25 + 1) >> 8 | *(ushort *)(ppuVar25 + 1) << 8),
                     pcVar12);
         }
       }
     }
     else {
       bVar5 = true;
       if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
         return;
       }
       if (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) == 0) || (WPP_GLOBAL_Control[0x29] == '\0'))
       break;
       puVar21 = local_98;
-      pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2d),puVar21);
+      pcVar12 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x2e),puVar21);
       WPP_SF_sdDdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),puVar21,ppuVar24,pcVar12);
     }
-LAB_5:
+LAB_7:
   } while (!bVar5);
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) {
-    WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3c,
-            &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+    WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x3e,
+            &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
   }
   return;
 }
 

```


## CtlpDeathTimeout

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.49|
|i_ratio|0.56|
|m_ratio|0.79|
|b_ratio|0.71|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CtlpDeathTimeout|CtlpDeathTimeout|
|fullname|CtlpDeathTimeout|CtlpDeathTimeout|
|refcount|3|3|
|`length`|170|262|
|`called`|CtlCleanup<br>CtlSetState<br>GetStringFromSockAddr<br>WPP_SF_s<br>__security_check_cookie<br>memset|CtlCleanup<br>CtlSetState<br>GetStringFromSockAddr<br>WPP_SF_q<br>WPP_SF_s<br>WskConnDisconnectEvent<br>__security_check_cookie<br>memset|
|calling|CtlpStopTimeout<br>CtlpWaitTimeout|CtlpStopTimeout<br>CtlpWaitTimeout|
|paramcount|1|1|
|`address`|1c00139f4|1c0013b50|
|sig|undefined __fastcall CtlpDeathTimeout(longlong param_1)|undefined __fastcall CtlpDeathTimeout(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CtlpDeathTimeout Called Diff


```diff
--- CtlpDeathTimeout called
+++ CtlpDeathTimeout called
@@ -3,0 +4 @@
+WPP_SF_q
@@ -4,0 +6 @@
+WskConnDisconnectEvent
```


### CtlpDeathTimeout Diff


```diff
--- CtlpDeathTimeout
+++ CtlpDeathTimeout
@@ -1,27 +1,40 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 
 void CtlpDeathTimeout(longlong param_1)
 
 {
   char *pcVar1;
-  undefined *puVar2;
+  longlong lVar2;
+  undefined *puVar3;
   undefined1 auStack_88 [32];
   undefined1 local_68 [80];
   ulonglong local_18;
   
   local_18 = __security_cookie ^ (ulonglong)auStack_88;
-  puVar2 = (undefined *)0x41;
+  puVar3 = (undefined *)0x41;
   memset(local_68,0,0x41);
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) {
-    pcVar1 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x168),local_68);
-    puVar2 = &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids;
-    WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5c,
-             &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,pcVar1);
+    pcVar1 = (char *)GetStringFromSockAddr((short *)(param_1 + 0x170),local_68);
+    puVar3 = &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids;
+    WPP_SF_s(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x60,
+             &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,pcVar1);
   }
-  CtlSetState(param_1,7,puVar2,'\0');
-  CtlCleanup(param_1,'\0');
+  CtlSetState(param_1,7,puVar3,'\0');
+  lVar2 = *(longlong *)(param_1 + 0x88);
+  if (lVar2 == 0) {
+    CtlCleanup(param_1,'\0');
+  }
+  else {
+    if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+        ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) {
+      WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x61,
+               &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,param_1);
+      lVar2 = *(longlong *)(param_1 + 0x88);
+    }
+    WskConnDisconnectEvent(lVar2);
+  }
   return;
 }
 

```


## CallReceiveDatagramCallback

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.91|
|i_ratio|0.67|
|m_ratio|0.99|
|b_ratio|0.97|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CallReceiveDatagramCallback|CallReceiveDatagramCallback|
|fullname|CallReceiveDatagramCallback|CallReceiveDatagramCallback|
|refcount|4|4|
|`length`|1283|1305|
|`called`|<details><summary>Expand for full list:<br>CallGetCall<br>CallQueueReceiveNBL<br>CompareSockAddress<br>GetStringFromSockAddr<br>NDIS.SYS::NdisGetDataBuffer<br>ProcessIpv4AddressFromPacket<br>ReceiveDataComplete<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_ss<br>__security_check_cookie</summary></details>|<details><summary>Expand for full list:<br>CallGetCall<br>CallQueueReceiveNBL<br>CompareSockAddress<br>DereferenceRefCount<br>GetStringFromSockAddr<br>NDIS.SYS::NdisGetDataBuffer<br>ProcessIpv4AddressFromPacket<br>ReceiveDataComplete<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_ss</summary>__security_check_cookie</details>|
|calling|||
|paramcount|3|3|
|`address`|1c0010570|1c0010580|
|sig|int __fastcall CallReceiveDatagramCallback(longlong param_1, longlong param_2, longlong * param_3)|int __fastcall CallReceiveDatagramCallback(longlong param_1, longlong param_2, longlong * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CallReceiveDatagramCallback Called Diff


```diff
--- CallReceiveDatagramCallback called
+++ CallReceiveDatagramCallback called
@@ -3,0 +4 @@
+DereferenceRefCount
```


### CallReceiveDatagramCallback Diff


```diff
--- CallReceiveDatagramCallback
+++ CallReceiveDatagramCallback
@@ -1,210 +1,211 @@
 
 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
 /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
 
 int CallReceiveDatagramCallback(longlong param_1,longlong param_2,longlong *param_3)
 
