# wal_8737.dll-wal_8875.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3305877819getcachedfeatureenabledstate) * [wil::details::FeatureImpl::GetCurrentFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3305877819getcurrentfeatureenabledstate) * [wil::details::FeatureImpl::ReportUsage](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3305877819reportusage) * [wil::details::FeatureImpl::__private_IsEnabled](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_3305877819__private_isenabled) * [Modified](#modified) * [Wallet::ServerUtils::HideAndRestrictFolder](#walletserverutilshideandrestrictfolder) * [Wallet::WalletDatabaseESE::HandleDatabaseCorruption](#walletwalletdatabaseesehandledatabasecorruption) * [Wallet::FileUtils::DeleteFiles](#walletfileutilsdeletefiles) * [RestrictFolder](#restrictfolder) * [Wallet::WalletDatabaseESE::Open](#walletwalletdatabaseeseopen) * [Modified (No Code Changes)](#modified-no-code-changes) * [API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive](#api-ms-win-core-synch-l1-1-0dllacquiresrwlockexclusive) * [push_back](#push_back) * [API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount](#api-ms-win-core-sysinfo-l1-1-0dllgettickcount) * [WilApi_GetFeatureEnabledState](#wilapi_getfeatureenabledstate) * [ReportUsageToService](#reportusagetoservice) * [~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>](#unique_storagestruct_wildetailsresource_policystruct__rtl_srwlock___ptr64void___cdeclstruct__rtl_srwlock___ptr64void___cdecl_releasesrwlockexclusivestruct__rtl_srwlock___ptr64struct_wistdintegral_constantunsigned___int641struct__rtl_srwlock___ptr64struct__rtl_srwlock___ptr640stdnullptr_t_) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) * [basic_string,class_utl::allocator_>](#basic_stringunsigned_shortstruct_utlchar_traitsunsigned_shortclass_utlallocatorunsigned_short_) # Visual Chart Diff ```mermaid flowchart LR WalletServerUtilsHideAndRestrictFolder-1-old<--Match 87%-->WalletServerUtilsHideAndRestrictFolder-1-new WalletWalletDatabaseESEHandleDatabaseCorruption-1-old<--Match 68%-->WalletWalletDatabaseESEHandleDatabaseCorruption-1-new WalletFileUtilsDeleteFiles-1-old<--Match 85%-->WalletFileUtilsDeleteFiles-1-new RestrictFolder-1-old<--Match 91%-->RestrictFolder-1-new WalletWalletDatabaseESEOpen-2-old<--Match 96%-->WalletWalletDatabaseESEOpen-2-new subgraph wal_8875.dll WalletServerUtilsHideAndRestrictFolder-1-new WalletWalletDatabaseESEHandleDatabaseCorruption-1-new WalletFileUtilsDeleteFiles-1-new RestrictFolder-1-new WalletWalletDatabaseESEOpen-2-new subgraph Added direction LR wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3305877819-GetCachedFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3305877819-GetCurrentFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3305877819-ReportUsage wil-details-FeatureImplstruct___WilFeatureTraits_Feature_3305877819-__private_IsEnabled end end subgraph wal_8737.dll WalletServerUtilsHideAndRestrictFolder-1-old WalletWalletDatabaseESEHandleDatabaseCorruption-1-old WalletFileUtilsDeleteFiles-1-old RestrictFolder-1-old WalletWalletDatabaseESEOpen-2-old end ``` ```mermaid pie showData title Function Matches - 99.9019% "unmatched_funcs_len" : 4 "matched_funcs_len" : 4074 ``` ```mermaid pie showData title Matched Function Similarity - 99.5336% "matched_funcs_with_code_changes_len" : 5 "matched_funcs_with_non_code_changes_len" : 14 "matched_funcs_no_changes_len" : 4055 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 wal_8737.dll wal_8875.dll ``` #### Verbose Args
``` --old ['wal_8737.dll'] --new [['wal_8875.dll']] --engine VersionTrackingDiff --output-path wal_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```
#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/WalletService.dll/FA6E9F5B76000/WalletService.dll -O walletservice.dll.x64.10.0.26100.8737 wget https://msdl.microsoft.com/download/symbols/WalletService.dll/99607AE377000/WalletService.dll -O walletservice.dll.x64.10.0.26100.8875 ``` ## Binary Metadata Diff ```diff --- wal_8737.dll Meta +++ wal_8875.dll Meta @@ -1,44 +1,44 @@ -Program Name: wal_8737.dll +Program Name: wal_8875.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 486352 +# of Bytes: 490512 # of Memory Blocks: 10 -# of Instructions: 70438 -# of Defined Data: 5402 -# of Functions: 2037 -# of Symbols: 15407 -# of Data Types: 1304 -# of Data Type Categories: 109 +# of Instructions: 70681 +# of Defined Data: 5409 +# of Functions: 2041 +# of Symbols: 15447 +# of Data Types: 1301 +# of Data Type Categories: 110 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Fri Aug 21 21:53:14 SGT 2026 +Date Created: Fri Aug 21 21:53:18 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/wal/wal_8737.dll -Executable MD5: 3951ee88919a50215a2c25e479363496 -Executable SHA256: 51a15901b445f0f58d0930535b2136bb567e56709291ca758f5a8265d66f4d12 -FSRL: file:///tmp/wal/wal_8737.dll?MD5=3951ee88919a50215a2c25e479363496 +Executable Location: /tmp/wal/wal_8875.dll +Executable MD5: 7bd209ca397adc0f0189314be76061e1 +Executable SHA256: b9b1b38e9036f9b55634bcd8181e779ebfc599587da4b374bf33fbe124d04880 +FSRL: file:///tmp/wal/wal_8875.dll?MD5=7bd209ca397adc0f0189314be76061e1 PDB Age: 1 PDB File: walletservice.pdb -PDB GUID: 0ac9793a-47d3-1ecd-ea60-c18c9773f9a5 +PDB GUID: b1bfb3a3-98d0-f47e-99fe-53a272b4bfdc PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Wallet Service -PE Property[FileVersion]: 10.0.26100.8737 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.8875 (WinBuild.160101.0800) PE Property[InternalName]: Wallet Service PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: WalletService.dll PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.8737 +PE Property[ProductVersion]: 10.0.26100.8875 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options
Ghidra wal_8737.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra wal_8737.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra wal_8737.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra wal_8875.dll Decompiler Options |Decompiler Option|Value| | :---: | :---: | |Prototype Evaluation|__fastcall|
Ghidra wal_8875.dll Specification extensions Options |Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|
