
ntfs.nostrip.sys:     file format pei-i386

Disassembly of section .text:

00011000 <_DriverEntry@8>:
 *           DriverObject = object describing this driver
 *           RegistryPath = path to our configuration entries
 * RETURNS: Success or failure
 */
{
   11000:	55                   	push   %ebp
   11001:	89 e5                	mov    %esp,%ebp
   11003:	53                   	push   %ebx
   11004:	83 ec 18             	sub    $0x18,%esp
  PDEVICE_OBJECT DeviceObject;
  NTSTATUS Status;
  UNICODE_STRING DeviceName = ROS_STRING_INITIALIZER(L"\\Ntfs");

  DPRINT("NTFS 0.0.1\n");

  Status = IoCreateDevice(DriverObject,
   11007:	8d 45 ec             	lea    0xffffffec(%ebp),%eax
   1100a:	8b 5d 08             	mov    0x8(%ebp),%ebx
   1100d:	50                   	push   %eax
   1100e:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
   11011:	6a 00                	push   $0x0
   11013:	66 c7 45 f0 0a 00    	movw   $0xa,0xfffffff0(%ebp)
   11019:	6a 00                	push   $0x0
   1101b:	66 c7 45 f2 0c 00    	movw   $0xc,0xfffffff2(%ebp)
   11021:	6a 08                	push   $0x8
   11023:	c7 45 f4 00 40 01 00 	movl   $0x14000,0xfffffff4(%ebp)
   1102a:	50                   	push   %eax
   1102b:	6a 0c                	push   $0xc
   1102d:	53                   	push   %ebx
   1102e:	e8 ed 29 00 00       	call   13a20 <_IoCreateDevice@28>
			  sizeof(NTFS_GLOBAL_DATA),
			  &DeviceName,
			  FILE_DEVICE_DISK_FILE_SYSTEM,
			  0,
			  FALSE,
			  &DeviceObject);
  if (!NT_SUCCESS(Status))
   11033:	59                   	pop    %ecx
   11034:	85 c0                	test   %eax,%eax
   11036:	78 78                	js     110b0 <_DriverEntry@8+0xb0>
    {
      return(Status);
    }

  /* Initialize global data */
  NtfsGlobalData = DeviceObject->DeviceExtension;
   11038:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   1103b:	8b 40 28             	mov    0x28(%eax),%eax
  RtlZeroMemory(NtfsGlobalData,
   1103e:	52                   	push   %edx
   1103f:	a3 00 50 01 00       	mov    %eax,0x15000
   11044:	52                   	push   %edx
   11045:	6a 0c                	push   $0xc
   11047:	50                   	push   %eax
   11048:	e8 e3 29 00 00       	call   13a30 <_RtlZeroMemory@8>
		sizeof(NTFS_GLOBAL_DATA));
  NtfsGlobalData->DriverObject = DriverObject;
   1104d:	a1 00 50 01 00       	mov    0x15000,%eax
  NtfsGlobalData->DeviceObject = DeviceObject;
   11052:	8b 55 ec             	mov    0xffffffec(%ebp),%edx
   11055:	89 18                	mov    %ebx,(%eax)
   11057:	89 50 04             	mov    %edx,0x4(%eax)

  /* Initialize driver data */
  DeviceObject->Flags = DO_DIRECT_IO;
  DriverObject->MajorFunction[IRP_MJ_CLOSE] = NtfsClose;
   1105a:	c7 43 40 f0 38 01 00 	movl   $0x138f0,0x40(%ebx)
   11061:	c7 42 1c 10 00 00 00 	movl   $0x10,0x1c(%edx)
  DriverObject->MajorFunction[IRP_MJ_CREATE] = NtfsCreate;
   11068:	c7 43 38 70 17 01 00 	movl   $0x11770,0x38(%ebx)
  DriverObject->MajorFunction[IRP_MJ_READ] = NtfsRead;
   1106f:	c7 43 44 90 39 01 00 	movl   $0x13990,0x44(%ebx)
  DriverObject->MajorFunction[IRP_MJ_WRITE] = NtfsWrite;
   11076:	c7 43 48 00 3a 01 00 	movl   $0x13a00,0x48(%ebx)
  DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] =
   1107d:	c7 43 6c e0 25 01 00 	movl   $0x125e0,0x6c(%ebx)
    NtfsFileSystemControl;
  DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] =
   11084:	c7 43 68 f0 19 01 00 	movl   $0x119f0,0x68(%ebx)
    NtfsDirectoryControl;
  DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] =
   1108b:	c7 43 4c 50 23 01 00 	movl   $0x12350,0x4c(%ebx)
    NtfsQueryInformation;
  DriverObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION] =
   11092:	c7 43 60 00 37 01 00 	movl   $0x13700,0x60(%ebx)
    NtfsQueryVolumeInformation;
  DriverObject->MajorFunction[IRP_MJ_SET_VOLUME_INFORMATION] =
   11099:	c7 43 64 c0 38 01 00 	movl   $0x138c0,0x64(%ebx)
    NtfsSetVolumeInformation;

  DriverObject->DriverUnload = NULL;
   110a0:	c7 43 34 00 00 00 00 	movl   $0x0,0x34(%ebx)

  IoRegisterFileSystem(DeviceObject);
   110a7:	50                   	push   %eax
   110a8:	52                   	push   %edx
   110a9:	e8 92 29 00 00       	call   13a40 <_IoRegisterFileSystem@4>

  return(STATUS_SUCCESS);
   110ae:	31 c0                	xor    %eax,%eax
}
   110b0:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   110b3:	c9                   	leave  
   110b4:	c2 08 00             	ret    $0x8
   110b7:	90                   	nop    
   110b8:	90                   	nop    
   110b9:	90                   	nop    
   110ba:	90                   	nop    
   110bb:	90                   	nop    
   110bc:	90                   	nop    
   110bd:	90                   	nop    
   110be:	90                   	nop    
   110bf:	90                   	nop    

000110c0 <_RunLength>:
   110c0:	55                   	push   %ebp
   110c1:	89 e5                	mov    %esp,%ebp
   110c3:	8b 45 08             	mov    0x8(%ebp),%eax
   110c6:	5d                   	pop    %ebp
   110c7:	8a 10                	mov    (%eax),%dl
   110c9:	89 d0                	mov    %edx,%eax
   110cb:	c0 ea 04             	shr    $0x4,%dl
   110ce:	83 e0 0f             	and    $0xf,%eax
   110d1:	83 e2 0f             	and    $0xf,%edx
   110d4:	8d 44 10 01          	lea    0x1(%eax,%edx,1),%eax
   110d8:	c3                   	ret    
   110d9:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

000110e0 <_RunLCN>:
   110e0:	55                   	push   %ebp
   110e1:	89 e5                	mov    %esp,%ebp
   110e3:	57                   	push   %edi
   110e4:	56                   	push   %esi
   110e5:	53                   	push   %ebx
   110e6:	50                   	push   %eax
   110e7:	50                   	push   %eax
   110e8:	8b 55 08             	mov    0x8(%ebp),%edx
   110eb:	be 0f 00 00 00       	mov    $0xf,%esi
   110f0:	8a 02                	mov    (%edx),%al
   110f2:	21 c6                	and    %eax,%esi
   110f4:	c0 e8 04             	shr    $0x4,%al
   110f7:	88 45 f3             	mov    %al,0xfffffff3(%ebp)
   110fa:	74 5a                	je     11156 <_RunLCN+0x76>
   110fc:	89 f0                	mov    %esi,%eax
   110fe:	31 d2                	xor    %edx,%edx
   11100:	25 ff 00 00 00       	and    $0xff,%eax
   11105:	8b 7d 08             	mov    0x8(%ebp),%edi
   11108:	8a 55 f3             	mov    0xfffffff3(%ebp),%dl
   1110b:	01 f8                	add    %edi,%eax
   1110d:	0f be 0c 10          	movsbl (%eax,%edx,1),%ecx
   11111:	89 cb                	mov    %ecx,%ebx
   11113:	c1 fb 1f             	sar    $0x1f,%ebx
   11116:	89 f0                	mov    %esi,%eax
   11118:	25 ff 00 00 00       	and    $0xff,%eax
   1111d:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   11120:	31 c0                	xor    %eax,%eax
   11122:	8b 55 ec             	mov    0xffffffec(%ebp),%edx
   11125:	8a 45 f3             	mov    0xfffffff3(%ebp),%al
   11128:	8d 74 02 ff          	lea    0xffffffff(%edx,%eax,1),%esi
   1112c:	39 f2                	cmp    %esi,%edx
   1112e:	eb 19                	jmp    11149 <_RunLCN+0x69>
   11130:	8b 7d 08             	mov    0x8(%ebp),%edi
   11133:	31 c0                	xor    %eax,%eax
   11135:	0f a4 cb 08          	shld   $0x8,%ecx,%ebx
   11139:	8a 04 3e             	mov    (%esi,%edi,1),%al
   1113c:	31 d2                	xor    %edx,%edx
   1113e:	c1 e1 08             	shl    $0x8,%ecx
   11141:	01 c1                	add    %eax,%ecx
   11143:	11 d3                	adc    %edx,%ebx
   11145:	4e                   	dec    %esi
   11146:	39 75 ec             	cmp    %esi,0xffffffec(%ebp)
   11149:	7c e5                	jl     11130 <_RunLCN+0x50>
   1114b:	89 c8                	mov    %ecx,%eax
   1114d:	89 da                	mov    %ebx,%edx
   1114f:	59                   	pop    %ecx
   11150:	5b                   	pop    %ebx
   11151:	5b                   	pop    %ebx
   11152:	5e                   	pop    %esi
   11153:	5f                   	pop    %edi
   11154:	5d                   	pop    %ebp
   11155:	c3                   	ret    
   11156:	31 c9                	xor    %ecx,%ecx
   11158:	31 db                	xor    %ebx,%ebx
   1115a:	eb ba                	jmp    11116 <_RunLCN+0x36>
   1115c:	8d 74 26 00          	lea    0x0(%esi),%esi

00011160 <_RunCount>:
   11160:	55                   	push   %ebp
   11161:	31 c9                	xor    %ecx,%ecx
   11163:	89 e5                	mov    %esp,%ebp
   11165:	57                   	push   %edi
   11166:	56                   	push   %esi
   11167:	53                   	push   %ebx
   11168:	8b 7d 08             	mov    0x8(%ebp),%edi
   1116b:	31 db                	xor    %ebx,%ebx
   1116d:	31 f6                	xor    %esi,%esi
   1116f:	8a 07                	mov    (%edi),%al
   11171:	83 e0 0f             	and    $0xf,%eax
   11174:	88 c1                	mov    %al,%cl
   11176:	85 c9                	test   %ecx,%ecx
   11178:	eb 19                	jmp    11193 <_RunCount+0x33>
   1117a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   11180:	31 c0                	xor    %eax,%eax
   11182:	31 d2                	xor    %edx,%edx
   11184:	0f a4 de 08          	shld   $0x8,%ebx,%esi
   11188:	c1 e3 08             	shl    $0x8,%ebx
   1118b:	8a 04 39             	mov    (%ecx,%edi,1),%al
   1118e:	01 c3                	add    %eax,%ebx
   11190:	11 d6                	adc    %edx,%esi
   11192:	49                   	dec    %ecx
   11193:	75 eb                	jne    11180 <_RunCount+0x20>
   11195:	89 d8                	mov    %ebx,%eax
   11197:	89 f2                	mov    %esi,%edx
   11199:	5b                   	pop    %ebx
   1119a:	5e                   	pop    %esi
   1119b:	5f                   	pop    %edi
   1119c:	5d                   	pop    %ebp
   1119d:	c3                   	ret    
   1119e:	89 f6                	mov    %esi,%esi

000111a0 <_FindRun>:
   111a0:	55                   	push   %ebp
   111a1:	89 e5                	mov    %esp,%ebp
   111a3:	57                   	push   %edi
   111a4:	56                   	push   %esi
   111a5:	53                   	push   %ebx
   111a6:	83 ec 1c             	sub    $0x1c,%esp
   111a9:	8b 4d 08             	mov    0x8(%ebp),%ecx
   111ac:	8b 71 14             	mov    0x14(%ecx),%esi
   111af:	8b 59 10             	mov    0x10(%ecx),%ebx
   111b2:	3b 75 10             	cmp    0x10(%ebp),%esi
   111b5:	77 09                	ja     111c0 <_FindRun+0x20>
   111b7:	72 17                	jb     111d0 <_FindRun+0x30>
   111b9:	3b 5d 0c             	cmp    0xc(%ebp),%ebx
   111bc:	76 12                	jbe    111d0 <_FindRun+0x30>
   111be:	89 f6                	mov    %esi,%esi