 {
   byte *pbVar1;
   byte bVar2;
   short sVar3;
   uint uVar4;
   short *psVar5;
   longlong lVar6;
   longlong lVar7;
   bool bVar8;
   int iVar9;
   char *pcVar10;
   undefined8 uVar11;
   char *pcVar12;
   ulonglong uVar13;
   ushort uVar14;
   ulonglong uVar15;
   int *piVar16;
   int iVar18;
   undefined1 auStackY_138 [32];
   uint local_f8;
   uint local_f4;
   longlong local_f0;
   undefined1 local_e8 [80];
   undefined1 local_98 [80];
   ulonglong local_48;
   int *piVar17;
   
   local_48 = __security_cookie ^ (ulonglong)auStackY_138;
   psVar5 = *(short **)(param_2 + 8);
   piVar17 = (int *)0x0;
   piVar16 = (int *)0x0;
   lVar6 = *(longlong *)(param_1 + 0x40);
   local_f8 = 0;
   sVar3 = *psVar5;
   local_f0 = param_1;
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) {
     WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x48,
-            &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+            &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
   }
   if (sVar3 == 2) {
     LOCK();
     _DAT_0 = _DAT_0 + 1;
     UNLOCK();
     uVar11 = 0;
     uVar4 = *(uint *)(param_3[1] + 0x18);
     pcVar10 = (char *)NdisGetDataBuffer(param_3[1],(ulonglong)uVar4,0,1);
     if (pcVar10 == (char *)0x0) {
       if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
           ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) &&
          (WPP_GLOBAL_Control[0x29] != '\0')) {
         WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4a,
-                &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+                &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
       }
       iVar9 = -0x3ffffde5;
     }
     else {
       uVar11 = ProcessIpv4AddressFromPacket(pcVar10,uVar4,uVar11,&local_f8);
       iVar9 = (int)uVar11;
-      if ((-1 < iVar9) && ((ulonglong)local_f8 + 0xc <= (ulonglong)uVar4)) {
-        pbVar1 = (byte *)(pcVar10 + local_f8);
+      if ((-1 < iVar9) && (uVar13 = (ulonglong)local_f8, uVar13 + 0xc <= (ulonglong)uVar4)) {
+        pbVar1 = (byte *)(pcVar10 + uVar13);
         bVar2 = *pbVar1;
-        uVar13 = (ulonglong)bVar2;
         local_f4 = (bVar2 & 0x10 | 0x20) >> 2;
         iVar18 = (uVar4 - local_f4) - local_f8;
         local_f4 = local_f4 + local_f8;
-        if ((((((uVar4 < local_f4) ||
-               (iVar18 < (int)(uint)(ushort)(*(ushort *)(pbVar1 + 4) >> 8 |
-                                            *(ushort *)(pbVar1 + 4) << 8))) ||
-              ((bVar2 & 0x6f) != 0x20)) || (((char)bVar2 < '\0' || ((pbVar1[1] & 7) != 1)))) ||
-            ((pbVar1[1] & 0x78) != 0)) || (*(short *)(pbVar1 + 2) != 0xb88)) {
+        if (((((((uVar4 < local_f4) ||
+                (iVar18 < (int)(uint)(ushort)(*(ushort *)(pbVar1 + 4) >> 8 |
+                                             *(ushort *)(pbVar1 + 4) << 8))) || ((bVar2 & 0xf) != 0)
+               ) || (((bVar2 & 0x20) == 0 || ((bVar2 & 0x40) != 0)))) || ((char)bVar2 < '\0')) ||
+            (((pbVar1[1] & 7) != 1 || ((pbVar1[1] & 0x78) != 0)))) ||
+           (*(short *)(pbVar1 + 2) != 0xb88)) {
           if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
               ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) &&
              (WPP_GLOBAL_Control[0x29] != '\0')) {
             WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4c,
-                    &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+                    &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
           }
           iVar9 = -0x3fffffff;
           LOCK();
           _DAT_1 = _DAT_1 + 1;
           UNLOCK();
           if (local_f4 <= uVar4) {
             piVar16 = piVar17;
             if (iVar18 < (int)(uint)(ushort)(*(ushort *)(pbVar1 + 4) >> 8 |
                                             *(ushort *)(pbVar1 + 4) << 8)) {
               LOCK();
               _DAT_2 = _DAT_2 + 1;
               UNLOCK();
             }
             goto LAB_3;
           }
           LOCK();
           _DAT_4 = _DAT_4 + 1;
           UNLOCK();
         }
         else {
           uVar14 = *(ushort *)(pbVar1 + 6) >> 8 | *(ushort *)(pbVar1 + 6) << 8;
           if (PptpClientSide == '\0') {
             uVar15 = (ulonglong)uVar14;
           }
           else {
             uVar15 = (ulonglong)(uVar14 & 0x3fff);
           }
-          piVar16 = (int *)CallGetCall(local_f0,uVar15);
-          if ((piVar16 != (int *)0x0) && (piVar16[0xc] == 0x43505450)) {
+          piVar16 = CallGetCall(local_f0,uVar15);
+          if ((piVar16 != (int *)0x0) && (DereferenceRefCount(piVar16), piVar16[0xc] == 0x43505450))
+          {
             LOCK();
             piVar16[0x9a] = piVar16[0x9a] + 1;
             UNLOCK();
             if (PptpValidateAddress != 0) {
               piVar17 = piVar16 + 0x46;
               bVar8 = CompareSockAddress(psVar5,(short *)piVar17);
               if (!bVar8) {
                 if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
                     ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) &&
                    (WPP_GLOBAL_Control[0x29] != '\0')) {
                   pcVar10 = (char *)GetStringFromSockAddr((short *)piVar17,local_e8);
                   pcVar12 = (char *)GetStringFromSockAddr(psVar5,local_98);
                   WPP_SF_ss(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4e,uVar13,pcVar12,pcVar10);
                 }
                 LOCK();
                 _DAT_5 = _DAT_5 + 1;
                 UNLOCK();
                 LOCK();
                 piVar16[0xa4] = piVar16[0xa4] + 1;
                 UNLOCK();
                 if (((*(char *)((longlong)piVar16 + 0xc2) != '\0') &&
                     ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control)) &&
                    (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x800) != 0 &&
                     (3 < (byte)WPP_GLOBAL_Control[0x29])))) {
                   pcVar10 = (char *)GetStringFromSockAddr((short *)piVar17,local_e8);
                   pcVar12 = (char *)GetStringFromSockAddr(psVar5,local_98);
                   WPP_SF_ss(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4f,uVar13,pcVar12,pcVar10);
                 }
                 goto LAB_6;
               }
             }
             lVar7 = param_3[2];
             uVar13 = (ulonglong)*(ushort *)(lVar7 + 10);
             *(byte **)(uVar13 + 0x18 + lVar7) = pbVar1;
             *(longlong *)(uVar13 + 0x20 + lVar7) = lVar6;
             *(char **)(uVar13 + 0x10 + lVar7) = pcVar10;
             *(uint *)(uVar13 + 0x28 + lVar7) = uVar4;
             uVar11 = CallQueueReceiveNBL(piVar16,param_3);
             if ((int)uVar11 == 0) goto LAB_7;
             goto LAB_3;
           }
           if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
              (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0 &&
               (WPP_GLOBAL_Control[0x29] != '\0')))) {
             WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4d,
-                    &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+                    &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
           }
           LOCK();
           _DAT_8 = _DAT_8 + 1;
           UNLOCK();
         }
 LAB_6:
         iVar9 = -0x3fffffff;
         goto LAB_3;
       }
       if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
          (((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0 && (WPP_GLOBAL_Control[0x29] != '\0'))
          )) {
         WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x4b,
-                &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+                &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
       }
       iVar9 = -0x3fffffff;
     }
     LOCK();
     _DAT_9 = _DAT_9 + 1;
     UNLOCK();
     piVar16 = piVar17;
   }
   else {
     if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
         ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0'))
     {
       WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x49,
-              &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids);
+              &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids);
     }
     iVar9 = -0x3fffffff;
     piVar16 = piVar17;
   }
 LAB_3:
   ReceiveDataComplete(lVar6,(longlong)param_3);
 LAB_7:
   if (iVar9 != 0) {
     if (piVar16 != (int *)0x0) {
       LOCK();
       piVar16[0x9c] = piVar16[0x9c] + 1;
       UNLOCK();
     }
     LOCK();
     DAT_10 = DAT_10 + 1;
     UNLOCK();
   }
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) {
     WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x50,
-             &WPP_d1208b06bde034e56d10b096047d14ae_Traceguids,iVar9);
+             &WPP_cc698d6f01a2387b3fd67c4a3cc5ece8_Traceguids,iVar9);
   }
   return iVar9;
 }
 

```


## CallGetCall

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,sig,called|
|ratio|0.29|
|i_ratio|0.67|
|m_ratio|0.95|
|b_ratio|0.91|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CallGetCall|CallGetCall|
|fullname|CallGetCall|CallGetCall|
|refcount|4|4|
|`length`|176|195|
|`called`|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>ReferenceRefCount|
|calling|CallReceiveDatagramCallback<br>CtlpEngine|CallReceiveDatagramCallback<br>CtlpEngine|
|paramcount|2|2|
|address|1c000fb00|1c000fb00|
|`sig`|longlong __fastcall CallGetCall(longlong param_1, ulonglong param_2)|int * __fastcall CallGetCall(longlong param_1, ulonglong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CallGetCall Called Diff