Ghidra wal_8875.dll Analyzers Options |Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|4| |deleted_funcs_len|0| |modified_funcs_len|19| |added_symbols_len|5| |deleted_symbols_len|2| |diff_time|5.692721366882324| |deleted_strings_len|1| |added_strings_len|1| |match_types|Counter({'SymbolsHash': 1947, 'ExternalsName': 312, 'ExactInstructionsFunctionHasher': 27, 'SigCallingCalledHasher': 21, 'ExactBytesFunctionHasher': 15, 'BulkBasicBlockMnemonicHash': 14, 'BSIM': 2, 'StructuralGraphHash': 2})| |items_to_process|30| |diff_types|Counter({'refcount': 14, 'address': 11, 'calling': 10, 'fullname': 6, 'sig': 6, 'parent': 6, 'code': 5, 'length': 5, 'called': 5, 'name': 2})| |unmatched_funcs_len|4| |total_funcs_len|4078| |matched_funcs_len|4074| |matched_funcs_with_code_changes_len|5| |matched_funcs_with_non_code_changes_len|14| |matched_funcs_no_changes_len|4055| |match_func_similarity_percent|99.5336%| |func_match_overall_percent|99.9019%| |first_matches|Counter({'SymbolsHash': 1947, 'ExactInstructionsFunctionHasher': 27, 'SigCallingCalledHasher': 21, 'ExactBytesFunctionHasher': 15, 'BulkBasicBlockMnemonicHash': 14, 'BSIM': 2, 'StructuralGraphHash': 2})| ```mermaid pie showData title All Matches "SymbolsHash" : 1947 "ExternalsName" : 312 "ExactBytesFunctionHasher" : 15 "ExactInstructionsFunctionHasher" : 27 "BSIM" : 2 "SigCallingCalledHasher" : 21 "StructuralGraphHash" : 2 "BulkBasicBlockMnemonicHash" : 14 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1947 "ExactBytesFunctionHasher" : 15 "ExactInstructionsFunctionHasher" : 27 "BSIM" : 2 "SigCallingCalledHasher" : 21 "StructuralGraphHash" : 2 "BulkBasicBlockMnemonicHash" : 14 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 4 "deleted_funcs_len" : 0 "modified_funcs_len" : 19 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 5 "deleted_symbols_len" : 2 ``` ## Strings ```mermaid pie showData title Strings "deleted_strings_len" : 1 "added_strings_len" : 1 ``` ### Strings Diff ```diff --- deleted strings +++ added strings @@ -1 +1 @@ -u_EOEOO +u_EOEEO ``` ### String References #### Old |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_EOEOO_18005420a|2|DrawPOSBarcode| #### New |String|Ref Count|Ref Func| | :---: | :---: | :---: | |u_EOEEO_18005520a|2|DrawPOSBarcode| # Deleted # Added ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|wal_8875.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|302| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>
wil::details_abi::heap_buffer::push_back| |calling|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|18000e10c| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,81 @@ + +/* WARNING: Removing unreachable block (ram,0x00018000e167) */ +/* WARNING: Removing unreachable block (ram,0x00018000e16c) */ +/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + uint uVar3; + uint uVar4; + uint *in_RDX; + bool bVar5; + uint local_res18 [2]; + undefined *local_res20; + undefined4 local_38; + undefined4 local_34; + undefined4 *local_30; + + in_RDX[0] = 0; + uVar3 = Feature_3305877819__private_cppFeatureState; + in_RDX[1] = 0; + *in_RDX = Feature_3305877819__private_cppFeatureState; + if (((byte)uVar3 & 6) == 6) { + return; + } + uVar2 = EnsureSubscribedToFeatureConfigurationChanges(); + GetCurrentFeatureEnabledState(this,(int *)local_res18); + uVar3 = *in_RDX; + do { + uVar1 = uVar3; + uVar4 = uVar1 | 0x40000; + *in_RDX = uVar4; + if ((uVar1 & 4) == 0) { + uVar4 = uVar1 & 0xfffffbff | 0x40000 | local_res18[0] & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + bVar5 = uVar1 != Feature_3305877819__private_cppFeatureState; + uVar3 = uVar1; + if (bVar5) { + uVar3 = Feature_3305877819__private_cppFeatureState; + uVar4 = Feature_3305877819__private_cppFeatureState; + } + Feature_3305877819__private_cppFeatureState = uVar4; + UNLOCK(); + } while (bVar5); + if (((uVar1 & 4) != 0) || (_g_enabledStateManager == 0)) goto LAB_18000e213; + AcquireSRWLockExclusive((PSRWLOCK)&DAT_18006d550); + local_res20 = &DAT_18006d550; + if ((uVar2 == 0) || (uVar2 != DAT_18006d564)) { +LAB_18000e206: + LOCK(); + Feature_3305877819__private_cppFeatureState = + Feature_3305877819__private_cppFeatureState & 0xfffffffb; + UNLOCK(); + } + else { + local_34 = 0; + local_38 = 3; + local_30 = &Feature_3305877819__private_cppFeatureState; + bVar5 = details_abi::heap_buffer::push_back((heap_buffer *)&DAT_18006d588,&local_38,0x10); + if (!bVar5) goto LAB_18000e206; + } + unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + :: + ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + ((unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> + *)&local_res20); +LAB_18000e213: + if ((*in_RDX & 2) == 0) { + *in_RDX = *in_RDX & 0xfffff63e | local_res18[0] & 0x9c1; + } + return; +} + ``` ## wil::details::FeatureImpl::GetCurrentFeatureEnabledState ### Function Meta |Key|wal_8875.dll| | :---: | :---: | |name|GetCurrentFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |refcount|2| |length|174| |called|wil::details::WilApi_GetFeatureEnabledState| |calling|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |paramcount|2| |address|18000e2bc| |sig|wil_details_FeatureStateCache __thiscall GetCurrentFeatureEnabledState(FeatureImpl * this, int * param_1)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCurrentFeatureEnabledState +++ wil::details::FeatureImpl::GetCurrentFeatureEnabledState @@ -0,0 +1,45 @@ + +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCurrentFeatureEnabledState(int * __ptr64) __ptr64 */ + +int * __thiscall +wil::details::FeatureImpl:: +GetCurrentFeatureEnabledState + (FeatureImpl *this,int *param_1) + +{ + bool bVar1; + FEATURE_ENABLED_STATE FVar2; + uint uVar3; + uint uVar4; + uint uVar5; + uint uVar6; + int *in_R8; + + FVar2 = WilApi_GetFeatureEnabledState(0x3b01caf,(FEATURE_CHANGE_TIME)param_1,in_R8); + param_1[0] = 0; + param_1[1] = 0; + uVar5 = -(uint)((FVar2 & 0x40) != 0) & 0x800 | -(uint)((FVar2 & 0x80) != 0) & 0x400; + uVar6 = uVar5 | (FVar2 & 3) << 7; + *param_1 = uVar6; + if ((FVar2 & 0xffffff3f) == 0) { + uVar3 = 0x40; + } + else { + uVar3 = 0; + if ((FVar2 & 0xffffff3f) == 2) { + uVar3 = 0x40; + } + } + bVar1 = false; + uVar4 = 1; + if ((uVar5 == 0xc00) || (uVar3 != 0)) { + bVar1 = true; + } + if ((uVar3 == 0) || (!bVar1)) { + uVar4 = 0; + } + *param_1 = uVar6 | uVar3 | uVar4; + return param_1; +} + ``` ## wil::details::FeatureImpl::ReportUsage ### Function Meta |Key|wal_8875.dll| | :---: | :---: | |name|ReportUsage| |fullname|wil::details::FeatureImpl::ReportUsage| |refcount|2| |length|134| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|4| |address|1800116e8| |sig|void __thiscall ReportUsage(FeatureImpl * this, bool param_1, ReportingKind param_2, __uint64 param_3)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::ReportUsage +++ wil::details::FeatureImpl::ReportUsage @@ -0,0 +1,31 @@ + +/* public: void __cdecl wil::details::FeatureImpl::ReportUsage(bool,enum wil::ReportingKind,unsigned + __int64) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl::ReportUsage + (FeatureImpl *this,bool param_1, + ReportingKind param_2,__uint64 param_3) + +{ + ulonglong *puVar1; + ulonglong uVar2; + undefined4 local_res8; + undefined2 local_resc; + __uint64 in_stack_ffffffffffffffe0; + + uVar2 = (ulonglong)Feature_3305877819__private_cppFeatureState; + if ((Feature_3305877819__private_cppFeatureState & 4) == 0) { + puVar1 = (ulonglong *)GetCachedFeatureEnabledState(this); + uVar2 = *puVar1; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x3b01caf,(uint)uVar2 >> 10 & 1, + (uint)(uVar2 >> 0xb) & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)param_1,3, + in_stack_ffffffffffffffe0); + return; +} + ``` ## wil::details::FeatureImpl::__private_IsEnabled ### Function Meta |Key|wal_8875.dll| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl::__private_IsEnabled| |refcount|6| |length|78| |called|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::ReportUsage| |calling|RestrictFolder
Wallet::FileUtils::DeleteFiles
Wallet::ServerUtils::HideAndRestrictFolder
Wallet::WalletDatabaseESE::HandleDatabaseCorruption
Wallet::WalletDatabaseESE::Open| |paramcount|1| |address|1800138a8| |sig|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::__private_IsEnabled +++ wil::details::FeatureImpl::__private_IsEnabled @@ -0,0 +1,19 @@ + +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) + +{ + ReportingKind in_R8D; + __uint64 in_R9; + undefined1 local_res10; + + GetCachedFeatureEnabledState(this); + ReportUsage(this,(bool)(local_res10 & 1),in_R8D,in_R9); + Feature_3305877819__private_lastUsedTickCount = GetTickCount(); + return (bool)(local_res10 & 1); +} + ``` # Modified *Modified functions contain code changes* ## Wallet::ServerUtils::HideAndRestrictFolder ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.25| |i_ratio|0.6| |m_ratio|0.93| |b_ratio|0.87| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|HideAndRestrictFolder|HideAndRestrictFolder| |fullname|Wallet::ServerUtils::HideAndRestrictFolder|Wallet::ServerUtils::HideAndRestrictFolder| |refcount|2|2| |`length`|157|183| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::GetFileAttributesW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::SetFileAttributesW
IsFolderRestricted
RestrictFolder|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::GetFileAttributesW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::SetFileAttributesW
IsFolderRestricted
RestrictFolder
wil::details::FeatureImpl::__private_IsEnabled| |calling|Wallet::WalletDatabaseESE::Open|Wallet::WalletDatabaseESE::Open| |paramcount|1|1| |`address`|18001d354|18001d694| |sig|long __cdecl HideAndRestrictFolder(ushort * param_1)|long __cdecl HideAndRestrictFolder(ushort * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Wallet::ServerUtils::HideAndRestrictFolder Called Diff ```diff --- Wallet::ServerUtils::HideAndRestrictFolder called +++ Wallet::ServerUtils::HideAndRestrictFolder called @@ -5,0 +6 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### Wallet::ServerUtils::HideAndRestrictFolder Diff ```diff --- Wallet::ServerUtils::HideAndRestrictFolder +++ Wallet::ServerUtils::HideAndRestrictFolder @@ -1,41 +1,50 @@ /* long __cdecl Wallet::ServerUtils::HideAndRestrictFolder(unsigned short const * __ptr64) */ long __cdecl Wallet::ServerUtils::HideAndRestrictFolder(ushort *param_1) { - DWORD DVar1; - BOOL BVar2; - long lVar3; + bool bVar1; + DWORD DVar2; + BOOL BVar3; long lVar4; + long lVar5; bool local_res10 [24]; - lVar3 = 0; - if (g_fUnitTestContext == 0) { - DVar1 = GetFileAttributesW((LPCWSTR)param_1); - if (((DVar1 & 2) == 0) && (BVar2 = SetFileAttributesW((LPCWSTR)param_1,DVar1 | 2), BVar2 == 0)) - { - DVar1 = GetLastError(); - if (DVar1 == 0) { - DVar1 = 0x80390004; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + lVar4 = 0; + } + else { + lVar4 = 0; + if (g_fUnitTestContext == 0) { + DVar2 = GetFileAttributesW((LPCWSTR)param_1); + if (((DVar2 & 2) == 0) && (BVar3 = SetFileAttributesW((LPCWSTR)param_1,DVar2 | 2), BVar3 == 0) + ) { + DVar2 = GetLastError(); + if (DVar2 == 0) { + DVar2 = 0x80390004; + } + else if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; + } + if ((int)DVar2 < 0) { + return DVar2; + } } - else if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; - } - if ((int)DVar1 < 0) { - return DVar1; - } - } - local_res10[0] = false; - lVar3 = IsFolderRestricted(param_1,local_res10); - if ((-1 < lVar3) && (lVar3 = 0, local_res10[0] == false)) { - lVar4 = RestrictFolder(param_1); - lVar3 = 0; - if (lVar4 < 0) { - lVar3 = lVar4; + local_res10[0] = false; + lVar4 = IsFolderRestricted(param_1,local_res10); + if ((-1 < lVar4) && (lVar4 = 0, local_res10[0] == false)) { + lVar5 = RestrictFolder(param_1); + lVar4 = 0; + if (lVar5 < 0) { + lVar4 = lVar5; + } } } } - return lVar3; + return lVar4; } ``` ## Wallet::WalletDatabaseESE::HandleDatabaseCorruption ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.3| |i_ratio|0.43| |m_ratio|0.83| |b_ratio|0.68| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|HandleDatabaseCorruption|HandleDatabaseCorruption| |fullname|Wallet::WalletDatabaseESE::HandleDatabaseCorruption|Wallet::WalletDatabaseESE::HandleDatabaseCorruption| |refcount|2|2| |`length`|173|241| |`called`|MSVCRT.DLL::mbstowcs_s
Wallet::FileUtils::DeleteFiles
Wallet::ServerUtils::GetWalletPhotosPath
Wallet::WalletDatabaseESE::SetCorruptionRegKey
__security_check_cookie
utl::basic_string,class_utl::allocator_>::_Uninit
utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_>|MSVCRT.DLL::mbstowcs_s
Wallet::FileUtils::DeleteFiles
Wallet::ServerUtils::GetWalletPhotosPath
Wallet::WalletDatabaseESE::SetCorruptionRegKey
__security_check_cookie
utl::basic_string,class_utl::allocator_>::_Uninit