   111c0:	31 c0                	xor    %eax,%eax
   111c2:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   111c5:	5b                   	pop    %ebx
   111c6:	5e                   	pop    %esi
   111c7:	5f                   	pop    %edi
   111c8:	5d                   	pop    %ebp
   111c9:	c3                   	ret    
   111ca:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   111d0:	8b 51 1c             	mov    0x1c(%ecx),%edx
   111d3:	8b 41 18             	mov    0x18(%ecx),%eax
   111d6:	3b 55 10             	cmp    0x10(%ebp),%edx
   111d9:	72 e5                	jb     111c0 <_FindRun+0x20>
   111db:	77 05                	ja     111e2 <_FindRun+0x42>
   111dd:	3b 45 0c             	cmp    0xc(%ebp),%eax
   111e0:	72 de                	jb     111c0 <_FindRun+0x20>
   111e2:	8b 45 14             	mov    0x14(%ebp),%eax
   111e5:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
   111eb:	c7 40 04 00 00 00 00 	movl   $0x0,0x4(%eax)
   111f2:	66 8b 41 20          	mov    0x20(%ecx),%ax
   111f6:	25 ff ff 00 00       	and    $0xffff,%eax
   111fb:	8d 3c 08             	lea    (%eax,%ecx,1),%edi
   111fe:	80 3f 00             	cmpb   $0x0,(%edi)
   11201:	74 bd                	je     111c0 <_FindRun+0x20>
   11203:	57                   	push   %edi
   11204:	e8 d7 fe ff ff       	call   110e0 <_RunLCN>
   11209:	8b 4d 14             	mov    0x14(%ebp),%ecx
   1120c:	01 01                	add    %eax,(%ecx)
   1120e:	11 51 04             	adc    %edx,0x4(%ecx)
   11211:	57                   	push   %edi
   11212:	e8 49 ff ff ff       	call   11160 <_RunCount>
   11217:	8b 4d 18             	mov    0x18(%ebp),%ecx
   1121a:	89 01                	mov    %eax,(%ecx)
   1121c:	89 51 04             	mov    %edx,0x4(%ecx)
   1121f:	89 45 d8             	mov    %eax,0xffffffd8(%ebp)
   11222:	89 55 dc             	mov    %edx,0xffffffdc(%ebp)
   11225:	58                   	pop    %eax
   11226:	3b 75 10             	cmp    0x10(%ebp),%esi
   11229:	5a                   	pop    %edx
   1122a:	77 27                	ja     11253 <_FindRun+0xb3>
   1122c:	72 05                	jb     11233 <_FindRun+0x93>
   1122e:	3b 5d 0c             	cmp    0xc(%ebp),%ebx
   11231:	77 20                	ja     11253 <_FindRun+0xb3>
   11233:	8b 45 d8             	mov    0xffffffd8(%ebp),%eax
   11236:	8b 55 dc             	mov    0xffffffdc(%ebp),%edx
   11239:	01 d8                	add    %ebx,%eax
   1123b:	8b 4d 10             	mov    0x10(%ebp),%ecx
   1123e:	11 f2                	adc    %esi,%edx
   11240:	89 45 e8             	mov    %eax,0xffffffe8(%ebp)
   11243:	89 55 ec             	mov    %edx,0xffffffec(%ebp)
   11246:	39 ca                	cmp    %ecx,%edx
   11248:	72 09                	jb     11253 <_FindRun+0xb3>
   1124a:	77 20                	ja     1126c <_FindRun+0xcc>
   1124c:	8b 55 0c             	mov    0xc(%ebp),%edx
   1124f:	39 d0                	cmp    %edx,%eax
   11251:	77 19                	ja     1126c <_FindRun+0xcc>
   11253:	03 5d d8             	add    0xffffffd8(%ebp),%ebx
   11256:	57                   	push   %edi
   11257:	13 75 dc             	adc    0xffffffdc(%ebp),%esi
   1125a:	e8 61 fe ff ff       	call   110c0 <_RunLength>
   1125f:	5a                   	pop    %edx
   11260:	01 c7                	add    %eax,%edi
   11262:	80 3f 00             	cmpb   $0x0,(%edi)
   11265:	75 9c                	jne    11203 <_FindRun+0x63>
   11267:	e9 54 ff ff ff       	jmp    111c0 <_FindRun+0x20>
   1126c:	57                   	push   %edi
   1126d:	e8 6e fe ff ff       	call   110e0 <_RunLCN>
   11272:	59                   	pop    %ecx
   11273:	89 d1                	mov    %edx,%ecx
   11275:	c7 45 e0 00 00 00 00 	movl   $0x0,0xffffffe0(%ebp)
   1127c:	c7 45 e4 00 00 00 00 	movl   $0x0,0xffffffe4(%ebp)
   11283:	09 c1                	or     %eax,%ecx
   11285:	74 1a                	je     112a1 <_FindRun+0x101>
   11287:	8b 4d 14             	mov    0x14(%ebp),%ecx
   1128a:	8b 45 0c             	mov    0xc(%ebp),%eax
   1128d:	8b 55 10             	mov    0x10(%ebp),%edx
   11290:	03 01                	add    (%ecx),%eax
   11292:	13 51 04             	adc    0x4(%ecx),%edx
   11295:	89 45 e0             	mov    %eax,0xffffffe0(%ebp)
   11298:	29 5d e0             	sub    %ebx,0xffffffe0(%ebp)
   1129b:	89 55 e4             	mov    %edx,0xffffffe4(%ebp)
   1129e:	19 75 e4             	sbb    %esi,0xffffffe4(%ebp)
   112a1:	8b 4d 14             	mov    0x14(%ebp),%ecx
   112a4:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   112a7:	8b 55 e4             	mov    0xffffffe4(%ebp),%edx
   112aa:	89 51 04             	mov    %edx,0x4(%ecx)
   112ad:	89 01                	mov    %eax,(%ecx)
   112af:	8b 45 0c             	mov    0xc(%ebp),%eax
   112b2:	8b 4d 18             	mov    0x18(%ebp),%ecx
   112b5:	29 d8                	sub    %ebx,%eax
   112b7:	31 d2                	xor    %edx,%edx
   112b9:	29 01                	sub    %eax,(%ecx)
   112bb:	b8 01 00 00 00       	mov    $0x1,%eax
   112c0:	19 51 04             	sbb    %edx,0x4(%ecx)
   112c3:	e9 fa fe ff ff       	jmp    111c2 <_FindRun+0x22>
   112c8:	90                   	nop    
   112c9:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