```diff
--- CallGetCall called
+++ CallGetCall called
@@ -2,0 +3 @@
+ReferenceRefCount
```


### CallGetCall Diff


```diff
--- CallGetCall
+++ CallGetCall
@@ -1,26 +1,35 @@
 
-longlong CallGetCall(longlong param_1,ulonglong param_2)
+int * CallGetCall(longlong param_1,ulonglong param_2)
 
 {
-  undefined1 uVar1;
-  ulonglong uVar2;
-  longlong lVar3;
+  int *piVar1;
+  undefined1 uVar2;
+  ulonglong uVar3;
+  int *piVar4;
   
-  lVar3 = 0;
-  uVar1 = KeAcquireSpinLockRaiseToDpc(param_1 + 8);
-  uVar2 = (ulonglong)PptpBaseCallId;
-  *(undefined1 *)(param_1 + 0x10) = uVar1;
-  if ((uVar2 <= param_2) && (param_2 < PptpMaxCallId)) {
+  piVar4 = (int *)0x0;
+  uVar2 = KeAcquireSpinLockRaiseToDpc(param_1 + 8);
+  uVar3 = (ulonglong)PptpBaseCallId;
+  *(undefined1 *)(param_1 + 0x10) = uVar2;
+  if ((uVar3 <= param_2) && (param_2 < PptpMaxCallId)) {
     if (PptpCallIdMaskSet == '\0') {
-      lVar3 = *(longlong *)(*(longlong *)(param_1 + 0x20) + (param_2 - uVar2) * 8);
+      piVar4 = *(int **)(*(longlong *)(param_1 + 0x20) + (param_2 - uVar3) * 8);
     }
-    else if ((((PptpCallIdMask & param_2) < (ulonglong)PptpWanEndpoints) &&
-             (lVar3 = *(longlong *)(*(longlong *)(param_1 + 0x20) + (PptpCallIdMask & param_2) * 8),
-             lVar3 != 0)) && (*(ulonglong *)(lVar3 + 0xd0) != param_2)) {
-      lVar3 = 0;
+    else {
+      if (((ulonglong)PptpWanEndpoints <= (PptpCallIdMask & param_2)) ||
+         (piVar1 = *(int **)(*(longlong *)(param_1 + 0x20) + (PptpCallIdMask & param_2) * 8),
+         piVar4 = piVar1, piVar1 == (int *)0x0)) goto LAB_0;
+      piVar4 = (int *)0x0;
+      if (*(ulonglong *)(piVar1 + 0x34) == param_2) {
+        piVar4 = piVar1;
+      }
+    }
+    if (piVar4 != (int *)0x0) {
+      ReferenceRefCount(piVar4);
     }
   }
-  KeReleaseSpinLock(param_1 + 8,uVar1);
-  return lVar3;
+LAB_0:
+  KeReleaseSpinLock(param_1 + 8,*(undefined1 *)(param_1 + 0x10));
+  return piVar4;
 }
 

```


## CtlAlloc

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.83|
|i_ratio|0.68|
|m_ratio|0.99|
|b_ratio|0.99|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CtlAlloc|CtlAlloc|
|fullname|CtlAlloc|CtlAlloc|
|refcount|3|3|
|`length`|636|652|
|`called`|CtlFree<br>MyMemAlloc<br>NDIS.SYS::NdisAllocateTimerObject<br>NTOSKRNL.EXE::ExInterlockedInsertTailList<br>NTOSKRNL.EXE::KeInitializeEvent<br>NTOSKRNL.EXE::KeInitializeSpinLock<br>ReferenceAdapter<br>WPP_SF_<br>memset|CtlFree<br>MyMemAlloc<br>NDIS.SYS::NdisAllocateTimerObject<br>NTOSKRNL.EXE::ExInitializeRundownProtection<br>NTOSKRNL.EXE::ExInterlockedInsertTailList<br>NTOSKRNL.EXE::KeInitializeEvent<br>NTOSKRNL.EXE::KeInitializeSpinLock<br>ReferenceAdapter<br>WPP_SF_<br>memset|
|calling|CtlConnectCall<br>CtlConnectQueryCallback|CtlConnectCall<br>CtlConnectQueryCallback|
|paramcount|1|1|
|`address`|1c0011da0|1c0011dc0|
|sig|longlong * __fastcall CtlAlloc(undefined8 * param_1)|longlong * __fastcall CtlAlloc(undefined8 * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CtlAlloc Called Diff


