# wds_8781.dll-wds_8864.dll Diff
# TOC
* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
* [Ghidra Diff Engine](#ghidra-diff-engine)
* [Command Line](#command-line)
* [Binary Metadata Diff](#binary-metadata-diff)
* [Program Options](#program-options)
* [Diff Stats](#diff-stats)
* [Strings](#strings)
* [Deleted](#deleted)
* [Added](#added)
* [EvaluateFeature](#evaluatefeature)
* [Modified](#modified)
* [EvaluateCurrentState](#evaluatecurrentstate)
* [EvaluateCurrentStateFromRegistry](#evaluatecurrentstatefromregistry)
* [Modified (No Code Changes)](#modified-no-code-changes)
* [MSVCRT.DLL::swprintf_s](#msvcrtdllswprintf_s)
* [ADVAPI32.DLL::RegQueryValueExW](#advapi32dllregqueryvalueexw)
# Visual Chart Diff
```mermaid
flowchart LR
EvaluateCurrentState-1-old<--Match 40%-->EvaluateCurrentState-1-new
EvaluateCurrentStateFromRegistry-3-old<--Match 74%-->EvaluateCurrentStateFromRegistry-3-new
subgraph wds_8864.dll
EvaluateCurrentState-1-new
EvaluateCurrentStateFromRegistry-3-new
subgraph Added
direction LR
EvaluateFeature
end
end
subgraph wds_8781.dll
EvaluateCurrentState-1-old
EvaluateCurrentStateFromRegistry-3-old
end
```
```mermaid
pie showData
title Function Matches - 99.9026%
"unmatched_funcs_len" : 1
"matched_funcs_len" : 1026
```
```mermaid
pie showData
title Matched Function Similarity - 99.5127%
"matched_funcs_with_code_changes_len" : 2
"matched_funcs_with_non_code_changes_len" : 3
"matched_funcs_no_changes_len" : 1021
```
# Metadata
## Ghidra Diff Engine
### Command Line
#### Captured Command Line
```
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 wds_8781.dll wds_8864.dll
```
#### Verbose Args
```
--old ['wds_8781.dll'] --new [['wds_8864.dll']] --engine VersionTrackingDiff --output-path wds_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```
#### Download Original PEs
```
wget https://msdl.microsoft.com/download/symbols/WdsImgSrv.dll/694CBDBD27000/WdsImgSrv.dll -O wdsimgsrv.dll.x64.10.0.14393.8781
wget https://msdl.microsoft.com/download/symbols/WdsImgSrv.dll/696F03F627000/WdsImgSrv.dll -O wdsimgsrv.dll.x64.10.0.14393.8864
```
## Binary Metadata Diff
```diff
--- wds_8781.dll Meta
+++ wds_8864.dll Meta
@@ -1,44 +1,44 @@
-Program Name: wds_8781.dll
+Program Name: wds_8864.dll
Language ID: x86:LE:64:default (4.6)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 180000000
Maximum Address: ff0000184f
# of Bytes: 152252
# of Memory Blocks: 9
-# of Instructions: 24625
-# of Defined Data: 1932
-# of Functions: 513
-# of Symbols: 4481
+# of Instructions: 24687
+# of Defined Data: 1939
+# of Functions: 514
+# of Symbols: 4490
# of Data Types: 501
# of Data Type Categories: 37
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 12.0.4
-Date Created: Tue Aug 18 21:36:48 SGT 2026
+Date Created: Tue Aug 18 21:36:51 SGT 2026
Executable Format: Portable Executable (PE)
-Executable Location: /tmp/wds/wds_8781.dll
-Executable MD5: dd805dc8488ec775c35633c8cc8ae7bb
-Executable SHA256: cf32b6fa785515829954b709cdf86ceaff4d1365ff6b2329f4b3f61fa5362e4b
-FSRL: file:///tmp/wds/wds_8781.dll?MD5=dd805dc8488ec775c35633c8cc8ae7bb
