# ws_7309.dll-ws_7623.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::ReportUsageToService](#wildetailsreportusagetoservice) * [wil::details::WilApi_GetFeatureEnabledState](#wildetailswilapi_getfeatureenabledstate) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3403109688getcachedfeatureenabledstate) * [wil::details::FeatureImpl::GetCurrentFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3403109688getcurrentfeatureenabledstate) * [wil::details::FeatureImpl::ReportUsage](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3403109688reportusage) * [Modified](#modified) * [wil::details::FeatureImpl::ReportUsage](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_apiusagetelemetrygereportusage) * [TheWallet::Release](#thewalletrelease) * [wil::details::FeatureImpl::GetCurrentFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_apiusagetelemetrygegetcurrentfeatureenabledstate) * [wil::details::ReportUsageToServiceDirect](#wildetailsreportusagetoservicedirect) * [wil::details::EnabledStateManager::QueueBackgroundUsageReporting](#wildetailsenabledstatemanagerqueuebackgroundusagereporting) * [ATL::CComCritSecLock::~CComCritSecLock](#atlccomcritseclockclass_atlccomautocriticalsectionccomcritseclockclass_atlccomautocriticalsection) * [Modified (No Code Changes)](#modified-no-code-changes) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [push_back](#push_back) * [~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) # Visual Chart Diff ```mermaid flowchart LR wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEReportUsage-4-old<--Match 67%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEReportUsage-4-new TheWalletRelease-1-old<--Match 61%-->TheWalletRelease-1-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEGetCurrentFeatureEnabledState-2-old<--Match 70%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEGetCurrentFeatureEnabledState-2-new wildetailsReportUsageToServiceDirect-8-old<--Match 97%-->wildetailsReportUsageToServiceDirect-8-new wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-old<--Match 93%-->wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-new ATLCComCritSecLockclass_ATLCComAutoCriticalSectionCComCritSecLockclass_ATLCComAutoCriticalSection-1-old<--Match 36%-->wildetailsFeatureImplstruct___WilFeatureTraits_Feature_3403109688__private_IsEnabled-1-new subgraph ws_7623.dll wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEReportUsage-4-new TheWalletRelease-1-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEGetCurrentFeatureEnabledState-2-new wildetailsReportUsageToServiceDirect-8-new wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-new wildetailsFeatureImplstruct___WilFeatureTraits_Feature_3403109688__private_IsEnabled-1-new subgraph Added direction LR wil-details-ReportUsageToService wil-details-WilApi_GetFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3403109688-GetCachedFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3403109688-GetCurrentFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3403109688-ReportUsage end end subgraph ws_7309.dll wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEReportUsage-4-old TheWalletRelease-1-old wildetailsFeatureImplstruct___WilFeatureTraits_Feature_APIUsageTelemetryGEGetCurrentFeatureEnabledState-2-old wildetailsReportUsageToServiceDirect-8-old wildetailsEnabledStateManagerQueueBackgroundUsageReporting-3-old ATLCComCritSecLockclass_ATLCComAutoCriticalSectionCComCritSecLockclass_ATLCComAutoCriticalSection-1-old end ``` ```mermaid pie showData title Function Matches - 99.8767% "unmatched_funcs_len" : 5 "matched_funcs_len" : 4049 ``` ```mermaid pie showData title Matched Function Similarity - 99.7530% "matched_funcs_with_code_changes_len" : 6 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 4039 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 ws_7309.dll ws_7623.dll ``` #### Verbose Args
``` --old ['ws_7309.dll'] --new [['ws_7623.dll']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/WalletService.dll/0F72BC8376000/WalletService.dll -O walletservice.dll.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/WalletService.dll/982E93FD76000/WalletService.dll -O walletservice.dll.x64.10.0.26100.7623 ``` ## Binary Metadata Diff ```diff --- ws_7309.dll Meta +++ ws_7623.dll Meta @@ -1,44 +1,44 @@ -Program Name: ws_7309.dll +Program Name: ws_7623.