wil::details::FeatureImpl::__private_IsEnabled| |calling|Wallet::WalletDatabaseESE::LoadDatabase|Wallet::WalletDatabaseESE::LoadDatabase| |paramcount|1|1| |`address`|18000eee8|18000f0d8| |sig|long __cdecl HandleDatabaseCorruption(char * param_1)|long __cdecl HandleDatabaseCorruption(char * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Wallet::WalletDatabaseESE::HandleDatabaseCorruption Called Diff ```diff --- Wallet::WalletDatabaseESE::HandleDatabaseCorruption called +++ Wallet::WalletDatabaseESE::HandleDatabaseCorruption called @@ -7 +7 @@ -utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_> +wil::details::FeatureImpl::__private_IsEnabled ``` ### Wallet::WalletDatabaseESE::HandleDatabaseCorruption Diff ```diff --- Wallet::WalletDatabaseESE::HandleDatabaseCorruption +++ Wallet::WalletDatabaseESE::HandleDatabaseCorruption @@ -1,47 +1,55 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: static long __cdecl Wallet::WalletDatabaseESE::HandleDatabaseCorruption(char const * __ptr64) */ long __cdecl Wallet::WalletDatabaseESE::HandleDatabaseCorruption(char *param_1) { - errno_t eVar1; + bool bVar1; long lVar2; - long lVar3; + errno_t eVar3; + long lVar4; undefined1 auStackY_288 [32]; size_t local_258; - ushort *local_250 [5]; + ushort *local_250; + ushort *local_248; + ushort local_240 [12]; wchar_t local_228 [264]; ulonglong local_18; local_18 = __security_cookie ^ (ulonglong)auStackY_288; - lVar3 = 0; - utl:: - basic_string,class_utl::allocator_> - :: - basic_string,class_utl::allocator_> - ((basic_string,class_utl::allocator_> - *)local_250); - local_258 = 0; - eVar1 = mbstowcs_s(&local_258,local_228,0x104,param_1,0x103); - if (eVar1 == 0) { - FileUtils::DeleteFiles((ushort *)local_228); - lVar2 = ServerUtils::GetWalletPhotosPath - ((basic_string,class_utl::allocator_> - *)local_250); - if (-1 < lVar2) { - FileUtils::DeleteFiles(local_250[0]); - } - SetCorruptionRegKey(0); + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + lVar2 = 0; + if (bVar1) { + lVar2 = 0; } else { - lVar3 = -0x7fff0001; + local_250 = local_240; + local_240[0] = 0; + local_248 = local_240; + local_258 = 0; + eVar3 = mbstowcs_s(&local_258,local_228,0x104,param_1,0x103); + if (eVar3 == 0) { + FileUtils::DeleteFiles((ushort *)local_228); + lVar4 = ServerUtils::GetWalletPhotosPath + ((basic_string,class_utl::allocator_> + *)&local_250); + if (-1 < lVar4) { + FileUtils::DeleteFiles(local_250); + } + SetCorruptionRegKey(0); + } + else { + lVar2 = -0x7fff0001; + } + utl:: + basic_string,class_utl::allocator_> + ::_Uninit((basic_string,class_utl::allocator_> + *)&local_250); } - utl:: - basic_string,class_utl::allocator_> - ::_Uninit((basic_string,class_utl::allocator_> - *)local_250); - return lVar3; + return lVar2; } ``` ## Wallet::FileUtils::DeleteFiles ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.61| |i_ratio|0.65| |m_ratio|0.97| |b_ratio|0.85| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|DeleteFiles|DeleteFiles| |fullname|Wallet::FileUtils::DeleteFiles|Wallet::FileUtils::DeleteFiles| |refcount|3|3| |`length`|358|377| |`called`|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::DeleteFileW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::FindFirstFileW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::FindNextFileW
StringCchPrintfW
__security_check_cookie
memset
tlx::unique_any::~unique_any|API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-FILE-L1-1-0.DLL::DeleteFileW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::FindFirstFileW
API-MS-WIN-CORE-FILE-L1-1-0.DLL::FindNextFileW
StringCchPrintfW
__security_check_cookie
memset
tlx::unique_any::~unique_any
wil::details::FeatureImpl::__private_IsEnabled| |calling|Wallet::WalletDatabaseESE::HandleDatabaseCorruption|Wallet::WalletDatabaseESE::HandleDatabaseCorruption| |paramcount|1|1| |`address`|18003784c|180037bbc| |sig|int __cdecl DeleteFiles(ushort * param_1)|int __cdecl DeleteFiles(ushort * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Wallet::FileUtils::DeleteFiles Called Diff ```diff --- Wallet::FileUtils::DeleteFiles called +++ Wallet::FileUtils::DeleteFiles called @@ -8,0 +9 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### Wallet::FileUtils::DeleteFiles Diff ```diff --- Wallet::FileUtils::DeleteFiles +++ Wallet::FileUtils::DeleteFiles @@ -1,65 +1,72 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* int __cdecl Wallet::FileUtils::DeleteFiles(unsigned short const * __ptr64) */ int __cdecl Wallet::FileUtils::DeleteFiles(ushort *param_1) { - long lVar1; - DWORD DVar2; - uint uVar3; - BOOL BVar4; + bool bVar1; + long lVar2; + DWORD DVar3; + uint uVar4; + BOOL BVar5; HANDLE hFindFile; - uint uVar5; int iVar6; + uint uVar7; undefined1 auStack_6d8 [32]; WCHAR *local_6b8; HANDLE local_6a8 [2]; _WIN32_FIND_DATAW local_698; WCHAR local_448 [264]; WCHAR local_238 [264]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStack_6d8; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + if (bVar1) { + return 0; + } memset(&local_698,0,0x250); local_6a8[0] = (HANDLE)0xffffffffffffffff; iVar6 = 1; - uVar5 = 1; - lVar1 = StringCchPrintfW((ushort *)local_448,0x104,(ushort *)L"%s\\*",param_1); - if (-1 < lVar1) { + uVar7 = 1; + lVar2 = StringCchPrintfW((ushort *)local_448,0x104,(ushort *)L"%s\\*",param_1); + if (-1 < lVar2) { hFindFile = FindFirstFileW(local_448,&local_698); local_6a8[0] = hFindFile; if (hFindFile == (HANDLE)0xffffffffffffffff) { - DVar2 = GetLastError(); - if (DVar2 != 0) { - if (0 < (int)DVar2) { - DVar2 = DVar2 & 0xffff | 0x80070000; + DVar3 = GetLastError(); + if (DVar3 != 0) { + if (0 < (int)DVar3) { + DVar3 = DVar3 & 0xffff | 0x80070000; } goto LAB_0; } } else { do { if (((byte)local_698.dwFileAttributes & 0x10) == 0) { local_6b8 = local_698.cFileName; - DVar2 = StringCchPrintfW((ushort *)local_238,0x104,(ushort *)L"%s\\%s",param_1); - if ((int)DVar2 < 0) break; - uVar3 = DeleteFileW(local_238); - uVar5 = uVar5 & uVar3; + DVar3 = StringCchPrintfW((ushort *)local_238,0x104,(ushort *)L"%s\\%s",param_1); + if ((int)DVar3 < 0) break; + uVar4 = DeleteFileW(local_238); + uVar7 = uVar7 & uVar4; } - BVar4 = FindNextFileW(hFindFile,&local_698); - DVar2 = 0; - } while (BVar4 != 0); - if (uVar5 != 0) { + BVar5 = FindNextFileW(hFindFile,&local_698); + DVar3 = 0; + } while (BVar5 != 0); + if (uVar7 != 0) { LAB_0: - if (-1 < (int)DVar2) goto LAB_1; + if (-1 < (int)DVar3) goto LAB_1; } } } iVar6 = 0; LAB_1: tlx::unique_any::~unique_any ((unique_any *)local_6a8); return iVar6; } ``` ## RestrictFolder ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.65| |i_ratio|0.71| |m_ratio|0.98| |b_ratio|0.91| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|RestrictFolder|RestrictFolder| |fullname|RestrictFolder|RestrictFolder| |refcount|2|2| |`length`|547|571| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::AddAccessAllowedAceEx