000112d0 <_NtfsDumpFileAttributes>:
   112d0:	55                   	push   %ebp
   112d1:	89 e5                	mov    %esp,%ebp
   112d3:	57                   	push   %edi
   112d4:	56                   	push   %esi
   112d5:	53                   	push   %ebx
   112d6:	83 ec 1c             	sub    $0x1c,%esp
   112d9:	8b 7d 08             	mov    0x8(%ebp),%edi
   112dc:	66 8b 47 14          	mov    0x14(%edi),%ax
   112e0:	25 ff ff 00 00       	and    $0xffff,%eax
   112e5:	8d 34 38             	lea    (%eax,%edi,1),%esi
   112e8:	8b 47 18             	mov    0x18(%edi),%eax
   112eb:	01 f8                	add    %edi,%eax
   112ed:	39 f0                	cmp    %esi,%eax
   112ef:	0f 86 00 01 00 00    	jbe    113f5 <_NtfsDumpFileAttributes+0x125>
   112f5:	8b 06                	mov    (%esi),%eax
   112f7:	83 f8 ff             	cmp    $0xffffffff,%eax
   112fa:	0f 84 f5 00 00 00    	je     113f5 <_NtfsDumpFileAttributes+0x125>
   11300:	3d 80 00 00 00       	cmp    $0x80,%eax
   11305:	0f 84 45 02 00 00    	je     11550 <_NtfsDumpFileAttributes+0x280>
   1130b:	77 29                	ja     11336 <_NtfsDumpFileAttributes+0x66>
   1130d:	83 f8 40             	cmp    $0x40,%eax
   11310:	0f 84 47 02 00 00    	je     1155d <_NtfsDumpFileAttributes+0x28d>
   11316:	77 4d                	ja     11365 <_NtfsDumpFileAttributes+0x95>
   11318:	83 f8 20             	cmp    $0x20,%eax
   1131b:	0f 84 9c 02 00 00    	je     115bd <_NtfsDumpFileAttributes+0x2ed>
   11321:	0f 87 b8 01 00 00    	ja     114df <_NtfsDumpFileAttributes+0x20f>
   11327:	83 f8 10             	cmp    $0x10,%eax
   1132a:	75 74                	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   1132c:	83 ec 0c             	sub    $0xc,%esp
   1132f:	68 10 40 01 00       	push   $0x14010
   11334:	eb 74                	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11336:	3d c0 00 00 00       	cmp    $0xc0,%eax
   1133b:	0f 84 29 02 00 00    	je     1156a <_NtfsDumpFileAttributes+0x29a>
   11341:	77 40                	ja     11383 <_NtfsDumpFileAttributes+0xb3>
   11343:	3d a0 00 00 00       	cmp    $0xa0,%eax
   11348:	0f 84 62 02 00 00    	je     115b0 <_NtfsDumpFileAttributes+0x2e0>
   1134e:	0f 87 73 01 00 00    	ja     114c7 <_NtfsDumpFileAttributes+0x1f7>
   11354:	3d 90 00 00 00       	cmp    $0x90,%eax
   11359:	75 45                	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   1135b:	83 ec 0c             	sub    $0xc,%esp
   1135e:	68 29 40 01 00       	push   $0x14029
   11363:	eb 45                	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11365:	83 f8 60             	cmp    $0x60,%eax
   11368:	0f 84 16 02 00 00    	je     11584 <_NtfsDumpFileAttributes+0x2b4>
   1136e:	0f 87 0e 01 00 00    	ja     11482 <_NtfsDumpFileAttributes+0x1b2>
   11374:	83 f8 50             	cmp    $0x50,%eax
   11377:	75 27                	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   11379:	83 ec 0c             	sub    $0xc,%esp
   1137c:	68 38 40 01 00       	push   $0x14038
   11381:	eb 27                	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11383:	3d e0 00 00 00       	cmp    $0xe0,%eax
   11388:	0f 84 e9 01 00 00    	je     11577 <_NtfsDumpFileAttributes+0x2a7>
   1138e:	77 6d                	ja     113fd <_NtfsDumpFileAttributes+0x12d>
   11390:	3d d0 00 00 00       	cmp    $0xd0,%eax
   11395:	0f 84 2f 02 00 00    	je     115ca <_NtfsDumpFileAttributes+0x2fa>
   1139b:	90                   	nop    
   1139c:	8d 74 26 00          	lea    0x0(%esi),%esi
   113a0:	50                   	push   %eax
   113a1:	50                   	push   %eax
   113a2:	8b 06                	mov    (%esi),%eax
   113a4:	50                   	push   %eax
   113a5:	68 50 40 01 00       	push   $0x14050
   113aa:	e8 a1 26 00 00       	call   13a50 <_DbgPrint>
   113af:	8a 46 09             	mov    0x9(%esi),%al
   113b2:	83 c4 10             	add    $0x10,%esp
   113b5:	84 c0                	test   %al,%al
   113b7:	0f 85 57 01 00 00    	jne    11514 <_NtfsDumpFileAttributes+0x244>
   113bd:	51                   	push   %ecx
   113be:	51                   	push   %ecx
   113bf:	b8 61 40 01 00       	mov    $0x14061,%eax
   113c4:	80 7e 08 00          	cmpb   $0x0,0x8(%esi)
   113c8:	75 05                	jne    113cf <_NtfsDumpFileAttributes+0xff>
   113ca:	b8 6e 40 01 00       	mov    $0x1406e,%eax
   113cf:	50                   	push   %eax
   113d0:	68 77 40 01 00       	push   $0x14077
   113d5:	e8 76 26 00 00       	call   13a50 <_DbgPrint>
   113da:	83 c4 10             	add    $0x10,%esp
   113dd:	80 7e 08 00          	cmpb   $0x0,0x8(%esi)
   113e1:	75 3d                	jne    11420 <_NtfsDumpFileAttributes+0x150>
   113e3:	8b 4e 04             	mov    0x4(%esi),%ecx
   113e6:	01 ce                	add    %ecx,%esi
   113e8:	8b 47 18             	mov    0x18(%edi),%eax
   113eb:	01 f8                	add    %edi,%eax
   113ed:	39 f0                	cmp    %esi,%eax
   113ef:	0f 87 00 ff ff ff    	ja     112f5 <_NtfsDumpFileAttributes+0x25>
   113f5:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   113f8:	5b                   	pop    %ebx
   113f9:	5e                   	pop    %esi
   113fa:	5f                   	pop    %edi
   113fb:	5d                   	pop    %ebp
   113fc:	c3                   	ret    
   113fd:	3d f0 00 00 00       	cmp    $0xf0,%eax
   11402:	0f 84 cf 01 00 00    	je     115d7 <_NtfsDumpFileAttributes+0x307>
   11408:	3d 00 01 00 00       	cmp    $0x100,%eax
   1140d:	75 91                	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   1140f:	83 ec 0c             	sub    $0xc,%esp
   11412:	68 7d 40 01 00       	push   $0x1407d
   11417:	eb 91                	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11419:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   11420:	8d 45 e0             	lea    0xffffffe0(%ebp),%eax
   11423:	50                   	push   %eax
   11424:	8d 45 d8             	lea    0xffffffd8(%ebp),%eax
   11427:	50                   	push   %eax
   11428:	6a 00                	push   $0x0
   1142a:	6a 00                	push   $0x0
   1142c:	56                   	push   %esi
   1142d:	e8 6e fd ff ff       	call   111a0 <_FindRun>
   11432:	58                   	pop    %eax
   11433:	8b 46 3c             	mov    0x3c(%esi),%eax
   11436:	5a                   	pop    %edx
   11437:	50                   	push   %eax
   11438:	8b 46 38             	mov    0x38(%esi),%eax
   1143b:	50                   	push   %eax
   1143c:	8b 46 34             	mov    0x34(%esi),%eax
   1143f:	50                   	push   %eax
   11440:	8b 5e 30             	mov    0x30(%esi),%ebx
   11443:	53                   	push   %ebx
   11444:	68 98 40 01 00       	push   $0x14098
   11449:	e8 02 26 00 00       	call   13a50 <_DbgPrint>
   1144e:	8b 4d d8             	mov    0xffffffd8(%ebp),%ecx
   11451:	89 c8                	mov    %ecx,%eax
   11453:	83 c4 14             	add    $0x14,%esp
   11456:	8b 5d dc             	mov    0xffffffdc(%ebp),%ebx
   11459:	03 45 e0             	add    0xffffffe0(%ebp),%eax
   1145c:	89 da                	mov    %ebx,%edx
   1145e:	13 55 e4             	adc    0xffffffe4(%ebp),%edx
   11461:	83 c0 ff             	add    $0xffffffff,%eax
   11464:	83 d2 ff             	adc    $0xffffffff,%edx
   11467:	52                   	push   %edx
   11468:	50                   	push   %eax
   11469:	53                   	push   %ebx
   1146a:	51                   	push   %ecx
   1146b:	68 c0 40 01 00       	push   $0x140c0
   11470:	e8 db 25 00 00       	call   13a50 <_DbgPrint>
   11475:	8b 4e 04             	mov    0x4(%esi),%ecx
   11478:	83 c4 20             	add    $0x20,%esp
   1147b:	01 ce                	add    %ecx,%esi
   1147d:	e9 66 ff ff ff       	jmp    113e8 <_NtfsDumpFileAttributes+0x118>
   11482:	83 f8 70             	cmp    $0x70,%eax
   11485:	0f 85 15 ff ff ff    	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   1148b:	83 ec 0c             	sub    $0xc,%esp
   1148e:	68 e3 40 01 00       	push   $0x140e3
   11493:	e8 b8 25 00 00       	call   13a50 <_DbgPrint>
   11498:	66 8b 56 14          	mov    0x14(%esi),%dx
   1149c:	83 c4 10             	add    $0x10,%esp
   1149f:	81 e2 ff ff 00 00    	and    $0xffff,%edx
   114a5:	01 f2                	add    %esi,%edx
   114a7:	66 8b 42 0a          	mov    0xa(%edx),%ax
   114ab:	25 ff ff 00 00       	and    $0xffff,%eax
   114b0:	50                   	push   %eax
   114b1:	31 c0                	xor    %eax,%eax
   114b3:	8a 42 09             	mov    0x9(%edx),%al
   114b6:	50                   	push   %eax
   114b7:	31 c0                	xor    %eax,%eax
   114b9:	8a 42 08             	mov    0x8(%edx),%al
   114bc:	50                   	push   %eax
   114bd:	68 fc 40 01 00       	push   $0x140fc
   114c2:	e9 e3 fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   114c7:	3d b0 00 00 00       	cmp    $0xb0,%eax
   114cc:	0f 85 ce fe ff ff    	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   114d2:	83 ec 0c             	sub    $0xc,%esp
   114d5:	68 20 41 01 00       	push   $0x14120
   114da:	e9 cb fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   114df:	83 f8 30             	cmp    $0x30,%eax
   114e2:	0f 85 b8 fe ff ff    	jne    113a0 <_NtfsDumpFileAttributes+0xd0>
   114e8:	83 ec 0c             	sub    $0xc,%esp
   114eb:	68 2b 41 01 00       	push   $0x1412b
   114f0:	e8 5b 25 00 00       	call   13a50 <_DbgPrint>
   114f5:	66 8b 46 14          	mov    0x14(%esi),%ax
   114f9:	83 c4 0c             	add    $0xc,%esp
   114fc:	25 ff ff 00 00       	and    $0xffff,%eax
   11501:	01 f0                	add    %esi,%eax
   11503:	8d 50 42             	lea    0x42(%eax),%edx
   11506:	52                   	push   %edx
   11507:	8a 40 40             	mov    0x40(%eax),%al
   1150a:	25 ff 00 00 00       	and    $0xff,%eax
   1150f:	e9 91 00 00 00       	jmp    115a5 <_NtfsDumpFileAttributes+0x2d5>
   11514:	25 ff 00 00 00       	and    $0xff,%eax
   11519:	01 c0                	add    %eax,%eax
   1151b:	66 89 45 e8          	mov    %ax,0xffffffe8(%ebp)
   1151f:	66 89 45 ea          	mov    %ax,0xffffffea(%ebp)
   11523:	66 8b 46 0a          	mov    0xa(%esi),%ax
   11527:	53                   	push   %ebx
   11528:	25 ff ff 00 00       	and    $0xffff,%eax
   1152d:	53                   	push   %ebx
   1152e:	01 f0                	add    %esi,%eax
   11530:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   11533:	8d 45 e8             	lea    0xffffffe8(%ebp),%eax
   11536:	50                   	push   %eax
   11537:	68 39 41 01 00       	push   $0x14139
   1153c:	e8 0f 25 00 00       	call   13a50 <_DbgPrint>
   11541:	83 c4 10             	add    $0x10,%esp
   11544:	e9 74 fe ff ff       	jmp    113bd <_NtfsDumpFileAttributes+0xed>
   11549:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   11550:	83 ec 0c             	sub    $0xc,%esp
   11553:	68 40 41 01 00       	push   $0x14140
   11558:	e9 4d fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   1155d:	83 ec 0c             	sub    $0xc,%esp
   11560:	68 49 41 01 00       	push   $0x14149
   11565:	e9 40 fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   1156a:	83 ec 0c             	sub    $0xc,%esp
   1156d:	68 57 41 01 00       	push   $0x14157
   11572:	e9 33 fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11577:	83 ec 0c             	sub    $0xc,%esp
   1157a:	68 69 41 01 00       	push   $0x14169
   1157f:	e9 26 fe ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   11584:	83 ec 0c             	sub    $0xc,%esp
   11587:	68 70 41 01 00       	push   $0x14170
   1158c:	e8 bf 24 00 00       	call   13a50 <_DbgPrint>
   11591:	66 8b 46 14          	mov    0x14(%esi),%ax
   11595:	83 c4 0c             	add    $0xc,%esp
   11598:	25 ff ff 00 00       	and    $0xffff,%eax
   1159d:	01 f0                	add    %esi,%eax
   1159f:	50                   	push   %eax
   115a0:	8b 46 10             	mov    0x10(%esi),%eax
   115a3:	d1 e8                	shr    %eax
   115a5:	50                   	push   %eax
   115a6:	68 80 41 01 00       	push   $0x14180
   115ab:	e9 fa fd ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   115b0:	83 ec 0c             	sub    $0xc,%esp
   115b3:	68 89 41 01 00       	push   $0x14189
   115b8:	e9 ed fd ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   115bd:	83 ec 0c             	sub    $0xc,%esp
   115c0:	68 9e 41 01 00       	push   $0x1419e
   115c5:	e9 e0 fd ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   115ca:	83 ec 0c             	sub    $0xc,%esp
   115cd:	68 b1 41 01 00       	push   $0x141b1
   115d2:	e9 d3 fd ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   115d7:	83 ec 0c             	sub    $0xc,%esp
   115da:	68 c4 41 01 00       	push   $0x141c4
   115df:	e9 c6 fd ff ff       	jmp    113aa <_NtfsDumpFileAttributes+0xda>
   115e4:	90                   	nop    
   115e5:	90                   	nop    
   115e6:	90                   	nop    
   115e7:	90                   	nop    
   115e8:	90                   	nop    
   115e9:	90                   	nop    
   115ea:	90                   	nop    
   115eb:	90                   	nop    
   115ec:	90                   	nop    
   115ed:	90                   	nop    
   115ee:	90                   	nop    
   115ef:	90                   	nop    

000115f0 <_NtfsReadSectors>:
   115f0:	55                   	push   %ebp
   115f1:	89 e5                	mov    %esp,%ebp
   115f3:	57                   	push   %edi
   115f4:	56                   	push   %esi
   115f5:	53                   	push   %ebx
   115f6:	83 ec 40             	sub    $0x40,%esp
   115f9:	8d 7d d8             	lea    0xffffffd8(%ebp),%edi
   115fc:	8a 45 1c             	mov    0x1c(%ebp),%al
   115ff:	8b 75 14             	mov    0x14(%ebp),%esi
   11602:	88 45 c7             	mov    %al,0xffffffc7(%ebp)
   11605:	8b 5d 10             	mov    0x10(%ebp),%ebx
   11608:	6a 00                	push   $0x0
   1160a:	6a 00                	push   $0x0
   1160c:	57                   	push   %edi
   1160d:	e8 4e 24 00 00       	call   13a60 <_KeInitializeEvent@12>
   11612:	8b 45 0c             	mov    0xc(%ebp),%eax
   11615:	f7 e6                	mul    %esi
   11617:	0f af de             	imul   %esi,%ebx
   1161a:	89 45 c8             	mov    %eax,0xffffffc8(%ebp)
   1161d:	8d 45 d0             	lea    0xffffffd0(%ebp),%eax
   11620:	89 55 cc             	mov    %edx,0xffffffcc(%ebp)
   11623:	50                   	push   %eax
   11624:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   11627:	57                   	push   %edi
   11628:	50                   	push   %eax
   11629:	53                   	push   %ebx
   1162a:	8b 45 18             	mov    0x18(%ebp),%eax
   1162d:	50                   	push   %eax
   1162e:	8b 45 08             	mov    0x8(%ebp),%eax
   11631:	50                   	push   %eax
   11632:	6a 03                	push   $0x3
   11634:	e8 37 24 00 00       	call   13a70 <_IoBuildSynchronousFsdRequest@28>
   11639:	89 c2                	mov    %eax,%edx
   1163b:	58                   	pop    %eax
   1163c:	85 d2                	test   %edx,%edx
   1163e:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11643:	74 1b                	je     11660 <_NtfsReadSectors+0x70>
   11645:	80 7d c7 00          	cmpb   $0x0,0xffffffc7(%ebp)
   11649:	75 1d                	jne    11668 <_NtfsReadSectors+0x78>
   1164b:	56                   	push   %esi
   1164c:	56                   	push   %esi
   1164d:	52                   	push   %edx
   1164e:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11651:	53                   	push   %ebx
   11652:	e8 29 24 00 00       	call   13a80 <_IoCallDriver@8>
   11657:	5a                   	pop    %edx
   11658:	3d 03 01 00 00       	cmp    $0x103,%eax
   1165d:	59                   	pop    %ecx
   1165e:	74 27                	je     11687 <_NtfsReadSectors+0x97>
   11660:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11663:	5b                   	pop    %ebx
   11664:	5e                   	pop    %esi
   11665:	5f                   	pop    %edi
   11666:	5d                   	pop    %ebp
   11667:	c3                   	ret    
   11668:	8b 42 60             	mov    0x60(%edx),%eax
   1166b:	83 e8 24             	sub    $0x24,%eax
   1166e:	80 48 02 02          	orb    $0x2,0x2(%eax)
   11672:	56                   	push   %esi
   11673:	56                   	push   %esi
   11674:	52                   	push   %edx
   11675:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11678:	53                   	push   %ebx
   11679:	e8 02 24 00 00       	call   13a80 <_IoCallDriver@8>
   1167e:	5a                   	pop    %edx
   1167f:	3d 03 01 00 00       	cmp    $0x103,%eax
   11684:	59                   	pop    %ecx
   11685:	75 d9                	jne    11660 <_NtfsReadSectors+0x70>
   11687:	83 ec 0c             	sub    $0xc,%esp
   1168a:	6a 00                	push   $0x0
   1168c:	6a 00                	push   $0x0
   1168e:	6a 00                	push   $0x0
   11690:	6a 05                	push   $0x5
   11692:	57                   	push   %edi
   11693:	e8 f8 23 00 00       	call   13a90 <_KeWaitForSingleObject@20>
   11698:	8b 45 d0             	mov    0xffffffd0(%ebp),%eax
   1169b:	83 c4 0c             	add    $0xc,%esp
   1169e:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   116a1:	5b                   	pop    %ebx
   116a2:	5e                   	pop    %esi
   116a3:	5f                   	pop    %edi
   116a4:	5d                   	pop    %ebp
   116a5:	c3                   	ret    
   116a6:	8d 76 00             	lea    0x0(%esi),%esi
   116a9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