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f # of Bytes: 486256 # of Memory Blocks: 10 -# of Instructions: 69761 -# of Defined Data: 5366 -# of Functions: 2024 -# of Symbols: 15281 -# of Data Types: 1294 +# of Instructions: 70003 +# of Defined Data: 5368 +# of Functions: 2030 +# of Symbols: 15332 +# of Data Types: 1298 # of Data Type Categories: 110 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 22:50:48 SGT 2026 +Date Created: Sun Aug 16 22:50:52 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/ws/ws_7309.dll -Executable MD5: 5c3bcda436e03367a2bb6003a2248084 -Executable SHA256: ce29edfce447d9f20218d33c60e98a7f2f339512735d3bcfb73227888e47e218 -FSRL: file:///tmp/ws/ws_7309.dll?MD5=5c3bcda436e03367a2bb6003a2248084 +Executable Location: /tmp/ws/ws_7623.dll +Executable MD5: d082fdf4868a1925633c2dd376e02c01 +Executable SHA256: 0050a978e39b82cb28a554f9c1263f0cc90bf2fcf5b771c850832f50596c8d67 +FSRL: file:///tmp/ws/ws_7623.dll?MD5=d082fdf4868a1925633c2dd376e02c01 PDB Age: 1 PDB File: walletservice.pdb -PDB GUID: 4f409d44-0ae8-1fce-7bcc-d15bc5b2a4aa +PDB GUID: 33ef3448-8df4-3571-b2b4-c118c0dbbd28 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Wallet Service -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7623 (WinBuild.160101.0800) PE Property[InternalName]: Wallet Service PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: WalletService.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7623 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra ws_7309.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ws_7309.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ws_7309.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra ws_7623.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra ws_7623.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra ws_7623.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|5| |deleted_funcs_len|0| |modified_funcs_len|10| |added_symbols_len|0| |deleted_symbols_len|0| |diff_time|5.299258470535278| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 2013, 'ExternalsName': 311, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 2, 'StructuralGraphHash': 2, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1, 'Implied Match': 1})| |items_to_process|15| |diff_types|Counter({'code': 6, 'length': 6, 'address': 6, 'calling': 6, 'refcount': 5, 'called': 4, 'name': 1, 'fullname': 1, 'sig': 1, 'parent': 1})| |unmatched_funcs_len|5| |total_funcs_len|4054| |matched_funcs_len|4049| |matched_funcs_with_code_changes_len|6| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|4039| |match_func_similarity_percent|99.7530%| |func_match_overall_percent|99.8767%| |first_matches|Counter({'SymbolsHash': 2013, 'ExactBytesFunctionHasher': 2, 'ExactInstructionsFunctionHasher': 2, 'StructuralGraphHash': 2, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1, 'Implied Match': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 2013 "ExternalsName" : 311 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 2 "BulkInstructionHash" : 1 "SigCallingCalledHasher" : 1 "StructuralGraphHash" : 2 "Implied-Match" : 1 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 2013 "ExactBytesFunctionHasher" : 2 "ExactInstructionsFunctionHasher" : 2 "BulkInstructionHash" : 1 "SigCallingCalledHasher" : 1 "StructuralGraphHash" : 2 "Implied-Match" : 1 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 5 "deleted_funcs_len" : 0 "modified_funcs_len" : 10 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 0 "deleted_symbols_len" : 0 ``` ## Strings *No string differences found* # Deleted # Added ## wil::details::ReportUsageToService ### Function Meta |Key|ws_7623.dll| | :---: | :---: | |name|ReportUsageToService| |fullname|wil::details::ReportUsageToService| |refcount|3| |length|164| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage| |paramcount|8| |address|1800090ac| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::ReportUsageToService +++ wil::details::ReportUsageToService @@ -0,0 +1,31 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* void __cdecl wil::details::ReportUsageToService(struct wil_details_FeatureReportingCache * + __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS const * __ptr64,int,enum + wil_ReportingKind,unsigned __int64) */ + +void __cdecl +wil::details::ReportUsageToService + (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, + FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8) + +{ + wil_details_ServiceReportingKind wVar1; + int iVar2; + uint