```diff
--- CtlAlloc called
+++ CtlAlloc called
@@ -3,0 +4 @@
+NTOSKRNL.EXE::ExInitializeRundownProtection
```


### CtlAlloc Diff


```diff
--- CtlAlloc
+++ CtlAlloc
@@ -1,83 +1,84 @@
 
 longlong * CtlAlloc(undefined8 *param_1)
 
 {
   longlong *plVar1;
   int iVar2;
   longlong *_Dst;
   undefined2 uVar3;
   undefined4 local_28;
   undefined4 local_24;
   code *local_20;
   longlong *local_18;
   
-  _Dst = (longlong *)MyMemAlloc(0x290,0x54505450);
+  _Dst = (longlong *)MyMemAlloc(0x298,0x54505450);
   if (_Dst == (longlong *)0x0) {
     if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
         ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) != 0)) && (WPP_GLOBAL_Control[0x29] != '\0')) {
       WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),10,
-              &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+              &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
     }
     return (longlong *)0x0;
   }
-  memset(_Dst,0,0x290);
+  memset(_Dst,0,0x298);
   ReferenceAdapter((longlong)param_1);
   *(undefined4 *)(_Dst + 4) = 0x54505450;
-  _Dst[0x46] = (longlong)&DAT_0;
+  _Dst[0x47] = (longlong)&DAT_0;
   _Dst[5] = (longlong)param_1;
-  KeInitializeSpinLock(_Dst + 0xb);
+  ExInitializeRundownProtection(_Dst + 0xb);
+  KeInitializeSpinLock(_Dst + 0xc);
   _Dst[1] = (longlong)_Dst;
   plVar1 = _Dst + 7;
   _Dst[8] = (longlong)plVar1;
   *plVar1 = (longlong)plVar1;
   *_Dst = (longlong)_Dst;
-  plVar1 = _Dst + 0xe;
-  _Dst[0xf] = (longlong)plVar1;
+  plVar1 = _Dst + 0xf;
+  _Dst[0x10] = (longlong)plVar1;
   *plVar1 = (longlong)plVar1;
   local_20 = CtlpEchoTimeout;
   local_28 = 0x180197;
   local_24 = 0x544d5450;
   local_18 = _Dst;
-  iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x47);
+  iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x48);
   if (iVar2 == 0) {
     local_20 = CtlpWaitTimeout;
-    iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x49);
+    iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x4a);
     if (iVar2 == 0) {
       local_20 = CtlpStopTimeout;
-      iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x4a);
+      iVar2 = NdisAllocateTimerObject(*param_1,&local_28,_Dst + 0x4b);
       if (iVar2 == 0) {
-        KeInitializeEvent(_Dst + 0x4b,0,1);
-        KeInitializeEvent(_Dst + 0x4e,0,1);
+        KeInitializeEvent(_Dst + 0x4c,0,1);
+        KeInitializeEvent(_Dst + 0x4f,0,1);
         *(undefined4 *)(_Dst + 2) = 1;
         _Dst[3] = (longlong)CtlFree;
         ExInterlockedInsertTailList(param_1 + 5,_Dst,param_1 + 1);
         goto LAB_1;
       }
       if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
           ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || (WPP_GLOBAL_Control[0x29] == '\0'))
       goto LAB_1;
       uVar3 = 0xd;
     }
     else {
       if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
           ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || (WPP_GLOBAL_Control[0x29] == '\0'))
       goto LAB_1;
       uVar3 = 0xc;
     }
   }
   else {
     if ((((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
         ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 1) == 0)) || (WPP_GLOBAL_Control[0x29] == '\0'))
     goto LAB_1;
     uVar3 = 0xb;
   }
   WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar3,
-          &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+          &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
 LAB_1:
   if (iVar2 != 0) {
     CtlFree(_Dst);
     _Dst = (longlong *)0x0;
   }
   return _Dst;
 }
 

```


## CtlpCleanup

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.79|
|i_ratio|0.35|
|m_ratio|0.95|
|b_ratio|0.95|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|CtlpCleanup|CtlpCleanup|
|fullname|CtlpCleanup|CtlpCleanup|
|refcount|3|3|
|`length`|844|934|
|`called`|<details><summary>Expand for full list:<br>CallCleanup<br>CallSetState<br>DeleteHostRoute<br>EnumComplete<br>EnumListEntry<br>NDIS.SYS::NdisCancelTimerObject<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeSetEvent<br>NTOSKRNL.EXE::KeWaitForMultipleObjects<br>WPP_SF_</summary>WPP_SF_D<br>_guard_dispatch_icall</details>|<details><summary>Expand for full list:<br>CallCleanup<br>CallSetState<br>DeleteHostRoute<br>EnumComplete<br>EnumListEntry<br>NDIS.SYS::NdisCancelTimerObject<br>NTOSKRNL.EXE::ExRundownCompleted<br>NTOSKRNL.EXE::ExWaitForRundownProtectionRelease<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeSetEvent</summary>NTOSKRNL.EXE::KeWaitForMultipleObjects<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_q<br>_guard_dispatch_icall</details>|
|calling|||
|paramcount|1|1|
|`address`|1c00136a0|1c00137a0|
|sig|undefined __fastcall CtlpCleanup(longlong param_1)|undefined __fastcall CtlpCleanup(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### CtlpCleanup Called Diff


```diff
--- CtlpCleanup called
+++ CtlpCleanup called
@@ -6,0 +7,2 @@
+NTOSKRNL.EXE::ExRundownCompleted
+NTOSKRNL.EXE::ExWaitForRundownProtectionRelease
@@ -12,0 +15 @@
+WPP_SF_q
```


### CtlpCleanup Diff


```diff
--- CtlpCleanup
+++ CtlpCleanup
@@ -1,139 +1,147 @@
 
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 
 void CtlpCleanup(longlong param_1)
 