000116b0 <_NtfsDeviceIoControl>:
   116b0:	55                   	push   %ebp
   116b1:	89 e5                	mov    %esp,%ebp
   116b3:	57                   	push   %edi
   116b4:	56                   	push   %esi
   116b5:	53                   	push   %ebx
   116b6:	83 ec 30             	sub    $0x30,%esp
   116b9:	8d 75 d8             	lea    0xffffffd8(%ebp),%esi
   116bc:	8a 45 20             	mov    0x20(%ebp),%al
   116bf:	8b 5d 1c             	mov    0x1c(%ebp),%ebx
   116c2:	88 45 cf             	mov    %al,0xffffffcf(%ebp)
   116c5:	6a 00                	push   $0x0
   116c7:	8b 7d 08             	mov    0x8(%ebp),%edi
   116ca:	6a 00                	push   $0x0
   116cc:	56                   	push   %esi
   116cd:	e8 8e 23 00 00       	call   13a60 <_KeInitializeEvent@12>
   116d2:	50                   	push   %eax
   116d3:	50                   	push   %eax
   116d4:	8d 45 d0             	lea    0xffffffd0(%ebp),%eax
   116d7:	50                   	push   %eax
   116d8:	31 c0                	xor    %eax,%eax
   116da:	56                   	push   %esi
   116db:	85 db                	test   %ebx,%ebx
   116dd:	6a 00                	push   $0x0
   116df:	74 02                	je     116e3 <_NtfsDeviceIoControl+0x33>
   116e1:	8b 03                	mov    (%ebx),%eax
   116e3:	50                   	push   %eax
   116e4:	8b 45 18             	mov    0x18(%ebp),%eax
   116e7:	50                   	push   %eax
   116e8:	8b 45 14             	mov    0x14(%ebp),%eax
   116eb:	50                   	push   %eax
   116ec:	8b 45 10             	mov    0x10(%ebp),%eax
   116ef:	50                   	push   %eax
   116f0:	8b 45 0c             	mov    0xc(%ebp),%eax
   116f3:	57                   	push   %edi
   116f4:	50                   	push   %eax
   116f5:	e8 a6 23 00 00       	call   13aa0 <_IoBuildDeviceIoControlRequest@36>
   116fa:	89 c2                	mov    %eax,%edx
   116fc:	83 c4 0c             	add    $0xc,%esp
   116ff:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11704:	85 d2                	test   %edx,%edx
   11706:	74 26                	je     1172e <_NtfsDeviceIoControl+0x7e>
   11708:	80 7d cf 00          	cmpb   $0x0,0xffffffcf(%ebp)
   1170c:	75 28                	jne    11736 <_NtfsDeviceIoControl+0x86>
   1170e:	50                   	push   %eax
   1170f:	50                   	push   %eax
   11710:	52                   	push   %edx
   11711:	57                   	push   %edi
   11712:	e8 69 23 00 00       	call   13a80 <_IoCallDriver@8>
   11717:	89 c2                	mov    %eax,%edx
   11719:	58                   	pop    %eax
   1171a:	81 fa 03 01 00 00    	cmp    $0x103,%edx
   11720:	59                   	pop    %ecx
   11721:	74 32                	je     11755 <_NtfsDeviceIoControl+0xa5>
   11723:	85 db                	test   %ebx,%ebx
   11725:	74 05                	je     1172c <_NtfsDeviceIoControl+0x7c>
   11727:	8b 45 d4             	mov    0xffffffd4(%ebp),%eax
   1172a:	89 03                	mov    %eax,(%ebx)
   1172c:	89 d0                	mov    %edx,%eax
   1172e:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11731:	5b                   	pop    %ebx
   11732:	5e                   	pop    %esi
   11733:	5f                   	pop    %edi
   11734:	5d                   	pop    %ebp
   11735:	c3                   	ret    
   11736:	8b 42 60             	mov    0x60(%edx),%eax
   11739:	83 e8 24             	sub    $0x24,%eax
   1173c:	80 48 02 02          	orb    $0x2,0x2(%eax)
   11740:	50                   	push   %eax
   11741:	50                   	push   %eax
   11742:	52                   	push   %edx
   11743:	57                   	push   %edi
   11744:	e8 37 23 00 00       	call   13a80 <_IoCallDriver@8>
   11749:	89 c2                	mov    %eax,%edx
   1174b:	58                   	pop    %eax
   1174c:	81 fa 03 01 00 00    	cmp    $0x103,%edx
   11752:	59                   	pop    %ecx
   11753:	75 ce                	jne    11723 <_NtfsDeviceIoControl+0x73>
   11755:	83 ec 0c             	sub    $0xc,%esp
   11758:	6a 00                	push   $0x0
   1175a:	6a 00                	push   $0x0
   1175c:	6a 00                	push   $0x0
   1175e:	6a 05                	push   $0x5
   11760:	56                   	push   %esi
   11761:	e8 2a 23 00 00       	call   13a90 <_KeWaitForSingleObject@20>
   11766:	8b 55 d0             	mov    0xffffffd0(%ebp),%edx
   11769:	83 c4 0c             	add    $0xc,%esp
   1176c:	eb b5                	jmp    11723 <_NtfsDeviceIoControl+0x73>
   1176e:	90                   	nop    
   1176f:	90                   	nop    

