# wersvc_7309.dll-wersvc_7623.dll Diff # TOC * [Visual Chart Diff](#visual-chart-diff) * [Metadata](#metadata) * [Ghidra Diff Engine](#ghidra-diff-engine) * [Command Line](#command-line) * [Binary Metadata Diff](#binary-metadata-diff) * [Program Options](#program-options) * [Diff Stats](#diff-stats) * [Strings](#strings) * [Deleted](#deleted) * [Added](#added) * [wil::details::FeatureImpl::GetCachedFeatureEnabledState](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_2473284922getcachedfeatureenabledstate) * [wil::details::FeatureImpl::__private_IsEnabled](#wildetailsfeatureimplstruct___wilfeaturetraits_feature_2473284922__private_isenabled) * [Modified](#modified) * [CWerService::SvcElevatedLaunch](#cwerservicesvcelevatedlaunch) * [Modified (No Code Changes)](#modified-no-code-changes) * [SubscribeFeatureStateCacheToConfigurationChanges](#subscribefeaturestatecachetoconfigurationchanges) * [ReportUsageToService](#reportusagetoservice) * [EnsureSubscribedToFeatureConfigurationChanges](#ensuresubscribedtofeatureconfigurationchanges) # Visual Chart Diff ```mermaid flowchart LR CWerServiceSvcElevatedLaunch-3-old<--Match 83%-->CWerServiceSvcElevatedLaunch-3-new subgraph wersvc_7623.dll CWerServiceSvcElevatedLaunch-3-new subgraph Added direction LR wil-details-FeatureImplstruct___WilFeatureTraits_Feature_2473284922-GetCachedFeatureEnabledState wil-details-FeatureImplstruct___WilFeatureTraits_Feature_2473284922-__private_IsEnabled end end subgraph wersvc_7309.dll CWerServiceSvcElevatedLaunch-3-old end ``` ```mermaid pie showData title Function Matches - 99.9139% "unmatched_funcs_len" : 2 "matched_funcs_len" : 2322 ``` ```mermaid pie showData title Matched Function Similarity - 99.7847% "matched_funcs_with_code_changes_len" : 1 "matched_funcs_with_non_code_changes_len" : 4 "matched_funcs_no_changes_len" : 2317 ``` # Metadata ## Ghidra Diff Engine ### Command Line #### Captured Command Line ``` ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 wersvc_7309.dll wersvc_7623.dll ``` #### Verbose Args

``` --old ['wersvc_7309.dll'] --new [['wersvc_7623.dll']] --engine VersionTrackingDiff --output-path ghidriff_out --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None ```

#### Download Original PEs ``` wget https://msdl.microsoft.com/download/symbols/wersvc/A2DF7B4052000/wersvc -O wersvc.x64.10.0.26100.7309 wget https://msdl.microsoft.com/download/symbols/wersvc/9DAA7BCE52000/wersvc -O wersvc.x64.10.0.26100.7623 ``` ## Binary Metadata Diff ```diff --- wersvc_7309.dll Meta +++ wersvc_7623.dll Meta @@ -1,44 +1,44 @@ -Program Name: wersvc_7309.dll +Program Name: wersvc_7623.dll Language ID: x86:LE:64:default (4.6) Compiler ID: windows Processor: x86 Endian: Little Address Size: 64 Minimum Address: 180000000 Maximum Address: ff0000184f -# of Bytes: 341360 +# of Bytes: 341392 # of Memory Blocks: 10 -# of Instructions: 54634 -# of Defined Data: 3588 -# of Functions: 1161 -# of Symbols: 11371 -# of Data Types: 1026 +# of Instructions: 54823 +# of Defined Data: 3589 +# of Functions: 1163 +# of Symbols: 11391 +# of Data Types: 1027 # of Data Type Categories: 143 Analyzed: true Compiler: visualstudio:unknown Created With Ghidra Version: 12.0.4 -Date Created: Sun Aug 16 23:05:49 SGT 2026 +Date Created: Sun Aug 16 23:05:52 SGT 2026 Executable Format: Portable