# tapisrv_8521.dll-tapisrv_8655.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [Feature_784066872__private_IsEnabledDeviceUsageNoInline](#feature_784066872__private_isenableddeviceusagenoinline) * [Feature_500158777__private_IsEnabledDeviceUsageNoInline](#feature_500158777__private_isenableddeviceusagenoinline) * [GetEventMasksOrSubMasks](#geteventmasksorsubmasks) * [Modified](#modified) * [SetEventMasksOrSubMasks](#seteventmasksorsubmasks) * [TGetEventMasksOrSubMasks](#tgeteventmasksorsubmasks) * [DestroytCall](#destroytcall) * [Modified (No Code Changes)](#modified-no-code-changes) * [KERNEL32.DLL::LeaveCriticalSection](#kernel32dllleavecriticalsection) * [USER32.DLL::LoadIconW](#user32dllloadiconw) * [GetSubMaskIndex](#getsubmaskindex) * [ReferenceObject](#referenceobject) * [WaitForExclusivetCallAccess](#waitforexclusivetcallaccess) * [wil_details_IsEnabledFallback](#wil_details_isenabledfallback) * [DereferenceObject](#dereferenceobject) # Visual Chart Diff ```mermaid flowchart LR SetEventMasksOrSubMasks-4-old<--Match 74%-->SetEventMasksOrSubMasks-4-new TGetEventMasksOrSubMasks-5-old<--Match 16%-->TGetEventMasksOrSubMasks-5-new DestroytCall-4-old<--Match 83%-->DestroytCall-4-new subgraph tapisrv_8655.dll SetEventMasksOrSubMasks-4-new TGetEventMasksOrSubMasks-5-new DestroytCall-4-new subgraph Added direction LR Feature_784066872__private_IsEnabledDeviceUsageNoInline Feature_500158777__private_IsEnabledDeviceUsageNoInline GetEventMasksOrSubMasks end end subgraph tapisrv_8521.dll SetEventMasksOrSubMasks-4-old TGetEventMasksOrSubMasks-5-old DestroytCall-4-old end ``` ```mermaid pie showData title Function Matches - 99.8527% "unmatched_funcs_len" : 3 "matched_funcs_len" : 2034 ``` ```mermaid pie showData title Matched Function Similarity - 99.5084% "matched_funcs_with_code_changes_len" : 3 "matched_funcs_with_non_code_changes_len" : 7 "matched_funcs_no_changes_len" : 2024 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 tapisrv_8521.dll tapisrv_8655.dll ``` #### Verbose Args

``` --old ['tapisrv_8521.dll'] --new [['tapisrv_8655.dll']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/DC1F13005D000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.26100.8521 wget https://msdl.microsoft.com/download/symbols/TAPISRV.EXE/E3F297515D000/TAPISRV.EXE -O tapisrv.exe.x64.10.0.26100.8655 ``` ## Binary Metadata Diff ```diff --- tapisrv_8521.dll Meta +++ tapisrv_8655.dll Meta @@ -1,44 +1,44 @@ -Program Name: tapisrv_8521.dll +Program Name: tapisrv_8655.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 384016 +# of Bytes: 384032 # of Memory Blocks: 10 -# of Instructions: 64035 -# of Defined Data: 3583 -# of Functions: 1017 -# of Symbols: 11984 +# of Instructions: 64070 +# of Defined Data: 3598 +# of Functions: 1020 +# of Symbols: 12010 # of Data Types: 772 # of Data Type Categories: 43 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 20:28:04 SGT 2026 +Date Created: Sun Aug 16 20:28:07 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/tapi/tapisrv_8521.dll -Executable MD5: 486b56da845f3b41de8796f94049f005 -Executable SHA256: be01d3bd28d2e12d81690790d3a68fbab6814a97b650a1534a9e73ad5ed5a01e -FSRL: file:///tmp/tapi/tapisrv_8521.dll?MD5=486b56da845f3b41de8796f94049f005 +Executable Location: /tmp/tapi/tapisrv_8655.dll +Executable MD5: a3da9348a02627f9e640c1bcc96f3ee9 +Executable SHA256: c00c8f51b6ba0bbd76927ac6eefb399a62e5e20fbbe41bdb45ef5901a8a1f169 +FSRL: file:///tmp/tapi/tapisrv_8655.dll?MD5=a3da9348a02627f9e640c1bcc96f3ee9 PDB Age: 1 PDB File: tapisrv.pdb -PDB GUID: 08c2004a-441b-3959-ff54-0b7f6e6ec021 +PDB GUID: 4f0c9741-7767-d18c-f64a-7e5e1eb07b6f PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Microsoft® Windows(TM) Telephony Server -PE Property[FileVersion]: 10.0.26100.8521 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8655 (WinBuild.160101.0800) PE Property[InternalName]: Telephony Service PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: TAPISRV.EXE PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8521 +PE Property[ProductVersion]: 10.0.26100.8655 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: false Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra tapisrv_8521.dll Decompiler Options

Ghidra tapisrv_8521.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra tapisrv_8521.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra tapisrv_8655.dll Decompiler Options

Ghidra tapisrv_8655.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra tapisrv_8655.