00011770 <_NtfsCreate@8>:
   11770:	55                   	push   %ebp
   11771:	89 e5                	mov    %esp,%ebp
   11773:	57                   	push   %edi
   11774:	56                   	push   %esi
   11775:	53                   	push   %ebx
   11776:	83 ec 1c             	sub    $0x1c,%esp
   11779:	a1 00 50 01 00       	mov    0x15000,%eax
   1177e:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11781:	39 58 04             	cmp    %ebx,0x4(%eax)
   11784:	0f 84 b6 01 00 00    	je     11940 <_NtfsCreate@8+0x1d0>
   1178a:	8b 4b 28             	mov    0x28(%ebx),%ecx
   1178d:	89 4d e8             	mov    %ecx,0xffffffe8(%ebp)
   11790:	57                   	push   %edi
   11791:	57                   	push   %edi
   11792:	6a 01                	push   $0x1
   11794:	51                   	push   %ecx
   11795:	e8 16 23 00 00       	call   13ab0 <_ExAcquireResourceExclusiveLite@8>
   1179a:	8b 7b 28             	mov    0x28(%ebx),%edi
   1179d:	59                   	pop    %ecx
   1179e:	85 ff                	test   %edi,%edi
   117a0:	5e                   	pop    %esi
   117a1:	0f 84 aa 01 00 00    	je     11951 <_NtfsCreate@8+0x1e1>
   117a7:	8b 45 0c             	mov    0xc(%ebp),%eax
   117aa:	8b 58 60             	mov    0x60(%eax),%ebx
   117ad:	85 db                	test   %ebx,%ebx
   117af:	0f 84 ba 01 00 00    	je     1196f <_NtfsCreate@8+0x1ff>
   117b5:	31 c9                	xor    %ecx,%ecx
   117b7:	8b 73 18             	mov    0x18(%ebx),%esi
   117ba:	8a 4b 0b             	mov    0xb(%ebx),%cl
   117bd:	83 f9 02             	cmp    $0x2,%ecx
   117c0:	0f 94 c2             	sete   %dl
   117c3:	83 f9 05             	cmp    $0x5,%ecx
   117c6:	0f 94 c0             	sete   %al
   117c9:	09 d0                	or     %edx,%eax
   117cb:	a8 01                	test   $0x1,%al
   117cd:	74 38                	je     11807 <_NtfsCreate@8+0x97>
   117cf:	b8 22 00 00 c0       	mov    $0xc0000022,%eax
   117d4:	8b 4d e8             	mov    0xffffffe8(%ebp),%ecx
   117d7:	89 c3                	mov    %eax,%ebx
   117d9:	e8 e2 22 00 00       	call   13ac0 <@ExReleaseResourceLite@4>
   117de:	8b 45 0c             	mov    0xc(%ebp),%eax
   117e1:	89 58 18             	mov    %ebx,0x18(%eax)
   117e4:	89 d8                	mov    %ebx,%eax
   117e6:	c1 f8 1f             	sar    $0x1f,%eax
   117e9:	52                   	push   %edx
   117ea:	83 f0 ff             	xor    $0xffffffff,%eax
   117ed:	52                   	push   %edx
   117ee:	83 e0 04             	and    $0x4,%eax
   117f1:	50                   	push   %eax
   117f2:	8b 45 0c             	mov    0xc(%ebp),%eax
   117f5:	50                   	push   %eax
   117f6:	e8 d5 22 00 00       	call   13ad0 <_IoCompleteRequest@8>
   117fb:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   117fe:	89 d8                	mov    %ebx,%eax
   11800:	5b                   	pop    %ebx
   11801:	5e                   	pop    %esi
   11802:	5f                   	pop    %edi
   11803:	5d                   	pop    %ebp
   11804:	c2 08 00             	ret    $0x8
   11807:	85 c9                	test   %ecx,%ecx
   11809:	74 c4                	je     117cf <_NtfsCreate@8+0x5f>
   1180b:	8b 4e 34             	mov    0x34(%esi),%ecx
   1180e:	8b 46 20             	mov    0x20(%esi),%eax
   11811:	89 4d e4             	mov    %ecx,0xffffffe4(%ebp)
   11814:	85 c0                	test   %eax,%eax
   11816:	0f 84 a4 00 00 00    	je     118c0 <_NtfsCreate@8+0x150>
   1181c:	8b 58 0c             	mov    0xc(%eax),%ebx
   1181f:	85 db                	test   %ebx,%ebx
   11821:	0f 84 66 01 00 00    	je     1198d <_NtfsCreate@8+0x21d>
   11827:	83 ec 0c             	sub    $0xc,%esp
   1182a:	53                   	push   %ebx
   1182b:	e8 00 05 00 00       	call   11d30 <_NtfsFCBIsDirectory>
   11830:	83 c4 10             	add    $0x10,%esp
   11833:	84 c0                	test   %al,%al
   11835:	0f 84 d6 00 00 00    	je     11911 <_NtfsCreate@8+0x1a1>
   1183b:	8b 45 e4             	mov    0xffffffe4(%ebp),%eax
   1183e:	66 83 38 5c          	cmpw   $0x5c,(%eax)
   11842:	0f 84 c9 00 00 00    	je     11911 <_NtfsCreate@8+0x1a1>
   11848:	83 ec 0c             	sub    $0xc,%esp
   1184b:	8d 7b 40             	lea    0x40(%ebx),%edi
   1184e:	57                   	push   %edi
   1184f:	e8 cc 22 00 00       	call   13b20 <_wcslen>
   11854:	5a                   	pop    %edx
   11855:	89 c6                	mov    %eax,%esi
   11857:	8b 45 e4             	mov    0xffffffe4(%ebp),%eax
   1185a:	50                   	push   %eax
   1185b:	e8 c0 22 00 00       	call   13b20 <_wcslen>
   11860:	83 c4 10             	add    $0x10,%esp
   11863:	8d 44 06 02          	lea    0x2(%esi,%eax,1),%eax
   11867:	3d 04 01 00 00       	cmp    $0x104,%eax
   1186c:	0f 87 36 01 00 00    	ja     119a8 <_NtfsCreate@8+0x238>
   11872:	56                   	push   %esi
   11873:	56                   	push   %esi
   11874:	68 08 02 00 00       	push   $0x208
   11879:	6a 00                	push   $0x0
   1187b:	e8 60 22 00 00       	call   13ae0 <_ExAllocatePool@8>
   11880:	89 c6                	mov    %eax,%esi
   11882:	5a                   	pop    %edx
   11883:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11888:	59                   	pop    %ecx
   11889:	85 f6                	test   %esi,%esi
   1188b:	0f 84 85 00 00 00    	je     11916 <_NtfsCreate@8+0x1a6>
   11891:	50                   	push   %eax
   11892:	50                   	push   %eax
   11893:	57                   	push   %edi
   11894:	56                   	push   %esi
   11895:	e8 76 22 00 00       	call   13b10 <_wcscpy>
   1189a:	89 1c 24             	mov    %ebx,(%esp)
   1189d:	e8 9e 04 00 00       	call   11d40 <_NtfsFCBIsRoot>
   118a2:	83 c4 10             	add    $0x10,%esp
   118a5:	84 c0                	test   %al,%al
   118a7:	0f 84 27 01 00 00    	je     119d4 <_NtfsCreate@8+0x264>
   118ad:	50                   	push   %eax
   118ae:	50                   	push   %eax
   118af:	8b 45 e4             	mov    0xffffffe4(%ebp),%eax
   118b2:	50                   	push   %eax
   118b3:	56                   	push   %esi
   118b4:	e8 47 22 00 00       	call   13b00 <_wcscat>
   118b9:	83 c4 10             	add    $0x10,%esp
   118bc:	31 c0                	xor    %eax,%eax
   118be:	eb 56                	jmp    11916 <_NtfsCreate@8+0x1a6>
   118c0:	8b 5d e4             	mov    0xffffffe4(%ebp),%ebx
   118c3:	50                   	push   %eax
   118c4:	50                   	push   %eax
   118c5:	53                   	push   %ebx
   118c6:	57                   	push   %edi
   118c7:	e8 b4 05 00 00       	call   11e80 <_NtfsGrabFCBFromTable>
   118cc:	83 c4 10             	add    $0x10,%esp
   118cf:	85 c0                	test   %eax,%eax
   118d1:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
   118d4:	75 28                	jne    118fe <_NtfsCreate@8+0x18e>
   118d6:	8b 4d e4             	mov    0xffffffe4(%ebp),%ecx
   118d9:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
   118dc:	51                   	push   %ecx
   118dd:	50                   	push   %eax
   118de:	8d 45 ec             	lea    0xffffffec(%ebp),%eax
   118e1:	50                   	push   %eax
   118e2:	57                   	push   %edi
   118e3:	e8 38 08 00 00       	call   12120 <_NtfsGetFCBForFile>
   118e8:	83 c4 10             	add    $0x10,%esp
   118eb:	89 c3                	mov    %eax,%ebx
   118ed:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   118f0:	85 c0                	test   %eax,%eax
   118f2:	0f 85 cb 00 00 00    	jne    119c3 <_NtfsCreate@8+0x253>
   118f8:	89 da                	mov    %ebx,%edx
   118fa:	85 db                	test   %ebx,%ebx
   118fc:	78 23                	js     11921 <_NtfsCreate@8+0x1b1>
   118fe:	8b 4d f0             	mov    0xfffffff0(%ebp),%ecx
   11901:	53                   	push   %ebx
   11902:	56                   	push   %esi
   11903:	51                   	push   %ecx
   11904:	57                   	push   %edi
   11905:	e8 76 07 00 00       	call   12080 <_NtfsAttachFCBToFileObject>
   1190a:	83 c4 10             	add    $0x10,%esp
   1190d:	89 c2                	mov    %eax,%edx
   1190f:	eb 10                	jmp    11921 <_NtfsCreate@8+0x1b1>
   11911:	b8 0d 00 00 c0       	mov    $0xc000000d,%eax
   11916:	89 c2                	mov    %eax,%edx
   11918:	85 c0                	test   %eax,%eax
   1191a:	78 05                	js     11921 <_NtfsCreate@8+0x1b1>
   1191c:	ba 01 00 00 c0       	mov    $0xc0000001,%edx
   11921:	89 d0                	mov    %edx,%eax
   11923:	8b 4d 0c             	mov    0xc(%ebp),%ecx
   11926:	83 f0 ff             	xor    $0xffffffff,%eax
   11929:	c1 e8 1f             	shr    $0x1f,%eax
   1192c:	89 51 18             	mov    %edx,0x18(%ecx)
   1192f:	89 41 1c             	mov    %eax,0x1c(%ecx)
   11932:	89 d0                	mov    %edx,%eax
   11934:	e9 9b fe ff ff       	jmp    117d4 <_NtfsCreate@8+0x64>
   11939:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   11940:	8b 45 0c             	mov    0xc(%ebp),%eax
   11943:	31 db                	xor    %ebx,%ebx
   11945:	c7 40 1c 01 00 00 00 	movl   $0x1,0x1c(%eax)
   1194c:	e9 8d fe ff ff       	jmp    117de <_NtfsCreate@8+0x6e>
   11951:	68 e0 41 01 00       	push   $0x141e0
   11956:	68 ac 00 00 00       	push   $0xac
   1195b:	68 e1 41 01 00       	push   $0x141e1
   11960:	68 ea 41 01 00       	push   $0x141ea
   11965:	e8 86 21 00 00       	call   13af0 <_RtlAssert@16>
   1196a:	e9 38 fe ff ff       	jmp    117a7 <_NtfsCreate@8+0x37>
   1196f:	68 e0 41 01 00       	push   $0x141e0
   11974:	68 ae 00 00 00       	push   $0xae
   11979:	68 e1 41 01 00       	push   $0x141e1
   1197e:	68 ea 41 01 00       	push   $0x141ea
   11983:	e8 68 21 00 00       	call   13af0 <_RtlAssert@16>
   11988:	e9 28 fe ff ff       	jmp    117b5 <_NtfsCreate@8+0x45>
   1198d:	68 e0 41 01 00       	push   $0x141e0
   11992:	6a 32                	push   $0x32
   11994:	68 e1 41 01 00       	push   $0x141e1
   11999:	68 ea 41 01 00       	push   $0x141ea
   1199e:	e8 4d 21 00 00       	call   13af0 <_RtlAssert@16>
   119a3:	e9 7f fe ff ff       	jmp    11827 <_NtfsCreate@8+0xb7>
   119a8:	68 e0 41 01 00       	push   $0x141e0
   119ad:	6a 3e                	push   $0x3e
   119af:	68 e1 41 01 00       	push   $0x141e1
   119b4:	68 ea 41 01 00       	push   $0x141ea
   119b9:	e8 32 21 00 00       	call   13af0 <_RtlAssert@16>
   119be:	e9 af fe ff ff       	jmp    11872 <_NtfsCreate@8+0x102>
   119c3:	52                   	push   %edx
   119c4:	52                   	push   %edx
   119c5:	50                   	push   %eax
   119c6:	57                   	push   %edi
   119c7:	e8 e4 03 00 00       	call   11db0 <_NtfsReleaseFCB>
   119cc:	83 c4 10             	add    $0x10,%esp
   119cf:	e9 24 ff ff ff       	jmp    118f8 <_NtfsCreate@8+0x188>
   119d4:	50                   	push   %eax
   119d5:	50                   	push   %eax
   119d6:	68 ee 41 01 00       	push   $0x141ee
   119db:	56                   	push   %esi
   119dc:	e8 1f 21 00 00       	call   13b00 <_wcscat>
   119e1:	83 c4 10             	add    $0x10,%esp
   119e4:	e9 c4 fe ff ff       	jmp    118ad <_NtfsCreate@8+0x13d>
   119e9:	90                   	nop    
   119ea:	90                   	nop    
   119eb:	90                   	nop    
   119ec:	90                   	nop    
   119ed:	90                   	nop    
   119ee:	90                   	nop    
   119ef:	90                   	nop    

