# rmcast-07.sys-rmcast-08.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_4002387257__private_IsEnabledDeviceUsageNoInline](#feature_4002387257__private_isenableddeviceusagenoinline)
	* [Feature_4002387257__private_IsEnabledFallback](#feature_4002387257__private_isenabledfallback)
* [Modified](#modified)
	* [SendNextPacket](#sendnextpacket)
	* [AdvanceWindow](#advancewindow)
	* [PgmSendRData](#pgmsendrdata)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)
	* [NTOSKRNL.EXE::KeUnstackDetachProcess](#ntoskrnlexekeunstackdetachprocess)
	* [DestroyEntry](#destroyentry)
	* [WPP_SF_dD](#wpp_sf_dd)
	* [WPP_SF_D](#wpp_sf_d)
	* [NTOSKRNL.EXE::ExFreeToNPagedLookasideList](#ntoskrnlexeexfreetonpagedlookasidelist)
	* [NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc](#ntoskrnlexekeacquirespinlockraisetodpc)

# Visual Chart Diff



```mermaid

flowchart LR

SendNextPacket-4-old<--Match 27%-->SendNextPacket-4-new
AdvanceWindow-3-old<--Match 75%-->AdvanceWindow-3-new
PgmSendRData-4-old<--Match 35%-->PgmSendRData-4-new

subgraph rmcast-08.sys
    SendNextPacket-4-new
AdvanceWindow-3-new
PgmSendRData-4-new
    subgraph Added
direction LR
Feature_4002387257__private_IsEnabledDeviceUsageNoInline
    Feature_4002387257__private_IsEnabledFallback
end
end

subgraph rmcast-07.sys
    SendNextPacket-4-old
AdvanceWindow-3-old
PgmSendRData-4-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.7630%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 842
```



```mermaid
pie showData
    title Matched Function Similarity - 98.8124%
"matched_funcs_with_code_changes_len" : 3
"matched_funcs_with_non_code_changes_len" : 7
"matched_funcs_no_changes_len" : 832
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 rmcast-07.sys rmcast-08.sys
```


#### Verbose Args


<details>

```
--old ['rmcast-07.sys'] --new [['rmcast-08.sys']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/rmcast.sys/CBB2E34742000/rmcast.sys -O rmcast.sys.x64.10.0.26100.8972
wget https://msdl.microsoft.com/download/symbols/rmcast.sys/9EEDDB0542000/rmcast.sys -O rmcast.sys.x64.10.0.26100.9168
```


## Binary Metadata Diff


```diff
--- rmcast-07.sys Meta
+++ rmcast-08.sys Meta
@@ -1,44 +1,44 @@
-Program Name: rmcast-07.sys
+Program Name: rmcast-08.sys
 Language ID: x86:LE:64:default (4.7)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
-# of Bytes: 274680
+# of Bytes: 274688
 # of Memory Blocks: 13
-# of Instructions: 32811
-# of Defined Data: 2512
-# of Functions: 421
-# of Symbols: 3956
+# of Instructions: 33072
+# of Defined Data: 2529
+# of Functions: 423
+# of Symbols: 3966
 # of Data Types: 154
 # of Data Type Categories: 11
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.1.2
-Date Created: Wed Aug 26 22:46:18 SGT 2026
+Date Created: Wed Aug 26 22:46:23 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /C:/Users/Jacob/Downloads/pdbs/rmcast-07.sys
-Executable MD5: d3306cee77481edc30f07d81f1c870d4
-Executable SHA256: 22211a0ca72d952c0d96e542153ac68158c4620c2f57bb08abfad1f94f6ba77e
-FSRL: file:///C:/Users/Jacob/Downloads/pdbs/rmcast-07.sys?MD5=d3306cee77481edc30f07d81f1c870d4
+Executable Location: /C:/Users/Jacob/Downloads/pdbs/rmcast-08.sys
+Executable MD5: d69d9cb54a62d1541e5d3a67ce1e75ec
+Executable SHA256: 8d8463382d7d33b129f8f428e93ffec05721b631d5f4ba1131086adbc16679a9
+FSRL: file:///C:/Users/Jacob/Downloads/pdbs/rmcast-08.sys?MD5=d69d9cb54a62d1541e5d3a67ce1e75ec
 PDB Age: 1
 PDB File: rmcast.pdb
-PDB GUID: 4c74a434-c9d0-8d87-da2e-629003a0dcef
+PDB GUID: 0cf00497-56f8-7c6e-2392-174743403b90
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Reliable Multicast Transport
-PE Property[FileVersion]: 10.0.26100.8972 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.9168 (WinBuild.160101.0800)
 PE Property[InternalName]: rmcast.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: rmcast.sys
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.8972
+PE Property[ProductVersion]: 10.0.26100.9168
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra rmcast-07.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra rmcast-07.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra rmcast-07.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
	interpretation: FUNCTION_IF_EXISTS,
	applyCallingConvention: true,
	applySignature: true,
	demangleOnlyKnownPatterns: true,
	doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra rmcast-08.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra rmcast-08.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra rmcast-08.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.msdApplyOptions|{
	interpretation: FUNCTION_IF_EXISTS,
	applyCallingConvention: true,
	applySignature: true,
	demangleOnlyKnownPatterns: true,
	doDisassembly: true
}|
|Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|10|
|added_symbols_len|5|
|deleted_symbols_len|3|
|diff_time|14.196530103683472|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 419, 'ExternalsName': 96, 'ExactBytesFunctionHasher': 1})|
|items_to_process|20|
|diff_types|Counter({'refcount': 7, 'code': 3, 'length': 3, 'calling': 2, 'sig': 2, 'address': 2, 'called': 2})|
|unmatched_funcs_len|2|
|total_funcs_len|844|
|matched_funcs_len|842|
|matched_funcs_with_code_changes_len|3|
|matched_funcs_with_non_code_changes_len|7|
|matched_funcs_no_changes_len|832|
|match_func_similarity_percent|98.8124%|
|func_match_overall_percent|99.7630%|
|first_matches|Counter({'SymbolsHash': 419, 'ExactBytesFunctionHasher': 1})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 419
"ExternalsName" : 96
"ExactBytesFunctionHasher" : 1
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 419
"ExactBytesFunctionHasher" : 1
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 10
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 5
"deleted_symbols_len" : 3
```

## Strings


*No string differences found*

# Deleted

# Added

## Feature_4002387257__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|rmcast-08.sys|
| :---: | :---: |
|name|Feature_4002387257__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_4002387257__private_IsEnabledDeviceUsageNoInline|
|refcount|5|
|length|49|
|called|Feature_4002387257__private_IsEnabledFallback|
|calling|AdvanceWindow<br>PgmSendRData|
|paramcount|0|
|address|1400188f4|
|sig|ulonglong __fastcall Feature_4002387257__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4002387257__private_IsEnabledDeviceUsageNoInline
+++ Feature_4002387257__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+

+ulonglong Feature_4002387257__private_IsEnabledDeviceUsageNoInline(void)

+

+{

+  ulonglong uVar1;

+  undefined8 local_res8;

+  

+  local_res8 = (ulonglong)Feature_4002387257__private_featureState;

+  if ((Feature_4002387257__private_featureState & 0x10) == 0) {

+    uVar1 = Feature_4002387257__private_IsEnabledFallback(local_res8,3);

+  }

+  else {

+    uVar1 = (ulonglong)(Feature_4002387257__private_featureState & 1);

+  }

+  return uVar1;

+}

+


```


## Feature_4002387257__private_IsEnabledFallback

### Function Meta



|Key|rmcast-08.sys|
| :---: | :---: |
|name|Feature_4002387257__private_IsEnabledFallback|
|fullname|Feature_4002387257__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_4002387257__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|14001892c|
|sig|undefined __fastcall Feature_4002387257__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_4002387257__private_IsEnabledFallback
+++ Feature_4002387257__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+

+void Feature_4002387257__private_IsEnabledFallback(ulonglong param_1,int param_2)

+

+{

+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_4002387257__private_descriptor);

+  return;

+}