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|3| |deleted_funcs_len|0| |modified_funcs_len|10| |added_symbols_len|10| |deleted_symbols_len|0| |diff_time|4.164268493652344| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1011, 'ExternalsName': 231, 'ExactBytesFunctionHasher': 2, 'SigCallingCalledHasher': 2, 'ExactInstructionsFunctionHasher': 1})| |items_to_process|23| |diff_types|Counter({'refcount': 7, 'address': 7, 'calling': 3, 'code': 3, 'length': 3, 'called': 3, 'sig': 1})| |unmatched_funcs_len|3| |total_funcs_len|2037| |matched_funcs_len|2034| |matched_funcs_with_code_changes_len|3| |matched_funcs_with_non_code_changes_len|7| |matched_funcs_no_changes_len|2024| |match_func_similarity_percent|99.5084%| |func_match_overall_percent|99.8527%| |first_matches|Counter({'SymbolsHash': 1011, 'ExactBytesFunctionHasher': 2, 'SigCallingCalledHasher': 2, 'ExactInstructionsFunctionHasher': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1011 "ExternalsName" : 231 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 1 "SigCallingCalledHasher" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1011 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 1 "SigCallingCalledHasher" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 3 "deleted_funcs_len" : 0 "modified_funcs_len" : 10 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 10 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## Feature_784066872__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|tapisrv_8655.dll| | :---: | :---: | |name|Feature_784066872__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_784066872__private_IsEnabledDeviceUsageNoInline| |refcount|1| |length|51| |called|wil_details_IsEnabledFallback| |calling|DestroytCall| |paramcount|0| |address|180006c04| |sig|uint __fastcall Feature_784066872__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_784066872__private_IsEnabledDeviceUsageNoInline +++ Feature_784066872__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_784066872__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + ulonglong local_res8; + + local_res8 = (ulonglong)Feature_784066872__private_featureState; + if ((Feature_784066872__private_featureState & 0x10) != 0) { + return Feature_784066872__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3,&Feature_784066872__private_descriptor); + return uVar1; +} + ``` ## Feature_500158777__private_IsEnabledDeviceUsageNoInline ### Function Meta |Key|tapisrv_8655.dll| | :---: | :---: | |name|Feature_500158777__private_IsEnabledDeviceUsageNoInline| |fullname|Feature_500158777__private_IsEnabledDeviceUsageNoInline| |refcount|2| |length|51| |called|wil_details_IsEnabledFallback| |calling|GetEventMasksOrSubMasks
SetEventMasksOrSubMasks| |paramcount|0| |address|1800379e4| |sig|uint __fastcall Feature_500158777__private_IsEnabledDeviceUsageNoInline(void)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- Feature_500158777__private_IsEnabledDeviceUsageNoInline +++ Feature_500158777__private_IsEnabledDeviceUsageNoInline @@ -0,0 +1,15 @@ + +uint Feature_500158777__private_IsEnabledDeviceUsageNoInline(void) + +{ + uint uVar1; + ulonglong local_res8; + + local_res8 = (ulonglong)Feature_500158777__private_featureState; + if ((Feature_500158777__private_featureState & 0x10) != 0) { + return Feature_500158777__private_featureState & 1; + } + uVar1 = wil_details_IsEnabledFallback(local_res8,3,&Feature_500158777__private_descriptor); + return uVar1; +} + ``` ## GetEventMasksOrSubMasks ### Function Meta |Key|tapisrv_8655.dll| | :---: | :---: | |name|GetEventMasksOrSubMasks| |fullname|GetEventMasksOrSubMasks| |refcount|3| |length|142| |called|Feature_500158777__private_IsEnabledDeviceUsageNoInline
GetSubMaskIndex| |calling|TGetEventMasksOrSubMasks| |paramcount|5| |address|180037a28| |sig|undefined8 __fastcall GetEventMasksOrSubMasks(int param_1, ulonglong param_2, ulonglong * param_3, int * param_4, int * param_5)| |sym_type|Function| |sym_source|IMPORTED| |external|False| ```diff --- GetEventMasksOrSubMasks +++ GetEventMasksOrSubMasks @@ -0,0 +1,41 @@ + +undefined8 +GetEventMasksOrSubMasks(int param_1,ulonglong param_2,ulonglong *param_3,int *param_4,int *param_5) + +{ + uint uVar1; + uint uVar2; + longlong lVar3; + undefined8 uVar4; + ulonglong uVar5; + + if (((param_5 == (int *)0x0) || (param_3 == (ulonglong *)0x0)) || (param_4 == (int *)0x0)) { + uVar4 = 0x80000035; + } + else { + if (param_1 == 0) { + *param_3 = 0; + uVar5 = 1; + lVar3 = 0x1f; + do { + if (*param_5 != 0) { + *param_3 = *param_3 | uVar5; + } + uVar5 = uVar5 * 2; + param_5 = param_5 + 1; + lVar3 = lVar3 + -1; + } while (lVar3 != 0); + } + else { + uVar1 = GetSubMaskIndex(param_2); + uVar2 = Feature_500158777__private_IsEnabledDeviceUsageNoInline(); + if ((uVar2 != 0) && (0x1e < uVar1)) { + return 0x80000032; + } + *param_4 = param_5[uVar1]; + } + uVar4 = 0; + } + return uVar4; +} + ``` # Modified *Modified functions contain code changes* ## SetEventMasksOrSubMasks ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.51| |i_ratio|0.29| |m_ratio|0.76| |b_ratio|0.74| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|SetEventMasksOrSubMasks|SetEventMasksOrSubMasks| |fullname|SetEventMasksOrSubMasks|SetEventMasksOrSubMasks| |refcount|7|7| |`length`|81|132| |`called`|GetSubMaskIndex|Feature_500158777__private_IsEnabledDeviceUsageNoInline
GetSubMaskIndex| |calling|SettCallClientEventMasks
SettClientEventMasks
SettLineAppEventMasks
SettLineClientEventMasks
SettPhoneAppEventMasks
SettPhoneClientEventMasks|SettCallClientEventMasks
SettClientEventMasks
SettLineAppEventMasks
SettLineClientEventMasks
SettPhoneAppEventMasks
