# tapisrv-02.dll-tapisrv-03.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [wil::details::`dynamic_initializer_for_'g_enabledStateManager''](#wildetailsdynamic_initializer_for_g_enabledstatemanager) * [Feature_1390216506__private_IsEnabledDeviceUsageNoInline](#feature_1390216506__private_isenableddeviceusagenoinline) * [wil_RtlStagingConfig_QueryFeatureState](#wil_rtlstagingconfig_queryfeaturestate) * [wil_details_FeatureReporting_IncrementOpportunityInCache](#wil_details_featurereporting_incrementopportunityincache) * [wil_details_FeatureReporting_IncrementUsageInCache](#wil_details_featurereporting_incrementusageincache) * [wil_details_FeatureReporting_RecordUsageInCache](#wil_details_featurereporting_recordusageincache) * [wil_details_FeatureReporting_ReportUsageToService](#wil_details_featurereporting_reportusagetoservice) * [wil_details_FeatureReporting_ReportUsageToServiceDirect](#wil_details_featurereporting_reportusagetoservicedirect) * [wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState](#wil_details_featurestatecache_reevaluatecachedfeatureenabledstate) * [wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath](#wil_details_featurestatecache_tryenabledeviceusagefastpath) * [wil_details_GetCurrentFeatureEnabledState](#wil_details_getcurrentfeatureenabledstate) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [wil_details_MapReportingKind](#wil_details_mapreportingkind) * [wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>](#wildetailsunique_storagewildetailsresource_policyfeature_state_change_subscription_____ptr64void___cdeclfeature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64wistdintegral_constantunsigned___int640feature_state_change_subscription_____ptr64feature_state_change_subscription_____ptr640stdnullptr_t_unique_storagewildetailsresource_policyfeature_state_change_subscription_____ptr64void___cdeclfeature_state_change_subscription_____ptr64void___cdecl_wildetailswilapi_unsubscribefeaturestatechangenotificationstruct_feature_state_change_subscription_____ptr64wistdintegral_constantunsigned___int640feature_state_change_subscription_____ptr64feature_state_change_subscription_____ptr640stdnullptr_t_) * [wil::details::EnabledStateManager::~EnabledStateManager](#wildetailsenabledstatemanagerenabledstatemanager) * [wil::details::EnsureSubscribedToFeatureConfigurationChanges](#wildetailsensuresubscribedtofeatureconfigurationchanges) * [wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl](#wildetailsenabledstatemanagerensuresubscribedtofeatureconfigurationchangesimpl) * [wil::details::EnabledStateManager::OnStateChange](#wildetailsenabledstatemanageronstatechange) * [wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges](#wildetailsenabledstatemanagersubscribefeaturestatecachetoconfigurationchanges) * [wil::details::SubscribeFeatureStateCacheToConfigurationChanges](#wildetailssubscribefeaturestatecachetoconfigurationchanges) * [wil::details::WilApi_RecordFeatureUsage](#wildetailswilapi_recordfeatureusage) * [wil::details::WilApi_RecordFeatureUsageReports](#wildetailswilapi_recordfeatureusagereports) * [wil::details::WilApi_UnsubscribeFeatureStateChangeNotification](#wildetailswilapi_unsubscribefeaturestatechangenotification) * [wil_details_RecordCachedUsage](#wil_details_recordcachedusage) * [wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''](#wildetailsdynamic_atexit_destructor_for_g_enabledstatemanager) * [Added](#added) * [Modified](#modified) * [GetMediaModesPriorityLists](#getmediamodesprioritylists) * [wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''](#wildetailsdynamic_initializer_for_g_header_init_initializestagingheaderinternalapi) * [LSetAppPriority](#lsetapppriority) * [GetPriorityList](#getprioritylist) * [Modified (No Code Changes)](#modified-no-code-changes) * [__GSHandlerCheck](#__gshandlercheck) * [atexit](#atexit) * [~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagewildetailsresource_policy_rtl_srwlock___ptr64void___cdecl_rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64wistdintegral_constantunsigned___int641_rtl_srwlock___ptr64_rtl_srwlock___ptr640stdnullptr_t_) * [ProcessShutdownInProgress](#processshutdowninprogress) * [reset](#reset) * [~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>](#unique_storagewildetailsresource_policy_tp_timer___ptr64void___cdecl_tp_timer___ptr64public_static_void___cdecl_wildetailsdestroythreadpooltimerstruct_wildetailssystemthreadpoolmethods0destroystruct__tp_timer___ptr64wistdintegral_constantunsigned___int640_tp_timer___ptr64_tp_timer___ptr640stdnullptr_t_) * [push_back](#push_back) * [KERNEL32.DLL::AcquireSRWLockExclusive](#kernel32dllacquiresrwlockexclusive) * [KERNEL32.DLL::GetModuleHandleW](#kernel32dllgetmodulehandlew) * [__security_check_cookie](#__security_check_cookie) * [KERNEL32.DLL::GetProcAddress](#kernel32dllgetprocaddress) * [wil_details_GetNtDllProcedureAddress](#wil_details_getntdllprocedureaddress) # Visual Chart Diff ```mermaid flowchart LR GetMediaModesPriorityLists-4-old<--Match 88%-->GetMediaModesPriorityLists-4-new wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-old<--Match 78%-->wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-new LSetAppPriority-4-old<--Match 59%-->LSetAppPriority-4-new GetPriorityList-3-old<--Match 89%-->GetPriorityList-3-new subgraph tapisrv-03.dll GetMediaModesPriorityLists-4-new wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-new LSetAppPriority-4-new GetPriorityList-3-new end subgraph tapisrv-02.dll GetMediaModesPriorityLists-4-old wildetailsdynamic_initializer_for_g_header_init_InitializeStagingHeaderInternalApi-0-old LSetAppPriority-4-old GetPriorityList-3-old subgraph Deleted direction LR wil-details-dynamic_initializer_for_g_enabledStateManager Feature_1390216506__private_IsEnabledDeviceUsageNoInline wil_RtlStagingConfig_QueryFeatureState wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache wil_details_FeatureReporting_RecordUsageInCache wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath wil_details_GetCurrentFeatureEnabledState wil_details_IsEnabledFallback wil_details_MapReportingKind wil-details-unique_storagewil-details-resource_policyFEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclFEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-WilApi_UnsubscribeFeatureStateChangeNotificationstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64wistd-integral_constantunsigned___int640FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_-unique_storagewil-details-resource_policyFEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdeclFEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64void___cdecl_wil-details-WilApi_UnsubscribeFeatureStateChangeNotificationstruct_FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64wistd-integral_constantunsigned___int640FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr64FEATURE_STATE_CHANGE_SUBSCRIPTION_____ptr640std-nullptr_t_ wil-details-EnabledStateManager-EnabledStateManager wil-details-EnsureSubscribedToFeatureConfigurationChanges wil-details-EnabledStateManager-EnsureSubscribedToFeatureConfigurationChangesImpl wil-details-EnabledStateManager-OnStateChange wil-details-EnabledStateManager-SubscribeFeatureStateCacheToConfigurationChanges wil-details-SubscribeFeatureStateCacheToConfigurationChanges wil-details-WilApi_RecordFeatureUsage wil-details-WilApi_RecordFeatureUsageReports wil-details-WilApi_UnsubscribeFeatureStateChangeNotification wil_details_RecordCachedUsage wil-details-dynamic_atexit_destructor_for_g_enabledStateManager end end ``` ```mermaid pie showData title Function Matches - 98.6877% "unmatched_funcs_len" : 25 "matched_funcs_len" : 1880 ``` ```mermaid pie showData title Matched Function Similarity - 98.9362% "matched_funcs_with_code_changes_len" : 4 "matched_funcs_with_non_code_changes_len" : 16 "matched_funcs_no_changes_len" : 1860 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --max-ram-percent 60.0 --max-section-funcs 200 tapisrv-02.dll tapisrv-03.dll ``` #### Verbose Args
``` --old ['tapisrv-02.dll'] --new [['tapisrv-03.dll']] --engine VersionTrackingDiff --output-path out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim False --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/07B55A085D000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.26100.3037 wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/15111C4C5B000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.26100.3323 ``` ## Binary Metadata Diff ```diff --- tapisrv-02.dll Meta +++ tapisrv-03.dll Meta @@ -1,44 +1,44 @@ -Program Name: tapisrv-02.dll +Program Name: tapisrv-03.dll Language ID: x86:LE:64:default (4.7) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 383928 +# of Bytes: 375536 # of Memory Blocks: 10 -# of Instructions: 63284 -# of Defined Data: 4136 -# of Functions: 966 -# of Symbols: 11757 -# of Data Types: 1068 +# of Instructions: 62166 +# of Defined Data: 4077 +# of Functions: 939 +# of Symbols: 11582 +# of Data Types: 1060 # of Data Type Categories: 45 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.1.2 -Date Created: Thu Aug 27 20:56:44 SGT 2026 +Date Created: Thu Aug 27 20:56:49 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /C:/Users/Jacob/Downloads/pdbs/tapisrv-02.dll -Executable MD5: 90f393085fa37b104deb11c9200efbd2 -Executable SHA256: 7cde3632cc64c832593ce03e3d5f61eb22fb12253af2a35d618e36efcdb378db -FSRL: file:///C:/Users/Jacob/Downloads/pdbs/tapisrv-02.dll?MD5=90f393085fa37b104deb11c9200efbd2 +Executable Location: /C:/Users/Jacob/Downloads/pdbs/tapisrv-03.dll +Executable MD5: 489240d7d16e5cbb33aa984a2c8d3890 +Executable SHA256: c0fbaec69f5495be56c3d4de2a56aa55a538171600024d8be084a8a7e6fa6ce2 +FSRL: file:///C:/Users/Jacob/Downloads/pdbs/tapisrv-03.dll?MD5=489240d7d16e5cbb33aa984a2c8d3890 PDB Age: 1 PDB File: tapisrv.pdb -PDB GUID: ce9c98ec-022a-deff-13a3-089c14cd1e74 +PDB GUID: aa05daea-5d99-4800-d939-db37cbfd00db PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft® Windows(TM) Telephony Server -PE Property[FileVersion]: 10.0.26100.3037 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.3323 (WinBuild.160101.0800) PE Property[InternalName]: Telephony Service PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: TAPISRV.EXE PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.3037 +PE Property[ProductVersion]: 10.0.26100.3323 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra tapisrv-02.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra tapisrv-02.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra tapisrv-02.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra tapisrv-03.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra tapisrv-03.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra tapisrv-03.