Executable (PE) -Executable Location: /tmp/wer/wersvc_7309.dll -Executable MD5: 7a2788ce842027c64237e0626c31166f -Executable SHA256: 2a4730306506d8247136f8862745eaa16b71336300bc624bcf2bf9610a933eb0 -FSRL: file:///tmp/wer/wersvc_7309.dll?MD5=7a2788ce842027c64237e0626c31166f +Executable Location: /tmp/wer/wersvc_7623.dll +Executable MD5: 6d2658c35a926cd91d83d836f616a147 +Executable SHA256: 43f067229e621f9eda9ebf0ba4377a88fb29a9e73ae9d743472197a15d170295 +FSRL: file:///tmp/wer/wersvc_7623.dll?MD5=6d2658c35a926cd91d83d836f616a147 PDB Age: 1 PDB File: WerSvc.pdb -PDB GUID: cfdac687-1182-0314-56b5-a1207dc89f91 +PDB GUID: 91f448d9-5251-7ff9-0098-3679becaae63 PDB Loaded: true PDB Version: RSDS PE Property[CompanyName]: Microsoft Corporation PE Property[FileDescription]: Windows Error Reporting Service -PE Property[FileVersion]: 10.0.26100.7309 (WinBuild.160101.0800) +PE Property[FileVersion]: 10.0.26100.7623 (WinBuild.160101.0800) PE Property[InternalName]: wersvc PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved. PE Property[OriginalFilename]: wersvc PE Property[ProductName]: Microsoft® Windows® Operating System -PE Property[ProductVersion]: 10.0.26100.7309 +PE Property[ProductVersion]: 10.0.26100.7623 PE Property[Translation]: 4b00409 Preferred Root Namespace Category: RTTI Found: true Relocatable: true SectionAlignment: 4096 Should Ask To Analyze: false ``` ## Program Options

Ghidra wersvc_7309.dll Decompiler Options

Ghidra wersvc_7309.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra wersvc_7309.dll Analyzers Options

|Analyzers Option|Value| | :---: | :---: | |ASCII Strings|true| |ASCII Strings.Create Strings Containing Existing Strings|true| |ASCII Strings.Create Strings Containing References|true| |ASCII Strings.Force Model Reload|false| |ASCII Strings.Minimum String Length|LEN_5| |ASCII Strings.Model File|StringModel.sng| |ASCII Strings.Require Null Termination for String|true| |ASCII Strings.Search Only in Accessible Memory Blocks|true| |ASCII Strings.String Start Alignment|ALIGN_1| |ASCII Strings.String end alignment|4| |Aggressive Instruction Finder|false| |Aggressive Instruction Finder.Create Analysis Bookmarks|true| |Apply Data Archives|true| |Apply Data Archives.Archive Chooser|[Auto-Detect]| |Apply Data Archives.Create Analysis Bookmarks|true| |Apply Data Archives.GDT User File Archive Path|None| |Apply Data Archives.User Project Archive Path|None| |Call Convention ID|true| |Call Convention ID.Analysis Decompiler Timeout (sec)|60| |Call-Fixup Installer|true| |Condense Filler Bytes|false| |Condense Filler Bytes.Filler Value|Auto| |Condense Filler Bytes.Minimum number of sequential bytes|1| |Create Address Tables|true| |Create Address Tables.Allow Offcut References|false| |Create Address Tables.Auto Label Table|false| |Create Address Tables.Create Analysis Bookmarks|true| |Create Address Tables.Maxmimum Pointer Distance|16777215| |Create Address Tables.Minimum Pointer Address|4132| |Create Address Tables.Minimum Table Size|2| |Create Address Tables.Pointer Alignment|1| |Create Address Tables.Relocation Table Guide|true| |Create Address Tables.Table Alignment|4| |Data Reference|true| |Data Reference.Address Table Alignment|1| |Data Reference.Address Table Minimum Size|2| |Data Reference.Align End of Strings|false| |Data