# pre.exe-post.exe Diff

# TOC

* [Visual Chart Diff](#visual-chart-diff)
* [Metadata](#metadata)
	* [Ghidra Diff Engine](#ghidra-diff-engine)
		* [Command Line](#command-line)
	* [Binary Metadata Diff](#binary-metadata-diff)
	* [Program Options](#program-options)
	* [Diff Stats](#diff-stats)
	* [Strings](#strings)
* [Deleted](#deleted)
	* [ATL::CRegKey::RecurseDeleteKey](#atlcregkeyrecursedeletekey)
	* [KERNEL32.DLL::FreeLibrary](#kernel32dllfreelibrary)
	* [KERNEL32.DLL::LoadLibraryExW](#kernel32dllloadlibraryexw)
	* [KERNEL32.DLL::LoadLibraryW](#kernel32dllloadlibraryw)
	* [KERNEL32.DLL::GetProcAddress](#kernel32dllgetprocaddress)
* [Added](#added)
	* [WPP_SF_qSDdd](#wpp_sf_qsddd)
	* [DeleteKeyRecursive_64KEY_Recurse](#deletekeyrecursive_64key_recurse)
	* [KERNEL32.DLL::RegDeleteKeyExW](#kernel32dllregdeletekeyexw)
	* [NTDLL.DLL::NtQueryKey](#ntdlldllntquerykey)
	* [NTDLL.DLL::NtDeleteKey](#ntdlldllntdeletekey)
* [Modified](#modified)
	* [DeleteKeyRecursive_64KEY](#deletekeyrecursive_64key)
* [Modified (No Code Changes)](#modified-no-code-changes)
	* [KERNEL32.DLL::GetModuleHandleW](#kernel32dllgetmodulehandlew)
	* [__GSHandlerCheck_EH](#__gshandlercheck_eh)
	* [WPP_SF_dI](#wpp_sf_di)
	* [KERNEL32.DLL::RegQueryInfoKeyW](#kernel32dllregqueryinfokeyw)
	* [ADVAPI32.DLL::RegQueryValueExW](#advapi32dllregqueryvalueexw)
	* [ADVAPI32.DLL::RegCloseKey](#advapi32dllregclosekey)
	* [KERNEL32.DLL::GetLastError](#kernel32dllgetlasterror)
	* [__security_check_cookie](#__security_check_cookie)
	* [ADVAPI32.DLL::RegOpenKeyExW](#advapi32dllregopenkeyexw)
	* [MSVCRT.DLL::operator_delete[]](#msvcrtdlloperator_delete)
	* [dtor$0](#dtor0)
	* [WPP_SF_](#wpp_sf_)
	* [operator_new[]](#operator_new)
	* [ADVAPI32.DLL::TraceMessage](#advapi32dlltracemessage)
	* [WPP_SF_L](#wpp_sf_l)
	* [WPP_SF_S](#wpp_sf_s)

# Visual Chart Diff



```mermaid

flowchart LR

DeleteKeyRecursive_64KEY-2-old<--Match 34%-->DeleteKeyRecursive_64KEY-2-new

subgraph post.exe
    DeleteKeyRecursive_64KEY-2-new
    subgraph Added
direction LR
WPP_SF_qSDdd
    DeleteKeyRecursive_64KEY_Recurse
    KERNEL32DLL-RegDeleteKeyExW
    NTDLLDLL-NtQueryKey
    NTDLLDLL-NtDeleteKey
end
end

subgraph pre.exe
    DeleteKeyRecursive_64KEY-2-old
    subgraph Deleted
direction LR
ATL-CRegKey-RecurseDeleteKey
    KERNEL32DLL-FreeLibrary
    KERNEL32DLL-LoadLibraryExW
    KERNEL32DLL-LoadLibraryW
    KERNEL32DLL-GetProcAddress
end
end

```


```mermaid
pie showData
    title Function Matches - 99.8178%
"unmatched_funcs_len" : 10
"matched_funcs_len" : 5478
```



```mermaid
pie showData
    title Matched Function Similarity - 99.6714%
"matched_funcs_with_code_changes_len" : 1
"matched_funcs_with_non_code_changes_len" : 17
"matched_funcs_no_changes_len" : 5460
```

# Metadata

## Ghidra Diff Engine

### Command Line

#### Captured Command Line


```
ghidriff --project-location ./proj --project-name wmp-30225 --symbols-path symbols --gzfs-path gzfs --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --min-func-len 10 --gdt [] --bsim --max-ram-percent 60.0 --max-section-funcs 200 pre.exe post.exe
```


#### Verbose Args


<details>

```
--old ['pre.exe'] --new [['post.exe']] --engine VersionTrackingDiff --output-path ./out --summary False --project-location ./proj --project-name wmp-30225 --symbols-path symbols --gzfs-path gzfs --base-address None --program-options None --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --min-func-len 10 --use-calling-counts False --gdt [] --bsim True --bsim-full False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
```


</details>

#### Download Original PEs


```
wget https://msdl.microsoft.com/download/symbols/WMPNetwk.exe/E7BB581FEE000/WMPNetwk.exe -O wmpnetwk.exe.x64.12.0.19041.928
wget https://msdl.microsoft.com/download/symbols/WMPNetwk.exe/6DEDEE22EF000/WMPNetwk.exe -O wmpnetwk.exe.x64.12.0.19041.2728
```


## Binary Metadata Diff


```diff
--- pre.exe Meta
+++ post.exe Meta
@@ -1,44 +1,44 @@
-Program Name: pre.exe
+Program Name: post.exe
 Language ID: x86:LE:64:default (4.6)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
-# of Bytes: 970728
+# of Bytes: 971240
 # of Memory Blocks: 9
-# of Instructions: 169486
-# of Defined Data: 8335
+# of Instructions: 169668
+# of Defined Data: 8325
 # of Functions: 2744
-# of Symbols: 25870
-# of Data Types: 1528
-# of Data Type Categories: 95
+# of Symbols: 25869
+# of Data Types: 1525
+# of Data Type Categories: 94
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 12.0.4
-Date Created: Sun Aug 16 18:29:44 SGT 2026
+Date Created: Sun Aug 16 18:29:48 SGT 2026
 Executable Format: Portable Executable (PE)
-Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/wmp-30225/pre.exe
-Executable MD5: 321bcc034b10352b2a24ebb1bf0c7fc5
-Executable SHA256: 6b55a4b90b8b354c4cfb456ff5b78b16f6ac4248374076984fcac6e77f3c211f
-FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/wmp-30225/pre.exe?MD5=321bcc034b10352b2a24ebb1bf0c7fc5
+Executable Location: /sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/wmp-30225/post.exe
+Executable MD5: f7639b0cbbdad8d08ef07410e2bb7d2c
+Executable SHA256: 451a16262dee9923a643c0364da95cbdebd8356f5c2499c7dff7fb49b5acd5f2
+FSRL: file:///sessions/fervent-laughing-brahmagupta/mnt/patchpalooza/ghidriff/wmp-30225/post.exe?MD5=f7639b0cbbdad8d08ef07410e2bb7d2c
 PDB Age: 1
 PDB File: WMPNetwk.pdb
-PDB GUID: 1ca21949-e31f-fd5d-eb31-63a12e5632f0
+PDB GUID: 83ef5c98-34ca-2956-8771-0b620f3713df
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: Windows Media Player Network Sharing Service
-PE Property[FileVersion]: 12.0.19041.928 (WinBuild.160101.0800)
+PE Property[FileVersion]: 12.0.19041.2728 (WinBuild.160101.0800)
 PE Property[InternalName]: Windows Media Player Network Sharing Service
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: WMPNetwk.exe
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 12.0.19041.928
+PE Property[ProductVersion]: 12.0.19041.2728
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: true
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

```


## Program Options


<details>
<summary>Ghidra pre.exe Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra pre.exe Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra pre.exe Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>


<details>
<summary>Ghidra post.exe Decompiler Options</summary>


|Decompiler Option|Value|
| :---: | :---: |
|Prototype Evaluation|__fastcall|

</details>


<details>
<summary>Ghidra post.exe Specification extensions Options</summary>


|Specification extensions Option|Value|
| :---: | :---: |
|FormatVersion|0|
|VersionCounter|0|

</details>


<details>
<summary>Ghidra post.exe Analyzers Options</summary>


|Analyzers Option|Value|
| :---: | :---: |
|ASCII Strings|true|
|ASCII Strings.Create Strings Containing Existing Strings|true|
|ASCII Strings.Create Strings Containing References|true|
|ASCII Strings.Force Model Reload|false|
|ASCII Strings.Minimum String Length|LEN_5|
|ASCII Strings.Model File|StringModel.sng|
|ASCII Strings.Require Null Termination for String|true|
|ASCII Strings.Search Only in Accessible Memory Blocks|true|
|ASCII Strings.String Start Alignment|ALIGN_1|
|ASCII Strings.String end alignment|4|
|Aggressive Instruction Finder|false|
|Aggressive Instruction Finder.Create Analysis Bookmarks|true|
|Apply Data Archives|true|
|Apply Data Archives.Archive Chooser|[Auto-Detect]|
|Apply Data Archives.Create Analysis Bookmarks|true|
|Apply Data Archives.GDT User File Archive Path|None|
|Apply Data Archives.User Project Archive Path|None|
|Call Convention ID|true|
|Call Convention ID.Analysis Decompiler Timeout (sec)|60|
|Call-Fixup Installer|true|
|Condense Filler Bytes|false|
|Condense Filler Bytes.Filler Value|Auto|
|Condense Filler Bytes.Minimum number of sequential bytes|1|
|Create Address Tables|true|
|Create Address Tables.Allow Offcut References|false|
|Create Address Tables.Auto Label Table|false|
|Create Address Tables.Create Analysis Bookmarks|true|
|Create Address Tables.Maxmimum Pointer Distance|16777215|
|Create Address Tables.Minimum Pointer Address|4132|
|Create Address Tables.Minimum Table Size|2|
|Create Address Tables.Pointer Alignment|1|
|Create Address Tables.Relocation Table Guide|true|
|Create Address Tables.Table Alignment|4|
|Data Reference|true|
|Data Reference.Address Table Alignment|1|
|Data Reference.Address Table Minimum Size|2|
|Data Reference.Align End of Strings|false|
|Data Reference.Ascii String References|true|
|Data Reference.Create Address Tables|true|
|Data Reference.Minimum String Length|5|
|Data Reference.References to Pointers|true|
|Data Reference.Relocation Table Guide|true|
|Data Reference.Respect Execute Flag|true|
|Data Reference.Subroutine References|true|
|Data Reference.Switch Table References|false|
|Data Reference.Unicode String References|true|
|Decompiler Parameter ID|true|
|Decompiler Parameter ID.Analysis Clear Level|ANALYSIS|
|Decompiler Parameter ID.Analysis Decompiler Timeout (sec)|60|
|Decompiler Parameter ID.Commit Data Types|true|
|Decompiler Parameter ID.Commit Void Return Values|false|
|Decompiler Parameter ID.Prototype Evaluation|__fastcall|
|Decompiler Switch Analysis|true|
|Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)|60|
|Demangler Microsoft|true|
|Demangler Microsoft.Apply Function Calling Conventions|true|
|Demangler Microsoft.Apply Function Signatures|true|
|Demangler Microsoft.C-Style Symbol Interpretation|FUNCTION_IF_EXISTS|
|Demangler Microsoft.Demangle Only Known Mangled Symbols|false|
|Disassemble Entry Points|true|
|Disassemble Entry Points.Respect Execute Flag|true|
|Embedded Media|true|
|Embedded Media.Create Analysis Bookmarks|true|
|External Entry References|true|
|Function ID|true|
|Function ID.Always Apply FID Labels|false|
|Function ID.Create Analysis Bookmarks|true|
|Function ID.Instruction Count Threshold|14.6|
|Function ID.Multiple Match Threshold|30.0|
|Function Start Search|true|
|Function Start Search.Bookmark Functions|false|
|Function Start Search.Search Data Blocks|false|
|Non-Returning Functions - Discovered|true|
|Non-Returning Functions - Discovered.Create Analysis Bookmarks|true|
|Non-Returning Functions - Discovered.Function Non-return Threshold|3|
|Non-Returning Functions - Discovered.Repair Flow Damage|true|
|Non-Returning Functions - Known|true|
|Non-Returning Functions - Known.Create Analysis Bookmarks|true|
|PDB MSDIA|false|
|PDB MSDIA.Search untrusted symbol servers|false|
|PDB Universal|true|
|PDB Universal.Import Source Line Info|true|
|PDB Universal.Search untrusted symbol servers|false|
|Reference|true|
|Reference.Address Table Alignment|1|
|Reference.Address Table Minimum Size|2|
|Reference.Align End of Strings|false|
|Reference.Ascii String References|true|
|Reference.Create Address Tables|true|
|Reference.Minimum String Length|5|
|Reference.References to Pointers|true|
|Reference.Relocation Table Guide|true|
|Reference.Respect Execute Flag|true|
|Reference.Subroutine References|true|
|Reference.Switch Table References|false|
|Reference.Unicode String References|true|
|Scalar Operand References|true|
|Scalar Operand References.Relocation Table Guide|true|
|Shared Return Calls|true|
|Shared Return Calls.Allow Conditional Jumps|false|
|Shared Return Calls.Assume Contiguous Functions Only|true|
|Stack|true|
|Stack.Create Local Variables|true|
|Stack.Create Param Variables|false|
|Stack.Max Threads|2|
|Subroutine References|true|
|Subroutine References.Create Thunks Early|true|
|Variadic Function Signature Override|false|
|Variadic Function Signature Override.Create Analysis Bookmarks|false|
|Windows x86 PE Exception Handling|true|
|Windows x86 PE RTTI Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer|true|
|Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB||
|Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version|Windows 7|
|WindowsPE x86 Propagate External Parameters|false|
|WindowsResourceReference|true|
|WindowsResourceReference.Create Analysis Bookmarks|true|
|x86 Constant Reference Analyzer|true|
|x86 Constant Reference Analyzer.Create Data from pointer|false|
|x86 Constant Reference Analyzer.Function parameter/return Pointer analysis|true|
|x86 Constant Reference Analyzer.Max Threads|2|
|x86 Constant Reference Analyzer.Min absolute reference|4|
|x86 Constant Reference Analyzer.Require pointer param data type|false|
|x86 Constant Reference Analyzer.Speculative reference max|256|
|x86 Constant Reference Analyzer.Speculative reference min|1024|
|x86 Constant Reference Analyzer.Stored Value Pointer analysis|true|
|x86 Constant Reference Analyzer.Trust values read from writable memory|true|

</details>

## Diff Stats



|Stat|Value|
| :---: | :---: |
|added_funcs_len|5|
|deleted_funcs_len|5|
|modified_funcs_len|18|
|added_symbols_len|4|
|deleted_symbols_len|5|
|diff_time|7.442243337631226|
|deleted_strings_len|4|
|added_strings_len|1|
|match_types|Counter({'SymbolsHash': 2729, 'ExternalsName': 296, 'StructuralGraphHash': 8})|
|items_to_process|37|
|diff_types|Counter({'refcount': 18, 'calling': 16, 'address': 9, 'code': 1, 'length': 1, 'called': 1})|
|unmatched_funcs_len|10|
|total_funcs_len|5488|
|matched_funcs_len|5478|
|matched_funcs_with_code_changes_len|1|
|matched_funcs_with_non_code_changes_len|17|
|matched_funcs_no_changes_len|5460|
|match_func_similarity_percent|99.6714%|
|func_match_overall_percent|99.8178%|
|first_matches|Counter({'SymbolsHash': 2729, 'StructuralGraphHash': 8})|



```mermaid
pie showData
    title All Matches
"SymbolsHash" : 2729
"ExternalsName" : 296
"StructuralGraphHash" : 8
```



```mermaid
pie showData
    title First Matches
"SymbolsHash" : 2729
"StructuralGraphHash" : 8
```



```mermaid
pie showData
    title Diff Stats
"added_funcs_len" : 5
"deleted_funcs_len" : 5
"modified_funcs_len" : 18
```



```mermaid
pie showData
    title Symbols
"added_symbols_len" : 4
"deleted_symbols_len" : 5
```

## Strings



```mermaid
pie showData
    title Strings
"deleted_strings_len" : 4
"added_strings_len" : 1
```

### Strings Diff


```diff
--- deleted strings
+++ added strings
@@ -1,4 +1 @@
-s_RegDeleteKeyExW
-s_RegDeleteKeyW
-u_API-MS-Win-Core
-u_advapi32.dll
+u_SymbolicLinkVal

```


### String References

#### Old



|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|u_advapi32.dll|2|DeleteKeyRecursive_64KEY,RecurseDeleteKey|
|u_API-MS-Win-Core|1|RecurseDeleteKey|
|s_RegDeleteKeyW|1|RecurseDeleteKey|
|s_RegDeleteKeyExW|2|DeleteKeyRecursive_64KEY,RecurseDeleteKey|

#### New



|String|Ref Count|Ref Func|
| :---: | :---: | :---: |
|u_SymbolicLinkVal|1|DeleteKeyRecursive_64KEY_Recurse|

# Deleted

## ATL::CRegKey::RecurseDeleteKey

### Function Meta



|Key|pre.exe|
| :---: | :---: |
|name|RecurseDeleteKey|
|fullname|ATL::CRegKey::RecurseDeleteKey|
|refcount|3|
|length|532|
|called|ADVAPI32.DLL::RegCloseKey<br>ADVAPI32.DLL::RegEnumKeyExW<br>ADVAPI32.DLL::RegOpenKeyExW<br>ATL::CRegKey::RecurseDeleteKey<br>KERNEL32.DLL::GetLastError<br>KERNEL32.DLL::GetModuleHandleW<br>KERNEL32.DLL::GetProcAddress<br>KERNEL32.DLL::LoadLibraryExW<br>__security_check_cookie<br>_guard_dispatch_icall|
|calling|ATL::CRegKey::RecurseDeleteKey<br>DeleteKeyRecursive_64KEY|
|paramcount|2|
|address|14008c670|
|sig|long __thiscall RecurseDeleteKey(CRegKey * this, ushort * param_1)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|


```diff
--- ATL::CRegKey::RecurseDeleteKey
+++ ATL::CRegKey::RecurseDeleteKey
@@ -1,82 +0,0 @@
-
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* public: long __cdecl ATL::CRegKey::RecurseDeleteKey(unsigned short const * __ptr64) __ptr64 */
-
-long __thiscall ATL::CRegKey::RecurseDeleteKey(CRegKey *this,ushort *param_1)
-
-{
-  HKEY pHVar1;
-  DWORD DVar2;
-  LSTATUS LVar3;
-  HMODULE pHVar4;
-  FARPROC pFVar5;
-  undefined1 auStackY_298 [32];
-  DWORD local_258 [2];
-  HKEY local_250;
-  undefined8 local_248;
-  undefined8 local_240;
-  HKEY local_238;
-  _FILETIME local_230;
-  WCHAR local_228 [256];
-  ulonglong local_28;
-  
-  local_28 = __security_cookie ^ (ulonglong)auStackY_298;
-  local_250 = (HKEY)0x0;
-  local_248 = 0;
-  local_240 = 0;
-  local_238 = (HKEY)0x0;
-  DVar2 = RegOpenKeyExW(*(HKEY *)this,(LPCWSTR)param_1,0,0x2001f,&local_238);
-  if (DVar2 == 0) {
-    DVar2 = 0;
-    pHVar1 = local_238;
-    if (local_250 != (HKEY)0x0) {
-      DVar2 = RegCloseKey(local_250);
-      pHVar1 = local_238;
-    }
-    while (local_250 = pHVar1, DVar2 == 0) {
-      local_258[0] = 0x100;
-      LVar3 = RegEnumKeyExW(local_250,0,local_228,local_258,(LPDWORD)0x0,(LPWSTR)0x0,(LPDWORD)0x0,
-                            &local_230);
-      if (LVar3 != 0) {
-        if (local_250 != (HKEY)0x0) {
-          RegCloseKey(local_250);
-          local_250 = (HKEY)0x0;
-        }
-        if ((*(longlong *)(this + 8) == 0) && (*(longlong *)(this + 0x10) == 0)) {
-          pHVar4 = GetModuleHandleW(L"API-MS-Win-Core-LocalRegistry-L1-1-0.dll");
-          if (pHVar4 == (HMODULE)0x0) {
-            pHVar4 = LoadLibraryExW(L"advapi32.dll",(HANDLE)0x0,0);
-            if (pHVar4 != (HMODULE)0x0) {
-              pFVar5 = GetProcAddress(pHVar4,"RegDeleteKeyW");
-              *(FARPROC *)(this + 0x10) = pFVar5;
-            }
-          }
-          else {
-            pFVar5 = GetProcAddress(pHVar4,"RegDeleteKeyExW");
-            *(FARPROC *)(this + 8) = pFVar5;
-          }
-        }
-        if (*(code **)(this + 8) == (code *)0x0) {
-          if (*(code **)(this + 0x10) == (code *)0x0) {
-            DVar2 = GetLastError();
-          }
-          else {
-            DVar2 = (**(code **)(this + 0x10))(*(undefined8 *)this,param_1);
-          }
-        }
-        else {
-          DVar2 = (**(code **)(this + 8))(*(undefined8 *)this,param_1,0,0);
-        }
-        break;
-      }
-      DVar2 = RecurseDeleteKey((CRegKey *)&local_250,(ushort *)local_228);
-      pHVar1 = local_250;
-    }
-  }
-  if (local_250 != (HKEY)0x0) {
-    RegCloseKey(local_250);
-  }
-  return DVar2;
-}
-