000119f0 <_NtfsDirectoryControl@8>:
   119f0:	55                   	push   %ebp
   119f1:	89 e5                	mov    %esp,%ebp
   119f3:	57                   	push   %edi
   119f4:	56                   	push   %esi
   119f5:	53                   	push   %ebx
   119f6:	83 ec 10             	sub    $0x10,%esp
   119f9:	8b 75 0c             	mov    0xc(%ebp),%esi
   119fc:	68 a8 02 00 00       	push   $0x2a8
   11a01:	68 00 42 01 00       	push   $0x14200
   11a06:	68 09 42 01 00       	push   $0x14209
   11a0b:	e8 40 20 00 00       	call   13a50 <_DbgPrint>
   11a10:	c7 04 24 14 42 01 00 	movl   $0x14214,(%esp)
   11a17:	e8 34 20 00 00       	call   13a50 <_DbgPrint>
   11a1c:	8b 5e 60             	mov    0x60(%esi),%ebx
   11a1f:	31 c0                	xor    %eax,%eax
   11a21:	83 c4 10             	add    $0x10,%esp
   11a24:	8a 43 01             	mov    0x1(%ebx),%al
   11a27:	83 f8 01             	cmp    $0x1,%eax
   11a2a:	74 58                	je     11a84 <_NtfsDirectoryControl@8+0x94>
   11a2c:	83 f8 02             	cmp    $0x2,%eax
   11a2f:	0f 84 e3 00 00 00    	je     11b18 <_NtfsDirectoryControl@8+0x128>
   11a35:	57                   	push   %edi
   11a36:	68 b9 02 00 00       	push   $0x2b9
   11a3b:	68 00 42 01 00       	push   $0x14200
   11a40:	68 09 42 01 00       	push   $0x14209
   11a45:	e8 06 20 00 00       	call   13a50 <_DbgPrint>
   11a4a:	31 c0                	xor    %eax,%eax
   11a4c:	5a                   	pop    %edx
   11a4d:	8a 43 01             	mov    0x1(%ebx),%al
   11a50:	59                   	pop    %ecx
   11a51:	50                   	push   %eax
   11a52:	68 33 42 01 00       	push   $0x14233
   11a57:	e8 f4 1f 00 00       	call   13a50 <_DbgPrint>
   11a5c:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   11a61:	83 c4 10             	add    $0x10,%esp
   11a64:	89 5e 18             	mov    %ebx,0x18(%esi)
   11a67:	c7 46 1c 00 00 00 00 	movl   $0x0,0x1c(%esi)
   11a6e:	50                   	push   %eax
   11a6f:	50                   	push   %eax
   11a70:	6a 00                	push   $0x0
   11a72:	56                   	push   %esi
   11a73:	e8 58 20 00 00       	call   13ad0 <_IoCompleteRequest@8>
   11a78:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11a7b:	89 d8                	mov    %ebx,%eax
   11a7d:	5b                   	pop    %ebx
   11a7e:	5e                   	pop    %esi
   11a7f:	5f                   	pop    %edi
   11a80:	5d                   	pop    %ebp
   11a81:	c2 08 00             	ret    $0x8
   11a84:	c6 45 f3 00          	movb   $0x0,0xfffffff3(%ebp)
   11a88:	50                   	push   %eax
   11a89:	68 f5 01 00 00       	push   $0x1f5
   11a8e:	68 00 42 01 00       	push   $0x14200
   11a93:	68 09 42 01 00       	push   $0x14209
   11a98:	e8 b3 1f 00 00       	call   13a50 <_DbgPrint>
   11a9d:	c7 04 24 4b 42 01 00 	movl   $0x1424b,(%esp)
   11aa4:	e8 a7 1f 00 00       	call   13a50 <_DbgPrint>
   11aa9:	8b 46 60             	mov    0x60(%esi),%eax
   11aac:	89 c2                	mov    %eax,%edx
   11aae:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   11ab1:	8b 40 18             	mov    0x18(%eax),%eax
   11ab4:	83 c4 10             	add    $0x10,%esp
   11ab7:	8b 5a 08             	mov    0x8(%edx),%ebx
   11aba:	8b 78 10             	mov    0x10(%eax),%edi
   11abd:	85 db                	test   %ebx,%ebx
   11abf:	0f 84 01 01 00 00    	je     11bc6 <_NtfsDirectoryControl@8+0x1d6>
   11ac5:	8b 47 1c             	mov    0x1c(%edi),%eax
   11ac8:	85 c0                	test   %eax,%eax
   11aca:	0f 84 99 00 00 00    	je     11b69 <_NtfsDirectoryControl@8+0x179>
   11ad0:	8b 55 ec             	mov    0xffffffec(%ebp),%edx
   11ad3:	31 c0                	xor    %eax,%eax
   11ad5:	8a 42 02             	mov    0x2(%edx),%al
   11ad8:	a8 04                	test   $0x4,%al
   11ada:	74 67                	je     11b43 <_NtfsDirectoryControl@8+0x153>
   11adc:	8b 47 10             	mov    0x10(%edi),%eax
   11adf:	89 47 18             	mov    %eax,0x18(%edi)
   11ae2:	8b 56 04             	mov    0x4(%esi),%edx
   11ae5:	85 d2                	test   %edx,%edx
   11ae7:	74 08                	je     11af1 <_NtfsDirectoryControl@8+0x101>
   11ae9:	66 8b 42 06          	mov    0x6(%edx),%ax
   11aed:	a8 05                	test   $0x5,%al
   11aef:	74 65                	je     11b56 <_NtfsDirectoryControl@8+0x166>
   11af1:	b8 06 00 00 80       	mov    $0x80000006,%eax
   11af6:	89 c3                	mov    %eax,%ebx
   11af8:	c7 46 1c 00 00 00 00 	movl   $0x0,0x1c(%esi)
   11aff:	89 5e 18             	mov    %ebx,0x18(%esi)
   11b02:	50                   	push   %eax
   11b03:	50                   	push   %eax
   11b04:	6a 00                	push   $0x0
   11b06:	56                   	push   %esi
   11b07:	e8 c4 1f 00 00       	call   13ad0 <_IoCompleteRequest@8>
   11b0c:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11b0f:	89 d8                	mov    %ebx,%eax
   11b11:	5b                   	pop    %ebx
   11b12:	5e                   	pop    %esi
   11b13:	5f                   	pop    %edi
   11b14:	5d                   	pop    %ebp
   11b15:	c2 08 00             	ret    $0x8
   11b18:	50                   	push   %eax
   11b19:	68 b4 02 00 00       	push   $0x2b4
   11b1e:	68 00 42 01 00       	push   $0x14200
   11b23:	68 09 42 01 00       	push   $0x14209
   11b28:	e8 23 1f 00 00       	call   13a50 <_DbgPrint>
   11b2d:	c7 04 24 68 42 01 00 	movl   $0x14268,(%esp)
   11b34:	bb 02 00 00 c0       	mov    $0xc0000002,%ebx
   11b39:	e8 12 1f 00 00       	call   13a50 <_DbgPrint>
   11b3e:	e9 1e ff ff ff       	jmp    11a61 <_NtfsDirectoryControl@8+0x71>
   11b43:	80 7d f3 00          	cmpb   $0x0,0xfffffff3(%ebp)
   11b47:	75 04                	jne    11b4d <_NtfsDirectoryControl@8+0x15d>
   11b49:	a8 01                	test   $0x1,%al
   11b4b:	74 95                	je     11ae2 <_NtfsDirectoryControl@8+0xf2>
   11b4d:	c7 47 18 00 00 00 00 	movl   $0x0,0x18(%edi)
   11b54:	eb 8c                	jmp    11ae2 <_NtfsDirectoryControl@8+0xf2>
   11b56:	51                   	push   %ecx
   11b57:	51                   	push   %ecx
   11b58:	6a 00                	push   $0x0
   11b5a:	52                   	push   %edx
   11b5b:	e8 d0 1f 00 00       	call   13b30 <_MmMapLockedPages@8>
   11b60:	58                   	pop    %eax
   11b61:	b8 06 00 00 80       	mov    $0x80000006,%eax
   11b66:	5a                   	pop    %edx
   11b67:	eb 8d                	jmp    11af6 <_NtfsDirectoryControl@8+0x106>
   11b69:	c6 45 f3 01          	movb   $0x1,0xfffffff3(%ebp)
   11b6d:	50                   	push   %eax
   11b6e:	50                   	push   %eax
   11b6f:	66 8b 03             	mov    (%ebx),%ax
   11b72:	25 ff ff 00 00       	and    $0xffff,%eax
   11b77:	83 c0 02             	add    $0x2,%eax
   11b7a:	50                   	push   %eax
   11b7b:	6a 00                	push   $0x0
   11b7d:	e8 5e 1f 00 00       	call   13ae0 <_ExAllocatePool@8>
   11b82:	5a                   	pop    %edx
   11b83:	89 c2                	mov    %eax,%edx
   11b85:	59                   	pop    %ecx
   11b86:	85 d2                	test   %edx,%edx
   11b88:	89 47 1c             	mov    %eax,0x1c(%edi)
   11b8b:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11b90:	0f 84 60 ff ff ff    	je     11af6 <_NtfsDirectoryControl@8+0x106>
   11b96:	66 8b 03             	mov    (%ebx),%ax
   11b99:	25 ff ff 00 00       	and    $0xffff,%eax
   11b9e:	51                   	push   %ecx
   11b9f:	50                   	push   %eax
   11ba0:	8b 43 04             	mov    0x4(%ebx),%eax
   11ba3:	50                   	push   %eax
   11ba4:	52                   	push   %edx
   11ba5:	e8 96 1f 00 00       	call   13b40 <_memcpy>
   11baa:	66 8b 03             	mov    (%ebx),%ax
   11bad:	66 d1 e8             	shr    %ax
   11bb0:	8b 57 1c             	mov    0x1c(%edi),%edx
   11bb3:	25 ff ff 00 00       	and    $0xffff,%eax
   11bb8:	83 c4 10             	add    $0x10,%esp
   11bbb:	66 c7 04 42 00 00    	movw   $0x0,(%edx,%eax,2)
   11bc1:	e9 0a ff ff ff       	jmp    11ad0 <_NtfsDirectoryControl@8+0xe0>
   11bc6:	8b 5f 1c             	mov    0x1c(%edi),%ebx
   11bc9:	85 db                	test   %ebx,%ebx
   11bcb:	0f 85 ff fe ff ff    	jne    11ad0 <_NtfsDirectoryControl@8+0xe0>
   11bd1:	c6 45 f3 01          	movb   $0x1,0xfffffff3(%ebp)
   11bd5:	51                   	push   %ecx
   11bd6:	51                   	push   %ecx
   11bd7:	6a 04                	push   $0x4
   11bd9:	6a 00                	push   $0x0
   11bdb:	e8 00 1f 00 00       	call   13ae0 <_ExAllocatePool@8>
   11be0:	5b                   	pop    %ebx
   11be1:	5a                   	pop    %edx
   11be2:	89 c2                	mov    %eax,%edx
   11be4:	89 47 1c             	mov    %eax,0x1c(%edi)
   11be7:	85 d2                	test   %edx,%edx
   11be9:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11bee:	0f 84 02 ff ff ff    	je     11af6 <_NtfsDirectoryControl@8+0x106>
   11bf4:	66 c7 02 2a 00       	movw   $0x2a,(%edx)
   11bf9:	66 c7 42 02 00 00    	movw   $0x0,0x2(%edx)
   11bff:	e9 cc fe ff ff       	jmp    11ad0 <_NtfsDirectoryControl@8+0xe0>
   11c04:	90                   	nop    
   11c05:	90                   	nop    
   11c06:	90                   	nop    
   11c07:	90                   	nop    
   11c08:	90                   	nop    
   11c09:	90                   	nop    
   11c0a:	90                   	nop    
   11c0b:	90                   	nop    
   11c0c:	90                   	nop    
   11c0d:	90                   	nop    
   11c0e:	90                   	nop    
   11c0f:	90                   	nop    

00011c10 <_NtfsGetNextPathElement>:
   11c10:	55                   	push   %ebp
   11c11:	89 c1                	mov    %eax,%ecx
   11c13:	66 8b 10             	mov    (%eax),%dx
   11c16:	89 e5                	mov    %esp,%ebp
   11c18:	31 c0                	xor    %eax,%eax
   11c1a:	66 85 d2             	test   %dx,%dx
   11c1d:	74 24                	je     11c43 <_NtfsGetNextPathElement+0x33>
   11c1f:	66 83 fa 5c          	cmp    $0x5c,%dx
   11c23:	eb 1a                	jmp    11c3f <_NtfsGetNextPathElement+0x2f>
   11c25:	83 c1 02             	add    $0x2,%ecx
   11c28:	66 8b 01             	mov    (%ecx),%ax
   11c2b:	66 85 c0             	test   %ax,%ax
   11c2e:	0f 95 c2             	setne  %dl
   11c31:	66 83 f8 5c          	cmp    $0x5c,%ax
   11c35:	0f 95 c0             	setne  %al
   11c38:	25 ff 00 00 00       	and    $0xff,%eax
   11c3d:	85 c2                	test   %eax,%edx
   11c3f:	75 e4                	jne    11c25 <_NtfsGetNextPathElement+0x15>
   11c41:	89 c8                	mov    %ecx,%eax
   11c43:	5d                   	pop    %ebp
   11c44:	c3                   	ret    
   11c45:	8d 74 26 00          	lea    0x0(%esi),%esi
   11c49:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00011c50 <_NtfsWSubString>:
   11c50:	55                   	push   %ebp
   11c51:	89 e5                	mov    %esp,%ebp
   11c53:	56                   	push   %esi
   11c54:	53                   	push   %ebx
   11c55:	89 c3                	mov    %eax,%ebx
   11c57:	8b 75 08             	mov    0x8(%ebp),%esi
   11c5a:	50                   	push   %eax
   11c5b:	56                   	push   %esi
   11c5c:	52                   	push   %edx
   11c5d:	53                   	push   %ebx
   11c5e:	e8 8d 1f 00 00       	call   13bf0 <_wcsncpy>
   11c63:	66 c7 04 73 00 00    	movw   $0x0,(%ebx,%esi,2)
   11c69:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11c6c:	5b                   	pop    %ebx
   11c6d:	5e                   	pop    %esi
   11c6e:	5d                   	pop    %ebp
   11c6f:	c3                   	ret    

00011c70 <_NtfsCreateFCB>:
   11c70:	55                   	push   %ebp
   11c71:	89 e5                	mov    %esp,%ebp
   11c73:	56                   	push   %esi
   11c74:	53                   	push   %ebx
   11c75:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11c78:	56                   	push   %esi
   11c79:	68 49 46 43 42       	push   $0x42434649
   11c7e:	68 d0 02 00 00       	push   $0x2d0
   11c83:	6a 00                	push   $0x0
   11c85:	e8 c6 1e 00 00       	call   13b50 <_ExAllocatePoolWithTag@12>
   11c8a:	89 c6                	mov    %eax,%esi
   11c8c:	51                   	push   %ecx
   11c8d:	68 d0 02 00 00       	push   $0x2d0
   11c92:	50                   	push   %eax
   11c93:	e8 98 1d 00 00       	call   13a30 <_RtlZeroMemory@8>
   11c98:	85 db                	test   %ebx,%ebx
   11c9a:	58                   	pop    %eax
   11c9b:	5a                   	pop    %edx
   11c9c:	74 20                	je     11cbe <_NtfsCreateFCB+0x4e>
   11c9e:	50                   	push   %eax
   11c9f:	50                   	push   %eax
   11ca0:	53                   	push   %ebx
   11ca1:	8d 5e 40             	lea    0x40(%esi),%ebx
   11ca4:	53                   	push   %ebx
   11ca5:	e8 66 1e 00 00       	call   13b10 <_wcscpy>
   11caa:	59                   	pop    %ecx
   11cab:	58                   	pop    %eax
   11cac:	6a 5c                	push   $0x5c
   11cae:	53                   	push   %ebx
   11caf:	e8 2c 1f 00 00       	call   13be0 <_wcsrchr>
   11cb4:	83 c4 10             	add    $0x10,%esp
   11cb7:	85 c0                	test   %eax,%eax
   11cb9:	75 1b                	jne    11cd6 <_NtfsCreateFCB+0x66>
   11cbb:	89 5e 3c             	mov    %ebx,0x3c(%esi)
   11cbe:	83 ec 0c             	sub    $0xc,%esp
   11cc1:	8d 86 80 02 00 00    	lea    0x280(%esi),%eax
   11cc7:	50                   	push   %eax
   11cc8:	e8 93 1e 00 00       	call   13b60 <_ExInitializeResourceLite@4>
   11ccd:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11cd0:	89 f0                	mov    %esi,%eax
   11cd2:	5b                   	pop    %ebx
   11cd3:	5e                   	pop    %esi
   11cd4:	5d                   	pop    %ebp
   11cd5:	c3                   	ret    
   11cd6:	52                   	push   %edx
   11cd7:	52                   	push   %edx
   11cd8:	6a 5c                	push   $0x5c
   11cda:	53                   	push   %ebx
   11cdb:	e8 00 1f 00 00       	call   13be0 <_wcsrchr>
   11ce0:	83 c4 10             	add    $0x10,%esp
   11ce3:	83 ec 0c             	sub    $0xc,%esp
   11ce6:	89 46 3c             	mov    %eax,0x3c(%esi)
   11ce9:	8d 86 80 02 00 00    	lea    0x280(%esi),%eax
   11cef:	50                   	push   %eax
   11cf0:	e8 6b 1e 00 00       	call   13b60 <_ExInitializeResourceLite@4>
   11cf5:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11cf8:	89 f0                	mov    %esi,%eax
   11cfa:	5b                   	pop    %ebx
   11cfb:	5e                   	pop    %esi
   11cfc:	5d                   	pop    %ebp
   11cfd:	c3                   	ret    
   11cfe:	89 f6                	mov    %esi,%esi