+Executable Location: /tmp/wds/wds_8864.dll
+Executable MD5: 2d2d28324d360464deb4b0f23112d65b
+Executable SHA256: dbb20ac921e2932422ca4c6d86109f86d3d42d79e1e742a977ed97df00f87ebb
+FSRL: file:///tmp/wds/wds_8864.dll?MD5=2d2d28324d360464deb4b0f23112d65b
PDB Age: 1
PDB File: WdsImgSrv.pdb
-PDB GUID: 39cf09b4-d3a0-4083-98ec-8b1c01adb259
+PDB GUID: 37dd5aa9-2981-4d02-b2ff-2a27e9b200e6
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: Windows Deployment Services Image Server Library
-PE Property[FileVersion]: 10.0.14393.8781 (rs1_release.251224-1746)
+PE Property[FileVersion]: 10.0.14393.8864 (rs1_release.260119-1756)
PE Property[InternalName]: WdsImgSrv.dll
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: WdsImgSrv.dll
PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.14393.8781
+PE Property[ProductVersion]: 10.0.14393.8864
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: true
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
```
## Program Options
Ghidra wds_8781.dll Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra wds_8781.dll Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra wds_8781.dll Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
Ghidra wds_8864.dll Decompiler Options
|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|
Ghidra wds_8864.dll Specification extensions Options
|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|
Ghidra wds_8864.dll Analyzers Options
|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|
## Diff Stats
|Stat|Value|
| :---: | :---: |
|added_funcs_len|1|
|deleted_funcs_len|0|
|modified_funcs_len|5|
|added_symbols_len|1|
|deleted_symbols_len|0|
|diff_time|2.6915242671966553|
|deleted_strings_len|0|
|added_strings_len|1|
|match_types|Counter({'SymbolsHash': 509, 'ExternalsName': 208})|
|items_to_process|7|
|diff_types|Counter({'refcount': 4, 'code': 2, 'length': 2, 'address': 2, 'called': 2, 'calling': 2, 'sig': 1})|
|unmatched_funcs_len|1|
|total_funcs_len|1027|
|matched_funcs_len|1026|
|matched_funcs_with_code_changes_len|2|
|matched_funcs_with_non_code_changes_len|3|
|matched_funcs_no_changes_len|1021|
|match_func_similarity_percent|99.5127%|
|func_match_overall_percent|99.9026%|
|first_matches|Counter({'SymbolsHash': 509})|
```mermaid
pie showData
title All Matches
"SymbolsHash" : 509
"ExternalsName" : 208
```
```mermaid
pie showData
title First Matches
"SymbolsHash" : 509
```
```mermaid
pie showData
title Diff Stats
"added_funcs_len" : 1
"deleted_funcs_len" : 0
"modified_funcs_len" : 5
```
```mermaid
pie showData
title Symbols
"added_symbols_len" : 1
"deleted_symbols_len" : 0
```
## Strings
```mermaid
pie showData
title Strings
"deleted_strings_len" : 0
"added_strings_len" : 1
```
### Strings Diff
```diff
--- deleted strings
+++ added strings
@@ -0,0 +1 @@
+u_%lu_variant
```
### String References
#### Old
|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
#### New
|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|u_%lu_variant|1|EvaluateCurrentStateFromRegistry|
# Deleted
# Added
## EvaluateFeature
### Function Meta
|Key|wds_8864.dll|
| :---: | :---: |