```


## KERNEL32.DLL::FreeLibrary

### Function Meta



|Key|pre.exe|
| :---: | :---: |
|name|FreeLibrary|
|fullname|KERNEL32.DLL::FreeLibrary|
|refcount|2|
|length|0|
|called||
|calling|DeleteKeyRecursive_64KEY|
|paramcount|1|
|address|EXTERNAL:0000006f|
|sig|BOOL __stdcall FreeLibrary(HMODULE hLibModule)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for KERNEL32.DLL::FreeLibrary*
## KERNEL32.DLL::LoadLibraryExW

### Function Meta



|Key|pre.exe|
| :---: | :---: |
|name|LoadLibraryExW|
|fullname|KERNEL32.DLL::LoadLibraryExW|
|refcount|2|
|length|0|
|called||
|calling|ATL::CRegKey::RecurseDeleteKey|
|paramcount|3|
|address|EXTERNAL:0000006e|
|sig|HMODULE __stdcall LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for KERNEL32.DLL::LoadLibraryExW*
## KERNEL32.DLL::LoadLibraryW

### Function Meta



|Key|pre.exe|
| :---: | :---: |
|name|LoadLibraryW|
|fullname|KERNEL32.DLL::LoadLibraryW|
|refcount|2|
|length|0|
|called||
|calling|DeleteKeyRecursive_64KEY|
|paramcount|1|
|address|EXTERNAL:00000071|
|sig|HMODULE __stdcall LoadLibraryW(LPCWSTR lpLibFileName)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for KERNEL32.DLL::LoadLibraryW*
## KERNEL32.DLL::GetProcAddress

### Function Meta



|Key|pre.exe|
| :---: | :---: |
|name|GetProcAddress|
|fullname|KERNEL32.DLL::GetProcAddress|
|refcount|4|
|length|0|
|called||
|calling|ATL::CRegKey::RecurseDeleteKey<br>DeleteKeyRecursive_64KEY|
|paramcount|2|
|address|EXTERNAL:00000070|
|sig|FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for KERNEL32.DLL::GetProcAddress*
# Added

## WPP_SF_qSDdd

### Function Meta



|Key|post.exe|
| :---: | :---: |
|name|WPP_SF_qSDdd|
|fullname|WPP_SF_qSDdd|
|refcount|2|
|length|264|
|called|ADVAPI32.DLL::TraceMessage|
|calling|DeleteKeyRecursive_64KEY_Recurse|
|paramcount|5|
|address|14008a5a4|
|sig|undefined __fastcall WPP_SF_qSDdd(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4, wchar_t * param_5)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|False|


```diff
--- WPP_SF_qSDdd
+++ WPP_SF_qSDdd
@@ -0,0 +1,42 @@
+
+void WPP_SF_qSDdd(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
+                 wchar_t *param_5)
+
+{
+  longlong lVar1;
+  undefined8 local_res20;
+  undefined4 local_18 [6];
+  longlong lVar2;
+  
+  local_18[0] = 0x100;
+  if (param_5 == (wchar_t *)0x0) {
+    lVar1 = 10;
+  }
+  else if (*param_5 == L'\0') {
+    lVar1 = 0xe;
+  }
+  else {
+    lVar1 = -1;
+    do {
+      lVar2 = lVar1;
+      lVar1 = lVar2 + 1;
+    } while (param_5[lVar1] != L'\0');
+    if (lVar2 + 2U < 0xf3d) {
+      lVar1 = lVar1 * 2 + 2;
+    }
+    else {
+      lVar1 = 0x1e78;
+    }
+  }
+  if (param_5 == (wchar_t *)0x0) {
+    param_5 = L"NULL";
+  }
+  else if (*param_5 == L'\0') {
+    param_5 = L"<NULL>";
+  }
+  local_res20 = param_4;
+  TraceMessage(param_1,0x2b,&WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,0x59,&local_res20,8,
+               param_5,lVar1,&stack0x00000030,4,local_18,4,&stack0x00000040,4,0);
+  return;
+}
+

```


## DeleteKeyRecursive_64KEY_Recurse

### Function Meta



|Key|post.exe|
| :---: | :---: |
|name|DeleteKeyRecursive_64KEY_Recurse|
|fullname|DeleteKeyRecursive_64KEY_Recurse|
|refcount|3|
|length|1386|
|called|<details><summary>Expand for full list:<br>ADVAPI32.DLL::RegEnumKeyExW<br>ADVAPI32.DLL::RegOpenKeyExW<br>ADVAPI32.DLL::RegQueryValueExW<br>DeleteKeyRecursive_64KEY_Recurse<br>KERNEL32.DLL::RegDeleteKeyExW<br>KERNEL32.DLL::RegQueryInfoKeyW<br>MSVCRT.DLL::operator_delete[]<br>NTDLL.DLL::NtDeleteKey<br>NTDLL.DLL::NtQueryKey<br>WPP_SF_<br>WPP_SF_DqS</summary>WPP_SF_L<br>WPP_SF_S<br>WPP_SF_dI<br>WPP_SF_qSDdd<br>__security_check_cookie<br>operator_new[]</details>|
|calling|DeleteKeyRecursive_64KEY<br>DeleteKeyRecursive_64KEY_Recurse|
|paramcount|6|
|address|14008bf78|
|sig|long __cdecl DeleteKeyRecursive_64KEY_Recurse(HKEY__ * * param_1, ushort * param_2, ulong param_3, HKEY__ * * param_4, ulong param_5, ulong * param_6)|
|sym_type|Function|
|sym_source|ANALYSIS|
|external|False|


```diff
--- DeleteKeyRecursive_64KEY_Recurse
+++ DeleteKeyRecursive_64KEY_Recurse
@@ -0,0 +1,193 @@
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+/* long __cdecl DeleteKeyRecursive_64KEY_Recurse(struct HKEY__ * __ptr64 & __ptr64,unsigned short
+   const * __ptr64,unsigned long,struct HKEY__ * __ptr64 * __ptr64,unsigned long,unsigned long &
+   __ptr64) */
+
+long __cdecl
+DeleteKeyRecursive_64KEY_Recurse
+          (HKEY__ **param_1,ushort *param_2,ulong param_3,HKEY__ **param_4,ulong param_5,
+          ulong *param_6)
+
+{
+  undefined1 auVar1 [16];
+  HKEY__ **ppHVar2;
+  byte bVar3;
+  int iVar4;
+  int iVar5;
+  __uint64 _Var6;
+  wchar_t *lpData;
+  LPWSTR lpName;
+  undefined2 uVar7;
+  undefined4 in_register_00000084;
+  undefined8 uVar8;
+  undefined1 auStackY_e8 [32];
+  DWORD local_88;
+  DWORD local_84;
+  HKEY__ *local_80;
+  undefined4 local_78;
+  HKEY__ **local_70;
+  HKEY__ **local_68;
+  undefined1 local_60 [4];
+  byte local_5c;
+  ulonglong local_50;
+  
+  local_50 = __security_cookie ^ (ulonglong)auStackY_e8;
+  local_70 = param_4;
+  local_68 = param_1;
+  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+      ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) {
+    WPP_SF_qSDdd(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),param_2,
+                 CONCAT44(in_register_00000084,param_3),*param_1,(wchar_t *)param_2);
+  }
+  iVar4 = 4;
+  if (*param_6 < 0x100) {
+    uVar8 = 8;
+    iVar4 = RegOpenKeyExW(*param_1,(LPCWSTR)param_2,8,param_3 | 0xf003f,&local_80);
+    if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+       ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) {
+      bVar3 = 2;
+      if (iVar4 == 0) {
+        bVar3 = 5;
+      }
+      if (bVar3 <= (byte)WPP_GLOBAL_Control[0x19]) {
+        WPP_SF_DqS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),
+                   (ulonglong)(byte)WPP_GLOBAL_Control[0x19],uVar8,iVar4,*param_1,(wchar_t *)param_2
+                  );
+      }
+    }
+    if (iVar4 == 0) {
+      param_4[*param_6] = local_80;
+      *param_6 = *param_6 + 1;
+      local_78 = 0;
+      iVar4 = NtQueryKey(local_80,5,local_60,0xc);
+      if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+         ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) {
+        bVar3 = 2;
+        if (iVar4 == 0) {
+          bVar3 = 5;
+        }
+        if (bVar3 <= (byte)WPP_GLOBAL_Control[0x19]) {
+          WPP_SF_dI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5b,
+                    &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,iVar4);
+        }
+      }
+      if (-1 < iVar4) {
+        if ((local_5c & 2) == 0) {
+          local_84 = 0;
+          iVar4 = RegQueryInfoKeyW(local_80,(LPWSTR)0x0,(LPDWORD)0x0,(LPDWORD)0x0,(LPDWORD)0x0,
+                                   &local_84,(LPDWORD)0x0,(LPDWORD)0x0,(LPDWORD)0x0,(LPDWORD)0x0,
+                                   (LPDWORD)0x0,(PFILETIME)0x0);
+          if (iVar4 == 0) {
+            local_88 = local_84 + 1;
+            _Var6 = SUB168(ZEXT416(2) * ZEXT416(local_88),0);
+            if (SUB168(ZEXT416(2) * ZEXT416(local_88),8) != 0) {
+              _Var6 = 0xffffffffffffffff;
+            }
+            lpName = operator_new__(_Var6);
+            if (lpName == (LPWSTR)0x0) {
+              iVar4 = 0xe;
+            }
+            else {
+              iVar4 = RegEnumKeyExW(local_80,0,lpName,&local_88,(LPDWORD)0x0,(LPWSTR)0x0,
+                                    (LPDWORD)0x0,(PFILETIME)0x0);
+              ppHVar2 = local_70;
+              while (iVar4 == 0) {
+                lpName[local_88] = L'\0';
+                iVar4 = DeleteKeyRecursive_64KEY_Recurse
+                                  (&local_80,(ushort *)lpName,param_3,ppHVar2,0x100,param_6);
+                param_1 = local_68;
+                if (iVar4 != 0) break;
+                local_88 = local_84 + 1;
+                iVar4 = RegEnumKeyExW(local_80,0,lpName,&local_88,(LPDWORD)0x0,(LPWSTR)0x0,
+                                      (LPDWORD)0x0,(PFILETIME)0x0);
+                param_1 = local_68;
+              }
+              operator_delete__(lpName);
+              if (iVar4 == 0x103) {
+                iVar4 = RegDeleteKeyExW(*param_1,(LPCWSTR)param_2,param_3,0);
+              }
+            }
+          }
+        }
+        else {
+          if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+              ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) && (3 < (byte)WPP_GLOBAL_Control[0x19])) {
+            WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5c,
+                    &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids);
+          }
+          local_84 = 0;
+          local_88 = 0x80;
+          do {
+            auVar1 = ZEXT816(2) * ZEXT416((local_88 >> 1) + 1);
+            _Var6 = auVar1._0_8_;
+            if (auVar1._8_8_ != 0) {
+              _Var6 = 0xffffffffffffffff;
+            }
+            lpData = operator_new__(_Var6);
+            if (lpData == (wchar_t *)0x0) {
+              iVar4 = 0xe;
+              break;
+            }
+            iVar4 = RegQueryValueExW(local_80,L"SymbolicLinkValue",(LPDWORD)0x0,&local_84,
+                                     (LPBYTE)lpData,&local_88);
+            if ((((iVar4 == 0) && (local_84 == 6)) &&
+                (((local_88 & 1) == 0 &&
+                 ((lpData[local_88 >> 1] = L'\0',
+                  (undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control &&
+                  ((WPP_GLOBAL_Control[0x1c] & 2) != 0)))))) && (3 < (byte)WPP_GLOBAL_Control[0x19])
+               ) {
+              WPP_SF_S(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5d,
+                       &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,lpData);
+            }
+            operator_delete__(lpData);
+          } while (iVar4 == 0xea);
+          if (iVar4 == 0) {
+            iVar5 = NtDeleteKey();
+            if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+               ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) {
+              bVar3 = 2;
+              if (iVar5 == 0) {
+                bVar3 = 5;
+              }
+              if (bVar3 <= (byte)WPP_GLOBAL_Control[0x19]) {
+                WPP_SF_dI(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5e,
+                          &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,iVar5);
+              }
+            }
+            if (iVar5 < 0) {
+              if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
+                return iVar5;
+              }
+              iVar4 = iVar5;
+              if (((WPP_GLOBAL_Control[0x1c] & 2) == 0) || ((byte)WPP_GLOBAL_Control[0x19] < 4))
+              goto LAB_14008c480;
+              uVar7 = 0x60;
+            }
+            else {
+              if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
+                return 0;
+              }
+              if (((WPP_GLOBAL_Control[0x1c] & 2) == 0) || ((byte)WPP_GLOBAL_Control[0x19] < 4))
+              goto LAB_14008c480;
+              uVar7 = 0x5f;
+              iVar5 = iVar4;
+            }
+            WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),uVar7,
+                    &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids);
+            iVar4 = iVar5;
+          }
+        }
+      }
+    }
+  }
+LAB_14008c480:
+  if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
+      ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) &&
+     ((-(uint)(iVar4 != 0) & 0xfffffffd) + 5 <= (uint)(byte)WPP_GLOBAL_Control[0x19])) {
+    WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x61,
+             &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,iVar4);
+  }
+  return iVar4;
+}
+

```


## KERNEL32.DLL::RegDeleteKeyExW

### Function Meta



|Key|post.exe|
| :---: | :---: |
|name|RegDeleteKeyExW|
|fullname|KERNEL32.DLL::RegDeleteKeyExW|
|refcount|2|
|length|0|
|called||
|calling|DeleteKeyRecursive_64KEY_Recurse|
|paramcount|4|
|address|EXTERNAL:0000006e|
|sig|LSTATUS __stdcall RegDeleteKeyExW(HKEY hKey, LPCWSTR lpSubKey, REGSAM samDesired, DWORD Reserved)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for KERNEL32.DLL::RegDeleteKeyExW*
## NTDLL.DLL::NtQueryKey

### Function Meta



|Key|post.exe|
| :---: | :---: |
|name|NtQueryKey|
|fullname|NTDLL.DLL::NtQueryKey|
|refcount|2|
|length|0|
|called||
|calling|DeleteKeyRecursive_64KEY_Recurse|
|paramcount|0|
|address|EXTERNAL:00000112|
|sig|undefined NtQueryKey(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTDLL.DLL::NtQueryKey*
## NTDLL.DLL::NtDeleteKey

### Function Meta



|Key|post.exe|
| :---: | :---: |
|name|NtDeleteKey|
|fullname|NTDLL.DLL::NtDeleteKey|
|refcount|2|
|length|0|
|called||
|calling|DeleteKeyRecursive_64KEY_Recurse|
|paramcount|0|
|address|EXTERNAL:00000113|
|sig|undefined NtDeleteKey(void)|
|sym_type|Function|
|sym_source|IMPORTED|
|external|True|


*No code available for NTDLL.DLL::NtDeleteKey*
# Modified


*Modified functions contain code changes*
## DeleteKeyRecursive_64KEY

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|code,refcount,length,address,calling,called|
|ratio|0.2|
|i_ratio|0.2|
|m_ratio|0.64|
|b_ratio|0.34|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|DeleteKeyRecursive_64KEY|DeleteKeyRecursive_64KEY|
|fullname|DeleteKeyRecursive_64KEY|DeleteKeyRecursive_64KEY|
|`refcount`|11|10|
|`length`|754|319|
|`called`|<details><summary>Expand for full list:<br>ADVAPI32.DLL::RegCloseKey<br>ADVAPI32.DLL::RegEnumKeyExW<br>ADVAPI32.DLL::RegOpenKeyExW<br>ATL::CRegKey::RecurseDeleteKey<br>DeleteKeyRecursive_64KEY<br>KERNEL32.DLL::FreeLibrary<br>KERNEL32.DLL::GetCurrentProcess<br>KERNEL32.DLL::GetProcAddress<br>KERNEL32.DLL::IsWow64Process<br>KERNEL32.DLL::LoadLibraryW<br>WPP_SF_DqS</summary>WPP_SF_L<br>WPP_SF_qS<br>__security_check_cookie<br>_guard_dispatch_icall</details>|ADVAPI32.DLL::RegCloseKey<br>DeleteKeyRecursive_64KEY_Recurse<br>KERNEL32.DLL::GetCurrentProcess<br>KERNEL32.DLL::IsWow64Process<br>MSVCRT.DLL::operator_delete[]<br>WPP_SF_L<br>WPP_SF_qS<br>operator_new[]|
|`calling`|CDevicesDB::DeleteDevice<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CMACAddressControl::Shutdown<br>CWMCService::Uninstall<br>DeleteKeyRecursive_64KEY|CDevicesDB::DeleteDevice<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CMACAddressControl::Shutdown<br>CWMCService::Uninstall|
|paramcount|2|2|
|`address`|14008be68|14008c4ec|
|sig|long __cdecl DeleteKeyRecursive_64KEY(CRegKey * param_1, ushort * param_2)|long __cdecl DeleteKeyRecursive_64KEY(CRegKey * param_1, ushort * param_2)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### DeleteKeyRecursive_64KEY Called Diff


```diff
--- DeleteKeyRecursive_64KEY called
+++ DeleteKeyRecursive_64KEY called
@@ -2,5 +2 @@
-ADVAPI32.DLL::RegEnumKeyExW
-ADVAPI32.DLL::RegOpenKeyExW
-ATL::CRegKey::RecurseDeleteKey
-DeleteKeyRecursive_64KEY
-KERNEL32.DLL::FreeLibrary
+DeleteKeyRecursive_64KEY_Recurse
@@ -8 +3,0 @@
-KERNEL32.DLL::GetProcAddress
@@ -10,2 +5 @@
-KERNEL32.DLL::LoadLibraryW
-WPP_SF_DqS
+MSVCRT.DLL::operator_delete[]
@@ -14,2 +8 @@
-__security_check_cookie
-_guard_dispatch_icall
+operator_new[]
```


### DeleteKeyRecursive_64KEY Calling Diff


```diff
--- DeleteKeyRecursive_64KEY calling
+++ DeleteKeyRecursive_64KEY calling
@@ -6 +5,0 @@
-DeleteKeyRecursive_64KEY
```