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.msdApplyOptions|{ interpretation: FUNCTION_IF_EXISTS, applyCallingConvention: true, applySignature: true, demangleOnlyKnownPatterns: true, doDisassembly: true }| |Demangler Microsoft.msdOutputOptions|ghidra.app.util.demangler.microsoft.options.MsdOutputOption@9e5b| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|0| |deleted_funcs_len|25| |modified_funcs_len|20| |added_symbols_len|0| |deleted_symbols_len|13| |diff_time|15.947745323181152| |deleted_strings_len|1| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 934, 'ExternalsName': 227, 'ExactBytesFunctionHasher': 2, 'SigCallingCalledHasher': 1, 'StructuralGraphHash': 1, 'Implied Match': 1})| |items_to_process|58| |diff_types|Counter({'address': 20, 'refcount': 16, 'calling': 14, 'length': 5, 'code': 4, 'called': 4, 'sig': 2})| |unmatched_funcs_len|25| |total_funcs_len|1905| |matched_funcs_len|1880| |matched_funcs_with_code_changes_len|4| |matched_funcs_with_non_code_changes_len|16| |matched_funcs_no_changes_len|1860| |match_func_similarity_percent|98.9362%| |func_match_overall_percent|98.6877%| |first_matches|Counter({'SymbolsHash': 934, 'ExactBytesFunctionHasher': 2, 'SigCallingCalledHasher': 1, 'StructuralGraphHash': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 934 "ExternalsName" : 227 "ExactBytesFunctionHasher" : 2 "SigCallingCalledHasher" : 1 "StructuralGraphHash" : 1 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 934 "ExactBytesFunctionHasher" : 2 "SigCallingCalledHasher" : 1 "StructuralGraphHash" : 1 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 0 "deleted_funcs_len" : 25 "modified_funcs_len" : 20 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 0 "deleted_symbols_len" : 13 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 0 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1 +0,0 @@ -s_RtlQueryFeatureConfiguration ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |s_RtlQueryFeatureConfiguration|1|wil_RtlStagingConfig_QueryFeatureState| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | # Deleted ## wil::details::`dynamic_initializer_for_'g_enabledStateManager'' ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|`dynamic_initializer_for_'g_enabledStateManager''| |fullname|wil::details::`dynamic_initializer_for_'g_enabledStateManager''| |refcount|2| |length|12| |called|atexit| |calling|| |paramcount|0| |address|180001010| |sig|undefined __fastcall `dynamic_initializer_for_'g_enabledStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_initializer_for_'g_enabledStateManager'' +++ wil::details::`dynamic_initializer_for_'g_enabledStateManager'' @@ -1,8 +0,0 @@ - -void wil::details::_dynamic_initializer_for__g_enabledStateManager__(void) - -{ - atexit(_dynamic_atexit_destructor_for__g_enabledStateManager__); - return; -} - ``` ## Feature_1390216506__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|Feature_1390216506__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_1390216506__private_IsEnabledDeviceUsageNoInline| |refcount|7| |length|44| |called|wil_details_IsEnabledFallback| |calling|GetMediaModesPriorityLists
GetPriorityList
LSetAppPriority| |paramcount|0| |address|1800062d4| |sig|uint __fastcall Feature_1390216506__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_1390216506__private_IsEnabledDeviceUsageNoInline +++ Feature_1390216506__private_IsEnabledDeviceUsageNoInline @@ -1,15 +0,0 @@ - -uint Feature_1390216506__private_IsEnabledDeviceUsageNoInline(void) - -{ - uint uVar1; - undefined8 local_res8; - - local_res8 = (undefined4 *)(ulonglong)Feature_1390216506__private_featureState; - if ((Feature_1390216506__private_featureState & 0x10) != 0) { - return Feature_1390216506__private_featureState & 1; - } - uVar1 = wil_details_IsEnabledFallback(local_res8,3); - return uVar1; -} - ``` ## wil_RtlStagingConfig_QueryFeatureState ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_RtlStagingConfig_QueryFeatureState| |fullname|wil_RtlStagingConfig_QueryFeatureState| |refcount|2| |length|271| |called|__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetNtDllProcedureAddress| |calling|wil_details_GetCurrentFeatureEnabledState| |paramcount|4| |address|180020194| |sig|undefined4 __fastcall wil_RtlStagingConfig_QueryFeatureState(uint * param_1, undefined4 param_2, int param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_RtlStagingConfig_QueryFeatureState +++ wil_RtlStagingConfig_QueryFeatureState @@ -1,50 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ - -undefined4 -wil_RtlStagingConfig_QueryFeatureState(uint *param_1,undefined4 param_2,int param_3,uint *param_4) - -{ - int iVar1; - undefined4 uVar2; - undefined1 auStack_78 [48]; - undefined8 local_48; - undefined8 local_40; - uint local_38; - ulonglong local_30; - - local_30 = __security_cookie ^ (ulonglong)auStack_78; - local_48 = 0; - uVar2 = 0; - local_40 = 0; - local_38 = 0; - if ((g_wil_details_pfnRtlQueryFeatureConfiguration == (code *)0x0) && - (g_wil_details_pfnRtlQueryFeatureConfiguration = - (code *)wil_details_GetNtDllProcedureAddress("RtlQueryFeatureConfiguration"), - g_wil_details_pfnRtlQueryFeatureConfiguration == (code *)0x0)) { - iVar1 = -0x3ffffec7; - uVar2 = 0; - } - else { - iVar1 = (*g_wil_details_pfnRtlQueryFeatureConfiguration) - (param_2,param_3 == 0,&local_48,&local_40); - if (iVar1 == 0) { - *param_1 = local_40._4_4_ >> 4 & 3; - *(byte *)(param_1 + 1) = (byte)((ulonglong)local_40 >> 0x28) & 0x3f; - param_1[3] = local_38; - param_1[2] = local_40._4_4_ >> 0xe & 3; - param_1[5] = local_40._4_4_ >> 6 & 1; - } - else if (iVar1 != 0x117) goto LAB_18002026f; - uVar2 = 1; - param_1[4] = local_40._4_4_ >> 7 & 1; - } -LAB_18002026f: - if (param_4 != (uint *)0x0) { - *param_4 = (uint)(iVar1 != -0x7fffffde); - } - return uVar2; -} - ``` ## wil_details_FeatureReporting_IncrementOpportunityInCache ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementOpportunityInCache| |fullname|wil_details_FeatureReporting_IncrementOpportunityInCache| |refcount|2| |length|208| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|18002030c| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementOpportunityInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementOpportunityInCache +++ wil_details_FeatureReporting_IncrementOpportunityInCache @@ -1,54 +0,0 @@ - -void wil_details_FeatureReporting_IncrementOpportunityInCache - (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - bool bVar5; - - uVar2 = *param_1; - do { - uVar4 = uVar2; - param_4[1] = 0; - uVar1 = uVar4 | 1; - if ((uVar4 & 0x400000) >> 0x16 != (uint)(param_2 == 5)) { - uVar2 = (uVar4 & 0x3f8000) >> 0xf; - if (uVar2 != 0) { - param_4[1] = uVar2; - uVar2 = 5; - if (param_2 != 1) { - uVar2 = 1; - } - uVar1 = uVar4 & 0xffc07fff | 1; - param_4[2] = uVar2; - } - uVar2 = 0; - if (param_2 == 5) { - uVar2 = 0x400000; - } - uVar1 = uVar2 | uVar1 & 0xffbfffff; - } - uVar2 = uVar1 >> 0xf & 0x7f; - uVar3 = uVar2 + 1; - if ((0x7f < uVar3) || (uVar3 < uVar2)) { - uVar3 = 1; - param_4[2] = param_2; - param_4[1] = uVar2; - } - LOCK(); - uVar2 = *param_1; - bVar5 = uVar4 == uVar2; - if (bVar5) { - *param_1 = (uVar3 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1; - uVar2 = uVar4; - } - UNLOCK(); - } while (!bVar5); - param_4[4] = 0; - *param_4 = ~uVar4 & 1; - return; -} - ``` ## wil_details_FeatureReporting_IncrementUsageInCache ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureReporting_IncrementUsageInCache| |fullname|wil_details_FeatureReporting_IncrementUsageInCache| |refcount|2| |length|220| |called|| |calling|wil_details_FeatureReporting_RecordUsageInCache| |paramcount|4| |address|1800203e4| |sig|undefined __fastcall wil_details_FeatureReporting_IncrementUsageInCache(uint * param_1, uint param_2, undefined8 param_3, uint * param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_IncrementUsageInCache +++ wil_details_FeatureReporting_IncrementUsageInCache @@ -1,50 +0,0 @@ - -void wil_details_FeatureReporting_IncrementUsageInCache - (uint *param_1,uint param_2,undefined8 param_3,uint *param_4) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - bool bVar5; - - uVar4 = *param_1; - do { - uVar3 = uVar4; - param_4[1] = 0; - uVar1 = uVar3 | 1; - if ((uVar3 & 0x4000) >> 0xe != (uint)(param_2 == 4)) { - uVar4 = (uVar3 & 0x3fe0) >> 5; - if (uVar4 != 0) { - param_4[1] = uVar4; - param_4[2] = ~-(uint)(param_2 != 0) & 4; - uVar1 = uVar3 & 0xffffc01f | 1; - } - uVar4 = 0; - if (param_2 == 4) { - uVar4 = 0x4000; - } - uVar1 = uVar4 | uVar1 & 0xffffbfff; - } - uVar4 = uVar1 >> 5 & 0x1ff; - uVar2 = uVar4 + 1; - if ((0x1ff < uVar2) || (uVar2 < uVar4)) { - uVar2 = 1; - param_4[2] = param_2; - param_4[1] = uVar4; - } - LOCK(); - uVar4 = *param_1; - bVar5 = uVar3 == uVar4; - if (bVar5) { - *param_1 = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1; - uVar4 = uVar3; - } - UNLOCK(); - } while (!bVar5); - param_4[4] = 0; - *param_4 = ~uVar3 & 1; - return; -} - ``` ## wil_details_FeatureReporting_RecordUsageInCache ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureReporting_RecordUsageInCache| |fullname|wil_details_FeatureReporting_RecordUsageInCache| |refcount|2| |length|359| |called|wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToServiceDirect| |paramcount|4| |address|1800204c8| |sig|uint * __fastcall wil_details_FeatureReporting_RecordUsageInCache(uint * param_1, uint * param_2, undefined8 param_3, uint param_4)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_RecordUsageInCache +++ wil_details_FeatureReporting_RecordUsageInCache @@ -1,98 +0,0 @@ - -uint * wil_details_FeatureReporting_RecordUsageInCache - (uint *param_1,uint *param_2,undefined8 param_3,uint param_4) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - uint uVar5; - bool bVar6; - - uVar3 = (uint)param_3; - param_1[0] = 0; - param_1[1] = 0; - param_1[2] = 0; - param_1[3] = 0; - param_1[4] = 0; - param_1[5] = 0; - if (uVar3 == 0) { -LAB_180020611: - wil_details_FeatureReporting_IncrementUsageInCache(param_2,uVar3,param_3,param_1); - } - else { - if (uVar3 == 1) { -LAB_180020604: - wil_details_FeatureReporting_IncrementOpportunityInCache(param_2,uVar3,param_3,param_1); - return param_1; - } - if ((uVar3 != 2) && (uVar3 != 3)) { - if (uVar3 == 4) goto LAB_180020611; - if (uVar3 == 5) goto LAB_180020604; - if ((uVar3 != 6) && (uVar3 != 7)) { - uVar4 = uVar3 - 0x140; - if ((int)uVar4 < 0x40) { - uVar5 = param_2[1]; - do { - if (((uVar5 & 0x10) == 0) || (uVar2 = 1, (uVar5 >> 5 & 0x3f) != uVar4)) { - uVar2 = 0; - } - param_1[4] = uVar2; - LOCK(); - uVar2 = param_2[1]; - bVar6 = uVar5 == uVar2; - if (bVar6) { - param_2[1] = (uVar4 * 0x20 ^ uVar5) & 0x7e0 ^ uVar5 | 0x10; - uVar2 = uVar5; - } - uVar5 = uVar2; - UNLOCK(); - } while (!bVar6); - } - param_1[2] = uVar3; - param_1[1] = 1; - param_1[3] = param_4; - return param_1; - } - } - uVar4 = 0; - if (uVar3 == 2) { - uVar4 = 2; - } - else if (uVar3 == 3) { - uVar4 = 8; - } - else if (uVar3 == 6) { - uVar4 = 4; - } - else if (uVar3 == 7) { - uVar4 = 0x10; - } - uVar5 = 1; - uVar3 = *param_2; - do { - uVar1 = uVar3; - uVar3 = uVar4 | uVar1; - param_1[4] = (uint)(uVar3 == uVar1); - uVar2 = uVar3 | 1; - if (uVar3 == uVar1) { - uVar2 = uVar3; - } - LOCK(); - uVar3 = *param_2; - bVar6 = uVar1 == uVar3; - if (bVar6) { - *param_2 = uVar2; - uVar3 = uVar1; - } - UNLOCK(); - } while (!bVar6); - if (((uVar2 & 1) == 0) || ((uVar1 & 1) != 0)) { - uVar5 = 0; - } - *param_1 = uVar5; - } - return param_1; -} - ``` ## wil_details_FeatureReporting_ReportUsageToService ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToService| |fullname|wil_details_FeatureReporting_ReportUsageToService| |refcount|2| |length|114| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil_details_IsEnabledFallback| |paramcount|3| |address|180020638| |sig|undefined __fastcall wil_details_FeatureReporting_ReportUsageToService(undefined8 param_1, undefined8 param_2, uint param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToService +++ wil_details_FeatureReporting_ReportUsageToService @@ -1,28 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ - -void wil_details_FeatureReporting_ReportUsageToService - (undefined8 param_1,undefined8 param_2,uint param_3) - -{ - bool bVar1; - uint uVar2; - undefined7 extraout_var; - ulonglong uVar3; - uint uVar4; - uint local_res18 [4]; - - uVar4 = (uint)param_2 & 1; - uVar3 = (ulonglong)param_3; - local_res18[0] = param_3; - uVar2 = wil_details_MapReportingKind(param_3,uVar4); - bVar1 = wil_details_FeatureReporting_ReportUsageToServiceDirect(uVar3,param_2,(ulonglong)uVar2); - if (((int)CONCAT71(extraout_var,bVar1) != 0) && - (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { - (*g_wil_details_pfnFeatureLoggingHook) - (0x31de9ca,&Feature_1390216506_logged_traits,0,uVar4,local_res18,0,0,1); - } - return; -} - ``` ## wil_details_FeatureReporting_ReportUsageToServiceDirect ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureReporting_ReportUsageToServiceDirect| |fullname|wil_details_FeatureReporting_ReportUsageToServiceDirect| |refcount|2| |length|137| |called|__security_check_cookie
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|3| |address|1800206b4| |sig|bool __fastcall wil_details_FeatureReporting_ReportUsageToServiceDirect(undefined8 param_1, undefined8 param_2, undefined8 param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureReporting_ReportUsageToServiceDirect +++ wil_details_FeatureReporting_ReportUsageToServiceDirect @@ -1,24 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -bool wil_details_FeatureReporting_ReportUsageToServiceDirect - (undefined8 param_1,undefined8 param_2,undefined8 param_3) - -{ - uint *puVar1; - undefined1 auStack_78 [48]; - uint local_48 [10]; - undefined8 local_20; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStack_78; - puVar1 = wil_details_FeatureReporting_RecordUsageInCache - (local_48,(uint *)&Feature_1390216506__private_reporting,param_3, - (uint)((ulonglong)param_2 >> 0x20)); - local_20 = *(undefined8 *)(puVar1 + 4); - if ((((uint)param_2 >> 10 & 1) != 0) && ((int)param_3 != 0xfe)) { - wil_RtlStagingConfig_RecordFeatureUsage(0x31de9ca,(short)param_3,(uint)param_2 >> 0xb & 1); - } - return (int)local_20 == 0; -} - ``` ## wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |fullname|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |refcount|3| |length|263| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil_details_GetCurrentFeatureEnabledState| |calling|wil_details_GetCurrentFeatureEnabledState
wil_details_IsEnabledFallback| |paramcount|3| |address|180020744| |sig|ulonglong __fastcall wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(uint * param_1, ulonglong param_2, longlong param_3)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState +++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState @@ -1,68 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ - -ulonglong wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (uint *param_1,ulonglong param_2,longlong param_3) - -{ - int iVar1; - uint uVar2; - ulonglong uVar3; - uint uVar4; - uint uVar5; - ulonglong uVar6; - bool bVar7; - uint local_res8 [2]; - undefined8 local_res10; - - iVar1 = 0; - local_res8[0] = 0; - local_res10 = param_2; - if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) { - iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)(); - } - uVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,local_res8); - if (*(char *)(param_3 + 0x1c) == '\0') { - local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0); - } - uVar3 = param_2 & 0xffffffff; - do { - uVar6 = param_2; - uVar5 = (uint)uVar3; - local_res10 = CONCAT44(local_res10._4_4_,uVar5); - if ((local_res8[0] != 0) && (local_res10 = CONCAT44(local_res10._4_4_,uVar5), (uVar3 & 2) == 0)) - { - uVar4 = uVar5 & 0xfffff63e | uVar2 & 0x9c1; - uVar5 = uVar4 | 2; - local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 2; - } - if ((uVar6 & 4) == 0) { - uVar4 = uVar2 & 0x400 | uVar5 & 0xfffffbff; - uVar5 = uVar4 | 4; - local_res10 = CONCAT44(local_res10._4_4_,uVar4) | 4; - } - uVar3 = uVar6 & 0xffffffff; - LOCK(); - uVar4 = *param_1; - bVar7 = (uint)uVar6 == uVar4; - if (bVar7) { - *param_1 = uVar5; - } - else { - uVar3 = (ulonglong)uVar4; - } - UNLOCK(); - param_2 = uVar3; - } while (!bVar7); - if (((uVar6 & 4) == 0) && - (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) { - (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges) - (param_1,*(undefined1 *)(param_3 + 0x1c),iVar1); - } - if (local_res8[0] == 0) { - local_res10 = CONCAT44(local_res10._4_4_,uVar2 & 0x9c1 | uVar5 & 0xfffff63e); - } - return local_res10; -} - ``` ## wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |fullname|wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |refcount|1| |length|76| |called|| |calling|wil_details_IsEnabledFallback| |paramcount|2| |address|180020854| |sig|undefined __fastcall wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath +++ wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath @@ -1,41 +0,0 @@ - -void wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath(uint param_1,int param_2) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - bool bVar4; - - if (param_2 == 3) { - uVar3 = 0x10; - } - else { - if (param_2 != 4) { - return; - } - uVar3 = 0x20; - } - if ((Feature_1390216506__private_featureState & 2) != 0) { - uVar2 = Feature_1390216506__private_featureState; - while ((uVar2 & 1) == (param_1 & 1)) { - LOCK(); - bVar4 = uVar2 == Feature_1390216506__private_featureState; - uVar1 = uVar3 | uVar2; - if (!bVar4) { - uVar2 = Feature_1390216506__private_featureState; - uVar1 = Feature_1390216506__private_featureState; - } - Feature_1390216506__private_featureState = uVar1; - UNLOCK(); - if (bVar4) { - return; - } - if ((uVar2 & 2) == 0) { - return; - } - } - } - return; -} - ``` ## wil_details_GetCurrentFeatureEnabledState ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_GetCurrentFeatureEnabledState| |fullname|wil_details_GetCurrentFeatureEnabledState| |refcount|2| |length|343| |called|wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |calling|wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState| |paramcount|2| |address|1800208a8| |sig|uint __fastcall wil_details_GetCurrentFeatureEnabledState(longlong param_1, undefined4 * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_GetCurrentFeatureEnabledState +++ wil_details_GetCurrentFeatureEnabledState @@ -1,73 +0,0 @@ - -uint wil_details_GetCurrentFeatureEnabledState(longlong param_1,undefined4 *param_2) - -{ - char cVar1; - undefined8 *puVar2; - int iVar3; - uint uVar4; - ulonglong uVar5; - uint uVar6; - longlong *plVar7; - uint local_res8; - ulonglong local_res10; - uint local_28 [8]; - - cVar1 = *(char *)(param_1 + 0x1c); - *param_2 = 1; - local_28[4] = 0; - local_28[5] = 0; - local_28[0] = 0; - local_28[1] = 0; - local_28[2] = 0; - local_28[3] = 0; - iVar3 = wil_RtlStagingConfig_QueryFeatureState - (local_28,*(undefined4 *)(param_1 + 0x18),(uint)((byte)(cVar1 - 2U) < 2), - (uint *)0x0); - uVar4 = -(uint)(iVar3 != 0) & local_28[0] & 3; - if (uVar4 == 0) { - uVar6 = -(uint)(*(char *)(param_1 + 0x1f) != '\0') & 0x40; - } - else { - uVar6 = 0; - if (local_28[0] == 2) { - uVar6 = 0x40; - } - } - local_res8 = uVar6 >> 6 ^ - (uVar4 << 7 | -(uint)(local_28[5] != 0) & 0x800 | -(uint)(local_28[4] != 0) & 0x400 | - uVar6); - if ((uVar6 != 0) && (plVar7 = *(longlong **)(param_1 + 0x20), plVar7 != (longlong *)0x0)) { - do { - puVar2 = (undefined8 *)*plVar7; - if (puVar2 == (undefined8 *)0x0) { - return local_res8; - } - if ((*(char *)((longlong)puVar2 + 0x1e) == '\0') && - (*(char *)((longlong)puVar2 + 0x1d) == '\0')) { - uVar6 = *(uint *)*puVar2; - local_res10 = (ulonglong)uVar6; - if ((uVar6 & 2) == 0) { - uVar5 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - ((uint *)*puVar2,local_res10,(longlong)puVar2); - uVar6 = (uint)uVar5; - } - uVar4 = local_res8 & 0xfffffffe; - local_res8 = (uint)((uVar6 & local_res8 & 1) != 0); - } - else { - if (((local_res8 & 1) == 0) || (*(char *)((longlong)puVar2 + 0x1f) == '\0')) { - uVar4 = 0; - } - else { - uVar4 = 1; - } - local_res8 = local_res8 & 0xfffffffe; - } - local_res8 = local_res8 | uVar4; - plVar7 = plVar7 + 1; - } while ((local_res8 & 1) != 0); - } - return local_res8; -} - ``` ## wil_details_IsEnabledFallback ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_IsEnabledFallback| |fullname|wil_details_IsEnabledFallback| |refcount|2| |length|135| |called|wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath| |calling|Feature_1390216506__private_IsEnabledDeviceUsageNoInline| |paramcount|2| |address|180020a54| |sig|uint __fastcall wil_details_IsEnabledFallback(undefined4 * param_1, uint param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_IsEnabledFallback +++ wil_details_IsEnabledFallback @@ -1,26 +0,0 @@ - -uint wil_details_IsEnabledFallback(undefined4 *param_1,uint param_2) - -{ - uint uVar1; - undefined4 *puVar2; - ulonglong local_res18; - - uVar1 = (uint)param_1; - local_res18 = (ulonglong)param_1 & 0xffffffff; - if (((ulonglong)param_1 & 2) == 0) { - puVar2 = &Feature_1390216506__private_featureState; - local_res18 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState - (&Feature_1390216506__private_featureState,(ulonglong)param_1, - 0x180053348); - param_1 = puVar2; - uVar1 = (uint)local_res18; - } - if ((param_2 != 0) && - (wil_details_FeatureReporting_ReportUsageToService(param_1,local_res18,param_2), - param_2 - 3 < 2)) { - wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath((uint)local_res18,param_2); - } - return uVar1 & 1; -} - ``` ## wil_details_MapReportingKind ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_MapReportingKind| |fullname|wil_details_MapReportingKind| |refcount|1| |length|144| |called|| |calling|wil_details_FeatureReporting_ReportUsageToService| |paramcount|2| |address|180020ae4| |sig|uint __fastcall wil_details_MapReportingKind(int