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::GetLengthSid
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::InitializeAcl
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::InitializeSecurityDescriptor
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::SetFileSecurityW
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::SetSecurityDescriptorDacl
CreateLocalWellKnownSid
MSVCRT.DLL::operator_delete[]
operator_new[]
std::unique_ptr_>::_Delete
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::AddAccessAllowedAceEx
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::GetLengthSid
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::InitializeAcl
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::InitializeSecurityDescriptor
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::SetFileSecurityW
API-MS-WIN-SECURITY-BASE-L1-1-0.DLL::SetSecurityDescriptorDacl
CreateLocalWellKnownSid
MSVCRT.DLL::operator_delete[]
operator_new[]
std::unique_ptr_>::_Deletewil::details::FeatureImpl::__private_IsEnabled
| |calling|Wallet::ServerUtils::HideAndRestrictFolder|Wallet::ServerUtils::HideAndRestrictFolder| |paramcount|1|1| |`address`|18001d6cc|18001da28| |sig|long __cdecl RestrictFolder(ushort * param_1)|long __cdecl RestrictFolder(ushort * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### RestrictFolder Called Diff ```diff --- RestrictFolder called +++ RestrictFolder called @@ -11,0 +12 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### RestrictFolder Diff ```diff --- RestrictFolder +++ RestrictFolder @@ -1,91 +1,98 @@ /* long __cdecl RestrictFolder(unsigned short const * __ptr64) */ long __cdecl RestrictFolder(ushort *param_1) { - DWORD DVar1; + bool bVar1; DWORD DVar2; - BOOL BVar3; - PACL pAVar4; + DWORD DVar3; + BOOL BVar4; + PACL pAVar5; PACL pAcl; PACL pSid; PACL pSid_00; uint nAclLength; PACL local_res10; PACL local_res18; PACL local_res20; undefined8 local_68; undefined8 uStack_60; undefined8 local_58; undefined8 uStack_50; undefined8 local_48; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); pAcl = (PACL)0x0; + if (bVar1) { + return 0; + } local_res20 = (PACL)0x0; local_res10 = (PACL)0x0; local_res18 = (PACL)0x0; pSid = pAcl; pSid_00 = pAcl; - DVar1 = 0; + DVar2 = 0; if (((g_fUnitTestContext == 0) && - (DVar1 = CreateLocalWellKnownSid + (DVar2 = CreateLocalWellKnownSid (WinLocalSystemSid, (unique_ptr_> - *)&local_res10), pSid_00 = local_res10, -1 < (int)DVar1)) && - (DVar1 = CreateLocalWellKnownSid + *)&local_res10), pSid_00 = local_res10, -1 < (int)DVar2)) && + (DVar2 = CreateLocalWellKnownSid (WinBuiltinAdministratorsSid, (unique_ptr_> *)&local_res18), pSid = local_res18, pSid_00 = local_res10, - -1 < (int)DVar1)) { - DVar1 = GetLengthSid(local_res18); + -1 < (int)DVar2)) { + DVar2 = GetLengthSid(local_res18); pSid_00 = local_res10; - DVar2 = GetLengthSid(local_res10); - nAclLength = DVar1 + DVar2 + 0x1b & 0xfffffffc; - pAVar4 = operator_new__((ulonglong)nAclLength); + DVar3 = GetLengthSid(local_res10); + nAclLength = DVar2 + DVar3 + 0x1b & 0xfffffffc; + pAVar5 = operator_new__((ulonglong)nAclLength); local_res10 = (PACL)0x0; - if (pAVar4 != (PACL)0x0) { + if (pAVar5 != (PACL)0x0) { std::unique_ptr_>::_Delete ((unique_ptr_> * )&local_res20); - pAcl = pAVar4; - local_res20 = pAVar4; + pAcl = pAVar5; + local_res20 = pAVar5; } std::unique_ptr_>::_Delete ((unique_ptr_> *) &local_res10); if (pAcl == (PACL)0x0) { - DVar1 = 0x8007000e; + DVar2 = 0x8007000e; } else { - BVar3 = InitializeAcl(pAcl,nAclLength,2); - if (((BVar3 != 0) && (BVar3 = AddAccessAllowedAceEx(pAcl,2,3,0x1fffff,pSid_00), BVar3 != 0)) - && (BVar3 = AddAccessAllowedAceEx(pAcl,2,3,0x1fffff,pSid), BVar3 != 0)) { + BVar4 = InitializeAcl(pAcl,nAclLength,2); + if (((BVar4 != 0) && (BVar4 = AddAccessAllowedAceEx(pAcl,2,3,0x1fffff,pSid_00), BVar4 != 0)) + && (BVar4 = AddAccessAllowedAceEx(pAcl,2,3,0x1fffff,pSid), BVar4 != 0)) { local_48 = 0; local_68 = 0; uStack_60 = 0; local_58 = 0; uStack_50 = 0; - BVar3 = InitializeSecurityDescriptor(&local_68,1); - if (((BVar3 != 0) && (BVar3 = SetSecurityDescriptorDacl(&local_68,1,pAcl,0), BVar3 != 0)) && - (BVar3 = SetFileSecurityW((LPCWSTR)param_1,4,&local_68), DVar1 = 0, BVar3 != 0)) + BVar4 = InitializeSecurityDescriptor(&local_68,1); + if (((BVar4 != 0) && (BVar4 = SetSecurityDescriptorDacl(&local_68,1,pAcl,0), BVar4 != 0)) && + (BVar4 = SetFileSecurityW((LPCWSTR)param_1,4,&local_68), DVar2 = 0, BVar4 != 0)) goto LAB_0; } - DVar1 = GetLastError(); - if (DVar1 == 0) { - DVar1 = 0x80390004; + DVar2 = GetLastError(); + if (DVar2 == 0) { + DVar2 = 0x80390004; } - else if (0 < (int)DVar1) { - DVar1 = DVar1 & 0xffff | 0x80070000; + else if (0 < (int)DVar2) { + DVar2 = DVar2 & 0xffff | 0x80070000; } } } LAB_0: operator_delete__(pSid); operator_delete__(pSid_00); std::unique_ptr_>::_Delete ((unique_ptr_> *) &local_res20); - return DVar1; + return DVar2; } ``` ## Wallet::WalletDatabaseESE::Open ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.25| |i_ratio|0.58| |m_ratio|0.98| |b_ratio|0.96| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|Open|Open| |fullname|Wallet::WalletDatabaseESE::Open|Wallet::WalletDatabaseESE::Open| |refcount|3|3| |`length`|465|491| |`called`|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-STRING-L1-1-0.DLL::MultiByteToWideChar
BCRYPT.DLL::BCryptOpenAlgorithmProvider
Wallet::FileUtils::RecursiveCreateDirectory
Wallet::ServerUtils::HideAndRestrictFolder
Wallet::WalletDatabaseESE::JetErrToHR
Wallet::WalletDatabaseESE::LoadDatabase
WalletEncrypter::Cleanup
WalletEncrypter::InitializeKey
__security_check_cookie
memsetoperator_new
std::unique_ptr_>::_Delete
tlx::replace_>
|
Expand for full list:
API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL::GetLastError
API-MS-WIN-CORE-STRING-L1-1-0.DLL::MultiByteToWideChar
BCRYPT.DLL::BCryptOpenAlgorithmProvider
Wallet::FileUtils::RecursiveCreateDirectory
Wallet::ServerUtils::HideAndRestrictFolder
Wallet::WalletDatabaseESE::JetErrToHR
Wallet::WalletDatabaseESE::LoadDatabase
WalletEncrypter::Cleanup
WalletEncrypter::InitializeKey
__security_check_cookie
memsetoperator_new
std::unique_ptr_>::_Delete
tlx::replace_>
wil::details::FeatureImpl::__private_IsEnabled