+


```


# Modified


*Modified functions contain code changes*
## SendNextPacket

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|code,length,sig,address|
|ratio|0.37|
|i_ratio|0.49|
|m_ratio|0.99|
|b_ratio|0.27|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|SendNextPacket|SendNextPacket|
|fullname|SendNextPacket|SendNextPacket|
|refcount|2|2|
|`length`|884|871|
|called|<details><summary>Expand for full list:<br>AdvanceWindow<br>CheckForTermination<br>FindFirstEntry<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>PgmSendNextOData<br>PgmSendRData<br>PgmSendSpm<br>RemoveAllEntries<br>WPP_SF_D<br>WPP_SF_didd</summary>WPP_SF_iD<br>WPP_SF_id<br>WPP_SF_idd</details>|<details><summary>Expand for full list:<br>AdvanceWindow<br>CheckForTermination<br>FindFirstEntry<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>PgmSendNextOData<br>PgmSendRData<br>PgmSendSpm<br>RemoveAllEntries<br>WPP_SF_D<br>WPP_SF_didd</summary>WPP_SF_iD<br>WPP_SF_id<br>WPP_SF_idd</details>|
|calling|SenderWorkerThread|SenderWorkerThread|
|paramcount|4|4|
|`address`|14001c1b0|14001c680|
|`sig`|ulonglong __fastcall SendNextPacket(longlong * param_1, undefined8 param_2, undefined8 param_3, undefined * * param_4)|ulonglong __fastcall SendNextPacket(longlong * param_1, undefined8 param_2, undefined * * param_3, undefined * * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### SendNextPacket Diff


```diff
--- SendNextPacket
+++ SendNextPacket
@@ -1,146 +1,131 @@
 

-ulonglong SendNextPacket(longlong *param_1,undefined8 param_2,undefined8 param_3,undefined **param_4

-                        )

+ulonglong SendNextPacket(longlong *param_1,undefined8 param_2,undefined **param_3,

+                        undefined **param_4)

 

 {

   byte bVar1;

-  uint uVar2;

-  longlong lVar3;

-  ulonglong uVar4;

-  uint uVar5;

-  undefined **ppuVar6;

+  longlong lVar2;

+  ulonglong uVar3;

+  uint uVar4;

+  undefined **ppuVar5;

+  undefined8 uVar6;

   undefined8 uVar7;

-  undefined8 uVar8;

-  undefined **ppuVar9;

-  undefined **ppuVar10;

-  undefined **ppuVar11;

-  bool bVar12;

-  bool bVar13;

-  undefined1 local_res8 [8];

-  undefined *local_res10;

-  undefined *local_res18;

+  undefined **ppuVar8;

+  byte bVar9;

+  undefined *local_res8;

+  uint local_res10 [2];

+  undefined *local_res18 [2];

   

-  lVar3 = param_1[5];

-  local_res18 = (undefined *)0x0;

-  bVar1 = *(byte *)(*(longlong *)(lVar3 + 0x20) + 0x38);

-  local_res8[0] = KeAcquireSpinLockRaiseToDpc(param_1 + 0x2d);

+  lVar2 = param_1[5];

+  local_res10[0] = 0;

+  local_res18[0] = (undefined *)0x0;

+  bVar1 = *(byte *)(*(longlong *)(lVar2 + 0x20) + 0x38);

+  bVar9 = bVar1 & 0x10;

+  local_res8._0_1_ = KeAcquireSpinLockRaiseToDpc(param_1 + 0x2d);

   do {

-    ppuVar9 = &WPP_GLOBAL_Control;

-    uVar2 = *(uint *)(lVar3 + 0x198);

-    ppuVar11 = (undefined **)(ulonglong)uVar2;

-    if (uVar2 < *(uint *)(*(longlong *)(lVar3 + 0x20) + 0xf8)) {

+    ppuVar8 = &WPP_GLOBAL_Control;

+    if (*(uint *)(lVar2 + 0x198) < *(uint *)(*(longlong *)(lVar2 + 0x20) + 0xf8)) {

 LAB_0:

-      if ((bVar1 & 0x10) == 0) {

-        ppuVar9 = (undefined **)0x0;

+      if (bVar9 == 0) {

+        ppuVar8 = (undefined **)0x0;

         RemoveAllEntries((longlong)param_1,'\0');

       }

-      AdvanceWindow((longlong)param_1,ppuVar9,ppuVar11);

-      uVar7 = CheckForTermination(param_1,local_res8,ppuVar11,(longlong *)param_4);

+      AdvanceWindow((longlong)param_1,ppuVar8,param_3);

+      uVar6 = CheckForTermination(param_1,(undefined1 *)&local_res8,param_3,(longlong *)param_4);

       if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

          ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) {

         WPP_SF_iD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),

-                  (ulonglong)*(uint *)(WPP_GLOBAL_Control + 0x2c),ppuVar11,param_1[0x18]);

+                  (ulonglong)*(uint *)(WPP_GLOBAL_Control + 0x2c),param_3,param_1[0x18]);

       }

       *(uint *)(param_1 + 4) = *(uint *)(param_1 + 4) & 0xfffffffd;

-      uVar8 = KeReleaseSpinLock(param_1 + 0x2d,local_res8[0]);

-      return CONCAT71((int7)((ulonglong)uVar8 >> 8),(char)uVar7);

+      uVar7 = KeReleaseSpinLock(param_1 + 0x2d,local_res8._0_1_);

+      return CONCAT71((int7)((ulonglong)uVar7 >> 8),(char)uVar6);

     }

-    ppuVar10 = (undefined **)0x0;

-    local_res10._0_4_ = 0;

+    local_res10[0] = 0;

     if ((*(uint *)(param_1 + 4) & 4) == 0) {

-      if (*(ulonglong *)(lVar3 + 0x180) <= *(ulonglong *)(lVar3 + 0x170)) {

+      if (*(ulonglong *)(lVar2 + 0x180) <= *(ulonglong *)(lVar2 + 0x170)) {

         if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

            ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-          param_4 = *(undefined ***)(lVar3 + 0x128);

-          WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x57,ppuVar11,param_4);

+          param_4 = *(undefined ***)(lVar2 + 0x128);

+          WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5e,param_3,param_4);

         }

-        PgmSendSpm((longlong)param_1,local_res8,(uint *)&local_res10);

-        *(undefined8 *)(lVar3 + 0x170) = 0;

-        uVar4 = *(longlong *)(lVar3 + 0x180) * 2;

-        *(ulonglong *)(lVar3 + 0x180) = uVar4;

-        if (*(ulonglong *)(lVar3 + 400) < uVar4) {

-          *(ulonglong *)(lVar3 + 0x180) = *(ulonglong *)(lVar3 + 400);

+        param_3 = (undefined **)local_res10;

+        PgmSendSpm((longlong)param_1,(undefined1 *)&local_res8,(uint *)param_3);

+        *(undefined8 *)(lVar2 + 0x170) = 0;

+        uVar3 = *(longlong *)(lVar2 + 0x180) * 2;

+        *(ulonglong *)(lVar2 + 0x180) = uVar3;

+        if (*(ulonglong *)(lVar2 + 400) < uVar3) {

+          *(ulonglong *)(lVar2 + 0x180) = *(ulonglong *)(lVar2 + 400);

         }

         goto LAB_1;

       }

 LAB_2:

-      if ((*(int *)(lVar3 + 0x94) == 0) && (*(int *)(lVar3 + 0x90) == 0)) {

-        uVar5 = *(int *)(lVar3 + 0x19c) * 2;

-        bVar12 = uVar2 < uVar5;

-        bVar13 = uVar2 == uVar5;

-      }

-      else {

-        uVar2 = CONCAT31((int3)(uVar2 >> 8),bVar1) & 0xffffff10;

-        ppuVar11 = (undefined **)(ulonglong)uVar2;

-        ppuVar9 = &local_res18;

-        ppuVar6 = (undefined **)FindFirstEntry((longlong)param_1,ppuVar9,(char)uVar2);

-        if (ppuVar6 == (undefined **)0x0) {

-          if (*(int *)(lVar3 + 0x90) != 0) {

+      if ((*(int *)(lVar2 + 0x94) != 0) || (*(int *)(lVar2 + 0x90) != 0)) {

+        param_3 = (undefined **)

+                  (CONCAT71((int7)((ulonglong)param_3 >> 8),bVar1) & 0xffffffffffffff10);

+        ppuVar8 = local_res18;

+        ppuVar5 = (undefined **)FindFirstEntry((longlong)param_1,ppuVar8,bVar9);

+        if (ppuVar5 == (undefined **)0x0) {

+          if (*(int *)(lVar2 + 0x90) != 0) {

             if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

                ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-              param_4 = *(undefined ***)(lVar3 + 0x128);

+              param_4 = *(undefined ***)(lVar2 + 0x128);

               WPP_SF_idd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),

-                         (ulonglong)*(uint *)(*(longlong *)(lVar3 + 0x20) + 0xf8),ppuVar11,param_4);

+                         (ulonglong)*(uint *)(*(longlong *)(lVar2 + 0x20) + 0xf8),param_3,param_4);

             }

-            ppuVar11 = &local_res10;

-            ppuVar6 = (undefined **)local_res8;

-            PgmSendNextOData((longlong)param_1,(undefined1 *)ppuVar6,(uint *)ppuVar11);

-            goto LAB_3;

+            param_3 = (undefined **)local_res10;

+            ppuVar8 = &local_res8;

+            PgmSendNextOData((longlong)param_1,(undefined1 *)ppuVar8,(uint *)param_3);

           }

         }

         else {

           if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

              ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-            WPP_SF_didd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),*(undefined8 *)(lVar3 + 0x20),

-                        ppuVar11,*(undefined4 *)(ppuVar6 + 2));

+            WPP_SF_didd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),*(undefined8 *)(lVar2 + 0x20),

+                        param_3,*(undefined4 *)(ppuVar5 + 2));

           }

-          param_4 = &local_res10;

-          ppuVar11 = (undefined **)local_res8;

-          PgmSendRData((longlong)param_1,(longlong *)ppuVar6,(undefined1 *)ppuVar11,(uint *)param_4)

-          ;

-LAB_3:

-          ppuVar10 = (undefined **)(ulonglong)(uint)local_res10;

-          ppuVar9 = ppuVar6;

+          param_4 = (undefined **)local_res10;

+          param_3 = &local_res8;

+          PgmSendRData((longlong)param_1,(longlong *)ppuVar5,(undefined1 *)param_3,(uint *)param_4);

+          ppuVar8 = ppuVar5;

         }

         if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

            ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-          ppuVar11 = (undefined **)&WPP_ad5a23d009db360b9b5fbd08776dfa43_Traceguids;

-          ppuVar9 = (undefined **)0x5a;

-          param_4 = ppuVar10;

-          WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5a,

-                   &WPP_ad5a23d009db360b9b5fbd08776dfa43_Traceguids,(int)ppuVar10);

+          param_4 = (undefined **)(ulonglong)local_res10[0];

+          param_3 = (undefined **)&WPP_2d619c39f4c936783a7b398058864277_Traceguids;

+          ppuVar8 = (undefined **)0x61;

+          WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x61,

+                   &WPP_2d619c39f4c936783a7b398058864277_Traceguids,local_res10[0]);

         }

-        if ((int)ppuVar10 != 0) {

+        if (local_res10[0] != 0) {

           *(uint *)(param_1 + 4) = *(uint *)(param_1 + 4) | 4;

-          *(int *)(lVar3 + 0xc0) = *(int *)(lVar3 + 0xc0) + 1;

-          goto LAB_4;

+          *(int *)(lVar2 + 0xc0) = *(int *)(lVar2 + 0xc0) + 1;

+          goto LAB_3;

         }

-        uVar5 = *(int *)(lVar3 + 0x19c) * 2;

-        bVar12 = *(uint *)(lVar3 + 0x198) < uVar5;

-        bVar13 = *(uint *)(lVar3 + 0x198) == uVar5;

       }

-      if (!bVar12 && !bVar13) {

-        *(uint *)(lVar3 + 0x198) = uVar5;

+      uVar4 = *(int *)(lVar2 + 0x19c) * 2;

+      if (uVar4 < *(uint *)(lVar2 + 0x198)) {

+        *(uint *)(lVar2 + 0x198) = uVar4;

       }

       goto LAB_0;

     }

-    if ((*(uint *)(lVar3 + 0xc0) < 0x33) &&

-       (*(ulonglong *)(lVar3 + 0x170) < *(ulonglong *)(lVar3 + 0x178))) goto LAB_2;

+    if ((*(uint *)(lVar2 + 0xc0) < 0x33) &&

+       (*(ulonglong *)(lVar2 + 0x170) < *(ulonglong *)(lVar2 + 0x178))) goto LAB_2;

     if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

        ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-      param_4 = *(undefined ***)(lVar3 + 0x128);

-      WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x56,ppuVar11,param_4);

+      param_4 = *(undefined ***)(lVar2 + 0x128);

+      WPP_SF_id(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x5d,param_3,param_4);

     }

-    PgmSendSpm((longlong)param_1,local_res8,(uint *)&local_res10);

-    *(undefined8 *)(lVar3 + 0x170) = 0;

-    *(undefined8 *)(lVar3 + 0x180) = *(undefined8 *)(lVar3 + 0x188);

+    param_3 = (undefined **)local_res10;

+    PgmSendSpm((longlong)param_1,(undefined1 *)&local_res8,(uint *)param_3);

+    *(undefined8 *)(lVar2 + 0x170) = 0;

+    *(undefined8 *)(lVar2 + 0x180) = *(undefined8 *)(lVar2 + 0x188);

     *(uint *)(param_1 + 4) = *(uint *)(param_1 + 4) & 0xfffffffb;

 LAB_1:

-    *(undefined4 *)(lVar3 + 0xc0) = 0;

-    ppuVar10 = (undefined **)(ulonglong)(uint)local_res10;

-LAB_4:

-    param_1[0x18] = param_1[0x18] + (longlong)ppuVar10;

-    *(int *)(lVar3 + 0x198) = *(int *)(lVar3 + 0x198) - (int)ppuVar10;

+    *(undefined4 *)(lVar2 + 0xc0) = 0;

+LAB_3:

+    param_1[0x18] = param_1[0x18] + (ulonglong)local_res10[0];

+    *(int *)(lVar2 + 0x198) = *(int *)(lVar2 + 0x198) - local_res10[0];

   } while( true );

 }

 


```


## AdvanceWindow

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|code,length,sig,called|
|ratio|0.16|
|i_ratio|0.52|
|m_ratio|0.96|
|b_ratio|0.75|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|AdvanceWindow|AdvanceWindow|
|fullname|AdvanceWindow|AdvanceWindow|
|refcount|2|2|
|`length`|1370|1506|
|`called`|NTOSKRNL.EXE::ExFreeToNPagedLookasideList<br>WPP_SF_dddddii<br>WPP_SF_ddi<br>WPP_SF_ddidii<br>WPP_SF_ddiii<br>WPP_SF_ii<br>WPP_SF_iiii|Feature_4002387257__private_IsEnabledDeviceUsageNoInline<br>NTOSKRNL.EXE::ExFreeToNPagedLookasideList<br>WPP_SF_dD<br>WPP_SF_dddddii<br>WPP_SF_ddi<br>WPP_SF_ddidii<br>WPP_SF_ddiii<br>WPP_SF_ii<br>WPP_SF_iiii|
|calling|SendNextPacket|SendNextPacket|
|paramcount|3|3|
|address|140017c68|140017c68|
|`sig`|uint __fastcall AdvanceWindow(longlong param_1, undefined8 param_2, undefined8 param_3)|undefined * * __fastcall AdvanceWindow(longlong param_1, undefined8 param_2, undefined8 param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### AdvanceWindow Called Diff


```diff
--- AdvanceWindow called
+++ AdvanceWindow called
@@ -0,0 +1 @@
+Feature_4002387257__private_IsEnabledDeviceUsageNoInline
@@ -1,0 +3 @@
+WPP_SF_dD
```