 {
   longlong lVar1;
   longlong *plVar2;
   longlong *plVar3;
   int *piVar4;
   int iVar5;
   longlong lVar6;
   bool bVar7;
   undefined1 uVar8;
   char cVar9;
   longlong *plVar10;
   undefined8 uVar11;
   undefined *puVar12;
   longlong local_48;
   longlong local_40;
   longlong local_38;
   undefined8 local_30;
   undefined4 local_28;
   undefined4 local_24;
   
   lVar6 = *(longlong *)(param_1 + 0x18);
   bVar7 = false;
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])) {
     WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x12,
-            &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+            &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
   }
-  lVar1 = lVar6 + 0x58;
+  lVar1 = lVar6 + 0x60;
   uVar8 = KeAcquireSpinLockRaiseToDpc(lVar1);
   plVar2 = (longlong *)(lVar6 + 0x38);
-  *(undefined1 *)(lVar6 + 0x60) = uVar8;
+  *(undefined1 *)(lVar6 + 0x68) = uVar8;
   if ((longlong *)*plVar2 == plVar2) {
 LAB_0:
-    if (*(longlong **)(lVar6 + 0x70) == (longlong *)(lVar6 + 0x70)) {
-      if (*(char *)(lVar6 + 0x245) == '\0') {
-        *(undefined1 *)(lVar6 + 0x245) = 1;
-        KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x60));
-        NdisCancelTimerObject(*(undefined8 *)(lVar6 + 0x238));
+    if (*(longlong **)(lVar6 + 0x78) == (longlong *)(lVar6 + 0x78)) {
+      if (*(char *)(lVar6 + 0x24d) == '\0') {
+        *(undefined1 *)(lVar6 + 0x24d) = 1;
+        KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x68));
+        NdisCancelTimerObject(*(undefined8 *)(lVar6 + 0x240));
         uVar8 = KeAcquireSpinLockRaiseToDpc(lVar1);
-        *(undefined1 *)(lVar6 + 0x60) = uVar8;
+        *(undefined1 *)(lVar6 + 0x68) = uVar8;
       }
       if (*(int *)(lVar6 + 0x10) == 2) {
-        KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x60));
-        cVar9 = NdisCancelTimerObject(*(undefined8 *)(lVar6 + 0x248));
-        if (cVar9 == '\x01') {
-          KeSetEvent(lVar6 + 600,0,0);
-        }
+        KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x68));
         cVar9 = NdisCancelTimerObject(*(undefined8 *)(lVar6 + 0x250));
         if (cVar9 == '\x01') {
-          KeSetEvent(lVar6 + 0x270,0,0);
+          KeSetEvent(lVar6 + 0x260,0,0);
         }
-        local_48 = lVar6 + 600;
-        local_40 = lVar6 + 0x270;
+        cVar9 = NdisCancelTimerObject(*(undefined8 *)(lVar6 + 600));
+        if (cVar9 == '\x01') {
+          KeSetEvent(lVar6 + 0x278,0,0);
+        }
+        local_48 = lVar6 + 0x260;
+        local_40 = lVar6 + 0x278;
         KeWaitForMultipleObjects(2,&local_48,0,0,0,0,0,0);
         bVar7 = true;
         uVar8 = KeAcquireSpinLockRaiseToDpc(lVar1);
-        *(undefined1 *)(lVar6 + 0x60) = uVar8;
+        *(undefined1 *)(lVar6 + 0x68) = uVar8;
         goto LAB_1;
       }
       if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
           ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29])
          ) {
         WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x14,
-                 &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids,*(int *)(lVar6 + 0x10));
+                 &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,*(int *)(lVar6 + 0x10));
       }
     }
   }
   else {
     local_24 = 0;
     if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
         ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (1 < (byte)WPP_GLOBAL_Control[0x29]))
     {
       WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x13,
-              &WPP_be37cabcf8053ca2192e70b03bf2a59b_Traceguids);
+              &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids);
     }
     LOCK();
     *(int *)(lVar6 + 0x10) = *(int *)(lVar6 + 0x10) + 1;
     UNLOCK();
-    KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x60));
+    KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x68));
     local_30 = 0;
     puVar12 = (undefined *)(*(longlong *)(lVar6 + 0x28) + 8);
     local_38 = 0;
     local_28 = 0x4d554e45;
     plVar10 = EnumListEntry(plVar2,&local_38,(longlong)puVar12);
     while (plVar10 != (longlong *)0x0) {
       plVar3 = plVar10 + -2;
       if ((plVar3 != (longlong *)0x0) && ((int)plVar10[4] == 0x43505450)) {
         uVar11 = 0xb;
         CallSetState((longlong)plVar3,0xb,puVar12,'\0');
         CallCleanup((int *)plVar3,uVar11,puVar12);
       }
       puVar12 = (undefined *)(*(longlong *)(lVar6 + 0x28) + 8);
       plVar10 = EnumListEntry(plVar2,&local_38,(longlong)puVar12);
     }
     EnumComplete(&local_38,*(longlong *)(lVar6 + 0x28) + 8);
     LOCK();
     piVar4 = (int *)(lVar6 + 0x10);
     iVar5 = *piVar4;
     *piVar4 = *piVar4 + -1;
     UNLOCK();
     if (iVar5 == 1) {
       (**(code **)(lVar6 + 0x18))(lVar6);
     }
     uVar8 = KeAcquireSpinLockRaiseToDpc(lVar1);
-    *(undefined1 *)(lVar6 + 0x60) = uVar8;
+    *(undefined1 *)(lVar6 + 0x68) = uVar8;
     if ((longlong *)*plVar2 == plVar2) goto LAB_0;
   }
-  *(undefined1 *)(lVar6 + 0x68) = 0;
+  *(undefined1 *)(lVar6 + 0x70) = 0;
 LAB_1:
-  KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x60));
+  KeReleaseSpinLock(lVar1,*(undefined1 *)(lVar6 + 0x68));
   LOCK();
   piVar4 = (int *)(lVar6 + 0x10);
   iVar5 = *piVar4;
   *piVar4 = *piVar4 + -1;
   UNLOCK();
   if (iVar5 == 1) {
     (**(code **)(lVar6 + 0x18))(lVar6);
   }
   if (bVar7) {
     if (*(char *)(lVar6 + 0x48) == '\0') {
-      DeleteHostRoute((short *)(lVar6 + 0x168));
+      DeleteHostRoute((short *)(lVar6 + 0x170));
+    }
+    ExWaitForRundownProtectionRelease(lVar6 + 0x58);
+    ExRundownCompleted(lVar6 + 0x58);
+    if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+        ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 8) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x29]))
+    {
+      WPP_SF_q(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x15,
+               &WPP_fd4d18c18a5d350ad78eb496d3892b7c_Traceguids,lVar6);
     }
     LOCK();
     piVar4 = (int *)(lVar6 + 0x10);
     iVar5 = *piVar4;
     *piVar4 = *piVar4 + -1;
     UNLOCK();
     if (iVar5 == 1) {
       (**(code **)(lVar6 + 0x18))(lVar6);
     }
   }
   return;
 }
 

```


## ReceiveDataComplete

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,refcount,length|
|ratio|0.58|
|i_ratio|0.79|
|m_ratio|0.95|
|b_ratio|0.95|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|ReceiveDataComplete|ReceiveDataComplete|
|fullname|ReceiveDataComplete|ReceiveDataComplete|
|`refcount`|5|7|
|`length`|67|72|
|called|NDIS.SYS::NdisFreeNetBufferList<br>_guard_dispatch_icall|NDIS.SYS::NdisFreeNetBufferList<br>_guard_dispatch_icall|
|calling|CallFlushRxNBLQueue<br>CallProcessRxNBLs<br>CallReceiveDatagramCallback<br>CtlReceiveCallback|CallFlushRxNBLQueue<br>CallProcessRxNBLs<br>CallReceiveDatagramCallback<br>CtlReceiveCallback|
|paramcount|2|2|
|address|1c001a858|1c001a858|
|sig|undefined __fastcall ReceiveDataComplete(longlong param_1, longlong param_2)|undefined __fastcall ReceiveDataComplete(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### ReceiveDataComplete Diff