param_1, int param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_MapReportingKind +++ wil_details_MapReportingKind @@ -1,33 +0,0 @@ - -uint wil_details_MapReportingKind(int param_1,int param_2) - -{ - byte bVar1; - - if (param_1 != 0) { - if (param_1 == 1) { - return ~-(uint)(param_2 != 0) & 4; - } - if (param_1 == 2) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 5; - } - if (param_1 == 3) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 6; - } - if (param_1 == 4) { - return (-(uint)(param_2 != 0) & 0xfffffffc) + 7; - } - if (param_1 == 5) { - return (-(uint)(param_2 != 0) & 0xfffffffe) + 10; - } - if (param_1 == 6) { - return (-(uint)(param_2 != 0) & 0xfffffffe) + 0xb; - } - bVar1 = (char)param_1 + 0x9c; - if (bVar1 < 0x32) { - return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1; - } - } - return 0xff; -} - ``` ## wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |refcount|3| |length|22| |called|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |calling|wil::details::EnabledStateManager::~EnabledStateManager| |paramcount|1| |address|180038bc8| |sig|void __thiscall ~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>(unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> +++ wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> @@ -1,30 +0,0 @@ - -/* public: __cdecl wil::details::unique_storage,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct - FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,0,std::nullptr_t> >::~unique_storage,struct FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,struct - FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64,0,std::nullptr_t> >(void) __ptr64 */ - -void __thiscall -wil::details:: -unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> -:: -~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - (unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - *this) - -{ - if (*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this != (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *)0x0) { - WilApi_UnsubscribeFeatureStateChangeNotification(*(FEATURE_STATE_CHANGE_SUBSCRIPTION__ **)this); - } - return; -} - ``` ## wil::details::EnabledStateManager::~EnabledStateManager ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|~EnabledStateManager| |fullname|wil::details::EnabledStateManager::~EnabledStateManager| |refcount|2| |length|190| |called|wil::details::FreeProcessHeap
wil::details::WilApi_RecordFeatureUsage
wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>
wil_details_RecordCachedUsage| |calling|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|1| |address|180038cfc| |sig|void __thiscall ~EnabledStateManager(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::~EnabledStateManager +++ wil::details::EnabledStateManager::~EnabledStateManager @@ -1,53 +0,0 @@ - -/* public: __cdecl wil::details::EnabledStateManager::~EnabledStateManager(void) __ptr64 */ - -void __thiscall wil::details::EnabledStateManager::~EnabledStateManager(EnabledStateManager *this) - -{ - undefined4 *puVar1; - void *pvVar2; - undefined4 *puVar3; - char *in_R9; - - *this = (EnabledStateManager)0x0; - unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> - ::reset((unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> - *)(this + 0x10),(_TP_TIMER *)0x0); - *this = (EnabledStateManager)0x0; - puVar1 = *(undefined4 **)(this + 0x38); - puVar3 = *(undefined4 **)(this + 0x30); - if (0xf < (ulonglong)((longlong)puVar1 - (longlong)puVar3)) { - for (; puVar3 != puVar1; puVar3 = puVar3 + 4) { - wil_details_RecordCachedUsage(*puVar3,*(uint **)(puVar3 + 2)); - } - *(undefined8 *)(this + 0x38) = *(undefined8 *)(this + 0x30); - WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); - } - pvVar2 = *(void **)(this + 0x68); - *(undefined8 *)(this + 0x68) = 0; - if (pvVar2 != (void *)0x0) { - FreeProcessHeap(pvVar2); - } - pvVar2 = *(void **)(this + 0x48); - *(undefined8 *)(this + 0x48) = 0; - if (pvVar2 != (void *)0x0) { - FreeProcessHeap(pvVar2); - } - unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - ((unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - *)(this + 0x28)); - unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - ((unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_> - *)(this + 0x20)); - unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> - ((unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> - *)(this + 0x10)); - return; -} - ``` ## wil::details::EnsureSubscribedToFeatureConfigurationChanges ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |refcount|3| |length|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |calling|| |paramcount|0| |address|18003a760| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges @@ -1,16 +0,0 @@ - -/* unsigned int __cdecl wil::details::EnsureSubscribedToFeatureConfigurationChanges(void) */ - -uint __cdecl wil::details::EnsureSubscribedToFeatureConfigurationChanges(void) - -{ - uint uVar1; - - uVar1 = DAT_1800563c4; - if (DAT_1800563c4 == 0) { - uVar1 = EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl - ((EnabledStateManager *)&g_enabledStateManager); - } - return uVar1; -} - ``` ## wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChangesImpl| |fullname|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |refcount|2| |length|150| |called|KERNEL32.DLL::AcquireSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |paramcount|1| |address|18003a788| |sig|uint __thiscall EnsureSubscribedToFeatureConfigurationChangesImpl(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl +++ wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl @@ -1,54 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* private: unsigned int __cdecl - wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl(void) - __ptr64 */ - -uint __thiscall -wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl - (EnabledStateManager *this) - -{ - EnabledStateManager *SRWLock; - EnabledStateManager *pEVar1; - code *pcVar2; - uint uVar3; - EnabledStateManager *local_res8; - - if (*this == (EnabledStateManager)0x0) { - uVar3 = 0; - } - else { - SRWLock = this + 8; - AcquireSRWLockExclusive((PSRWLOCK)SRWLock); - pEVar1 = this + 0x20; - local_res8 = SRWLock; - if (*(longlong *)pEVar1 == 0) { - *(longlong *)pEVar1 = 0; - pcVar2 = g_wil_details_internalSubscribeFeatureStateChangeNotification; - if ((g_wil_details_internalSubscribeFeatureStateChangeNotification != (code *)0x0) || - (pcVar2 = g_wil_details_apiSubscribeFeatureStateChangeNotification, - g_wil_details_apiSubscribeFeatureStateChangeNotification != (code *)0x0)) { - (*pcVar2)(pEVar1,::,this); - } - if (*(longlong *)pEVar1 == 0) { - uVar3 = 0; - } - else { - uVar3 = 1; - *(undefined4 *)(this + 0x1c) = 1; - } - } - else { - uVar3 = *(uint *)(this + 0x1c); - } - unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - ((unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - *)&local_res8); - } - return uVar3; -} - ``` ## wil::details::EnabledStateManager::OnStateChange ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|OnStateChange| |fullname|wil::details::EnabledStateManager::OnStateChange| |refcount|2| |length|132| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |calling|| |paramcount|1| |address|18003c7dc| |sig|void __thiscall OnStateChange(EnabledStateManager * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::OnStateChange +++ wil::details::EnabledStateManager::OnStateChange @@ -1,35 +0,0 @@ - -/* public: void __cdecl wil::details::EnabledStateManager::OnStateChange(void) __ptr64 */ - -void __thiscall wil::details::EnabledStateManager::OnStateChange(EnabledStateManager *this) - -{ - int *piVar1; - int iVar2; - int *piVar3; - EnabledStateManager *local_res8; - - if (*this != (EnabledStateManager)0x0) { - AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); - piVar1 = *(int **)(this + 0x58); - for (piVar3 = *(int **)(this + 0x50); piVar3 != piVar1; piVar3 = piVar3 + 4) { - LOCK(); - **(uint **)(piVar3 + 2) = **(uint **)(piVar3 + 2) & (-(uint)(*piVar3 != 0) & 0x83a) - 0x83f; - UNLOCK(); - } - *(undefined8 *)(this + 0x58) = *(undefined8 *)(this + 0x50); - iVar2 = 1; - if (*(int *)(this + 0x1c) + 1 != 0) { - iVar2 = *(int *)(this + 0x1c) + 1; - } - *(int *)(this + 0x1c) = iVar2; - local_res8 = this + 8; - unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - ((unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - *)&local_res8); - } - return; -} - ``` ## wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges| |refcount|2| |length|156| |called|KERNEL32.DLL::AcquireSRWLockExclusive
wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |paramcount|4| |address|18003e524| |sig|void __thiscall SubscribeFeatureStateCacheToConfigurationChanges(EnabledStateManager * this, wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges +++ wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges @@ -1,42 +0,0 @@ - -/* public: void __cdecl - wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges(union - wil_details_FeatureStateCache * __ptr64,enum wil_FeatureChangeTime,unsigned int) __ptr64 */ - -void __thiscall -wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges - (EnabledStateManager *this,wil_details_FeatureStateCache *param_1, - wil_FeatureChangeTime param_2,uint param_3) - -{ - EnabledStateManager *SRWLock; - bool bVar1; - EnabledStateManager *local_res8; - wil_FeatureChangeTime local_28 [2]; - wil_details_FeatureStateCache *local_20; - - if (*this == (EnabledStateManager)0x0) { - return; - } - SRWLock = this + 8; - AcquireSRWLockExclusive((PSRWLOCK)SRWLock); - local_res8 = SRWLock; - if ((param_3 != 0) && (param_3 == *(uint *)(this + 0x1c))) { - local_28[1] = 0; - local_28[0] = param_2; - local_20 = param_1; - bVar1 = details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x50),local_28,0x10); - if (bVar1) goto LAB_18003e5a3; - } - LOCK(); - *(uint *)param_1 = *(uint *)param_1 & (-(uint)(param_2 != 0) & 0x83a) - 0x83f; - UNLOCK(); -LAB_18003e5a3: - unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - :: - ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - ((unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> - *)&local_res8); - return; -} - ``` ## wil::details::SubscribeFeatureStateCacheToConfigurationChanges ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |refcount|2| |length|21| |called|wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges| |calling|| |paramcount|3| |address|18003e5d0| |sig|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::SubscribeFeatureStateCacheToConfigurationChanges +++ wil::details::SubscribeFeatureStateCacheToConfigurationChanges @@ -1,14 +0,0 @@ - -/* void __cdecl wil::details::SubscribeFeatureStateCacheToConfigurationChanges(union - wil_details_FeatureStateCache * __ptr64,enum wil_FeatureChangeTime,unsigned int) */ - -void __cdecl -wil::details::SubscribeFeatureStateCacheToConfigurationChanges - (wil_details_FeatureStateCache *param_1,wil_FeatureChangeTime param_2,uint param_3) - -{ - EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges - ((EnabledStateManager *)&g_enabledStateManager,param_1,param_2,param_3); - return; -} - ``` ## wil::details::WilApi_RecordFeatureUsage ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsage| |fullname|wil::details::WilApi_RecordFeatureUsage| |refcount|4| |length|41| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::WilApi_RecordFeatureUsageReports