### AdvanceWindow Diff


```diff
--- AdvanceWindow
+++ AdvanceWindow
@@ -1,278 +1,305 @@
 

-uint AdvanceWindow(longlong param_1,undefined8 param_2,undefined8 param_3)

+undefined ** AdvanceWindow(longlong param_1,undefined8 param_2,undefined8 param_3)

 

 {

   byte bVar1;

-  undefined4 uVar2;

-  longlong lVar3;

-  ulonglong uVar4;

-  longlong *plVar5;

-  longlong *plVar6;

-  undefined8 uVar7;

-  undefined8 uVar8;

-  longlong lVar9;

-  undefined1 auVar10 [16];

-  code *pcVar11;

-  ulonglong uVar12;

-  int iVar13;

-  ulonglong uVar14;

-  undefined2 uVar15;

-  uint uVar16;

+  longlong lVar2;

+  longlong *plVar3;

+  undefined8 uVar4;

+  undefined1 auVar5 [16];

+  code *pcVar6;

+  undefined1 auVar7 [16];

+  undefined1 auVar8 [16];

+  uint uVar9;

+  ulonglong uVar10;

+  longlong lVar11;

+  int iVar12;

+  ulonglong uVar13;

+  undefined2 uVar14;

+  uint uVar15;

+  longlong *plVar16;

   undefined1 *puVar17;

-  ulonglong uVar18;

-  uint uVar19;

+  undefined **ppuVar18;

+  ulonglong uVar19;

   uint uVar20;

-  int iVar21;

+  undefined **ppuVar21;

   int iVar22;

-  uint uVar23;

-  longlong *plVar24;

-  longlong *plVar25;

+  ulonglong uVar23;

+  int iVar24;

+  uint uVar25;

   longlong *plVar26;

-  longlong lVar27;

   undefined1 auStack_88 [8];

   undefined1 auStack_80 [24];

   ulonglong local_68;

   ulonglong local_60;

   ulonglong local_58;

   ulonglong local_50;

   ulonglong local_48;

+  ulonglong local_40;

   

   puVar17 = auStack_88;

-  lVar3 = *(longlong *)(param_1 + 0x28);

-  uVar14 = *(ulonglong *)(lVar3 + 0x128);

-  uVar18 = *(ulonglong *)(lVar3 + 0x158);

-  if (uVar18 < uVar14) {

+  lVar2 = *(longlong *)(param_1 + 0x28);

+  uVar13 = *(ulonglong *)(lVar2 + 0x128);

+  uVar19 = *(ulonglong *)(lVar2 + 0x158);

+  if (uVar19 < uVar13) {

     if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

        ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-      local_68 = uVar18;

-      WPP_SF_ii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar14,param_3,uVar14);

-    }

-    uVar14 = *(ulonglong *)(lVar3 + 0x128);

-    uVar18 = *(longlong *)(lVar3 + 0x140) + uVar14;

-    *(ulonglong *)(lVar3 + 0x158) = uVar18;

-  }

-  uVar12 = *(ulonglong *)(lVar3 + 0x148);

-  uVar4 = *(ulonglong *)(lVar3 + 0x160);

-  uVar18 = (uVar18 - uVar12) - *(longlong *)(lVar3 + 0x140);

-  if (uVar18 < uVar4) {

+      local_68 = uVar19;

+      WPP_SF_ii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar13,param_3,uVar13);

+    }

+    uVar13 = *(ulonglong *)(lVar2 + 0x128);

+    uVar19 = *(longlong *)(lVar2 + 0x140) + uVar13;

+    *(ulonglong *)(lVar2 + 0x158) = uVar19;

+  }

+  uVar10 = *(ulonglong *)(lVar2 + 0x148);

+  uVar23 = *(ulonglong *)(lVar2 + 0x160);

+  uVar19 = (uVar19 - uVar10) - *(longlong *)(lVar2 + 0x140);

+  if (uVar19 < uVar23) {

     if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

-      return 0;

+      return (undefined **)0x0;

     }

     if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) == 0) {

-      return 0;

-    }

-    local_68 = CONCAT44(local_68._4_4_,*(int *)(lVar3 + 0x98) + -1);

-    local_60 = uVar14;

-    local_58 = uVar18;

-    local_50 = uVar4;

-    WPP_SF_ddiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar14,uVar12,

-                 *(undefined4 *)(lVar3 + 0xa0));

-    return 0;

-  }

-  uVar20 = *(uint *)(lVar3 + 0x98);

-  iVar21 = *(int *)(lVar3 + 0xa0);

-  uVar19 = -(uint)*(byte *)(param_1 + 0xa0) & uVar20;

-  plVar24 = (longlong *)**(longlong **)(lVar3 + 0x108);

-  uVar16 = uVar19 - iVar21;

-  if (((plVar24 != *(longlong **)(lVar3 + 0x108)) && (plVar24 != (longlong *)0x0)) &&

-     ((int)(*(uint *)(plVar24 + 2) - uVar19) < 0)) {

-    uVar19 = *(uint *)(plVar24 + 2);

-  }

-  uVar23 = uVar19 - iVar21;

-  if (((*(uint *)(*(longlong *)(lVar3 + 0x20) + 0x38) & 2) == 0) ||

+      return (undefined **)0x0;

+    }

+    local_68 = CONCAT44(local_68._4_4_,*(int *)(lVar2 + 0x98) + -1);

+    local_60 = uVar13;

+    local_58 = uVar19;

+    local_50 = uVar23;

+    WPP_SF_ddiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar13,uVar10,

+                 *(undefined4 *)(lVar2 + 0xa0));

+    return (undefined **)0x0;

+  }

+  uVar9 = *(uint *)(lVar2 + 0x98);

+  iVar22 = *(int *)(lVar2 + 0xa0);

+  uVar20 = -(uint)*(byte *)(param_1 + 0xa0) & uVar9;

+  plVar16 = (longlong *)**(longlong **)(lVar2 + 0x108);

+  uVar15 = uVar20 - iVar22;

+  if (((plVar16 != *(longlong **)(lVar2 + 0x108)) && (plVar16 != (longlong *)0x0)) &&

+     ((int)(*(uint *)(plVar16 + 2) - uVar20) < 0)) {

+    uVar20 = *(uint *)(plVar16 + 2);

+  }

+  uVar25 = uVar20 - iVar22;

+  if (((*(uint *)(*(longlong *)(lVar2 + 0x20) + 0x38) & 2) == 0) ||

      ((*(uint *)(param_1 + 0x20) & 0x1000) != 0)) {

 LAB_0:

-    if (uVar23 != 0) {

+    if (uVar25 != 0) {

       if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

          ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-        local_68 = uVar4;

-        local_60 = *(longlong *)(lVar3 + 0x140);

-        local_58 = uVar12;

-        WPP_SF_iiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)uVar16,uVar12,uVar18);

-      }

-      uVar20 = 0;

-      plVar25 = (longlong *)0x0;

-      plVar24 = (longlong *)0x0;

-      plVar26 = *(longlong **)(lVar3 + 0xd8);

-      while (plVar26 != (longlong *)(lVar3 + 0xd8)) {

-        plVar24 = plVar26;

-        if ((((int)plVar26[0x11] != 0) || (uVar18 <= (ulonglong)plVar26[6])) ||

-           (iVar21 = (int)plVar26[0xb], -1 < (int)(iVar21 - uVar19))) {

-          uVar19 = *(uint *)(lVar3 + 0xa0);

-          uVar16 = *(uint *)(plVar26 + 0xb);

-          uVar23 = uVar20;

-          if ((int)(uVar19 - uVar16) < 1) {

-            uVar20 = uVar16 - uVar19;

-            uVar23 = uVar20;

-            uVar19 = uVar16;

+        local_68 = uVar23;

+        local_60 = *(longlong *)(lVar2 + 0x140);

+        local_58 = uVar10;

+        WPP_SF_iiii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)uVar15,uVar10,uVar19);

+      }

+      ppuVar18 = (undefined **)0x0;

+      plVar16 = *(longlong **)(lVar2 + 0xd8);

+      if (plVar16 == (longlong *)(lVar2 + 0xd8)) {

+        plVar26 = *(longlong **)(lVar2 + 0xe8);

+        if (((((plVar26 != (longlong *)(lVar2 + 0xe8)) && ((int)plVar26[0x11] == 0)) &&

+             (*(int *)((longlong)plVar26 + 0x8c) == 0)) &&

+            (((int)plVar26[0x10] != 0 && (*(int *)((longlong)plVar26 + 0x6c) == (int)plVar26[0x10]))

+            )) && (uVar13 = uVar19, (ulonglong)plVar26[6] <= uVar19)) {

+LAB_1:

+          if (plVar26 != (longlong *)0x0) {

+            iVar22 = *(int *)(*(longlong *)(lVar2 + 0x20) + 0xf8);

+            lVar11 = *(longlong *)(*(longlong *)(lVar2 + 0x20) + 0x110);

+            auVar5._8_8_ = 0;

+            auVar5._0_8_ = (uVar19 - plVar26[6]) * lVar11 * 0x14;

+            auVar5 = auVar5 / ZEXT416((uint)(iVar22 * 8));

+            uVar10 = auVar5._0_8_;

+            iVar12 = (int)plVar26[0xb];

+            iVar24 = iVar12 - *(int *)((longlong)plVar26 + 0x5c);

+            if (0 < auVar5._0_4_ + iVar24) {

+              uVar10 = (ulonglong)((*(int *)((longlong)plVar26 + 0x5c) - iVar12) + 1);

+            }

+            if (0 < (int)((iVar12 - uVar20) + (int)uVar10)) {

+              uVar20 = uVar20 - iVar12;

+              uVar10 = (ulonglong)uVar20;

+            }

+            iVar12 = iVar12 - *(int *)(lVar2 + 0xa0);

+            uVar9 = iVar12 + (int)uVar10;

+            if ((int)uVar9 < 1) {

+              uVar10 = 0;

+            }

+            else {

+              uVar10 = uVar10 & 0xffffffff;

+              if (iVar12 < 0) {

+                uVar10 = (ulonglong)uVar9;

+              }

+            }

+            iVar12 = (int)uVar10;

+            uVar13 = lVar11 * 0x14;

+            ppuVar18 = (undefined **)(ulonglong)(uint)((int)ppuVar18 + iVar12);

+            uVar23 = (ulonglong)(uint)(iVar22 * iVar12 * 8);

+            plVar16 = (longlong *)(uVar23 % uVar13);

+            uVar13 = plVar26[6] + uVar23 / uVar13;

+            if (((int)plVar26[0xd] == 0) && (0 < iVar24 + iVar12)) {

+              lVar11 = *plVar26;

+              if ((*(longlong **)(lVar11 + 8) != plVar26) ||

+                 (plVar3 = (longlong *)plVar26[1], (longlong *)*plVar3 != plVar26)) {

+LAB_2:

+                uVar9 = (uint)uVar10;

+                pcVar6 = (code *)swi(0x29);

+                (*pcVar6)(3,plVar16);

+                puVar17 = auStack_80;

+                goto LAB_3;

+              }

+              *plVar3 = lVar11;

+              *(longlong **)(lVar11 + 8) = plVar3;

+              ExFreeToNPagedLookasideList(lVar2 + 0x240,plVar26);

+            }

           }

-          break;

-        }

-        if (-1 < (int)(*(int *)((longlong)plVar26 + 0x5c) - uVar19)) {

-          plVar25 = plVar26;

-          if (*(int *)(lVar3 + 0xa0) - iVar21 < 1) {

-            uVar20 = iVar21 - *(int *)(lVar3 + 0xa0);

-          }

-          break;

-        }

-        plVar5 = (longlong *)*plVar26;

-        if (((longlong *)plVar5[1] != plVar26) ||

-           (plVar6 = (longlong *)plVar26[1], (longlong *)*plVar6 != plVar26)) goto LAB_1;

-        *plVar6 = (longlong)plVar5;

-        plVar5[1] = (longlong)plVar6;

-        ExFreeToNPagedLookasideList(lVar3 + 0x240);

-        plVar26 = plVar5;

-      }

-      if ((((plVar24 == (longlong *)0x0) &&

-           (plVar24 = *(longlong **)(lVar3 + 0xe8), plVar24 != (longlong *)(lVar3 + 0xe8))) &&

-          ((puVar17 = auStack_88, (int)plVar24[0x11] != 0 ||

-           ((((puVar17 = auStack_88, *(int *)((longlong)plVar24 + 0x8c) != 0 ||

-              (puVar17 = auStack_88, (int)plVar24[0x10] == 0)) ||

-             (puVar17 = auStack_88, *(int *)((longlong)plVar24 + 0x6c) != (int)plVar24[0x10])) ||

-            (puVar17 = auStack_88, plVar25 = plVar24, uVar18 < (ulonglong)plVar24[6])))))) ||

-         (puVar17 = auStack_88, plVar25 == (longlong *)0x0)) {

-LAB_2:

-        lVar27 = *(longlong *)(puVar17 + 0x98);

-      }

-      else {

-        iVar21 = *(int *)(*(longlong *)(lVar3 + 0x20) + 0xf8);

-        lVar27 = *(longlong *)(*(longlong *)(lVar3 + 0x20) + 0x110);

-        auVar10._8_8_ = 0;

-        auVar10._0_8_ = (uVar18 - plVar25[6]) * lVar27 * 0x14;

-        auVar10 = auVar10 / ZEXT416((uint)(iVar21 * 8));

-        uVar12 = auVar10._0_8_;

-        iVar13 = (int)plVar25[0xb];

-        iVar22 = iVar13 - *(int *)((longlong)plVar25 + 0x5c);

-        if (0 < auVar10._0_4_ + iVar22) {

-          uVar12 = (ulonglong)((*(int *)((longlong)plVar25 + 0x5c) - iVar13) + 1);

-        }

-        if (0 < (int)((iVar13 - uVar19) + (int)uVar12)) {

-          uVar12 = (ulonglong)(uVar19 - iVar13);

-        }

-        iVar13 = iVar13 - *(int *)(lVar3 + 0xa0);

-        uVar19 = iVar13 + (int)uVar12;

-        if ((int)uVar19 < 1) {

-          uVar12 = 0;

-        }

-        else {

-          uVar12 = uVar12 & 0xffffffff;

-          if (iVar13 < 0) {

-            uVar12 = (ulonglong)uVar19;