00011d00 <_NtfsDestroyFCB>:
   11d00:	55                   	push   %ebp
   11d01:	89 e5                	mov    %esp,%ebp
   11d03:	53                   	push   %ebx
   11d04:	83 ec 10             	sub    $0x10,%esp
   11d07:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11d0a:	8d 83 80 02 00 00    	lea    0x280(%ebx),%eax
   11d10:	50                   	push   %eax
   11d11:	e8 5a 1e 00 00       	call   13b70 <_ExDeleteResourceLite@4>
   11d16:	53                   	push   %ebx
   11d17:	e8 64 1e 00 00       	call   13b80 <_ExFreePool@4>
   11d1c:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   11d1f:	c9                   	leave  
   11d20:	c3                   	ret    
   11d21:	eb 0d                	jmp    11d30 <_NtfsFCBIsDirectory>
   11d23:	90                   	nop    
   11d24:	90                   	nop    
   11d25:	90                   	nop    
   11d26:	90                   	nop    
   11d27:	90                   	nop    
   11d28:	90                   	nop    
   11d29:	90                   	nop    
   11d2a:	90                   	nop    
   11d2b:	90                   	nop    
   11d2c:	90                   	nop    
   11d2d:	90                   	nop    
   11d2e:	90                   	nop    
   11d2f:	90                   	nop    

00011d30 <_NtfsFCBIsDirectory>:
   11d30:	55                   	push   %ebp
   11d31:	b8 01 00 00 00       	mov    $0x1,%eax
   11d36:	89 e5                	mov    %esp,%ebp
   11d38:	5d                   	pop    %ebp
   11d39:	c3                   	ret    
   11d3a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

00011d40 <_NtfsFCBIsRoot>:
   11d40:	55                   	push   %ebp
   11d41:	89 e5                	mov    %esp,%ebp
   11d43:	83 ec 10             	sub    $0x10,%esp
   11d46:	8b 45 08             	mov    0x8(%ebp),%eax
   11d49:	68 90 42 01 00       	push   $0x14290
   11d4e:	83 c0 40             	add    $0x40,%eax
   11d51:	50                   	push   %eax
   11d52:	e8 79 1e 00 00       	call   13bd0 <_wcscmp>
   11d57:	83 c4 10             	add    $0x10,%esp
   11d5a:	85 c0                	test   %eax,%eax
   11d5c:	0f 94 c0             	sete   %al
   11d5f:	25 ff 00 00 00       	and    $0xff,%eax
   11d64:	c9                   	leave  
   11d65:	c3                   	ret    
   11d66:	8d 76 00             	lea    0x0(%esi),%esi
   11d69:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00011d70 <_NtfsGrabFCB>:
   11d70:	55                   	push   %ebp
   11d71:	89 e5                	mov    %esp,%ebp
   11d73:	56                   	push   %esi
   11d74:	53                   	push   %ebx
   11d75:	83 ec 18             	sub    $0x18,%esp
   11d78:	8d 45 f7             	lea    0xfffffff7(%ebp),%eax
   11d7b:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11d7e:	8b 75 0c             	mov    0xc(%ebp),%esi
   11d81:	83 c3 38             	add    $0x38,%ebx
   11d84:	50                   	push   %eax
   11d85:	53                   	push   %ebx
   11d86:	e8 c5 1e 00 00       	call   13c50 <_KeAcquireSpinLock@8>
   11d8b:	8b 86 c8 02 00 00    	mov    0x2c8(%esi),%eax
   11d91:	40                   	inc    %eax
   11d92:	89 86 c8 02 00 00    	mov    %eax,0x2c8(%esi)
   11d98:	31 c0                	xor    %eax,%eax
   11d9a:	8a 45 f7             	mov    0xfffffff7(%ebp),%al
   11d9d:	50                   	push   %eax
   11d9e:	53                   	push   %ebx
   11d9f:	e8 bc 1e 00 00       	call   13c60 <_KeReleaseSpinLock@8>
   11da4:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11da7:	5b                   	pop    %ebx
   11da8:	5e                   	pop    %esi
   11da9:	5d                   	pop    %ebp
   11daa:	c3                   	ret    
   11dab:	90                   	nop    
   11dac:	8d 74 26 00          	lea    0x0(%esi),%esi

00011db0 <_NtfsReleaseFCB>:
   11db0:	55                   	push   %ebp
   11db1:	89 e5                	mov    %esp,%ebp
   11db3:	56                   	push   %esi
   11db4:	53                   	push   %ebx
   11db5:	83 ec 18             	sub    $0x18,%esp
   11db8:	8d 45 f7             	lea    0xfffffff7(%ebp),%eax
   11dbb:	8b 75 08             	mov    0x8(%ebp),%esi
   11dbe:	8b 5d 0c             	mov    0xc(%ebp),%ebx
   11dc1:	83 c6 38             	add    $0x38,%esi
   11dc4:	50                   	push   %eax
   11dc5:	56                   	push   %esi
   11dc6:	e8 85 1e 00 00       	call   13c50 <_KeAcquireSpinLock@8>
   11dcb:	8b 83 c8 02 00 00    	mov    0x2c8(%ebx),%eax
   11dd1:	48                   	dec    %eax
   11dd2:	89 83 c8 02 00 00    	mov    %eax,0x2c8(%ebx)
   11dd8:	85 c0                	test   %eax,%eax
   11dda:	59                   	pop    %ecx
   11ddb:	5a                   	pop    %edx
   11ddc:	7e 15                	jle    11df3 <_NtfsReleaseFCB+0x43>
   11dde:	50                   	push   %eax
   11ddf:	50                   	push   %eax
   11de0:	31 c0                	xor    %eax,%eax
   11de2:	8a 45 f7             	mov    0xfffffff7(%ebp),%al
   11de5:	50                   	push   %eax
   11de6:	56                   	push   %esi
   11de7:	e8 74 1e 00 00       	call   13c60 <_KeReleaseSpinLock@8>
   11dec:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11def:	5b                   	pop    %ebx
   11df0:	5e                   	pop    %esi
   11df1:	5d                   	pop    %ebp
   11df2:	c3                   	ret    
   11df3:	53                   	push   %ebx
   11df4:	e8 37 ff ff ff       	call   11d30 <_NtfsFCBIsDirectory>
   11df9:	5a                   	pop    %edx
   11dfa:	84 c0                	test   %al,%al
   11dfc:	75 e0                	jne    11dde <_NtfsReleaseFCB+0x2e>
{
  PLIST_ENTRY OldFlink;
  PLIST_ENTRY OldBlink;

  OldFlink = Entry->Flink;
   11dfe:	8b 93 b8 02 00 00    	mov    0x2b8(%ebx),%edx
  OldBlink = Entry->Blink;
   11e04:	8b 83 bc 02 00 00    	mov    0x2bc(%ebx),%eax
}


BOOLEAN
NtfsFCBIsDirectory(PFCB Fcb)
{
//  return(Fcb->entry.Attrib & FILE_ATTRIBUTE_DIRECTORY);
//  return(Fcb->Entry.FileFlags & 0x02);
  return(TRUE);
}


BOOLEAN
NtfsFCBIsRoot(PFCB Fcb)
{
  return(wcscmp(Fcb->PathName, L"\\") == 0);
}


VOID
NtfsGrabFCB(PDEVICE_EXTENSION Vcb,
	    PFCB Fcb)
{
  KIRQL  oldIrql;

  DPRINT("grabbing FCB at %x: %S, refCount:%d\n",
	 Fcb,
	 Fcb->PathName,
	 Fcb->RefCount);

  KeAcquireSpinLock(&Vcb->FcbListLock, &oldIrql);
  Fcb->RefCount++;
  KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
}


VOID
NtfsReleaseFCB(PDEVICE_EXTENSION Vcb,
	       PFCB Fcb)
{
  KIRQL  oldIrql;

  DPRINT("releasing FCB at %x: %S, refCount:%d\n",
	 Fcb,
	 Fcb->PathName,
	 Fcb->RefCount);

  KeAcquireSpinLock(&Vcb->FcbListLock, &oldIrql);
  Fcb->RefCount--;
  if (Fcb->RefCount <= 0 && !NtfsFCBIsDirectory(Fcb))
    {
      RemoveEntryList(&Fcb->FcbListEntry);
#ifdef USE_ROS_CC_AND_FS
      CcRosReleaseFileCache(Fcb->FileObject);
   11e0a:	83 ec 0c             	sub    $0xc,%esp
  PLIST_ENTRY OldBlink;

  OldFlink = Entry->Flink;
  OldBlink = Entry->Blink;
  OldFlink->Blink = OldBlink;
   11e0d:	89 42 04             	mov    %eax,0x4(%edx)
  OldBlink->Flink = OldFlink;
   11e10:	89 10                	mov    %edx,(%eax)
   11e12:	8b 43 34             	mov    0x34(%ebx),%eax
   11e15:	50                   	push   %eax
   11e16:	e8 75 1d 00 00       	call   13b90 <_CcRosReleaseFileCache@4>
#else
      CcUninitializeCacheMap (Fcb->FileObject, NULL, NULL);
#endif
      NtfsDestroyFCB(Fcb);
   11e1b:	53                   	push   %ebx
   11e1c:	e8 df fe ff ff       	call   11d00 <_NtfsDestroyFCB>
   11e21:	83 c4 10             	add    $0x10,%esp
   11e24:	eb b8                	jmp    11dde <_NtfsReleaseFCB+0x2e>
   11e26:	8d 76 00             	lea    0x0(%esi),%esi
   11e29:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00011e30 <_NtfsAddFCBToTable>:
    }
  KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
}


VOID
NtfsAddFCBToTable(PDEVICE_EXTENSION Vcb,
		  PFCB Fcb)
{
   11e30:	55                   	push   %ebp
   11e31:	89 e5                	mov    %esp,%ebp
   11e33:	57                   	push   %edi
   11e34:	56                   	push   %esi
   11e35:	53                   	push   %ebx
   11e36:	83 ec 14             	sub    $0x14,%esp
  KIRQL  oldIrql;

  KeAcquireSpinLock(&Vcb->FcbListLock, &oldIrql);
   11e39:	8d 45 f3             	lea    0xfffffff3(%ebp),%eax
   11e3c:	8b 5d 08             	mov    0x8(%ebp),%ebx
   11e3f:	8b 75 0c             	mov    0xc(%ebp),%esi
   11e42:	50                   	push   %eax
   11e43:	8d 7b 38             	lea    0x38(%ebx),%edi
   11e46:	57                   	push   %edi
   11e47:	e8 04 1e 00 00       	call   13c50 <_KeAcquireSpinLock@8>
  Fcb->DevExt = Vcb;
   11e4c:	89 5e 38             	mov    %ebx,0x38(%esi)
static __inline VOID
InsertTailList(
	IN PLIST_ENTRY  ListHead,
	IN PLIST_ENTRY  Entry)
{
   11e4f:	83 c3 3c             	add    $0x3c,%ebx
   11e52:	8d 86 b8 02 00 00    	lea    0x2b8(%esi),%eax
	PLIST_ENTRY OldBlink;
	OldBlink = ListHead->Blink;
	Entry->Flink = ListHead;
   11e58:	89 9e b8 02 00 00    	mov    %ebx,0x2b8(%esi)
   11e5e:	8b 53 04             	mov    0x4(%ebx),%edx
	Entry->Blink = OldBlink;
   11e61:	89 50 04             	mov    %edx,0x4(%eax)
	OldBlink->Flink = Entry;
	ListHead->Blink = Entry;
   11e64:	89 43 04             	mov    %eax,0x4(%ebx)
   11e67:	89 02                	mov    %eax,(%edx)
  InsertTailList(&Vcb->FcbListHead, &Fcb->FcbListEntry);
  KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
   11e69:	31 c0                	xor    %eax,%eax
   11e6b:	8a 45 f3             	mov    0xfffffff3(%ebp),%al
   11e6e:	50                   	push   %eax
   11e6f:	57                   	push   %edi
   11e70:	e8 eb 1d 00 00       	call   13c60 <_KeReleaseSpinLock@8>
   11e75:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11e78:	5b                   	pop    %ebx
   11e79:	5e                   	pop    %esi
   11e7a:	5f                   	pop    %edi
   11e7b:	5d                   	pop    %ebp
   11e7c:	c3                   	ret    
   11e7d:	8d 76 00             	lea    0x0(%esi),%esi

00011e80 <_NtfsGrabFCBFromTable>:
}


PFCB
NtfsGrabFCBFromTable(PDEVICE_EXTENSION Vcb,
		     PWSTR FileName)
{
   11e80:	55                   	push   %ebp
   11e81:	89 e5                	mov    %esp,%ebp
   11e83:	57                   	push   %edi
   11e84:	56                   	push   %esi
   11e85:	53                   	push   %ebx
   11e86:	83 ec 14             	sub    $0x14,%esp
  KIRQL  oldIrql;
  PFCB Fcb;
  PLIST_ENTRY  current_entry;