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|4| |address|18003f078| |sig|void __cdecl WilApi_RecordFeatureUsage(uint param_1, uint param_2, uint param_3, char * param_4)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_RecordFeatureUsage +++ wil::details::WilApi_RecordFeatureUsage @@ -1,21 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* void __cdecl wil::details::WilApi_RecordFeatureUsage(unsigned int,unsigned int,unsigned int,char - const * __ptr64) */ - -void __cdecl -wil::details::WilApi_RecordFeatureUsage(uint param_1,uint param_2,uint param_3,char *param_4) - -{ - code *pcVar1; - - pcVar1 = g_wil_details_internalRecordFeatureUsage; - if ((g_wil_details_internalRecordFeatureUsage != (code *)0x0) || - (pcVar1 = g_wil_details_apiRecordFeatureUsage, - g_wil_details_apiRecordFeatureUsage != (code *)0x0)) { - (*pcVar1)(); - } - return; -} - ``` ## wil::details::WilApi_RecordFeatureUsageReports ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|WilApi_RecordFeatureUsageReports| |fullname|wil::details::WilApi_RecordFeatureUsageReports| |refcount|2| |length|59| |called|wil::details::WilApi_RecordFeatureUsage| |calling|wil_details_RecordCachedUsage| |paramcount|2| |address|18003f0a8| |sig|void __cdecl WilApi_RecordFeatureUsageReports(__WIL_RTL_FEATURE_USAGE_DATA * param_1, __uint64 param_2)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_RecordFeatureUsageReports +++ wil::details::WilApi_RecordFeatureUsageReports @@ -1,25 +0,0 @@ - -/* void __cdecl wil::details::WilApi_RecordFeatureUsageReports(struct __WIL_RTL_FEATURE_USAGE_DATA * - __ptr64,unsigned __int64) */ - -void __cdecl -wil::details::WilApi_RecordFeatureUsageReports - (__WIL_RTL_FEATURE_USAGE_DATA *param_1,__uint64 param_2) - -{ - __WIL_RTL_FEATURE_USAGE_DATA *p_Var1; - char *in_R9; - - if (param_2 != 0) { - p_Var1 = param_1 + 4; - do { - WilApi_RecordFeatureUsage - (*(uint *)(p_Var1 + -4),(uint)*(ushort *)p_Var1,(uint)*(ushort *)(p_Var1 + 2),in_R9) - ; - p_Var1 = p_Var1 + 8; - param_2 = param_2 - 1; - } while (param_2 != 0); - } - return; -} - ``` ## wil::details::WilApi_UnsubscribeFeatureStateChangeNotification ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|WilApi_UnsubscribeFeatureStateChangeNotification| |fullname|wil::details::WilApi_UnsubscribeFeatureStateChangeNotification| |refcount|2| |length|38| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>::~unique_storage,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,FEATURE_STATE_CHANGE_SUBSCRIPTION__*___ptr64,0,std::nullptr_t>_>| |paramcount|1| |address|18003f0ec| |sig|void __cdecl WilApi_UnsubscribeFeatureStateChangeNotification(FEATURE_STATE_CHANGE_SUBSCRIPTION__ * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_UnsubscribeFeatureStateChangeNotification +++ wil::details::WilApi_UnsubscribeFeatureStateChangeNotification @@ -1,22 +0,0 @@ - -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ -/* void __cdecl wil::details::WilApi_UnsubscribeFeatureStateChangeNotification(struct - FEATURE_STATE_CHANGE_SUBSCRIPTION__ * __ptr64) */ - -void __cdecl -wil::details::WilApi_UnsubscribeFeatureStateChangeNotification - (FEATURE_STATE_CHANGE_SUBSCRIPTION__ *param_1) - -{ - code *pcVar1; - - pcVar1 = g_wil_details_internalUnsubscribeFeatureStateChangeNotification; - if ((g_wil_details_internalUnsubscribeFeatureStateChangeNotification != (code *)0x0) || - (pcVar1 = g_wil_details_apiUnsubscribeFeatureStateChangeNotification, - g_wil_details_apiUnsubscribeFeatureStateChangeNotification != (code *)0x0)) { - (*pcVar1)(); - } - return; -} - ``` ## wil_details_RecordCachedUsage ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|wil_details_RecordCachedUsage| |fullname|wil_details_RecordCachedUsage| |refcount|3| |length|324| |called|__security_check_cookie
wil::details::WilApi_RecordFeatureUsageReports| |calling|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |paramcount|2| |address|180040980| |sig|undefined __fastcall wil_details_RecordCachedUsage(undefined4 param_1, uint * param_2)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil_details_RecordCachedUsage +++ wil_details_RecordCachedUsage @@ -1,90 +0,0 @@ - -/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ - -void wil_details_RecordCachedUsage(undefined4 param_1,uint *param_2) - -{ - uint uVar1; - uint uVar2; - uint uVar3; - uint uVar4; - undefined4 *puVar5; - __uint64 _Var6; - bool bVar7; - undefined1 auStack_68 [32]; - undefined4 local_48; - short local_44 [2]; - undefined4 local_40 [10]; - ulonglong local_18; - - local_18 = __security_cookie ^ (ulonglong)auStack_68; - uVar2 = *param_2; - do { - LOCK(); - uVar4 = *param_2; - bVar7 = uVar2 == uVar4; - if (bVar7) { - *param_2 = uVar2 & 0xffc0401e; - uVar4 = uVar2; - } - uVar2 = uVar4; - UNLOCK(); - } while (!bVar7); - uVar3 = uVar2 >> 1 & 0xf; - uVar4 = 0; - if (uVar3 != 0) { - uVar4 = param_2[1]; - do { - LOCK(); - uVar1 = param_2[1]; - bVar7 = uVar4 == uVar1; - if (bVar7) { - param_2[1] = uVar4 | uVar3; - uVar1 = uVar4; - } - uVar4 = uVar1; - UNLOCK(); - } while (!bVar7); - uVar4 = uVar3 & ~uVar4; - } - puVar5 = &local_48; - if ((uVar4 & 1) != 0) { - puVar5 = local_40; - local_44[0] = 2; - local_44[1] = 1; - local_48 = param_1; - } - if ((uVar4 & 2) != 0) { - *puVar5 = param_1; - puVar5[1] = 0x10006; - puVar5 = puVar5 + 2; - } - if ((uVar4 & 4) != 0) { - *puVar5 = param_1; - puVar5[1] = 0x10003; - puVar5 = puVar5 + 2; - } - if (7 < uVar4) { - *puVar5 = param_1; - puVar5[1] = 0x10007; - puVar5 = puVar5 + 2; - } - if ((uVar2 >> 5 & 0x1ff) != 0) { - *puVar5 = param_1; - *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 5) & 0x1ff; - *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0xe) & 1) << 2; - puVar5 = puVar5 + 2; - } - if ((uVar2 >> 0xf & 0x7f) != 0) { - *puVar5 = param_1; - *(ushort *)((longlong)puVar5 + 6) = (ushort)(uVar2 >> 0xf) & 0x7f; - *(ushort *)(puVar5 + 1) = ((ushort)(uVar2 >> 0x16) & 1) * 4 + 1; - puVar5 = puVar5 + 2; - } - _Var6 = (longlong)puVar5 - (longlong)&local_48 >> 3; - if (0 < (longlong)_Var6) { - wil::details::WilApi_RecordFeatureUsageReports((__WIL_RTL_FEATURE_USAGE_DATA *)&local_48,_Var6); - } - return; -} - ``` ## wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' ### Function Meta |Key|tapisrv-02.dll| | :---: | :---: | |name|`dynamic_atexit_destructor_for_'g_enabledStateManager''| |fullname|wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''| |refcount|3| |length|128| |called|wil::ProcessShutdownInProgress
wil::details::EnabledStateManager::~EnabledStateManager
wil::details::WilApi_RecordFeatureUsage
wil_details_RecordCachedUsage| |calling|| |paramcount|0| |address|180043400| |sig|undefined __fastcall `dynamic_atexit_destructor_for_'g_enabledStateManager''(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' +++ wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' @@ -1,28 +0,0 @@ - -void wil::details::_dynamic_atexit_destructor_for__g_enabledStateManager__(void) - -{ - undefined4 *puVar1; - bool bVar2; - undefined4 *puVar3; - char *in_R9; - - bVar2 = ProcessShutdownInProgress(); - puVar1 = DAT_1800563e0; - if (bVar2) { - g_enabledStateManager = (shutdown_aware_object)0x0; - puVar3 = DAT_1800563d8; - if (0xf < (ulonglong)((longlong)DAT_1800563e0 - (longlong)DAT_1800563d8)) { - for (; puVar3 != puVar1; puVar3 = puVar3 + 4) { - wil_details_RecordCachedUsage(*puVar3,*(uint **)(puVar3 + 2)); - } - DAT_1800563e0 = DAT_1800563d8; - WilApi_RecordFeatureUsage(0,0xfe,0,in_R9); - } - } - else { - EnabledStateManager::~EnabledStateManager((EnabledStateManager *)&g_enabledStateManager); - } - return; -} - ``` # Added # Modified *Modified functions contain code changes* ## GetMediaModesPriorityLists ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.64| |i_ratio|0.45| |m_ratio|0.96| |b_ratio|0.88| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|GetMediaModesPriorityLists|GetMediaModesPriorityLists| |fullname|GetMediaModesPriorityLists|GetMediaModesPriorityLists| |refcount|2|2| |`length`|639|643| |`called`|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegEnumValueW
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
Feature_1390216506__private_IsEnabledDeviceUsageNoInline
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::_wtol
ServerFree
TRACELogPrint
memcpy|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegEnumValueW
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::_wtol
ServerFree
TRACELogPrint
memcpy| |calling|ClientAttach|ClientAttach| |paramcount|4|4| |`address`|18002b9f0|18002af90| |sig|undefined __fastcall GetMediaModesPriorityLists(HKEY param_1, longlong * param_2, undefined8 param_3, wchar_t * param_4)|undefined __fastcall GetMediaModesPriorityLists(HKEY param_1, longlong * param_2, undefined8 param_3, wchar_t * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### GetMediaModesPriorityLists Called Diff ```diff --- GetMediaModesPriorityLists called +++ GetMediaModesPriorityLists called @@ -3 +2,0 @@ -Feature_1390216506__private_IsEnabledDeviceUsageNoInline ``` ### GetMediaModesPriorityLists Diff ```diff --- GetMediaModesPriorityLists +++ GetMediaModesPriorityLists @@ -1,94 +1,83 @@ void GetMediaModesPriorityLists(HKEY param_1,longlong *param_2,undefined8 param_3,wchar_t *param_4) { LSTATUS LVar1; long lVar2; - uint uVar3; LPWSTR lpValueName; LPVOID _Dst; wchar_t *_Str; - char *pcVar4; - ulonglong uVar5; + char *pcVar3; + ulonglong uVar4; LPWSTR dwBytes; DWORD local_res18 [2]; DWORD local_res20 [2]; - wchar_t local_48 [8]; + wchar_t local_38 [8]; - uVar5 = 0; + uVar4 = 0; local_res20[0] = 0x14; - local_48[0] = L'\0'; - local_48[1] = L'\0'; + local_38[0] = L'\0'; + local_38[1] = L'\0'; local_res18[0] = 0; dwBytes = (LPWSTR)0x28; lpValueName = HeapAlloc(ghTapisrvHeap,8,0x28); if (lpValueName != (LPWSTR)0x0) { - for (; DAT_0 != DAT_180056ec4; DAT_0 = DAT_0 + 1) { + for (; DAT_0 != DAT_180054e04; DAT_0 = DAT_0 + 1) { LAB_1: local_res20[0] = 0x14; - LVar1 = RegEnumValueW(param_1,(DWORD)uVar5,lpValueName,local_res20,(LPDWORD)0x0,(LPDWORD)0x0, + LVar1 = RegEnumValueW(param_1,(DWORD)uVar4,lpValueName,local_res20,(LPDWORD)0x0,(LPDWORD)0x0, (LPBYTE)0x0,(LPDWORD)0x0); if (LVar1 != 0) goto LAB_2; lVar2 = _wtol(lpValueName); - param_4 = local_48; + param_4 = local_38; dwBytes = (LPWSTR)0x0; - *(long *)(*param_2 + uVar5 * 0x10) = lVar2; + *(long *)(*param_2 + uVar4 * 0x10) = lVar2; LVar1 = RegQueryValueExW(param_1,lpValueName,(LPDWORD)0x0,(LPDWORD)param_4,(LPBYTE)0x0, local_res18); - if (((LVar1 == 0) && (local_res18[0] != 0)) && - ((uVar3 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(), uVar3 == 0 || - (local_res18[0] <= local_res18[0] + 2)))) { + if (((LVar1 == 0) && (local_res18[0] != 0)) && (local_res18[0] <= local_res18[0] + 2)) { dwBytes = (LPWSTR)(ulonglong)(local_res18[0] + 2); _Str = HeapAlloc(ghTapisrvHeap,8,(SIZE_T)dwBytes); if (_Str != (wchar_t *)0x0) { *_Str = L'\"'; dwBytes = (LPWSTR)0x0; - param_4 = local_48; + param_4 = local_38; LVar1 = RegQueryValueExW(param_1,lpValueName,(LPDWORD)0x0,(LPDWORD)param_4, (LPBYTE)(_Str + 1),local_res18); - if (LVar1 == 0) { - uVar3 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if (uVar3 != 0) { - if (local_res18[0] < 2) goto LAB_3; - *(undefined2 *) - ((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) = 0; - } + if ((LVar1 == 0) && (1 < local_res18[0])) { + *(undefined2 *) + ((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) = 0; _wcsupr(_Str); - *(wchar_t **)(*param_2 + 8 + uVar5 * 0x10) = _Str; + *(wchar_t **)(*param_2 + 8 + uVar4 * 0x10) = _Str; dwBytes = lpValueName; TRACELogPrint(0x40002,"PriList: %ls=%ls",lpValueName,_Str); param_4 = _Str; } else { - uVar3 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if (uVar3 != 0) { -LAB_3: - ServerFree(_Str); - } + ServerFree(_Str); } } } - uVar5 = (ulonglong)((DWORD)uVar5 + 1); + uVar4 = (ulonglong)((DWORD)uVar4 + 1); } - if ((ulonglong)DAT_4 << 5 < 0x100000000) { - dwBytes = (LPWSTR)((ulonglong)DAT_4 << 5 & 0xffffffff); + if ((ulonglong)DAT_3 << 5 < 0x100000000) { + dwBytes = (LPWSTR)((ulonglong)DAT_3 << 5 & 0xffffffff); _Dst = HeapAlloc(ghTapisrvHeap,8,(SIZE_T)dwBytes); if (_Dst != (LPVOID)0x0) { - memcpy(_Dst,(void *)*param_2,(ulonglong)DAT_4 << 4); + memcpy(_Dst,(void *)*param_2,(ulonglong)DAT_3 << 4); ServerFree((LPVOID)*param_2); *param_2 = (longlong)_Dst; - DAT_4 = DAT_4 * 2; + DAT_3 = DAT_3 * 2; goto LAB_1; } - pcVar4 = "ServerAlloc failed in GetMediaModesPriorityLists 2"; + pcVar3 = "ServerAlloc failed in GetMediaModesPriorityLists 2"; } else { - pcVar4 = "overflow while trying GetMediaModesPriorityLists 2"; + pcVar3 = "overflow while trying GetMediaModesPriorityLists 2"; } - TRACELogPrint(0x10002,pcVar4,dwBytes,param_4); + TRACELogPrint(0x10002,pcVar3,dwBytes,param_4); LAB_2: ServerFree(lpValueName); } return; } ``` ## wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.55| |i_ratio|0.11| |m_ratio|0.78| |b_ratio|0.78| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''|`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |fullname|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''|wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''| |refcount|2|2| |`length`|71|43| |called||| |calling||| |paramcount|0|0| |`address`|1800010d0|1800010b0| |sig|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)|undefined __fastcall `dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi''(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' Diff ```diff --- wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' +++ wil::details::`dynamic_initializer_for_'g_header_init_InitializeStagingHeaderInternalApi'' @@ -1,17 +1,15 @@ + +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void wil::details::_dynamic_initializer_for__g_header_init_InitializeStagingHeaderInternalApi__ (void) { - g_wil_details_ensureSubscribedToFeatureConfigurationChanges = - EnsureSubscribedToFeatureConfigurationChanges; - g_wil_details_subscribeFeatureStateCacheToConfigurationChanges = - SubscribeFeatureStateCacheToConfigurationChanges; - g_wil_details_internalRecordFeatureUsage = WilApiImpl_RecordFeatureUsage; - g_wil_details_internalSubscribeFeatureStateChangeNotification = + _g_wil_details_internalRecordFeatureUsage = WilApiImpl_RecordFeatureUsage; + _g_wil_details_internalSubscribeFeatureStateChangeNotification = WilApiImpl_SubscribeFeatureStateChangeNotification; - g_wil_details_internalUnsubscribeFeatureStateChangeNotification = + _g_wil_details_internalUnsubscribeFeatureStateChangeNotification = WilApiImpl_UnsubscribeFeatureStateChangeNotification; return; } ``` ## LSetAppPriority ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.54| |i_ratio|0.36| |m_ratio|1.0| |b_ratio|0.59| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|LSetAppPriority|LSetAppPriority| |fullname|LSetAppPriority|LSetAppPriority| |refcount|3|3| |`length`|1224|1210| |`called`|
Expand for full list:
Feature_1390216506__private_IsEnabledDeviceUsageNoInline
GetPriorityListTReqCall
IsBadStringParam
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::lstrlenW
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::wcsstr
ServerFree
SetPriorityListTReqCallStringCbCatW
StringCbCopyNW
StringCbCopyW
TRACELogPrint
WstrToBufSize
__security_check_cookie
memcpy
memmove
|
Expand for full list:
GetPriorityListTReqCall
IsBadStringParam
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::HeapAlloc
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::lstrlenW
MSVCRT.DLL::_wcsupr
MSVCRT.DLL::wcsstr
ServerFree
SetPriorityListTReqCall
StringCbCatWStringCbCopyNW
StringCbCopyW
TRACELogPrint
WstrToBufSize
__security_check_cookie
memcpy
memmove
| |calling||| |paramcount|4|4| |`address`|180014920|1800148b0| |sig|undefined __fastcall LSetAppPriority(undefined8 param_1, uint * param_2, uint param_3, longlong param_4)|undefined __fastcall LSetAppPriority(undefined8 param_1, uint * param_2, uint param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### LSetAppPriority Called Diff ```diff --- LSetAppPriority called +++ LSetAppPriority called @@ -1 +0,0 @@ -Feature_1390216506__private_IsEnabledDeviceUsageNoInline ``` ### LSetAppPriority Diff ```diff --- LSetAppPriority +++ LSetAppPriority @@ -1,219 +1,210 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ void LSetAppPriority(undefined8 param_1,uint *param_2,uint param_3,longlong param_4) { undefined2 *_Dst; - longlong lVar1; + wchar_t *_Src; + uint uVar1; bool bVar2; uint uVar3; - uint uVar4; undefined7 extraout_var; - ulonglong uVar5; + ulonglong uVar4; LPVOID _Dst_00; - STRSAFE_LPWSTR ******pppppppwVar6; + STRSAFE_LPWSTR ******pppppppwVar5; STRSAFE_LPWSTR *****pszDest; - longlong lVar7; - int iVar8; + int iVar6; + undefined8 uVar7; + char *pcVar8; + STRSAFE_LPWSTR ******_Str; uint uVar9; undefined8 uVar10; - char *pcVar11; - STRSAFE_LPWSTR ******_Str; - wchar_t *pwVar12; - undefined8 uVar13; - ulonglong uVar14; - STRSAFE_LPWSTR ******pppppppwVar15; + longlong lVar11; + int iVar12; + STRSAFE_LPWSTR ******pppppppwVar13; undefined1 auStack_288 [32]; int local_268; - int local_264; + uint local_264; STRSAFE_LPWSTR *****local_260; WCHAR local_258; wchar_t local_256 [263]; ulonglong local_48; local_48 = __security_cookie ^ (ulonglong)auStack_288; - uVar4 = param_2[3]; + uVar3 = param_2[3]; uVar9 = param_2[6]; _Str = (STRSAFE_LPWSTR ******)0x0; - uVar3 = param_2[8]; - local_264 = 0; + uVar1 = param_2[8]; + local_268 = 0; local_260 = (STRSAFE_LPWSTR *****)0x0; bVar2 = IsBadStringParam(param_3,param_4,param_2[2]); if ((int)CONCAT71(extraout_var,bVar2) != 0) { LAB_0: *param_2 = 0x80000048; return; } - uVar5 = 0xffffffffffffffff; + lVar11 = -1; + uVar4 = 0xffffffffffffffff; do { - uVar5 = uVar5 + 1; - } while (((STRSAFE_PCNZWCH)((ulonglong)param_2[2] + param_4))[uVar5] != L'\0'); - uVar13 = 0x104; - if (0x104 < uVar5) goto LAB_0; - if (uVar4 == 0) { + uVar4 = uVar4 + 1; + } while (((STRSAFE_PCNZWCH)((ulonglong)param_2[2] + param_4))[uVar4] != L'\0'); + uVar10 = 0x104; + if (0x104 < uVar4) goto LAB_0; + if (uVar3 == 0) { if (1 < uVar9 - 1) { *param_2 = 0x80000038; goto LAB_1; } } - else if ((uVar4 & 0xffff0001) != 0) { + else if ((uVar3 & 0xffff0001) != 0) { *param_2 = 0x8000002f; goto LAB_1; } - if ((uVar3 & 0xfffffffe) != 0) { + if ((uVar1 & 0xfffffffe) != 0) { *param_2 = 0x80000032; goto LAB_1; } - if (((uVar4 & 0xffffff) == 0) && (uVar4 != 0)) goto LAB_1; - uVar10 = 0x20a; + if (((uVar3 & 0xffffff) == 0) && (uVar3 != 0)) goto LAB_1; + uVar7 = 0x20a; local_258 = L'\"'; StringCbCopyNW(local_256,0x20a,(STRSAFE_PCNZWCH)((ulonglong)param_2[2] + param_4),0x104); _wcsupr(local_256); - uVar3 = lstrlenW(&local_258); - uVar14 = (ulonglong)uVar3; + local_264 = lstrlenW(&local_258); EnterCriticalSection((LPCRITICAL_SECTION)&gPriorityListCritSec); - uVar5 = 0xffffffff; - if ((uVar4 & 0xffffff) == 0) { + uVar4 = 0xffffffff; + pppppppwVar13 = _Str; + if ((uVar3 & 0xffffff) == 0) { if (uVar9 == 1) { - GetPriorityListTReqCall(&local_260,uVar10,0xffffffff,uVar13); - pppppppwVar15 = &local_260; - local_264 = 1; + GetPriorityListTReqCall(&local_260,uVar7,0xffffffff,uVar10); + pppppppwVar13 = &local_260; _Str = (STRSAFE_LPWSTR ******)local_260; + iVar12 = 1; } else { - pppppppwVar15 = (STRSAFE_LPWSTR ******)&DAT_2; + pppppppwVar13 = (STRSAFE_LPWSTR ******)&DAT_2; _Str = DAT_2; + iVar12 = 0; } LAB_3: - pwVar12 = (wchar_t *)_Str; + pppppppwVar5 = _Str; if (_Str == (STRSAFE_LPWSTR ******)0x0) goto LAB_4; } else { - pppppppwVar15 = _Str; - if (DAT_5 != 0) { - do { - if (uVar4 == *(uint *)((longlong)pppppppwVar15 * 0x10 + (longlong)DAT_6)) { - pppppppwVar15 = - (STRSAFE_LPWSTR ******)((longlong)DAT_6 + (longlong)pppppppwVar15 * 0x10 + 8) - ; - _Str = (STRSAFE_LPWSTR ******)*pppppppwVar15; - goto LAB_3; - } - uVar9 = (int)pppppppwVar15 + 1; - pppppppwVar15 = (STRSAFE_LPWSTR ******)(ulonglong)uVar9; - } while (uVar9 < DAT_5); - } - pppppppwVar15 = _Str; + for (; (uint)pppppppwVar13 < DAT_5; + pppppppwVar13 = (STRSAFE_LPWSTR ******)(ulonglong)((uint)pppppppwVar13 + 1)) { + if (uVar3 == *(uint *)((longlong)pppppppwVar13 * 0x10 + (longlong)DAT_6)) { + pppppppwVar13 = + (STRSAFE_LPWSTR ******)((longlong)DAT_6 + (longlong)pppppppwVar13 * 0x10 + 8); + _Str = (STRSAFE_LPWSTR ******)*pppppppwVar13; + iVar12 = local_268; + goto LAB_3; + } + } if (param_2[8] != 0) { - if (DAT_5 == DAT_180056ec4) { + if (DAT_5 == DAT_180054e04) { if ((ulonglong)DAT_7 << 5 < 0x100000000) { - uVar5 = (ulonglong)DAT_7 << 5 & 0xffffffff; - _Dst_00 = HeapAlloc(ghTapisrvHeap,8,uVar5); + uVar4 = (ulonglong)DAT_7 << 5 & 0xffffffff; + _Dst_00 = HeapAlloc(ghTapisrvHeap,8,uVar4); if (_Dst_00 != (LPVOID)0x0) { - memcpy(_Dst_00,DAT_6,(ulonglong)DAT_180056ec0 << 4); + memcpy(_Dst_00,DAT_6,(ulonglong)DAT_180054e00 << 4); ServerFree(DAT_6); DAT_7 = DAT_7 * 2; DAT_6 = _Dst_00; goto LAB_8; } LeaveCriticalSection((LPCRITICAL_SECTION)&gPriorityListCritSec); - pcVar11 = "Alloc failed in LineSetAppPriority"; + pcVar8 = "Alloc failed in LineSetAppPriority"; } else { LeaveCriticalSection((LPCRITICAL_SECTION)&gPriorityListCritSec); - pcVar11 = "Multiplication Overflow in LineSetAppPriority"; - } - TRACELogPrint(0x10002,pcVar11,uVar5,uVar13); + pcVar8 = "Multiplication Overflow in LineSetAppPriority"; + } + TRACELogPrint(0x10002,pcVar8,uVar4,uVar10); *param_2 = 0x80000044; goto LAB_1; } LAB_8: - *(uint *)((longlong)DAT_6 + (ulonglong)DAT_180056ec0 * 