+          if ((uint)ppuVar18 != 0) {

+            uVar9 = *(uint *)(lVar2 + 0xa0);

+            ppuVar21 = (undefined **)(ulonglong)uVar25;

+            if ((uint)ppuVar18 <= uVar25) {

+              ppuVar21 = ppuVar18;

+            }

+            uVar20 = (uint)ppuVar21;

+            uVar15 = uVar9 + uVar20;

+            ppuVar18 = &WPP_GLOBAL_Control;

+            if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

+               ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

+              local_48 = *(undefined8 *)(lVar2 + 0x160);

+              local_50 = CONCAT44(local_50._4_4_,uVar15);

+              local_58 = CONCAT44(local_58._4_4_,uVar9);

+              local_60 = CONCAT44(local_60._4_4_,uVar25);

+              local_68 = CONCAT44(local_68._4_4_,uVar20);

+              local_40 = uVar13;

+              WPP_SF_dddddii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)uVar9,uVar10,

+                             *(undefined4 *)(lVar2 + 0x78));

+            }

+            uVar19 = Feature_4002387257__private_IsEnabledDeviceUsageNoInline();

+            uVar9 = *(uint *)(lVar2 + 0x6c);

+            uVar10 = CONCAT44(0,uVar9);

+            if ((int)uVar19 == 0) {

+              *(int *)(lVar2 + 0x74) = *(int *)(lVar2 + 0x74) + uVar20;

+              uVar10 = (ulonglong)(uVar9 * uVar20);

+              *(longlong *)(lVar2 + 0x78) = *(longlong *)(lVar2 + 0x78) + uVar10;

+              uVar19 = *(longlong *)(lVar2 + 0x88) + uVar10;

+              *(ulonglong *)(lVar2 + 0x88) = uVar19;

+              if (*(ulonglong *)(lVar2 + 0x58) <= uVar19) {

+                *(ulonglong *)(lVar2 + 0x88) = uVar19 - *(ulonglong *)(lVar2 + 0x58);

+              }

+            }

+            else {

+              auVar7._8_8_ = 0;

+              auVar7._0_8_ = uVar10;

+              auVar8._8_8_ = 0;

+              auVar8._0_8_ = ppuVar21;

+              lVar11 = SUB168(auVar7 * auVar8,0);

+              if (SUB168(auVar7 * auVar8,8) != 0) {

+LAB_3:

+                if ((undefined **)WPP_GLOBAL_Control == ppuVar18) {

+                  return (undefined **)0x0;

+                }

+                if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+                  return (undefined **)0x0;

+                }

+                uVar4 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);

+                *(uint *)(puVar17 + 0x20) = uVar9;

+                *(undefined8 *)(puVar17 + -8) = 0x140018195;

+                WPP_SF_dD(uVar4,0x4f,&WPP_2d619c39f4c936783a7b398058864277_Traceguids,uVar20);

+                return (undefined **)0x0;

+              }

+              *(longlong *)(lVar2 + 0x78) = *(longlong *)(lVar2 + 0x78) + lVar11;

+              uVar19 = lVar11 + *(longlong *)(lVar2 + 0x88);

+              *(int *)(lVar2 + 0x74) = *(int *)(lVar2 + 0x74) + uVar20;

+              *(ulonglong *)(lVar2 + 0x88) = uVar19;

+              if (*(ulonglong *)(lVar2 + 0x58) <= uVar19) {

+                *(ulonglong *)(lVar2 + 0x88) = uVar19 - *(ulonglong *)(lVar2 + 0x58);

+              }

+            }

+            *(uint *)(lVar2 + 0xa0) = uVar15;

+            bVar1 = *(byte *)(param_1 + 0xa0);

+            *(ulonglong *)(lVar2 + 0x160) = uVar13;

+            *(uint *)(lVar2 + 0xa4) = (bVar1 - 1) + uVar15 & -(uint)bVar1;

+            lVar11 = *(longlong *)(lVar2 + 0x108);

+            *(uint *)(lVar11 + 0x20) =

+                 uVar15 >> ((byte)*(undefined4 *)(lVar11 + 0x14) & 0x1f) & *(uint *)(lVar11 + 0x18);

+            if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+              return ppuVar21;

+            }

+            if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0) {

+              local_60 = *(undefined8 *)(lVar2 + 0x128);

+              uVar20 = *(int *)(lVar2 + 0x98) - 1;

+              local_68 = CONCAT44(local_68._4_4_,uVar20);

+              WPP_SF_ddi(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)uVar20,uVar10,

+                         *(undefined4 *)(lVar2 + 0xa0));

+              return ppuVar21;

+            }

+            return ppuVar21;

           }

         }

-        iVar13 = (int)uVar12;

-        uVar20 = uVar20 + iVar13;

-        lVar27 = (ulonglong)(uint)(iVar21 * iVar13 * 8) / (ulonglong)(lVar27 * 0x14) + plVar25[6];

-        puVar17 = auStack_88;

-        if (((int)plVar25[0xd] == 0) && (puVar17 = auStack_88, 0 < iVar22 + iVar13)) {

-          lVar9 = *plVar25;

-          if ((*(longlong **)(lVar9 + 8) != plVar25) ||

-             (plVar24 = (longlong *)plVar25[1], (longlong *)*plVar24 != plVar25)) {

-LAB_1:

-            pcVar11 = (code *)swi(0x29);

-            (*pcVar11)(3);

-            puVar17 = auStack_80;

-            goto LAB_2;

+      }

+      else {

+        do {

+          uVar13 = plVar16[6];

+          if ((((int)plVar16[0x11] != 0) || (uVar19 <= uVar13)) ||

+             (iVar22 = (int)plVar16[0xb], -1 < (int)(iVar22 - uVar20))) {

+            uVar20 = *(uint *)(lVar2 + 0xa0);

+            uVar9 = *(uint *)(plVar16 + 0xb);

+            if ((int)(uVar20 - uVar9) < 1) {

+              ppuVar18 = (undefined **)(ulonglong)(uVar9 - uVar20);

+              uVar20 = uVar9;

+            }

+            uVar25 = (uint)ppuVar18;

+            plVar26 = (longlong *)0x0;

+            goto LAB_1;

           }

-          *plVar24 = lVar9;

-          *(longlong **)(lVar9 + 8) = plVar24;

-          ExFreeToNPagedLookasideList(lVar3 + 0x240,plVar25);

-          puVar17 = auStack_88;

-        }

-      }

-      if (uVar20 != 0) {

-        uVar19 = *(uint *)(lVar3 + 0xa0);

-        if (uVar23 < uVar20) {

-          uVar20 = uVar23;

-        }

-        uVar16 = uVar19 + uVar20;

-        if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

-           ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x20) != 0)) {

-          uVar7 = *(undefined8 *)(lVar3 + 0x160);

-          uVar2 = *(undefined4 *)(lVar3 + 0x78);

-          uVar8 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);

-          *(longlong *)(puVar17 + 0x48) = lVar27;

-          *(undefined8 *)(puVar17 + 0x40) = uVar7;

-          *(uint *)(puVar17 + 0x38) = uVar16;

-          *(uint *)(puVar17 + 0x30) = uVar19;

-          *(uint *)(puVar17 + 0x28) = uVar23;

-          *(uint *)(puVar17 + 0x20) = uVar20;

-          *(undefined8 *)(puVar17 + -8) = 0x1400180fb;

-          WPP_SF_dddddii(uVar8,(ulonglong)uVar19,uVar12,uVar2);

-        }

-        uVar14 = (ulonglong)(uVar20 * *(int *)(lVar3 + 0x6c));

-        *(int *)(lVar3 + 0x74) = *(int *)(lVar3 + 0x74) + uVar20;

-        *(longlong *)(lVar3 + 0x78) = *(longlong *)(lVar3 + 0x78) + uVar14;

-        uVar14 = *(longlong *)(lVar3 + 0x88) + uVar14;

-        *(ulonglong *)(lVar3 + 0x88) = uVar14;

-        if (*(ulonglong *)(lVar3 + 0x58) <= uVar14) {

-          *(ulonglong *)(lVar3 + 0x88) = uVar14 - *(ulonglong *)(lVar3 + 0x58);

-        }

-        lVar9 = *(longlong *)(puVar17 + 0x90);

-        *(uint *)(lVar3 + 0xa0) = uVar16;

-        bVar1 = *(byte *)(lVar9 + 0xa0);

-        *(longlong *)(lVar3 + 0x160) = lVar27;

-        *(uint *)(lVar3 + 0xa4) = (bVar1 - 1) + uVar16 & -(uint)bVar1;

-        lVar27 = *(longlong *)(lVar3 + 0x108);

-        *(uint *)(lVar27 + 0x20) =

-             uVar16 >> ((byte)*(undefined4 *)(lVar27 + 0x14) & 0x1f) & *(uint *)(lVar27 + 0x18);

-        if ((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) {

-          if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0) {

-            uVar7 = *(undefined8 *)(lVar3 + 0x128);

-            uVar19 = *(int *)(lVar3 + 0x98) - 1;

-            uVar2 = *(undefined4 *)(lVar3 + 0xa0);

-            uVar8 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);

-            *(undefined8 *)(puVar17 + 0x28) = uVar7;

-            *(uint *)(puVar17 + 0x20) = uVar19;

-            *(undefined8 *)(puVar17 + -8) = 0x1400181a8;

-            WPP_SF_ddi(uVar8,uVar7,(ulonglong)uVar19,uVar2);

-            return uVar20;

+          if (-1 < (int)(*(int *)((longlong)plVar16 + 0x5c) - uVar20)) {

+            plVar26 = plVar16;

+            if (*(int *)(lVar2 + 0xa0) - iVar22 < 1) {

+              ppuVar18 = (undefined **)(ulonglong)(uint)(iVar22 - *(int *)(lVar2 + 0xa0));

+            }

+            goto LAB_1;

           }

-          return uVar20;

-        }

-        return uVar20;

+          plVar26 = (longlong *)*plVar16;

+          if (((longlong *)plVar26[1] != plVar16) ||

+             (plVar3 = (longlong *)plVar16[1], (longlong *)*plVar3 != plVar16)) goto LAB_2;

+          *plVar3 = (longlong)plVar26;

+          plVar26[1] = (longlong)plVar3;

+          ExFreeToNPagedLookasideList(lVar2 + 0x240);

+          plVar16 = plVar26;

+        } while (plVar26 != (longlong *)(lVar2 + 0xd8));

       }

       if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

-        return 0;

+        return (undefined **)0x0;

       }

       if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) == 0) {

-        return 0;

-      }

-      uVar15 = 0x47;

-      uVar20 = *(uint *)(lVar3 + 0x98);

-      iVar21 = *(int *)(lVar3 + 0xa0);

-      *(undefined8 *)(puVar17 + 0x40) = *(undefined8 *)(lVar3 + 0x160);

-      *(ulonglong *)(puVar17 + 0x38) = uVar18;

-      *(uint *)(puVar17 + 0x30) = uVar23;

-      goto LAB_3;

+        return (undefined **)0x0;

+      }

+      local_48 = *(ulonglong *)(lVar2 + 0x160);

+      uVar14 = 0x4d;

+      uVar9 = *(uint *)(lVar2 + 0x98);

+      iVar22 = *(int *)(lVar2 + 0xa0);

+      local_58 = CONCAT44(local_58._4_4_,uVar25);

+      goto LAB_4;

     }

   }

   else {

-    uVar14 = *(ulonglong *)(lVar3 + 0x60) >> 1;

-    if (uVar14 < uVar16) {

-      if (uVar16 - uVar23 < uVar14) {

-        uVar23 = uVar16 - (int)uVar14;

-        uVar19 = iVar21 + uVar23;

+    uVar13 = *(ulonglong *)(lVar2 + 0x60) >> 1;

+    if (uVar13 < uVar15) {

+      if (uVar15 - uVar25 < uVar13) {

+        uVar25 = uVar15 - (int)uVar13;

+        uVar20 = iVar22 + uVar25;

       }

       goto LAB_0;

     }

   }

   if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

-    return 0;

+    return (undefined **)0x0;

   }

   if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) == 0) {

-    return 0;

-  }

-  uVar15 = 0x45;

+    return (undefined **)0x0;

+  }

+  uVar14 = 0x4b;

   local_58 = local_58 & 0xffffffff00000000;

-  local_50 = uVar18;

-  local_48 = uVar4;

-LAB_3:

-  uVar7 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);

-  *(undefined8 *)(puVar17 + 0x28) = *(undefined8 *)(lVar3 + 0x128);

-  *(uint *)(puVar17 + 0x20) = uVar20 - 1;

-  *(undefined8 *)(puVar17 + -8) = 0x14001809b;

-  WPP_SF_ddidii(uVar7,uVar15,(ulonglong)(uVar20 - 1),iVar21);

-  return 0;

+  local_48 = uVar23;

+LAB_4:

+  local_60 = *(undefined8 *)(lVar2 + 0x128);

+  local_68 = CONCAT44(local_68._4_4_,uVar9 - 1);

+  local_50 = uVar19;

+  WPP_SF_ddidii(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar14,(ulonglong)(uVar9 - 1),iVar22);

+  return (undefined **)0x0;

 }

 


