# wci_7920.sys-wci_8246.sys Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
	* [Feature_1773654331__private_IsEnabledDeviceUsageNoInline](#feature_1773654331__private_isenableddeviceusagenoinline)
	* [Feature_1773654331__private_IsEnabledFallback](#feature_1773654331__private_isenabledfallback)
* [Modified](#modified)
	* [WcScheduleExpansionWorkItem](#wcscheduleexpansionworkitem)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [wil_details_IsEnabledFallback](#wil_details_isenabledfallback)

# Visual Chart Diff



```mermaid

flowchart LR

WcScheduleExpansionWorkItem-4-old<--Match 90%-->WcScheduleExpansionWorkItem-4-new

subgraph wci_8246.sys
    WcScheduleExpansionWorkItem-4-new
    subgraph Added
direction LR
Feature_1773654331__private_IsEnabledDeviceUsageNoInline
    Feature_1773654331__private_IsEnabledFallback
end
end

subgraph wci_7920.sys
    WcScheduleExpansionWorkItem-4-old
    
end

```


```mermaid
pie showData
    title Function Matches - 99.8296%
"unmatched_funcs_len" : 2
"matched_funcs_len" : 1172
```



```mermaid
pie showData
    title Matched Function Similarity - 99.8294%
"matched_funcs_with_code_changes_len" : 1
"matched_funcs_with_non_code_changes_len" : 1
"matched_funcs_no_changes_len" : 1170
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 wci_7920.sys wci_8246.sys
```


#### Verbose Args


<details>

```
--old ['wci_7920.sys'] --new [['wci_8246.sys']] --engine VersionTrackingDiff --output-path wci_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/wcifs.sys/1DE9D7F93C000/wcifs.sys -O wcifs.sys.x64.10.0.26100.7920
wget https://msdl.microsoft.com/download/symbols/wcifs.sys/F32872533C000/wcifs.sys -O wcifs.sys.x64.10.0.26100.8246
```


## Binary Metadata Diff


```diff
--- wci_7920.sys Meta
+++ wci_8246.sys Meta
@@ -1,44 +1,44 @@
-Program Name: wci_7920.sys
+Program Name: wci_8246.sys
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
 # of Bytes: 251984
 # of Memory Blocks: 13
-# of Instructions: 38622
-# of Defined Data: 2787
-# of Functions: 586
-# of Symbols: 6455
+# of Instructions: 38652
+# of Defined Data: 2793
+# of Functions: 588
+# of Symbols: 6463
 # of Data Types: 161
 # of Data Type Categories: 12
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Tue Aug 18 22:01:58 SGT 2026
+Date Created: Tue Aug 18 22:02:01 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /tmp/wci/wci_7920.sys
-Executable MD5: 1ebcd696099ec8ff50f9f6dd75f46618
-Executable SHA256: 586e4753c651381ee945a92c3b7b3ce044515f2b19daabfdad6c827f8eadcb5e
-FSRL: file:///tmp/wci/wci_7920.sys?MD5=1ebcd696099ec8ff50f9f6dd75f46618
+Executable Location: /tmp/wci/wci_8246.sys
+Executable MD5: a8b0d4f2990a6e872448c1e3e2fc18ba
+Executable SHA256: b17e6ee478e8614fb7dca82410f88b7d97e9acaa1ea059cc4a3aaa370206a19a
+FSRL: file:///tmp/wci/wci_8246.sys?MD5=a8b0d4f2990a6e872448c1e3e2fc18ba
 PDB Age: 1
 PDB File: wcifs.pdb
-PDB GUID: 7da4a38c-9f87-1efe-ee99-3a76ef69dca5
+PDB GUID: a324190f-e71e-ef28-1cb6-f63178500923
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Windows Container Isolation FS Filter Driver
-PE Property[FileVersion]: 10.0.26100.7920 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.26100.8246 (WinBuild.160101.0800)
 PE Property[InternalName]: wcifs.sys
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: wcifs.sys
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.26100.7920
+PE Property[ProductVersion]: 10.0.26100.8246
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra wci_7920.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra wci_7920.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra wci_7920.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra wci_8246.sys Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra wci_8246.sys Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra wci_8246.sys Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|2|
|deleted_funcs_len|0|
|modified_funcs_len|2|
|added_symbols_len|7|
|deleted_symbols_len|4|
|diff_time|3.1745784282684326|
|deleted_strings_len|0|
|added_strings_len|0|
|match_types|Counter({'SymbolsHash': 583, 'ExternalsName': 236, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})|
|items_to_process|15|
|diff_types|Counter({'refcount': 1, 'address': 1, 'calling': 1, 'code': 1, 'length': 1, 'called': 1})|
|unmatched_funcs_len|2|
|total_funcs_len|1174|
|matched_funcs_len|1172|
|matched_funcs_with_code_changes_len|1|
|matched_funcs_with_non_code_changes_len|1|
|matched_funcs_no_changes_len|1170|
|match_func_similarity_percent|99.8294%|
|func_match_overall_percent|99.8296%|
|first_matches|Counter({'SymbolsHash': 583, 'ExactBytesFunctionHasher': 1, 'BSIM': 1})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 583
"ExternalsName" : 236
"ExactBytesFunctionHasher" : 1
"BSIM" : 1
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 583
"ExactBytesFunctionHasher" : 1
"BSIM" : 1
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 2
"deleted_funcs_len" : 0
"modified_funcs_len" : 2
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 7
"deleted_symbols_len" : 4
```