in_stack_ffffffffffffffd0; + undefined1 in_stack_ffffffffffffffd8; + undefined7 in_stack_ffffffffffffffd9; + + param_7 = 3; + wVar1 = wil_details_MapReportingKind(3,param_6); + iVar2 = ReportUsageToServiceDirect + (param_1,param_2,param_3,param_4,wVar1,in_stack_ffffffffffffffd0, + CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8),(uchar)param_5[4] + ); + if ((iVar2 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { + (*g_wil_details_pfnFeatureLoggingHook)(param_2,param_5,0,param_6,¶m_7,0,0,1); + } + return; +} + ``` ## wil::details::WilApi_GetFeatureEnabledState ### Function Meta |Key|ws_7623.dll| | :---: | :---: | |name|WilApi_GetFeatureEnabledState| |fullname|wil::details::WilApi_GetFeatureEnabledState| |refcount|2| |length|35| |called|_guard_dispatch_icall$thunk$10345483385596137414| |calling|wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |paramcount|3| |address|18000a178| |sig|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::WilApi_GetFeatureEnabledState +++ wil::details::WilApi_GetFeatureEnabledState @@ -0,0 +1,23 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* enum FEATURE_ENABLED_STATE __cdecl wil::details::WilApi_GetFeatureEnabledState(unsigned int,enum + FEATURE_CHANGE_TIME,int * __ptr64) */ + +FEATURE_ENABLED_STATE __cdecl +wil::details::WilApi_GetFeatureEnabledState(uint param_1,FEATURE_CHANGE_TIME param_2,int *param_3) + +{ + FEATURE_ENABLED_STATE FVar1; + code *pcVar2; + + pcVar2 = g_wil_details_internalGetFeatureEnabledState; + if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && + (pcVar2 = g_wil_details_apiGetFeatureEnabledState, + g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { + return 0; + } + FVar1 = (*pcVar2)(param_1,3); + return FVar1; +} + ``` ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|ws_7623.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|293| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|1800175ac| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,82 @@ + +/* WARNING: Removing unreachable block (ram,0x0001800175fe) */ +/* WARNING: Removing unreachable block (ram,0x000180017604) */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + FeatureImpl *this_00; + uint uVar4; + uint *in_RDX; + bool bVar5; + uint local_res10 [2]; + undefined *local_res18 [2]; + undefined4 local_38; + undefined4 local_34; + FeatureImpl *local_30; + + in_RDX[0] = 0; + in_RDX[1] = 0; + uVar3 = *(uint *)this; + *in_RDX = uVar3; + if (((byte)uVar3 & 6) == 6) { + return; + } + this_00 = this; + uVar2 = EnsureSubscribedToFeatureConfigurationChanges(); + GetCurrentFeatureEnabledState(this_00,(int *)local_res10); + uVar3 = *in_RDX; + do { + uVar1 = uVar3; + *in_RDX = uVar1; + uVar4 = uVar1; + if ((uVar1 & 4) == 0) { + uVar4 = uVar1 & 0xfffffbff | local_res10[0] & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + uVar3 = *(uint *)this; + bVar5 = uVar1 == uVar3; + if (bVar5) { + *(uint *)this = uVar4; + uVar3 = uVar1; + } + UNLOCK(); + } while (!bVar5); + if (((uVar1 & 4) != 0) || + (g_enabledStateManager == (shutdown_aware_object)0x0)) + goto LAB_1800176aa; + AcquireSRWLockExclusive((PSRWLOCK)&DAT_18006c550); + local_res18[0] = &DAT_18006c550; + if ((uVar2 == 0) || (uVar2 != DAT_18006c564)) { +LAB_18001769d: + LOCK(); + *(uint *)this = *(uint *)this & 0xfffffffb; + UNLOCK(); + } + else { + local_34 = 0; + local_38 = 3; + local_30 = this; + bVar5 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_18006c598,&local_38,0x10); + if (!bVar5) goto LAB_18001769d; + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)local_res18); +LAB_1800176aa: + if ((*in_RDX & 2) == 0) { + *in_RDX = *in_RDX & 0xfffff63e | local_res10[0] & 0x9c1; + } + return; +} + ``` ## wil::details::FeatureImpl::GetCurrentFeatureEnabledState ### Function Meta |Key|ws_7623.dll| | :---: | :---: | |name|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |refcount|2| |length|174| |called|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |paramcount|2| |address|1800176d8| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState @@ -0,0 +1,45 @@ + +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ + +int * __thiscall +wil::details::FeatureImpl:: +GetCurrentFeatureEnabledState + (FeatureImpl *this,int *param_1) + +{ + bool bVar1; + FEATURE_ENABLED_STATE FVar2; + uint uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + int *in_R8; + + FVar2 = WilApi_GetFeatureEnabledState(0x389eb6c,(FEATURE_CHANGE_TIME)param_1,in_R8); + param_1[0] = 0; + param_1[1] = 0; + uVar5 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400; + uVar6 = uVar5 | (FVar2 & 3) << 7; + *param_1 = uVar6; + if ((FVar2 & 0xffffff3f) == 0) { + uVar3 = 0x40; + } + else { + uVar3 = 0; + if ((FVar2 & 0xffffff3f) == 2) { + uVar3 = 0x40; + } + } + bVar1 = false; + uVar4 = 1; + if ((uVar5 == 0xc00) || (uVar3 != 0)) { + bVar1 = true; + } + if ((uVar3 == 0) || (!bVar1)) { + uVar4 = 0; + } + *param_1 = uVar6 | uVar3 | uVar4; + return param_1; +} + ``` ## wil::details::FeatureImpl::ReportUsage ### Function Meta |Key|ws_7623.