Reference.Ascii String References|true| |Data Reference.Create Address Tables|true| |Data Reference.Minimum String Length|5| |Data Reference.References to Pointers|true| |Data Reference.Relocation Table Guide|true| |Data Reference.Respect Execute Flag|true| |Data Reference.Subroutine References|true| |Data Reference.Switch Table References|false| |Data Reference.Unicode String References|true| |Decompiler Parameter ID|true| |Decompiler Parameter ID.Analysis Clear Level|ANALYSIS| |Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60| |Decompiler Parameter ID.Commit Data Types|true| |Decompiler Parameter ID.Commit Void Return Values|false| |Decompiler Parameter ID.Prototype Evaluation|__fastcall| |Decompiler Switch Analysis|true| |Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60| |Demangler Microsoft|true| |Demangler Microsoft.Apply Function Calling Conventions|true| |Demangler Microsoft.Apply Function Signatures|true| |Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS| |Demangler Microsoft.Demangle Only Known Mangled Symbols|false| |Disassemble Entry Points|true| |Disassemble Entry Points.Respect Execute Flag|true| |Embedded Media|true| |Embedded Media.Create Analysis Bookmarks|true| |External Entry References|true| |Function ID|true| |Function ID.Always Apply FID Labels|false| |Function ID.Create Analysis Bookmarks|true| |Function ID.Instruction Count Threshold|14.6| |Function ID.Multiple Match Threshold|30.0| |Function Start Search|true| |Function Start Search.Bookmark Functions|false| |Function Start Search.Search Data Blocks|false| |Non-Returning Functions - Discovered|true| |Non-Returning Functions - Discovered.Create Analysis Bookmarks|true| |Non-Returning Functions - Discovered.Function Non-return Threshold|3| |Non-Returning Functions - Discovered.Repair Flow Damage|true| |Non-Returning Functions - Known|true| |Non-Returning Functions - Known.Create Analysis Bookmarks|true| |PDB MSDIA|false| |PDB MSDIA.Search untrusted symbol servers|false| |PDB Universal|true| |PDB Universal.Import Source Line Info|true| |PDB Universal.Search untrusted symbol servers|false| |Reference|true| |Reference.Address Table Alignment|1| |Reference.Address Table Minimum Size|2| |Reference.Align End of Strings|false| |Reference.Ascii String References|true| |Reference.Create Address Tables|true| |Reference.Minimum String Length|5| |Reference.References to Pointers|true| |Reference.Relocation Table Guide|true| |Reference.Respect Execute Flag|true| |Reference.Subroutine References|true| |Reference.Switch Table References|false| |Reference.Unicode String References|true| |Scalar Operand References|true| |Scalar Operand References.Relocation Table Guide|true| |Shared Return Calls|true| |Shared Return Calls.Allow Conditional Jumps|false| |Shared Return Calls.Assume Contiguous Functions Only|true| |Stack|true| |Stack.Create Local Variables|true| |Stack.Create Param Variables|false| |Stack.Max Threads|2| |Subroutine References|true| |Subroutine References.Create Thunks Early|true| |Variadic Function Signature Override|false| |Variadic Function Signature Override.Create Analysis Bookmarks|false| |Windows x86 PE Exception Handling|true| |Windows x86 PE RTTI Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer|true| |Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB|| |Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7| |WindowsPE