SettPhoneClientEventMasks| |paramcount|4|4| |`address`|18003787c|180037ad8| |sig|undefined8 __fastcall SetEventMasksOrSubMasks(int param_1, ulonglong param_2, int param_3, int * param_4)|undefined8 __fastcall SetEventMasksOrSubMasks(int param_1, ulonglong param_2, int param_3, int * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### SetEventMasksOrSubMasks Called Diff ```diff --- SetEventMasksOrSubMasks called +++ SetEventMasksOrSubMasks called @@ -0,0 +1 @@ +Feature_500158777__private_IsEnabledDeviceUsageNoInline ``` ### SetEventMasksOrSubMasks Diff ```diff --- SetEventMasksOrSubMasks +++ SetEventMasksOrSubMasks @@ -1,34 +1,39 @@ undefined8 SetEventMasksOrSubMasks(int param_1,ulonglong param_2,int param_3,int *param_4) { uint uVar1; - undefined8 uVar2; - ulonglong uVar3; - longlong lVar4; - ulonglong uVar5; + uint uVar2; + undefined8 uVar3; + ulonglong uVar4; + longlong lVar5; + ulonglong uVar6; - uVar5 = 1; + uVar6 = 1; if (param_4 == (int *)0x0) { - uVar2 = 0x80000035; + uVar3 = 0x80000035; } else { if (param_1 == 0) { - lVar4 = 0x1f; + lVar5 = 0x1f; do { - uVar3 = uVar5 & param_2; - uVar5 = uVar5 * 2; - *param_4 = -(uint)(uVar3 != 0); + uVar4 = uVar6 & param_2; + uVar6 = uVar6 * 2; + *param_4 = -(uint)(uVar4 != 0); param_4 = param_4 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); + lVar5 = lVar5 + -1; + } while (lVar5 != 0); } else { uVar1 = GetSubMaskIndex(param_2); + uVar2 = Feature_500158777__private_IsEnabledDeviceUsageNoInline(); + if ((uVar2 != 0) && (0x1e < uVar1)) { + return 0x80000032; + } param_4[uVar1] = param_3; } - uVar2 = 0; + uVar3 = 0; } - return uVar2; + return uVar3; } ``` ## TGetEventMasksOrSubMasks ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.31| |i_ratio|0.12| |m_ratio|0.76| |b_ratio|0.16| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|TGetEventMasksOrSubMasks|TGetEventMasksOrSubMasks| |fullname|TGetEventMasksOrSubMasks|TGetEventMasksOrSubMasks| |refcount|3|3| |`length`|1431|938| |`called`|DereferenceObject
GetSubMaskIndex
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::LeaveCriticalSection
ReferenceObject
StringCbCopyA
WaitForExclusiveClientAccess|DereferenceObject
GetEventMasksOrSubMasks
KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::GetCurrentThreadId
KERNEL32.DLL::LeaveCriticalSection
ReferenceObject
StringCbCopyA
WaitForExclusiveClientAccess| |calling||| |paramcount|5|5| |`address`|180037f10|1800381a0| |sig|undefined __fastcall TGetEventMasksOrSubMasks(int * param_1, int * param_2, undefined8 param_3, undefined8 param_4, undefined4 * param_5)|undefined __fastcall TGetEventMasksOrSubMasks(int * param_1, int * param_2, undefined8 param_3, undefined8 param_4, undefined4 * param_5)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### TGetEventMasksOrSubMasks Called Diff ```diff --- TGetEventMasksOrSubMasks called +++ TGetEventMasksOrSubMasks called @@ -2 +2 @@ -GetSubMaskIndex +GetEventMasksOrSubMasks ``` ### TGetEventMasksOrSubMasks Diff ```diff --- TGetEventMasksOrSubMasks +++ TGetEventMasksOrSubMasks @@ -1,250 +1,130 @@ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ void TGetEventMasksOrSubMasks (int *param_1,int *param_2,undefined8 param_3,undefined8 param_4,undefined4 *param_5) { - uint uVar1; - int iVar2; - int *piVar3; - longlong lVar4; - undefined *puVar5; + int iVar1; + int *piVar2; + undefined8 uVar3; + undefined *puVar4; + LPCRITICAL_SECTION lpCriticalSection; + int *cbDest; + int *piVar5; ulonglong uVar6; - LPCRITICAL_SECTION lpCriticalSection; - int *piVar7; - int *piVar8; - ulonglong uVar9; - ulonglong uVar10; - int iVar11; + ulonglong local_res10; - uVar10 = 0; - iVar11 = 0; - uVar9 = 0; - uVar6 = uVar10; + piVar5 = (int *)0x0; + local_res10 = 0; if (param_2[4] != 0) { - uVar6 = *(ulonglong *)(param_2 + 6); + piVar5 = *(int **)(param_2 + 6); } - piVar7 = param_2; + cbDest = param_2; EnterCriticalSection((LPCRITICAL_SECTION)&DAT_0); - _DAT_1 = 0x404; + _DAT_1 = 0x41c; _DAT_2 = GetCurrentThreadId(); - puVar5 = &DAT_3; - StringCbCopyA(&DAT_3,(size_t)piVar7,"\\server\\event.c"); - iVar2 = param_2[2]; - if (iVar2 == 0) { - piVar3 = WaitForExclusiveClientAccess(param_1); - if (piVar3 == (int *)0x0) { + puVar4 = &DAT_3; + StringCbCopyA(&DAT_3,(size_t)cbDest,"\\server\\event.c"); + iVar1 = param_2[2]; + if (iVar1 == 0) { + piVar2 = WaitForExclusiveClientAccess(param_1); + if (piVar2 == (int *)0x0) { *param_2 = -0x7fffffce; } else { - piVar8 = param_1 + 0x3f; - piVar3 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar3 == (int *)0x0)) { - iVar11 = -0x7fffffcb; - } - else { - if (param_2[4] == 0) { - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); - } - else { - uVar1 = GetSubMaskIndex(uVar6); - piVar7 = (int *)(ulonglong)uVar1; - *piVar3 = piVar8[(longlong)piVar7]; - } - iVar11 = 0; - } - *param_2 = iVar11; + uVar3 = GetEventMasksOrSubMasks + (param_2[4],(ulonglong)piVar5,&local_res10,param_2 + 5,param_1 + 0x3f); + *param_2 = (int)uVar3; LeaveCriticalSection ((LPCRITICAL_SECTION) (gLockTable + ((ulonglong)param_1 >> 4 & (ulonglong)gdwPointerToLockTableIndexBits) * 0x28)); - uVar9 = uVar10; + cbDest = piVar5; } goto LAB_4; } - if (iVar2 == 1) { - piVar7 = (int *)(ulonglong)(uint)param_2[3]; - piVar3 = ReferenceObject(puVar5,param_2[3],0x5050414c); - if ((piVar3 == (int *)0x0) || (*piVar3 != 0x5050414c)) { + if (iVar1 == 1) { + cbDest = (int *)(ulonglong)(uint)param_2[3]; + piVar2 = ReferenceObject(puVar4,param_2[3],0x5050414c); + if ((piVar2 == (int *)0x0) || (*piVar2 != 0x5050414c)) { *param_2 = -0x7fffffec; goto LAB_4; } - uVar9 = (ulonglong)piVar3 >> 4; + uVar6 = (ulonglong)piVar2 >> 4; EnterCriticalSection - ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28)); - piVar8 = piVar3 + 0x14; - piVar7 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar7 == (int *)0x0)) { -LAB_5: - iVar11 = -0x7fffffcb; - } - else if (param_2[4] == 0) { - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); - } - else { - uVar1 = GetSubMaskIndex(uVar6); - iVar2 = piVar3[(ulonglong)uVar1 + 0x14]; -LAB_6: - *piVar7 = iVar2; - } + ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28)); + piVar2 = piVar2 + 0x14; } - else if (iVar2 == 2) { - piVar7 = (int *)(ulonglong)(uint)param_2[3]; - piVar3 = ReferenceObject(puVar5,param_2[3],0x494c434c); - if ((piVar3 == (int *)0x0) || (*piVar3 != 0x494c434c)) { + else if (iVar1 == 2) { + cbDest = (int *)(ulonglong)(uint)param_2[3]; + piVar2 = ReferenceObject(puVar4,param_2[3],0x494c434c); + if ((piVar2 == (int *)0x0) || (*piVar2 != 0x494c434c)) { *param_2 = -0x7fffffd5; goto LAB_4; } - uVar9 = (ulonglong)piVar3 >> 4; + uVar6 = (ulonglong)piVar2 >> 4; EnterCriticalSection - ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28)); - piVar8 = piVar3 + 0x2a; - piVar7 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar7 == (int *)0x0)) goto LAB_5; - if (param_2[4] != 0) { - uVar1 = GetSubMaskIndex(uVar6); - iVar2 = piVar3[(ulonglong)uVar1 + 0x2a]; - goto LAB_6; - } - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); + ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28)); + piVar2 = piVar2 + 0x2a; } - else if (iVar2 == 3) { - piVar7 = (int *)(ulonglong)(uint)param_2[3]; - piVar3 = ReferenceObject(puVar5,param_2[3],0x494c4343); - if ((piVar3 == (int *)0x0) || (*piVar3 != 0x494c4343)) { + else if (iVar1 == 3) { + cbDest = (int *)(ulonglong)(uint)param_2[3]; + piVar2 = ReferenceObject(puVar4,param_2[3],0x494c4343); + if ((piVar2 == (int *)0x0) || (*piVar2 != 0x494c4343)) { *param_2 = -0x7fffffe8; goto LAB_4; } - uVar9 = (ulonglong)piVar3 >> 4; + uVar6 = (ulonglong)piVar2 >> 4; EnterCriticalSection - ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28)); - piVar8 = piVar3 + 0x17; - piVar7 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar7 == (int *)0x0)) goto LAB_5; - if (param_2[4] != 0) { - uVar1 = GetSubMaskIndex(uVar6); - iVar2 = piVar3[(ulonglong)uVar1 + 0x17]; - goto LAB_6; - } - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); + ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28)); + piVar2 = piVar2 + 0x17; } - else if (iVar2 == 4) { - piVar7 = (int *)(ulonglong)(uint)param_2[3]; - piVar3 = ReferenceObject(puVar5,param_2[3],0x50504150); - if ((piVar3 == (int *)0x0) || (*piVar3 != 0x50504150)) { + else if (iVar1 == 4) { + cbDest = (int *)(ulonglong)(uint)param_2[3]; + piVar2 = ReferenceObject(puVar4,param_2[3],0x50504150); + if ((piVar2 == (int *)0x0) || (*piVar2 != 0x50504150)) { *param_2 = -0x6ffffff9; goto LAB_4; } - uVar9 = (ulonglong)piVar3 >> 4; + uVar6 = (ulonglong)piVar2 >> 4; EnterCriticalSection - ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28)); - piVar8 = piVar3 + 0x13; - piVar7 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar7 == (int *)0x0)) goto LAB_5; - if (param_2[4] != 0) { - uVar1 = GetSubMaskIndex(uVar6); - iVar2 = piVar3[(ulonglong)uVar1 + 0x13]; - goto LAB_6; - } - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); + ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28)); + piVar2 = piVar2 + 0x13; } else { - if (iVar2 != 5) { + if (iVar1 != 5) { *param_2 = -0x7fffffb8; - uVar9 = uVar10; goto LAB_4; } - piVar7 = (int *)(ulonglong)(uint)param_2[3]; - piVar3 = ReferenceObject(puVar5,param_2[3],0x494c4350); - if ((piVar3 == (int *)0x0) || (*piVar3 != 0x494c4350)) { + cbDest = (int *)(ulonglong)(uint)param_2[3]; + piVar2 = ReferenceObject(puVar4,param_2[3],0x494c4350); + if ((piVar2 == (int *)0x0) || (*piVar2 != 0x494c4350)) { *param_2 = -0x6fffffed; goto LAB_4; } - uVar9 = (ulonglong)piVar3 >> 4; + uVar6 = (ulonglong)piVar2 >> 4; EnterCriticalSection - ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28)); - piVar8 = piVar3 + 0x19; - piVar7 = param_2 + 5; - if ((piVar8 == (int *)0x0) || (piVar7 == (int *)0x0)) goto LAB_5; - if (param_2[4] != 0) { - uVar1 = GetSubMaskIndex(uVar6); - iVar2 = piVar3[(ulonglong)uVar1 + 0x19]; - goto LAB_6; - } - uVar6 = 1; - lVar4 = 0x1f; - do { - if (*piVar8 != 0) { - uVar10 = uVar10 | uVar6; - } - uVar6 = uVar6 * 2; - piVar8 = piVar8 + 1; - lVar4 = lVar4 + -1; - } while (lVar4 != 0); + ((LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28)); + piVar2 = piVar2 + 0x19; } - *param_2 = iVar11; + uVar3 = GetEventMasksOrSubMasks(param_2[4],(ulonglong)piVar5,&local_res10,param_2 + 5,piVar2); + *param_2 = (int)uVar3; lpCriticalSection = - (LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar9) * 0x28); + (LPCRITICAL_SECTION)(gLockTable + (gdwPointerToLockTableIndexBits & uVar6) * 0x28); LeaveCriticalSection(lpCriticalSection); - piVar7 = (int *)(ulonglong)(uint)param_2[3]; + cbDest = (int *)(ulonglong)(uint)param_2[3]; DereferenceObject(lpCriticalSection,param_2[3],1); - uVar9 = uVar10; LAB_4: - _DAT_7 = 0x4d3; - _DAT_8 = GetCurrentThreadId(); - StringCbCopyA(&DAT_9,(size_t)piVar7,"\\server\\event.c"); + _DAT_5 = 0x4eb; + _DAT_6 = GetCurrentThreadId(); + StringCbCopyA(&DAT_7,(size_t)cbDest,"\\server\\event.c"); LeaveCriticalSection((LPCRITICAL_SECTION)&DAT_0); if ((*param_2 == 0) && (param_2[4] == 0)) { - param_2[8] = (int)uVar9; - param_2[9] = (int)(uVar9 >> 0x20); + param_2[8] = (int)local_res10; + param_2[9] = (int)(local_res10 >> 0x20); } *param_5 = 0x28; return; } ``` ## DestroytCall ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|code,length,sig,called| |ratio|0.37| |i_ratio|0.32| |m_ratio|0.86| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|DestroytCall|DestroytCall| |fullname|DestroytCall|DestroytCall| |refcount|7|7| |`length`|1046|1349| |`called`|