```


## PgmSendRData

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|code,length,address,called|
|ratio|0.18|
|i_ratio|0.36|
|m_ratio|0.75|
|b_ratio|0.35|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|PgmSendRData|PgmSendRData|
|fullname|PgmSendRData|PgmSendRData|
|refcount|2|2|
|`length`|1372|2377|
|`called`|<details><summary>Expand for full list:<br>AnyMoreNaks<br>DestroyEntry<br>GetNextNakIndex<br>NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList<br>NTOSKRNL.EXE::ExFreeToNPagedLookasideList<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeStackAttachProcess<br>NTOSKRNL.EXE::KeUnstackDetachProcess<br>NTOSKRNL.EXE::PsGetCurrentProcess<br>PgmBuildParityPacket</summary>RemoveEntry<br>TdiSendDatagram<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_ddDd<br>__security_check_cookie<br>memmove<br>memset<br>tcpxsum</details>|<details><summary>Expand for full list:<br>AnyMoreNaks<br>DestroyEntry<br>Feature_4002387257__private_IsEnabledDeviceUsageNoInline<br>GetNextNakIndex<br>NTOSKRNL.EXE::ExAllocateFromNPagedLookasideList<br>NTOSKRNL.EXE::ExFreeToNPagedLookasideList<br>NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc<br>NTOSKRNL.EXE::KeReleaseSpinLock<br>NTOSKRNL.EXE::KeStackAttachProcess<br>NTOSKRNL.EXE::KeUnstackDetachProcess<br>NTOSKRNL.EXE::PsGetCurrentProcess</summary>PgmBuildParityPacket<br>RemoveEntry<br>TdiSendDatagram<br>WPP_SF_<br>WPP_SF_D<br>WPP_SF_dD<br>WPP_SF_ddDd<br>__security_check_cookie<br>memcpy<br>memset<br>tcpxsum</details>|
|calling|SendNextPacket|SendNextPacket|
|paramcount|4|4|
|`address`|14001abbc|14001ac9c|
|sig|ulonglong __fastcall PgmSendRData(longlong param_1, longlong * param_2, undefined1 * param_3, uint * param_4)|ulonglong __fastcall PgmSendRData(longlong param_1, longlong * param_2, undefined1 * param_3, uint * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### PgmSendRData Called Diff


```diff
--- PgmSendRData called
+++ PgmSendRData called
@@ -2,0 +3 @@
+Feature_4002387257__private_IsEnabledDeviceUsageNoInline
@@ -15,0 +17 @@
+WPP_SF_dD
@@ -18 +20 @@
-memmove
+memcpy
```