### DeleteKeyRecursive_64KEY Diff


```diff
--- DeleteKeyRecursive_64KEY
+++ DeleteKeyRecursive_64KEY
@@ -1,102 +1,52 @@
 
-/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
-/* WARNING: Exceeded maximum restarts with more pending */
 /* long __cdecl DeleteKeyRecursive_64KEY(class ATL::CRegKey & __ptr64,unsigned short const *
    __ptr64) */
 
 long __cdecl DeleteKeyRecursive_64KEY(CRegKey *param_1,ushort *param_2)
 
 {
-  LSTATUS LVar1;
-  LSTATUS LVar2;
+  long lVar1;
+  HKEY__ **ppHVar2;
   HANDLE hProcess;
-  HMODULE hModule;
-  FARPROC pFVar3;
-  undefined8 uVar4;
-  undefined1 auStackY_2c8 [32];
-  HKEY local_288;
-  BOOL local_280 [2];
-  HKEY local_278;
-  undefined8 local_270;
-  undefined8 local_268;
-  _FILETIME local_260;
-  undefined8 local_258;
-  WCHAR local_248 [256];
-  ulonglong local_48;
+  uint uVar3;
+  ulong local_res18 [2];
+  BOOL local_res20 [2];
+  ulong in_stack_ffffffffffffffc8;
+  ushort *puVar4;
   
-  local_258 = 0xfffffffffffffffe;
-  local_48 = __security_cookie ^ (ulonglong)auStackY_2c8;
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) && (4 < (byte)WPP_GLOBAL_Control[0x19])) {
-    WPP_SF_qS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x59,
-              &WPP_ed0f7b30f44832d28dc48323d814e8bc_Traceguids,*(undefined8 *)param_1,
+    puVar4 = param_2;
+    WPP_SF_qS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x62,
+              &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,*(undefined8 *)param_1,
               (wchar_t *)param_2);
+    in_stack_ffffffffffffffc8 = (ulong)puVar4;
   }
-  LVar1 = 1;
-  local_280[0] = 0;
-  hProcess = GetCurrentProcess();
-  IsWow64Process(hProcess,local_280);
-  if (local_280[0] == 0) {
-    LVar1 = ATL::CRegKey::RecurseDeleteKey(param_1,param_2);
-  }
-  else {
-    hModule = LoadLibraryW(L"advapi32.dll");
-    if (hModule != (HMODULE)0x0) {
-      pFVar3 = GetProcAddress(hModule,"RegDeleteKeyExW");
-      if (pFVar3 != (FARPROC)0x0) {
-        local_278 = (HKEY)0x0;
-        local_270 = 0;
-        local_268 = 0;
-        local_288 = (HKEY)0x0;
-        LVar1 = RegOpenKeyExW(*(HKEY *)param_1,(LPCWSTR)param_2,0,0x2011f,&local_288);
-        if (LVar1 == 0) {
-          LVar1 = 0;
-          if (local_278 != (HKEY)0x0) {
-            LVar1 = RegCloseKey(local_278);
-          }
-          local_278 = local_288;
-        }
-        if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
-           ((WPP_GLOBAL_Control[0x1c] & 2) != 0)) {
-          uVar4 = 2;
-          if (LVar1 == 0) {
-            uVar4 = 5;
-          }
-          if ((uint)uVar4 <= (uint)(byte)WPP_GLOBAL_Control[0x19]) {
-            WPP_SF_DqS(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),WPP_GLOBAL_Control,uVar4,LVar1,
-                       *(undefined8 *)param_1,(wchar_t *)param_2);
-          }
-        }
-        if (LVar1 == 0) {
-          do {
-            local_288 = (HKEY)CONCAT44(local_288._4_4_,0x100);
-            LVar2 = RegEnumKeyExW(local_278,0,local_248,(LPDWORD)&local_288,(LPDWORD)0x0,(LPWSTR)0x0
-                                  ,(LPDWORD)0x0,&local_260);
-            if (LVar2 != 0) break;
-            LVar1 = DeleteKeyRecursive_64KEY((CRegKey *)&local_278,(ushort *)local_248);
-          } while (LVar1 == 0);
-          if (local_278 != (HKEY)0x0) {
-            RegCloseKey(local_278);
-            local_278 = (HKEY)0x0;
-          }
-          if (LVar1 == 0) {
-            LVar1 = (*pFVar3)(*(undefined8 *)param_1,param_2,0x100,0);
-          }
-        }
-        if (local_278 != (HKEY)0x0) {
-          RegCloseKey(local_278);
-        }
-      }
-      FreeLibrary(hModule);
+  uVar3 = 0;
+  local_res18[0] = 0;
+  lVar1 = 0xe;
+  ppHVar2 = operator_new__(0x800);
+  if (ppHVar2 != (HKEY__ **)0x0) {
+    local_res20[0] = 0;
+    hProcess = GetCurrentProcess();
+    IsWow64Process(hProcess,local_res20);
+    lVar1 = DeleteKeyRecursive_64KEY_Recurse
+                      ((HKEY__ **)param_1,param_2,-(uint)(local_res20[0] != 0) & 0x100,ppHVar2,
+                       in_stack_ffffffffffffffc8,local_res18);
+    if (local_res18[0] != 0) {
+      do {
+        RegCloseKey(ppHVar2[uVar3]);
+        uVar3 = uVar3 + 1;
+      } while (uVar3 < local_res18[0]);
     }
+    operator_delete__(ppHVar2);
   }
   if ((((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
       ((WPP_GLOBAL_Control[0x1c] & 1) != 0)) &&
-     ((-(uint)(LVar1 != 0) & 0xfffffffd) + 5 <= (uint)(byte)WPP_GLOBAL_Control[0x19])) {
-    WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),0x5b,
-             &WPP_ed0f7b30f44832d28dc48323d814e8bc_Traceguids,LVar1);
+     ((-(uint)(lVar1 != 0) & 0xfffffffd) + 5 <= (uint)(byte)WPP_GLOBAL_Control[0x19])) {
+    WPP_SF_L(*(undefined8 *)(WPP_GLOBAL_Control + 0x10),99,
+             &WPP_244cda6ac18c304bc3d1542ebee4ed18_Traceguids,lVar1);
   }
-  return LVar1;
+  return lVar1;
 }
 

```


# Modified (No Code Changes)


*Slightly modified functions have no code changes, rather differnces in:*
- refcount
- length
- called
- calling
- name
- fullname

## KERNEL32.DLL::GetModuleHandleW

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|GetModuleHandleW|GetModuleHandleW|
|fullname|KERNEL32.DLL::GetModuleHandleW|KERNEL32.DLL::GetModuleHandleW|
|`refcount`|3|2|
|length|0|0|
|called|||
|`calling`|ATL::CRegKey::RecurseDeleteKey<br>_get_image_app_type|_get_image_app_type|
|paramcount|1|1|
|`address`|EXTERNAL:00000075|EXTERNAL:00000072|
|sig|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|HMODULE __stdcall GetModuleHandleW(LPCWSTR lpModuleName)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### KERNEL32.DLL::GetModuleHandleW Calling Diff


```diff
--- KERNEL32.DLL::GetModuleHandleW calling
+++ KERNEL32.DLL::GetModuleHandleW calling
@@ -1 +0,0 @@
-ATL::CRegKey::RecurseDeleteKey
```


## __GSHandlerCheck_EH

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|0.92|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|__GSHandlerCheck_EH|__GSHandlerCheck_EH|
|fullname|__GSHandlerCheck_EH|__GSHandlerCheck_EH|
|`refcount`|69|68|
|length|127|127|
|called|__CxxFrameHandler3<br>__GSHandlerCheckCommon|__CxxFrameHandler3<br>__GSHandlerCheckCommon|
|calling|||
|paramcount|4|4|
|`address`|1400a492c|1400a4bdc|
|sig|undefined __fastcall __GSHandlerCheck_EH(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|undefined __fastcall __GSHandlerCheck_EH(longlong param_1, undefined8 param_2, undefined8 param_3, longlong param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

## WPP_SF_dI

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.94|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|WPP_SF_dI|WPP_SF_dI|
|fullname|WPP_SF_dI|WPP_SF_dI|
|`refcount`|144|146|
|length|74|74|
|called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage|
|`calling`|<details><summary>Expand for full list:<br>CConnectionManager::SendEvent<br>CContentDirectory::OnContainersChanged<br>CContentDirectory::SendEvent<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetResElementValue<br>CIPAddress::GetAdapterAddressesList<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginUrlTransform</summary>CMDEContentServer::CreateInstance<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::FreeResElements<br>CMDEContentServer::GenerateImageTranscodingResElement<br>CMDEContentServer::GenerateNonTranscodingResElements<br>CMDEContentServer::GenerateTranscodingResElements<br>CMDEContentServer::GenerateWMCResElement<br>CMDEContentServer::GetLocalPath<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::IsImageValid<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::UpdateConnectionInfo<br>CMDEProfileCollection::AddProfile<br>CMDEProfileCollection::FindHighestProfileInGroup<br>CMDEProfileCollection::FindLowestProfileInGroup<br>CMediaReceiverRegistrar::SendEvent<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationReqMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationRespMsg<br>CMediaReceiverRegistrar::internal_Advise<br>CMediaServer::GetWMCContentProvider<br>CMediaServer::GetWMCContentServers<br>CMediaServer::InitializeServer<br>CMediaServer::ShutdownServer<br>CMediaServer::~CMediaServer<br>CNetworkEvents::CreateInstance<br>CNetworkEvents::CreateProfileManager<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::Initialize<br>CNetworkEvents::NcCoSetProxyBlanket<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::RegisterProfileEvent<br>CShellProvider::CreateInstance<br>CShellProvider::GetCustomNamespace<br>CShellProvider::GetFriendlyName<br>CShellProvider::GetMIMETypes<br>CShellProvider::GetSerialNumber<br>CShellProvider::Initialize<br>CShellProvider::InternalCompareUPnPItems<br>CShellProvider::ReturnWMPBrowseMetadataResults<br>CShellProvider::SortAggregateItemResultSet<br>CShellProviderAggregateResults::CreateInstance<br>CShellProviderAggregateResults::get_Item<br>CShellProviderFactory::CreateInstance<br>CShellProviderFactory::EnumerateContentProviders<br>CShellProviderFactory::Initialize<br>CShellProviderResults::CreateBrowseChildrenInstance<br>CShellProviderResults::CreateBrowseMetadataInstance<br>CShellProviderResults::PopulateSortMappingArray<br>CShellProviderResults::get_Item<br>CWMCContentProviderEventHandler::CreateInstance<br>CWMCProviders::CreateInstance<br>CWMCProviders::get_Item<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DestroyMediaDevices<br>CWMCService::GetMDEOpCenter<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::OnContentProviderRemoved<br>CWMCService::UpdateSharingStatus<br>CdsAndQuery::Duplicate<br>CdsBinaryOpQuery::Duplicate<br>CdsExistsQuery::Duplicate<br>CdsOrQuery::Duplicate<br>CdsParseLevel::CreateCompositeQuery<br>CdsParseProduct::CreateCompositeQuery<br>CdsQuery::Duplicate<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsStarQuery::Duplicate<br>CdsUpdateObjectParser::ParseTagValueList<br>ContentDirectoryErrors::SetCDErrorInfo<br>ConvertStringToUINT64<br>CreateMediaServer<br>DLNACommon::IsWakeOnLANEnabled<br>FindMatchingMDEProfileInCollection<br>_NetworkAddressChange</details>|<details><summary>Expand for full list:<br>CConnectionManager::SendEvent<br>CContentDirectory::OnContainersChanged<br>CContentDirectory::SendEvent<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetResElementValue<br>CIPAddress::GetAdapterAddressesList<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginUrlTransform</summary>CMDEContentServer::CreateInstance<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::FreeResElements<br>CMDEContentServer::GenerateImageTranscodingResElement<br>CMDEContentServer::GenerateNonTranscodingResElements<br>CMDEContentServer::GenerateTranscodingResElements<br>CMDEContentServer::GenerateWMCResElement<br>CMDEContentServer::GetLocalPath<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::IsImageValid<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::UpdateConnectionInfo<br>CMDEProfileCollection::AddProfile<br>CMDEProfileCollection::FindHighestProfileInGroup<br>CMDEProfileCollection::FindLowestProfileInGroup<br>CMediaReceiverRegistrar::SendEvent<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationReqMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationRespMsg<br>CMediaReceiverRegistrar::internal_Advise<br>CMediaServer::GetWMCContentProvider<br>CMediaServer::GetWMCContentServers<br>CMediaServer::InitializeServer<br>CMediaServer::ShutdownServer<br>CMediaServer::~CMediaServer<br>CNetworkEvents::CreateInstance<br>CNetworkEvents::CreateProfileManager<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::Initialize<br>CNetworkEvents::NcCoSetProxyBlanket<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::RegisterProfileEvent<br>CShellProvider::CreateInstance<br>CShellProvider::GetCustomNamespace<br>CShellProvider::GetFriendlyName<br>CShellProvider::GetMIMETypes<br>CShellProvider::GetSerialNumber<br>CShellProvider::Initialize<br>CShellProvider::InternalCompareUPnPItems<br>CShellProvider::ReturnWMPBrowseMetadataResults<br>CShellProvider::SortAggregateItemResultSet<br>CShellProviderAggregateResults::CreateInstance<br>CShellProviderAggregateResults::get_Item<br>CShellProviderFactory::CreateInstance<br>CShellProviderFactory::EnumerateContentProviders<br>CShellProviderFactory::Initialize<br>CShellProviderResults::CreateBrowseChildrenInstance<br>CShellProviderResults::CreateBrowseMetadataInstance<br>CShellProviderResults::PopulateSortMappingArray<br>CShellProviderResults::get_Item<br>CWMCContentProviderEventHandler::CreateInstance<br>CWMCProviders::CreateInstance<br>CWMCProviders::get_Item<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DestroyMediaDevices<br>CWMCService::GetMDEOpCenter<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::OnContentProviderRemoved<br>CWMCService::UpdateSharingStatus<br>CdsAndQuery::Duplicate<br>CdsBinaryOpQuery::Duplicate<br>CdsExistsQuery::Duplicate<br>CdsOrQuery::Duplicate<br>CdsParseLevel::CreateCompositeQuery<br>CdsParseProduct::CreateCompositeQuery<br>CdsQuery::Duplicate<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsStarQuery::Duplicate<br>CdsUpdateObjectParser::ParseTagValueList<br>ContentDirectoryErrors::SetCDErrorInfo<br>ConvertStringToUINT64<br>CreateMediaServer<br>DLNACommon::IsWakeOnLANEnabled<br>DeleteKeyRecursive_64KEY_Recurse<br>FindMatchingMDEProfileInCollection<br>_NetworkAddressChange</details>|
|paramcount|4|4|
|address|14000adac|14000adac|
|sig|undefined __fastcall WPP_SF_dI(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_dI(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_dI Calling Diff


```diff
--- WPP_SF_dI calling
+++ WPP_SF_dI calling
@@ -86,0 +87 @@
+DeleteKeyRecursive_64KEY_Recurse
```


## KERNEL32.DLL::RegQueryInfoKeyW

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|RegQueryInfoKeyW|RegQueryInfoKeyW|
|fullname|KERNEL32.DLL::RegQueryInfoKeyW|KERNEL32.DLL::RegQueryInfoKeyW|
|`refcount`|2|3|
|length|0|0|
|called|||
|`calling`|EnumSubKeys|DeleteKeyRecursive_64KEY_Recurse<br>EnumSubKeys|
|paramcount|12|12|
|`address`|EXTERNAL:00000072|EXTERNAL:0000006f|
|sig|LSTATUS __stdcall RegQueryInfoKeyW(HKEY hKey, LPWSTR lpClass, LPDWORD lpcchClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime)|LSTATUS __stdcall RegQueryInfoKeyW(HKEY hKey, LPWSTR lpClass, LPDWORD lpcchClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### KERNEL32.DLL::RegQueryInfoKeyW Calling Diff


```diff
--- KERNEL32.DLL::RegQueryInfoKeyW calling
+++ KERNEL32.DLL::RegQueryInfoKeyW calling
@@ -0,0 +1 @@
+DeleteKeyRecursive_64KEY_Recurse
```


## ADVAPI32.DLL::RegQueryValueExW

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|RegQueryValueExW|RegQueryValueExW|
|fullname|ADVAPI32.DLL::RegQueryValueExW|ADVAPI32.DLL::RegQueryValueExW|
|`refcount`|17|18|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::CRegKey::QueryStringValue<br>CDeviceShim::GetCompatFlagsValue<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::SetDeviceAuthorization<br>CEventsDB::GetEvents<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID</summary>CheckDWORDRegistryValue<br>GetStringValue<br>IsHMEAllowedByGroupPolicy<br>WriteResults2</details>|<details><summary>Expand for full list:<br>ATL::CRegKey::QueryStringValue<br>CDeviceShim::GetCompatFlagsValue<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::SetDeviceAuthorization<br>CEventsDB::GetEvents<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID</summary>CheckDWORDRegistryValue<br>DeleteKeyRecursive_64KEY_Recurse<br>GetStringValue<br>IsHMEAllowedByGroupPolicy<br>WriteResults2</details>|
|paramcount|6|6|
|address|EXTERNAL:00000028|EXTERNAL:00000028|
|sig|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|LSTATUS __stdcall RegQueryValueExW(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### ADVAPI32.DLL::RegQueryValueExW Calling Diff


```diff
--- ADVAPI32.DLL::RegQueryValueExW calling
+++ ADVAPI32.DLL::RegQueryValueExW calling
@@ -12,0 +13 @@
+DeleteKeyRecursive_64KEY_Recurse
```


## ADVAPI32.DLL::RegCloseKey

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|RegCloseKey|RegCloseKey|
|fullname|ADVAPI32.DLL::RegCloseKey|ADVAPI32.DLL::RegCloseKey|
|`refcount`|84|79|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::CRegKey::Create<br>ATL::CRegKey::RecurseDeleteKey<br>ATL::CRegKey::~CRegKey<br>CContentDirectory::internal_get_SearchCapabilities<br>CDevicePolicy::LoadPolicy<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs</summary>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::IsExistingDevice<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CHMESharedLibraryMonitor::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CHMESharedLibraryMonitor::~CHMESharedLibraryMonitor<br>CMACAddressControl::Shutdown<br>CNTService::Install<br>CServiceControl::SetSubStatus<br>CShellProvider::InitializeMIMETypes<br>CWMCService::AnyUsersWantSharing<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::Run<br>CWMCService::Uninstall<br>CWMCService::UpdateServerUPnPDeviceID<br>CheckDWORDRegistryValue<br>CreateKeyAndSetACLs<br>DeleteKeyRecursive_64KEY<br>IsHMEAllowedByGroupPolicy<br>IsWakeOnLANEnabled<br>IsWindowsSetupComplete<br>WriteResults2</details>|<details><summary>Expand for full list:<br>ATL::CRegKey::Create<br>ATL::CRegKey::~CRegKey<br>CContentDirectory::internal_get_SearchCapabilities<br>CDevicePolicy::LoadPolicy<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs<br>CDevicesDB::GetDeviceAuthorization</summary>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::IsExistingDevice<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CHMESharedLibraryMonitor::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CHMESharedLibraryMonitor::~CHMESharedLibraryMonitor<br>CMACAddressControl::Shutdown<br>CNTService::Install<br>CServiceControl::SetSubStatus<br>CShellProvider::InitializeMIMETypes<br>CWMCService::AnyUsersWantSharing<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::Run<br>CWMCService::Uninstall<br>CWMCService::UpdateServerUPnPDeviceID<br>CheckDWORDRegistryValue<br>CreateKeyAndSetACLs<br>DeleteKeyRecursive_64KEY<br>IsHMEAllowedByGroupPolicy<br>IsWakeOnLANEnabled<br>IsWindowsSetupComplete<br>WriteResults2</details>|
|paramcount|1|1|
|address|EXTERNAL:0000000d|EXTERNAL:0000000d|
|sig|LSTATUS __stdcall RegCloseKey(HKEY hKey)|LSTATUS __stdcall RegCloseKey(HKEY hKey)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### ADVAPI32.DLL::RegCloseKey Calling Diff


```diff
--- ADVAPI32.DLL::RegCloseKey calling
+++ ADVAPI32.DLL::RegCloseKey calling
@@ -2 +1,0 @@
-ATL::CRegKey::RecurseDeleteKey
```