x86 Propagate External Parameters|false| |WindowsResourceReference|true| |WindowsResourceReference.Create Analysis Bookmarks|true| |x86 Constant Reference Analyzer|true| |x86 Constant Reference Analyzer.Create Data from pointer|false| |x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true| |x86 Constant Reference Analyzer.Max Threads|2| |x86 Constant Reference Analyzer.Min absolute reference|4| |x86 Constant Reference Analyzer.Require pointer param data type|false| |x86 Constant Reference Analyzer.Speculative reference max|256| |x86 Constant Reference Analyzer.Speculative reference min|1024| |x86 Constant Reference Analyzer.Stored Value Pointer analysis|true| |x86 Constant Reference Analyzer.Trust values read from writable memory|true|

Ghidra wersvc_7623.dll Decompiler Options

Ghidra wersvc_7623.dll Specification extensions Options

|Specification extensions Option|Value| | :---: | :---: | |FormatVersion|0| |VersionCounter|0|

Ghidra wersvc_7623.dll Analyzers Options

## Diff Stats |Stat|Value| | :---: | :---: | |added_funcs_len|2| |deleted_funcs_len|0| |modified_funcs_len|5| |added_symbols_len|1| |deleted_symbols_len|1| |diff_time|5.044554233551025| |deleted_strings_len|0| |added_strings_len|0| |match_types|Counter({'SymbolsHash': 1156, 'ExternalsName': 322, 'StructuralGraphHash': 2, 'BSIM': 1, 'BulkInstructionHash': 1})| |items_to_process|9| |diff_types|Counter({'refcount': 4, 'calling': 4, 'code': 1, 'length': 1, 'address': 1, 'called': 1})| |unmatched_funcs_len|2| |total_funcs_len|2324| |matched_funcs_len|2322| |matched_funcs_with_code_changes_len|1| |matched_funcs_with_non_code_changes_len|4| |matched_funcs_no_changes_len|2317| |match_func_similarity_percent|99.7847%| |func_match_overall_percent|99.9139%| |first_matches|Counter({'SymbolsHash': 1156, 'StructuralGraphHash': 2, 'BSIM': 1, 'BulkInstructionHash': 1})| ```mermaid pie showData title All Matches "SymbolsHash" : 1156 "ExternalsName" : 322 "BSIM" : 1 "BulkInstructionHash" : 1 "StructuralGraphHash" : 2 ``` ```mermaid pie showData title First Matches "SymbolsHash" : 1156 "BSIM" : 1 "BulkInstructionHash" : 1 "StructuralGraphHash" : 2 ``` ```mermaid pie showData title Diff Stats "added_funcs_len" : 2 "deleted_funcs_len" : 0 "modified_funcs_len" : 5 ``` ```mermaid pie showData title Symbols "added_symbols_len" : 1 "deleted_symbols_len" : 1 ``` ## Strings *No string differences found* # Deleted # Added ## wil::details::FeatureImpl::GetCachedFeatureEnabledState ### Function Meta |Key|wersvc_7623.dll| | :---: | :---: | |name|GetCachedFeatureEnabledState| |fullname|wil::details::FeatureImpl::GetCachedFeatureEnabledState| |refcount|3| |length|408| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::EnsureSubscribedToFeatureConfigurationChanges
wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |calling|wil::details::FeatureImpl::__private_IsEnabled| |paramcount|1| |address|180016268| |sig|wil_details_FeatureStateCache __thiscall GetCachedFeatureEnabledState(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::GetCachedFeatureEnabledState +++ wil::details::FeatureImpl::GetCachedFeatureEnabledState @@ -0,0 +1,100 @@ + +/* WARNING: Function: _guard_dispatch_icall$thunk$10345483385596137414 replaced with