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl::ReportUsage| |refcount|2| |length|119| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|4| |address|1800193d4| |sig|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::ReportUsage +++ wil::details::FeatureImpl::ReportUsage @@ -0,0 +1,32 @@ + +/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned + __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl::ReportUsage + (FeatureImpl *this,bool param_1, + ReportingKind param_2,__uint64 param_3) + +{ + ulonglong *puVar1; + ulonglong uVar2; + undefined4 local_res8; + undefined2 local_resc; + wil_ReportingKind in_stack_ffffffffffffffd8; + __uint64 in_stack_ffffffffffffffe0; + + uVar2 = (ulonglong)*(uint *)this; + if ((*(uint *)this & 4) == 0) { + puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); + uVar2 = *puVar1; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x389eb6c,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1, + in_stack_ffffffffffffffd8,in_stack_ffffffffffffffe0); + return; +} + ``` # Modified *Modified functions contain code changes* ## wil::details::FeatureImpl::ReportUsage ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.34| |i_ratio|0.24| |m_ratio|0.74| |b_ratio|0.67| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|ReportUsage|ReportUsage| |fullname|wil::details::FeatureImpl::ReportUsage|wil::details::FeatureImpl::ReportUsage| |refcount|2|2| |`length`|212|119| |`called`|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl::__private_IsEnabled|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|4|4| |`address`|18000903c|18000902c| |sig|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl::ReportUsage Called Diff ```diff --- wil::details::FeatureImpl::ReportUsage called +++ wil::details::FeatureImpl::ReportUsage called @@ -1 +0,0 @@ -_guard_dispatch_icall$thunk$10345483385596137414 @@ -3,2 +2 @@ -wil::details::ReportUsageToServiceDirect -wil_details_MapReportingKind +wil::details::ReportUsageToService ``` ### wil::details::FeatureImpl::ReportUsage Diff ```diff --- wil::details::FeatureImpl::ReportUsage +++ wil::details::FeatureImpl::ReportUsage @@ -1,49 +1,32 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ /* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned __int64) __ptr64 */ void __thiscall wil::details::FeatureImpl::ReportUsage (FeatureImpl *this,bool param_1, ReportingKind param_2,__uint64 param_3) { - wil_details_ServiceReportingKind wVar1; - int iVar2; - ulonglong *puVar3; - uint uVar4; - ulonglong uVar5; + ulonglong *puVar1; + ulonglong uVar2; undefined4 local_res8; undefined2 local_resc; - undefined4 local_res18 [2]; - __uint64 local_res20; - uint in_stack_ffffffffffffffb0; - undefined1 in_stack_ffffffffffffffb8; - undefined7 in_stack_ffffffffffffffb9; + wil_ReportingKind in_stack_ffffffffffffffd8; + __uint64 in_stack_ffffffffffffffe0; - local_res18[0] = CONCAT31(local_res18[0]._1_3_,(char)param_2); - uVar5 = (ulonglong)*(uint *)this; - local_res20 = param_3; + uVar2 = (ulonglong)*(uint *)this; if ((*(uint *)this & 4) == 0) { - puVar3 = (ulonglong *)GetCachedFeatureEnabledState(this); - local_res20 = *puVar3; - uVar5 = local_res20 & 0xffffffff; + puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); + uVar2 = *puVar1; } + local_res8 = 0; local_resc = 1; - local_res8 = 0; - local_res18[0] = 3; - uVar4 = (uint)param_1; - wVar1 = wil_details_MapReportingKind(3,uVar4); - iVar2 = ReportUsageToServiceDirect - ((wil_details_FeatureReportingCache *)(this + 8),uVar4,(uint)uVar5 >> 10 & 1, - (uint)(uVar5 >> 0xb) & 1,wVar1,in_stack_ffffffffffffffb0, - CONCAT71(in_stack_ffffffffffffffb9,in_stack_ffffffffffffffb8),'\x01'); - if ((iVar2 != 0) && (g_wil_details_pfnFeatureLoggingHook != (code *)0x0)) { - (*g_wil_details_pfnFeatureLoggingHook)(0x36ce414,&local_res8,0,param_1,local_res18,0,0,1); - } + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x36ce414,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1, + in_stack_ffffffffffffffd8,in_stack_ffffffffffffffe0); return; } ``` ## TheWallet::Release ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.39| |m_ratio|0.7| |b_ratio|0.61| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|Release|Release| |fullname|TheWallet::Release|TheWallet::Release| |refcount|4|4| |`length`|84|152| |`called`|ATL::CComCritSecLock::CComCritSecLock