```diff
--- ReceiveDataComplete
+++ ReceiveDataComplete
@@ -1,23 +1,25 @@
 
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 
 void ReceiveDataComplete(longlong param_1,longlong param_2)
 
 {
   int *piVar1;
   int iVar2;
   
   if (param_2 != 0) {
     NdisFreeNetBufferList(param_2);
   }
-  LOCK();
-  piVar1 = (int *)(param_1 + 0x200);
-  iVar2 = *piVar1;
-  *piVar1 = *piVar1 + -1;
-  UNLOCK();
-  if (iVar2 == 1) {
-    (**(code **)(param_1 + 0x208))(param_1);
+  if (param_1 != 0) {
+    LOCK();
+    piVar1 = (int *)(param_1 + 0x200);
+    iVar2 = *piVar1;
+    *piVar1 = *piVar1 + -1;
+    UNLOCK();
+    if (iVar2 == 1) {
+      (**(code **)(param_1 + 0x208))(param_1);
+    }
   }
   return;
 }
 

```


## FreeSockContextCommon

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|code,length|
|ratio|0.97|
|i_ratio|0.79|
|m_ratio|0.99|
|b_ratio|0.99|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|FreeSockContextCommon|FreeSockContextCommon|
|fullname|FreeSockContextCommon|FreeSockContextCommon|
|refcount|3|3|
|`length`|182|187|
|called|NTOSKRNL.EXE::ExDeleteNPagedLookasideList<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>_guard_dispatch_icall|NTOSKRNL.EXE::ExDeleteNPagedLookasideList<br>NTOSKRNL.EXE::ExFreePoolWithTag<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>_guard_dispatch_icall|
|calling|FreeSockHandle<br>WskCloseSocketIrpCompletion|FreeSockHandle<br>WskCloseSocketIrpCompletion|
|paramcount|1|1|
|address|1c001a364|1c001a364|
|sig|undefined __fastcall FreeSockContextCommon(longlong param_1)|undefined __fastcall FreeSockContextCommon(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### FreeSockContextCommon Diff


```diff
--- FreeSockContextCommon
+++ FreeSockContextCommon
@@ -1,22 +1,23 @@
 
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
 
 void FreeSockContextCommon(longlong param_1)
 
 {
   undefined1 uVar1;
   
   (**(code **)(param_1 + 0x30))("FreeSockContextCommon..Freeing the Socket Context");
   if ((*(uint *)(param_1 + 0x188) & 0x800) != 0) {
     (**(code **)(param_1 + 0x30))("FreeSockContextCommon..Freeing Socket Lists and locks");
     uVar1 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x1c8);
     *(undefined1 *)(param_1 + 0x1d0) = uVar1;
     ExDeleteNPagedLookasideList(param_1 + 0x80);
     ExDeleteNPagedLookasideList(param_1 + 0x100);
     *(undefined8 *)(param_1 + 0x180) = 0;
+    *(undefined8 *)(param_1 + 8) = 0;
     KeReleaseSpinLock(param_1 + 0x1c8,*(undefined1 *)(param_1 + 0x1d0));
   }
   ExFreePoolWithTag(param_1,0);
   return;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## WPP_SF_