|name|EvaluateFeature|
|fullname|EvaluateFeature|
|refcount|2|
|length|116|
|called|EvaluateCurrentStateFromRegistry|
|calling|EvaluateCurrentState|
|paramcount|1|
|address|1800013d0|
|sig|void __cdecl EvaluateFeature(reg_FeatureDescriptor * param_1)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|
```diff
--- EvaluateFeature
+++ EvaluateFeature
@@ -0,0 +1,29 @@
+
+/* void __cdecl EvaluateFeature(struct reg_FeatureDescriptor const * __ptr64) */
+
+void __cdecl EvaluateFeature(reg_FeatureDescriptor *param_1)
+
+{
+ int iVar1;
+ ulonglong local_res8;
+
+ if ((g_Feature_319049964060216433_cachedstate == 0) &&
+ (g_Feature_3190499640_cachedvariant == 0x80000000)) {
+ local_res8 = (ulonglong)param_1 & 0xffffffffffffff00;
+ iVar1 = EvaluateCurrentStateFromRegistry(0x396d471,0,2,'\0',(uchar *)&local_res8);
+ LOCK();
+ iVar1 = (iVar1 != 0) + 1;
+ if (g_Feature_319049964060216433_cachedstate != 0) {
+ iVar1 = g_Feature_319049964060216433_cachedstate;
+ }
+ g_Feature_319049964060216433_cachedstate = iVar1;
+ UNLOCK();
+ LOCK();
+ if (g_Feature_3190499640_cachedvariant == 0x80000000) {
+ g_Feature_3190499640_cachedvariant = (uint)(byte)local_res8;
+ }
+ UNLOCK();
+ }
+ return;
+}
+
```
# Modified
*Modified functions contain code changes*
## EvaluateCurrentState
### Match Info
|Key|wds_8781.dll - wds_8864.dll|
| :---: | :---: |
|diff_type|code,refcount,length,address,called|
|ratio|0.4|
|i_ratio|0.4|
|m_ratio|0.9|
|b_ratio|0.4|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|wds_8781.dll|wds_8864.dll|
| :---: | :---: | :---: |
|name|EvaluateCurrentState|EvaluateCurrentState|
|fullname|EvaluateCurrentState|EvaluateCurrentState|
|`refcount`|2|3|
|`length`|38|31|
|`called`|EvaluateCurrentStateFromRegistry|EvaluateFeature|
|calling|HandlerClientUnattend
WdsProviderInitialize|HandlerClientUnattend
WdsProviderInitialize|
|paramcount|1|1|
|`address`|18000134c|18000144c|
|sig|int __cdecl EvaluateCurrentState(reg_FeatureDescriptor * param_1)|int __cdecl EvaluateCurrentState(reg_FeatureDescriptor * param_1)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### EvaluateCurrentState Called Diff
```diff
--- EvaluateCurrentState called
+++ EvaluateCurrentState called
@@ -1 +1 @@
-EvaluateCurrentStateFromRegistry
+EvaluateFeature
```
### EvaluateCurrentState Diff
```diff
--- EvaluateCurrentState
+++ EvaluateCurrentState
@@ -1,15 +1,10 @@
/* int __cdecl EvaluateCurrentState(struct reg_FeatureDescriptor const * __ptr64) */
int __cdecl EvaluateCurrentState(reg_FeatureDescriptor *param_1)
{
- int iVar1;
-
- if (g_Feature_319049964060216433_cachedstate != 0) {
- return (int)(g_Feature_319049964060216433_cachedstate != 1);
- }
- iVar1 = EvaluateCurrentStateFromRegistry(0x396d471,2,&g_Feature_319049964060216433_cachedstate);
- return iVar1;
+ EvaluateFeature(param_1);
+ return (int)(g_Feature_319049964060216433_cachedstate != 1);
}
```
## EvaluateCurrentStateFromRegistry
### Match Info
|Key|wds_8781.dll - wds_8864.dll|
| :---: | :---: |
|diff_type|code,length,sig,calling,called|
|ratio|0.2|
|i_ratio|0.29|
|m_ratio|0.86|
|b_ratio|0.74|
|match_types|SymbolsHash|