injection: + guard_dispatch_icall */ +/* private: union wil_details_FeatureStateCache __cdecl wil::details::FeatureImpl::GetCachedFeatureEnabledState(void) __ptr64 */ + +void __thiscall +wil::details::FeatureImpl:: +GetCachedFeatureEnabledState(FeatureImpl *this) + +{ + uint uVar1; + uint uVar2; + code *pcVar3; + uint uVar4; + uint uVar5; + uint *in_RDX; + uint uVar6; + bool bVar7; + int local_res8 [2]; + + in_RDX[0] = 0; + in_RDX[1] = 0; + uVar1 = *(uint *)this; + *in_RDX = uVar1; + if (((byte)uVar1 & 6) == 6) { + return; + } + uVar1 = EnsureSubscribedToFeatureConfigurationChanges(); + local_res8[0] = 0; + pcVar3 = g_wil_details_internalGetFeatureEnabledState; + if ((g_wil_details_internalGetFeatureEnabledState == (code *)0x0) && + (pcVar3 = g_wil_details_apiGetFeatureEnabledState, + g_wil_details_apiGetFeatureEnabledState == (code *)0x0)) { + uVar2 = 0; + } + else { + uVar2 = (*pcVar3)(0x38984fa,3,local_res8); + } + uVar6 = (((uVar2 & 3) << 2 | uVar2 & 0x40) << 2 | uVar2 & 0x80) * 8; + if ((uVar2 & 0xffffff3f) == 0) { + uVar6 = uVar6 | 0x40; + } + else { + uVar4 = 0; + if ((uVar2 & 0xffffff3f) == 2) { + uVar4 = 0x40; + } + uVar6 = uVar6 | uVar4; + } + bVar7 = false; + if ((uVar6 & 0xc00) == 0xc00) { + bVar7 = true; +LAB_180016331: + if (((uVar6 & 0x40) == 0) || (!bVar7)) { + uVar2 = 0; + goto LAB_180016343; + } + } + else if ((uVar6 & 0x40) == 0) goto LAB_180016331; + uVar2 = 1; +LAB_180016343: + uVar6 = uVar6 | uVar2; + uVar2 = *in_RDX; + do { + uVar5 = uVar2; + *in_RDX = uVar5; + uVar4 = uVar5; + if ((local_res8[0] != 0) && ((uVar5 & 2) == 0)) { + uVar2 = (uVar6 ^ uVar5) & 0x180 ^ uVar5; + uVar2 = (uVar2 ^ uVar6) & 0x40 ^ uVar2; + uVar2 = (uVar2 ^ uVar6) & 1 ^ uVar2; + uVar4 = (uVar2 ^ uVar6) & 0x800 ^ uVar2 | 2; + *in_RDX = uVar4; + } + if ((uVar5 & 4) == 0) { + uVar4 = uVar4 ^ (uVar6 ^ uVar4) & 0x400 | 4; + *in_RDX = uVar4; + } + LOCK(); + uVar2 = *(uint *)this; + bVar7 = uVar5 == uVar2; + if (bVar7) { + *(uint *)this = uVar4; + uVar2 = uVar5; + } + UNLOCK(); + } while (!bVar7); + if ((uVar5 & 4) == 0) { + SubscribeFeatureStateCacheToConfigurationChanges((wil_details_FeatureStateCache *)this,3,uVar1); + } + if ((*in_RDX & 2) == 0) { + uVar1 = (uVar6 ^ *in_RDX) & 0x180 ^ *in_RDX; + uVar1 = (uVar6 ^ uVar1) & 0x40 ^ uVar1; + uVar1 = (uVar1 ^ uVar6) & 1 ^ uVar1; + *in_RDX = (uVar1 ^ uVar6) & 0x800 ^ uVar1; + } + return; +} + ``` ## wil::details::FeatureImpl::__private_IsEnabled ### Function Meta |Key|wersvc_7623.dll| | :---: | :---: | |name|__private_IsEnabled| |fullname|wil::details::FeatureImpl::__private_IsEnabled| |refcount|2| |length|151| |called|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::ReportUsageToService| |calling|CWerService::SvcElevatedLaunch| |paramcount|1| |address|180020028| |sig|bool __thiscall __private_IsEnabled(FeatureImpl * this)| |sym_type|Function| |sym_source|ANALYSIS| |external|False| ```diff --- wil::details::FeatureImpl::__private_IsEnabled +++ wil::details::FeatureImpl::__private_IsEnabled @@ -0,0 +1,34 @@ + +/* public: bool __cdecl wil::details::FeatureImpl::__private_IsEnabled(void) __ptr64 */ + +bool __thiscall +wil::details::FeatureImpl::__private_IsEnabled + (FeatureImpl *this) + +{ + undefined8 *puVar1; + uint uVar2; + bool bVar3; + undefined4 local_res8; + undefined2 local_resc; + undefined8 