## Strings


*No string differences found*

# Deleted

# Added

## Feature_1773654331__private_IsEnabledDeviceUsageNoInline

### Function Meta



|Key|wci_8246.sys|
| :---: | :---: |
|name|Feature_1773654331__private_IsEnabledDeviceUsageNoInline|
|fullname|Feature_1773654331__private_IsEnabledDeviceUsageNoInline|
|refcount|3|
|length|49|
|called|Feature_1773654331__private_IsEnabledFallback|
|calling|WcScheduleExpansionWorkItem|
|paramcount|0|
|address|140005358|
|sig|ulonglong __fastcall Feature_1773654331__private_IsEnabledDeviceUsageNoInline(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_1773654331__private_IsEnabledDeviceUsageNoInline
+++ Feature_1773654331__private_IsEnabledDeviceUsageNoInline
@@ -0,0 +1,17 @@
+
+ulonglong Feature_1773654331__private_IsEnabledDeviceUsageNoInline(void)
+
+{
+  ulonglong uVar1;
+  undefined8 local_res8;
+  
+  local_res8 = (ulonglong)Feature_1773654331__private_featureState;
+  if ((Feature_1773654331__private_featureState & 0x10) == 0) {
+    uVar1 = Feature_1773654331__private_IsEnabledFallback(local_res8,3);
+  }
+  else {
+    uVar1 = (ulonglong)(Feature_1773654331__private_featureState & 1);
+  }
+  return uVar1;
+}
+

```


## Feature_1773654331__private_IsEnabledFallback

### Function Meta



|Key|wci_8246.sys|
| :---: | :---: |
|name|Feature_1773654331__private_IsEnabledFallback|
|fullname|Feature_1773654331__private_IsEnabledFallback|
|refcount|2|
|length|21|
|called|wil_details_IsEnabledFallback|
|calling|Feature_1773654331__private_IsEnabledDeviceUsageNoInline|
|paramcount|2|
|address|140005390|
|sig|undefined __fastcall Feature_1773654331__private_IsEnabledFallback(ulonglong param_1, int param_2)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- Feature_1773654331__private_IsEnabledFallback
+++ Feature_1773654331__private_IsEnabledFallback
@@ -0,0 +1,8 @@
+
+void Feature_1773654331__private_IsEnabledFallback(ulonglong param_1,int param_2)
+
+{
+  wil_details_IsEnabledFallback(param_1,param_2,&Feature_1773654331__private_descriptor);
+  return;
+}
+

```


# Modified


*Modified functions contain code changes*
## WcScheduleExpansionWorkItem

### Match Info



|Key|wci_7920.sys - wci_8246.sys|
| :---: | :---: |
|diff_type|code,length,called|
|ratio|0.93|
|i_ratio|0.61|
|m_ratio|0.94|
|b_ratio|0.9|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|wci_7920.sys|wci_8246.sys|
| :---: | :---: | :---: |
|name|WcScheduleExpansionWorkItem|WcScheduleExpansionWorkItem|
|fullname|WcScheduleExpansionWorkItem|WcScheduleExpansionWorkItem|
|refcount|3|3|
|`length`|351|380|
|`called`|FLTMGR.SYS::FltAllocateGenericWorkItem<br>FLTMGR.SYS::FltFreeGenericWorkItem<br>FLTMGR.SYS::FltQueueGenericWorkItem<br>NTOSKRNL.EXE::KeClearEvent<br>NTOSKRNL.EXE::KeWaitForSingleObject<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::ObfReferenceObject|FLTMGR.SYS::FltAllocateGenericWorkItem<br>FLTMGR.SYS::FltFreeGenericWorkItem<br>FLTMGR.SYS::FltQueueGenericWorkItem<br>Feature_1773654331__private_IsEnabledDeviceUsageNoInline<br>NTOSKRNL.EXE::KeClearEvent<br>NTOSKRNL.EXE::KeWaitForSingleObject<br>NTOSKRNL.EXE::ObfDereferenceObject<br>NTOSKRNL.EXE::ObfReferenceObject|
|calling|WcExpansionCsqInsertIo<br>WcLaunchExpansion|WcExpansionCsqInsertIo<br>WcLaunchExpansion|
|paramcount|4|4|
|address|140019b18|140019b18|
|sig|ulonglong __fastcall WcScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)|ulonglong __fastcall WcScheduleExpansionWorkItem(undefined8 param_1, undefined8 param_2, longlong param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WcScheduleExpansionWorkItem Called Diff


```diff
--- WcScheduleExpansionWorkItem called
+++ WcScheduleExpansionWorkItem called
@@ -3,0 +4 @@
+Feature_1773654331__private_IsEnabledDeviceUsageNoInline
```


