# tapisrv-2024-10.dll-tapisrv-2024-11.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [FUN_180006084](#fun_180006084) * [FUN_18001f558](#fun_18001f558) * [FUN_18001f664](#fun_18001f664) * [FUN_18001f6dc](#fun_18001f6dc) * [FUN_18001f7d0](#fun_18001f7d0) * [FUN_18001f8cc](#fun_18001f8cc) * [FUN_18001fa48](#fun_18001fa48) * [FUN_18001facc](#fun_18001facc) * [FUN_18001fba8](#fun_18001fba8) * [FUN_18001fcb8](#fun_18001fcb8) * [FUN_18001fcfc](#fun_18001fcfc) * [FUN_18001fe4c](#fun_18001fe4c) * [FUN_18001fe84](#fun_18001fe84) * [FUN_18001ff0c](#fun_18001ff0c) * [KERNEL32.DLL::GetModuleHandleW](#kernel32dllgetmodulehandlew) * [Modified](#modified) * [FUN_18002a950](#fun_18002a950) * [FUN_18002a458](#fun_18002a458) * [FUN_180013fe0](#fun_180013fe0) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [USER32.DLL::LoadIconW](#user32dllloadiconw) * [__security_check_cookie](#__security_check_cookie) * [KERNEL32.DLL::GetProcAddress](#kernel32dllgetprocaddress) # Visual Chart Diff ```mermaid flowchart LR FUN_18002a950-3-old<--Match 79%-->FUN_18002b47c-3-new FUN_18002a458-4-old<--Match 84%-->FUN_18002af28-4-new FUN_180013fe0-4-old<--Match 63%-->FUN_180014010-4-new subgraph tapisrv-2024-11.dll FUN_18002b47c-3-new FUN_18002af28-4-new FUN_180014010-4-new subgraph Added direction LR FUN_180006084 FUN_18001f558 FUN_18001f664 FUN_18001f6dc FUN_18001f7d0 FUN_18001f8cc FUN_18001fa48 FUN_18001facc FUN_18001fba8 FUN_18001fcb8 FUN_18001fcfc FUN_18001fe4c FUN_18001fe84 FUN_18001ff0c KERNEL32DLL-GetModuleHandleW end end subgraph tapisrv-2024-10.dll FUN_18002a950-3-old FUN_18002a458-4-old FUN_180013fe0-4-old end ``` ```mermaid pie showData title Function Matches - 98.9817% "unmatched_funcs_len" : 15 "matched_funcs_len" : 1458 ``` ```mermaid pie showData title Matched Function Similarity - 99.4513% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 5 "matched_funcs_no_changes_len" : 1450 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --no-symbols --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 tapisrv-2024-10.dll tapisrv-2024-11.dll ``` #### Verbose Args
``` --old ['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-10.dll'] --new [['/sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-11.dll']] --engine VersionTrackingDiff --output-path /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/CVE-2024-43626 --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols True --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/59BD51D052000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.22621.4440 wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/0694834753000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.22621.1420 ``` ## Binary Metadata Diff ```diff --- tapisrv-2024-10.dll Meta +++ tapisrv-2024-11.dll Meta @@ -1,43 +1,43 @@ -Program Name: tapisrv-2024-10.dll +Program Name: tapisrv-2024-11.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 342096 +# of Bytes: 346192 # of Memory Blocks: 9 -# of Instructions: 55379 -# of Defined Data: 3159 -# of Functions: 729 -# of Symbols: 7796 +# of Instructions: 56198 +# of Defined Data: 3193 +# of Functions: 744 +# of Symbols: 7898 # of Data Types: 592 # of Data Type Categories: 33 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Jul 26 18:38:32 SGT 2026 +Date Created: Sun Jul 26 18:38:35 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-10.dll -Executable MD5: dab09a31175fd71d6c03667f67bbe1dc -Executable SHA256: 21d08102e15b5044bc962276df80e69f22ca761a2cae316db1d096d76e1b2c17 -FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-10.dll?MD5=dab09a31175fd71d6c03667f67bbe1dc +Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-11.dll +Executable MD5: 1b616cdfda409d61493a165b93434c9e +Executable SHA256: e0a430da166b711733c7ad2035df13c1c53fdbf400b80f78462d92c00f23f87a +FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/static/data/patch_diffs/binaries/tapisrv-2024-11.dll?MD5=1b616cdfda409d61493a165b93434c9e PDB Age: 1 PDB File: tapisrv.pdb -PDB GUID: caea2e27-8fdc-5842-b8c7-5eea3383d5d5 +PDB GUID: 05ea4bc7-b875-1f4a-569f-ed689843a793 PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft® Windows(TM) Telephony Server -PE Property[FileVersion]: 10.0.22621.4440 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.22621.1420 (WinBuild.160101.0800) PE Property[InternalName]: Telephony Service PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: TAPISRV.EXE PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.22621.4440 +PE Property[ProductVersion]: 10.0.22621.1420 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra tapisrv-2024-10.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra tapisrv-2024-10.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra tapisrv-2024-10.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|false| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra tapisrv-2024-11.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra tapisrv-2024-11.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra tapisrv-2024-11.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|false| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|15| |deleted_funcs_len|0| |modified_funcs_len|8| |added_symbols_len|2| |deleted_symbols_len|0| |diff_time|6.367840766906738| |deleted_strings_len|0| |added_strings_len|3| |match_types|Counter({'ExactInstructionsFunctionHasher': 369, 'SymbolsHash': 260, 'ExternalsName': 197, 'StructuralGraphHash': 127, 'ExactBytesFunctionHasher': 36, 'BSIM': 7})| |items_to_process|25| |diff_types|Counter({'address': 7, 'calling': 6, 'refcount': 5, 'name': 4, 'fullname': 4, 'sig': 4, 'code': 3, 'length': 3, 'called': 3})| |unmatched_funcs_len|15| |total_funcs_len|1473| |matched_funcs_len|1458| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|5| |matched_funcs_no_changes_len|1450| |match_func_similarity_percent|99.4513%| |func_match_overall_percent|98.9817%| |first_matches|Counter({'ExactInstructionsFunctionHasher': 369, 'SymbolsHash': 260, 'StructuralGraphHash': 127, 'ExactBytesFunctionHasher': 36, 'BSIM': 5})| ```mermaid pie showData title All Matches "SymbolsHash" : 260 "ExternalsName" : 197 "BSIM" : 7 "ExactBytesFunctionHasher" : 36 "ExactInstructionsFunctionHasher" : 369 "StructuralGraphHash" : 127 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 260 "ExactBytesFunctionHasher" : 36 "ExactInstructionsFunctionHasher" : 369 "BSIM" : 5 "StructuralGraphHash" : 127 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 15 "deleted_funcs_len" : 0 "modified_funcs_len" : 8 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 2 "deleted_symbols_len" : 0 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 0 "added_strings_len" : 3 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -0,0 +1,3 @@ +s_RtlNotifyFeatureUsage +s_RtlQueryFeatureConfiguration +u_ntdll.dll ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_RtlQueryFeatureConfiguration_18003ef48|1|FUN_18001f558| |s_RtlNotifyFeatureUsage_18003ef68|1|FUN_18001f664| |u_ntdll.dll_18003ef30|1|FUN_18001fe4c| # Deleted # Added ## FUN_180006084 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_180006084| |fullname|FUN_180006084| |refcount|7| |length|38| |called|FUN_18001fe84| |calling|FUN_180014010