### Function Meta Diff
|Key|wds_8781.dll|wds_8864.dll|
| :---: | :---: | :---: |
|name|EvaluateCurrentStateFromRegistry|EvaluateCurrentStateFromRegistry|
|fullname|EvaluateCurrentStateFromRegistry|EvaluateCurrentStateFromRegistry|
|refcount|2|2|
|`length`|319|452|
|`called`|ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegQueryValueExW
MSVCRT.DLL::swprintf_s
__security_check_cookie|ADVAPI32.DLL::RegCloseKey
ADVAPI32.DLL::RegOpenKeyExW
ADVAPI32.DLL::RegQueryValueExW
MSVCRT.DLL::swprintf_s
__security_check_cookie
memset|
|`calling`|EvaluateCurrentState|EvaluateFeature|
|paramcount|3|5|
|address|180001204|180001204|
|`sig`|int __cdecl EvaluateCurrentStateFromRegistry(uint param_1, reg_FeatureStage param_2, long * param_3)|int __cdecl EvaluateCurrentStateFromRegistry(uint param_1, int param_2, reg_FeatureStage param_3, uchar param_4, uchar * param_5)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|
### EvaluateCurrentStateFromRegistry Called Diff
```diff
--- EvaluateCurrentStateFromRegistry called
+++ EvaluateCurrentStateFromRegistry called
@@ -5,0 +6 @@
+memset
```
### EvaluateCurrentStateFromRegistry Calling Diff
```diff
--- EvaluateCurrentStateFromRegistry calling
+++ EvaluateCurrentStateFromRegistry calling
@@ -1 +1 @@
-EvaluateCurrentState
+EvaluateFeature
```
### EvaluateCurrentStateFromRegistry Diff
```diff
--- EvaluateCurrentStateFromRegistry
+++ EvaluateCurrentStateFromRegistry
@@ -1,59 +1,66 @@
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* int __cdecl EvaluateCurrentStateFromRegistry(unsigned int,enum reg_FeatureStage,long volatile *
- __ptr64) */
+/* int __cdecl EvaluateCurrentStateFromRegistry(unsigned int,int,enum reg_FeatureStage,unsigned
+ char,unsigned char * __ptr64) */
-int __cdecl EvaluateCurrentStateFromRegistry(uint param_1,reg_FeatureStage param_2,long *param_3)
+int __cdecl
+EvaluateCurrentStateFromRegistry
+ (uint param_1,int param_2,reg_FeatureStage param_3,uchar param_4,uchar *param_5)
{
- LSTATUS LVar1;
+ bool bVar1;
bool bVar2;
- undefined1 auStackY_98 [32];
- DWORD local_68;
- DWORD local_64;
- int local_60 [2];
- HKEY local_58;
- wchar_t local_50 [16];
+ LSTATUS LVar3;
+ uint uVar4;
+ uint uVar5;
+ undefined1 auStackY_a8 [32];
+ DWORD local_78;
+ uint local_74;
+ DWORD local_70 [2];
+ HKEY local_68;
+ wchar_t local_60 [24];
ulonglong local_30;
- local_30 = __security_cookie ^ (ulonglong)auStackY_98;
- local_68 = 4;
- bVar2 = param_2 != 1;
- local_50[0] = L'\0';
- local_50[1] = L'\0';
- local_50[2] = L'\0';
- local_50[3] = L'\0';
- local_50[4] = L'\0';
- local_50[5] = L'\0';
- local_50[6] = L'\0';
- local_50[7] = L'\0';
- local_50[8] = L'\0';
- local_50[9] = L'\0';
- local_50[10] = L'\0';
- local_50[0xb] = L'\0';
- local_50[0xc] = L'\0';
- local_50[0xd] = L'\0';
- local_50[0xe] = L'\0';
- local_50[0xf] = 0;
- LVar1 = RegOpenKeyExW((HKEY)0xffffffff80000002,
+ local_30 = __security_cookie ^ (ulonglong)auStackY_a8;
+ local_78 = 4;
+ uVar5 = 0x80000000;
+ uVar4 = (uint)(param_3 != 1);
+ *param_5 = param_4;
+ bVar1 = false;
+ bVar2 = false;
+ memset(local_60,0,0x2c);
+ LVar3 = RegOpenKeyExW((HKEY)0xffffffff80000002,