### WcScheduleExpansionWorkItem Diff


```diff
--- WcScheduleExpansionWorkItem
+++ WcScheduleExpansionWorkItem
@@ -1,74 +1,82 @@
 
 ulonglong WcScheduleExpansionWorkItem
                     (undefined8 param_1,undefined8 param_2,longlong param_3,longlong param_4)
 
 {
   longlong *plVar1;
   int *piVar2;
   longlong *plVar3;
   int iVar4;
   longlong *plVar5;
   longlong *plVar6;
   undefined8 *puVar7;
   code *pcVar8;
   uint uVar9;
   longlong lVar10;
   ulonglong uVar11;
+  ulonglong uVar12;
+  bool bVar13;
   
   uVar11 = 0;
   plVar3 = (longlong *)(param_3 + 0xa8);
+  bVar13 = false;
   plVar5 = (longlong *)*plVar3;
   if (param_4 != 0) {
     plVar6 = *(longlong **)(param_3 + 0xb0);
     plVar1 = (longlong *)(param_4 + 0x30);
     if ((longlong *)*plVar6 != plVar3) goto LAB_0;
     *plVar1 = (longlong)plVar3;
     *(longlong **)(param_4 + 0x38) = plVar6;
     *plVar6 = (longlong)plVar1;
     *(longlong **)(param_3 + 0xb0) = plVar1;
   }
   if (plVar5 == plVar3) {
     LOCK();
     piVar2 = (int *)(param_3 + 0x20);
     iVar4 = *piVar2;
     *piVar2 = *piVar2 + 1;
     UNLOCK();
     if (iVar4 == 0) {
       KeWaitForSingleObject(param_3 + 8,0,0,0,0);
       KeClearEvent(param_3 + 8);
       lVar10 = FltAllocateGenericWorkItem();
       if (lVar10 == 0) {
         uVar11 = 0xc000009a;
       }
       else {
         ObfReferenceObject(param_2);
+        uVar11 = Feature_1773654331__private_IsEnabledDeviceUsageNoInline();
+        bVar13 = (int)uVar11 != 0;
         uVar9 = FltQueueGenericWorkItem(lVar10,param_1,WcExpansionWorker,0,param_2);
         uVar11 = (ulonglong)uVar9;
         if (-1 < (int)uVar9) {
           return uVar11;
         }
         FltFreeGenericWorkItem(lVar10);
       }
       if (param_4 != 0) {
         puVar7 = *(undefined8 **)(param_3 + 0xb0);
         if (((longlong *)*puVar7 != plVar3) ||
            (plVar5 = (longlong *)puVar7[1], (undefined8 *)*plVar5 != puVar7)) {
 LAB_0:
           pcVar8 = (code *)swi(0x29);
           (*pcVar8)(3);
           pcVar8 = (code *)swi(3);
           uVar11 = (*pcVar8)();
           return uVar11;
         }
         *(longlong **)(param_3 + 0xb0) = plVar5;
         *plVar5 = (longlong)plVar3;
       }
       LOCK();
       *(int *)(param_3 + 0x20) = *(int *)(param_3 + 0x20) + -1;
       UNLOCK();
-      ObfDereferenceObject(param_2);
+      uVar12 = Feature_1773654331__private_IsEnabledDeviceUsageNoInline();
+      if (((int)uVar12 == 0) || (bVar13)) {
+        ObfDereferenceObject(param_2);
+      }
     }
   }
   return uVar11;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## wil_details_IsEnabledFallback

### Match Info



|Key|wci_7920.sys - wci_8246.sys|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.83|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|wci_7920.sys|wci_8246.sys|
| :---: | :---: | :---: |
|name|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|fullname|wil_details_IsEnabledFallback|wil_details_IsEnabledFallback|
|`refcount`|5|6|
|length|140|140|
|called|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|wil_details_FeatureReporting_ReportUsageToService<br>wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState<br>wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath|
|`calling`|Feature_UndockedWindowsSandboxParity__private_IsEnabledFallback<br>Feature_WcPortMessageOOBReadFixes__private_IsEnabledFallback<br>Feature_WcPortMessageStackLeakFix__private_IsEnabledFallback<br>Feature_WcProcessGetUnionsOOBReadFix__private_IsEnabledFallback|Feature_1773654331__private_IsEnabledFallback<br>Feature_UndockedWindowsSandboxParity__private_IsEnabledFallback<br>Feature_WcPortMessageOOBReadFixes__private_IsEnabledFallback<br>Feature_WcPortMessageStackLeakFix__private_IsEnabledFallback<br>Feature_WcProcessGetUnionsOOBReadFix__private_IsEnabledFallback|
|paramcount|3|3|
|`address`|140005f9c|140005d28|
|sig|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|uint __fastcall wil_details_IsEnabledFallback(ulonglong param_1, int param_2, undefined8 * param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### wil_details_IsEnabledFallback Calling Diff


```diff
--- wil_details_IsEnabledFallback calling
+++ wil_details_IsEnabledFallback calling
@@ -0,0 +1 @@
+Feature_1773654331__private_IsEnabledFallback
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-18T22:02:33</sub>