## KERNEL32.DLL::GetLastError

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|GetLastError|GetLastError|
|fullname|KERNEL32.DLL::GetLastError|KERNEL32.DLL::GetLastError|
|`refcount`|56|55|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::AtlHresultFromLastError<br>ATL::AtlThrowLastWin32<br>ATL::CA2WEX<128>::CA2WEX<128><br>ATL::CRegKey::RecurseDeleteKey<br>ATL::CSecurityDesc::MakeAbsolute<br>ATL::CSid::GetAccountNameAndDomain<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::AppendFormat<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::Format<br>ATL::ChTraitsOS<unsigned_short>::Format<br>Base64ToUnicode<br>CDevicesDB::CreateUserKey</summary>CEventsDB::Create<br>CEventsDB::SignalEvents<br>CHMELibraryPathMonitor::Initialize<br>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CHMELibraryPathMonitor::_FolderWatchProc<br>CMFBaseStringT<unsigned_short>::Append<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::ServiceMain<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::Start<br>CShellProvider::GetFriendlyName<br>CShellQuery::_WaitForItems<br>CShellResultsListenerEvent::Initialize<br>CWMCService::OnInit<br>GenerateStringFromResourceData<br>SafeGetModuleFileName<br>StartNetworkMonitoring<br>StopService<br>UPnPEventPublisher::OnAdvise<br>UPnPEventPublisher::Publish<br>WaitForStop</details>|<details><summary>Expand for full list:<br>ATL::AtlHresultFromLastError<br>ATL::AtlThrowLastWin32<br>ATL::CA2WEX<128>::CA2WEX<128><br>ATL::CSecurityDesc::MakeAbsolute<br>ATL::CSid::GetAccountNameAndDomain<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::AppendFormat<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::Format<br>ATL::ChTraitsOS<unsigned_short>::Format<br>Base64ToUnicode<br>CDevicesDB::CreateUserKey<br>CEventsDB::Create</summary>CEventsDB::SignalEvents<br>CHMELibraryPathMonitor::Initialize<br>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CHMELibraryPathMonitor::_FolderWatchProc<br>CMFBaseStringT<unsigned_short>::Append<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::ServiceMain<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::Start<br>CShellProvider::GetFriendlyName<br>CShellQuery::_WaitForItems<br>CShellResultsListenerEvent::Initialize<br>CWMCService::OnInit<br>GenerateStringFromResourceData<br>SafeGetModuleFileName<br>StartNetworkMonitoring<br>StopService<br>UPnPEventPublisher::OnAdvise<br>UPnPEventPublisher::Publish<br>WaitForStop</details>|
|paramcount|0|0|
|address|EXTERNAL:0000006b|EXTERNAL:0000006b|
|sig|DWORD __stdcall GetLastError(void)|DWORD __stdcall GetLastError(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### KERNEL32.DLL::GetLastError Calling Diff


```diff
--- KERNEL32.DLL::GetLastError calling
+++ KERNEL32.DLL::GetLastError calling
@@ -4 +3,0 @@
-ATL::CRegKey::RecurseDeleteKey
```


## __security_check_cookie

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.5|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|__security_check_cookie|__security_check_cookie|
|fullname|__security_check_cookie|__security_check_cookie|
|`refcount`|136|135|
|length|30|30|
|called|__report_gsfailure|__report_gsfailure|
|`calling`|<details><summary>Expand for full list:<br>ATL::AtlEscapeUrl<br>ATL::CComTypeInfoHolder::GetTI<br>ATL::CDacl::Copy<br>ATL::COleDateTime::COleDateTime<br>ATL::COleDateTime::ConvertSystemTimeToVariantTime<br>ATL::CRegKey::RecurseDeleteKey<br>ATL::CSecurityDesc::SetDacl<br>ATL::CSid::GetAccountNameAndDomain<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::AppendFormat<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::Format<br>ATL::CWorkerThread<class_ATL::Win32ThreadTraits>::WorkerThreadProc</summary>ATL::ChTraitsOS<unsigned_short>::Format<br>AddAccessSidToDacl<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_Search<br>CContentDirectory::internal_UpdateObject<br>CDevicesDB::CreateUserKey<br>CDidlLiteObjectWriter::ActuallyWriteElement<br>CDidlLiteObjectWriter::WriteEscapedAttributeValue<br>CDidlLiteObjectWriter::WriteEscapedElementValue<br>CDidlLiteObjectWriter::WriteInnerAttributes<br>CDidlLiteObjectWriter::WriteObject<br>CDidlLiteObjectWriter::WriteObjectAttributes<br>CDistinctHMEMediaContainer::CreatePhotoDateSubcontainers<br>CDistinctHMEMediaContainer::CreateSubcontainers<br>CEventLog::ReportEventW<br>CGeneratedContainerFactory::_GenerateContainerID<br>CGeneratedFolderContainer::CreatePlaylistSubcontainers<br>CGeneratedStackContainer::CreateSubcontainers<br>CHMEContainerManager::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CMACAddressControl::FilterAddress<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::GetNetworkId<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::ShouldAllowAccess<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginUrlTransform<br>CMDEContentServer::CreateInstance<br>CMDEContentServer::CustomizeSingleProfile<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::GenerateImageTranscodingResElement<br>CMDEContentServer::GenerateTranscodingResElements<br>CMDEContentServer::GenerateURI<br>CMDEContentServer::GetMACAddress<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::GetResElements<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::SetContentProvider<br>CMDEContentServer::UpdateConnectionInfo<br>CMediaReceiverRegistrar::RegisterDevice<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::internal_RegisterDevice<br>CMetadataWriter::WriteDate<br>CNTService::DecrementContentRequestsOutstandingAtTime<br>CNTService::IncrementContentRequestsOutstanding<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::Uninstall<br>CNetworkEvents::Initialize<br>CNetworkEvents::NetworkAdded<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::NetworkPropertyChanged<br>CPlaylistsHMEMediaContainer::CreateSubcontainers<br>CServerDevicesDB::IsValidID<br>CShellCommandFactory::CreateCommand<br>CShellPropertyThunk::AdjustTimeAndDate<br>CShellPropertyThunk::AppendDateQueryForProperty<br>CShellPropertyThunk::ConvertDateTimeToString<br>CShellPropertyThunk::ConvertDateToString<br>CShellPropertyThunk::DateFromUpnpDateString<br>CShellPropertyThunk::DateSearchThunk<br>CShellPropertyThunk::DateThunk<br>CShellPropertyThunk::FolderPathThunk<br>CShellPropertyThunk::GetVideoCodecProperty<br>CShellPropertyThunk::IfoFileThunk<br>CShellProvider::InitializeMIMETypes<br>CShellProvider::OnChanged<br>CShellProviderResults::CWMCUPnPItem::ConvertAlphaToWhite<br>CShellProviderResults::CWMCUPnPItem::ConvertFrameToJPEG<br>CShellProviderResults::CWMCUPnPItem::GetDescElementValues<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellQuery::CopyOutputItemsFromRowset<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::Install<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CdsFilter::Clear<br>CdsItemInfo::GetElementValue<br>CdsItemInfoBase::GetAttributeUINT32Value<br>CdsItemInfoBase::GetAttributeUINT64Value<br>CdsObjectWriter::ActuallyWriteAlbumArtURIs<br>CdsObjectWriter::ActuallyWriteAlbumArtURIsAsResElement<br>CdsObjectWriter::ActuallyWriteElement<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::WriteElement<br>CdsObjectWriter::WriteInnerAttributes<br>CdsObjectWriter::WriteObjectAttributes<br>CreateUUID<br>DeleteKeyRecursive_64KEY<br>GetStringFromAddress<br>IsIPAddressPermitted<br>IsWMC<br>IsWindowsSetupComplete<br>McTemplateU0pppq_EventWriteTransfer<br>McTemplateU0pq_EventWriteTransfer<br>McTemplateU0pzpq_EventWriteTransfer<br>McTemplateU0qq_EventWriteTransfer<br>McTemplateU0qqqq_EventWriteTransfer<br>McTemplateU0qqqqq_EventWriteTransfer<br>McTemplateU0tqqqqq_EventWriteTransfer<br>McTemplateU0ttq_EventWriteTransfer<br>McTemplateU0z_EventWriteTransfer<br>McTemplateU0zq_EventWriteTransfer<br>McTemplateU0zqqqqq_EventWriteTransfer<br>McTemplateU0zqqqqqqq_EventWriteTransfer<br>McTemplateU0ztqqqqq_EventWriteTransfer<br>McTemplateU0zzqqqqqq_EventWriteTransfer<br>McTemplateU0zzqqzzqqq_EventWriteTransfer<br>McTemplateU0zzz_EventWriteTransfer<br>StopService<br>WriteResults2<br>__GSHandlerCheckCommon<br>_invoke_watson<br>wWinMain</details>|<details><summary>Expand for full list:<br>ATL::AtlEscapeUrl<br>ATL::CComTypeInfoHolder::GetTI<br>ATL::CDacl::Copy<br>ATL::COleDateTime::COleDateTime<br>ATL::COleDateTime::ConvertSystemTimeToVariantTime<br>ATL::CSecurityDesc::SetDacl<br>ATL::CSid::GetAccountNameAndDomain<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::AppendFormat<br>ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>::Format<br>ATL::CWorkerThread<class_ATL::Win32ThreadTraits>::WorkerThreadProc<br>ATL::ChTraitsOS<unsigned_short>::Format</summary>AddAccessSidToDacl<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_Search<br>CContentDirectory::internal_UpdateObject<br>CDevicesDB::CreateUserKey<br>CDidlLiteObjectWriter::ActuallyWriteElement<br>CDidlLiteObjectWriter::WriteEscapedAttributeValue<br>CDidlLiteObjectWriter::WriteEscapedElementValue<br>CDidlLiteObjectWriter::WriteInnerAttributes<br>CDidlLiteObjectWriter::WriteObject<br>CDidlLiteObjectWriter::WriteObjectAttributes<br>CDistinctHMEMediaContainer::CreatePhotoDateSubcontainers<br>CDistinctHMEMediaContainer::CreateSubcontainers<br>CEventLog::ReportEventW<br>CGeneratedContainerFactory::_GenerateContainerID<br>CGeneratedFolderContainer::CreatePlaylistSubcontainers<br>CGeneratedStackContainer::CreateSubcontainers<br>CHMEContainerManager::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CMACAddressControl::FilterAddress<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::GetNetworkId<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::ShouldAllowAccess<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginUrlTransform<br>CMDEContentServer::CreateInstance<br>CMDEContentServer::CustomizeSingleProfile<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::GenerateImageTranscodingResElement<br>CMDEContentServer::GenerateTranscodingResElements<br>CMDEContentServer::GenerateURI<br>CMDEContentServer::GetMACAddress<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::GetResElements<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::SetContentProvider<br>CMDEContentServer::UpdateConnectionInfo<br>CMediaReceiverRegistrar::RegisterDevice<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::internal_RegisterDevice<br>CMetadataWriter::WriteDate<br>CNTService::DecrementContentRequestsOutstandingAtTime<br>CNTService::IncrementContentRequestsOutstanding<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::Uninstall<br>CNetworkEvents::Initialize<br>CNetworkEvents::NetworkAdded<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::NetworkPropertyChanged<br>CPlaylistsHMEMediaContainer::CreateSubcontainers<br>CServerDevicesDB::IsValidID<br>CShellCommandFactory::CreateCommand<br>CShellPropertyThunk::AdjustTimeAndDate<br>CShellPropertyThunk::AppendDateQueryForProperty<br>CShellPropertyThunk::ConvertDateTimeToString<br>CShellPropertyThunk::ConvertDateToString<br>CShellPropertyThunk::DateFromUpnpDateString<br>CShellPropertyThunk::DateSearchThunk<br>CShellPropertyThunk::DateThunk<br>CShellPropertyThunk::FolderPathThunk<br>CShellPropertyThunk::GetVideoCodecProperty<br>CShellPropertyThunk::IfoFileThunk<br>CShellProvider::InitializeMIMETypes<br>CShellProvider::OnChanged<br>CShellProviderResults::CWMCUPnPItem::ConvertAlphaToWhite<br>CShellProviderResults::CWMCUPnPItem::ConvertFrameToJPEG<br>CShellProviderResults::CWMCUPnPItem::GetDescElementValues<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellQuery::CopyOutputItemsFromRowset<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::Install<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CdsFilter::Clear<br>CdsItemInfo::GetElementValue<br>CdsItemInfoBase::GetAttributeUINT32Value<br>CdsItemInfoBase::GetAttributeUINT64Value<br>CdsObjectWriter::ActuallyWriteAlbumArtURIs<br>CdsObjectWriter::ActuallyWriteAlbumArtURIsAsResElement<br>CdsObjectWriter::ActuallyWriteElement<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::WriteElement<br>CdsObjectWriter::WriteInnerAttributes<br>CdsObjectWriter::WriteObjectAttributes<br>CreateUUID<br>DeleteKeyRecursive_64KEY_Recurse<br>GetStringFromAddress<br>IsIPAddressPermitted<br>IsWMC<br>IsWindowsSetupComplete<br>McTemplateU0pppq_EventWriteTransfer<br>McTemplateU0pq_EventWriteTransfer<br>McTemplateU0pzpq_EventWriteTransfer<br>McTemplateU0qq_EventWriteTransfer<br>McTemplateU0qqqq_EventWriteTransfer<br>McTemplateU0qqqqq_EventWriteTransfer<br>McTemplateU0tqqqqq_EventWriteTransfer<br>McTemplateU0ttq_EventWriteTransfer<br>McTemplateU0z_EventWriteTransfer<br>McTemplateU0zq_EventWriteTransfer<br>McTemplateU0zqqqqq_EventWriteTransfer<br>McTemplateU0zqqqqqqq_EventWriteTransfer<br>McTemplateU0ztqqqqq_EventWriteTransfer<br>McTemplateU0zzqqqqqq_EventWriteTransfer<br>McTemplateU0zzqqzzqqq_EventWriteTransfer<br>McTemplateU0zzz_EventWriteTransfer<br>StopService<br>WriteResults2<br>__GSHandlerCheckCommon<br>_invoke_watson<br>wWinMain</details>|
|paramcount|1|1|
|`address`|1400a37d0|1400a3a80|
|sig|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|void __cdecl __security_check_cookie(uintptr_t _StackCookie)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### __security_check_cookie Calling Diff


```diff
--- __security_check_cookie calling
+++ __security_check_cookie calling
@@ -6 +5,0 @@
-ATL::CRegKey::RecurseDeleteKey
@@ -110 +109 @@
-DeleteKeyRecursive_64KEY
+DeleteKeyRecursive_64KEY_Recurse
```


## ADVAPI32.DLL::RegOpenKeyExW

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|RegOpenKeyExW|RegOpenKeyExW|
|fullname|ADVAPI32.DLL::RegOpenKeyExW|ADVAPI32.DLL::RegOpenKeyExW|
|`refcount`|40|39|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::CRegKey::RecurseDeleteKey<br>CContentDirectory::internal_get_SearchCapabilities<br>CDevicePolicy::LoadPolicy<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CEventsDB::GetEvents<br>CHMESharedLibraryMonitor::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry</summary>CNTService::Install<br>CShellProvider::InitializeMIMETypes<br>CWMCService::AnyUsersWantSharing<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::Run<br>CWMCService::Uninstall<br>CheckDWORDRegistryValue<br>DeleteKeyRecursive_64KEY<br>IsHMEAllowedByGroupPolicy<br>IsWakeOnLANEnabled<br>IsWindowsSetupComplete<br>WriteResults2</details>|<details><summary>Expand for full list:<br>CContentDirectory::internal_get_SearchCapabilities<br>CDevicePolicy::LoadPolicy<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CEventsDB::GetEvents<br>CHMESharedLibraryMonitor::Initialize<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CNTService::Install</summary>CShellProvider::InitializeMIMETypes<br>CWMCService::AnyUsersWantSharing<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::Run<br>CWMCService::Uninstall<br>CheckDWORDRegistryValue<br>DeleteKeyRecursive_64KEY_Recurse<br>IsHMEAllowedByGroupPolicy<br>IsWakeOnLANEnabled<br>IsWindowsSetupComplete<br>WriteResults2</details>|
|paramcount|5|5|
|address|EXTERNAL:0000000f|EXTERNAL:0000000f|
|sig|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)|LSTATUS __stdcall RegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### ADVAPI32.DLL::RegOpenKeyExW Calling Diff


```diff
--- ADVAPI32.DLL::RegOpenKeyExW calling
+++ ADVAPI32.DLL::RegOpenKeyExW calling
@@ -1 +0,0 @@
-ATL::CRegKey::RecurseDeleteKey
@@ -22 +21 @@
-DeleteKeyRecursive_64KEY
+DeleteKeyRecursive_64KEY_Recurse
```


## MSVCRT.DLL::operator_delete[]

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|operator_delete[]|operator_delete[]|
|fullname|MSVCRT.DLL::operator_delete[]|MSVCRT.DLL::operator_delete[]|
|`refcount`|81|84|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CComPtr<struct_IHMEMediaContainer>,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_ATL::CComPtr<struct_IHMEMediaContainer>_>_>::RemoveAll<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>_>::~CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>_><br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CQueryResultsEntry*___ptr64,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_CQueryResultsEntry*___ptr64>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::~CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_><br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_ContentProviderInfo*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_ContentProviderInfo*___ptr64>_>::RemoveAll<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::Rehash<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::~CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_><br>ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::~CAtlREMatchContext<class_ATL::CAtlRECharTraitsW></summary>ATL::CAtlRegExp<class_ATL::CAtlRECharTraitsW>::Match<br>ATL::CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup>::~CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup><br>ATL::CComTypeInfoHolder::Cleanup<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddress::`scalar_deleting_destructor'<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_Search<br>CHMELibraryPathMonitor::_ClearLibraryPathFolderMonitoring<br>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CHMELibraryPathMonitor::_FolderWatchProc<br>CIPAddress::GetLocalIPAddresses<br>CIPAddressCommon::GetAdaptersAddresses<br>CMACAddress::IsValidStringMAC<br>CMDEContentServer::FreeResElements<br>CMetadataWriter::WriteMetadata<br>CQueryResultsEntry::~CQueryResultsEntry<br>CShellProvider::SortAggregateItemResultSet<br>CWMCService::Run<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::Parse<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadValue<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>IsIPAddressPermitted<br>SetHandleACLs<br>StartNetworkMonitoring<br>StopNetworkMonitoring<br>UPnPEventPublisher::Publish<br>_GetIPTable<br>_NetworkAddressChange<br>`dynamic_atexit_destructor_for_'CdsValues::s_cdsNameToAtomMap''</details>|<details><summary>Expand for full list:<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CComPtr<struct_IHMEMediaContainer>,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_ATL::CComPtr<struct_IHMEMediaContainer>_>_>::RemoveAll<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>_>::~CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>_><br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CQueryResultsEntry*___ptr64,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_CQueryResultsEntry*___ptr64>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::~CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_><br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_ContentProviderInfo*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_ContentProviderInfo*___ptr64>_>::RemoveAll<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::Rehash<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::~CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_><br>ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::~CAtlREMatchContext<class_ATL::CAtlRECharTraitsW></summary>ATL::CAtlRegExp<class_ATL::CAtlRECharTraitsW>::Match<br>ATL::CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup>::~CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup><br>ATL::CComTypeInfoHolder::Cleanup<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddress::`scalar_deleting_destructor'<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_Search<br>CHMELibraryPathMonitor::_ClearLibraryPathFolderMonitoring<br>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CHMELibraryPathMonitor::_FolderWatchProc<br>CIPAddress::GetLocalIPAddresses<br>CIPAddressCommon::GetAdaptersAddresses<br>CMACAddress::IsValidStringMAC<br>CMDEContentServer::FreeResElements<br>CMetadataWriter::WriteMetadata<br>CQueryResultsEntry::~CQueryResultsEntry<br>CShellProvider::SortAggregateItemResultSet<br>CWMCService::Run<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::Parse<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadValue<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>DeleteKeyRecursive_64KEY<br>DeleteKeyRecursive_64KEY_Recurse<br>IsIPAddressPermitted<br>SetHandleACLs<br>StartNetworkMonitoring<br>StopNetworkMonitoring<br>UPnPEventPublisher::Publish<br>_GetIPTable<br>_NetworkAddressChange<br>`dynamic_atexit_destructor_for_'CdsValues::s_cdsNameToAtomMap''</details>|
|paramcount|1|1|
|`address`|EXTERNAL:000000cc|EXTERNAL:000000c9|
|sig|void __cdecl operator_delete[](void * param_1)|void __cdecl operator_delete[](void * param_1)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### MSVCRT.DLL::operator_delete[] Calling Diff


```diff
--- MSVCRT.DLL::operator_delete[] calling
+++ MSVCRT.DLL::operator_delete[] calling
@@ -36,0 +37,2 @@
+DeleteKeyRecursive_64KEY
+DeleteKeyRecursive_64KEY_Recurse
```