### PgmSendRData Diff


```diff
--- PgmSendRData
+++ PgmSendRData
@@ -1,231 +1,380 @@
 

 /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */

 

 ulonglong PgmSendRData(longlong param_1,longlong *param_2,undefined1 *param_3,uint *param_4)

 

 {

-  longlong lVar1;

-  byte bVar2;

-  undefined1 uVar3;

-  char cVar4;

-  int iVar5;

+  uint uVar1;

+  longlong lVar2;

+  undefined1 auVar3 [16];

+  ushort *puVar4;

+  bool bVar5;

+  undefined1 uVar6;

+  char cVar7;

+  int iVar8;

   ulonglong *_Dst;

-  longlong lVar6;

-  ulonglong uVar7;

-  byte bVar8;

-  uint uVar9;

-  ulonglong uVar10;

-  ushort *puVar11;

-  uint uVar12;

-  ushort *puVar13;

-  uint uVar14;

-  ushort uVar15;

-  byte bVar16;

-  uint uVar17;

-  ushort uVar18;

-  bool bVar19;

-  undefined1 auStackY_e8 [32];

-  bool local_98;

-  char local_97;

-  ushort local_94 [2];

-  int local_90;

-  ushort *local_88;

-  undefined1 *local_80;

+  ulonglong uVar9;

+  longlong lVar10;

+  byte bVar11;

+  undefined2 uVar12;

+  ulonglong uVar13;

+  ushort *puVar14;

+  uint uVar15;

+  ulonglong uVar16;

+  ushort uVar17;

+  ulonglong uVar18;

+  byte bVar19;

+  short sVar20;

+  bool bVar21;

+  undefined1 auStackY_f8 [32];

+  byte local_a7 [3];

+  uint local_a4;

+  ushort local_a0 [2];

+  ushort local_9c;

+  uint local_98;

+  ushort *local_90;

+  undefined1 *local_88;

+  ulonglong *local_80;

   uint *local_78;

   undefined8 local_70;

   undefined8 uStack_68;

   undefined8 local_60;

   undefined8 uStack_58;

   undefined8 local_50;

   undefined8 uStack_48;

   ulonglong local_40;

   

-  local_40 = __security_cookie ^ (ulonglong)auStackY_e8;

-  lVar1 = *(longlong *)(param_1 + 0x28);

+  local_40 = __security_cookie ^ (ulonglong)auStackY_f8;

+  lVar2 = *(longlong *)(param_1 + 0x28);

+  local_a7[0] = 0;

+  *param_4 = 0;

   local_70 = 0;

   uStack_68 = 0;

-  local_98 = false;

-  *param_4 = 0;

   local_60 = 0;

   uStack_58 = 0;

   local_50 = 0;

   uStack_48 = 0;

-  local_80 = param_3;

+  local_88 = param_3;

   local_78 = param_4;

-  _Dst = (ulonglong *)ExAllocateFromNPagedLookasideList(lVar1 + 0x1c0);

+  _Dst = (ulonglong *)ExAllocateFromNPagedLookasideList(lVar2 + 0x1c0);

+  local_80 = _Dst;

   if (_Dst == (ulonglong *)0x0) {

-    if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

-       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {

-      WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x28,

-              &WPP_ad5a23d009db360b9b5fbd08776dfa43_Traceguids);

-    }

-    return 0xc000009a;

-  }

-  iVar5 = (int)param_2[2];

-  uVar18 = *(short *)(lVar1 + 0x70) + 0x44;

-  uVar14 = (uint)uVar18;

-  uVar9 = 1;

-  uVar17 = 1;

-  local_94[0] = uVar18;

-  local_90 = iVar5;

+    if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+      return 0xc000009a;

+    }

+    if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+      return 0xc000009a;

+    }

+    uVar12 = 0x28;

+    goto LAB_0;

+  }

+  uVar15 = *(uint *)(param_2 + 2);

+  local_a0[0] = *(short *)(lVar2 + 0x70) + 0x44;

+  sVar20 = 2;

+  local_98 = 1;

+  local_a4 = uVar15;

+  local_9c = local_a0[0];

   if (*(char *)(param_1 + 0xa1) == '\0') {

+    sVar20 = 1;

     *(undefined1 *)(param_2 + 8) = 0;

-    param_2[5] = *(longlong *)(lVar1 + 0x128) + param_2[4];

-    *(int *)(lVar1 + 0x94) = *(int *)(lVar1 + 0x94) + -1;

-    bVar19 = param_2[4] == 0;

-    local_98 = false;

-    uVar12 = uVar9;

-LAB_0:

-    if (bVar19) {

-      RemoveEntry(*(longlong *)(lVar1 + 0x108),param_2);

+    bVar5 = false;

+    param_2[5] = *(longlong *)(lVar2 + 0x128) + param_2[4];

+    *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + -1;

+    lVar10 = param_2[4];

+LAB_1:

+    if (lVar10 == 0) {

+      RemoveEntry(*(longlong *)(lVar2 + 0x108),param_2);

     }

   }

   else {

     if (*(short *)((longlong)param_2 + 0x3a) == 0) {

-      uVar12 = 1;

-      cVar4 = GetNextNakIndex((longlong)param_2,&local_98);

-      if (cVar4 != '\0') {

-        local_90 = local_90 + (uint)local_98;

+      sVar20 = 1;

+      cVar7 = GetNextNakIndex((longlong)param_2,(char *)local_a7);

+      if (cVar7 != '\0') {

+        local_a4 = uVar15 + local_a7[0];

       }

     }

     else {

-      uVar12 = 2;

       *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + -1;

     }

-    lVar6 = 0;

-    iVar5 = local_90;

-    local_98 = AnyMoreNaks((longlong)param_2);

-    if (!local_98) {

-      param_2[5] = *(longlong *)(lVar1 + 0x128) + param_2[4];

-      *(int *)(lVar1 + 0x94) = *(int *)(lVar1 + 0x94) + -1;

-      bVar19 = param_2[4] == lVar6;

-      goto LAB_0;

-    }

-  }

-  uVar10 = (ulonglong)(uint)((iVar5 - *(int *)(lVar1 + 0xa0)) * *(int *)(lVar1 + 0x6c)) +

-           *(longlong *)(lVar1 + 0x88);

-  uVar7 = uVar10 - *(ulonglong *)(lVar1 + 0x58);

-  if (uVar10 < *(ulonglong *)(lVar1 + 0x58)) {

-    uVar7 = uVar10;

-  }

-  local_88 = (ushort *)(uVar7 + *(longlong *)(lVar1 + 0x50));

+    bVar5 = AnyMoreNaks((longlong)param_2);

+    if (!bVar5) {

+      param_2[5] = *(longlong *)(lVar2 + 0x128) + param_2[4];

+      *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + -1;

+      lVar10 = param_2[4];

+      goto LAB_1;

+    }

+  }

+  uVar9 = Feature_4002387257__private_IsEnabledDeviceUsageNoInline();

+  if ((int)uVar9 == 0) {

+    uVar13 = (ulonglong)((local_a4 - *(int *)(lVar2 + 0xa0)) * *(int *)(lVar2 + 0x6c)) +

+             *(longlong *)(lVar2 + 0x88);

+    if (*(ulonglong *)(lVar2 + 0x58) <= uVar13) {

+      uVar13 = uVar13 - *(ulonglong *)(lVar2 + 0x58);

+    }

+  }

+  else {

+    uVar15 = local_a4 - *(int *)(lVar2 + 0xa0);

+    if ((int)uVar15 < 0) {

+      ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+      if ((bVar5 == false) && (param_2[4] == 0)) {

+        DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

+      }

+      else {

+        if (sVar20 == 2) {

+          *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + 1;

+        }

+        *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+      }

+      if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+        return 0xc000009a;

+      }

+      if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+        return 0xc000009a;

+      }

+      WPP_SF_dD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x29,

+                &WPP_2d619c39f4c936783a7b398058864277_Traceguids,local_a4);

+      return 0xc000009a;

+    }

+    uVar18 = CONCAT44(0,*(uint *)(lVar2 + 0x6c));

+    auVar3._8_8_ = 0;

+    auVar3._0_8_ = uVar18;

+    auVar3 = auVar3 * ZEXT416(uVar15);

+    uVar9 = auVar3._0_8_;

+    local_90 = (ushort *)0x0;

+    if (auVar3._8_8_ != 0) {

+      ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+      if ((bVar5 == false) && (param_2[4] == 0)) {

+        DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

+      }

+      else {

+        if (sVar20 == 2) {

+          *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + 1;

+        }

+        *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+      }

+      if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+        return 0xc000009a;

+      }

+      if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+        return 0xc000009a;

+      }

+      uVar12 = 0x2a;

+LAB_2:

+      WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar12,

+               &WPP_2d619c39f4c936783a7b398058864277_Traceguids,0xc0000095);

+      return 0xc000009a;

+    }

+    uVar16 = *(longlong *)(lVar2 + 0x88) + uVar9;

+    if (uVar16 < uVar9) {

+      ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+      if ((bVar5 == false) && (param_2[4] == 0)) {

+        DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

+      }

+      else {

+        if (sVar20 == 2) {

+          *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + 1;

+        }

+        *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+      }

+      if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+        return 0xc000009a;

+      }

+      if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+        return 0xc000009a;

+      }

+      uVar12 = 0x2b;

+      goto LAB_2;

+    }

+    uVar9 = *(ulonglong *)(lVar2 + 0x58);

+    uVar13 = uVar16 - uVar9;

+    if (uVar16 < uVar9) {

+      uVar13 = uVar16;

+    }

+    if (uVar9 < uVar13 + uVar18) {

+      ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+      if ((bVar5 == false) && (param_2[4] == 0)) {

+        DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

+      }

+      else {

+        if (sVar20 == 2) {

+          *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + 1;

+        }

+        *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+      }

+      if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {

+        return 0xc000009a;

+      }

+      if ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0) {

+        return 0xc000009a;

+      }

+      uVar12 = 0x2c;

+LAB_0:

+      WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar12,

+              &WPP_2d619c39f4c936783a7b398058864277_Traceguids);

+      return 0xc000009a;

+    }

+  }

+  local_90 = (ushort *)(*(longlong *)(lVar2 + 0x50) + uVar13);

   *(short *)(param_2 + 7) = (short)param_2[7] + 1;

   *(int *)(param_1 + 0x14) = *(int *)(param_1 + 0x14) + 1;

   KeReleaseSpinLock(param_1 + 0x168);

-  lVar6 = PsGetCurrentProcess();

-  local_97 = lVar6 != PgmStaticConfig;

-  if ((bool)local_97) {

+  lVar10 = PsGetCurrentProcess();

+  bVar21 = lVar10 != PgmStaticConfig;

+  if (bVar21) {

     KeStackAttachProcess();

   }

-  puVar13 = local_88;

-  if (uVar12 != 1) {

-    if (uVar12 != 2) goto LAB_1;

-    bVar16 = 0;

-    bVar2 = *(byte *)((longlong)param_2 + 0x61);

+  puVar4 = local_90;

+  if (sVar20 != 1) {

+    if (sVar20 != 2) {

+      uVar15 = (uint)local_9c;

+      goto LAB_3;

+    }

+    bVar19 = *(byte *)((longlong)param_2 + 0x61);

     if (*(byte *)((longlong)param_2 + 0x61) == 0) {

       *(undefined4 *)((longlong)param_2 + 100) = 0;

+      bVar19 = 0;

       *(undefined1 *)((longlong)param_2 + 0x61) = 0;

-      uVar7 = 0;

-      uVar14 = 0;

-      bVar8 = 0;

-      puVar11 = local_88;

+      uVar9 = 0;

+      uVar15 = 0;

+      bVar11 = 0;

+      puVar14 = local_90;

       if (*(char *)(param_1 + 0xa0) != '\0') {

         do {

-          param_2[uVar7 + 0xd] = (ulonglong)puVar11[1] + 0x38 + (longlong)puVar11;

-          uVar14 = *(uint *)(puVar11 + 2) & 0x861 | *(uint *)((longlong)param_2 + 100);

-          *(uint *)((longlong)param_2 + 100) = uVar14;

-          if ((*(uint *)(puVar11 + 2) & 0x800) != 0) {

-            *(undefined1 *)((longlong)param_2 + 0x61) = *(undefined1 *)((longlong)puVar11 + 0x1d);

+          param_2[uVar9 + 0xd] = (ulonglong)puVar14[1] + 0x38 + (longlong)puVar14;

+          uVar15 = *(uint *)(puVar14 + 2) & 0x861 | *(uint *)((longlong)param_2 + 100);

+          *(uint *)((longlong)param_2 + 100) = uVar15;

+          if ((*(uint *)(puVar14 + 2) & 0x800) != 0) {

+            *(undefined1 *)((longlong)param_2 + 0x61) = *(undefined1 *)((longlong)puVar14 + 0x1d);

           }

-          uVar15 = (short)uVar7 + 1;

-          uVar7 = (ulonglong)uVar15;

-          bVar8 = *(byte *)(param_1 + 0xa0);

-          puVar11 = (ushort *)((longlong)puVar11 + (ulonglong)*(uint *)(lVar1 + 0x6c));

-        } while (uVar15 < bVar8);

-        bVar16 = *(byte *)((longlong)param_2 + 0x61);

-      }

-      bVar2 = bVar16;

-      if ((uVar14 >> 0xb & 1) == 0) {

-        *(byte *)((longlong)param_2 + 0x61) = bVar8;

-        bVar2 = bVar8;

-      }

-    }

-    if (bVar2 != 1) {

-      memset(_Dst,0,(ulonglong)uVar18);

-      uVar7 = PgmBuildParityPacket

-                        (param_1,(longlong)puVar13,(byte *)(param_2 + 0xc),(ushort *)_Dst,local_94,5

-                        );

-      if ((int)uVar7 < 0) {

+          uVar17 = (short)uVar9 + 1;

+          uVar9 = (ulonglong)uVar17;

+          bVar11 = *(byte *)(param_1 + 0xa0);

+          puVar14 = (ushort *)((longlong)puVar14 + (ulonglong)*(uint *)(lVar2 + 0x6c));

+        } while (uVar17 < bVar11);

+        bVar19 = *(byte *)((longlong)param_2 + 0x61);

+      }

+      if ((uVar15 >> 0xb & 1) == 0) {

+        *(byte *)((longlong)param_2 + 0x61) = bVar11;

+        bVar19 = bVar11;

+      }

+    }

+    if (bVar19 != 1) {

+      memset(_Dst,0,(ulonglong)local_9c);

+      uVar9 = PgmBuildParityPacket

+                        (param_1,(longlong)puVar4,(byte *)(param_2 + 0xc),(ushort *)_Dst,local_a0,5)

+      ;

+      if ((int)uVar9 < 0) {

         if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

            ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) != 0)) {

-          WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x29,

-                   &WPP_ad5a23d009db360b9b5fbd08776dfa43_Traceguids,(int)uVar7);

-        }

-        if (local_97 != '\0') {

+          WPP_SF_D(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x2d,

+                   &WPP_2d619c39f4c936783a7b398058864277_Traceguids,(int)uVar9);

+        }

+        if (bVar21) {

           KeUnstackDetachProcess(&local_70);

         }

-        uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x168);

-        *local_80 = uVar3;

-        ExFreeToNPagedLookasideList(lVar1 + 0x1c0,_Dst);

-        if ((local_98 == false) && (param_2[4] == 0)) {

+        uVar6 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x168);

+        *local_88 = uVar6;

+        ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+        if ((bVar5 == false) && (param_2[4] == 0)) {

           DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

-          return uVar7 & 0xffffffff;

+          return uVar9 & 0xffffffff;

         }

         *(short *)(param_2 + 7) = (short)param_2[7] + -1;

         *(short *)((longlong)param_2 + 0x3a) = *(short *)((longlong)param_2 + 0x3a) + 1;

-        *(int *)(lVar1 + 0x94) = *(int *)(lVar1 + 0x94) + 1;

-        return uVar7 & 0xffffffff;

-      }

-      uVar14 = (uint)local_94[0];

-      uVar9 = uVar17;

-      goto LAB_1;

-    }

-    uVar17 = uVar9;

-    if (local_98 != false) {

-      uVar18 = *(ushort *)((longlong)param_2 + 0x3a);

+        *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+        return uVar9 & 0xffffffff;

+      }

+      uVar15 = (uint)local_a0[0];

+      goto LAB_3;

+    }

+    if (bVar5 != false) {

+      uVar15 = *(ushort *)((longlong)param_2 + 0x3a) + 1;

       *(undefined2 *)((longlong)param_2 + 0x3a) = 0;

-      uVar17 = (uint)uVar18;

-      cVar4 = GetNextNakIndex((longlong)param_2,&local_98);

-      while (uVar17 = uVar17 + 1, cVar4 != '\0') {

-        cVar4 = GetNextNakIndex((longlong)param_2,&local_98);

-        puVar13 = local_88;

-      }

-      param_2[5] = *(longlong *)(lVar1 + 0x128) + param_2[4];

-      *(int *)(lVar1 + 0x94) = *(int *)(lVar1 + 0x94) + -1;

+      local_98 = uVar15;

+      cVar7 = GetNextNakIndex((longlong)param_2,(char *)local_a7);

+      uVar1 = local_98;

+      while (cVar7 != '\0') {

+        uVar15 = uVar15 + 1;

+        cVar7 = GetNextNakIndex((longlong)param_2,(char *)local_a7);

+        _Dst = local_80;

+        uVar1 = uVar15;

+      }

+      bVar5 = false;

+      param_2[5] = *(longlong *)(lVar2 + 0x128) + param_2[4];

+      *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + -1;

+      local_98 = uVar1;

       if (param_2[4] == 0) {

-        RemoveEntry(*(longlong *)(lVar1 + 0x108),param_2);

-      }

-    }

-  }

-  uVar14 = (uint)*puVar13;

-  memmove(_Dst,puVar13 + 0x10,(ulonglong)*puVar13);

-  uVar9 = uVar17;

-LAB_1:

-  if (local_97 != '\0') {

-    KeUnstackDetachProcess();

-  }

-  uVar17 = *(uint *)(lVar1 + 0xa4);

-  *(undefined2 *)((longlong)_Dst + 6) = 0;

-  *(uint *)((longlong)_Dst + 0x14) =

-       uVar17 >> 0x18 | (uVar17 & 0xff0000) >> 8 | (uVar17 & 0xff00) << 8 | uVar17 << 0x18;

-  *(undefined1 *)((longlong)_Dst + 4) = 5;

-  iVar5 = tcpxsum(0,_Dst,uVar14);

-  *(ushort *)((longlong)_Dst + 6) = ~(ushort)iVar5;

-  uVar7 = TdiSendDatagram(*(undefined8 *)(*(longlong *)(lVar1 + 0x20) + 0x60),

-                          *(undefined8 *)(*(longlong *)(lVar1 + 0x20) + 0x68),_Dst,uVar14,

-                          PgmSendRDataCompletion,param_2,_Dst,*(uint *)(lVar1 + 0x28),

-                          *(ushort *)(lVar1 + 0x30),'\0');

-  if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

-     ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) {

-    WPP_SF_ddDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)*(uint *)(lVar1 + 0x28),_Dst,

-                local_90);

-  }

-  uVar3 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x168);

-  *local_80 = uVar3;

-  *(longlong *)(lVar1 + 0x368) = *(longlong *)(lVar1 + 0x368) - (ulonglong)uVar9;

-  *(longlong *)(lVar1 + 0x380) = *(longlong *)(lVar1 + 0x380) + 1;

-  *(longlong *)(lVar1 + 0x350) = *(longlong *)(lVar1 + 0x350) + 1;

-  *local_78 = uVar14;

-  return uVar7 & 0xffffffff;

+        RemoveEntry(*(longlong *)(lVar2 + 0x108),param_2);

+      }

+    }

+  }

+  puVar4 = local_90;

+  uVar9 = Feature_4002387257__private_IsEnabledDeviceUsageNoInline();

+  if (((int)uVar9 == 0) ||

+     (uVar15 = *(uint *)(puVar4 + 0x18),

+     local_a4 ==

+     (uVar15 >> 0x18 | (uVar15 & 0xff0000) >> 8 | (uVar15 & 0xff00) << 8 | uVar15 << 0x18))) {

+    uVar17 = *puVar4;

+    uVar15 = (uint)uVar17;

+    uVar9 = Feature_4002387257__private_IsEnabledDeviceUsageNoInline();

+    if (((int)uVar9 == 0) || (uVar17 + 0x20 <= *(uint *)(lVar2 + 0x6c))) {

+      memcpy(_Dst,local_90 + 0x10,(ulonglong)uVar17);

+LAB_3:

+      if (bVar21) {

+        KeUnstackDetachProcess();

+      }

+      uVar1 = *(uint *)(lVar2 + 0xa4);

+      *(uint *)((longlong)_Dst + 0x14) =

+           uVar1 >> 0x18 | (uVar1 & 0xff0000) >> 8 | (uVar1 & 0xff00) << 8 | uVar1 << 0x18;

+      *(undefined1 *)((longlong)_Dst + 4) = 5;

+      *(undefined2 *)((longlong)_Dst + 6) = 0;

+      iVar8 = tcpxsum(0,_Dst,uVar15);

+      *(ushort *)((longlong)_Dst + 6) = ~(ushort)iVar8;

+      uVar9 = TdiSendDatagram(*(undefined8 *)(*(longlong *)(lVar2 + 0x20) + 0x60),

+                              *(undefined8 *)(*(longlong *)(lVar2 + 0x20) + 0x68),_Dst,uVar15,

+                              PgmSendRDataCompletion,param_2,_Dst,*(uint *)(lVar2 + 0x28),

+                              *(ushort *)(lVar2 + 0x30),'\0');

+      if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&

+         ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 0x10) != 0)) {

+        WPP_SF_ddDd(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),(ulonglong)*(uint *)(lVar2 + 0x28),

+                    _Dst,local_a4);

+      }

+      uVar6 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x168);

+      *local_88 = uVar6;

+      *(longlong *)(lVar2 + 0x368) = *(longlong *)(lVar2 + 0x368) - (ulonglong)local_98;

+      *(longlong *)(lVar2 + 0x380) = *(longlong *)(lVar2 + 0x380) + 1;

+      *(longlong *)(lVar2 + 0x350) = *(longlong *)(lVar2 + 0x350) + 1;

+      *local_78 = uVar15;

+      return uVar9 & 0xffffffff;

+    }

+    if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||

+       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0)) goto LAB_4;

+    uVar15 = (uint)uVar17;

+    uVar12 = 0x2f;

+  }

+  else {

+    if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||

+       ((*(uint *)(WPP_GLOBAL_Control + 0x2c) & 2) == 0)) goto LAB_4;

+    uVar12 = 0x2e;

+    uVar15 = local_a4;

+  }

+  WPP_SF_dD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar12,

+            &WPP_2d619c39f4c936783a7b398058864277_Traceguids,uVar15);

+LAB_4:

+  if (bVar21) {

+    KeUnstackDetachProcess(&local_70);

+  }

+  uVar6 = KeAcquireSpinLockRaiseToDpc(param_1 + 0x168);

+  *local_88 = uVar6;

+  ExFreeToNPagedLookasideList(lVar2 + 0x1c0,_Dst);

+  if ((bVar5 == false) && (param_2[4] == 0)) {

+    DestroyEntry(*(longlong *)(*(longlong *)(param_1 + 0x28) + 0x108),(longlong)param_2);

+  }

+  else {

+    *(short *)(param_2 + 7) = (short)param_2[7] + -1;

+    *(int *)(lVar2 + 0x94) = *(int *)(lVar2 + 0x94) + 1;

+  }

+  return 0xc0000001;

 }

 