local_res10; + __uint64 in_stack_fffffffffffffff0; + + GetCachedFeatureEnabledState(this); + uVar2 = *(uint *)this; + bVar3 = (bool)((byte)local_res10 & 1); + if ((uVar2 & 4) == 0) { + puVar1 = (undefined8 *)GetCachedFeatureEnabledState(this); + local_res10 = *puVar1; + uVar2 = (uint)local_res10; + } + local_res8 = 0; + local_resc = 2; + ReportUsageToService + ((wil_details_FeatureReportingCache *)(this + 8),0x38984fa,uVar2 >> 10 & 1, + uVar2 >> 0xb & 1,(FEATURE_LOGGED_TRAITS *)&local_res8,(uint)bVar3,3, + in_stack_fffffffffffffff0); + return bVar3; +} + ``` # Modified *Modified functions contain code changes* ## CWerService::SvcElevatedLaunch ### Match Info |Key|wersvc_7309.dll - wersvc_7623.dll| | :---: | :---: | |diff_type|code,length,address,called| |ratio|0.2| |i_ratio|0.7| |m_ratio|0.95| |b_ratio|0.83| |match_types|SymbolsHash| ### Function Meta Diff |Key|wersvc_7309.dll|wersvc_7623.dll| | :---: | :---: | :---: | |name|SvcElevatedLaunch|SvcElevatedLaunch| |fullname|CWerService::SvcElevatedLaunch|CWerService::SvcElevatedLaunch| |refcount|2|2| |`length`|337|386| |`called`|API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
CWerService::OpenSenderProcessThread
ElevatedProcessStart
__security_check_cookie
memset|API-MS-WIN-CORE-HANDLE-L1-1-0.DLL::CloseHandle
CWerService::OpenSenderProcessThread
ElevatedProcessStart
__security_check_cookie
memset
wil::details::FeatureImpl::__private_IsEnabled| |calling|CWerService::DispatchPortRequestWorkItem|CWerService::DispatchPortRequestWorkItem| |paramcount|3|3| |`address`|18001a7e0|18001a980| |sig|long __thiscall SvcElevatedLaunch(CWerService * this, _WERSVC_MSG * param_1, _WERSVC_MSG * param_2)|long __thiscall SvcElevatedLaunch(CWerService * this, _WERSVC_MSG * param_1, _WERSVC_MSG * param_2)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### CWerService::SvcElevatedLaunch Called Diff ```diff --- CWerService::SvcElevatedLaunch called +++ CWerService::SvcElevatedLaunch called @@ -5,0 +6 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ### CWerService::SvcElevatedLaunch Diff ```diff --- CWerService::SvcElevatedLaunch +++ CWerService::SvcElevatedLaunch @@ -1,78 +1,89 @@ /* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */ /* private: long __cdecl CWerService::SvcElevatedLaunch(struct _WERSVC_MSG * __ptr64,struct _WERSVC_MSG * __ptr64) __ptr64 */ long __thiscall CWerService::SvcElevatedLaunch(CWerService *this,_WERSVC_MSG *param_1,_WERSVC_MSG *param_2) { uint uVar1; - long lVar2; - undefined4 uVar3; - uint uVar4; - HANDLE pvVar6; - _WERSVC_MSG *p_Var7; - ulong uVar8; - HANDLE pvVar9; + bool bVar2; + long lVar3; + undefined4 uVar4; + uint uVar5; + HANDLE pvVar7; + _WERSVC_MSG *p_Var8; + ulong uVar9; + HANDLE pvVar10; undefined1 auStackY_108 [32]; HANDLE local_c8; void *local_c0; void *local_b8 [16]; ulonglong local_38; - HANDLE pvVar5; + HANDLE pvVar6; local_38 = __security_cookie ^ (ulonglong)auStackY_108; - pvVar6 = (HANDLE)0x0; - local_c0 = (void *)0x0; - local_c8 = (HANDLE)0x0; - uVar8 = 0; - lVar2 = OpenSenderProcessThread - (this,param_1,(-(uint)(*(int *)(param_1 + 0xc0) != 0) & 0x80) + 0x440, - (unique_any *)&local_c0,0, - (unique_any *)0x0,0); - if (-1 < lVar2) { - memset(local_b8,0,0x80); - uVar1 = *(uint *)(param_1 + 0xc0); - if (uVar1 != 0) { - p_Var7 = param_1 + 0x40; - pvVar5 = pvVar6; - pvVar9 = pvVar6; - do { - uVar8 = (ulong)pvVar9; - if (0xf < (uint)pvVar5) break; - if (*(void **)p_Var7 != (void *)0x0) { - local_b8[(longlong)pvVar9] = *(void **)p_Var7; - pvVar9 = (HANDLE)(ulonglong)(uVar8 + 1); - } - uVar8 = (ulong)pvVar9; - uVar4 = (uint)pvVar5 + 1; - pvVar5 = (HANDLE)(ulonglong)uVar4; - p_Var7 = p_Var7 + 8; - } while (uVar4 < uVar1); - } - lVar2 = ElevatedProcessStart - (*(ulong *)(param_1 + 0x30),local_c0,*(void **)(param_1 + 0x38),local_b8,uVar8 - ,(unique_any *)&local_c8); - } - pvVar5 = local_c8; - *(long *)(param_2 + 0x2c) = lVar2; - if (lVar2 < 0) { - uVar3 = 0x50000002; + bVar2 = wil::details::FeatureImpl:: + __private_IsEnabled(&`private:_static_class_wil::details::FeatureImpl&___ptr64___cdecl_wil::Feature::GetImpl(void)' + ::__l2::impl); + pvVar7 = (HANDLE)0x0; + if (bVar2) { + *(undefined4 *)(param_2 + 0x28) = 1; + *(undefined4 *)(param_2 + 0x2c) = 0xc0000001; + lVar3 = -0x7fffbffb; } else { + local_c0 = (void *)0x0; local_c8 = (HANDLE)0x0; - uVar3 = 0x50000001; - pvVar6 = pvVar5; + uVar9 = 0; + lVar3 = OpenSenderProcessThread + (this,param_1,(-(uint)(*(int *)(param_1 + 0xc0) != 0) & 0x80) + 0x440, + (unique_any *)&local_c0,0, + (unique_any *)0x0,0); + if (-1 < lVar3) { + memset(local_b8,0,0x80); + uVar1 = *(uint *)(param_1 + 0xc0); + if (uVar1 != 0) { + p_Var8 = param_1 + 0x40; + pvVar6 = pvVar7; + pvVar10 = pvVar7; + do { + uVar9 = (ulong)pvVar10; + if (0xf < (uint)pvVar6) break; + if (*(void **)p_Var8 != (void *)0x0) { + local_b8[(longlong)pvVar10] = *(void **)p_Var8; + pvVar10 = (HANDLE)(ulonglong)(uVar9 + 1); + } + uVar9 = (ulong)pvVar10; + uVar5 = (uint)pvVar6 + 1; + pvVar6 = (HANDLE)(ulonglong)uVar5; + p_Var8 = p_Var8 + 8; + } while (uVar5 < uVar1); + } + lVar3 = ElevatedProcessStart + (*(ulong *)(param_1 + 0x30),local_c0,*(void **)(param_1 + 0x38),local_b8, + uVar9,(unique_any *)&local_c8); + } + pvVar6 = local_c8; + *(long *)(param_2 + 0x2c) = lVar3; + if (lVar3 < 0) { + uVar4 = 0x50000002; + } + else { + local_c8 = (HANDLE)0x0; + uVar4 = 0x50000001; + pvVar7 = pvVar6; + } + *(HANDLE *)(param_2 + 200) = pvVar7; + *(undefined4 *)(param_2 + 0x28) = uVar4; + if (1 < (longlong)local_c8 + 1U) { + CloseHandle(local_c8); + } + if (1 < (longlong)local_c0 + 1U) { + CloseHandle(local_c0); + } } - *(HANDLE *)(param_2 + 200) = pvVar6; - *(undefined4 *)(param_2 + 0x28) = uVar3; - if (1 < (longlong)local_c8 + 1U) { - CloseHandle(local_c8); - } - if (1 < (longlong)local_c0 + 1U) { - CloseHandle(local_c0); - } - return lVar2; + return lVar3; } ``` # Modified (No Code Changes) *Slightly modified functions have no code changes, rather differnces in:* - refcount - length - called - calling - name - fullname ## SubscribeFeatureStateCacheToConfigurationChanges ### Match Info |Key|wersvc_7309.dll - wersvc_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wersvc_7309.dll|wersvc_7623.dll| | :---: | :---: | :---: | |name|SubscribeFeatureStateCacheToConfigurationChanges|SubscribeFeatureStateCacheToConfigurationChanges| |fullname|wil::details::SubscribeFeatureStateCacheToConfigurationChanges|wil::details::SubscribeFeatureStateCacheToConfigurationChanges| |`refcount`|5|6| |length|158|158| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