## dtor$0

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|dtor$0|dtor$0|
|fullname|`CWMCService::IsWMPNSSContextCurrentlyEnabled'::__l1::dtor$0|`CWMCService::IsWMPNSSContextCurrentlyEnabled'::__l1::dtor$0|
|`refcount`|3|2|
|length|12|12|
|called|ATL::CRegKey::~CRegKey|ATL::CRegKey::~CRegKey|
|calling|||
|paramcount|2|2|
|`address`|1400a4d58|1400a5008|
|sig|undefined __fastcall dtor$0(undefined8 param_1, longlong param_2)|undefined __fastcall dtor$0(undefined8 param_1, longlong param_2)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

## WPP_SF_

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.88|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|WPP_SF_|WPP_SF_|
|fullname|WPP_SF_|WPP_SF_|
|`refcount`|648|650|
|length|36|36|
|called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage|
|`calling`|<details><summary>Expand for full list:<br>ATL::CComObject<class_CConnectionManager>::CreateInstance<br>ATL::CComObject<class_CContentDirectory>::CreateInstance<br>ATL::CComObject<class_CLibraryEventHandler>::CreateInstance<br>ATL::CComObject<class_CMediaReceiverRegistrar>::CComObject<class_CMediaReceiverRegistrar><br>ATL::CComObject<class_CMediaReceiverRegistrar>::CreateInstance<br>ATL::CComObject<class_CMediaServer>::CComObject<class_CMediaServer><br>ATL::CComObject<class_CNetworkEvents>::CComObject<class_CNetworkEvents><br>ATL::CComObject<class_CShellContentProviderEventHandler>::CreateInstance<br>ATL::CComObject<class_CShellProviderAggregateResults>::CreateInstance<br>ATL::CComObject<class_CShellProviderFactory>::CComObject<class_CShellProviderFactory><br>ATL::CComObject<class_CShellProviderResults::CWMCUPnPItem>::CComObject<class_CShellProviderResults::CWMCUPnPItem></summary>ATL::CComObject<class_CShellProviderResults>::CreateInstance<br>ATL::CComObject<class_CWMCContentProviderEventHandler>::CreateInstance<br>ATL::CComObject<class_CWMCProviders>::CreateInstance<br>AppendValueToStringList<br>AreUPnPClassesSameOrParentChild<br>Base64ToUnicode<br>BytesToBase64<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddressCache::GetAdapterAddress<br>CConnectionManager::CConnectionManager<br>CConnectionManager::OnConnectionIdsChanged<br>CConnectionManager::SetMediaServer<br>CConnectionManager::Unadvise<br>CConnectionManager::get_A_ARG_TYPE_AVTransportID<br>CConnectionManager::get_A_ARG_TYPE_ConnectionID<br>CConnectionManager::get_A_ARG_TYPE_RcsID<br>CConnectionManager::internal_GetCurrentConnectionInfo<br>CConnectionManager::internal_GetProtocolInfo<br>CConnectionManager::~CConnectionManager<br>CContentDirectory::CContentDirectory<br>CContentDirectory::OnRemoteSharingStatusChanged<br>CContentDirectory::OnSystemUpdateIDChanged<br>CContentDirectory::SetMediaServer<br>CContentDirectory::Unadvise<br>CContentDirectory::get_A_ARG_TYPE_Count<br>CContentDirectory::get_A_ARG_TYPE_Index<br>CContentDirectory::get_A_ARG_TYPE_UpdateID<br>CContentDirectory::get_SortCapabilities<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_get_ContainerUpdateIDs<br>CContentDirectory::internal_get_SearchCapabilities<br>CContentDirectory::internal_get_SystemUpdateID<br>CContentDirectory::internal_get_X_RemoteSharingEnabled<br>CContentDirectory::~CContentDirectory<br>CDeviceShim::GetCompatFlags<br>CDeviceShim::GetDeviceInfo<br>CDeviceShim::GetSearchCapabilities<br>CDevicesDB::CDevicesDB<br>CDevicesDB::CreateDevice<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs<br>CDevicesDB::GetAllIDs_Extra<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CDidlLiteObjectWriter::AreUPnPClassesSameOrParentChild<br>CDidlLiteObjectWriter::CdsElement::CdsElement<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CDidlLiteObjectWriter::OnErrorResetResponse<br>CDidlLiteObjectWriter::WriteObject<br>CDidlLiteObjectWriter::~CDidlLiteObjectWriter<br>CDlnaContentFeaturesWriter::CDlnaContentFeaturesWriter<br>CEventLog::ReportEventW<br>CEventsDB::Close<br>CEventsDB::Create<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CEventsDB::~CEventsDB<br>CIPAddress::GetLocalIPAddresses<br>CLibraryEventHandler::Shutdown<br>CLibraryEventHandler::~CLibraryEventHandler<br>CMACAddress::IsValidStringMAC<br>CMACAddressControl::CMACAddressControl<br>CMACAddressControl::Execute<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterMAC<br>CMACAddressControl::GetRecentDeviceIDs<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::Init<br>CMACAddressControl::IsAllowed<br>CMACAddressControl::NotifyNewDeviceAuthorizationDenied<br>CMACAddressControl::NotifyNewDeviceAuthorizationGranted<br>CMACAddressControl::ShouldAllowAccess<br>CMACAddressControl::Shutdown<br>CMACAddressControl::`scalar_deleting_destructor'<br>CMDEContentServer::AddDLNAProtocolInfoForGetProtocolInfo<br>CMDEContentServer::CMDEContentServer<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::GetConnectionInfo<br>CMDEContentServer::GetProtocolInfo<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::~CMDEContentServer<br>CMDEProfileCollection::~CMDEProfileCollection<br>CMediaReceiverRegistrar::SetMediaServer<br>CMediaReceiverRegistrar::Unadvise<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationReqMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationRespMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_Result<br>CMediaReceiverRegistrar::get_AuthorizationDeniedUpdateID<br>CMediaReceiverRegistrar::get_AuthorizationGrantedUpdateID<br>CMediaReceiverRegistrar::get_ValidationRevokedUpdateID<br>CMediaReceiverRegistrar::get_ValidationSucceededUpdateID<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::~CMediaReceiverRegistrar<br>CMediaServer::FilterEndpoint<br>CMediaServer::FilterEndpoint<br>CMediaServer::FilterEndpoint<br>CMediaServer::FinalConstruct<br>CMediaServer::GetServiceObject<br>CMediaServer::GetWMCContentProvider<br>CMediaServer::NewDeviceAuthorizationDenied<br>CMediaServer::NewDeviceAuthorizationGranted<br>CMediaServer::NewDeviceValidationRevoked<br>CMediaServer::NewDeviceValidationSucceeded<br>CMediaServer::OnWinSATChanged<br>CMediaServer::ShutdownServer<br>CMediaServer::UpnpClientConnected<br>CMediaServer::UpnpClientDisconnected<br>CMediaServer::~CMediaServer<br>CNTService::CNTService<br>CNTService::DecrementContentRequestsOutstanding<br>CNTService::DecrementContentRequestsOutstandingAtTime<br>CNTService::HandlerEx<br>CNTService::IncrementContentRequestsOutstanding<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::LogEvent<br>CNTService::OnContinue<br>CNTService::OnDeviceEvent<br>CNTService::OnInit<br>CNTService::OnInterrogate<br>CNTService::OnPause<br>CNTService::OnResume<br>CNTService::OnSessionLogoff<br>CNTService::OnShutdown<br>CNTService::OnStop<br>CNTService::OnSuspend<br>CNTService::OnUninit<br>CNTService::RegisterForPowerNotifications<br>CNTService::Run<br>CNTService::ServiceMain<br>CNTService::SetStatus<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CNTService::UpdatePowerManagementSettings<br>CNTService::WaitForServiceExit<br>CNTService::~CNTService<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::GetListOfDisconnectedNetworks<br>CNetworkEvents::NcCoSetProxyBlanket<br>CNetworkEvents::RegisterProfileEvent<br>CNetworkEvents::Shutdown<br>CNetworkEvents::~CNetworkEvents<br>CNetworkInterfaces::Initialize<br>CRendererDevicesDB::CRendererDevicesDB<br>CRendererDevicesDB::IsValidID<br>CServiceControl::CServiceControl<br>CServiceControl::CloseServiceManager<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::Start<br>CServiceControl::~CServiceControl<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellContentProviderEventHandler::Shutdown<br>CShellContentProviderEventHandler::~CShellContentProviderEventHandler<br>CShellProvider::CShellProvider<br>CShellProvider::InitializeStaticVariables<br>CShellProvider::OnCDSChanged<br>CShellProvider::OnRemoteSharingStatusChanged<br>CShellProvider::UpdateExternalParams<br>CShellProvider::~CShellProvider<br>CShellProviderAggregateResults::~CShellProviderAggregateResults<br>CShellProviderFactory::Unadvise<br>CShellProviderFactory::~CShellProviderFactory<br>CShellProviderResults::CWMCUPnPContainer::GetSearchClassElementValues<br>CShellProviderResults::CWMCUPnPItem::GetDescElementValues<br>CShellProviderResults::CWMCUPnPItem::~CWMCUPnPItem<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellProviderResults::PopulateSortMappingArray<br>CShellProviderResults::~CShellProviderResults<br>CShellQuery::_NotifyIndexingItems<br>CShellQuery::_WaitForItems<br>CWMCContentProviderEventHandler::~CWMCContentProviderEventHandler<br>CWMCProviders::~CWMCProviders<br>CWMCService::AnySessions<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CWMCService<br>CWMCService::CreateAndRegisterServer<br>CWMCService::CreateContentProviderFactories<br>CWMCService::CreateMediaDevices<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DestroyMediaDevices<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::GetPrivateMFWorkQueue<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::NotifyShellLibraryDefinitionChanged<br>CWMCService::OnContentProviderRemoved<br>CWMCService::OnDeviceEvent<br>CWMCService::OnInit<br>CWMCService::OnResume<br>CWMCService::OnSessionLogoff<br>CWMCService::OnSuspend<br>CWMCService::OnUninit<br>CWMCService::OnUserControl<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CWMCService::Shutdown<br>CWMCService::Uninstall<br>CWMCService::UpdateSharingStatus<br>CWMCService::~CWMCService<br>CdsAndQuery::CdsAndQuery<br>CdsAndQuery::~CdsAndQuery<br>CdsBinaryOpQuery::CdsBinaryOpQuery<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::InitializeStaticVariables<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsBinaryOpQuery::~CdsBinaryOpQuery<br>CdsCompoundQuery::ChildQueryCount<br>CdsCompoundQuery::Initialize<br>CdsCompoundQuery::SetArray<br>CdsExistsQuery::CdsExistsQuery<br>CdsExistsQuery::Initialize<br>CdsExistsQuery::Set<br>CdsExistsQuery::~CdsExistsQuery<br>CdsFilter::CdsFilter<br>CdsFilter::CdsFilter<br>CdsFilter::Clear<br>CdsFilter::InitializeStaticVariables<br>CdsFilter::Parse<br>CdsFilter::SelectMandatoryAttributes<br>CdsItemInfoBase::GetCodecInfo<br>CdsItemInfoBase::GetImageResolution<br>CdsItemInfoBase::GetMIMETypeAndProfileIDs<br>CdsItemInfoBase::GetWMCAlbumArtURIData<br>CdsItemInfoBase::GetWMCResElementData<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::CdsObjectWriter<br>CdsObjectWriter::~CdsObjectWriter<br>CdsOrQuery::CdsOrQuery<br>CdsOrQuery::~CdsOrQuery<br>CdsParseLevel::CdsParseLevel<br>CdsParseLevel::Reset<br>CdsParseLevel::StartNewProduct<br>CdsParseLevel::get_CurrentProduct<br>CdsParseLevel::~CdsParseLevel<br>CdsParseProduct::CdsParseProduct<br>CdsParseProduct::CdsParseProduct<br>CdsParseProduct::CreateCompositeQuery<br>CdsParseProduct::~CdsParseProduct<br>CdsQuery::CdsQuery<br>CdsQuery::Initialize<br>CdsQuery::~CdsQuery<br>CdsQueryParser::CdsQueryParser<br>CdsQueryParser::InitializeStaticVariables<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::PopParseLevel<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadNextToken<br>CdsQueryParser::ReadQuotedValue<br>CdsQueryParser::ReadValue<br>CdsSortEntry::InitializeStaticVariables<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>CdsSortEntry::~CdsSortEntry<br>CdsStarQuery::CdsStarQuery<br>CdsStarQuery::~CdsStarQuery<br>CdsUpdatePropertyCollection::CreateInstance<br>CdsUpdatePropertyCollection::~CdsUpdatePropertyCollection<br>CdsValues::CdsValuesCreateRelationships<br>CdsValues::CdsValuesInitializeHashTable<br>CdsValues::TransformAtomName<br>CdsValues::XMLUnescape<br>ContentDirectoryErrors::SetCDErrorInfo<br>ConvertStringToUINT32<br>ConvertStringToUINT64<br>CreateMediaServer<br>CreateUUID<br>DLNACommon::IsWakeOnLANEnabled<br>EnumSubKeys<br>GenerateStringFromResourceData<br>GetBSTRHelper<br>GetInscribedRectangle<br>GetModulePath<br>GetSearchClassesForContainerID<br>InitializeNetworkMonitoring<br>InitializeService<br>InterfaceChangeNotification<br>IsHMEAllowedByGroupPolicy<br>IsIPAddressPermitted<br>IsNetworkService<br>IsWMC<br>IsWindowsSetupComplete<br>ParseAspectRatio<br>ParseDimension<br>ParseNameValuePair<br>ParseUrl<br>ReserveHTTPPrefix<br>SafeGetModuleFileName<br>SetHandleACLs<br>StartNetworkMonitoring<br>StopNetworkMonitoring<br>StopService<br>WaitForDeletion<br>WaitForStop<br>WriteResults2<br>_NetworkAddressChange<br>wWinMain</details>|<details><summary>Expand for full list:<br>ATL::CComObject<class_CConnectionManager>::CreateInstance<br>ATL::CComObject<class_CContentDirectory>::CreateInstance<br>ATL::CComObject<class_CLibraryEventHandler>::CreateInstance<br>ATL::CComObject<class_CMediaReceiverRegistrar>::CComObject<class_CMediaReceiverRegistrar><br>ATL::CComObject<class_CMediaReceiverRegistrar>::CreateInstance<br>ATL::CComObject<class_CMediaServer>::CComObject<class_CMediaServer><br>ATL::CComObject<class_CNetworkEvents>::CComObject<class_CNetworkEvents><br>ATL::CComObject<class_CShellContentProviderEventHandler>::CreateInstance<br>ATL::CComObject<class_CShellProviderAggregateResults>::CreateInstance<br>ATL::CComObject<class_CShellProviderFactory>::CComObject<class_CShellProviderFactory><br>ATL::CComObject<class_CShellProviderResults::CWMCUPnPItem>::CComObject<class_CShellProviderResults::CWMCUPnPItem></summary>ATL::CComObject<class_CShellProviderResults>::CreateInstance<br>ATL::CComObject<class_CWMCContentProviderEventHandler>::CreateInstance<br>ATL::CComObject<class_CWMCProviders>::CreateInstance<br>AppendValueToStringList<br>AreUPnPClassesSameOrParentChild<br>Base64ToUnicode<br>BytesToBase64<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddressCache::GetAdapterAddress<br>CConnectionManager::CConnectionManager<br>CConnectionManager::OnConnectionIdsChanged<br>CConnectionManager::SetMediaServer<br>CConnectionManager::Unadvise<br>CConnectionManager::get_A_ARG_TYPE_AVTransportID<br>CConnectionManager::get_A_ARG_TYPE_ConnectionID<br>CConnectionManager::get_A_ARG_TYPE_RcsID<br>CConnectionManager::internal_GetCurrentConnectionInfo<br>CConnectionManager::internal_GetProtocolInfo<br>CConnectionManager::~CConnectionManager<br>CContentDirectory::CContentDirectory<br>CContentDirectory::OnRemoteSharingStatusChanged<br>CContentDirectory::OnSystemUpdateIDChanged<br>CContentDirectory::SetMediaServer<br>CContentDirectory::Unadvise<br>CContentDirectory::get_A_ARG_TYPE_Count<br>CContentDirectory::get_A_ARG_TYPE_Index<br>CContentDirectory::get_A_ARG_TYPE_UpdateID<br>CContentDirectory::get_SortCapabilities<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_get_ContainerUpdateIDs<br>CContentDirectory::internal_get_SearchCapabilities<br>CContentDirectory::internal_get_SystemUpdateID<br>CContentDirectory::internal_get_X_RemoteSharingEnabled<br>CContentDirectory::~CContentDirectory<br>CDeviceShim::GetCompatFlags<br>CDeviceShim::GetDeviceInfo<br>CDeviceShim::GetSearchCapabilities<br>CDevicesDB::CDevicesDB<br>CDevicesDB::CreateDevice<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs<br>CDevicesDB::GetAllIDs_Extra<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CDidlLiteObjectWriter::AreUPnPClassesSameOrParentChild<br>CDidlLiteObjectWriter::CdsElement::CdsElement<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CDidlLiteObjectWriter::OnErrorResetResponse<br>CDidlLiteObjectWriter::WriteObject<br>CDidlLiteObjectWriter::~CDidlLiteObjectWriter<br>CDlnaContentFeaturesWriter::CDlnaContentFeaturesWriter<br>CEventLog::ReportEventW<br>CEventsDB::Close<br>CEventsDB::Create<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CEventsDB::~CEventsDB<br>CIPAddress::GetLocalIPAddresses<br>CLibraryEventHandler::Shutdown<br>CLibraryEventHandler::~CLibraryEventHandler<br>CMACAddress::IsValidStringMAC<br>CMACAddressControl::CMACAddressControl<br>CMACAddressControl::Execute<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterMAC<br>CMACAddressControl::GetRecentDeviceIDs<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::Init<br>CMACAddressControl::IsAllowed<br>CMACAddressControl::NotifyNewDeviceAuthorizationDenied<br>CMACAddressControl::NotifyNewDeviceAuthorizationGranted<br>CMACAddressControl::ShouldAllowAccess<br>CMACAddressControl::Shutdown<br>CMACAddressControl::`scalar_deleting_destructor'<br>CMDEContentServer::AddDLNAProtocolInfoForGetProtocolInfo<br>CMDEContentServer::CMDEContentServer<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::GetConnectionInfo<br>CMDEContentServer::GetProtocolInfo<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::~CMDEContentServer<br>CMDEProfileCollection::~CMDEProfileCollection<br>CMediaReceiverRegistrar::SetMediaServer<br>CMediaReceiverRegistrar::Unadvise<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationReqMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_RegistrationRespMsg<br>CMediaReceiverRegistrar::get_A_ARG_TYPE_Result<br>CMediaReceiverRegistrar::get_AuthorizationDeniedUpdateID<br>CMediaReceiverRegistrar::get_AuthorizationGrantedUpdateID<br>CMediaReceiverRegistrar::get_ValidationRevokedUpdateID<br>CMediaReceiverRegistrar::get_ValidationSucceededUpdateID<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::~CMediaReceiverRegistrar<br>CMediaServer::FilterEndpoint<br>CMediaServer::FilterEndpoint<br>CMediaServer::FilterEndpoint<br>CMediaServer::FinalConstruct<br>CMediaServer::GetServiceObject<br>CMediaServer::GetWMCContentProvider<br>CMediaServer::NewDeviceAuthorizationDenied<br>CMediaServer::NewDeviceAuthorizationGranted<br>CMediaServer::NewDeviceValidationRevoked<br>CMediaServer::NewDeviceValidationSucceeded<br>CMediaServer::OnWinSATChanged<br>CMediaServer::ShutdownServer<br>CMediaServer::UpnpClientConnected<br>CMediaServer::UpnpClientDisconnected<br>CMediaServer::~CMediaServer<br>CNTService::CNTService<br>CNTService::DecrementContentRequestsOutstanding<br>CNTService::DecrementContentRequestsOutstandingAtTime<br>CNTService::HandlerEx<br>CNTService::IncrementContentRequestsOutstanding<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::LogEvent<br>CNTService::OnContinue<br>CNTService::OnDeviceEvent<br>CNTService::OnInit<br>CNTService::OnInterrogate<br>CNTService::OnPause<br>CNTService::OnResume<br>CNTService::OnSessionLogoff<br>CNTService::OnShutdown<br>CNTService::OnStop<br>CNTService::OnSuspend<br>CNTService::OnUninit<br>CNTService::RegisterForPowerNotifications<br>CNTService::Run<br>CNTService::ServiceMain<br>CNTService::SetStatus<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CNTService::UpdatePowerManagementSettings<br>CNTService::WaitForServiceExit<br>CNTService::~CNTService<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::GetListOfDisconnectedNetworks<br>CNetworkEvents::NcCoSetProxyBlanket<br>CNetworkEvents::RegisterProfileEvent<br>CNetworkEvents::Shutdown<br>CNetworkEvents::~CNetworkEvents<br>CNetworkInterfaces::Initialize<br>CRendererDevicesDB::CRendererDevicesDB<br>CRendererDevicesDB::IsValidID<br>CServiceControl::CServiceControl<br>CServiceControl::CloseServiceManager<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::Start<br>CServiceControl::~CServiceControl<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellContentProviderEventHandler::Shutdown<br>CShellContentProviderEventHandler::~CShellContentProviderEventHandler<br>CShellProvider::CShellProvider<br>CShellProvider::InitializeStaticVariables<br>CShellProvider::OnCDSChanged<br>CShellProvider::OnRemoteSharingStatusChanged<br>CShellProvider::UpdateExternalParams<br>CShellProvider::~CShellProvider<br>CShellProviderAggregateResults::~CShellProviderAggregateResults<br>CShellProviderFactory::Unadvise<br>CShellProviderFactory::~CShellProviderFactory<br>CShellProviderResults::CWMCUPnPContainer::GetSearchClassElementValues<br>CShellProviderResults::CWMCUPnPItem::GetDescElementValues<br>CShellProviderResults::CWMCUPnPItem::~CWMCUPnPItem<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellProviderResults::PopulateSortMappingArray<br>CShellProviderResults::~CShellProviderResults<br>CShellQuery::_NotifyIndexingItems<br>CShellQuery::_WaitForItems<br>CWMCContentProviderEventHandler::~CWMCContentProviderEventHandler<br>CWMCProviders::~CWMCProviders<br>CWMCService::AnySessions<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CWMCService<br>CWMCService::CreateAndRegisterServer<br>CWMCService::CreateContentProviderFactories<br>CWMCService::CreateMediaDevices<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DestroyMediaDevices<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::GetPrivateMFWorkQueue<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::NotifyShellLibraryDefinitionChanged<br>CWMCService::OnContentProviderRemoved<br>CWMCService::OnDeviceEvent<br>CWMCService::OnInit<br>CWMCService::OnResume<br>CWMCService::OnSessionLogoff<br>CWMCService::OnSuspend<br>CWMCService::OnUninit<br>CWMCService::OnUserControl<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CWMCService::Shutdown<br>CWMCService::Uninstall<br>CWMCService::UpdateSharingStatus<br>CWMCService::~CWMCService<br>CdsAndQuery::CdsAndQuery<br>CdsAndQuery::~CdsAndQuery<br>CdsBinaryOpQuery::CdsBinaryOpQuery<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::InitializeStaticVariables<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsBinaryOpQuery::~CdsBinaryOpQuery<br>CdsCompoundQuery::ChildQueryCount<br>CdsCompoundQuery::Initialize<br>CdsCompoundQuery::SetArray<br>CdsExistsQuery::CdsExistsQuery<br>CdsExistsQuery::Initialize<br>CdsExistsQuery::Set<br>CdsExistsQuery::~CdsExistsQuery<br>CdsFilter::CdsFilter<br>CdsFilter::CdsFilter<br>CdsFilter::Clear<br>CdsFilter::InitializeStaticVariables<br>CdsFilter::Parse<br>CdsFilter::SelectMandatoryAttributes<br>CdsItemInfoBase::GetCodecInfo<br>CdsItemInfoBase::GetImageResolution<br>CdsItemInfoBase::GetMIMETypeAndProfileIDs<br>CdsItemInfoBase::GetWMCAlbumArtURIData<br>CdsItemInfoBase::GetWMCResElementData<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::CdsObjectWriter<br>CdsObjectWriter::~CdsObjectWriter<br>CdsOrQuery::CdsOrQuery<br>CdsOrQuery::~CdsOrQuery<br>CdsParseLevel::CdsParseLevel<br>CdsParseLevel::Reset<br>CdsParseLevel::StartNewProduct<br>CdsParseLevel::get_CurrentProduct<br>CdsParseLevel::~CdsParseLevel<br>CdsParseProduct::CdsParseProduct<br>CdsParseProduct::CdsParseProduct<br>CdsParseProduct::CreateCompositeQuery<br>CdsParseProduct::~CdsParseProduct<br>CdsQuery::CdsQuery<br>CdsQuery::Initialize<br>CdsQuery::~CdsQuery<br>CdsQueryParser::CdsQueryParser<br>CdsQueryParser::InitializeStaticVariables<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::PopParseLevel<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadNextToken<br>CdsQueryParser::ReadQuotedValue<br>CdsQueryParser::ReadValue<br>CdsSortEntry::InitializeStaticVariables<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>CdsSortEntry::~CdsSortEntry<br>CdsStarQuery::CdsStarQuery<br>CdsStarQuery::~CdsStarQuery<br>CdsUpdatePropertyCollection::CreateInstance<br>CdsUpdatePropertyCollection::~CdsUpdatePropertyCollection<br>CdsValues::CdsValuesCreateRelationships<br>CdsValues::CdsValuesInitializeHashTable<br>CdsValues::TransformAtomName<br>CdsValues::XMLUnescape<br>ContentDirectoryErrors::SetCDErrorInfo<br>ConvertStringToUINT32<br>ConvertStringToUINT64<br>CreateMediaServer<br>CreateUUID<br>DLNACommon::IsWakeOnLANEnabled<br>DeleteKeyRecursive_64KEY_Recurse<br>EnumSubKeys<br>GenerateStringFromResourceData<br>GetBSTRHelper<br>GetInscribedRectangle<br>GetModulePath<br>GetSearchClassesForContainerID<br>InitializeNetworkMonitoring<br>InitializeService<br>InterfaceChangeNotification<br>IsHMEAllowedByGroupPolicy<br>IsIPAddressPermitted<br>IsNetworkService<br>IsWMC<br>IsWindowsSetupComplete<br>ParseAspectRatio<br>ParseDimension<br>ParseNameValuePair<br>ParseUrl<br>ReserveHTTPPrefix<br>SafeGetModuleFileName<br>SetHandleACLs<br>StartNetworkMonitoring<br>StopNetworkMonitoring<br>StopService<br>WaitForDeletion<br>WaitForStop<br>WriteResults2<br>_NetworkAddressChange<br>wWinMain</details>|
|paramcount|3|3|
|address|1400034f0|1400034f0|
|sig|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|undefined __fastcall WPP_SF_(undefined8 param_1, undefined2 param_2, undefined8 param_3)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_ Calling Diff


```diff
--- WPP_SF_ calling
+++ WPP_SF_ calling
@@ -297,0 +298 @@
+DeleteKeyRecursive_64KEY_Recurse
```