0x10) = uVar4; - pppppppwVar15 = - (STRSAFE_LPWSTR ******)((longlong)DAT_6 + (ulonglong)DAT_180056ec0 * 0x10 + 8); + *(uint *)((longlong)DAT_6 + (ulonglong)DAT_180054e00 * 0x10) = uVar3; + pppppppwVar13 = + (STRSAFE_LPWSTR ******)((longlong)DAT_6 + (ulonglong)DAT_180054e00 * 0x10 + 8); DAT_5 = DAT_5 + 1; - _Str = (STRSAFE_LPWSTR ******)*pppppppwVar15; + _Str = (STRSAFE_LPWSTR ******)*pppppppwVar13; + iVar12 = local_268; goto LAB_3; } + iVar12 = 0; + pppppppwVar13 = _Str; LAB_4: - pwVar12 = L""; - } - TRACELogPrint(0x40002,"LSetAppPri: priList=%ls",pwVar12,uVar13); + pppppppwVar5 = (STRSAFE_LPWSTR ******)L""; + } + TRACELogPrint(0x40002,"LSetAppPri: priList=%ls",pppppppwVar5,uVar10); if (param_2[8] == 0) { if ((_Str != (STRSAFE_LPWSTR ******)0x0) && - (pppppppwVar6 = (STRSAFE_LPWSTR ******)wcsstr((wchar_t *)_Str,&local_258), - pppppppwVar6 != (STRSAFE_LPWSTR ******)0x0)) { - pwVar12 = (wchar_t *)((longlong)pppppppwVar6 + uVar14 * 2); - if (*pwVar12 == L'\0') { - if (pppppppwVar6 == _Str) { + (pppppppwVar5 = (STRSAFE_LPWSTR ******)wcsstr((wchar_t *)_Str,&local_258), + pppppppwVar5 != (STRSAFE_LPWSTR ******)0x0)) { + _Src = (wchar_t *)((longlong)pppppppwVar5 + (ulonglong)local_264 * 2); + if (*_Src == L'\0') { + if (pppppppwVar5 == _Str) { ServerFree(_Str); - *pppppppwVar15 = (STRSAFE_LPWSTR *****)0x0; + *pppppppwVar13 = (STRSAFE_LPWSTR *****)0x0; } else { - *(wchar_t *)pppppppwVar6 = L'\0'; + *(wchar_t *)pppppppwVar5 = L'\0'; } } else { - lVar7 = -1; do { - lVar7 = lVar7 + 1; - } while (*(wchar_t *)((longlong)pppppppwVar6 + lVar7 * 2) != L'\0'); - uVar4 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if (uVar4 == 0) { - lVar1 = -uVar14; - } - else { - lVar1 = uVar14 * -2; - } - memmove(pppppppwVar6,pwVar12,lVar7 * 2 + 2 + lVar1); + lVar11 = lVar11 + 1; + } while (*(wchar_t *)((longlong)pppppppwVar5 + lVar11 * 2) != L'\0'); + memmove(pppppppwVar5,_Src,(lVar11 + (1 - (ulonglong)local_264)) * 2); } } } else if ((_Str == (STRSAFE_LPWSTR ******)0x0) || - (pppppppwVar6 = (STRSAFE_LPWSTR ******)wcsstr((wchar_t *)_Str,&local_258), - pppppppwVar6 == (STRSAFE_LPWSTR ******)0x0)) { + (pppppppwVar5 = (STRSAFE_LPWSTR ******)wcsstr((wchar_t *)_Str,&local_258), + uVar3 = local_264, pppppppwVar5 == (STRSAFE_LPWSTR ******)0x0)) { local_268 = 0; if (_Str == (STRSAFE_LPWSTR ******)0x0) { - iVar8 = 2; + iVar6 = 2; LAB_9: - if (uVar14 * 2 < 0x100000000) { - uVar4 = (uint)(uVar14 * 2); - uVar9 = iVar8 + uVar4; - if ((uVar4 <= uVar9) && + if ((ulonglong)local_264 * 2 < 0x100000000) { + uVar3 = (uint)((ulonglong)local_264 * 2); + uVar9 = iVar6 + uVar3; + if ((uVar3 <= uVar9) && (pszDest = HeapAlloc(ghTapisrvHeap,8,(ulonglong)uVar9), pszDest != (STRSAFE_LPWSTR *****)0x0)) { StringCbCopyW((STRSAFE_LPWSTR)pszDest,(ulonglong)uVar9,&local_258); if (_Str != (STRSAFE_LPWSTR ******)0x0) { StringCbCatW((STRSAFE_LPWSTR)pszDest,(ulonglong)uVar9,(STRSAFE_LPCWSTR)_Str); ServerFree(_Str); } - *pppppppwVar15 = pszDest; + *pppppppwVar13 = pszDest; goto LAB_10; } } } else { - uVar4 = WstrToBufSize((LPCWSTR)_Str,&local_268); - iVar8 = local_268; - if (-1 < (int)uVar4) goto LAB_9; + uVar3 = WstrToBufSize((LPCWSTR)_Str,&local_268); + iVar6 = local_268; + if (-1 < (int)uVar3) goto LAB_9; } *param_2 = 0x80000044; } - else if (pppppppwVar6 != _Str) { - _Dst = (undefined2 *)((longlong)_Str + uVar14 * 2); - memmove(_Dst,_Str,((longlong)pppppppwVar6 - (longlong)_Str >> 1) * 2); + else if (pppppppwVar5 != _Str) { + _Dst = (undefined2 *)((longlong)_Str + (ulonglong)local_264 * 2); + memmove(_Dst,_Str,((longlong)pppppppwVar5 - (longlong)_Str >> 1) * 2); StringCbCopyW((STRSAFE_LPWSTR)_Str,(ulonglong)(uVar3 + 1) * 2,&local_258); *_Dst = 0x22; } LAB_10: - if (local_264 != 0) { - SetPriorityListTReqCall((LPCWSTR)*pppppppwVar15); + if (iVar12 != 0) { + SetPriorityListTReqCall((LPCWSTR)*pppppppwVar13); } LeaveCriticalSection((LPCRITICAL_SECTION)&gPriorityListCritSec); LAB_1: TRACELogPrint(0x80002,"LineEpilogSync (lineSetAppPriority) exit, returning x%x", - (ulonglong)*param_2,uVar13); + (ulonglong)*param_2,uVar10); return; } ``` ## GetPriorityList ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.39| |i_ratio|0.65| |m_ratio|0.94| |b_ratio|0.89| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|GetPriorityList|GetPriorityList| |fullname|GetPriorityList|GetPriorityList| |refcount|3|3| |`length`|354|317| |`called`|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
Feature_1390216506__private_IsEnabledDeviceUsageNoInline
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
ServerFree
TRACELogPrint|API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL::RegQueryValueExW
KERNEL32.DLL::HeapAlloc
MSVCRT.DLL::_wcsupr
ServerFree
TRACELogPrint| |calling|ClientAttach
GetPriorityListTReqCall|ClientAttach
GetPriorityListTReqCall| |paramcount|3|3| |`address`|18002bef8|18002b49c| |sig|undefined __fastcall GetPriorityList(HKEY param_1, LPCWSTR param_2, undefined8 * param_3)|undefined __fastcall GetPriorityList(HKEY param_1, LPCWSTR param_2, undefined8 * param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### GetPriorityList Called Diff ```diff --- GetPriorityList called +++ GetPriorityList called @@ -2 +1,0 @@ -Feature_1390216506__private_IsEnabledDeviceUsageNoInline ``` ### GetPriorityList Diff ```diff --- GetPriorityList +++ GetPriorityList @@ -1,54 +1,45 @@ void GetPriorityList(HKEY param_1,LPCWSTR param_2,undefined8 *param_3) { LSTATUS LVar1; - uint uVar2; wchar_t *_Str; LPDWORD lpType; DWORD local_res18 [2]; DWORD local_res20 [2]; *param_3 = 0; lpType = local_res20; local_res20[0] = 0; local_res18[0] = 0; LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,lpType,(LPBYTE)0x0,local_res18); - if ((LVar1 != 0) || (local_res18[0] == 0)) { + if ((LVar1 == 0) && (local_res18[0] != 0)) { + if (local_res18[0] <= local_res18[0] + 2) { + _Str = HeapAlloc(ghTapisrvHeap,8,(ulonglong)(local_res18[0] + 2)); + if (_Str == (wchar_t *)0x0) { + *param_3 = 0; + } + else { + *_Str = L'\"'; + LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,local_res20,(LPBYTE)(_Str + 1), + local_res18); + if ((LVar1 == 0) && (1 < local_res18[0])) { + *(undefined2 *)((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) + = 0; + _wcsupr(_Str); + *param_3 = _Str; + TRACELogPrint(0x40002,"PriList: %ls=%ls",param_2,_Str); + } + else { + ServerFree(_Str); + } + } + } + } + else { *param_3 = 0; TRACELogPrint(0x40002,"PriList: %ls=NULL",param_2,lpType); - return; - } - uVar2 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if ((uVar2 != 0) && (local_res18[0] + 2 < local_res18[0])) { - return; - } - _Str = HeapAlloc(ghTapisrvHeap,8,(ulonglong)(local_res18[0] + 2)); - if (_Str == (wchar_t *)0x0) { - *param_3 = 0; - return; - } - *_Str = L'\"'; - LVar1 = RegQueryValueExW(param_1,param_2,(LPDWORD)0x0,local_res20,(LPBYTE)(_Str + 1),local_res18); - if (LVar1 == 0) { - uVar2 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if (uVar2 != 0) { - if (local_res18[0] < 2) goto LAB_0; - *(undefined2 *)((longlong)_Str + ((ulonglong)local_res18[0] - 2 & 0xfffffffffffffffe) + 2) = 0 - ; - } - _wcsupr(_Str); - *param_3 = _Str; - TRACELogPrint(0x40002,"PriList: %ls=%ls",param_2,_Str); - } - else { - uVar2 = Feature_1390216506__private_IsEnabledDeviceUsageNoInline(); - if (uVar2 == 0) { - return; - } -LAB_0: - ServerFree(_Str); } return; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## __GSHandlerCheck ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|__GSHandlerCheck|__GSHandlerCheck| |fullname|__GSHandlerCheck|__GSHandlerCheck| |`refcount`|70|67| |length|29|29| |called|__GSHandlerCheckCommon|__GSHandlerCheckCommon| |calling||| |paramcount|4|4| |`address`|180042d74|180041e64| |sig|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined8 __fastcall __GSHandlerCheck(undefined8 param_1, undefined8 param_2, undefined8 param_3, longlong param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ## atexit ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|atexit|atexit| |fullname|atexit|atexit| |`refcount`|5|4| |length|23|23| |called|_onexit|_onexit| |`calling`|wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''
wil::details::`dynamic_initializer_for_'g_enabledStateManager''
wil::details::`dynamic_initializer_for_'g_featureStateManager''
wil::details::`dynamic_initializer_for_'g_processLocalData''|wil::details::`dynamic_atexit_destructor_for_'g_threadFailureCallbacks''
wil::details::`dynamic_initializer_for_'g_featureStateManager''
wil::details::`dynamic_initializer_for_'g_processLocalData''| |paramcount|1|1| |`address`|180001ad8|180001aa8| |sig|int __cdecl atexit(_func_5014 * param_1)|int __cdecl atexit(_func_5014 * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### atexit Calling Diff ```diff --- atexit calling +++ atexit calling @@ -2 +1,0 @@ -wil::details::`dynamic_initializer_for_'g_enabledStateManager'' ``` ## ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.75| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|16|13| |length|29|29| |called|KERNEL32.DLL::ReleaseSRWLockExclusive|KERNEL32.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlushwil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaledwil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|180038c0c|180038154| |sig|void __thiscall ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,_RTL_SRWLOCK*___ptr64,_RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -3,3 +2,0 @@ -wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl -wil::details::EnabledStateManager::OnStateChange -wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges ``` ## ProcessShutdownInProgress ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.62| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|ProcessShutdownInProgress|ProcessShutdownInProgress| |fullname|wil::ProcessShutdownInProgress|wil::ProcessShutdownInProgress| |`refcount`|9|8| |length|47|47| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager''
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release|wil::details::FeatureStateManager::FlushUsage
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::`dynamic_atexit_destructor_for_'g_featureStateManager''
wil::details_abi::ProcessLocalStorageData::Release
wil::details_abi::ProcessLocalStorageData::Release| |paramcount|0|0| |`address`|18003c970|18003bca4| |sig|bool __cdecl ProcessShutdownInProgress(void)|bool __cdecl ProcessShutdownInProgress(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ProcessShutdownInProgress Calling Diff ```diff --- wil::ProcessShutdownInProgress calling +++ wil::ProcessShutdownInProgress calling @@ -5 +4,0 @@ -wil::details::`dynamic_atexit_destructor_for_'g_enabledStateManager'' ``` ## reset ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.81| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|reset|reset| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset| |`refcount`|6|5| |length|76|76| |called|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|wil::details::DestroyThreadPoolTimer::Destroy