FUN_18002af28
FUN_18002b47c| |paramcount|3| |address|180006084| |sig|uint __fastcall FUN_180006084(undefined8 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_180006084 +++ FUN_180006084 @@ -0,0 +1,14 @@ + +uint FUN_180006084(undefined8 param_1,undefined8 param_2,undefined8 param_3) + +{ + uint uVar1; + undefined4 uStackX_c; + + if ((DAT_18004df20 & 0x10) != 0) { + return DAT_18004df20 & 1; + } + uVar1 = FUN_18001fe84((undefined4 *)CONCAT44(uStackX_c,DAT_18004df20),3,param_3); + return uVar1; +} + ``` ## FUN_18001f558 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001f558| |fullname|FUN_18001f558| |refcount|2| |length|259| |called|FUN_18001fe4c
KERNEL32.DLL::GetProcAddress
__security_check_cookie
_guard_dispatch_icall| |calling|FUN_18001fcfc| |paramcount|3| |address|18001f558| |sig|undefined4 __fastcall FUN_18001f558(uint * param_1, undefined4 param_2, int param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001f558 +++ FUN_18001f558 @@ -0,0 +1,44 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ +/* WARNING: Exceeded maximum restarts with more pending */ + +undefined4 FUN_18001f558(uint *param_1,undefined4 param_2,int param_3) + +{ + int iVar1; + HMODULE hModule; + undefined1 auStack_68 [48]; + undefined1 local_38 [8]; + undefined8 local_30; + uint local_28; + ulonglong local_20; + + local_20 = DAT_18004d008 ^ (ulonglong)auStack_68; + local_30 = 0; + local_28 = 0; + if (DAT_18004d778 == (FARPROC)0x0) { + hModule = (HMODULE)FUN_18001fe4c(); + DAT_18004d778 = GetProcAddress(hModule,"RtlQueryFeatureConfiguration"); + if (DAT_18004d778 == (FARPROC)0x0) { + return 0; + } + } + iVar1 = (*DAT_18004d778)(param_2,param_3 == 0,local_38,&local_30); + if (iVar1 == 0) { + *param_1 = local_30._4_4_ >> 4 & 3; + *(byte *)(param_1 + 1) = (byte)((ulonglong)local_30 >> 0x28) & 0x3f; + param_1[3] = local_28; + param_1[2] = local_30._4_4_ >> 0xe & 3; + param_1[5] = local_30._4_4_ >> 6 & 1; + param_1[4] = local_30._4_4_ >> 7 & 1; + } + else { + if (iVar1 != 0x117) { + return 0; + } + param_1[4] = local_30._4_4_ >> 7 & 1; + } + return 1; +} + ``` ## FUN_18001f664 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001f664| |fullname|FUN_18001f664| |refcount|2| |length|113| |called|FUN_18001fe4c
KERNEL32.DLL::GetProcAddress
_guard_dispatch_icall| |calling|FUN_18001facc| |paramcount|3| |address|18001f664| |sig|undefined8 __fastcall FUN_18001f664(undefined4 param_1, undefined2 param_2, int param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001f664 +++ FUN_18001f664 @@ -0,0 +1,29 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Exceeded maximum restarts with more pending */ + +undefined8 FUN_18001f664(undefined4 param_1,undefined2 param_2,int param_3) + +{ + uint6 uVar1; + HMODULE hModule; + undefined8 uVar2; + undefined8 local_res20; + + local_res20._0_6_ = CONCAT24(param_2,param_1); + uVar1 = (uint6)local_res20; + local_res20 = (ulonglong)(uint6)local_res20; + if (param_3 != 0) { + local_res20 = CONCAT26(1,uVar1); + } + if (DAT_18004d770 == (FARPROC)0x0) { + hModule = (HMODULE)FUN_18001fe4c(); + DAT_18004d770 = GetProcAddress(hModule,"RtlNotifyFeatureUsage"); + if (DAT_18004d770 == (FARPROC)0x0) { + return 0xc0000139; + } + } + uVar2 = (*DAT_18004d770)(&local_res20); + return uVar2; +} + ``` ## FUN_18001f6dc ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001f6dc| |fullname|FUN_18001f6dc| |refcount|2| |length|237| |called|| |calling|FUN_18001f8cc| |paramcount|4| |address|18001f6dc| |sig|undefined __fastcall FUN_18001f6dc(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001f6dc +++ FUN_18001f6dc @@ -0,0 +1,53 @@ + +void FUN_18001f6dc(uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar3 = *param_1; + do { + uVar1 = uVar3; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { + uVar3 = (uVar1 & 0x3f8000) >> 0xf; + if (uVar3 != 0) { + param_4[1] = uVar3; + uVar3 = 5; + if (param_2 != 1) { + uVar3 = 1; + } + uVar2 = uVar1 & 0xffc07fff | 1; + param_4[2] = uVar3; + } + uVar3 = 0; + if (param_2 == 5) { + uVar3 = 0x400000; + } + uVar2 = uVar3 | uVar2 & 0xffbfffff; + } + uVar3 = uVar2 >> 0xf & 0x7f; + uVar4 = uVar3 + 1; + if ((0x7f < uVar4) || (uVar4 < (uVar2 >> 0xf & 0x7f))) { + uVar4 = 1; + param_4[2] = param_2; + param_4[1] = uVar3; + } + LOCK(); + uVar3 = *param_1; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *param_1 = uVar2 ^ (uVar4 << 0xf ^ uVar2) & 0x3f8000; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## FUN_18001f7d0 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001f7d0| |fullname|FUN_18001f7d0| |refcount|2| |length|245| |called|| |calling|FUN_18001f8cc| |paramcount|4| |address|18001f7d0| |sig|undefined __fastcall FUN_18001f7d0(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001f7d0 +++ FUN_18001f7d0 @@ -0,0 +1,49 @@ + +void FUN_18001f7d0(uint *param_1,uint param_2,undefined8 param_3,uint *param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + bool bVar5; + + uVar4 = *param_1; + do { + uVar1 = uVar4; + param_4[1] = 0; + uVar2 = uVar1 | 1; + if ((uVar1 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { + uVar4 = (uVar1 & 0x3fe0) >> 5; + if (uVar4 != 0) { + param_4[1] = uVar4; + param_4[2] = ~-(uint)(param_2 != 0) & 4; + uVar2 = uVar1 & 0xffffc01f | 1; + } + uVar4 = 0; + if (param_2 == 4) { + uVar4 = 0x4000; + } + uVar2 = uVar4 | uVar2 & 0xffffbfff; + } + uVar4 = uVar2 >> 5 & 0x1ff; + uVar3 = uVar4 + 1; + if ((0x1ff < uVar3) || (uVar3 < (uVar2 >> 5 & 0x1ff))) { + uVar3 = 1; + param_4[2] = param_2; + param_4[1] = uVar4; + } + LOCK(); + uVar4 = *param_1; + bVar5 = uVar1 == uVar4; + if (bVar5) { + *param_1 = uVar2 ^ (uVar3 << 5 ^ uVar2) & 0x3fe0; + uVar4 = uVar1; + } + UNLOCK(); + } while (!bVar5); + param_4[4] = 0; + *param_4 = ~uVar1 & 1; + return; +} + ``` ## FUN_18001f8cc ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001f8cc| |fullname|FUN_18001f8cc| |refcount|2| |length|372| |called|FUN_18001f6dc