## operator_new[]

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,address,calling|
|ratio|1.0|
|i_ratio|0.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|operator_new[]|operator_new[]|
|fullname|operator_new[]|operator_new[]|
|`refcount`|22|25|
|length|5|5|
|called|||
|`calling`|<details><summary>Expand for full list:<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CQueryResultsEntry*___ptr64,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_CQueryResultsEntry*___ptr64>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::Rehash<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::Rehash<br>ATL::CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup>::Allocate<br>ATL::CAutoVectorPtr<void*___ptr64>::Allocate<br>ATL::CComTypeInfoHolder::LoadNameCache<br>CContentDirectory::SetupBrowseSearch<br>CContentDirectory::internal_Browse<br>CHMELibraryPathMonitor::_BuildHandleList</summary>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CIPAddressCommon::GetAdaptersAddresses<br>CMDEContentServer::GetAlbumArtElements<br>CMDEContentServer::GetResElements<br>CMetadataWriter::BuildFilterList<br>CQueryResultsCache::GetQueryResults<br>CShellProvider::SortAggregateItemResultSet<br>CWMCService::Run<br>SetHandleACLs<br>UPnPEventPublisher::Publish<br>_GetIPTable</details>|<details><summary>Expand for full list:<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CQueryResultsEntry*___ptr64,class_ATL::CElementTraits<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>_>,class_ATL::CElementTraits<class_CQueryResultsEntry*___ptr64>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::InitHashTable<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,enum_CdsValue::Value,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<enum_CdsValue::Value>_>::Rehash<br>ATL::CAtlMap<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64,class_CLocaleStringElementTraitsI<class_ATL::CStringT<unsigned_short,class_ATL::StrTraitATL<unsigned_short,class_ATL::ChTraitsOS<unsigned_short>_>_>,class_CLocaleCharTraits<unsigned_short>_>,class_ATL::CElementTraits<struct_CMACAddressControl::_DRM_DEVICE_CACHE_INFO*___ptr64>_>::Rehash<br>ATL::CAtlMap<struct__GUID,bool,class_ATL::CElementTraits<struct__GUID>,class_ATL::CElementTraits<bool>_>::Rehash<br>ATL::CAutoVectorPtr<struct_ATL::CAtlREMatchContext<class_ATL::CAtlRECharTraitsW>::MatchGroup>::Allocate<br>ATL::CAutoVectorPtr<void*___ptr64>::Allocate<br>ATL::CComTypeInfoHolder::LoadNameCache<br>CContentDirectory::SetupBrowseSearch<br>CContentDirectory::internal_Browse<br>CHMELibraryPathMonitor::_BuildHandleList</summary>CHMELibraryPathMonitor::_CreateMonitorHandlesForLibrary<br>CIPAddressCommon::GetAdaptersAddresses<br>CMDEContentServer::GetAlbumArtElements<br>CMDEContentServer::GetResElements<br>CMetadataWriter::BuildFilterList<br>CQueryResultsCache::GetQueryResults<br>CShellProvider::SortAggregateItemResultSet<br>CWMCService::Run<br>DeleteKeyRecursive_64KEY<br>DeleteKeyRecursive_64KEY_Recurse<br>SetHandleACLs<br>UPnPEventPublisher::Publish<br>_GetIPTable</details>|
|paramcount|1|1|
|`address`|1400a2adc|1400a2d8c|
|sig|void * __cdecl operator_new[](__uint64 param_1)|void * __cdecl operator_new[](__uint64 param_1)|
|sym_type|Function|Function|
|sym_source|ANALYSIS|ANALYSIS|
|external|False|False|

### operator_new[] Calling Diff


```diff
--- operator_new[] calling
+++ operator_new[] calling
@@ -19,0 +20,2 @@
+DeleteKeyRecursive_64KEY
+DeleteKeyRecursive_64KEY_Recurse
```


## ADVAPI32.DLL::TraceMessage

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|1.0|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash,ExternalsName|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|TraceMessage|TraceMessage|
|fullname|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage|
|`refcount`|181|182|
|length|0|0|
|called|||
|`calling`|<details><summary>Expand for full list:<br>WPP_SF_<br>WPP_SF_DDDD<br>WPP_SF_DDS<br>WPP_SF_DDSd<br>WPP_SF_DDd<br>WPP_SF_DDl<br>WPP_SF_DLSSS<br>WPP_SF_DS<br>WPP_SF_DSl<br>WPP_SF_DSq<br>WPP_SF_DdD</summary>WPP_SF_DdDSd<br>WPP_SF_DdSSS<br>WPP_SF_DqS<br>WPP_SF_Dqq<br>WPP_SF_DqqD<br>WPP_SF_I<br>WPP_SF_IDDdqq<br>WPP_SF_II<br>WPP_SF_Iq<br>WPP_SF_L<br>WPP_SF_LD<br>WPP_SF_LL<br>WPP_SF_LLqq<br>WPP_SF_Ld<br>WPP_SF_Lq<br>WPP_SF_S<br>WPP_SF_SDD<br>WPP_SF_SDDD<br>WPP_SF_SDDDqS<br>WPP_SF_SDDd<br>WPP_SF_SDq<br>WPP_SF_SDqLLSqq<br>WPP_SF_SDqd<br>WPP_SF_SL<br>WPP_SF_SLDDDDd<br>WPP_SF_SLqDqDDDSqqq<br>WPP_SF_SS<br>WPP_SF_SSD<br>WPP_SF_SSLL<br>WPP_SF_SSS<br>WPP_SF_SSSLLS<br>WPP_SF_SSSSSdq<br>WPP_SF_SSSd<br>WPP_SF_SSSq<br>WPP_SF_SSh<br>WPP_SF_SShl<br>WPP_SF_SSl<br>WPP_SF_SSq<br>WPP_SF_SSqDqDDDSqqq<br>WPP_SF_SSqSSq<br>WPP_SF_SSqq<br>WPP_SF_Sd<br>WPP_SF_SdD<br>WPP_SF_SdDq<br>WPP_SF_SdS<br>WPP_SF_SdSDq<br>WPP_SF_SdSdd<br>WPP_SF_Sdh<br>WPP_SF_Sdq<br>WPP_SF_SlD<br>WPP_SF_SlDDDqS<br>WPP_SF_Sld<br>WPP_SF_SldSSS<br>WPP_SF_Sq<br>WPP_SF_SqDSq<br>WPP_SF_Sqq<br>WPP_SF_Ss<br>WPP_SF__IPV6_<br>WPP_SF__MAC_DD<br>WPP_SF__guid_<br>WPP_SF__guid_D<br>WPP_SF__guid_Ddd<br>WPP_SF__guid_Dddd<br>WPP_SF__guid__guid_<br>WPP_SF__guid_qq<br>WPP_SF_dDD<br>WPP_SF_dDDDS<br>WPP_SF_dDDS<br>WPP_SF_dDDq<br>WPP_SF_dDS<br>WPP_SF_dDq<br>WPP_SF_dI<br>WPP_SF_dIqq<br>WPP_SF_dLLS<br>WPP_SF_dLS<br>WPP_SF_dSD<br>WPP_SF_dSS<br>WPP_SF_dSSS<br>WPP_SF_dSSSS<br>WPP_SF_dSSd<br>WPP_SF_dSSq<br>WPP_SF_dS_guid_<br>WPP_SF_dSd<br>WPP_SF_dSq<br>WPP_SF_d_MAC_<br>WPP_SF_d_guid_<br>WPP_SF_d_guid_Ddd<br>WPP_SF_d_guid_q<br>WPP_SF_dc<br>WPP_SF_ddS<br>WPP_SF_dddS<br>WPP_SF_dddSSdSS<br>WPP_SF_dddd<br>WPP_SF_dddddd<br>WPP_SF_ddddddg<br>WPP_SF_dddqq<br>WPP_SF_ddh<br>WPP_SF_ddl<br>WPP_SF_dh<br>WPP_SF_di<br>WPP_SF_dl<br>WPP_SF_dlS<br>WPP_SF_dqD<br>WPP_SF_dqDDDqS<br>WPP_SF_dqIq<br>WPP_SF_dqS<br>WPP_SF_dqSS<br>WPP_SF_dqSSd<br>WPP_SF_dqSSddd<br>WPP_SF_dqdS<br>WPP_SF_dqq<br>WPP_SF_dqqD<br>WPP_SF_dqqq<br>WPP_SF_ds<br>WPP_SF_h<br>WPP_SF_iLL<br>WPP_SF_lS<br>WPP_SF_lc<br>WPP_SF_ld<br>WPP_SF_lh<br>WPP_SF_ll<br>WPP_SF_qDDDqS<br>WPP_SF_qDDq<br>WPP_SF_qDLD<br>WPP_SF_qDS<br>WPP_SF_qI<br>WPP_SF_qIqq<br>WPP_SF_qS<br>WPP_SF_qSD<br>WPP_SF_qSDD<br>WPP_SF_qSDLD<br>WPP_SF_qSS<br>WPP_SF_qSSS<br>WPP_SF_qSSSD<br>WPP_SF_qSSSDDqqqDq<br>WPP_SF_qSSSLLSqqqq<br>WPP_SF_qSSSSSSSdqI<br>WPP_SF_qSSSSSqq<br>WPP_SF_qSSddd<br>WPP_SF_qSq<br>WPP_SF_qdd<br>WPP_SF_qdqd<br>WPP_SF_qi<br>WPP_SF_ql<br>WPP_SF_qlDDDqS<br>WPP_SF_qll<br>WPP_SF_qlll<br>WPP_SF_qlq<br>WPP_SF_qlqll<br>WPP_SF_qlqqqqqqq<br>WPP_SF_qqD<br>WPP_SF_qqDD<br>WPP_SF_qqIqDdqqq<br>WPP_SF_qqSSSSDDDDSq<br>WPP_SF_qqSSSSSq<br>WPP_SF_qqSd<br>WPP_SF_qqSqq<br>WPP_SF_qql<br>WPP_SF_qqllq<br>WPP_SF_qqq<br>WPP_SF_qqqD<br>WPP_SF_qqqLL<br>WPP_SF_qqqSSSSq<br>WPP_SF_qqqq<br>WPP_SF_qs<br>WPP_SF_s<br>WPP_SF_sDq<br>WPP_SF_sS<br>WPP_SF_ss</details>|<details><summary>Expand for full list:<br>WPP_SF_<br>WPP_SF_DDDD<br>WPP_SF_DDS<br>WPP_SF_DDSd<br>WPP_SF_DDd<br>WPP_SF_DDl<br>WPP_SF_DLSSS<br>WPP_SF_DS<br>WPP_SF_DSl<br>WPP_SF_DSq<br>WPP_SF_DdD</summary>WPP_SF_DdDSd<br>WPP_SF_DdSSS<br>WPP_SF_DqS<br>WPP_SF_Dqq<br>WPP_SF_DqqD<br>WPP_SF_I<br>WPP_SF_IDDdqq<br>WPP_SF_II<br>WPP_SF_Iq<br>WPP_SF_L<br>WPP_SF_LD<br>WPP_SF_LL<br>WPP_SF_LLqq<br>WPP_SF_Ld<br>WPP_SF_Lq<br>WPP_SF_S<br>WPP_SF_SDD<br>WPP_SF_SDDD<br>WPP_SF_SDDDqS<br>WPP_SF_SDDd<br>WPP_SF_SDq<br>WPP_SF_SDqLLSqq<br>WPP_SF_SDqd<br>WPP_SF_SL<br>WPP_SF_SLDDDDd<br>WPP_SF_SLqDqDDDSqqq<br>WPP_SF_SS<br>WPP_SF_SSD<br>WPP_SF_SSLL<br>WPP_SF_SSS<br>WPP_SF_SSSLLS<br>WPP_SF_SSSSSdq<br>WPP_SF_SSSd<br>WPP_SF_SSSq<br>WPP_SF_SSh<br>WPP_SF_SShl<br>WPP_SF_SSl<br>WPP_SF_SSq<br>WPP_SF_SSqDqDDDSqqq<br>WPP_SF_SSqSSq<br>WPP_SF_SSqq<br>WPP_SF_Sd<br>WPP_SF_SdD<br>WPP_SF_SdDq<br>WPP_SF_SdS<br>WPP_SF_SdSDq<br>WPP_SF_SdSdd<br>WPP_SF_Sdh<br>WPP_SF_Sdq<br>WPP_SF_SlD<br>WPP_SF_SlDDDqS<br>WPP_SF_Sld<br>WPP_SF_SldSSS<br>WPP_SF_Sq<br>WPP_SF_SqDSq<br>WPP_SF_Sqq<br>WPP_SF_Ss<br>WPP_SF__IPV6_<br>WPP_SF__MAC_DD<br>WPP_SF__guid_<br>WPP_SF__guid_D<br>WPP_SF__guid_Ddd<br>WPP_SF__guid_Dddd<br>WPP_SF__guid__guid_<br>WPP_SF__guid_qq<br>WPP_SF_dDD<br>WPP_SF_dDDDS<br>WPP_SF_dDDS<br>WPP_SF_dDDq<br>WPP_SF_dDS<br>WPP_SF_dDq<br>WPP_SF_dI<br>WPP_SF_dIqq<br>WPP_SF_dLLS<br>WPP_SF_dLS<br>WPP_SF_dSD<br>WPP_SF_dSS<br>WPP_SF_dSSS<br>WPP_SF_dSSSS<br>WPP_SF_dSSd<br>WPP_SF_dSSq<br>WPP_SF_dS_guid_<br>WPP_SF_dSd<br>WPP_SF_dSq<br>WPP_SF_d_MAC_<br>WPP_SF_d_guid_<br>WPP_SF_d_guid_Ddd<br>WPP_SF_d_guid_q<br>WPP_SF_dc<br>WPP_SF_ddS<br>WPP_SF_dddS<br>WPP_SF_dddSSdSS<br>WPP_SF_dddd<br>WPP_SF_dddddd<br>WPP_SF_ddddddg<br>WPP_SF_dddqq<br>WPP_SF_ddh<br>WPP_SF_ddl<br>WPP_SF_dh<br>WPP_SF_di<br>WPP_SF_dl<br>WPP_SF_dlS<br>WPP_SF_dqD<br>WPP_SF_dqDDDqS<br>WPP_SF_dqIq<br>WPP_SF_dqS<br>WPP_SF_dqSS<br>WPP_SF_dqSSd<br>WPP_SF_dqSSddd<br>WPP_SF_dqdS<br>WPP_SF_dqq<br>WPP_SF_dqqD<br>WPP_SF_dqqq<br>WPP_SF_ds<br>WPP_SF_h<br>WPP_SF_iLL<br>WPP_SF_lS<br>WPP_SF_lc<br>WPP_SF_ld<br>WPP_SF_lh<br>WPP_SF_ll<br>WPP_SF_qDDDqS<br>WPP_SF_qDDq<br>WPP_SF_qDLD<br>WPP_SF_qDS<br>WPP_SF_qI<br>WPP_SF_qIqq<br>WPP_SF_qS<br>WPP_SF_qSD<br>WPP_SF_qSDD<br>WPP_SF_qSDLD<br>WPP_SF_qSDdd<br>WPP_SF_qSS<br>WPP_SF_qSSS<br>WPP_SF_qSSSD<br>WPP_SF_qSSSDDqqqDq<br>WPP_SF_qSSSLLSqqqq<br>WPP_SF_qSSSSSSSdqI<br>WPP_SF_qSSSSSqq<br>WPP_SF_qSSddd<br>WPP_SF_qSq<br>WPP_SF_qdd<br>WPP_SF_qdqd<br>WPP_SF_qi<br>WPP_SF_ql<br>WPP_SF_qlDDDqS<br>WPP_SF_qll<br>WPP_SF_qlll<br>WPP_SF_qlq<br>WPP_SF_qlqll<br>WPP_SF_qlqqqqqqq<br>WPP_SF_qqD<br>WPP_SF_qqDD<br>WPP_SF_qqIqDdqqq<br>WPP_SF_qqSSSSDDDDSq<br>WPP_SF_qqSSSSSq<br>WPP_SF_qqSd<br>WPP_SF_qqSqq<br>WPP_SF_qql<br>WPP_SF_qqllq<br>WPP_SF_qqq<br>WPP_SF_qqqD<br>WPP_SF_qqqLL<br>WPP_SF_qqqSSSSq<br>WPP_SF_qqqq<br>WPP_SF_qs<br>WPP_SF_s<br>WPP_SF_sDq<br>WPP_SF_sS<br>WPP_SF_ss</details>|
|paramcount|0|0|
|address|EXTERNAL:00000003|EXTERNAL:00000003|
|sig|undefined TraceMessage(void)|undefined TraceMessage(void)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|True|True|