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager|wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|2|2| |`address`|18003f62c|18003e80c| |sig|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)|void __thiscall reset(unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> * this, _TP_TIMER * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### reset Calling Diff ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset calling +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset calling @@ -1 +0,0 @@ -wil::details::EnabledStateManager::~EnabledStateManager ``` ## ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>|~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>| |`refcount`|4|3| |length|22|22| |called|wil::details::DestroyThreadPoolTimer::Destroy|wil::details::DestroyThreadPoolTimer::Destroy| |`calling`|wil::details::EnabledStateManager::~EnabledStateManager
wil::details::FeatureStateManager::~FeatureStateManager|wil::details::FeatureStateManager::~FeatureStateManager| |paramcount|1|1| |`address`|180038c54|18003819c| |sig|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>(unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_>::~unique_storage::Destroy(struct__TP_TIMER*___ptr64),wistd::integral_constant,_TP_TIMER*___ptr64,_TP_TIMER*___ptr64,0,std::nullptr_t>_> calling @@ -1 +0,0 @@ -wil::details::EnabledStateManager::~EnabledStateManager ``` ## push_back ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.89| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|push_back|push_back| |fullname|wil::details_abi::heap_buffer::push_back|wil::details_abi::heap_buffer::push_back| |`refcount`|4|3| |length|97|97| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure| |`calling`|wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details_abi::SubscriptionList::SubscribeUnderLock|wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3|3| |`address`|18003f4fc|18003e6dc| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### push_back Calling Diff ```diff --- wil::details_abi::heap_buffer::push_back calling +++ wil::details_abi::heap_buffer::push_back calling @@ -1 +0,0 @@ -wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges ``` ## KERNEL32.DLL::AcquireSRWLockExclusive ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|KERNEL32.DLL::AcquireSRWLockExclusive|KERNEL32.DLL::AcquireSRWLockExclusive| |`refcount`|16|13| |length|0|0| |called||| |`calling`|
Expand for full list:
::
::
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlushwil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaledwil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |`address`|EXTERNAL:00000061|EXTERNAL:00000064| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- KERNEL32.DLL::AcquireSRWLockExclusive calling +++ KERNEL32.DLL::AcquireSRWLockExclusive calling @@ -3,3 +2,0 @@ -wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl -wil::details::EnabledStateManager::OnStateChange -wil::details::EnabledStateManager::SubscribeFeatureStateCacheToConfigurationChanges ``` ## KERNEL32.DLL::GetModuleHandleW ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|GetModuleHandleW|GetModuleHandleW| |fullname|KERNEL32.DLL::GetModuleHandleW|KERNEL32.DLL::GetModuleHandleW| |`refcount`|6|5| |length|0|0| |called||| |`calling`|wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress
wil_details_GetNtDllModuleHandle
wil_details_GetNtDllProcedureAddress|wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress
wil_details_GetNtDllModuleHandle| |paramcount|1|1| |`address`|EXTERNAL:0000009c|EXTERNAL:00000059| |sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### KERNEL32.DLL::GetModuleHandleW Calling Diff ```diff --- KERNEL32.DLL::GetModuleHandleW calling +++ KERNEL32.DLL::GetModuleHandleW calling @@ -5 +4,0 @@ -wil_details_GetNtDllProcedureAddress ``` ## __security_check_cookie ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.5| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|__security_check_cookie|__security_check_cookie| |fullname|__security_check_cookie|__security_check_cookie| |`refcount`|92|89| |length|30|30| |called|__report_gsfailure|__report_gsfailure| |`calling`|
Expand for full list:
AllowAccessToScpProperties
BuildCountryList
BuildCountryListCache
BuildCountryRegistryListFromRCW
BuildDeviceInfoList
ChangeDeviceUserAssociation
CleanUpClient
ClientAttach
CompletionProc
ConvertLocations
ConvertOneLocationConvertUserLocations
CreateAreaCodeRule
CreateCallMonitors
CreateProxySCP
CreateSCP
CreateTapiSCP
DestroytCall
DestroytLine
DestroytLineApp
DestroytLineClient
DestroytPhone
EnablePrivilege
EnsureTsecIni
FreeDialogInstance
GetCallIDs
GetLocalSystemToken
GetProviderFriendlyName
GetUIDllName
InitSecurityDescriptor
InsertDevNameAddrInfo
IsLocalSystem
IsLocalSystemOnly
IsNTServer
LGetAppPriority
LGetCountry
LGetProviderList
LHandoff
LProxyMessage
LSetAppPriority
LSetCallHubTracking
LSetupConference_PostProcess
LineEventProc
MGetAvailableProviders
ManagementAddLineProc
NotifyHighestPriorityRequestRecipient
PhoneEventProc
RegDeleteKeyNT
RemoveProxySCP
RemoveSCP
ReportStatusToSCMgr
SendAMsgToAllLineApps
SendAMsgToAllPhoneApps
SendMsgToCallClients
SendMsgToLineClients
SendMsgToPhoneClients
ServerInit
ServerShutdown
ServiceMain
SetDeviceInfo
SetMediaModesPriorityList
SetPrivilege
SetSidOnAcl
SetTokenDefaultDacl
StoreADialingRuleInReg
TRACELogPrint
TRACELogRegister
TReadLocations
TWriteLocations
UpdateLastWriteTime
UpdateSCP
UpdateTapiSCP
ValidateButtonInfo
ValidateCallParams
__GSHandlerCheckCommon
wil::GetFailureLogString
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_RecordCachedUsage
wil_details_WriteSRUMWnfUsageBuffer
xxxLOpen
|
Expand for full list:
AllowAccessToScpProperties
BuildCountryList
BuildCountryListCache
BuildCountryRegistryListFromRCW
BuildDeviceInfoList
ChangeDeviceUserAssociation
CleanUpClient
ClientAttach
CompletionProc
ConvertLocations
ConvertOneLocationConvertUserLocations
CreateAreaCodeRule
CreateCallMonitors
CreateProxySCP
CreateSCP
CreateTapiSCP
DestroytCall
DestroytLine
DestroytLineApp
DestroytLineClient
DestroytPhone
EnablePrivilege
EnsureTsecIni
FreeDialogInstance
GetCallIDs
GetLocalSystemToken
GetProviderFriendlyName
GetUIDllName
InitSecurityDescriptor
InsertDevNameAddrInfo
IsLocalSystem
IsLocalSystemOnly
IsNTServer
LGetAppPriority
LGetCountry
LGetProviderList
LHandoff
LProxyMessage
LSetAppPriority
LSetCallHubTracking
LSetupConference_PostProcess
LineEventProc
MGetAvailableProviders
ManagementAddLineProc
NotifyHighestPriorityRequestRecipient
PhoneEventProc
RegDeleteKeyNT
RemoveProxySCP
RemoveSCP
ReportStatusToSCMgr
SendAMsgToAllLineApps
SendAMsgToAllPhoneApps
SendMsgToCallClients
SendMsgToLineClients
SendMsgToPhoneClients
ServerInit
ServerShutdown
ServiceMain
SetDeviceInfo
SetMediaModesPriorityList
SetPrivilege
SetSidOnAcl
SetTokenDefaultDacl
StoreADialingRuleInReg
TRACELogPrint
TRACELogRegister
TReadLocations
TWriteLocations
UpdateLastWriteTime
UpdateSCP
UpdateTapiSCP
ValidateButtonInfo
ValidateCallParams
__GSHandlerCheckCommon
wil::GetFailureLogString
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::GetModuleInformation
wil::details::ReportFailure_Return<1>
wil::details::ReportFailure_Return<2>
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::ProcessLocalStorageData::Acquire
wil::details_abi::RecordWnfUsageIndex
wil::details_abi::SemaphoreValue::CreateFromValueInternal
wil::details_abi::SemaphoreValue::TryGetValueInternal
wil::details_abi::UsageIndexes::Record
wil_details_WriteSRUMWnfUsageBuffer
xxxLOpen
| |paramcount|1|1| |`address`|180042ee0|180041fd0| |sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### __security_check_cookie Calling Diff ```diff --- __security_check_cookie calling +++ __security_check_cookie calling @@ -87,3 +86,0 @@ -wil_RtlStagingConfig_QueryFeatureState -wil_details_FeatureReporting_ReportUsageToServiceDirect -wil_details_RecordCachedUsage ``` ## KERNEL32.DLL::GetProcAddress ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|GetProcAddress|GetProcAddress| |fullname|KERNEL32.DLL::GetProcAddress|KERNEL32.DLL::GetProcAddress| |`refcount`|24|23| |length|0|0| |called||| |calling|GetProviderFriendlyName
GetUIDllName
LoadNewDll
MGetAvailableProviders
ReadAndInitMapper
ServerInit
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress|GetProviderFriendlyName
GetUIDllName
LoadNewDll
MGetAvailableProviders
ReadAndInitMapper
ServerInit
wil::details::ProcessHeapAlloc
wil::details::WilDynamicLoadRaiseFailFastException
wil_details_GetKernelBaseProcAddress| |paramcount|2|2| |`address`|EXTERNAL:0000009a|EXTERNAL:00000084| |sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## wil_details_GetNtDllProcedureAddress ### Match Info |Key|tapisrv-02.dll - tapisrv-03.dll| | :---: | :---: | |diff_type|refcount,length,sig,address,calling,called| |ratio|0.36| |i_ratio|0.5| |m_ratio|0.75| |b_ratio|0.42| |match_types|Implied Match| ### Function Meta Diff |Key|tapisrv-02.dll|tapisrv-03.dll| | :---: | :---: | :---: | |name|wil_details_GetNtDllProcedureAddress|wil_details_GetNtDllProcedureAddress| |fullname|wil_details_GetNtDllProcedureAddress|wil_details_GetNtDllProcedureAddress| |`refcount`|3|8| |`length`|65|32| |`called`|KERNEL32.DLL::GetModuleHandleW|wil_details_GetNtDllModuleHandle| |`calling`|wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_RecordFeatureUsage|wil::details::RtlDllShutdownInProgress
wil::details::RtlNtStatusToDosErrorNoTeb
wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>
wil_RtlStagingConfig_RecordFeatureUsage
wil_details_NtQueryWnfStateData
wil_details_NtUpdateWnfStateData
wil_details_RtlRegisterFeatureConfigurationChangeNotification| |paramcount|1|1| |`address`|180020a08|18003e9a4| |`sig`|undefined __fastcall wil_details_GetNtDllProcedureAddress(LPCSTR param_1)|_func___int64 * __cdecl wil_details_GetNtDllProcedureAddress(char * param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|ANALYSIS| |external|False|False| ### wil_details_GetNtDllProcedureAddress Called Diff ```diff --- wil_details_GetNtDllProcedureAddress called +++ wil_details_GetNtDllProcedureAddress called @@ -1 +1 @@ -KERNEL32.DLL::GetModuleHandleW +wil_details_GetNtDllModuleHandle ``` ### wil_details_GetNtDllProcedureAddress Calling Diff ```diff --- wil_details_GetNtDllProcedureAddress calling +++ wil_details_GetNtDllProcedureAddress calling @@ -1 +1,3 @@ -wil_RtlStagingConfig_QueryFeatureState +wil::details::RtlDllShutdownInProgress +wil::details::RtlNtStatusToDosErrorNoTeb +wil::details::unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_>::~unique_storage,void*___ptr64,void*___ptr64,0,std::nullptr_t>_> @@ -2,0 +5,3 @@ +wil_details_NtQueryWnfStateData +wil_details_NtUpdateWnfStateData +wil_details_RtlRegisterFeatureConfigurationChangeNotification ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-27T20:57:48