Expand for full list:
AcquireHashTableEntryLock
DereferenceObject
DestroytCallClient
FMsgDisabled
FindDynamicHashTableEntry
FreetCall
GetConfCallListFromConf
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::ReleaseMutex
KERNEL32.DLL::Sleep
KERNEL32.DLL::WaitForSingleObject

ReferenceObject
ReleaseHashTableEntryLock
RemoveCallFromLineList
RemoveDynamicHashTableEntry
ServerFree
SetCallConfList
TRACELogPrint
WaitForExclusivetCallAccess
WriteEventBuffer
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset

Expand for full list:
AcquireHashTableEntryLock
DereferenceObject
DestroytCallClient
FMsgDisabled
Feature_784066872__private_IsEnabledDeviceUsageNoInline
FindDynamicHashTableEntry
FreetCall
GetConfCallListFromConf
KERNEL32.DLL::LeaveCriticalSection
KERNEL32.DLL::ReleaseMutex
KERNEL32.DLL::Sleep

KERNEL32.DLL::WaitForSingleObject
ReferenceObject
ReleaseHashTableEntryLock
RemoveCallFromLineList
RemoveDynamicHashTableEntry
ServerFree
SetCallConfList
TRACELogPrint
WaitForExclusivetCallAccess
WriteEventBuffer
__security_check_cookie
_guard_dispatch_icall$thunk$10345483385596137414
memset

| |calling|CreatetCallAndClient
DestroytCallClient
DestroytLine
LSetupConference
LineEventProc|CreatetCallAndClient
DestroytCallClient
DestroytLine
LSetupConference
LineEventProc| |paramcount|4|4| |address|180004c88|180004c88| |`sig`|undefined __fastcall DestroytCall(int * param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)|undefined __fastcall DestroytCall(int * param_1, undefined8 param_2, undefined8 param_3, void * param_4)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### DestroytCall Called Diff ```diff --- DestroytCall called +++ DestroytCall called @@ -4,0 +5 @@ +Feature_784066872__private_IsEnabledDeviceUsageNoInline ``` ### DestroytCall Diff ```diff --- DestroytCall +++ DestroytCall @@ -1,196 +1,286 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ void DestroytCall(int *param_1,undefined8 param_2,undefined8 param_3,void *param_4) { byte *pbVar1; uint *puVar2; longlong lVar3; longlong lVar4; longlong *plVar5; uint *puVar6; - LPVOID pvVar7; - uint uVar8; - undefined8 uVar9; + uint uVar7; + undefined8 uVar8; + int *piVar9; int *piVar10; - int *piVar11; - int iVar12; - int *piVar13; - uint *puVar14; - LPVOID pvVar15; - undefined1 auStack_f8 [32]; + LPCRITICAL_SECTION p_Var11; + LPCRITICAL_SECTION p_Var12; + HANDLE *ppvVar13; + ulonglong uVar14; + uint uVar15; + LPCRITICAL_SECTION p_Var16; + uint uVar17; + uint *puVar18; + int iVar19; + LPCRITICAL_SECTION p_Var20; + HANDLE *ppvVar21; + int *piVar22; + LPCRITICAL_SECTION p_Var23; + undefined1 auStack_108 [32]; + uint *local_e8; + uint local_e0; uint *local_d8; - int local_d0; - longlong local_c8; - byte *local_c0; - int *local_b8; - uint *local_b0; + LPCRITICAL_SECTION local_d0; + int *local_c8; + int local_c0; + longlong local_b8; uint local_a8 [20]; uint local_58 [10]; ulonglong local_30; - local_30 = __security_cookie ^ (ulonglong)auStack_f8; + local_30 = __security_cookie ^ (ulonglong)auStack_108; + piVar9 = param_1; + local_c8 = param_1; + TRACELogPrint(0x80002,"DestroytCall: enter, ptCall=x%p",param_1,param_4); + iVar19 = 0x4c4c4143; + if (*param_1 != 0x4c4c4143) { + iVar19 = 0x4c414349; + } piVar10 = param_1; - local_b8 = param_1; - TRACELogPrint(0x80002,"DestroytCall: enter, ptCall=x%p",param_1,param_4); - iVar12 = 0x4c4c4143; - if (*param_1 != 0x4c4c4143) { - iVar12 = 0x4c414349; - } - piVar11 = param_1; - local_d0 = iVar12; - uVar9 = WaitForExclusivetCallAccess(param_1,iVar12); - if (((int)uVar9 == 0) && - (piVar11 = param_1, uVar9 = WaitForExclusivetCallAccess(param_1,0x4c4c4143), (int)uVar9 == 0)) + local_c0 = iVar19; + uVar8 = WaitForExclusivetCallAccess(param_1,iVar19); + p_Var16 = (LPCRITICAL_SECTION)0x0; + if (((int)uVar8 == 0) && + (piVar10 = param_1, uVar8 = WaitForExclusivetCallAccess(param_1,0x4c4c4143), (int)uVar8 == 0)) { - TRACELogPrint(0x10002,"DestroytCall: two waits failed!",piVar10,param_4); + TRACELogPrint(0x10002,"DestroytCall: two waits failed!",piVar9,param_4); return; } - piVar10 = ReferenceObject(piVar11,param_1[0xc],iVar12); - if (piVar10 != (int *)0x0) { - piVar13 = (int *)0x1; - DereferenceObject(piVar11,piVar10[0xc],1); - if (param_1 == piVar10) { + piVar9 = ReferenceObject(piVar10,param_1[0xc],iVar19); + if (piVar9 != (int *)0x0) { + piVar22 = (int *)0x1; + DereferenceObject(piVar10,piVar9[0xc],1); + if (param_1 == piVar9) { *param_1 = 0x4c41435a; LeaveCriticalSection ((LPCRITICAL_SECTION) (gLockTable + ((ulonglong)param_1 >> 4 & (ulonglong)gdwPointerToLockTableIndexBits) * 0x28)); pbVar1 = (byte *)(param_1 + 8); - local_c0 = pbVar1; + local_d0 = (LPCRITICAL_SECTION)pbVar1; while ((*pbVar1 & 1) == 0) { Sleep(0); } lVar3 = *(longlong *)(param_1 + 6); - piVar10 = (int *)(ulonglong)(uint)param_1[0x28]; - local_c8 = lVar3; + piVar9 = (int *)(ulonglong)(uint)param_1[0x28]; + uVar17 = 0; + local_b8 = lVar3; if (param_1[0x28] != 0) { - piVar10 = (int *)AcquireHashTableEntryLock(lVar3,(ulonglong)piVar10); + piVar9 = (int *)AcquireHashTableEntryLock(lVar3,(ulonglong)piVar9); lVar4 = *(longlong *)(param_1 + 0x2a); if ((lVar4 != 0) && (plVar5 = *(longlong **)(param_1 + 0x2c), plVar5 != (longlong *)0x0)) { *plVar5 = lVar4; *(longlong **)(lVar4 + 8) = plVar5; param_1[0x2a] = 0; param_1[0x2b] = 0; param_1[0x2c] = 0; param_1[0x2d] = 0; - piVar11 = piVar10; - if (*piVar10 != param_1[0x28]) { - piVar11 = (int *)FindDynamicHashTableEntry(piVar10,param_1[0x28]); - } - if (*(longlong **)(piVar11 + 2) == (longlong *)(piVar11 + 2)) { - puVar14 = *(uint **)(piVar11 + 6); - local_d8 = puVar14; - if (piVar11 == piVar10) { - *piVar10 = 0; - piVar10[6] = 0; - piVar10[7] = 0; + piVar10 = piVar9; + if (*piVar9 != param_1[0x28]) { + piVar10 = (int *)FindDynamicHashTableEntry(piVar9,param_1[0x28]); + } + if (*(longlong **)(piVar10 + 2) == (longlong *)(piVar10 + 2)) { + puVar18 = *(uint **)(piVar10 + 6); + local_e8 = puVar18; + if (piVar10 == piVar9) { + *piVar9 = 0; + piVar9[6] = 0; + piVar9[7] = 0; } else { - RemoveDynamicHashTableEntry(lVar3,piVar10,piVar11); - piVar13 = piVar11; - } - ReleaseHashTableEntryLock(*(longlong *)(param_1 + 6),(longlong)piVar10); - if (puVar14 != (uint *)0x0) { + RemoveDynamicHashTableEntry(lVar3,piVar9,piVar10); + piVar22 = piVar10; + } + ReleaseHashTableEntryLock(*(longlong *)(param_1 + 6),(longlong)piVar9); + if (puVar18 != (uint *)0x0) { local_58[0] = 0x28; local_58[1] = 0; local_58[5] = 0; local_58[6] = 0; local_58[8] = 0; local_58[9] = 0; local_58[4] = 0x21; local_58[2] = 0; local_58[3] = 0; local_58[7] = 0; - while (puVar14 != (uint *)0x0) { - puVar2 = puVar14 + 7; + while (puVar18 != (uint *)0x0) { + puVar2 = puVar18 + 7; local_58[6] = *puVar2; - piVar11 = *(int **)(puVar14 + 8); - local_58[1] = piVar11[7]; - local_b0 = puVar2; - if (*piVar11 == 0x5050414c) { - piVar10 = piVar11 + 0x14; + piVar10 = *(int **)(puVar18 + 8); + local_58[1] = piVar10[7]; + local_d8 = puVar2; + if (*piVar10 == 0x5050414c) { + piVar9 = piVar10 + 0x14; param_4 = (void *)0x0; - uVar9 = 0x21; - puVar6 = (uint *)(piVar11 + 0xc); - piVar11 = (int *)(ulonglong)*puVar6; - uVar8 = FMsgDisabled(*puVar6,(longlong)piVar10,0x21,0); - if (uVar8 == 0) { - piVar11 = *(int **)(puVar14 + 2); - WriteEventBuffer(piVar11,local_58,uVar9,param_4); + uVar8 = 0x21; + puVar6 = (uint *)(piVar10 + 0xc); + piVar10 = (int *)(ulonglong)*puVar6; + uVar7 = FMsgDisabled(*puVar6,(longlong)piVar9,0x21,0); + if (uVar7 == 0) { + piVar10 = *(int **)(puVar18 + 2); + WriteEventBuffer(piVar10,local_58,uVar8,param_4); } } - puVar6 = *(uint **)(puVar14 + 10); - *puVar14 = 0x4c564e49; - piVar13 = (int *)0x1; - piVar10 = (int *)(ulonglong)*puVar2; - DereferenceObject(piVar11,*puVar2,1); - puVar14 = puVar6; - local_d8 = puVar6; + puVar6 = *(uint **)(puVar18 + 10); + *puVar18 = 0x4c564e49; + piVar22 = (int *)0x1; + piVar9 = (int *)(ulonglong)*puVar2; + DereferenceObject(piVar10,*puVar2,1); + puVar18 = puVar6; + local_e8 = puVar6; } } goto LAB_0; } } - ReleaseHashTableEntryLock(*(longlong *)(param_1 + 6),(longlong)piVar10); + ReleaseHashTableEntryLock(*(longlong *)(param_1 + 6),(longlong)piVar9); } LAB_0: - while (*(uint **)(param_1 + 2) != (uint *)0x0) { - DestroytCallClient(*(uint **)(param_1 + 2),piVar10,piVar13,param_4); + while (*(int **)(param_1 + 2) != (int *)0x0) { + DestroytCallClient(*(int **)(param_1 + 2),piVar9,piVar22,param_4); } if ((*pbVar1 & 2) != 0) { if ((*(byte *)(lVar3 + 0x18) & 1) != 0) { WaitForSingleObject(*(HANDLE *)(lVar3 + 8),0xffffffff); } if (*(code **)(lVar3 + 0xb0) != (code *)0x0) { (**(code **)(lVar3 + 0xb0))(*(undefined8 *)(param_1 + 10)); } if ((*(byte *)(lVar3 + 0x18) & 1) != 0) { ReleaseMutex(*(HANDLE *)(lVar3 + 8)); } } + piVar9 = param_1; RemoveCallFromLineList((longlong)param_1); - pvVar15 = *(LPVOID *)(param_1 + 0x22); - if (((longlong)pvVar15 - 1U < 0xfffffffffffffffe) && - (*(int **)((longlong)pvVar15 + 0x18) == param_1)) { - local_a8[1] = 0; - memset(local_a8,0,0x44); - local_d8 = local_a8; - uVar9 = GetConfCallListFromConf((longlong)pvVar15,(longlong *)&local_d8); - puVar14 = local_d8; - if ((int)uVar9 == 0) { - uVar8 = 1; - if (1 < *local_d8) { - do { - iVar12 = SetCallConfList(*(int **)(puVar14 + (ulonglong)uVar8 * 2 + 2),(LPVOID)0x0,0); - param_1 = (int *)CONCAT44((int)((ulonglong)param_1 >> 0x20),iVar12); - uVar8 = uVar8 + 1; - } while (uVar8 < *puVar14); - } - if (puVar14 != local_a8) { - ServerFree(puVar14); - } - } - do { - pvVar7 = *(LPVOID *)((longlong)pvVar15 + 0x10); - ServerFree(pvVar15); - pvVar15 = pvVar7; - } while (pvVar7 != (LPVOID)0x0); + p_Var23 = *(LPCRITICAL_SECTION *)(param_1 + 0x22); + local_d0 = p_Var23; + if ((undefined1 *)((longlong)&p_Var23[-1].SpinCount + 7U) < (undefined1 *)0xfffffffffffffffe) + { + if (p_Var23->LockSemaphore == param_1) { + local_a8[1] = 0; + memset(local_a8,0,0x44); + local_e8 = local_a8; + uVar8 = GetConfCallListFromConf((longlong)p_Var23,(longlong *)&local_e8); + if ((int)uVar8 == 0) { + uVar17 = 1; + puVar18 = local_e8; + if (1 < *local_e8) { + do { + iVar19 = SetCallConfList(*(int **)(puVar18 + (ulonglong)uVar17 * 2 + 2),(LPVOID)0x0, + 0); + puVar18 = (uint *)CONCAT44((int)((ulonglong)puVar18 >> 0x20),iVar19); + uVar17 = uVar17 + 1; + } while (uVar17 < *puVar18); + } + if (puVar18 != local_a8) { + ServerFree(puVar18); + } + } + do { + p_Var16 = p_Var23->OwningThread; + ServerFree(p_Var23); + p_Var23 = p_Var16; + } while (p_Var16 != (LPCRITICAL_SECTION)0x0); + } + else { + uVar7 = Feature_784066872__private_IsEnabledDeviceUsageNoInline(); + if (uVar7 != 0) { + local_d8 = (uint *)0x0; + piVar10 = p_Var23->LockSemaphore; + uVar7 = uVar17; + if ((piVar10 != (int *)0x0) && (piVar10 != param_1)) { + uVar7 = piVar10[0xc]; + local_e0 = uVar7; + } + p_Var11 = p_Var16; + if (uVar7 != 0) { + p_Var11 = (LPCRITICAL_SECTION)ReferenceObject(piVar9,uVar7,0x4c4c4143); + } + if (p_Var11 == (LPCRITICAL_SECTION)0x0) { + param_1[0x22] = 0; + param_1[0x23] = 0; + } + else { + p_Var12 = p_Var11; + uVar8 = WaitForExclusivetCallAccess((int *)p_Var11,0x4c4c4143); + if ((int)uVar8 != 0) { + uVar17 = 0; + if ((p_Var11[3].OwningThread == p_Var23) && + (uVar17 = 0, p_Var23->LockSemaphore == p_Var11)) { + param_1[0x22] = 0; + param_1[0x23] = 0; + do { + uVar17 = p_Var23->LockCount; + if (uVar17 != 0) { + ppvVar13 = &p_Var23->LockSemaphore; + p_Var12 = p_Var16; + p_Var20 = p_Var16; +LAB_1: + uVar15 = (uint)p_Var12; + if (*ppvVar13 != param_1) goto code_r0x0001800050ec; + if (uVar15 < uVar17 - 1) { + ppvVar13 = &p_Var23->LockSemaphore + (uVar15 + 1); + ppvVar21 = &p_Var23->LockSemaphore + (longlong)&p_Var20->DebugInfo; + for (uVar14 = (ulonglong)((uVar17 - 1) - uVar15); uVar14 != 0; + uVar14 = uVar14 - 1) { + *ppvVar21 = *ppvVar13; + ppvVar13 = ppvVar13 + 1; + ppvVar21 = ppvVar21 + 1; + } + } + p_Var23->LockCount = p_Var23->LockCount + -1; + p_Var23 = p_Var16; + } +LAB_2: + } while ((p_Var23 != (LPCRITICAL_SECTION)0x0) && + (p_Var23 = p_Var23->OwningThread, p_Var23 != (LPCRITICAL_SECTION)0x0)); + uVar17 = 1; + } + p_Var12 = (LPCRITICAL_SECTION) + (gLockTable + + ((ulonglong)p_Var11 >> 4 & (ulonglong)gdwPointerToLockTableIndexBits) * + 0x28); + LeaveCriticalSection(p_Var12); + } + if (uVar17 == 0) { + param_1[0x22] = 0; + param_1[0x23] = 0; + } + DereferenceObject(p_Var12,uVar7,1); + } + } + } } while (param_1[0x2f] != 0) { Sleep(5); } FreetCall((longlong)param_1); return; } } LeaveCriticalSection ((LPCRITICAL_SECTION) (gLockTable + ((ulonglong)param_1 >> 4 & (ulonglong)gdwPointerToLockTableIndexBits) * 0x28)); return; +code_r0x0001800050ec: + p_Var12 = (LPCRITICAL_SECTION)(ulonglong)(uVar15 + 1); + p_Var20 = (LPCRITICAL_SECTION)((longlong)&p_Var20->DebugInfo + 1); + ppvVar13 = ppvVar13 + 1; + if (uVar17 <= uVar15 + 1) goto LAB_2; + goto LAB_1; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## KERNEL32.DLL::LeaveCriticalSection ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|refcount| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|LeaveCriticalSection|LeaveCriticalSection| |fullname|KERNEL32.DLL::LeaveCriticalSection|KERNEL32.DLL::LeaveCriticalSection| |`refcount`|229|230| |length|0|0| |called||| |calling|

Expand for full list:
AcquireHashTableEntryLock
AppendNewDeviceInfo
BuildDeviceInfoList
CleanUpClient
ClientAttach
ClientDetach
CreateCallMonitors
CreateTapiSCP
CreatetCallClient
DequeueSPEvent
DereferenceObject

DestroytCall
DestroytCallClient
DestroytLineApp
DestroytLineClient
DestroytPhoneApp
DestroytPhoneClient
EventNotificationThread
FreeDialogInstance
FreeOldDllListProc
GetAsyncEvents
GetCallClientListFromCall
GetCallIDs
GetClientList
GetDeviceInfo
GetHighestPriorityRequestRecipient
GetLineAppListFromClient
GetPhoneAppListFromClient
GetPriorityListForMediaModes
GetPriorityListTReqCall
GetTCClient
GetUIDllName
InitializeClient
InsertDevNameAddrInfo
LAccept
LAddToConference_PostProcess
LAnswer
LCompleteTransfer_PostProcess
LGetAppPriority
LGetConfRelatedCalls
LGetID
LGetRequest
LHandoff
LInitialize
LMakeCall_PostProcess
LMonitorDigits
LMonitorMedia
LMonitorTones
LNegotiateAPIVersion
LProxyResponse
LRegisterRequestRecipient
LSetAppPriority
LSetCallPrivilege
LSetNumRings
LSetStatusMessages
LSetupConference_PostProcess
LineEventProc
MGetDeviceFlags
MSetLineInfo
MSetPhoneInfo
MSetServerConfig
NewObject
NotifyHighestPriorityRequestRecipient
OnProxyLineClose
OnProxyLineOpen
OnProxySCPInit
OnProxySCPShutdown
PCONTEXT_HANDLE_TYPE_rundown
PInitialize
PNegotiateAPIVersion
POpen
PSetStatusMessages
PhoneEventProc
QueueSPEvent
ReadAndInitManagementDlls
ReferenceObject
RemoveCallClientFromLineClientList
RemoveDeviceInfoEntry
SendAMsgToAllLineApps
SendAMsgToAllPhoneApps
SendProxyRequest
ServiceMain
ServiceShutdown
SetCallConfList
SetDeviceInfo
SetDrvCallFlags
SetGlobalEventMasks
SettCallClientEventMasks
SettClientEventMasks
SettLineAppEventMasks
SettLineClientEventMasks
SettPhoneAppEventMasks
SettPhoneClientEventMasks
TGetEventMasksOrSubMasks
TGetPermissibleMasks
TRequestMakeCall
TSetEventMasksOrSubMasks
TSetPermissibleMasks
TUISPIDLLCallback
UpdateCallHubHashing
UpdateTapiSCP
WaitForExclusiveClientAccess
WaitForExclusiveLineAppAccess
WaitForExclusiveLineClientAccess
WaitForExclusivePhoneAppAccess
WaitForExclusivePhoneClientAccess
WaitForExclusivetCallAccess
WaitForMutex
WriteEventBuffer
wil::details::unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_CRITICAL_SECTION*___ptr64,struct__RTL_CRITICAL_SECTION*___ptr64,0,std::nullptr_t>_>