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.88|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|WPP_SF_|WPP_SF_|
|fullname|WPP_SF_|WPP_SF_|
|`refcount`|149|150|
|length|37|37|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|`calling`|<details><summary>Expand for full list:<br>CallAlloc<br>CallDisconnectFromCtl<br>CallEventCallInConnect<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallFindAndLock<br>CallFlushRxNBLQueue<br>CallFlushTxNBLQueue<br>CallIndicateReceived<br>CallProcessNBLs<br>CallReceiveDatagramCallback</summary>CallSetLinkInfo<br>CallTransmitNB<br>CallpFinalDerefEx<br>CallpNewIncomingConnection<br>CallpSendCallClearReq<br>CallpVcFinalDerefEx<br>CtlAlloc<br>CtlCleanup<br>CtlConnectCompleteCallback<br>CtlConnectQueryCallback<br>CtlDisconnectCall<br>CtlFree<br>CtlListen<br>CtlpAllocPacketLocked<br>CtlpCleanup<br>CtlpEngine<br>CtlpQueryAddrInfoCallback<br>CtlpScheduleGetLinkSpeed<br>DereferenceAf<br>DereferenceSap<br>DoDerefMiniportAdapterBlockWork<br>MiniportInitializeEx<br>MiniportRestart<br>PptpBuildIpGreHdrs<br>PptpCmActivateVcComplete<br>PptpCmBuildCallParams<br>PptpCmCloseAf<br>PptpCmCloseCall<br>PptpCmCreateVc<br>PptpCmDeleteVc<br>PptpCmDeregSapPassive<br>PptpCmDeregisterSap<br>PptpCmIncomingCallComplete<br>PptpCmMakeCall<br>PptpCmMakeCallCallback<br>PptpCmModifyCallQoS<br>PptpCmOidRequest<br>PptpCmOpenAf<br>PptpCmRegSapPassive<br>PptpCmRegisterSap<br>PptpCoRequest<br>PptpInitialize<br>PptpMpQueryInformation<br>PptpMpSetInformation<br>PptpQueryCmInformation</details>|<details><summary>Expand for full list:<br>CallAlloc<br>CallDisconnectFromCtl<br>CallEventCallInConnect<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallFindAndLock<br>CallFlushRxNBLQueue<br>CallFlushTxNBLQueue<br>CallIndicateReceived<br>CallProcessNBLs<br>CallReceiveDatagramCallback</summary>CallSetLinkInfo<br>CallTransmitNB<br>CallpFinalDerefEx<br>CallpNewIncomingConnection<br>CallpSendCallClearReq<br>CallpVcFinalDerefEx<br>CtlAlloc<br>CtlCleanup<br>CtlConnectCompleteCallback<br>CtlConnectQueryCallback<br>CtlDisconnectCall<br>CtlFree<br>CtlListen<br>CtlReceiveCallback<br>CtlpAllocPacketLocked<br>CtlpCleanup<br>CtlpEngine<br>CtlpQueryAddrInfoCallback<br>CtlpScheduleGetLinkSpeed<br>DereferenceAf<br>DereferenceSap<br>DoDerefMiniportAdapterBlockWork<br>MiniportInitializeEx<br>MiniportRestart<br>PptpBuildIpGreHdrs<br>PptpCmActivateVcComplete<br>PptpCmBuildCallParams<br>PptpCmCloseAf<br>PptpCmCloseCall<br>PptpCmCreateVc<br>PptpCmDeleteVc<br>PptpCmDeregSapPassive<br>PptpCmDeregisterSap<br>PptpCmIncomingCallComplete<br>PptpCmMakeCall<br>PptpCmMakeCallCallback<br>PptpCmModifyCallQoS<br>PptpCmOidRequest<br>PptpCmOpenAf<br>PptpCmRegSapPassive<br>PptpCmRegisterSap<br>PptpCoRequest<br>PptpInitialize<br>PptpMpQueryInformation<br>PptpMpSetInformation<br>PptpQueryCmInformation</details>|
|paramcount|3|3|
|`address`|1c00033e0|1c00033f4|
|sig|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_ Calling Diff


```diff
--- WPP_SF_ calling
+++ WPP_SF_ calling
@@ -24,0 +25 @@
+CtlReceiveCallback
```


## _guard_dispatch_icall

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|_guard_dispatch_icall|_guard_dispatch_icall|
|fullname|_guard_dispatch_icall|_guard_dispatch_icall|
|`refcount`|113|114|
|length|2|2|
|called|||
|`calling`|<details><summary>Expand for full list:<br>CallDisconnectFromCtl<br>CtlCleanup<br>CtlConnectCall<br>CtlConnectCompleteCallback<br>CtlDisconnectCall<br>CtlFreePacket<br>CtlpCleanup<br>CtlpEngine<br>CtlpQueryAddrInfoCallback<br>CtlpScheduleGetLinkSpeed<br>DereferenceRefCount</summary>ExAllocateFromNPagedLookasideList<br>ExFreeToNPagedLookasideList<br>FreeSockContextCommon<br>FreeSockHandle<br>GetLocalAddress<br>MainPassiveLevelThread<br>ReceiveData<br>ReceiveDataComplete<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_DDDDDDDDDDDDDDDD<br>WPP_SF_Dd<br>WPP_SF_S<br>WPP_SF_dD<br>WPP_SF_dd<br>WPP_SF_ddd<br>WPP_SF_ds<br>WPP_SF_dss<br>WPP_SF_q<br>WPP_SF_qd<br>WPP_SF_qdD<br>WPP_SF_qdddddd<br>WPP_SF_qq<br>WPP_SF_qqD<br>WPP_SF_qss<br>WPP_SF_s<br>WPP_SF_sD<br>WPP_SF_sd<br>WPP_SF_sdDdd<br>WPP_SF_sdd<br>WPP_SF_sddd<br>WPP_SF_sq<br>WPP_SF_sqD<br>WPP_SF_sqd<br>WPP_SF_sqdd<br>WPP_SF_sqddd<br>WPP_SF_sqdddd<br>WPP_SF_sqdq<br>WPP_SF_sqq<br>WPP_SF_ss<br>WppCleanupKm<br>WppInitKm<br>WppLoadTracingSupport<br>WppTraceCallback<br>WskAcceptCompletion<br>WskCloseSocket<br>WskCloseSocketAndFreeSocketContext<br>WskCloseSocketContext<br>WskCloseSocketContextAndFreeSocket<br>WskCloseSocketIrpCompletion<br>WskCloseStreamServerSocketContext<br>WskConnAcceptEvent<br>WskConnDisconnectEvent<br>WskConnectControlCompletion<br>WskControlSocket<br>WskCreateServerSocket<br>WskCreateSocket<br>WskDestroySockContext<br>WskDisconnectSocket<br>WskGetLocalAddrIrpCompletion<br>WskOpenConnectedSocket<br>WskOpenConnectedSocketCompletion<br>WskOpenSocket<br>WskSend<br>WskSendCompletion<br>WskSendDatagram<br>WskSocketDisconnectCompletion<br>WskSocketDisconnectDone</details>|<details><summary>Expand for full list:<br>CallDisconnectFromCtl<br>CtlCleanup<br>CtlConnectCall<br>CtlConnectCompleteCallback<br>CtlDisconnectCall<br>CtlFreePacket<br>CtlReceiveCallback<br>CtlpCleanup<br>CtlpEngine<br>CtlpQueryAddrInfoCallback<br>CtlpScheduleGetLinkSpeed</summary>DereferenceRefCount<br>ExAllocateFromNPagedLookasideList<br>ExFreeToNPagedLookasideList<br>FreeSockContextCommon<br>FreeSockHandle<br>GetLocalAddress<br>MainPassiveLevelThread<br>ReceiveData<br>ReceiveDataComplete<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_DDDDDDDDDDDDDDDD<br>WPP_SF_Dd<br>WPP_SF_S<br>WPP_SF_dD<br>WPP_SF_dd<br>WPP_SF_ddd<br>WPP_SF_ds<br>WPP_SF_dss<br>WPP_SF_q<br>WPP_SF_qd<br>WPP_SF_qdD<br>WPP_SF_qdddddd<br>WPP_SF_qq<br>WPP_SF_qqD<br>WPP_SF_qss<br>WPP_SF_s<br>WPP_SF_sD<br>WPP_SF_sd<br>WPP_SF_sdDdd<br>WPP_SF_sdd<br>WPP_SF_sddd<br>WPP_SF_sq<br>WPP_SF_sqD<br>WPP_SF_sqd<br>WPP_SF_sqdd<br>WPP_SF_sqddd<br>WPP_SF_sqdddd<br>WPP_SF_sqdq<br>WPP_SF_sqq<br>WPP_SF_ss<br>WppCleanupKm<br>WppInitKm<br>WppLoadTracingSupport<br>WppTraceCallback<br>WskAcceptCompletion<br>WskCloseSocket<br>WskCloseSocketAndFreeSocketContext<br>WskCloseSocketContext<br>WskCloseSocketContextAndFreeSocket<br>WskCloseSocketIrpCompletion<br>WskCloseStreamServerSocketContext<br>WskConnAcceptEvent<br>WskConnDisconnectEvent<br>WskConnectControlCompletion<br>WskControlSocket<br>WskCreateServerSocket<br>WskCreateSocket<br>WskDestroySockContext<br>WskDisconnectSocket<br>WskGetLocalAddrIrpCompletion<br>WskOpenConnectedSocket<br>WskOpenConnectedSocketCompletion<br>WskOpenSocket<br>WskSend<br>WskSendCompletion<br>WskSendDatagram<br>WskSocketDisconnectCompletion<br>WskSocketDisconnectDone</details>|
|paramcount|0|0|
|address|1c00015f0|1c00015f0|
|sig|undefined __fastcall _guard_dispatch_icall(void)|undefined __fastcall _guard_dispatch_icall(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### _guard_dispatch_icall Calling Diff


```diff
--- _guard_dispatch_icall calling
+++ _guard_dispatch_icall calling
@@ -6,0 +7 @@
+CtlReceiveCallback
```