ATL::CComCritSecLock::~CComCritSecLock
_guard_dispatch_icall$thunk$10345483385596137414|ATL::CComCritSecLock::CComCritSecLock
ATL::CComCritSecLock::~CComCritSecLock
_guard_dispatch_icall$thunk$10345483385596137414
wil::details::FeatureImpl::__private_IsEnabled| |calling|TheWallet::Release`adjustor{8}'|TheWallet::Release`adjustor{8}'| |paramcount|1|1| |`address`|180018fd0|180019220| |sig|ulong __thiscall Release(TheWallet * this)|ulong __thiscall Release(TheWallet * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### TheWallet::Release Called Diff ```diff --- TheWallet::Release called +++ TheWallet::Release called @@ -3,0 +4 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### TheWallet::Release Diff ```diff --- TheWallet::Release +++ TheWallet::Release @@ -1,35 +1,59 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* public: virtual unsigned long __cdecl TheWallet::Release(void) __ptr64 */ ulong __thiscall TheWallet::Release(TheWallet *this) { - TheWallet *pTVar1; - int iVar2; - ulong uVar3; + int iVar1; + bool bVar2; + TheWallet *pTVar3; CComAutoCriticalSection *in_RDX; + ulong uVar4; + ulong uVar5; bool in_R8B; CComCritSecLock local_18 [16]; LOCK(); - pTVar1 = this + 0x48; - iVar2 = *(int *)pTVar1; - *(int *)pTVar1 = *(int *)pTVar1 + -1; + pTVar3 = this + 0x48; + iVar1 = *(int *)pTVar3; + *(int *)pTVar3 = *(int *)pTVar3 + -1; UNLOCK(); - uVar3 = iVar2 - 1; - if (uVar3 == 0) { - ATL::CComCritSecLock:: - CComCritSecLock(local_18,in_RDX,in_R8B); - if (*(int *)(this + 0x48) == 0) { + if (iVar1 - 1U != 0) { + return iVar1 - 1U; + } + ATL::CComCritSecLock:: + CComCritSecLock(local_18,in_RDX,in_R8B); + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + uVar4 = 0; + if (bVar2) { + uVar5 = *(ulong *)(this + 0x48); + if (*(ulong *)(this + 0x48) != 0) goto LAB_0; + LOCK(); + pTVar3 = s_pInstance; + if (this == s_pInstance) { s_pInstance = (TheWallet *)0x0; - (**(code **)(*(longlong *)this + 0x50))(this,1); + pTVar3 = this; } - ATL::CComCritSecLock:: - ~CComCritSecLock(local_18); - uVar3 = 0; + UNLOCK(); + uVar5 = uVar4; + if (this != pTVar3) goto LAB_0; } - return uVar3; + else { + uVar5 = uVar4; + if (*(int *)(this + 0x48) != 0) goto LAB_0; + s_pInstance = (TheWallet *)0x0; + } + uVar5 = uVar4; + if (this != (TheWallet *)0x0) { + (**(code **)(*(longlong *)this + 0x50))(this,1); + } +LAB_0: + ATL::CComCritSecLock:: + ~CComCritSecLock(local_18); + return uVar5; } ``` ## wil::details::FeatureImpl::GetCurrentFeatureEnabledState ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,length,called| |ratio|0.5| |i_ratio|0.13| |m_ratio|0.94| |b_ratio|0.7| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|GetCurrentFeatureEnabledState|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCurrentFeatureEnabledState|wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |refcount|2|2| |`length`|185|162| |`called`|_guard_dispatch_icall$thunk$10345483385596137414|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |paramcount|2|2| |address|180006810|180006810| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::FeatureImpl::GetCurrentFeatureEnabledState Called Diff ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState called +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState called @@ -1 +1 @@ -_guard_dispatch_icall$thunk$10345483385596137414 +wil::details::WilApi_GetFeatureEnabledState ``` ### wil::details::FeatureImpl::GetCurrentFeatureEnabledState Diff ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState @@ -1,50 +1,44 @@ -/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: - guard_dispatch_icall */ /* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ int * __thiscall wil::details::FeatureImpl:: GetCurrentFeatureEnabledState (FeatureImpl *this,int *param_1) { bool bVar1; - uint uVar2; + FEATURE_ENABLED_STATE FVar2; uint uVar3; - code *pcVar4; + uint uVar4; + int *in_R8; uint uVar5; - uint uVar6; - uVar6 = 0; - pcVar4 = g_wil_details_internalGetFeatureEnabledState; - if ((g_wil_details_internalGetFeatureEnabledState != (code *)0x0) || - (pcVar4 = g_wil_details_apiGetFeatureEnabledState, uVar2 = uVar6, - g_wil_details_apiGetFeatureEnabledState != (code *)0x0)) { - uVar2 = (*pcVar4)(0x36ce414,3); - } + FVar2 = WilApi_GetFeatureEnabledState(0x36ce414,(FEATURE_CHANGE_TIME)param_1,in_R8); + uVar5 = 0; param_1[0] = 0; param_1[1] = 0; - uVar5 = (((uVar2 & 3) << 2 | uVar2 & 0x40) << 2 | uVar2 & 0x80) << 3; - if ((uVar2 & 0xffffff3f) != 0) { - uVar3 = uVar6; - if ((uVar2 & 0xffffff3f) == 2) { + uVar4 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400 | + (FVar2 & 3) << 7; + if ((FVar2 & 0xffffff3f) != 0) { + uVar3 = 0; + if ((FVar2 & 0xffffff3f) == 2) { uVar3 = 0x40; } - uVar5 = uVar5 | uVar3; + uVar4 = uVar4 | uVar3; } bVar1 = false; - if ((uVar5 & 0xc00) == 0xc00) { + if ((uVar4 & 0xc00) == 0xc00) { bVar1 = true; LAB_0: - if (((uVar5 & 0x40) == 0) || (!bVar1)) goto LAB_1; + if (((uVar4 & 0x40) == 0) || (!bVar1)) goto LAB_1; } - else if ((uVar5 & 0x40) == 0) goto LAB_0; - uVar6 = 1; + else if ((uVar4 & 0x40) == 0) goto LAB_0; + uVar5 = 1; LAB_1: - *param_1 = uVar5 | uVar6; + *param_1 = uVar4 | uVar5; return param_1; } ``` ## wil::details::ReportUsageToServiceDirect ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,length,address,calling| |ratio|0.47| |i_ratio|0.52| |m_ratio|0.98| |b_ratio|0.97| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|ReportUsageToServiceDirect|ReportUsageToServiceDirect| |fullname|wil::details::ReportUsageToServiceDirect|wil::details::ReportUsageToServiceDirect| |refcount|2|2| |`length`|315|306| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::WilApi_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::WilApi_RecordFeatureUsage
wil_details_FeatureReporting_RecordUsageInCache| |`calling`|wil::details::FeatureImpl::ReportUsage|wil::details::ReportUsageToService| |paramcount|8|8| |`address`|180009118|180009158| |sig|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)|int __cdecl ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7, uchar param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::ReportUsageToServiceDirect Calling Diff ```diff --- wil::details::ReportUsageToServiceDirect calling +++ wil::details::ReportUsageToServiceDirect calling @@ -1 +1 @@ -wil::details::FeatureImpl::ReportUsage +wil::details::ReportUsageToService ``` ### wil::details::ReportUsageToServiceDirect Diff ```diff --- wil::details::ReportUsageToServiceDirect +++ wil::details::ReportUsageToServiceDirect @@ -1,72 +1,68 @@ /* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: guard_dispatch_icall */ /* int __cdecl wil::details::ReportUsageToServiceDirect(struct wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,enum wil_details_ServiceReportingKind,unsigned int,unsigned __int64,unsigned char) */ int __cdecl wil::details::ReportUsageToServiceDirect (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4, wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7,uchar param_8) { undefined8 uVar1; - uint uVar2; + wil_details_ServiceReportingKind wVar2; uint uVar3; uint uVar4; - uint *puVar5; - wil_details_ServiceReportingKind wVar6; + uint uVar5; + uint *puVar6; + int iVar7; int iVar8; - int iVar9; undefined4 in_register_0000008c; - int local_28; - uint local_20 [6]; - wil_details_FeatureReportingCache *pwVar7; + int local_38; + uint local_30 [6]; - pwVar7 = param_1; - iVar9 = param_4; - puVar5 = wil_details_FeatureReporting_RecordUsageInCache - (local_20,(uint *)param_1,(ulonglong)param_5); - wVar6 = (wil_details_ServiceReportingKind)pwVar7; - iVar8 = 1; - uVar2 = *puVar5; - uVar3 = puVar5[1]; - uVar4 = puVar5[2]; - uVar1 = *(undefined8 *)(puVar5 + 4); + iVar8 = param_4; + puVar6 = wil_details_FeatureReporting_RecordUsageInCache + (local_30,(uint *)param_1,(ulonglong)param_5); + iVar7 = 1; + uVar3 = *puVar6; + uVar4 = puVar6[1]; + uVar5 = puVar6[2]; + uVar1 = *(undefined8 *)(puVar6 + 4); if ((g_wil_details_RecordSRUMFeatureUsage != (code *)0x0) && ((param_5 == 0 || (param_5 - 100 < 0x32)))) { - wVar6 = param_5; - (*g_wil_details_RecordSRUMFeatureUsage)(0x36ce414,param_5,1); - } - if (uVar2 != 0) { - EnabledStateManager::QueueBackgroundUsageReporting - ((EnabledStateManager *)&g_enabledStateManager,wVar6,param_1); + (*g_wil_details_RecordSRUMFeatureUsage)(param_2,param_5,1); } if (uVar3 != 0) { - WilApi_RecordFeatureUsage(0x36ce414,uVar4,uVar3,(char *)CONCAT44(in_register_0000008c,iVar9)); + EnabledStateManager::QueueBackgroundUsageReporting + ((EnabledStateManager *)&g_enabledStateManager,param_2,param_1); } - local_28 = (int)uVar1; - if (local_28 == 0) { + if (uVar4 != 0) { + WilApi_RecordFeatureUsage(param_2,uVar5,uVar4,(char *)CONCAT44(in_register_0000008c,iVar8)); + } + local_38 = (int)uVar1; + if (local_38 == 0) { EnabledStateManager::EnsureSubscribedToUsageFlush ((EnabledStateManager *)&g_enabledStateManager, ::); } if (param_3 != 0) { - wVar6 = param_5 | 0x80000000; + wVar2 = param_5 | 0x80000000; if (param_4 == 0) { - wVar6 = param_5; + wVar2 = param_5; } - WilApi_RecordFeatureUsage(0x36ce414,wVar6,0,(char *)CONCAT44(in_register_0000008c,iVar9)); + WilApi_RecordFeatureUsage(param_2,wVar2,0,(char *)CONCAT44(in_register_0000008c,iVar8)); } - if (local_28 == 0) { + if (local_38 == 0) { if (g_wil_details_realtimeFeatureUsageHook != (code *)0x0) { - (*g_wil_details_realtimeFeatureUsageHook)(0x36ce414,param_5,param_8); + (*g_wil_details_realtimeFeatureUsageHook)(param_2,param_5,param_8); } } else { - iVar8 = 0; + iVar7 = 0; } - return iVar8; + return iVar7; } ``` ## wil::details::EnabledStateManager::QueueBackgroundUsageReporting ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,length,address| |ratio|0.88| |i_ratio|0.65| |m_ratio|0.95| |b_ratio|0.93| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|QueueBackgroundUsageReporting|QueueBackgroundUsageReporting| |fullname|wil::details::EnabledStateManager::QueueBackgroundUsageReporting|wil::details::EnabledStateManager::QueueBackgroundUsageReporting| |refcount|2|2| |`length`|217|212| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-THREADPOOL-L1-2-0.DLL::CreateThreadpoolTimer
wil::ProcessShutdownInProgress
wil::details::EnsureCoalescedTimer_SetTimer
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details::unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>::reset
wil::details_abi::heap_buffer::push_back
wil::last_error_context::last_error_context
wil::last_error_context::~last_error_context| |calling|wil::details::ReportUsageToServiceDirect|wil::details::ReportUsageToServiceDirect| |paramcount|3|3| |`address`|180008408|1800083f8| |sig|void __thiscall QueueBackgroundUsageReporting(EnabledStateManager * this, uint param_1, wil_details_FeatureReportingCache * param_2)|void __thiscall QueueBackgroundUsageReporting(EnabledStateManager * this, uint param_1, wil_details_FeatureReportingCache * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### wil::details::EnabledStateManager::QueueBackgroundUsageReporting Diff ```diff --- wil::details::EnabledStateManager::QueueBackgroundUsageReporting +++ wil::details::EnabledStateManager::QueueBackgroundUsageReporting @@ -1,52 +1,53 @@ /* public: void __cdecl wil::details::EnabledStateManager::QueueBackgroundUsageReporting(unsigned int,struct wil_details_FeatureReportingCache * __ptr64) __ptr64 */ void __thiscall wil::details::EnabledStateManager::QueueBackgroundUsageReporting (EnabledStateManager *this,uint param_1,wil_details_FeatureReportingCache *param_2) { unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> *this_00; bool bVar1; PTP_TIMER p_Var2; last_error_context local_res8 [8]; EnabledStateManager *local_res20; - undefined8 local_18; - wil_details_FeatureReportingCache *local_10; + uint local_28 [2]; + wil_details_FeatureReportingCache *local_20; if (*this != (EnabledStateManager)0x0) { bVar1 = ProcessShutdownInProgress(); if (!bVar1) { AcquireSRWLockExclusive((PSRWLOCK)(this + 8)); - local_18 = 0x36ce414; + local_28[1] = 0; local_res20 = this + 8; - local_10 = param_2; - details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x30),&local_18,0x10); + local_28[0] = param_1; + local_20 = param_2; + details_abi::heap_buffer::push_back((heap_buffer *)(this + 0x30),local_28,0x10); this_00 = (unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> *)(this + 0x10); if (this[0x18] == (EnabledStateManager)0x0) { if (*(longlong *)this_00 == 0) { last_error_context::last_error_context(local_res8); p_Var2 = CreateThreadpoolTimer (::,this ,(PTP_CALLBACK_ENVIRON)0x0); unique_storage::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_> ::reset(this_00,p_Var2); last_error_context::~last_error_context(local_res8); } EnsureCoalescedTimer_SetTimer ((unique_any_t::Destroy(struct__TP_TIMER*___ptr64),struct_wistd::integral_constant,struct__TP_TIMER*___ptr64,struct__TP_TIMER*___ptr64,0,std::nullptr_t>_>_> *)this_00,(bool *)(this + 0x18),300000); } unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> :: ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> *)&local_res20); } } return; } ``` ## ATL::CComCritSecLock::~CComCritSecLock ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|code,name,fullname,refcount,length,sig,address,calling,called,parent| |ratio|0.33| |i_ratio|0.21| |m_ratio|0.86| |b_ratio|0.36| |match_types|Implied Match| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |`name`|~CComCritSecLock|__private_IsEnabled| |`fullname`|ATL::CComCritSecLock::~CComCritSecLock|wil::details::FeatureImpl::__private_IsEnabled| |`refcount`|7|2| |`length`|40|53| |`called`|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |`calling`|RWService::OnStopping
TheWallet::GetInstance
TheWallet::GetWalletBackgroundAgentManager
TheWallet::Release
TheWallet::ShutdownThreadpools|TheWallet::Release| |paramcount|1|1| |`address`|180016568|18001a058| |`sig`|void __thiscall ~CComCritSecLock(CComCritSecLock * this)|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ATL::CComCritSecLock::~CComCritSecLock Called Diff ```diff --- ATL::CComCritSecLock::~CComCritSecLock called +++ wil::details::FeatureImpl::__private_IsEnabled called @@ -1 +1,2 @@ -API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::LeaveCriticalSection +wil::details::FeatureImpl::GetCachedFeatureEnabledState +wil::details::FeatureImpl::ReportUsage ``` ### ATL::CComCritSecLock::~CComCritSecLock Calling Diff ```diff --- ATL::CComCritSecLock::~CComCritSecLock calling +++ wil::details::FeatureImpl::__private_IsEnabled calling @@ -1,3 +0,0 @@ -RWService::OnStopping -TheWallet::GetInstance -TheWallet::GetWalletBackgroundAgentManager @@ -5 +1,0 @@ -TheWallet::ShutdownThreadpools ``` ### ATL::CComCritSecLock::~CComCritSecLock Diff ```diff --- ATL::CComCritSecLock::~CComCritSecLock +++ wil::details::FeatureImpl::__private_IsEnabled @@ -1,17 +1,18 @@ -/* public: __cdecl ATL::CComCritSecLock::~CComCritSecLock(void) __ptr64 */ +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ -void __thiscall -ATL::CComCritSecLock:: -~CComCritSecLock - (CComCritSecLock *this) +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) { - if (this[8] != (CComCritSecLock)0x0) { - LeaveCriticalSection(*(LPCRITICAL_SECTION *)this); - this[8] = (CComCritSecLock)0x0; - } - return; + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; + + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + return (bool)(local_res10 & 1); } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|25|26| |length|0|0| |called||| |`calling`|
Expand for full list:
::
::
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|EXTERNAL:00000077|EXTERNAL:00000077| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -12,0 +13 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## push_back ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|refcount,address,calling| |ratio|1.0| |i_ratio|0.93| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|push_back|push_back| |fullname|wil::details_abi::heap_buffer::push_back|wil::details_abi::heap_buffer::push_back| |`refcount`|6|7| |length|97|97| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure| |`calling`|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3|3| |`address`|18000a578|18000a5e8| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### push_back Calling Diff ```diff --- wil::details_abi::heap_buffer::push_back calling +++ wil::details_abi::heap_buffer::push_back calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|29|30| |length|29|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
::
WalletTelemetry::ItemDeletedByApp::StartActivity
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStop
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImplwil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
WalletTelemetry::ItemDeletedByApp::StartActivity
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStop
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImplwil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|1800055fc|1800055fc| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -15,0 +16 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|ws_7309.dll - ws_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|ws_7309.dll|ws_7623.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|3|4| |length|32|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |address|180006194|180006194| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-16T22:51:39