```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## wil_details_IsEnabledFallback

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|4|5|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Feature_2927561019__private_IsEnabledFallback<br>Feature_3646914874__private_IsEnabledFallback<br>Feature_47687993__private_IsEnabledFallback|Feature_2927561019__private_IsEnabledFallback<br>Feature_3646914874__private_IsEnabledFallback<br>Feature_4002387257__private_IsEnabledFallback<br>Feature_47687993__private_IsEnabledFallback|
|paramcount|3|3|
|address|14000b350|14000b350|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -2,0 +3 @@
+Feature_4002387257__private_IsEnabledFallback
```


## NTOSKRNL.EXE::KeUnstackDetachProcess

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|KeUnstackDetachProcess|KeUnstackDetachProcess|
|fullname|NTOSKRNL.EXE::KeUnstackDetachProcess|NTOSKRNL.EXE::KeUnstackDetachProcess|
|`refcount`|18|19|
|length|0|0|
|called|||
|calling|<details><summary>Expand for full list:<br>CloseAddressHandles<br>GetNextPacketOptionsAndData<br>PgmCreateDataFileAndMapSection<br>PgmDereferenceDevice<br>PgmQueryTcpInfo<br>PgmSendNextOData<br>PgmSendRData<br>PgmSendRequestFromClient<br>PgmSetTcpInfo<br>PgmTdiOpenControl<br>PgmUnmapAndCloseDataFile</summary>TdiOpenAddressHandle</details>|<details><summary>Expand for full list:<br>CloseAddressHandles<br>GetNextPacketOptionsAndData<br>PgmCreateDataFileAndMapSection<br>PgmDereferenceDevice<br>PgmQueryTcpInfo<br>PgmSendNextOData<br>PgmSendRData<br>PgmSendRequestFromClient<br>PgmSetTcpInfo<br>PgmTdiOpenControl<br>PgmUnmapAndCloseDataFile</summary>TdiOpenAddressHandle</details>|
|paramcount|0|0|
|address|EXTERNAL:0000001a|EXTERNAL:0000001a|
|sig|undefined KeUnstackDetachProcess(void)|undefined KeUnstackDetachProcess(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

## DestroyEntry

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|DestroyEntry|DestroyEntry|
|fullname|DestroyEntry|DestroyEntry|
|`refcount`|5|10|
|length|71|71|
|called|NTOSKRNL.EXE::ExFreeToNPagedLookasideList|NTOSKRNL.EXE::ExFreeToNPagedLookasideList|
|calling|FindFirstEntry<br>PgmSendRData<br>PgmSendRDataCompletion<br>RemoveAllEntries|FindFirstEntry<br>PgmSendRData<br>PgmSendRDataCompletion<br>RemoveAllEntries|
|paramcount|2|2|
|address|140008690|140008690|
|sig|undefined __fastcall DestroyEntry(longlong param_1, longlong param_2)|undefined __fastcall DestroyEntry(longlong param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

## WPP_SF_dD

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.94|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|WPP_SF_dD|WPP_SF_dD|
|fullname|WPP_SF_dD|WPP_SF_dD|
|`refcount`|69|72|
|length|71|71|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|`calling`|<details><summary>Expand for full list:<br>CheckAndAddNakRequests<br>CheckForTermination<br>ExtractNakNcfSequences<br>GetIpAddress<br>InitDataSpmHeader<br>InitDataSpmOptions<br>PgmAddMCastReceiveIf<br>PgmCreateConnection<br>PgmDelMCastReceiveIf<br>PgmHandleNewData<br>PgmIndicateGroup</summary>PgmProcessIncomingPacket<br>PgmQueryFecInfo<br>PgmQueryHighSpeedOptimization<br>PgmQueryLateJoinerPercentage<br>PgmQueryReceiverStats<br>PgmQuerySenderStats<br>PgmQueryTcpInfo<br>PgmQueryWindowAdvanceMethod<br>PgmQueryWindowAdvanceRate<br>PgmQueryWindowSizeAndSendRate<br>PgmSetFECInfo<br>PgmSetHighSpeedOptimization<br>PgmSetLateJoinerPercentage<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetRcvBufferLength<br>PgmSetTcpInfo<br>PgmSetWindowAdvanceMethod<br>PgmSetWindowAdvanceRate<br>PgmSetWindowSizeAndSendRate<br>ProcessDataPacket<br>ProcessOptions<br>ProcessSpmPacket<br>QueryAddressCompletion<br>ReceiverAddMCastIf<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SetSenderMCastOutIf<br>TdiAddressArrival<br>TdiRcvDatagramHandler</details>|<details><summary>Expand for full list:<br>AdvanceWindow<br>CheckAndAddNakRequests<br>CheckForTermination<br>ExtractNakNcfSequences<br>GetIpAddress<br>InitDataSpmHeader<br>InitDataSpmOptions<br>PgmAddMCastReceiveIf<br>PgmCreateConnection<br>PgmDelMCastReceiveIf<br>PgmHandleNewData</summary>PgmIndicateGroup<br>PgmProcessIncomingPacket<br>PgmQueryFecInfo<br>PgmQueryHighSpeedOptimization<br>PgmQueryLateJoinerPercentage<br>PgmQueryReceiverStats<br>PgmQuerySenderStats<br>PgmQueryTcpInfo<br>PgmQueryWindowAdvanceMethod<br>PgmQueryWindowAdvanceRate<br>PgmQueryWindowSizeAndSendRate<br>PgmSendRData<br>PgmSetFECInfo<br>PgmSetHighSpeedOptimization<br>PgmSetLateJoinerPercentage<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetRcvBufferLength<br>PgmSetTcpInfo<br>PgmSetWindowAdvanceMethod<br>PgmSetWindowAdvanceRate<br>PgmSetWindowSizeAndSendRate<br>ProcessDataPacket<br>ProcessOptions<br>ProcessSpmPacket<br>QueryAddressCompletion<br>ReceiverAddMCastIf<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SetSenderMCastOutIf<br>TdiAddressArrival<br>TdiRcvDatagramHandler</details>|
|paramcount|4|4|
|address|1400052f4|1400052f4|
|sig|undefined __fastcall WPP_SF_dD(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_dD(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_dD Calling Diff