### ADVAPI32.DLL::TraceMessage Calling Diff


```diff
--- ADVAPI32.DLL::TraceMessage calling
+++ ADVAPI32.DLL::TraceMessage calling
@@ -142,0 +143 @@
+WPP_SF_qSDdd
```


## WPP_SF_L

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.92|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|WPP_SF_L|WPP_SF_L|
|fullname|WPP_SF_L|WPP_SF_L|
|`refcount`|728|729|
|length|58|58|
|called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage|
|`calling`|<details><summary>Expand for full list:<br>ATL::CComObject<class_CConnectionManager>::CreateInstance<br>ATL::CComObject<class_CContentDirectory>::CreateInstance<br>ATL::CComObject<class_CMediaReceiverRegistrar>::CreateInstance<br>AddAccessSidToDacl<br>Base64ToUnicode<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddressCache::GetAdapterAddress<br>CConnectionManager::FilterEndpoint<br>CConnectionManager::SendEvent<br>CConnectionManager::Unadvise<br>CConnectionManager::internal_Advise</summary>CConnectionManager::internal_GetProtocolInfo<br>CContentDirectory::FilterEndpoint<br>CContentDirectory::FilterEndpoint<br>CContentDirectory::ModerateEvent<br>CContentDirectory::OnContainersChanged<br>CContentDirectory::OnRemoteSharingStatusChanged<br>CContentDirectory::OnSystemUpdateIDChanged<br>CContentDirectory::SendEvent<br>CContentDirectory::SetupBrowseSearch<br>CContentDirectory::Unadvise<br>CContentDirectory::internal_Advise<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_GetSearchCapabilities<br>CContentDirectory::internal_Search<br>CContentDirectory::internal_UpdateObject<br>CContentDirectory::internal_get_ContainerUpdateIDs<br>CContentDirectory::internal_get_SearchCapabilities<br>CContentDirectory::internal_get_SystemUpdateID<br>CContentDirectory::internal_get_X_RemoteSharingEnabled<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateRegKey<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs<br>CDevicesDB::GetAllIDs_Extra<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceAuthorization_Extra<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDevicePropertyNames_Extra<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CDidlLiteObjectWriter::ActuallyWriteAlbumArtURI<br>CDidlLiteObjectWriter::ActuallyWriteElement<br>CDidlLiteObjectWriter::ActuallyWriteResElement<br>CDidlLiteObjectWriter::CdsElement::IsAttributeSelected<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetAtlStringFromGUID<br>CDidlLiteObjectWriter::GetAttributeBufferLength<br>CDidlLiteObjectWriter::GetResElementValue<br>CDidlLiteObjectWriter::HasDuplicateResElement<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CEventLog::ReportEventW<br>CEventsDB::Create<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CIPAddress::GetAdapterAddressesList<br>CIPAddress::GetLocalIPAddresses<br>CIPAddressCommon::GetAdaptersAddresses<br>CLibraryEventHandler::Initialize<br>CMACAddress::IsValidStringMAC<br>CMACAddressControl::CloseHandle<br>CMACAddressControl::Execute<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterMAC<br>CMACAddressControl::GetNetworkId<br>CMACAddressControl::GetRecentDeviceIDs<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::Init<br>CMACAddressControl::IsAllowed<br>CMACAddressControl::NotifyNewDeviceAuthorizationDenied<br>CMACAddressControl::NotifyNewDeviceAuthorizationGranted<br>CMACAddressControl::ShouldAllowAccess<br>CMACAddressControl::Shutdown<br>CMDEContentServer::AuthenticateNetEventHandler::EndNetEvent<br>CMDEContentServer::AuthorizeNetEventHandler::EndNetEvent<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginSelectStreams<br>CMDEContentServer::BeginUrlTransform<br>CMDEContentServer::CloseNetEventHandler::EndNetEvent<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::CustomizeMDEProfiles<br>CMDEContentServer::CustomizeSingleProfile<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::FreeResElements<br>CMDEContentServer::GetConnectionInfo<br>CMDEContentServer::GetLocalPath<br>CMDEContentServer::GetMACAddress<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::Initialize<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::QueueNetEvent<br>CMDEContentServer::SelectProfileNetEventHandler::EndNetEvent<br>CMDEContentServer::SelectStreamsNetEventHandler::EndNetEvent<br>CMDEContentServer::SetContentProvider<br>CMDEContentServer::UrlTransformNetEventHandler::EndNetEvent<br>CMDEProfileCollection::AddProfile<br>CMDEProfileCollection::AddProfileAtCorrectPosition<br>CMediaReceiverRegistrar::SendEvent<br>CMediaReceiverRegistrar::Unadvise<br>CMediaReceiverRegistrar::internal_Advise<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::internal_RegisterDevice<br>CMediaServer::FilterEndpoint<br>CMediaServer::FinalConstruct<br>CMediaServer::GetConnectionInfo<br>CMediaServer::GetServiceObject<br>CMediaServer::Initialize<br>CMediaServer::IsAllowed<br>CMediaServer::NewDeviceAuthorizationDenied<br>CMediaServer::NewDeviceAuthorizationGranted<br>CMediaServer::NewDeviceValidationRevoked<br>CMediaServer::NewDeviceValidationSucceeded<br>CMediaServer::OnWinSATChanged<br>CMediaServer::UpnpClientConnected<br>CMediaServer::UpnpClientDisconnected<br>CNTService::HandlerEx<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::LogEvent<br>CNTService::OnContinue<br>CNTService::OnDeviceEvent<br>CNTService::OnInit<br>CNTService::OnInterrogate<br>CNTService::OnPause<br>CNTService::OnPowerSettingChange<br>CNTService::OnResume<br>CNTService::OnSessionLogoff<br>CNTService::OnShutdown<br>CNTService::OnStop<br>CNTService::OnSuspend<br>CNTService::OnUninit<br>CNTService::OnUserControl<br>CNTService::ServiceMain<br>CNTService::SetStatus<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CNTService::UpdatePowerManagementSettings<br>CNTService::WaitForServiceExit<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::GetListOfDisconnectedNetworks<br>CNetworkEvents::Initialize<br>CNetworkEvents::NetworkAdded<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::NetworkPropertyChanged<br>CNetworkEvents::RegisterProfileEvent<br>CNetworkEvents::Shutdown<br>CNetworkInterfaces::Initialize<br>CQueryResultsCache::CleanCache<br>CRendererDevicesDB::IsValidID<br>CServerDevicesDB::IsValidID<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::SetSubStatus<br>CServiceControl::Start<br>CShellContentProviderEventHandler::Initialize<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellLibraryCache::LoadLibraries<br>CShellProvider::Advise<br>CShellProvider::CompareAggregateResultItem<br>CShellProvider::ConvertToCDError<br>CShellProvider::GetFileTypesFromProtocolInfoSearch<br>CShellProvider::GetFriendlyName<br>CShellProvider::Initialize<br>CShellProvider::InitializeStaticVariables<br>CShellProvider::InternalCompareUPnPItems<br>CShellProvider::OnCDSChanged<br>CShellProvider::OnChanged<br>CShellProvider::OnRemoteSharingStatusChanged<br>CShellProvider::SetOutputProtocolInfo<br>CShellProvider::SortAggregateItemResultSet<br>CShellProvider::TryEnsureLibraryMonitor<br>CShellProvider::Unadvise<br>CShellProvider::UpdateObject<br>CShellProviderAggregateResults::Initialize<br>CShellProviderFactory::Advise<br>CShellProviderFactory::Initialize<br>CShellProviderFactory::OnLibraryAdded<br>CShellProviderFactory::OnLibraryChanged<br>CShellProviderFactory::OnLibraryRemoved<br>CShellProviderFactory::Unadvise<br>CShellProviderFactory::~CShellProviderFactory<br>CShellProviderResults::CWMCUPnPItem::ConvertAlphaToWhite<br>CShellProviderResults::CWMCUPnPItem::ConvertFrameToJPEG<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellProviderResults::CompareHomogenousResultItem<br>CShellProviderResults::Initialize<br>CShellProviderResults::PopulateSortMappingArray<br>CShellResultsListenerEvent::_CatalogStatusWatchProc<br>CWMCContentProviderEventHandler::Initialize<br>CWMCContentProviderEventHandler::OnContentProviderAdded<br>CWMCContentProviderEventHandler::OnContentProviderChanged<br>CWMCContentProviderEventHandler::OnContentProviderRemoved<br>CWMCProviders::Initialize<br>CWMCService::AnySessions<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::CreateMediaDevices<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::GetPrivateMFWorkQueue<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::OnContentProviderAdded<br>CWMCService::OnContentProviderRemoved<br>CWMCService::OnDeviceEvent<br>CWMCService::OnInit<br>CWMCService::OnResume<br>CWMCService::OnSessionLogoff<br>CWMCService::OnSuspend<br>CWMCService::OnUninit<br>CWMCService::OnUserControl<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CWMCService::Uninstall<br>CWMCService::UpdateServerUPnPDeviceID<br>CWMCService::UpdateSharingStatus<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::InitializeStaticVariables<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::InitializeStaticVariables<br>CdsFilter::IsMandatorilySelected<br>CdsFilter::IsSelected<br>CdsFilter::Parse<br>CdsFilter::Select<br>CdsFilter::SelectMandatory<br>CdsItemInfoBase::GetAttributeUINT32Value<br>CdsItemInfoBase::GetCodecInfo<br>CdsItemInfoBase::GetImageResolution<br>CdsItemInfoBase::GetWMCResElementData<br>CdsObjectWriter::ActuallyWriteAlbumArtURIs<br>CdsObjectWriter::ActuallyWriteAlbumArtURIsAsResElement<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::Initialize<br>CdsParseProduct::AddQuery<br>CdsQueryParser::GetBinaryOp<br>CdsQueryParser::InitializeStaticVariables<br>CdsQueryParser::IsExistsOp<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::PopParseLevel<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadNextToken<br>CdsQueryParser::ReadQuotedValue<br>CdsSortEntry::InitializeStaticVariables<br>CdsSortEntry::Parse<br>CdsUpdateObjectParser::ParseTagValueList<br>CdsUpdateObjectParser::ParseXML<br>CdsUpdateObjectParser::ParseXMLProperties<br>CdsValues::CdsValuesCreateRelationships<br>CdsValues::CdsValuesInitializeHashTable<br>CdsValues::GetAtomForElement<br>CdsValues::GetAtomForElementAttribute<br>CdsValues::GetAtomForName<br>CdsValues::GetAttributeTypeForAtom<br>CdsValues::GetNameForAtom<br>CdsValues::IsMultiValued<br>CdsValues::XMLUnescape<br>CheckDWORDRegistryValue<br>ContainsInvalidContainsCharacters<br>ContentDirectoryErrors::CheckAndSetCDError<br>ContentDirectoryErrors::GetCDError<br>ContentDirectoryErrors::GetErrorMessage<br>ContentDirectoryErrors::SetCDErrorInfo<br>CreateKeyAndSetACLs<br>CreateMediaServer<br>CreateUUID<br>DLNACommon::IsWakeOnLANEnabled<br>DeleteKeyRecursive_64KEY<br>EnumSubKeys<br>FindMatchingMDEProfileInCollection<br>FindValueInStringList<br>GenerateStringFromResourceData<br>GetInscribedRectangle<br>GetLocalStringIPAddressesList<br>GetModulePath<br>GetStringFromAddress<br>GetStringFromGUID<br>GetStringValue<br>InitializeService<br>IsCDSSearchCriteriaWhiteSpace<br>IsHMEAllowedByGroupPolicy<br>IsIPAddressPermitted<br>IsNetworkService<br>IsRestrictedContainer<br>IsWMC<br>IsWakeOnLANEnabled<br>MDEProfile::ParseProfile<br>ParseUrl<br>ReserveHTTPPrefix<br>SafeGetModuleFileName<br>SetHandleACLs<br>SetInteractiveAndNetworkHandleACLs<br>ShouldGenerateRefID<br>StopService<br>WaitForDeletion<br>WaitForStop<br>WmcHashStringToDWORD<br>WriteResults2<br>_NetworkAddressChange<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$3<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$4<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$5<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$6<br>`CConnectionManager::internal_GetProtocolInfo'::__l1::catch$2<br>`CConnectionManager::internal_GetProtocolInfo'::__l1::catch$3<br>`CContentDirectory::internal_Browse'::__l1::catch$18<br>`CContentDirectory::internal_Search'::__l1::catch$18<br>`CContentDirectory::internal_get_ContainerUpdateIDs'::__l1::catch$2<br>`CContentDirectory::internal_get_SearchCapabilities'::__l1::catch$3<br>`GetBSTRHelper'::__l1::catch$0<br>wWinMain</details>|<details><summary>Expand for full list:<br>ATL::CComObject<class_CConnectionManager>::CreateInstance<br>ATL::CComObject<class_CContentDirectory>::CreateInstance<br>ATL::CComObject<class_CMediaReceiverRegistrar>::CreateInstance<br>AddAccessSidToDacl<br>Base64ToUnicode<br>CAdapterAddress::RuntimeClassInitialize<br>CAdapterAddressCache::GetAdapterAddress<br>CConnectionManager::FilterEndpoint<br>CConnectionManager::SendEvent<br>CConnectionManager::Unadvise<br>CConnectionManager::internal_Advise</summary>CConnectionManager::internal_GetProtocolInfo<br>CContentDirectory::FilterEndpoint<br>CContentDirectory::FilterEndpoint<br>CContentDirectory::ModerateEvent<br>CContentDirectory::OnContainersChanged<br>CContentDirectory::OnRemoteSharingStatusChanged<br>CContentDirectory::OnSystemUpdateIDChanged<br>CContentDirectory::SendEvent<br>CContentDirectory::SetupBrowseSearch<br>CContentDirectory::Unadvise<br>CContentDirectory::internal_Advise<br>CContentDirectory::internal_Browse<br>CContentDirectory::internal_GetSearchCapabilities<br>CContentDirectory::internal_Search<br>CContentDirectory::internal_UpdateObject<br>CContentDirectory::internal_get_ContainerUpdateIDs<br>CContentDirectory::internal_get_SearchCapabilities<br>CContentDirectory::internal_get_SystemUpdateID<br>CContentDirectory::internal_get_X_RemoteSharingEnabled<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateRegKey<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices<br>CDevicesDB::DeleteDevice<br>CDevicesDB::GetAllIDs<br>CDevicesDB::GetAllIDs_Extra<br>CDevicesDB::GetDeviceAuthorization<br>CDevicesDB::GetDeviceAuthorization_Extra<br>CDevicesDB::GetDeviceDisabled<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDeviceProperty<br>CDevicesDB::GetDevicePropertyNames_Extra<br>CDevicesDB::OpenRegKeyForRead<br>CDevicesDB::OpenScopedRegKey<br>CDevicesDB::SetDeviceAuthorization<br>CDevicesDB::SetDeviceProperty<br>CDidlLiteObjectWriter::ActuallyWriteAlbumArtURI<br>CDidlLiteObjectWriter::ActuallyWriteElement<br>CDidlLiteObjectWriter::ActuallyWriteResElement<br>CDidlLiteObjectWriter::CdsElement::IsAttributeSelected<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetAtlStringFromGUID<br>CDidlLiteObjectWriter::GetAttributeBufferLength<br>CDidlLiteObjectWriter::GetResElementValue<br>CDidlLiteObjectWriter::HasDuplicateResElement<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CEventLog::ReportEventW<br>CEventsDB::Create<br>CEventsDB::CreateRegKey<br>CEventsDB::GetEvents<br>CEventsDB::SignalEvents<br>CEventsDB::Subscribe<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CIPAddress::GetAdapterAddressesList<br>CIPAddress::GetLocalIPAddresses<br>CIPAddressCommon::GetAdaptersAddresses<br>CLibraryEventHandler::Initialize<br>CMACAddress::IsValidStringMAC<br>CMACAddressControl::CloseHandle<br>CMACAddressControl::Execute<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::FilterMAC<br>CMACAddressControl::GetNetworkId<br>CMACAddressControl::GetRecentDeviceIDs<br>CMACAddressControl::GrantAccessToMACAddress<br>CMACAddressControl::Init<br>CMACAddressControl::IsAllowed<br>CMACAddressControl::NotifyNewDeviceAuthorizationDenied<br>CMACAddressControl::NotifyNewDeviceAuthorizationGranted<br>CMACAddressControl::ShouldAllowAccess<br>CMACAddressControl::Shutdown<br>CMDEContentServer::AuthenticateNetEventHandler::EndNetEvent<br>CMDEContentServer::AuthorizeNetEventHandler::EndNetEvent<br>CMDEContentServer::BeginAuthenticate<br>CMDEContentServer::BeginAuthorize<br>CMDEContentServer::BeginClose<br>CMDEContentServer::BeginSelectProfile<br>CMDEContentServer::BeginSelectStreams<br>CMDEContentServer::BeginUrlTransform<br>CMDEContentServer::CloseNetEventHandler::EndNetEvent<br>CMDEContentServer::CreateMDEProfiles<br>CMDEContentServer::CustomizeMDEProfiles<br>CMDEContentServer::CustomizeSingleProfile<br>CMDEContentServer::FindConnectionID<br>CMDEContentServer::FreeResElements<br>CMDEContentServer::GetConnectionInfo<br>CMDEContentServer::GetLocalPath<br>CMDEContentServer::GetMACAddress<br>CMDEContentServer::GetObjectW<br>CMDEContentServer::GetProfile<br>CMDEContentServer::Initialize<br>CMDEContentServer::OnNetEvent<br>CMDEContentServer::OnWinSATChanged<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::QueueNetEvent<br>CMDEContentServer::SelectProfileNetEventHandler::EndNetEvent<br>CMDEContentServer::SelectStreamsNetEventHandler::EndNetEvent<br>CMDEContentServer::SetContentProvider<br>CMDEContentServer::UrlTransformNetEventHandler::EndNetEvent<br>CMDEProfileCollection::AddProfile<br>CMDEProfileCollection::AddProfileAtCorrectPosition<br>CMediaReceiverRegistrar::SendEvent<br>CMediaReceiverRegistrar::Unadvise<br>CMediaReceiverRegistrar::internal_Advise<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaReceiverRegistrar::internal_IsValidated<br>CMediaReceiverRegistrar::internal_RegisterDevice<br>CMediaServer::FilterEndpoint<br>CMediaServer::FinalConstruct<br>CMediaServer::GetConnectionInfo<br>CMediaServer::GetServiceObject<br>CMediaServer::Initialize<br>CMediaServer::IsAllowed<br>CMediaServer::NewDeviceAuthorizationDenied<br>CMediaServer::NewDeviceAuthorizationGranted<br>CMediaServer::NewDeviceValidationRevoked<br>CMediaServer::NewDeviceValidationSucceeded<br>CMediaServer::OnWinSATChanged<br>CMediaServer::UpnpClientConnected<br>CMediaServer::UpnpClientDisconnected<br>CNTService::HandlerEx<br>CNTService::Initialize<br>CNTService::Install<br>CNTService::IsInstalled<br>CNTService::LogEvent<br>CNTService::OnContinue<br>CNTService::OnDeviceEvent<br>CNTService::OnInit<br>CNTService::OnInterrogate<br>CNTService::OnPause<br>CNTService::OnPowerSettingChange<br>CNTService::OnResume<br>CNTService::OnSessionLogoff<br>CNTService::OnShutdown<br>CNTService::OnStop<br>CNTService::OnSuspend<br>CNTService::OnUninit<br>CNTService::OnUserControl<br>CNTService::ServiceMain<br>CNTService::SetStatus<br>CNTService::StartServiceW<br>CNTService::Uninstall<br>CNTService::UpdatePowerManagementSettings<br>CNTService::WaitForServiceExit<br>CNetworkEvents::EnsureNetprofmIsReady<br>CNetworkEvents::GetListOfDisconnectedNetworks<br>CNetworkEvents::Initialize<br>CNetworkEvents::NetworkAdded<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CNetworkEvents::NetworkPropertyChanged<br>CNetworkEvents::RegisterProfileEvent<br>CNetworkEvents::Shutdown<br>CNetworkInterfaces::Initialize<br>CQueryResultsCache::CleanCache<br>CRendererDevicesDB::IsValidID<br>CServerDevicesDB::IsValidID<br>CServiceControl::OpenServiceManager<br>CServiceControl::OpenServiceW<br>CServiceControl::SetStartType<br>CServiceControl::SetSubStatus<br>CServiceControl::Start<br>CShellContentProviderEventHandler::Initialize<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellLibraryCache::LoadLibraries<br>CShellProvider::Advise<br>CShellProvider::CompareAggregateResultItem<br>CShellProvider::ConvertToCDError<br>CShellProvider::GetFileTypesFromProtocolInfoSearch<br>CShellProvider::GetFriendlyName<br>CShellProvider::Initialize<br>CShellProvider::InitializeStaticVariables<br>CShellProvider::InternalCompareUPnPItems<br>CShellProvider::OnCDSChanged<br>CShellProvider::OnChanged<br>CShellProvider::OnRemoteSharingStatusChanged<br>CShellProvider::SetOutputProtocolInfo<br>CShellProvider::SortAggregateItemResultSet<br>CShellProvider::TryEnsureLibraryMonitor<br>CShellProvider::Unadvise<br>CShellProvider::UpdateObject<br>CShellProviderAggregateResults::Initialize<br>CShellProviderFactory::Advise<br>CShellProviderFactory::Initialize<br>CShellProviderFactory::OnLibraryAdded<br>CShellProviderFactory::OnLibraryChanged<br>CShellProviderFactory::OnLibraryRemoved<br>CShellProviderFactory::Unadvise<br>CShellProviderFactory::~CShellProviderFactory<br>CShellProviderResults::CWMCUPnPItem::ConvertAlphaToWhite<br>CShellProviderResults::CWMCUPnPItem::ConvertFrameToJPEG<br>CShellProviderResults::CWMCUPnPObject::PopulateArtistAuthorField<br>CShellProviderResults::CompareHomogenousResultItem<br>CShellProviderResults::Initialize<br>CShellProviderResults::PopulateSortMappingArray<br>CShellResultsListenerEvent::_CatalogStatusWatchProc<br>CWMCContentProviderEventHandler::Initialize<br>CWMCContentProviderEventHandler::OnContentProviderAdded<br>CWMCContentProviderEventHandler::OnContentProviderChanged<br>CWMCContentProviderEventHandler::OnContentProviderRemoved<br>CWMCProviders::Initialize<br>CWMCService::AnySessions<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::CreateMediaDevices<br>CWMCService::CreateMediaDevicesForContentProviderFactory<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::GetMDEOpCenter<br>CWMCService::GetPrivateMFWorkQueue<br>CWMCService::Install<br>CWMCService::IsWMPNSSContextCurrentlyEnabled<br>CWMCService::OnContentProviderAdded<br>CWMCService::OnContentProviderRemoved<br>CWMCService::OnDeviceEvent<br>CWMCService::OnInit<br>CWMCService::OnResume<br>CWMCService::OnSessionLogoff<br>CWMCService::OnSuspend<br>CWMCService::OnUninit<br>CWMCService::OnUserControl<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::ReregisterServer<br>CWMCService::ReserveURLNamespace<br>CWMCService::Run<br>CWMCService::Uninstall<br>CWMCService::UpdateServerUPnPDeviceID<br>CWMCService::UpdateSharingStatus<br>CdsBinaryOpQuery::Initialize<br>CdsBinaryOpQuery::InitializeStaticVariables<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::InitializeStaticVariables<br>CdsFilter::IsMandatorilySelected<br>CdsFilter::IsSelected<br>CdsFilter::Parse<br>CdsFilter::Select<br>CdsFilter::SelectMandatory<br>CdsItemInfoBase::GetAttributeUINT32Value<br>CdsItemInfoBase::GetCodecInfo<br>CdsItemInfoBase::GetImageResolution<br>CdsItemInfoBase::GetWMCResElementData<br>CdsObjectWriter::ActuallyWriteAlbumArtURIs<br>CdsObjectWriter::ActuallyWriteAlbumArtURIsAsResElement<br>CdsObjectWriter::ActuallyWriteResElements<br>CdsObjectWriter::Initialize<br>CdsParseProduct::AddQuery<br>CdsQueryParser::GetBinaryOp<br>CdsQueryParser::InitializeStaticVariables<br>CdsQueryParser::IsExistsOp<br>CdsQueryParser::Parse<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::PopParseLevel<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadNextToken<br>CdsQueryParser::ReadQuotedValue<br>CdsSortEntry::InitializeStaticVariables<br>CdsSortEntry::Parse<br>CdsUpdateObjectParser::ParseTagValueList<br>CdsUpdateObjectParser::ParseXML<br>CdsUpdateObjectParser::ParseXMLProperties<br>CdsValues::CdsValuesCreateRelationships<br>CdsValues::CdsValuesInitializeHashTable<br>CdsValues::GetAtomForElement<br>CdsValues::GetAtomForElementAttribute<br>CdsValues::GetAtomForName<br>CdsValues::GetAttributeTypeForAtom<br>CdsValues::GetNameForAtom<br>CdsValues::IsMultiValued<br>CdsValues::XMLUnescape<br>CheckDWORDRegistryValue<br>ContainsInvalidContainsCharacters<br>ContentDirectoryErrors::CheckAndSetCDError<br>ContentDirectoryErrors::GetCDError<br>ContentDirectoryErrors::GetErrorMessage<br>ContentDirectoryErrors::SetCDErrorInfo<br>CreateKeyAndSetACLs<br>CreateMediaServer<br>CreateUUID<br>DLNACommon::IsWakeOnLANEnabled<br>DeleteKeyRecursive_64KEY<br>DeleteKeyRecursive_64KEY_Recurse<br>EnumSubKeys<br>FindMatchingMDEProfileInCollection<br>FindValueInStringList<br>GenerateStringFromResourceData<br>GetInscribedRectangle<br>GetLocalStringIPAddressesList<br>GetModulePath<br>GetStringFromAddress<br>GetStringFromGUID<br>GetStringValue<br>InitializeService<br>IsCDSSearchCriteriaWhiteSpace<br>IsHMEAllowedByGroupPolicy<br>IsIPAddressPermitted<br>IsNetworkService<br>IsRestrictedContainer<br>IsWMC<br>IsWakeOnLANEnabled<br>MDEProfile::ParseProfile<br>ParseUrl<br>ReserveHTTPPrefix<br>SafeGetModuleFileName<br>SetHandleACLs<br>SetInteractiveAndNetworkHandleACLs<br>ShouldGenerateRefID<br>StopService<br>WaitForDeletion<br>WaitForStop<br>WmcHashStringToDWORD<br>WriteResults2<br>_NetworkAddressChange<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$3<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$4<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$5<br>`CConnectionManager::internal_GetCurrentConnectionInfo'::__l1::catch$6<br>`CConnectionManager::internal_GetProtocolInfo'::__l1::catch$2<br>`CConnectionManager::internal_GetProtocolInfo'::__l1::catch$3<br>`CContentDirectory::internal_Browse'::__l1::catch$18<br>`CContentDirectory::internal_Search'::__l1::catch$18<br>`CContentDirectory::internal_get_ContainerUpdateIDs'::__l1::catch$2<br>`CContentDirectory::internal_get_SearchCapabilities'::__l1::catch$3<br>`GetBSTRHelper'::__l1::catch$0<br>wWinMain</details>|
|paramcount|4|4|
|address|1400035c4|1400035c4|
|sig|undefined __fastcall WPP_SF_L(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|undefined __fastcall WPP_SF_L(undefined8 param_1, undefined2 param_2, undefined8 param_3, undefined4 param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_L Calling Diff


```diff
--- WPP_SF_L calling
+++ WPP_SF_L calling
@@ -295,0 +296 @@
+DeleteKeyRecursive_64KEY_Recurse
```