| |calling||| |paramcount|2|2| |`address`|180010660|180010890| |sig|long __thiscall Open(WalletDatabaseESE * this, char * param_1)|long __thiscall Open(WalletDatabaseESE * this, char * param_1)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### Wallet::WalletDatabaseESE::Open Called Diff ```diff --- Wallet::WalletDatabaseESE::Open called +++ Wallet::WalletDatabaseESE::Open called @@ -14,0 +15 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### Wallet::WalletDatabaseESE::Open Diff ```diff --- Wallet::WalletDatabaseESE::Open +++ Wallet::WalletDatabaseESE::Open @@ -1,95 +1,104 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* public: virtual long __cdecl Wallet::WalletDatabaseESE::Open(char const * __ptr64) __ptr64 */ long __thiscall Wallet::WalletDatabaseESE::Open(WalletDatabaseESE *this,char *param_1) { unique_any_> *this_00; unique_ptr_> *this_01; - uint uVar1; - int iVar2; - DWORD DVar3; - long lVar4; + bool bVar1; + uint uVar2; + int iVar3; + DWORD DVar4; + long lVar5; void **phAlgorithm; - undefined8 *puVar5; undefined8 *puVar6; + undefined8 *puVar7; undefined1 auStackY_278 [32]; undefined8 *local_248 [2]; WCHAR local_238 [2]; undefined1 local_234 [524]; ulonglong local_28; local_28 = __security_cookie ^ (ulonglong)auStackY_278; - puVar6 = (undefined8 *)0x0; - this_00 = (unique_any_> - *)(this + 0x38); - if (*(int *)(this + 0x60) != 0) { - phAlgorithm = tlx:: - replace_> - (this_00); - uVar1 = BCryptOpenAlgorithmProvider(phAlgorithm,L"AES",(LPCWSTR)0x0,0); - uVar1 = uVar1 | 0x10000000; - if (((int)uVar1 < 0) || - (uVar1 = WalletEncrypter::InitializeKey((WalletEncrypter *)this_00), (int)uVar1 < 0)) { - WalletEncrypter::Cleanup((WalletEncrypter *)this_00); - return uVar1; + bVar1 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + puVar7 = (undefined8 *)0x0; + if (bVar1) { + DVar4 = 0x80004001; + } + else { + this_00 = (unique_any_> + *)(this + 0x38); + if (*(int *)(this + 0x60) != 0) { + phAlgorithm = tlx:: + replace_> + (this_00); + uVar2 = BCryptOpenAlgorithmProvider(phAlgorithm,L"AES",(LPCWSTR)0x0,0); + uVar2 = uVar2 | 0x10000000; + if (((int)uVar2 < 0) || + (uVar2 = WalletEncrypter::InitializeKey((WalletEncrypter *)this_00), (int)uVar2 < 0)) { + WalletEncrypter::Cleanup((WalletEncrypter *)this_00); + return uVar2; + } } - } - this_01 = (unique_ptr_> *) - (this + 0x68); - if (*(longlong *)this_01 == 0) { - puVar5 = operator_new(8,&std::nothrow); - if (puVar5 != (undefined8 *)0x0) { - *puVar5 = &JetDB::_vftable_; - puVar6 = puVar5; + this_01 = (unique_ptr_> *) + (this + 0x68); + if (*(longlong *)this_01 == 0) { + puVar6 = operator_new(8,&std::nothrow); + if (puVar6 != (undefined8 *)0x0) { + *puVar6 = &JetDB::_vftable_; + puVar7 = puVar6; + } + local_248[0] = puVar7; + if ((this_01 != + (unique_ptr_> *) + local_248) && (local_248[0] = (undefined8 *)0x0, puVar7 != *(undefined8 **)this_01)) { + std::unique_ptr_>:: + _Delete(this_01); + *(undefined8 **)this_01 = puVar7; + } + std::unique_ptr_>::_Delete + ((unique_ptr_> * + )local_248); + if (*(longlong *)this_01 == 0) { + return -0x7ff8fff2; + } } - local_248[0] = puVar6; - if ((this_01 != - (unique_ptr_> *) - local_248) && (local_248[0] = (undefined8 *)0x0, puVar6 != *(undefined8 **)this_01)) { - std::unique_ptr_>::_Delete - (this_01); - *(undefined8 **)this_01 = puVar6; - } - std::unique_ptr_>::_Delete - ((unique_ptr_> *) - local_248); - if (*(longlong *)this_01 == 0) { - return -0x7ff8fff2; - } - } - if (*(int *)(this + 8) == 0) { - local_238[0] = L'\0'; - local_238[1] = L'\0'; - memset(local_234,0,0x204); - iVar2 = MultiByteToWideChar(0xfde9,0,param_1,-1,local_238,0x104); - if (iVar2 == 0) { - DVar3 = GetLastError(); - if (DVar3 == 0) { - DVar3 = 0x80390004; + if (*(int *)(this + 8) == 0) { + local_238[0] = L'\0'; + local_238[1] = L'\0'; + memset(local_234,0,0x204); + iVar3 = MultiByteToWideChar(0xfde9,0,param_1,-1,local_238,0x104); + if (iVar3 == 0) { + DVar4 = GetLastError(); + if (DVar4 == 0) { + DVar4 = 0x80390004; + } + else if (0 < (int)DVar4) { + DVar4 = DVar4 & 0xffff | 0x80070000; + } } - else if (0 < (int)DVar3) { - DVar3 = DVar3 & 0xffff | 0x80070000; + else { + DVar4 = FileUtils::RecursiveCreateDirectory((ushort *)local_238); + if ((-1 < (int)DVar4) && + (DVar4 = ServerUtils::HideAndRestrictFolder((ushort *)local_238), -1 < (int)DVar4)) { + lVar5 = LoadDatabase(this,param_1); + DVar4 = JetErrToHR(lVar5); + if (-1 < (int)DVar4) { + *(undefined4 *)(this + 8) = 1; + DVar4 = 0; + } + } } } else { - DVar3 = FileUtils::RecursiveCreateDirectory((ushort *)local_238); - if ((-1 < (int)DVar3) && - (DVar3 = ServerUtils::HideAndRestrictFolder((ushort *)local_238), -1 < (int)DVar3)) { - lVar4 = LoadDatabase(this,param_1); - DVar3 = JetErrToHR(lVar4); - if (-1 < (int)DVar3) { - *(undefined4 *)(this + 8) = 1; - DVar3 = 0; - } - } + DVar4 = 0x8000ffff; } } - else { - DVar3 = 0x8000ffff; - } - return DVar3; + return DVar4; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|AcquireSRWLockExclusive|AcquireSRWLockExclusive| |fullname|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive| |`refcount`|28|29| |length|0|0| |called||| |`calling`|
Expand for full list:
::
::
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
_Init_thread_footer
_Init_thread_header
wil::ActivityBase::LockExclusive
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl
wil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimerwil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|EXTERNAL:00000077|EXTERNAL:00000077| |sig|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)|void __stdcall AcquireSRWLockExclusive(PSRWLOCK SRWLock)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive Calling Diff ```diff --- API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling +++ API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive calling @@ -13,0 +14 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## push_back ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.96| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|push_back|push_back| |fullname|wil::details_abi::heap_buffer::push_back|wil::details_abi::heap_buffer::push_back| |`refcount`|8|9| |length|97|97| |called|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure|MSVCRT.DLL::memcpy_s
wil::details_abi::heap_buffer::ensure| |`calling`|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock|wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::IsFeatureConfigured