```diff
--- WPP_SF_dD calling
+++ WPP_SF_dD calling
@@ -0,0 +1 @@
+AdvanceWindow
@@ -21,0 +23 @@
+PgmSendRData
```


## WPP_SF_D

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|0.92|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|WPP_SF_D|WPP_SF_D|
|fullname|WPP_SF_D|WPP_SF_D|
|`refcount`|101|102|
|length|58|58|
|called|_guard_dispatch_icall|_guard_dispatch_icall|
|calling|<details><summary>Expand for full list:<br>BuildPgmDataFileName<br>CheckForSessionTimeout<br>CheckForTermination<br>CheckIndicatePendedData<br>CleanupInit<br>CoalesceSelectiveNaksIntoGroups<br>DecodeParityPackets<br>DriverEntry<br>ExtractNakNcfSequences<br>FilterAndAddNaksToList<br>GetIpInterfaceInfoForDevice</summary>GetNextPacketOptionsAndData<br>InitDataSpmHeader<br>InitPgm<br>InitStaticPgmConfig<br>PgmAddMCastReceiveIf<br>PgmBuildParityPacket<br>PgmConnect<br>PgmCreateAddress<br>PgmCreateConnection<br>PgmCreateDataFileAndMapSection<br>PgmCreateDevice<br>PgmDereferenceDevice<br>PgmFipsInitialize<br>PgmHandleNewData<br>PgmIndicateToClient<br>PgmNewInboundConnection<br>PgmNewInboundConnectionOld<br>PgmOpenRegistryParameters<br>PgmQueryInformation<br>PgmReadRegistryParameters<br>PgmSendNak<br>PgmSendNakCompletion<br>PgmSendNcfCompletion<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient<br>PgmSendSpm<br>PgmSendSpmCompletion<br>PgmSetEventHandler<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetRcvBufferLength<br>PgmTdiOpenControl<br>ProcessOptions<br>ProcessSpmPacket<br>ReceiverProcessNakNcfPacket<br>SendNextPacket<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SetTdiHandlers<br>TdiAddressArrival<br>TdiErrorHandler<br>TdiOpenAddressHandle<br>TdiRcvDatagramHandler<br>TdiSendDatagram<br>TdiSetEventHandler</details>|<details><summary>Expand for full list:<br>BuildPgmDataFileName<br>CheckForSessionTimeout<br>CheckForTermination<br>CheckIndicatePendedData<br>CleanupInit<br>CoalesceSelectiveNaksIntoGroups<br>DecodeParityPackets<br>DriverEntry<br>ExtractNakNcfSequences<br>FilterAndAddNaksToList<br>GetIpInterfaceInfoForDevice</summary>GetNextPacketOptionsAndData<br>InitDataSpmHeader<br>InitPgm<br>InitStaticPgmConfig<br>PgmAddMCastReceiveIf<br>PgmBuildParityPacket<br>PgmConnect<br>PgmCreateAddress<br>PgmCreateConnection<br>PgmCreateDataFileAndMapSection<br>PgmCreateDevice<br>PgmDereferenceDevice<br>PgmFipsInitialize<br>PgmHandleNewData<br>PgmIndicateToClient<br>PgmNewInboundConnection<br>PgmNewInboundConnectionOld<br>PgmOpenRegistryParameters<br>PgmQueryInformation<br>PgmReadRegistryParameters<br>PgmSendNak<br>PgmSendNakCompletion<br>PgmSendNcfCompletion<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient<br>PgmSendSpm<br>PgmSendSpmCompletion<br>PgmSetEventHandler<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetRcvBufferLength<br>PgmTdiOpenControl<br>ProcessOptions<br>ProcessSpmPacket<br>ReceiverProcessNakNcfPacket<br>SendNextPacket<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SetTdiHandlers<br>TdiAddressArrival<br>TdiErrorHandler<br>TdiOpenAddressHandle<br>TdiRcvDatagramHandler<br>TdiSendDatagram<br>TdiSetEventHandler</details>|
|paramcount|4|4|
|address|1400052b0|1400052b0|
|sig|undefined __fastcall WPP_SF_D(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_D(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

## NTOSKRNL.EXE::ExFreeToNPagedLookasideList

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|ExFreeToNPagedLookasideList|ExFreeToNPagedLookasideList|
|fullname|NTOSKRNL.EXE::ExFreeToNPagedLookasideList|NTOSKRNL.EXE::ExFreeToNPagedLookasideList|
|`refcount`|20|25|
|length|0|0|
|called|||
|calling|<details><summary>Expand for full list:<br>AdvanceWindow<br>CheckForTermination<br>DestroyEntry<br>FreeDataBuffer<br>FreeNakContext<br>PgmCancelSendIrp<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient</summary>TdiSendDatagram<br>TdiSendDatagramCompletion</details>|<details><summary>Expand for full list:<br>AdvanceWindow<br>CheckForTermination<br>DestroyEntry<br>FreeDataBuffer<br>FreeNakContext<br>PgmCancelSendIrp<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient</summary>TdiSendDatagram<br>TdiSendDatagramCompletion</details>|
|paramcount|0|0|
|address|EXTERNAL:00000015|EXTERNAL:00000015|
|sig|undefined ExFreeToNPagedLookasideList(void)|undefined ExFreeToNPagedLookasideList(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

## NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc

### Match Info



|Key|rmcast-07.sys - rmcast-08.sys|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|rmcast-07.sys|rmcast-08.sys|
| :---: | :---: | :---: |
|name|KeAcquireSpinLockRaiseToDpc|KeAcquireSpinLockRaiseToDpc|
|fullname|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc|NTOSKRNL.EXE::KeAcquireSpinLockRaiseToDpc|
|`refcount`|165|166|
|length|0|0|
|called|||
|calling|<details><summary>Expand for full list:<br>CheckForTermination<br>CheckIndicateDisconnect<br>CheckSendPendingNaks<br>CleanupInit<br>CleanupPendingNaks<br>GetNextPacketOptionsAndData<br>ListenOnAllInterfaces<br>PgmAddMCastReceiveIf<br>PgmAssociateAddress<br>PgmCancelDisconnectIrp<br>PgmCancelReceiveIrp</summary>PgmCancelSendIrp<br>PgmCleanupAddress<br>PgmCleanupConnection<br>PgmCleanupSession<br>PgmCloseAddress<br>PgmConnect<br>PgmCreateAddress<br>PgmDelMCastReceiveIf<br>PgmDereferenceAddress<br>PgmDereferenceSessionCommon<br>PgmDisassociateAddress<br>PgmDisconnect<br>PgmExecuteWorker<br>PgmIndicateToClient<br>PgmNewInboundConnection<br>PgmNewInboundConnectionOld<br>PgmProcessIncomingPacket<br>PgmQueryFecInfo<br>PgmQueryHighSpeedOptimization<br>PgmQueryLateJoinerPercentage<br>PgmQueryReceiverStats<br>PgmQuerySenderStats<br>PgmQueryWindowAdvanceMethod<br>PgmQueryWindowAdvanceRate<br>PgmQueryWindowSizeAndSendRate<br>PgmQueueForDelayedExecution<br>PgmReceive<br>PgmSendNak<br>PgmSendNakCompletion<br>PgmSendNcf<br>PgmSendNcfCompletion<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient<br>PgmSendSpm<br>PgmSendSpmCompletion<br>PgmSetEventHandler<br>PgmSetFECInfo<br>PgmSetHighSpeedOptimization<br>PgmSetLateJoinerPercentage<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetWindowAdvanceMethod<br>PgmSetWindowAdvanceRate<br>PgmSetWindowSizeAndSendRate<br>ProcessDataPacket<br>ProcessSpmPacket<br>ReceiveTimerTimeout<br>ReceiverAddMCastIf<br>ReceiverProcessNakNcfPacket<br>SendNextPacket<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SenderWorkerThread<br>SetSenderMCastOutIf<br>StopListeningOnAllInterfacesExcept<br>StopListeningOnInterface<br>TdiAddressArrival<br>TdiAddressDeletion<br>TdiRcvDatagramHandler</details>|<details><summary>Expand for full list:<br>CheckForTermination<br>CheckIndicateDisconnect<br>CheckSendPendingNaks<br>CleanupInit<br>CleanupPendingNaks<br>GetNextPacketOptionsAndData<br>ListenOnAllInterfaces<br>PgmAddMCastReceiveIf<br>PgmAssociateAddress<br>PgmCancelDisconnectIrp<br>PgmCancelReceiveIrp</summary>PgmCancelSendIrp<br>PgmCleanupAddress<br>PgmCleanupConnection<br>PgmCleanupSession<br>PgmCloseAddress<br>PgmConnect<br>PgmCreateAddress<br>PgmDelMCastReceiveIf<br>PgmDereferenceAddress<br>PgmDereferenceSessionCommon<br>PgmDisassociateAddress<br>PgmDisconnect<br>PgmExecuteWorker<br>PgmIndicateToClient<br>PgmNewInboundConnection<br>PgmNewInboundConnectionOld<br>PgmProcessIncomingPacket<br>PgmQueryFecInfo<br>PgmQueryHighSpeedOptimization<br>PgmQueryLateJoinerPercentage<br>PgmQueryReceiverStats<br>PgmQuerySenderStats<br>PgmQueryWindowAdvanceMethod<br>PgmQueryWindowAdvanceRate<br>PgmQueryWindowSizeAndSendRate<br>PgmQueueForDelayedExecution<br>PgmReceive<br>PgmSendNak<br>PgmSendNakCompletion<br>PgmSendNcf<br>PgmSendNcfCompletion<br>PgmSendNextOData<br>PgmSendODataCompletion<br>PgmSendRData<br>PgmSendRDataCompletion<br>PgmSendRequestFromClient<br>PgmSendSpm<br>PgmSendSpmCompletion<br>PgmSetEventHandler<br>PgmSetFECInfo<br>PgmSetHighSpeedOptimization<br>PgmSetLateJoinerPercentage<br>PgmSetMCastOutIf<br>PgmSetMCastTtl<br>PgmSetNextMessageBoundary<br>PgmSetWindowAdvanceMethod<br>PgmSetWindowAdvanceRate<br>PgmSetWindowSizeAndSendRate<br>ProcessDataPacket<br>ProcessSpmPacket<br>ReceiveTimerTimeout<br>ReceiverAddMCastIf<br>ReceiverProcessNakNcfPacket<br>SendNextPacket<br>SendSessionTimeout<br>SenderProcessNakPacket<br>SenderWorkerThread<br>SetSenderMCastOutIf<br>StopListeningOnAllInterfacesExcept<br>StopListeningOnInterface<br>TdiAddressArrival<br>TdiAddressDeletion<br>TdiRcvDatagramHandler</details>|
|paramcount|0|0|
|address|EXTERNAL:00000057|EXTERNAL:00000057|
|sig|undefined KeAcquireSpinLockRaiseToDpc(void)|undefined KeAcquireSpinLockRaiseToDpc(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|



<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-26T22:47:10</sub>