## WPP_SF_S

### Match Info



|Key|pre.exe - post.exe|
| :---: | :---: |
|diff_type|refcount,calling|
|ratio|1.0|
|i_ratio|0.93|
|m_ratio|1.0|
|b_ratio|1.0|
|match_types|SymbolsHash|

### Function Meta Diff



|Key|pre.exe|post.exe|
| :---: | :---: | :---: |
|name|WPP_SF_S|WPP_SF_S|
|fullname|WPP_SF_S|WPP_SF_S|
|`refcount`|140|141|
|length|160|160|
|called|ADVAPI32.DLL::TraceMessage|ADVAPI32.DLL::TraceMessage|
|`calling`|<details><summary>Expand for full list:<br>CConnectionManager::GetSourceProtocolInfo<br>CConnectionManager::OnConnectionIdsChanged<br>CConnectionManager::SetMediaServer<br>CConnectionManager::serializeProtocolInfoMap<br>CContainerHierarchyCache::GetChildContainers<br>CContentDirectory::internal_Browse<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateRegKey<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices</summary>CDevicesDB::GetDevicePropertyNames_Extra<br>CDevicesDB::IsExistingDevice<br>CDevicesDB::IsExistingDevice_Extra<br>CDevicesDB::OpenRegKeyForRead<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetAtlStringFromGUID<br>CDidlLiteObjectWriter::GetResElementValue<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CDidlLiteObjectWriter::WriteEscapedAttributeValue<br>CDidlLiteObjectWriter::WriteEscapedElementValue<br>CDidlLiteObjectWriter::WriteObject<br>CEventsDB::CreateRegKey<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::IsAllowed<br>CMDEContentServer::AddDLNAProtocolInfoForGetProtocolInfo<br>CMDEContentServer::GetProfile<br>CMDEContentServer::GetProtocolInfo<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::SetContentProvider<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaServer::GetServiceObject<br>CMediaServer::Initialize<br>CMediaServer::IsAllowed<br>CNTService::Install<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CRendererDevicesDB::IsValidID<br>CServerDevicesDB::IsValidID<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellPropertyThunk::ProtocolInfoThunk<br>CShellProvider::CreateInstance<br>CShellProvider::ExecuteQueryOnContainers<br>CShellProvider::GetFileTypesFromProtocolInfoSearch<br>CShellProvider::GetFriendlyName<br>CShellProvider::Initialize<br>CShellProviderFactory::OnLibraryChanged<br>CShellProviderFactory::OnLibraryRemoved<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::Install<br>CWMCService::NotifyShellLibraryDefinitionChanged<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::UpdateSharingStatus<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::Parse<br>CdsFilter::Select<br>CdsItemInfoBase::GetAttributeStringValue<br>CdsQueryParser::CdsQueryParser<br>CdsQueryParser::GetBinaryOp<br>CdsQueryParser::IsExistsOp<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadValue<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>CdsValues::GetAtomForName<br>CdsValues::GetNameForAtom<br>CdsValues::TransformAtomName<br>ContainsInvalidContainsCharacters<br>ContentDirectoryErrors::GetErrorMessage<br>ConvertStringToUINT32<br>ConvertStringToUINT64<br>EnumSubKeys<br>GetLocalStringIPAddressesList<br>GetMSDurationFromUPnPDuration<br>GetStringFromGUID<br>GetStringValue<br>Inet_addrW<br>IsRestrictedContainer<br>MDEProfile::ParseProfile<br>ParseDimension<br>ParseNameValuePair<br>ParseQueryString<br>ParseUrl<br>ShouldGenerateRefID<br>UnicodeToBase64<br>WmcHashStringToDWORD</details>|<details><summary>Expand for full list:<br>CConnectionManager::GetSourceProtocolInfo<br>CConnectionManager::OnConnectionIdsChanged<br>CConnectionManager::SetMediaServer<br>CConnectionManager::serializeProtocolInfoMap<br>CContainerHierarchyCache::GetChildContainers<br>CContentDirectory::internal_Browse<br>CDeviceShim::GetCompatFlags<br>CDevicesDB::CreateDevice<br>CDevicesDB::CreateRegKey<br>CDevicesDB::CreateUserKey<br>CDevicesDB::DeleteAllNewDevices</summary>CDevicesDB::GetDevicePropertyNames_Extra<br>CDevicesDB::IsExistingDevice<br>CDevicesDB::IsExistingDevice_Extra<br>CDevicesDB::OpenRegKeyForRead<br>CDidlLiteObjectWriter::GetAlbumArtURIValue<br>CDidlLiteObjectWriter::GetAtlStringFromGUID<br>CDidlLiteObjectWriter::GetResElementValue<br>CDidlLiteObjectWriter::InitializeStaticVariables<br>CDidlLiteObjectWriter::WriteEscapedAttributeValue<br>CDidlLiteObjectWriter::WriteEscapedElementValue<br>CDidlLiteObjectWriter::WriteObject<br>CEventsDB::CreateRegKey<br>CHMESharedLibraryMonitor::_ReadRegistry<br>CMACAddressControl::FilterEndpoint<br>CMACAddressControl::IsAllowed<br>CMDEContentServer::AddDLNAProtocolInfoForGetProtocolInfo<br>CMDEContentServer::GetProfile<br>CMDEContentServer::GetProtocolInfo<br>CMDEContentServer::ProfileMatchesMIME<br>CMDEContentServer::SetContentProvider<br>CMediaReceiverRegistrar::internal_IsAuthorized<br>CMediaServer::GetServiceObject<br>CMediaServer::Initialize<br>CMediaServer::IsAllowed<br>CNTService::Install<br>CNetworkEvents::NetworkConnectivityChanged<br>CNetworkEvents::NetworkDeleted<br>CRendererDevicesDB::IsValidID<br>CServerDevicesDB::IsValidID<br>CShellContentProviderEventHandler::OnShellLibraryDefinitionChanged<br>CShellPropertyThunk::ProtocolInfoThunk<br>CShellProvider::CreateInstance<br>CShellProvider::ExecuteQueryOnContainers<br>CShellProvider::GetFileTypesFromProtocolInfoSearch<br>CShellProvider::GetFriendlyName<br>CShellProvider::Initialize<br>CShellProviderFactory::OnLibraryChanged<br>CShellProviderFactory::OnLibraryRemoved<br>CWMCService::AnyUsersWantSharing<br>CWMCService::CreateAndRegisterServer<br>CWMCService::DisableSharingForAllUsersIfRequired<br>CWMCService::Install<br>CWMCService::NotifyShellLibraryDefinitionChanged<br>CWMCService::ReadPersistedServerUPnPID<br>CWMCService::RegisterServer<br>CWMCService::UpdateSharingStatus<br>CdsBinaryOpQuery::ValidateDurationValue<br>CdsBinaryOpQuery::ValidateQuotedValueAndOperation<br>CdsFilter::Parse<br>CdsFilter::Select<br>CdsItemInfoBase::GetAttributeStringValue<br>CdsQueryParser::CdsQueryParser<br>CdsQueryParser::GetBinaryOp<br>CdsQueryParser::IsExistsOp<br>CdsQueryParser::ParseQuery<br>CdsQueryParser::ProcessLogOp<br>CdsQueryParser::ProcessRelExp<br>CdsQueryParser::ReadValue<br>CdsSortEntry::Parse<br>CdsSortEntry::ParseSortString<br>CdsValues::GetAtomForName<br>CdsValues::GetNameForAtom<br>CdsValues::TransformAtomName<br>ContainsInvalidContainsCharacters<br>ContentDirectoryErrors::GetErrorMessage<br>ConvertStringToUINT32<br>ConvertStringToUINT64<br>DeleteKeyRecursive_64KEY_Recurse<br>EnumSubKeys<br>GetLocalStringIPAddressesList<br>GetMSDurationFromUPnPDuration<br>GetStringFromGUID<br>GetStringValue<br>Inet_addrW<br>IsRestrictedContainer<br>MDEProfile::ParseProfile<br>ParseDimension<br>ParseNameValuePair<br>ParseQueryString<br>ParseUrl<br>ShouldGenerateRefID<br>UnicodeToBase64<br>WmcHashStringToDWORD</details>|
|paramcount|4|4|
|address|14000351c|14000351c|
|sig|undefined __fastcall WPP_SF_S(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)|undefined __fastcall WPP_SF_S(undefined8 param_1, undefined2 param_2, undefined8 param_3, wchar_t * param_4)|
|sym_type|Function|Function|
|sym_source|IMPORTED|IMPORTED|
|external|False|False|

### WPP_SF_S Calling Diff


```diff
--- WPP_SF_S calling
+++ WPP_SF_S calling
@@ -78,0 +79 @@
+DeleteKeyRecursive_64KEY_Recurse
```




<sub>Generated with `ghidriff` version: 1.0.0 on 2026-08-16T18:30:59</sub>