wil::details_abi::SubscriptionList::SubscribeUnderLock| |paramcount|3|3| |address|18000ac5c|18000ac5c| |sig|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)|bool __thiscall push_back(heap_buffer * this, void * param_1, __uint64 param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### push_back Calling Diff ```diff --- wil::details_abi::heap_buffer::push_back calling +++ wil::details_abi::heap_buffer::push_back calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash,ExternalsName| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|GetTickCount|GetTickCount| |fullname|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount|API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount| |`refcount`|5|6| |length|0|0| |called||| |`calling`|__security_init_cookie
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled|__security_init_cookie
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|0|0| |address|EXTERNAL:000000a1|EXTERNAL:000000a1| |sig|DWORD __stdcall GetTickCount(void)|DWORD __stdcall GetTickCount(void)| |sym_type|Function|Function| |sym_source|IMPORTED|IMPORTED| |external|True|True| ### API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount Calling Diff ```diff --- API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling +++ API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::GetTickCount calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ## WilApi_GetFeatureEnabledState ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.67| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|WilApi_GetFeatureEnabledState|WilApi_GetFeatureEnabledState| |fullname|wil::details::WilApi_GetFeatureEnabledState|wil::details::WilApi_GetFeatureEnabledState| |`refcount`|3|4| |length|35|35| |called|_guard_dispatch_icall$thunk$10345483385596137414|_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState|wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState
wil::details::FeatureImpl::GetCurrentFeatureEnabledState| |paramcount|3|3| |address|18000a778|18000a778| |sig|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)|FEATURE_ENABLED_STATE __cdecl WilApi_GetFeatureEnabledState(uint param_1, FEATURE_CHANGE_TIME param_2, int * param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### WilApi_GetFeatureEnabledState Calling Diff ```diff --- wil::details::WilApi_GetFeatureEnabledState calling +++ wil::details::WilApi_GetFeatureEnabledState calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::GetCurrentFeatureEnabledState ``` ## ReportUsageToService ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.95| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|4|5| |length|154|154| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |`calling`|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage|wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage
wil::details::FeatureImpl::ReportUsage| |paramcount|8|8| |address|180009640|180009640| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::ReportUsage ``` ## ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.88| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |fullname|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>|wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>| |`refcount`|32|33| |length|29|29| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive| |`calling`|
Expand for full list:
::
::
WalletTelemetry::ItemDeletedByApp::StartActivity
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStop
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImplwil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
|
Expand for full list:
::
::
WalletTelemetry::ItemDeletedByApp::StartActivity
wil::ActivityBase::Destroy
wil::ActivityBase::LockExclusive
wil::ActivityBase::NotifyFailure
wil::ActivityBase::Stop
wil::ActivityBase::zInternalStop
wil::details::ApiTelemetryLogger::ApiDataList::Flush
wil::details::ApiTelemetryLogger::ApiDataList::Insert
wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImplwil::details::EnabledStateManager::EnsureSubscribedToUsageFlush
wil::details::EnabledStateManager::OnStateChange
wil::details::EnabledStateManager::OnTimer
wil::details::EnabledStateManager::ProcessShutdown
wil::details::EnabledStateManager::QueueBackgroundUsageReporting
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureStateManager::EnsureStateData
wil::details::FeatureStateManager::EnsureSubscribedToProcessWideUsageFlushUnderLock
wil::details::FeatureStateManager::QueueBackgroundSRUMUsageReporting
wil::details::FeatureStateManager::RecordFeatureUsage
wil::details::FeatureStateManager::SubscribeToEnabledStateChanges
wil::details::FeatureStateManager::SubscribeToUsageFlush
wil::details::IsFeatureConfigured
wil::details_abi::FeatureStateData::RecordFeatureUsage
wil::details_abi::FeatureStateData::RecordUsage
wil::details_abi::SubscriptionList::OnSignaled
wil::details_abi::SubscriptionList::Unsubscribe
| |paramcount|1|1| |address|18000560c|18000560c| |sig|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)|void __thiscall ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>(unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> Calling Diff ```diff --- wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling +++ wil::details::unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_>::~unique_storage,struct__RTL_SRWLOCK*___ptr64,struct__RTL_SRWLOCK*___ptr64,0,std::nullptr_t>_> calling @@ -16,0 +17 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|0.78| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|5|6| |length|32|32| |called|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl|wil::details::EnabledStateManager::EnsureSubscribedToFeatureConfigurationChangesImpl| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |address|1800061a4|1800061a4| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -0,0 +1 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## basic_string,class_utl::allocator_> ### Match Info |Key|wal_8737.dll - wal_8875.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wal_8737.dll|wal_8875.dll| | :---: | :---: | :---: | |name|basic_string,class_utl::allocator_>|basic_string,class_utl::allocator_>| |fullname|utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_>|utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_>| |`refcount`|110|109| |length|20|20| |called||| |`calling`|
Expand for full list:
ATL::CComObject::CreateInstance
FormatDateTime
TheWallet::Initialize