wil::details_abi::heap_buffer::push_back| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|3|3| |address|18000d368|18000d368| |sig|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)|void __cdecl SubscribeFeatureStateCacheToConfigurationChanges(wil_details_FeatureStateCache * param_1, wil_FeatureChangeTime param_2, uint param_3)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### SubscribeFeatureStateCacheToConfigurationChanges Calling Diff ```diff --- wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling +++ wil::details::SubscribeFeatureStateCacheToConfigurationChanges calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` ## ReportUsageToService ### Match Info |Key|wersvc_7309.dll - wersvc_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wersvc_7309.dll|wersvc_7623.dll| | :---: | :---: | :---: | |name|ReportUsageToService|ReportUsageToService| |fullname|wil::details::ReportUsageToService|wil::details::ReportUsageToService| |`refcount`|4|5| |length|154|154| |called|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind|_guard_dispatch_icall$thunk$10345483385596137414
wil::details::ReportUsageToServiceDirect
wil_details_MapReportingKind| |`calling`|wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled|wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled
wil::details::FeatureImpl::__private_IsEnabled| |paramcount|8|8| |address|18000cb50|18000cb50| |sig|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)|void __cdecl ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### ReportUsageToService Calling Diff ```diff --- wil::details::ReportUsageToService calling +++ wil::details::ReportUsageToService calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::__private_IsEnabled ``` ## EnsureSubscribedToFeatureConfigurationChanges ### Match Info |Key|wersvc_7309.dll - wersvc_7623.dll| | :---: | :---: | |diff_type|refcount,calling| |ratio|1.0| |i_ratio|1.0| |m_ratio|1.0| |b_ratio|1.0| |match_types|SymbolsHash| ### Function Meta Diff |Key|wersvc_7309.dll|wersvc_7623.dll| | :---: | :---: | :---: | |name|EnsureSubscribedToFeatureConfigurationChanges|EnsureSubscribedToFeatureConfigurationChanges| |fullname|wil::details::EnsureSubscribedToFeatureConfigurationChanges|wil::details::EnsureSubscribedToFeatureConfigurationChanges| |`refcount`|5|6| |length|201|201| |called|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414|API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::AcquireSRWLockExclusive
API-MS-WIN-CORE-SYNCH-L1-1-0.DLL::ReleaseSRWLockExclusive
_guard_dispatch_icall$thunk$10345483385596137414| |`calling`|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured|wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::FeatureImpl::GetCachedFeatureEnabledState
wil::details::IsFeatureConfigured| |paramcount|0|0| |address|180009e04|180009e04| |sig|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)|uint __cdecl EnsureSubscribedToFeatureConfigurationChanges(void)| |sym_type|Function|Function| |sym_source|ANALYSIS|ANALYSIS| |external|False|False| ### EnsureSubscribedToFeatureConfigurationChanges Calling Diff ```diff --- wil::details::EnsureSubscribedToFeatureConfigurationChanges calling +++ wil::details::EnsureSubscribedToFeatureConfigurationChanges calling @@ -1,0 +2 @@ +wil::details::FeatureImpl::GetCachedFeatureEnabledState ``` _{Generated with `ghidriff` version: 1.0.0 on 2026-08-16T23:06:34}