FUN_18001f7d0| |calling|FUN_18001facc| |paramcount|4| |address|18001f8cc| |sig|uint * __fastcall FUN_18001f8cc(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001f8cc +++ FUN_18001f8cc @@ -0,0 +1,97 @@ + +uint * FUN_18001f8cc(uint *param_1,uint *param_2,undefined8 param_3,uint param_4) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint uVar5; + bool bVar6; + + uVar3 = (uint)param_3; + param_1[0] = 0; + param_1[1] = 0; + param_1[2] = 0; + param_1[3] = 0; + param_1[4] = 0; + param_1[5] = 0; + if (uVar3 == 0) { +LAB_18001fa1f: + FUN_18001f7d0(param_2,uVar3,param_3,param_1); + } + else { + if (uVar3 == 1) { +LAB_18001fa0f: + FUN_18001f6dc(param_2,uVar3,param_3,param_1); + return param_1; + } + if ((uVar3 != 2) && (uVar3 != 3)) { + if (uVar3 == 4) goto LAB_18001fa1f; + if (uVar3 == 5) goto LAB_18001fa0f; + if ((uVar3 != 6) && (uVar3 != 7)) { + uVar5 = uVar3 - 0x140; + if (uVar5 < 0x40) { + uVar4 = param_2[1]; + do { + if (((uVar4 & 0x10) == 0) || (uVar2 = 1, (uVar4 >> 5 & 0x3f) != uVar5)) { + uVar2 = 0; + } + param_1[4] = uVar2; + LOCK(); + uVar2 = param_2[1]; + bVar6 = uVar4 == uVar2; + if (bVar6) { + param_2[1] = uVar4 & 0xfffff81f | (uVar5 & 0x3f) << 5 | 0x10; + uVar2 = uVar4; + } + uVar4 = uVar2; + UNLOCK(); + } while (!bVar6); + } + param_1[2] = uVar3; + param_1[1] = 1; + param_1[3] = param_4; + return param_1; + } + } + uVar5 = 0; + if (uVar3 == 2) { + uVar5 = 2; + } + else if (uVar3 == 3) { + uVar5 = 8; + } + else if (uVar3 == 6) { + uVar5 = 4; + } + else if (uVar3 == 7) { + uVar5 = 0x10; + } + uVar4 = 1; + uVar3 = *param_2; + do { + uVar1 = uVar3; + uVar3 = uVar5 | uVar1; + param_1[4] = (uint)(uVar3 == uVar1); + uVar2 = uVar3 | 1; + if (uVar3 == uVar1) { + uVar2 = uVar3; + } + LOCK(); + uVar3 = *param_2; + bVar6 = uVar1 == uVar3; + if (bVar6) { + *param_2 = uVar2; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar6); + if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { + uVar4 = 0; + } + *param_1 = uVar4; + } + return param_1; +} + ``` ## FUN_18001fa48 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fa48| |fullname|FUN_18001fa48| |refcount|2| |length|125| |called|FUN_18001facc
FUN_18001ff0c
_guard_dispatch_icall| |calling|FUN_18001fe84| |paramcount|3| |address|18001fa48| |sig|undefined __fastcall FUN_18001fa48(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fa48 +++ FUN_18001fa48 @@ -0,0 +1,24 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +void FUN_18001fa48(undefined8 param_1,undefined8 param_2,uint param_3) + +{ + bool bVar1; + uint uVar2; + undefined7 extraout_var; + ulonglong uVar3; + uint uVar4; + uint local_res18 [4]; + + uVar4 = (uint)param_2 & 1; + uVar3 = (ulonglong)param_3; + local_res18[0] = param_3; + uVar2 = FUN_18001ff0c(param_3,uVar4); + bVar1 = FUN_18001facc(uVar3,param_2,(ulonglong)uVar2); + if (((int)CONCAT71(extraout_var,bVar1) != 0) && (DAT_18004d7c0 != 0)) { + (*(code *)DAT_18004d7c0)(0x31de9c8,&DAT_180042084,0,uVar4,local_res18,0,0,1); + } + return; +} + ``` ## FUN_18001facc ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001facc| |fullname|FUN_18001facc| |refcount|2| |length|213| |called|FUN_18001f664
FUN_18001f8cc
__security_check_cookie
_guard_dispatch_icall| |calling|FUN_18001fa48| |paramcount|3| |address|18001facc| |sig|bool __fastcall FUN_18001facc(undefined8 param_1, undefined8 param_2, ulonglong param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001facc +++ FUN_18001facc @@ -0,0 +1,36 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ +/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ + +bool FUN_18001facc(undefined8 param_1,undefined8 param_2,ulonglong param_3) + +{ + uint *puVar1; + undefined1 auStack_78 [32]; + uint *local_58; + uint local_48 [6]; + uint local_30; + uint uStack_2c; + uint uStack_28; + uint uStack_24; + undefined8 local_20; + ulonglong local_18; + + local_18 = DAT_18004d008 ^ (ulonglong)auStack_78; + puVar1 = FUN_18001f8cc(local_48,(uint *)&DAT_18004d788,param_3,(uint)((ulonglong)param_2 >> 0x20)) + ; + local_30 = *puVar1; + uStack_2c = puVar1[1]; + uStack_28 = puVar1[2]; + uStack_24 = puVar1[3]; + local_20 = *(undefined8 *)(puVar1 + 4); + if (DAT_18004d7b0 != 0) { + local_58 = &local_30; + (*(code *)DAT_18004d7b0)(0x31de9c8,param_3 & 0xffffffff,1,&DAT_18004d788); + } + if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { + FUN_18001f664(0x31de9c8,(short)(param_3 & 0xffffffff),(uint)param_2 >> 0xb & 1); + } + return (int)local_20 == 0; +} + ``` ## FUN_18001fba8 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fba8| |fullname|FUN_18001fba8| |refcount|3| |length|265| |called|FUN_18001fcfc
_guard_dispatch_icall| |calling|FUN_18001fcfc
FUN_18001fe84| |paramcount|3| |address|18001fba8| |sig|ulonglong __fastcall FUN_18001fba8(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fba8 +++ FUN_18001fba8 @@ -0,0 +1,63 @@ + +/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */ + +ulonglong FUN_18001fba8(uint *param_1,ulonglong param_2,longlong param_3) + +{ + int iVar1; + uint uVar2; + ulonglong uVar3; + uint uVar4; + uint uVar5; + ulonglong uVar6; + bool bVar7; + uint local_res8 [2]; + undefined8 local_res10; + + iVar1 = 0; + local_res10 = param_2; + if (DAT_18004d7b8 != 0) { + iVar1 = (*(code *)DAT_18004d7b8)(); + } + uVar2 = FUN_18001fcfc(param_3,local_res8); + if (*(char *)(param_3 + 0x1c) == '\0') { + local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); + } + uVar3 = param_2 & 0xffffffff; + do { + uVar6 = param_2; + uVar5 = (uint)uVar3; + local_res10 = CONCAT44(local_res10._4_4_,uVar5); + if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0)) + { + uVar4 = (uVar5 ^ uVar2) & 0x9c1 ^ uVar5; + uVar5 = uVar4 | 2; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; + } + if ((uVar6 & 4) == 0) { + uVar4 = uVar5 ^ (uVar2 ^ uVar5) & 0x400; + uVar5 = uVar4 | 4; + local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; + } + uVar3 = uVar6 & 0xffffffff; + LOCK(); + uVar4 = *param_1; + bVar7 = (uint)uVar6 == uVar4; + if (bVar7) { + *param_1 = uVar5; + } + else { + uVar3 = (ulonglong)uVar4; + } + UNLOCK(); + param_2 = uVar3; + } while (!bVar7); + if (((uVar6 & 4) == 0) && (DAT_18004d790 != 0)) { + (*(code *)DAT_18004d790)(param_1,*(undefined1 *)(param_3 + 0x1c),iVar1); + } + if (local_res8[0] == 0) { + local_res10 = CONCAT44(local_res10._4_4_,uVar5 ^ (uVar2 ^ uVar5) & 0x9c1); + } + return local_res10; +} + ``` ## FUN_18001fcb8 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fcb8| |fullname|FUN_18001fcb8| |refcount|1| |length|58| |called|| |calling|FUN_18001fe84| |paramcount|2| |address|18001fcb8| |sig|undefined __fastcall FUN_18001fcb8(uint param_1, int param_2)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fcb8 +++ FUN_18001fcb8 @@ -0,0 +1,40 @@ + +void FUN_18001fcb8(uint param_1,int param_2) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + bool bVar4; + + uVar2 = DAT_18004df20; + if (param_2 == 3) { + uVar3 = 0x10; + } + else { + if (param_2 != 4) { + return; + } + uVar3 = 0x20; + } + while( true ) { + if ((uVar2 & 2) == 0) { + return; + } + if (((uVar2 ^ param_1) & 1) != 0) break; + LOCK(); + bVar4 = uVar2 != DAT_18004df20; + uVar1 = uVar2 | uVar3; + if (bVar4) { + uVar2 = DAT_18004df20; + uVar1 = DAT_18004df20; + } + DAT_18004df20 = uVar1; + UNLOCK(); + if (!bVar4) { + return; + } + } + return; +} + ``` ## FUN_18001fcfc ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fcfc| |fullname|FUN_18001fcfc| |refcount|2| |length|326| |called|FUN_18001f558
FUN_18001fba8| |calling|FUN_18001fba8| |paramcount|2| |address|18001fcfc| |sig|uint __fastcall FUN_18001fcfc(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fcfc +++ FUN_18001fcfc @@ -0,0 +1,65 @@ + +uint FUN_18001fcfc(longlong param_1,undefined4 *param_2) + +{ + char cVar1; + undefined8 *puVar2; + int iVar3; + ulonglong uVar4; + uint uVar5; + uint uVar6; + longlong *plVar7; + uint local_res8; + undefined4 uStackX_14; + uint local_28 [8]; + + cVar1 = *(char *)(param_1 + 0x1c); + *param_2 = 1; + local_28[4] = 0; + local_28[5] = 0; + local_28[0] = 0; + local_28[1] = 0; + local_28[2] = 0; + local_28[3] = 0; + iVar3 = FUN_18001f558(local_28,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2)); + uVar6 = -(uint)(iVar3 != 0) & local_28[0] & 3; + if (uVar6 == 0) { + uVar5 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; + } + else { + uVar5 = 0; + if (local_28[0] == 2) { + uVar5 = 0x40; + } + } + local_res8 = uVar5 >> 6 | + uVar5 | uVar6 << 7 | + -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400; + if ((uVar5 >> 6 != 0) && (plVar7 = *(longlong **)(param_1 + 0x20), plVar7 != (longlong *)0x0)) { + for (; ((local_res8 & 1) != 0 && (puVar2 = (undefined8 *)*plVar7, puVar2 != (undefined8 *)0x0)); + plVar7 = plVar7 + 1) { + if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && + (*(char *)((longlong)puVar2 + 0x1d) == '\0')) { + uVar5 = *(uint *)*puVar2; + if ((uVar5 & 2) == 0) { + uVar4 = FUN_18001fba8((uint *)*puVar2,CONCAT44(uStackX_14,uVar5),(longlong)puVar2); + uVar5 = (uint)uVar4; + } + uVar6 = local_res8 & 0xfffffffe; + local_res8 = (uint)((uVar5 & local_res8 & 1) != 0); + } + else { + if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { + uVar6 = 0; + } + else { + uVar6 = 1; + } + local_res8 = local_res8 & 0xfffffffe; + } + local_res8 = local_res8 | uVar6; + } + } + return local_res8; +} + ``` ## FUN_18001fe4c ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fe4c| |fullname|FUN_18001fe4c| |refcount|3| |length|47| |called|KERNEL32.DLL::GetModuleHandleW| |calling|FUN_18001f558
FUN_18001f664| |paramcount|0| |address|18001fe4c| |sig|undefined __fastcall FUN_18001fe4c(void)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fe4c +++ FUN_18001fe4c @@ -0,0 +1,10 @@ + +void FUN_18001fe4c(void) + +{ + if (DAT_18004d798 == (HMODULE)0x0) { + DAT_18004d798 = GetModuleHandleW(L"ntdll.dll"); + } + return; +} + ``` ## FUN_18001fe84 ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001fe84| |fullname|FUN_18001fe84| |refcount|2| |length|129| |called|FUN_18001fa48
FUN_18001fba8
FUN_18001fcb8| |calling|FUN_180006084| |paramcount|3| |address|18001fe84| |sig|uint __fastcall FUN_18001fe84(undefined4 * param_1, uint param_2, undefined8 param_3)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001fe84 +++ FUN_18001fe84 @@ -0,0 +1,22 @@ + +uint FUN_18001fe84(undefined4 *param_1,uint param_2,undefined8 param_3) + +{ + uint uVar1; + undefined4 *puVar2; + undefined8 local_res18; + + uVar1 = (uint)param_1; + local_res18 = CONCAT44((int)((ulonglong)param_3 >> 0x20),uVar1); + if (((ulonglong)param_1 & 2) == 0) { + puVar2 = &DAT_18004df20; + local_res18 = FUN_18001fba8(&DAT_18004df20,(ulonglong)param_1,0x18004a868); + param_1 = puVar2; + uVar1 = (uint)local_res18; + } + if ((param_2 != 0) && (FUN_18001fa48(param_1,local_res18,param_2), param_2 - 3 < 2)) { + FUN_18001fcb8((uint)local_res18,param_2); + } + return uVar1 & 1; +} + ``` ## FUN_18001ff0c ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|FUN_18001ff0c| |fullname|FUN_18001ff0c| |refcount|1| |length|144| |called|| |calling|FUN_18001fa48| |paramcount|2| |address|18001ff0c| |sig|uint __fastcall FUN_18001ff0c(int param_1, int param_2)| |sym_type|Function| |sym_source|DEFAULT| |external|False| ```diff --- FUN_18001ff0c +++ FUN_18001ff0c @@ -0,0 +1,33 @@ + +uint FUN_18001ff0c(int param_1,int param_2) + +{ + byte bVar1; + + if (param_1 != 0) { + if (param_1 == 1) { + return ~-(uint)(param_2 != 0) & 4; + } + if (param_1 == 2) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; + } + if (param_1 == 3) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; + } + if (param_1 == 4) { + return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; + } + if (param_1 == 5) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; + } + if (param_1 == 6) { + return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; + } + bVar1 = (char)param_1 + 0x9c; + if (bVar1 < 0x32) { + return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; + } + } + return 0xff; +} + ``` ## KERNEL32.DLL::GetModuleHandleW ### Function Meta |Key|tapisrv-2024-11.dll| | :---: | :---: | |name|GetModuleHandleW| |fullname|KERNEL32.DLL::GetModuleHandleW| |refcount|2| |length|0| |called|| |calling|FUN_18001fe4c| |paramcount|1| |address|EXTERNAL:0000003c| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function| |sym_source|IMPORTED| |external|True| *No code available for KERNEL32.DLL::GetModuleHandleW* # Modified *Modified functions contain code changes* ## FUN_18002a950 ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling,called| |ratio|0.36| |i_ratio|0.54| |m_ratio|0.84| |b_ratio|0.79| |match_types|BSIM| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |`name`|FUN_18002a950|FUN_18002b47c| |`fullname`|FUN_18002a950|FUN_18002b47c| |refcount|3|3| |`length`|258|349| |`called`|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