Wallet::IsItemOwnedByApp
Wallet::ServerUtils::FormatPercent
Wallet::ServerUtils::GetWalletPhotosPath
Wallet::Utils::ActivateApplication
Wallet::Utils::ConstructApplicationLaunchUri
Wallet::Utils::ConstructStoreLaunchUri
Wallet::Utils::DeleteItemImage
Wallet::Utils::GetAppTaskUriAndDefaultParamsWallet::Utils::GetItemImageProperty
Wallet::Utils::GetLinkedAppUri
Wallet::Utils::GetWalletActivationArguments
Wallet::Utils::IsAppItemIdUnique
Wallet::Utils::IsItemLinkedToApp
Wallet::Utils::LinkItemToApp
Wallet::Utils::RemoveCustomProperties
Wallet::WalletCustomProperty::WalletCustomProperty
Wallet::WalletDatabaseESE::GetCustomPropertiesKeys
Wallet::WalletDatabaseESE::HandleDatabaseCorruption
Wallet::WalletDealsManager::ImportWalletItemPackage
Wallet::WalletItem::AddRowToWalletFieldStream
Wallet::WalletItem::GenerateBarcodeImage
Wallet::WalletItem::GetAssociatedAppStatus
Wallet::WalletItem::GetCustomProperty
Wallet::WalletItem::GetPropertyValue
Wallet::WalletItem::GetUniqueImagePath
Wallet::WalletItem::HandleBarcodePropertyValue
Wallet::WalletItem::LaunchApp
Wallet::WalletItem::Save
Wallet::WalletItem::SaveImageFile
Wallet::WalletItem::SetCustomProperty
Wallet::WalletItem::SetCustomPropertyValue
Wallet::WalletItemList::ProductIdSort
Wallet::WalletItemManager::GetFilteredList
Wallet::WalletPackageProcessor::FindLocalizedContent
Wallet::WalletPackageProcessor::FindOrCreateWalletItem
Wallet::WalletPackageProcessor::HandleStringProperty
Wallet::WalletPackageProcessor::Initialize
Wallet::WalletPackageProcessor::LogPackageErrorWithService
Wallet::WalletPackageProcessor::ProcessProperties
Wallet::WalletWebService::BeginLog
Wallet::WalletWebServiceRequest::InitiliazeExecute
Wallet::WalletWebServiceRequestGetWalletItem::Complete
Wallet::WalletWebServiceRequestGetWalletItem::ExecuteAsync
Wallet::WalletWebServiceRequestGetWalletItem::GetWalletItemUrl
Wallet::WalletX::DeleteAllAppOwnedWalletItems
Wallet::WalletX::GetAppOwnedWalletItemById
Wallet::WalletX::GetAppOwnedWalletItems
Wallet::WalletX::ShowWalletItem
Wallet::WalletX::UpdateAppItemId
Wallet::WalletXItem::Save
utl::_HashTable,class_utl::allocator_>,class_utl::basic_string,class_utl::allocator_>,struct_utl::hash,class_utl::allocator_>_>,struct_utl::equal_to,class_utl::allocator_>_>,class_utl::allocator,class_utl::allocator_>_>,0>::_NewNodeConstruct,class_utl::allocator_>_const&___ptr64>
utl::_HashTable,class_utl::allocator_>,struct_utl::pair,class_utl::allocator_>_const_,class_ce::WrappedPropVariant>,struct_utl::hash,class_utl::allocator_>_>,struct_utl::equal_to,class_utl::allocator_>_>,class_utl::allocator,class_utl::allocator_>_const_,class_ce::WrappedPropVariant>_>,0>::_NewNodeConstruct,class_utl::allocator_>&___ptr64,class_ce::WrappedPropVariant&___ptr64>
utl::construct,class_utl::allocator_>_>::operator(),class_utl::allocator_>,unsigned_short*___ptr64&___ptr64>
|
Expand for full list:
ATL::CComObject::CreateInstance
FormatDateTime
TheWallet::Initialize
Wallet::IsItemOwnedByApp
Wallet::ServerUtils::FormatPercent
Wallet::ServerUtils::GetWalletPhotosPath
Wallet::Utils::ActivateApplication
Wallet::Utils::ConstructApplicationLaunchUri
Wallet::Utils::ConstructStoreLaunchUri
Wallet::Utils::DeleteItemImage
Wallet::Utils::GetAppTaskUriAndDefaultParamsWallet::Utils::GetItemImageProperty
Wallet::Utils::GetLinkedAppUri
Wallet::Utils::GetWalletActivationArguments
Wallet::Utils::IsAppItemIdUnique
Wallet::Utils::IsItemLinkedToApp
Wallet::Utils::LinkItemToApp
Wallet::Utils::RemoveCustomProperties
Wallet::WalletCustomProperty::WalletCustomProperty
Wallet::WalletDatabaseESE::GetCustomPropertiesKeys
Wallet::WalletDealsManager::ImportWalletItemPackage
Wallet::WalletItem::AddRowToWalletFieldStream
Wallet::WalletItem::GenerateBarcodeImage
Wallet::WalletItem::GetAssociatedAppStatus
Wallet::WalletItem::GetCustomProperty
Wallet::WalletItem::GetPropertyValue
Wallet::WalletItem::GetUniqueImagePath
Wallet::WalletItem::HandleBarcodePropertyValue
Wallet::WalletItem::LaunchApp
Wallet::WalletItem::Save
Wallet::WalletItem::SaveImageFile
Wallet::WalletItem::SetCustomProperty
Wallet::WalletItem::SetCustomPropertyValue
Wallet::WalletItemList::ProductIdSort
Wallet::WalletItemManager::GetFilteredList
Wallet::WalletPackageProcessor::FindLocalizedContent
Wallet::WalletPackageProcessor::FindOrCreateWalletItem
Wallet::WalletPackageProcessor::HandleStringProperty
Wallet::WalletPackageProcessor::Initialize
Wallet::WalletPackageProcessor::LogPackageErrorWithService
Wallet::WalletPackageProcessor::ProcessProperties
Wallet::WalletWebService::BeginLog
Wallet::WalletWebServiceRequest::InitiliazeExecute
Wallet::WalletWebServiceRequestGetWalletItem::Complete
Wallet::WalletWebServiceRequestGetWalletItem::ExecuteAsync
Wallet::WalletWebServiceRequestGetWalletItem::GetWalletItemUrl
Wallet::WalletX::DeleteAllAppOwnedWalletItems
Wallet::WalletX::GetAppOwnedWalletItemById
Wallet::WalletX::GetAppOwnedWalletItems
Wallet::WalletX::ShowWalletItem
Wallet::WalletX::UpdateAppItemId
Wallet::WalletXItem::Save
utl::_HashTable,class_utl::allocator_>,class_utl::basic_string,class_utl::allocator_>,struct_utl::hash,class_utl::allocator_>_>,struct_utl::equal_to,class_utl::allocator_>_>,class_utl::allocator,class_utl::allocator_>_>,0>::_NewNodeConstruct,class_utl::allocator_>_const&___ptr64>
utl::_HashTable,class_utl::allocator_>,struct_utl::pair,class_utl::allocator_>_const_,class_ce::WrappedPropVariant>,struct_utl::hash,class_utl::allocator_>_>,struct_utl::equal_to,class_utl::allocator_>_>,class_utl::allocator,class_utl::allocator_>_const_,class_ce::WrappedPropVariant>_>,0>::_NewNodeConstruct,class_utl::allocator_>&___ptr64,class_ce::WrappedPropVariant&___ptr64>
utl::construct,class_utl::allocator_>_>::operator(),class_utl::allocator_>,unsigned_short*___ptr64&___ptr64>
| |paramcount|1|1| |address|18000cbe8|18000cbe8| |sig|undefined __thiscall basic_string,class_utl::allocator_>(basic_string,class_utl::allocator_> * this)|undefined __thiscall basic_string,class_utl::allocator_>(basic_string,class_utl::allocator_> * this)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### basic_string,class_utl::allocator_> Calling Diff ```diff --- utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_> calling +++ utl::basic_string,class_utl::allocator_>::basic_string,class_utl::allocator_> calling @@ -21 +20,0 @@ -Wallet::WalletDatabaseESE::HandleDatabaseCorruption ``` Generated with `ghidriff` version: 1.0.0 on 2026-08-21T21:54:02