## WPP_SF_q

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.92|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|WPP_SF_q|WPP_SF_q|
|fullname|WPP_SF_q|WPP_SF_q|
|`refcount`|13|16|
|length|59|59|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|`calling`|CallIndicateReceived<br>CallpNewIncomingConnection<br>CtlConnectCompleteCallback<br>CtlpAllocPacketLocked<br>CtlpScheduleGetLinkSpeed<br>PptpCmActivateVcComplete<br>PptpCmCreateVc|CallIndicateReceived<br>CallpNewIncomingConnection<br>CtlConnectCompleteCallback<br>CtlReceiveCallback<br>CtlpAllocPacketLocked<br>CtlpCleanup<br>CtlpDeathTimeout<br>CtlpScheduleGetLinkSpeed<br>PptpCmActivateVcComplete<br>PptpCmCreateVc|
|paramcount|4|4|
|`address`|1c00036fc|1c0003710|
|sig|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall WPP_SF_q(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined8 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_q Calling Diff


```diff
--- WPP_SF_q calling
+++ WPP_SF_q calling
@@ -3,0 +4 @@
+CtlReceiveCallback
@@ -4,0 +6,2 @@
+CtlpCleanup
+CtlpDeathTimeout
```


## WskConnDisconnectEvent

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.86|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|WskConnDisconnectEvent|WskConnDisconnectEvent|
|fullname|WskConnDisconnectEvent|WskConnDisconnectEvent|
|`refcount`|3|4|
|length|209|209|
|called|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>WskCloseSocketContextAndFreeSocket<br>_guard_dispatch_icall|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>WskCloseSocketContextAndFreeSocket<br>_guard_dispatch_icall|
|`calling`||CtlpDeathTimeout|
|paramcount|1|1|
|address|1c001b120|1c001b120|
|sig|undefined8 __fastcall WskConnDisconnectEvent(longlong param_1)|undefined8 __fastcall WskConnDisconnectEvent(longlong param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WskConnDisconnectEvent Calling Diff


```diff
--- WskConnDisconnectEvent calling
+++ WskConnDisconnectEvent calling
@@ -0,0 +1 @@
+CtlpDeathTimeout
```


## DereferenceRefCount

### Match Info



|Key|rp-1586.sys - rp-1706.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.89|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rp-1586.sys|rp-1706.sys|
| :---: | :---: | :---: |
|name|DereferenceRefCount|DereferenceRefCount|
|fullname|DereferenceRefCount|DereferenceRefCount|
|`refcount`|42|44|
|length|31|31|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|`calling`|<details><summary>Expand for full list:<br>CallCleanup<br>CallEventCallDisconnectNotify<br>CallEventCallInRequest<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallFlushRxNBLQueue<br>CallFlushTxNBLQueue<br>CallProcessNBLs<br>CallProcessRxNBLs<br>CallpAckTimeout<br>CallpCancelCallTimers</summary>CallpCloseTimeout<br>CallpDialTimeout<br>CallpNewIncomingConnection<br>CallpSendComplete<br>CallpSendCompleteDeferred<br>CtlpEngine<br>MiniportPause<br>MiniportReturnNetBufferLists<br>PptpCmCloseCall<br>PptpCmDeactivateVcComplete<br>PptpCmDeleteVc<br>PptpCmMakeCall<br>PptpCmMakeCallCallback<br>PptpCoSendNetBufferLists</details>|<details><summary>Expand for full list:<br>CallCleanup<br>CallEventCallDisconnectNotify<br>CallEventCallInRequest<br>CallEventCallOutRequest<br>CallEventOutboundTunnelEstablished<br>CallFlushRxNBLQueue<br>CallFlushTxNBLQueue<br>CallProcessNBLs<br>CallProcessRxNBLs<br>CallReceiveDatagramCallback<br>CallpAckTimeout</summary>CallpCancelCallTimers<br>CallpCloseTimeout<br>CallpDialTimeout<br>CallpNewIncomingConnection<br>CallpSendComplete<br>CallpSendCompleteDeferred<br>CtlpEngine<br>MiniportPause<br>MiniportReturnNetBufferLists<br>PptpCmCloseCall<br>PptpCmDeactivateVcComplete<br>PptpCmDeleteVc<br>PptpCmMakeCall<br>PptpCmMakeCallCallback<br>PptpCoSendNetBufferLists</details>|
|paramcount|1|1|
|address|1c0003294|1c0003294|
|sig|undefined __fastcall DereferenceRefCount(int * param_1)|undefined __fastcall DereferenceRefCount(int * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### DereferenceRefCount Calling Diff


```diff
--- DereferenceRefCount calling
+++ DereferenceRefCount calling
@@ -9,0 +10 @@
+CallReceiveDatagramCallback
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-16T15:41:21</sub>