FUN_180039a04
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
FUN_180006084
FUN_18002db3c
FUN_18003a584
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr| |`calling`|FUN_180026ba0
FUN_18002aa5c|FUN_180027670
FUN_18002b5e0| |paramcount|3|3| |`address`|18002a950|18002b47c| |`sig`|undefined __fastcall FUN_18002a950(HKEY param_1, LPCWSTR param_2, undefined8 * param_3)|undefined __fastcall FUN_18002b47c(HKEY param_1, LPCWSTR param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_18002a950 Called Diff ```diff --- FUN_18002a950 called +++ FUN_18002b47c called @@ -2 +2,3 @@ -FUN_180039a04 +FUN_180006084 +FUN_18002db3c +FUN_18003a584 ``` ### FUN_18002a950 Calling Diff ```diff --- FUN_18002a950 calling +++ FUN_18002b47c calling @@ -1,2 +1,2 @@ -FUN_180026ba0 -FUN_18002aa5c +FUN_180027670 +FUN_18002b5e0 ``` ### FUN_18002a950 Diff ```diff --- FUN_18002a950 +++ FUN_18002b47c @@ -1,36 +1,60 @@ -void FUN_18002a950(HKEY param_1,LPCWSTR param_2,undefined8 *param_3) +void FUN_18002b47c(HKEY param_1,LPCWSTR param_2,undefined8 *param_3) { LSTATUS LVar1; + uint uVar2; wchar_t *_Str; + HKEY pHVar3; + LPCWSTR pWVar4; + undefined8 uVar5; LPDWORD lpType; - DWORD local_res18 [2]; + uint local_res18 [2]; DWORD local_res20 [2]; *param_3 = 0; lpType = local_res20; + uVar5 = 0; + pHVar3 = param_1; + pWVar4 = param_2; LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,lpType,(LPBYTE)0x0,local_res18); - if ((LVar1 == 0) && (local_res18[0] != 0)) { - _Str = HeapAlloc(DAT_0,8,(ulonglong)(local_res18[0] + 2)); - if (_Str == (wchar_t *)0x0) { - *param_3 = 0; + if ((LVar1 != 0) || (local_res18[0] == 0)) { + *param_3 = 0; + FUN_18003a584(0x40002,"PriList: %ls=NULL",param_2,lpType); + return; + } + uVar2 = FUN_180006084(pHVar3,pWVar4,uVar5); + if ((uVar2 != 0) && (local_res18[0] + 2 < local_res18[0])) { + return; + } + _Str = HeapAlloc(DAT_0,8,(ulonglong)(local_res18[0] + 2)); + if (_Str == (wchar_t *)0x0) { + *param_3 = 0; + return; + } + *_Str = L'\"'; + uVar5 = 0; + pWVar4 = param_2; + LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,local_res20,(LPBYTE)(_Str + 1),local_res18); + if (LVar1 == 0) { + uVar2 = FUN_180006084(param_1,pWVar4,uVar5); + if (uVar2 != 0) { + if (local_res18[0] < 2) goto LAB_1; + *(undefined2 *)((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) = 0 + ; } - else { - *_Str = L'\"'; - LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,local_res20,(LPBYTE)(_Str + 1), - local_res18); - if (LVar1 == 0) { - _wcsupr(_Str); - *param_3 = _Str; - FUN_180039a04(0x40002,"PriList: %ls=%ls",param_2,_Str); - } - } + _wcsupr(_Str); + *param_3 = _Str; + FUN_18003a584(0x40002,"PriList: %ls=%ls",param_2,_Str); } else { - *param_3 = 0; - FUN_180039a04(0x40002,"PriList: %ls=NULL",param_2,lpType); + uVar2 = FUN_180006084(param_1,pWVar4,uVar5); + if (uVar2 == 0) { + return; + } +LAB_1: + FUN_18002db3c(_Str); } return; } ``` ## FUN_18002a458 ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,calling,called| |ratio|0.57| |i_ratio|0.44| |m_ratio|0.91| |b_ratio|0.84| |match_types|BSIM| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |`name`|FUN_18002a458|FUN_18002af28| |`fullname`|FUN_18002a458|FUN_18002af28| |refcount|2|2| |`length`|579|670| |`called`|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegEnumValueW
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
FUN_18002cfbc
FUN_180039a04
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::_wtol
MSVCRT.DLL::memcpy|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegEnumValueW
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
FUN_180006084
FUN_18002db3c
FUN_18003a584
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::_wtol
MSVCRT.DLL::memcpy| |`calling`|FUN_180026ba0|FUN_180027670| |paramcount|4|4| |`address`|18002a458|18002af28| |`sig`|undefined __fastcall FUN_18002a458(HKEY param_1, longlong * param_2, undefined8 param_3, wchar_t * param_4)|undefined __fastcall FUN_18002af28(HKEY param_1, longlong * param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_18002a458 Called Diff ```diff --- FUN_18002a458 called +++ FUN_18002af28 called @@ -3,2 +3,3 @@ -FUN_18002cfbc -FUN_180039a04 +FUN_180006084 +FUN_18002db3c +FUN_18003a584 ``` ### FUN_18002a458 Calling Diff ```diff --- FUN_18002a458 calling +++ FUN_18002af28 calling @@ -1 +1 @@ -FUN_180026ba0 +FUN_180027670 ``` ### FUN_18002a458 Diff ```diff --- FUN_18002a458 +++ FUN_18002af28 @@ -1,75 +1,97 @@ -void FUN_18002a458(HKEY param_1,longlong *param_2,undefined8 param_3,wchar_t *param_4) +void FUN_18002af28(HKEY param_1,longlong *param_2,undefined8 param_3,wchar_t *param_4) { LSTATUS LVar1; long lVar2; + uint uVar3; LPWSTR lpValueName; LPVOID _Dst; wchar_t *_Str; - char *pcVar3; - ulonglong uVar4; + HKEY pHVar4; + LPWSTR pWVar5; + char *pcVar6; + ulonglong uVar7; LPWSTR dwBytes; - DWORD local_res18 [2]; + uint local_res18 [2]; DWORD local_res20 [2]; wchar_t local_38 [8]; - local_res18[0] = 0x14; + local_res20[0] = 0x14; dwBytes = (LPWSTR)0x28; lpValueName = HeapAlloc(DAT_0,8,0x28); + uVar7 = 0; if (lpValueName != (LPWSTR)0x0) { - uVar4 = 0; - for (; DAT_1 != DAT_18004cd64; DAT_1 = DAT_1 + 1) { + for (; DAT_1 != DAT_18004dda4; DAT_1 = DAT_1 + 1) { LAB_2: - local_res18[0] = 0x14; - LVar1 = RegEnumValueW(param_1,(DWORD)uVar4,lpValueName,local_res18,(LPDWORD)0x0,(LPDWORD)0x0, + local_res20[0] = 0x14; + LVar1 = RegEnumValueW(param_1,(DWORD)uVar7,lpValueName,local_res20,(LPDWORD)0x0,(LPDWORD)0x0, (LPBYTE)0x0,(LPDWORD)0x0); if (LVar1 != 0) goto LAB_3; lVar2 = _wtol(lpValueName); param_4 = local_38; dwBytes = (LPWSTR)0x0; - *(long *)(*param_2 + uVar4 * 0x10) = lVar2; + *(long *)(*param_2 + uVar7 * 0x10) = lVar2; + pHVar4 = param_1; + pWVar5 = lpValueName; LVar1 = RegQueryValueExW(param_1,lpValueName,(LPDWORD)0x0,(LPDWORD)param_4,(LPBYTE)0x0, - local_res20); - if ((LVar1 == 0) && (local_res20[0] != 0)) { - dwBytes = (LPWSTR)(ulonglong)(local_res20[0] + 2); + local_res18); + if (((LVar1 == 0) && (local_res18[0] != 0)) && + ((uVar3 = FUN_180006084(pHVar4,pWVar5,dwBytes), uVar3 == 0 || + (local_res18[0] <= local_res18[0] + 2)))) { + dwBytes = (LPWSTR)(ulonglong)(local_res18[0] + 2); _Str = HeapAlloc(DAT_0,8,(SIZE_T)dwBytes); if (_Str != (wchar_t *)0x0) { *_Str = L'\"'; param_4 = local_38; dwBytes = (LPWSTR)0x0; + pHVar4 = param_1; + pWVar5 = lpValueName; LVar1 = RegQueryValueExW(param_1,lpValueName,(LPDWORD)0x0,(LPDWORD)param_4, - (LPBYTE)(_Str + 1),local_res20); + (LPBYTE)(_Str + 1),local_res18); if (LVar1 == 0) { + uVar3 = FUN_180006084(pHVar4,pWVar5,dwBytes); + if (uVar3 != 0) { + if (local_res18[0] < 2) goto LAB_4; + *(undefined2 *) + ((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) = 0; + } _wcsupr(_Str); - *(wchar_t **)(*param_2 + 8 + uVar4 * 0x10) = _Str; + *(wchar_t **)(*param_2 + 8 + uVar7 * 0x10) = _Str; dwBytes = lpValueName; - FUN_180039a04(0x40002,"PriList: %ls=%ls",lpValueName,_Str); + FUN_18003a584(0x40002,"PriList: %ls=%ls",lpValueName,_Str); param_4 = _Str; + } + else { + uVar3 = FUN_180006084(pHVar4,pWVar5,dwBytes); + if (uVar3 != 0) { +LAB_4: + FUN_18002db3c(_Str); + } } } } - uVar4 = (ulonglong)((DWORD)uVar4 + 1); + uVar7 = (ulonglong)((DWORD)uVar7 + 1); } - if ((ulonglong)DAT_4 << 5 < 0x100000000) { - dwBytes = (LPWSTR)((ulonglong)DAT_4 << 5 & 0xffffffff); + if ((ulonglong)DAT_5 << 5 < 0x100000000) { + dwBytes = (LPWSTR)((ulonglong)DAT_5 << 5 & 0xffffffff); _Dst = HeapAlloc(DAT_0,8,(SIZE_T)dwBytes); if (_Dst != (LPVOID)0x0) { - memcpy(_Dst,(void *)*param_2,(ulonglong)DAT_4 << 4); - FUN_18002cfbc((LPVOID)*param_2); + memcpy(_Dst,(void *)*param_2,(ulonglong)DAT_5 << 4); + FUN_18002db3c((LPVOID)*param_2); *param_2 = (longlong)_Dst; - DAT_4 = DAT_4 * 2; + DAT_5 = DAT_5 * 2; goto LAB_2; } - pcVar3 = "ServerAlloc failed in GetMediaModesPriorityLists 2"; + pcVar6 = "ServerAlloc failed in GetMediaModesPriorityLists 2"; } else { - pcVar3 = "overflow while trying GetMediaModesPriorityLists 2"; + pcVar6 = "overflow while trying GetMediaModesPriorityLists 2"; } - FUN_180039a04(0x10002,pcVar3,dwBytes,param_4); + FUN_18003a584(0x10002,pcVar6,dwBytes,param_4); LAB_3: - FUN_18002cfbc(lpValueName); + FUN_18002db3c(lpValueName); } return; } ``` ## FUN_180013fe0 ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|code,name,fullname,length,sig,address,called| |ratio|0.33| |i_ratio|0.44| |m_ratio|0.98| |b_ratio|0.63| |match_types|BSIM| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |`name`|FUN_180013fe0|FUN_180014010| |`fullname`|FUN_180013fe0|FUN_180014010| |refcount|3|3| |`length`|1157|1217| |`called`|
Expand for full list:
FUN_1800072a4
FUN_18001bf88
FUN_18001c054
FUN_18001c0a0
FUN_18001f498
FUN_18002aa5c
FUN_18002cfbc
FUN_18002fc6c
FUN_180039a04
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::HeapAllocKERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::lstrlenW
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::memcpy
MSVCRT.DLL::memmove
MSVCRT.DLL::wcsstr
__security_check_cookie
|
Expand for full list:
FUN_180006084
FUN_1800072d8
FUN_18001bff8
FUN_18001c0c4
FUN_18001c110
FUN_18001f508
FUN_18002b5e0
FUN_18002db3c
FUN_1800307ec
FUN_18003a584
KERNEL32.DLL::EnterCriticalSectionKERNEL32.DLL::HeapAlloc
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::lstrlenW
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::memcpy
MSVCRT.DLL::memmove
MSVCRT.DLL::wcsstr
__security_check_cookie
| |calling||| |paramcount|4|4| |`address`|180013fe0|180014010| |`sig`|undefined __fastcall FUN_180013fe0(undefined8 param_1, uint * param_2, uint param_3, longlong param_4)|undefined __fastcall FUN_180014010(undefined8 param_1, uint * param_2, uint param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|DEFAULT|DEFAULT| |external|False|False| ### FUN_180013fe0 Called Diff ```diff --- FUN_180013fe0 called +++ FUN_180014010 called @@ -1,9 +1,10 @@ -FUN_1800072a4 -FUN_18001bf88 -FUN_18001c054 -FUN_18001c0a0 -FUN_18001f498 -FUN_18002aa5c -FUN_18002cfbc -FUN_18002fc6c -FUN_180039a04 +FUN_180006084 +FUN_1800072d8 +FUN_18001bff8 +FUN_18001c0c4 +FUN_18001c110 +FUN_18001f508 +FUN_18002b5e0 +FUN_18002db3c +FUN_1800307ec +FUN_18003a584 ``` ### FUN_180013fe0 Diff ```diff --- FUN_180013fe0 +++ FUN_180014010 @@ -1,197 +1,221 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -void FUN_180013fe0(undefined8 param_1,uint *param_2,uint param_3,longlong param_4) +void FUN_180014010(undefined8 param_1,uint *param_2,uint param_3,longlong param_4) { - bool bVar1; - uint uVar2; + undefined2 *_Dst; + wchar_t *_Src; + longlong lVar1; + bool bVar2; uint uVar3; + uint uVar4; undefined7 extraout_var; - ulonglong uVar4; - LPVOID _Dst; - wchar_t *pwVar5; - LPCWSTR pWVar6; - ulonglong uVar7; - undefined8 uVar8; - char *pcVar9; - LPCWSTR _Str; - uint uVar10; - undefined8 uVar11; - longlong lVar12; - ulonglong uVar13; - LPCWSTR *ppWVar14; + ulonglong uVar5; + LPVOID _Dst_00; + LPCWSTR ******pppppppWVar6; + LPCWSTR *****ppppppWVar7; + longlong lVar8; + uint uVar9; + undefined8 uVar10; + char *pcVar11; + wchar_t *_SubStr; + LPCWSTR ******_Str; + wchar_t *pwVar12; + undefined8 uVar13; + ulonglong uVar14; + LPCWSTR ******pppppppWVar15; undefined1 auStack_288 [32]; int local_268; int local_264; - LPCWSTR local_260; + LPCWSTR *****local_260; WCHAR local_258; wchar_t local_256 [263]; ulonglong local_48; local_48 = DAT_0 ^ (ulonglong)auStack_288; - uVar3 = param_2[3]; - uVar10 = param_2[6]; - uVar2 = param_2[8]; + uVar4 = param_2[3]; + uVar9 = param_2[6]; + _Str = (LPCWSTR ******)0x0; + uVar3 = param_2[8]; local_268 = 0; - local_260 = (LPCWSTR)0x0; - bVar1 = FUN_1800072a4(param_3,param_4,param_2[2]); - if ((int)CONCAT71(extraout_var,bVar1) != 0) { + local_260 = (LPCWSTR *****)0x0; + bVar2 = FUN_1800072d8(param_3,param_4,param_2[2]); + if ((int)CONCAT71(extraout_var,bVar2) != 0) { LAB_1: *param_2 = 0x80000048; return; } - lVar12 = -1; - uVar4 = 0xffffffffffffffff; + uVar5 = 0xffffffffffffffff; do { - uVar4 = uVar4 + 1; - } while (*(short *)((ulonglong)param_2[2] + param_4 + uVar4 * 2) != 0); - uVar11 = 0x104; - if (0x104 < uVar4) goto LAB_1; - if (uVar3 == 0) { - if (1 < uVar10 - 1) { + uVar5 = uVar5 + 1; + } while (*(short *)((ulonglong)param_2[2] + param_4 + uVar5 * 2) != 0); + uVar13 = 0x104; + if (0x104 < uVar5) goto LAB_1; + if (uVar4 == 0) { + if (1 < uVar9 - 1) { *param_2 = 0x80000038; goto LAB_2; } } - else if ((uVar3 & 0xffff0001) != 0) { + else if ((uVar4 & 0xffff0001) != 0) { *param_2 = 0x8000002f; goto LAB_2; } - if ((uVar2 & 0xfffffffe) != 0) { + if ((uVar3 & 0xfffffffe) != 0) { *param_2 = 0x80000032; goto LAB_2; } - if (((uVar3 & 0xffffff) == 0) && (uVar3 != 0)) goto LAB_2; - uVar8 = 0x20a; + if (((uVar4 & 0xffffff) == 0) && (uVar4 != 0)) goto LAB_2; + uVar10 = 0x20a; local_258 = L'\"'; - FUN_18001c054(local_256,0x20a,(ulonglong)param_2[2] + param_4,0x104); + FUN_18001c0c4(local_256,0x20a,(ulonglong)param_2[2] + param_4,0x104); _wcsupr(local_256); - uVar2 = lstrlenW(&local_258); - uVar13 = (ulonglong)uVar2; + uVar3 = lstrlenW(&local_258); + uVar14 = (ulonglong)uVar3; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_3); - uVar4 = 0xffffffff; - if ((uVar3 & 0xffffff) == 0) { - if (uVar10 == 1) { - FUN_18002aa5c(&local_260,uVar8,0xffffffff,uVar11); - ppWVar14 = &local_260; + uVar5 = 0xffffffff; + if ((uVar4 & 0xffffff) == 0) { + if (uVar9 == 1) { + FUN_18002b5e0(&local_260,uVar10,0xffffffff,uVar13); + pppppppWVar15 = &local_260; local_268 = 1; - _Str = local_260; + _Str = (LPCWSTR ******)local_260; } else { - ppWVar14 = &DAT_4; + pppppppWVar15 = (LPCWSTR ******)&DAT_4; _Str = DAT_4; } LAB_5: - pwVar5 = _Str; - if (_Str == (LPCWSTR)0x0) goto LAB_6; + pwVar12 = (wchar_t *)_Str; + if (_Str == (LPCWSTR ******)0x0) goto LAB_6; } else { - _Str = (LPCWSTR)0x0; - ppWVar14 = (LPCWSTR *)0x0; - for (uVar7 = 0; (uint)uVar7 < DAT_7; uVar7 = (ulonglong)((uint)uVar7 + 1)) { - if (uVar3 == *(uint *)(uVar7 * 0x10 + (longlong)DAT_8)) { - ppWVar14 = (LPCWSTR *)((longlong)DAT_8 + uVar7 * 0x10 + 8); - _Str = *ppWVar14; - goto LAB_5; - } - } + pppppppWVar15 = _Str; + if (DAT_7 != 0) { + do { + if (uVar4 == *(uint *)((longlong)pppppppWVar15 * 0x10 + (longlong)DAT_8)) { + pppppppWVar15 = + (LPCWSTR ******)((longlong)DAT_8 + (longlong)pppppppWVar15 * 0x10 + 8); + _Str = (LPCWSTR ******)*pppppppWVar15; + goto LAB_5; + } + uVar9 = (int)pppppppWVar15 + 1; + pppppppWVar15 = (LPCWSTR ******)(ulonglong)uVar9; + } while (uVar9 < DAT_7); + } + pppppppWVar15 = _Str; if (param_2[8] != 0) { - if (DAT_7 == DAT_18004cd64) { + if (DAT_7 == DAT_18004dda4) { if ((ulonglong)DAT_9 << 5 < 0x100000000) { - uVar4 = (ulonglong)DAT_9 << 5 & 0xffffffff; - _Dst = HeapAlloc(DAT_10,8,uVar4); - if (_Dst != (LPVOID)0x0) { - memcpy(_Dst,DAT_8,(ulonglong)DAT_18004cd60 << 4); - FUN_18002cfbc(DAT_8); + uVar5 = (ulonglong)DAT_9 << 5 & 0xffffffff; + _Dst_00 = HeapAlloc(DAT_10,8,uVar5); + if (_Dst_00 != (LPVOID)0x0) { + memcpy(_Dst_00,DAT_8,(ulonglong)DAT_18004dda0 << 4); + FUN_18002db3c(DAT_8); DAT_9 = DAT_9 * 2; - DAT_8 = _Dst; + DAT_8 = _Dst_00; goto LAB_11; } LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_3); - pcVar9 = "Alloc failed in LineSetAppPriority"; + pcVar11 = "Alloc failed in LineSetAppPriority"; } else { LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_3); - pcVar9 = "Multiplication Overflow in LineSetAppPriority"; - } - FUN_180039a04(0x10002,pcVar9,uVar4,uVar11); + pcVar11 = "Multiplication Overflow in LineSetAppPriority"; + } + FUN_18003a584(0x10002,pcVar11,uVar5,uVar13); *param_2 = 0x80000044; goto LAB_2; } LAB_11: - *(uint *)((longlong)DAT_8 + (ulonglong)DAT_18004cd60 * 0x10) = uVar3; - ppWVar14 = (LPCWSTR *)((longlong)DAT_8 + (ulonglong)DAT_18004cd60 * 0x10 + 8); + *(uint *)((longlong)DAT_8 + (ulonglong)DAT_18004dda0 * 0x10) = uVar4; + pppppppWVar15 = + (LPCWSTR ******)((longlong)DAT_8 + (ulonglong)DAT_18004dda0 * 0x10 + 8); DAT_7 = DAT_7 + 1; - _Str = *ppWVar14; + _Str = (LPCWSTR ******)*pppppppWVar15; goto LAB_5; } LAB_6: - pwVar5 = L""; - } - pWVar6 = (LPCWSTR)0x0; - FUN_180039a04(0x40002,"LSetAppPri: priList=%ls",pwVar5,uVar11); + pwVar12 = L""; + } + FUN_18003a584(0x40002,"LSetAppPri: priList=%ls",pwVar12,uVar13); if (param_2[8] == 0) { - if ((_Str != (LPCWSTR)0x0) && (pwVar5 = wcsstr(_Str,&local_258), pwVar5 != (wchar_t *)0x0)) { - if (pwVar5[uVar13] == L'\0') { - if (pwVar5 == _Str) { + if (_Str != (LPCWSTR ******)0x0) { + _SubStr = &local_258; + pppppppWVar6 = (LPCWSTR ******)wcsstr((wchar_t *)_Str,_SubStr); + if (pppppppWVar6 != (LPCWSTR ******)0x0) { + _Src = (wchar_t *)((longlong)pppppppWVar6 + uVar14 * 2); + if (*_Src == L'\0') { + if (pppppppWVar6 == _Str) { + FUN_18002db3c(_Str); + *pppppppWVar15 = (LPCWSTR *****)0x0; + } + else { + *(wchar_t *)pppppppWVar6 = L'\0'; + } + } + else { + lVar8 = -1; + do { + lVar8 = lVar8 + 1; + } while (*(wchar_t *)((longlong)pppppppWVar6 + lVar8 * 2) != L'\0'); + uVar4 = FUN_180006084(0,_SubStr,pwVar12); + if (uVar4 == 0) { + lVar1 = -uVar14; + } + else { + lVar1 = uVar14 * -2; + } + memmove(pppppppWVar6,_Src,lVar8 * 2 + 2 + lVar1); + } + } + } + } + else { + if (_Str == (LPCWSTR ******)0x0) { + local_264 = 2; LAB_12: - FUN_18002cfbc(_Str); + if (uVar14 * 2 < 0x100000000) { + uVar4 = (uint)(uVar14 * 2); + uVar9 = uVar4 + local_264; + if ((uVar4 <= uVar9) && + (ppppppWVar7 = HeapAlloc(DAT_10,8,(ulonglong)uVar9), + ppppppWVar7 != (LPCWSTR *****)0x0)) { + FUN_18001c110((short *)ppppppWVar7,(ulonglong)uVar9,&local_258); + if (_Str != (LPCWSTR ******)0x0) { + FUN_18001bff8((short *)ppppppWVar7,(ulonglong)uVar9,_Str); + FUN_18002db3c(_Str); + } + *pppppppWVar15 = ppppppWVar7; goto LAB_13; } - *pwVar5 = L'\0'; - } - else { - do { - lVar12 = lVar12 + 1; - } while (pwVar5[lVar12] != L'\0'); - memmove(pwVar5,pwVar5 + uVar13,(lVar12 * 2 + 2) - uVar13); - } - } - } - else { - if (_Str == (LPCWSTR)0x0) { - local_264 = 2; -LAB_14: - if (uVar13 * 2 < 0x100000000) { - uVar3 = (uint)(uVar13 * 2); - uVar10 = uVar3 + local_264; - if ((uVar3 <= uVar10) && - (pWVar6 = HeapAlloc(DAT_10,8,(ulonglong)uVar10), pWVar6 != (LPCWSTR)0x0)) { - FUN_18001c0a0(pWVar6,(ulonglong)uVar10,&local_258); - if (_Str != (LPCWSTR)0x0) { - FUN_18001bf88(pWVar6,(ulonglong)uVar10,_Str); - goto LAB_12; - } + } + } + else { + pppppppWVar6 = (LPCWSTR ******)wcsstr((wchar_t *)_Str,&local_258); + if (pppppppWVar6 != (LPCWSTR ******)0x0) { + if (pppppppWVar6 != _Str) { + _Dst = (undefined2 *)((longlong)_Str + uVar14 * 2); + memmove(_Dst,_Str,((longlong)pppppppWVar6 - (longlong)_Str >> 1) * 2); + FUN_18001c110((short *)_Str,(ulonglong)(uVar3 + 1) * 2,&local_258); + *_Dst = 0x22; + } + goto LAB_13; + } + uVar4 = FUN_18001f508((LPCWSTR)_Str,&local_264); + if (-1 < (int)uVar4) goto LAB_12; + } + *param_2 = 0x80000044; + } LAB_13: - *ppWVar14 = pWVar6; - goto LAB_15; - } - } - } - else { - pwVar5 = wcsstr(_Str,&local_258); - if (pwVar5 != (wchar_t *)0x0) { - if (pwVar5 != _Str) { - memmove(_Str + uVar13,_Str,((longlong)pwVar5 - (longlong)_Str >> 1) * 2); - FUN_18001c0a0(_Str,(ulonglong)(uVar2 + 1) * 2,&local_258); - _Str[uVar13] = L'\"'; - } - goto LAB_15; - } - uVar3 = FUN_18001f498(_Str,&local_264); - if (-1 < (int)uVar3) goto LAB_14; - } - *param_2 = 0x80000044; - } -LAB_15: if (local_268 != 0) { - FUN_18002fc6c(*ppWVar14); + FUN_1800307ec((LPCWSTR)*pppppppWVar15); } LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_3); LAB_2: - FUN_180039a04(0x80002,"LineEpilogSync (lineSetAppPriority) exit, returning x%x", - (ulonglong)*param_2,uVar11); + FUN_18003a584(0x80002,"LineEpilogSync (lineSetAppPriority) exit, returning x%x", + (ulonglong)*param_2,uVar13); return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|56|58| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|18003ba64|18003c5e4| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ## USER32.DLL::LoadIconW ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |name|LoadIconW|LoadIconW| |fullname|USER32.DLL::LoadIconW|USER32.DLL::LoadIconW| |`refcount`|3|1| |length|0|0| |called||| |`calling`|ServiceMain|| |paramcount|2|2| |`address`|EXTERNAL:000000b7|EXTERNAL:000000b8| |sig|HICON __stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)|HICON __stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### USER32.DLL::LoadIconW Calling Diff ```diff --- USER32.DLL::LoadIconW calling +++ USER32.DLL::LoadIconW calling @@ -1 +0,0 @@ -ServiceMain ``` ## __security_check_cookie ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|77|79| |length|30|30| |called|FUN_180001650|FUN_180001650| |`calling`|
Expand for full list:
FUN_1800023b0
FUN_18000261c
FUN_180002c0c
FUN_180003088
FUN_18000430c
FUN_180004a00
FUN_180004d1c
FUN_1800050ec
FUN_1800064e0
FUN_18000b590
FUN_18000c490FUN_18000ee50
FUN_18000f940
FUN_180011e70
FUN_180013fe0
FUN_180014670
FUN_180016480
FUN_1800172e0
FUN_18001a308
FUN_18001a65c
FUN_18001a950
FUN_18001ac58
FUN_18001b284
FUN_18001b478
FUN_18001bc94
FUN_18001c330
FUN_18001d720
FUN_18001e5bc
FUN_18001f60c
FUN_1800206d0
FUN_180024bf8
FUN_180025934
FUN_180025b54
FUN_180026508
FUN_180026ba0
FUN_1800281d8
FUN_180028c10
FUN_18002ac90
FUN_18002b494
FUN_18002be20
FUN_18002cb08
FUN_18002cfec
FUN_18002daa0
FUN_18002fb10
FUN_180030ef8
FUN_180031cd0
FUN_180031fa4
FUN_180032448
FUN_18003287c
FUN_180032df4
FUN_180032fa0
FUN_18003411c
FUN_180035014
FUN_18003692c
FUN_180037044
FUN_180037124
FUN_1800378a8
FUN_180037f78
FUN_18003802c
FUN_1800383b8
FUN_1800384d8
FUN_1800386b8
FUN_180038880
FUN_180038c1c
FUN_180038d20
FUN_180038f1c
FUN_1800395a0
FUN_180039a04
FUN_180039bcc
FUN_18003a398
FUN_18003a890
FUN_18003ad9c
FUN_18003b0d8
FUN_18003b29c
ServiceMain
__GSHandlerCheckCommon
|
Expand for full list:
FUN_1800023b0
FUN_18000261c
FUN_180002c0c
FUN_180003088
FUN_18000430c
FUN_180004a00
FUN_180004d1c
FUN_1800050ec
FUN_180006514
FUN_18000b5c0
FUN_18000c4c0FUN_18000ee80
FUN_18000f970
FUN_180011ea0
FUN_180014010
FUN_1800146e0
FUN_1800164f0
FUN_180017350
FUN_18001a378
FUN_18001a6cc
FUN_18001a9c0
FUN_18001acc8
FUN_18001b2f4
FUN_18001b4e8
FUN_18001bd04
FUN_18001c3a0
FUN_18001d790
FUN_18001e62c
FUN_18001f558
FUN_18001facc
FUN_1800200d0
FUN_180021194
FUN_1800256c8
FUN_180026404
FUN_180026624
FUN_180026fd8
FUN_180027670
FUN_180028ca8
FUN_1800296e0
FUN_18002b810
FUN_18002c014
FUN_18002c9a0
FUN_18002d688
FUN_18002db6c
FUN_18002e620
FUN_180030690
FUN_180031a78
FUN_180032850
FUN_180032b24
FUN_180032fc8
FUN_1800333fc
FUN_180033974
FUN_180033b20
FUN_180034c9c
FUN_180035b94
FUN_1800374ac
FUN_180037bc4
FUN_180037ca4
FUN_180038428
FUN_180038af8
FUN_180038bac
FUN_180038f38
FUN_180039058
FUN_180039238
FUN_180039400
FUN_18003979c
FUN_1800398a0
FUN_180039a9c
FUN_18003a120
FUN_18003a584
FUN_18003a74c
FUN_18003af18
FUN_18003b410
FUN_18003b91c
FUN_18003bc58
FUN_18003be1c
ServiceMain
__GSHandlerCheckCommon
| |paramcount|1|1| |address|1800015f0|1800015f0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -9,66 +9,68 @@ -FUN_1800064e0 -FUN_18000b590 -FUN_18000c490 -FUN_18000ee50 -FUN_18000f940 -FUN_180011e70 -FUN_180013fe0 -FUN_180014670 -FUN_180016480 -FUN_1800172e0 -FUN_18001a308 -FUN_18001a65c -FUN_18001a950 -FUN_18001ac58 -FUN_18001b284 -FUN_18001b478 -FUN_18001bc94 -FUN_18001c330 -FUN_18001d720 -FUN_18001e5bc -FUN_18001f60c -FUN_1800206d0 -FUN_180024bf8 -FUN_180025934 -FUN_180025b54 -FUN_180026508 -FUN_180026ba0 -FUN_1800281d8 -FUN_180028c10 -FUN_18002ac90 -FUN_18002b494 -FUN_18002be20 -FUN_18002cb08 -FUN_18002cfec -FUN_18002daa0 -FUN_18002fb10 -FUN_180030ef8 -FUN_180031cd0 -FUN_180031fa4 -FUN_180032448 -FUN_18003287c -FUN_180032df4 -FUN_180032fa0 -FUN_18003411c -FUN_180035014 -FUN_18003692c -FUN_180037044 -FUN_180037124 -FUN_1800378a8 -FUN_180037f78 -FUN_18003802c -FUN_1800383b8 -FUN_1800384d8 -FUN_1800386b8 -FUN_180038880 -FUN_180038c1c -FUN_180038d20 -FUN_180038f1c -FUN_1800395a0 -FUN_180039a04 -FUN_180039bcc -FUN_18003a398 -FUN_18003a890 -FUN_18003ad9c -FUN_18003b0d8 -FUN_18003b29c +FUN_180006514 +FUN_18000b5c0 +FUN_18000c4c0 +FUN_18000ee80 +FUN_18000f970 +FUN_180011ea0 +FUN_180014010 +FUN_1800146e0 +FUN_1800164f0 +FUN_180017350 +FUN_18001a378 +FUN_18001a6cc +FUN_18001a9c0 +FUN_18001acc8 +FUN_18001b2f4 +FUN_18001b4e8 +FUN_18001bd04 +FUN_18001c3a0 +FUN_18001d790 +FUN_18001e62c +FUN_18001f558 +FUN_18001facc +FUN_1800200d0 +FUN_180021194 +FUN_1800256c8 +FUN_180026404 +FUN_180026624 +FUN_180026fd8 +FUN_180027670 +FUN_180028ca8 +FUN_1800296e0 +FUN_18002b810 +FUN_18002c014 +FUN_18002c9a0 +FUN_18002d688 +FUN_18002db6c +FUN_18002e620 +FUN_180030690 +FUN_180031a78 +FUN_180032850 +FUN_180032b24 +FUN_180032fc8 +FUN_1800333fc +FUN_180033974 +FUN_180033b20 +FUN_180034c9c +FUN_180035b94 +FUN_1800374ac +FUN_180037bc4 +FUN_180037ca4 +FUN_180038428 +FUN_180038af8 +FUN_180038bac +FUN_180038f38 +FUN_180039058 +FUN_180039238 +FUN_180039400 +FUN_18003979c +FUN_1800398a0 +FUN_180039a9c +FUN_18003a120 +FUN_18003a584 +FUN_18003a74c +FUN_18003af18 +FUN_18003b410 +FUN_18003b91c +FUN_18003bc58 +FUN_18003be1c ``` ## KERNEL32.DLL::GetProcAddress ### Match Info |Key|tapisrv-2024-10.dll - tapisrv-2024-11.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv-2024-10.dll|tapisrv-2024-11.dll| | :---: | :---: | :---: | |name|GetProcAddress|GetProcAddress| |fullname|KERNEL32.DLL::GetProcAddress|KERNEL32.DLL::GetProcAddress| |`refcount`|19|21| |length|0|0| |called||| |`calling`|FUN_18002ac90
FUN_18002bbac
FUN_18002c814
FUN_18002cfec
FUN_180032448
FUN_180032fa0|FUN_18001f558
FUN_18001f664
FUN_18002b810
FUN_18002c72c
FUN_18002d394
FUN_18002db6c
FUN_180032fc8
FUN_180033b20| |paramcount|2|2| |`address`|EXTERNAL:00000065|EXTERNAL:0000008b| |sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::GetProcAddress Calling Diff ```diff --- KERNEL32.DLL::GetProcAddress calling +++ KERNEL32.DLL::GetProcAddress calling @@ -1,6 +1,8 @@ -FUN_18002ac90 -FUN_18002bbac -FUN_18002c814 -FUN_18002cfec -FUN_180032448 -FUN_180032fa0 +FUN_18001f558 +FUN_18001f664 +FUN_18002b810 +FUN_18002c72c +FUN_18002d394 +FUN_18002db6c +FUN_180032fc8 +FUN_180033b20 ``` Generated with `ghidriff` version: 1.0.0 on 2026-07-26T18:39:35