L"System\\CurrentControlSet\\Policies\\Microsoft\\FeatureManagement\\Overrides"
- ,0,0x20019,&local_58);
- if (LVar1 == 0) {
- swprintf_s(local_50,0x10,L"%lu");
- LVar1 = RegQueryValueExW(local_58,local_50,(LPDWORD)0x0,&local_64,(LPBYTE)local_60,&local_68);
- if ((undefined1 *)((longlong)&local_58[-1].unused + 3U) < (undefined1 *)0xfffffffffffffffe) {
- RegCloseKey(local_58);
+ ,0,0x20019,&local_68);
+ if (LVar3 == 0) {
+ if (param_2 != 0) {
+ swprintf_s(local_60,0x16,L"%lu_variant");
+ LVar3 = RegQueryValueExW(local_68,local_60,(LPDWORD)0x0,local_70,(LPBYTE)&local_74,&local_78);
+ bVar1 = bVar2;
+ if ((((LVar3 == 0) && (local_70[0] == 4)) && (local_78 == 4)) && (local_74 < 0x100)) {
+ bVar1 = true;
+ uVar5 = local_74;
+ }
}
- if ((((LVar1 == 0) && (local_64 == 4)) && (local_68 == 4)) && ((local_60[0] != 0) != 0xffffffff)
- ) {
- bVar2 = (local_60[0] != 0) != 0;
+ swprintf_s(local_60,0x16,L"%lu");
+ LVar3 = RegQueryValueExW(local_68,local_60,(LPDWORD)0x0,local_70,(LPBYTE)&local_74,&local_78);
+ if ((undefined1 *)((longlong)&local_68[-1].unused + 3U) < (undefined1 *)0xfffffffffffffffe) {
+ RegCloseKey(local_68);
+ }
+ if (((LVar3 == 0) && (local_70[0] == 4)) && (local_78 == 4)) {
+ if ((local_74 != 0) != 0xffffffff) {
+ uVar4 = (uint)((local_74 != 0) != 0);
+ }
+ goto LAB_0;
}
}
- LOCK();
- if (*param_3 == 0) {
- *param_3 = bVar2 + 1;
+ if ((param_2 != 0) && (!bVar1)) {
+ return (uint)(param_3 != 1);
}
- UNLOCK();
- return (int)(*param_3 != 1);
+LAB_0:
+ if (uVar5 != 0x80000000) {
+ *param_5 = (uchar)uVar5;
+ }
+ return uVar4;
}
```
# Modified (No Code Changes)
*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname
## MSVCRT.DLL::swprintf_s
### Match Info
|Key|wds_8781.dll - wds_8864.dll|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|wds_8781.dll|wds_8864.dll|
| :---: | :---: | :---: |
|name|swprintf_s|swprintf_s|
|fullname|MSVCRT.DLL::swprintf_s|MSVCRT.DLL::swprintf_s|
|`refcount`|2|3|
|length|0|0|
|called|||
|calling|EvaluateCurrentStateFromRegistry|EvaluateCurrentStateFromRegistry|
|paramcount|3|3|
|address|EXTERNAL:00000013|EXTERNAL:00000013|
|sig|int __cdecl swprintf_s(wchar_t * _Dst, size_t _SizeInWords, wchar_t * _Format, ...)|int __cdecl swprintf_s(wchar_t * _Dst, size_t _SizeInWords, wchar_t * _Format, ...)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
## ADVAPI32.DLL::RegQueryValueExW
### Match Info
|Key|wds_8781.dll - wds_8864.dll|
| :---: | :---: |
|diff_type|refcount|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|
### Function Meta Diff
|Key|wds_8781.dll|wds_8864.dll|
| :---: | :---: | :---: |
|name|RegQueryValueExW|RegQueryValueExW|
|fullname|ADVAPI32.DLL::RegQueryValueExW|ADVAPI32.DLL::RegQueryValueExW|
|`refcount`|6|7|
|length|0|0|
|called|||
|calling|CRegKey::GetValue
EvaluateCurrentStateFromRegistry
RegExists
RegGetString|CRegKey::GetValue
EvaluateCurrentStateFromRegistry
RegExists
RegGetString|
|paramcount|6|6|
|address|EXTERNAL:00000075|EXTERNAL:00000075|
|sig|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|
Generated with `ghidriff` version: 1.0.0 on 2026-08-18T21:37:24