xxxLOpen

| |paramcount|1|1| |address|EXTERNAL:000000ad|EXTERNAL:000000ad| |sig|void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)|void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ## USER32.DLL::LoadIconW ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|LoadIconW|LoadIconW| |fullname|USER32.DLL::LoadIconW|USER32.DLL::LoadIconW| |`refcount`|3|1| |length|0|0| |called||| |`calling`|ServiceMain|| |paramcount|2|2| |address|EXTERNAL:000000db|EXTERNAL:000000db| |sig|HICON __stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)|HICON __stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### USER32.DLL::LoadIconW Calling Diff ```diff --- USER32.DLL::LoadIconW calling +++ USER32.DLL::LoadIconW calling @@ -1 +0,0 @@ -ServiceMain ``` ## GetSubMaskIndex ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.71| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|GetSubMaskIndex|GetSubMaskIndex| |fullname|GetSubMaskIndex|GetSubMaskIndex| |`refcount`|8|3| |length|16|16| |called||| |`calling`|FMsgDisabled
SetEventMasksOrSubMasks
TGetEventMasksOrSubMasks|FMsgDisabled
GetEventMasksOrSubMasks
SetEventMasksOrSubMasks| |paramcount|1|1| |`address`|180037864|180037ac0| |sig|int __fastcall GetSubMaskIndex(ulonglong param_1)|int __fastcall GetSubMaskIndex(ulonglong param_1)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| ### GetSubMaskIndex Calling Diff ```diff --- GetSubMaskIndex calling +++ GetSubMaskIndex calling @@ -1,0 +2 @@ +GetEventMasksOrSubMasks @@ -3 +3,0 @@ -TGetEventMasksOrSubMasks ``` ## ReferenceObject ### Match Info |Key|tapisrv_8521.dll - tapisrv_8655.dll| | :---: | :---: | |diff_type|refcount,address| |ratio|1.0| |i_ratio|0.83| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|tapisrv_8521.dll|tapisrv_8655.dll| | :---: | :---: | :---: | |name|ReferenceObject|ReferenceObject| |fullname|ReferenceObject|ReferenceObject| |`refcount`|93|94| |length|207|207| |called|KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection|KERNEL32.DLL::EnterCriticalSection
KERNEL32.DLL::LeaveCriticalSection| |calling|

Expand for full list:
ClientDetach
ClientRequest
CompletionProcSP
CreatetCallClient
DestroytCall
DestroytCallClient
DestroytLineApp
DestroytLineClient
DestroytPhoneApp
DestroytPhoneClient
FreeDialogInstance

GetPhoneVersions
IsValidCallHub
IsValidLineApp
LAddToConference
LAddToConference_PostProcess
LCompleteTransfer
LCompleteTransfer_PostProcess
LDevSpecific
LForward
LGetNewCalls
LGetStatusMessages
LMakeCall
LMakeCall_PostProcess
LPickup
LPrepareAddToConference
LProxyResponse
LReceiveMSPData
LRemoveFromConference
LSetCallPrivilege
LSetupConference
LSetupConference_PostProcess
LSetupTransfer
LSwapHold
LUnpark
LineEventProc
LineProlog
PCONTEXT_HANDLE_TYPE_rundown
PClose
PGetID
PGetStatus
PGetStatusMessages
PNegotiateAPIVersion
PSelectExtVersion
PSetStatusMessages
PhoneEventProc
PhoneProlog
ReferenceCall
SetDrvCallFlags
TGetEventMasksOrSubMasks
TSetEventMasksOrSubMasks
TUISPIDLLCallback
WaitForExclusiveLineAppAccess
WaitForExclusivePhoneAppAccess

Expand for full list:
CreateCallMonitors
CreatetCallClient
DestroytCall
GetCallClientListFromCall
LAccept
LAddToConference_PostProcess
LAnswer
LCompleteTransfer_PostProcess
LGetConfRelatedCalls
LHandoff
LMakeCall_PostProcess

LMonitorDigits
LMonitorMedia
LMonitorTones
LSetCallPrivilege
LSetupConference_PostProcess
LineEventProc
SetCallConfList
SettCallClientEventMasks
UpdateCallHubHashing

Expand for full list:
ClientAttach
ClientDetach
ClientRequest
CompletionProcSP
CreatetCall
CreatetCallClient
DestroytCall
DestroytCallClient
DestroytLine
DestroytLineApp
DestroytLineClient

DestroytPhone
DestroytPhoneApp
DestroytPhoneClient
DoCallHubHashing
FreeDialogInstance
FreetCall
GetPhoneVersions
GetUIDllName
IsValidCallHub
IsValidLineApp
LAddToConference
LAddToConference_PostProcess
LCompleteTransfer
LCompleteTransfer_PostProcess
LDevSpecific
LGatherDigits
LGenerateDigits
LGenerateTone
LGetCallAddressID
LGetCallIDs
LGetConfRelatedCalls
LGetHubRelatedCalls
LGetNewCalls
LGetStatusMessages
LInitialize
LMakeCall_PostProcess
LProxyMessage
LProxyResponse
LReceiveMSPData
LRemoveFromConference_PostProcess
LSetCallPrivilege
LSetupConference
LSetupConference_PostProcess
LSetupTransfer
LSwapHold
LineEpilogAsync
LineEpilogSync
LineEventProc
PCONTEXT_HANDLE_TYPE_rundown
PClose
PGetID
PGetStatus
PGetStatusMessages
PInitialize
PNegotiateAPIVersion
POpen
PSelectExtVersion
PSetStatusMessages
PhoneEpilogAsync
PhoneEventProc
PhoneProlog
ReferenceCall
SPEventHandlerThread
SetDrvCallFlags
TGetEventMasksOrSubMasks
TSetEventMasksOrSubMasks
TUISPIDLLCallback
WaitForExclusiveLineAppAccess
WaitForExclusivePhoneAppAccess
xxxLOpen

Expand for full list:
ClientAttach
ClientDetach
ClientRequest
CompletionProcSP
CreatetCall
CreatetCallClient
DestroytCall
DestroytCallClient
DestroytLine
DestroytLineApp
DestroytLineClient

| |paramcount|3|3| |`address`|180041f5c|18004200c| |sig|undefined __fastcall DereferenceObject(undefined8 param_1, uint param_2, int param_3)|undefined __fastcall DereferenceObject(undefined8 param_1, uint param_2, int param_3)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|False|False| _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T20:28:53}