  KeAcquireSpinLock(&Vcb->FcbListLock, &oldIrql);
   11e89:	8d 45 f3             	lea    0xfffffff3(%ebp),%eax
   11e8c:	8b 75 08             	mov    0x8(%ebp),%esi
   11e8f:	50                   	push   %eax
   11e90:	8d 46 38             	lea    0x38(%esi),%eax
   11e93:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   11e96:	50                   	push   %eax
   11e97:	e8 b4 1d 00 00       	call   13c50 <_KeAcquireSpinLock@8>

  if (FileName == NULL || *FileName == 0)
   11e9c:	8b 45 0c             	mov    0xc(%ebp),%eax
   11e9f:	5a                   	pop    %edx
   11ea0:	85 c0                	test   %eax,%eax
   11ea2:	59                   	pop    %ecx
   11ea3:	74 51                	je     11ef6 <_NtfsGrabFCBFromTable+0x76>
   11ea5:	8b 45 0c             	mov    0xc(%ebp),%eax
   11ea8:	66 83 38 00          	cmpw   $0x0,(%eax)
   11eac:	74 48                	je     11ef6 <_NtfsGrabFCBFromTable+0x76>
    {
      DPRINT("Return FCB for stream file object\n");
      Fcb = Vcb->StreamFileObject->FsContext;
      Fcb->RefCount++;
      KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
      return(Fcb);
    }

  current_entry = Vcb->FcbListHead.Flink;
   11eae:	8b 5e 3c             	mov    0x3c(%esi),%ebx
  while (current_entry != &Vcb->FcbListHead)
    {
      Fcb = CONTAINING_RECORD(current_entry, FCB, FcbListEntry);

      DPRINT("Comparing '%S' and '%S'\n", FileName, Fcb->PathName);
      if (_wcsicmp(FileName, Fcb->PathName) == 0)
	{
	  Fcb->RefCount++;
	  KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
	  return(Fcb);
	}

      //FIXME: need to compare against short name in FCB here

      current_entry = current_entry->Flink;
   11eb1:	8d 7e 3c             	lea    0x3c(%esi),%edi
   11eb4:	eb 21                	jmp    11ed7 <_NtfsGrabFCBFromTable+0x57>
   11eb6:	50                   	push   %eax
   11eb7:	50                   	push   %eax
   11eb8:	8d 83 88 fd ff ff    	lea    0xfffffd88(%ebx),%eax
   11ebe:	50                   	push   %eax
   11ebf:	8d b3 48 fd ff ff    	lea    0xfffffd48(%ebx),%esi
   11ec5:	8b 45 0c             	mov    0xc(%ebp),%eax
   11ec8:	50                   	push   %eax
   11ec9:	e8 32 1d 00 00       	call   13c00 <__wcsicmp>
   11ece:	83 c4 10             	add    $0x10,%esp
   11ed1:	85 c0                	test   %eax,%eax
   11ed3:	74 27                	je     11efc <_NtfsGrabFCBFromTable+0x7c>
   11ed5:	8b 1b                	mov    (%ebx),%ebx
   11ed7:	39 df                	cmp    %ebx,%edi
   11ed9:	75 db                	jne    11eb6 <_NtfsGrabFCBFromTable+0x36>
    }
  KeReleaseSpinLock(&Vcb->FcbListLock, oldIrql);
   11edb:	31 c0                	xor    %eax,%eax
   11edd:	53                   	push   %ebx
   11ede:	53                   	push   %ebx
   11edf:	8a 45 f3             	mov    0xfffffff3(%ebp),%al
   11ee2:	50                   	push   %eax
   11ee3:	8b 4d ec             	mov    0xffffffec(%ebp),%ecx
   11ee6:	51                   	push   %ecx
   11ee7:	e8 74 1d 00 00       	call   13c60 <_KeReleaseSpinLock@8>

  return(NULL);
}
   11eec:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11eef:	31 c0                	xor    %eax,%eax
   11ef1:	5b                   	pop    %ebx
   11ef2:	5e                   	pop    %esi
   11ef3:	5f                   	pop    %edi
   11ef4:	5d                   	pop    %ebp
   11ef5:	c3                   	ret    
   11ef6:	8b 46 4c             	mov    0x4c(%esi),%eax
   11ef9:	8b 70 0c             	mov    0xc(%eax),%esi
   11efc:	8b 86 c8 02 00 00    	mov    0x2c8(%esi),%eax
   11f02:	40                   	inc    %eax
   11f03:	89 86 c8 02 00 00    	mov    %eax,0x2c8(%esi)
   11f09:	50                   	push   %eax
   11f0a:	50                   	push   %eax
   11f0b:	31 c0                	xor    %eax,%eax
   11f0d:	8a 45 f3             	mov    0xfffffff3(%ebp),%al
   11f10:	50                   	push   %eax
   11f11:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   11f14:	50                   	push   %eax
   11f15:	e8 46 1d 00 00       	call   13c60 <_KeReleaseSpinLock@8>
   11f1a:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11f1d:	89 f0                	mov    %esi,%eax
   11f1f:	5b                   	pop    %ebx
   11f20:	5e                   	pop    %esi
   11f21:	5f                   	pop    %edi
   11f22:	5d                   	pop    %ebp
   11f23:	c3                   	ret    
   11f24:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   11f2a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

00011f30 <_NtfsFCBInitializeCache>:


NTSTATUS
NtfsFCBInitializeCache(PVCB Vcb,
		       PFCB Fcb)
{
   11f30:	55                   	push   %ebp
   11f31:	89 e5                	mov    %esp,%ebp
   11f33:	57                   	push   %edi
   11f34:	56                   	push   %esi
   11f35:	53                   	push   %ebx
   11f36:	83 ec 14             	sub    $0x14,%esp
  PFILE_OBJECT FileObject;
  NTSTATUS Status;
  PCCB  newCCB;

  FileObject = IoCreateStreamFileObject(NULL, Vcb->StorageDevice);
   11f39:	8b 45 08             	mov    0x8(%ebp),%eax
   11f3c:	8b 7d 0c             	mov    0xc(%ebp),%edi
   11f3f:	8b 40 48             	mov    0x48(%eax),%eax
   11f42:	50                   	push   %eax
   11f43:	6a 00                	push   $0x0
   11f45:	e8 56 1c 00 00       	call   13ba0 <_IoCreateStreamFileObject@8>
   11f4a:	89 c3                	mov    %eax,%ebx

  newCCB = ExAllocatePoolWithTag(NonPagedPool, sizeof(CCB), TAG_CCB);
   11f4c:	c7 04 24 49 43 43 42 	movl   $0x42434349,(%esp)
   11f53:	6a 28                	push   $0x28
   11f55:	6a 00                	push   $0x0
   11f57:	e8 f4 1b 00 00       	call   13b50 <_ExAllocatePoolWithTag@12>
   11f5c:	89 c6                	mov    %eax,%esi
  if (newCCB == NULL)
   11f5e:	58                   	pop    %eax
   11f5f:	85 f6                	test   %esi,%esi
    {
      return(STATUS_INSUFFICIENT_RESOURCES);
   11f61:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11f66:	74 4e                	je     11fb6 <_NtfsFCBInitializeCache+0x86>
    }
  RtlZeroMemory(newCCB,
   11f68:	50                   	push   %eax
   11f69:	50                   	push   %eax
   11f6a:	6a 28                	push   $0x28
   11f6c:	56                   	push   %esi
   11f6d:	e8 be 1a 00 00       	call   13a30 <_RtlZeroMemory@8>
		sizeof(CCB));

  FileObject->SectionObjectPointer = &Fcb->SectionObjectPointers;
   11f72:	8d 47 28             	lea    0x28(%edi),%eax
  FileObject->FsContext = Fcb;
  FileObject->FsContext2 = newCCB;
  newCCB->PtrFileObject = FileObject;
   11f75:	89 5e 08             	mov    %ebx,0x8(%esi)
   11f78:	89 43 14             	mov    %eax,0x14(%ebx)
  Fcb->FileObject = FileObject;
  Fcb->DevExt = Vcb;
   11f7b:	8b 45 08             	mov    0x8(%ebp),%eax
   11f7e:	89 73 10             	mov    %esi,0x10(%ebx)
   11f81:	89 7b 0c             	mov    %edi,0xc(%ebx)
   11f84:	89 5f 34             	mov    %ebx,0x34(%edi)
   11f87:	89 47 38             	mov    %eax,0x38(%edi)
#ifdef ROS_USE_CC_AND_FS
  Status = CcRosInitializeFileCache(FileObject,
				    CACHEPAGESIZE(Vcb));
  if (!NT_SUCCESS(Status))
    {
      DbgPrint("CcRosInitializeFileCache failed\n");
      KEBUGCHECK(0);
    }
#else
  Status = STATUS_SUCCESS;
  CcInitializeCacheMap(FileObject,
   11f8a:	8d 47 10             	lea    0x10(%edi),%eax
   11f8d:	56                   	push   %esi
   11f8e:	6a 00                	push   $0x0
   11f90:	6a 00                	push   $0x0
   11f92:	6a 00                	push   $0x0
   11f94:	50                   	push   %eax
   11f95:	53                   	push   %ebx
   11f96:	e8 15 1c 00 00       	call   13bb0 <_CcInitializeCacheMap@20>
                       (PCC_FILE_SIZES)(&Fcb->RFCB.AllocationSize),
                       FALSE,
                       NULL,
                       NULL);
#endif
  ObDereferenceObject(FileObject);
   11f9b:	89 d9                	mov    %ebx,%ecx
   11f9d:	83 c4 0c             	add    $0xc,%esp
   11fa0:	e8 1b 1c 00 00       	call   13bc0 <@ObfDereferenceObject@4>
  Fcb->Flags |= FCB_CACHE_INITIALIZED;
   11fa5:	8b 9f cc 02 00 00    	mov    0x2cc(%edi),%ebx
   11fab:	83 cb 01             	or     $0x1,%ebx

  return(Status);
   11fae:	31 c0                	xor    %eax,%eax
   11fb0:	89 9f cc 02 00 00    	mov    %ebx,0x2cc(%edi)
}
   11fb6:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11fb9:	5b                   	pop    %ebx
   11fba:	5e                   	pop    %esi
   11fbb:	5f                   	pop    %edi
   11fbc:	5d                   	pop    %ebp
   11fbd:	c3                   	ret    
   11fbe:	89 f6                	mov    %esi,%esi

00011fc0 <_NtfsMakeRootFCB>:


PFCB
NtfsMakeRootFCB(PDEVICE_EXTENSION Vcb)
{
   11fc0:	55                   	push   %ebp
   11fc1:	89 e5                	mov    %esp,%ebp
   11fc3:	56                   	push   %esi
   11fc4:	53                   	push   %ebx
  PFCB Fcb;

  Fcb = NtfsCreateFCB(L"\\");
   11fc5:	83 ec 0c             	sub    $0xc,%esp
   11fc8:	8b 75 08             	mov    0x8(%ebp),%esi
   11fcb:	68 90 42 01 00       	push   $0x14290
   11fd0:	e8 9b fc ff ff       	call   11c70 <_NtfsCreateFCB>
   11fd5:	89 c3                	mov    %eax,%ebx

//  memset(Fcb->entry.Filename, ' ', 11);

//  Fcb->Entry.DataLengthL = Vcb->CdInfo.RootSize;
//  Fcb->Entry.ExtentLocationL = Vcb->CdInfo.RootStart;
//  Fcb->Entry.FileFlags = 0x02; // FILE_ATTRIBUTE_DIRECTORY;
  Fcb->RefCount = 1;
   11fd7:	c7 80 c8 02 00 00 01 	movl   $0x1,0x2c8(%eax)
   11fde:	00 00 00 
  Fcb->DirIndex = 0;
   11fe1:	c7 80 c4 02 00 00 00 	movl   $0x0,0x2c4(%eax)
   11fe8:	00 00 00 
  Fcb->RFCB.FileSize.QuadPart = PAGE_SIZE;//Vcb->CdInfo.RootSize;
   11feb:	c7 40 18 00 10 00 00 	movl   $0x1000,0x18(%eax)
   11ff2:	c7 40 1c 00 00 00 00 	movl   $0x0,0x1c(%eax)
  Fcb->RFCB.ValidDataLength.QuadPart = PAGE_SIZE;//Vcb->CdInfo.RootSize;
   11ff9:	c7 40 20 00 10 00 00 	movl   $0x1000,0x20(%eax)
   12000:	c7 40 24 00 00 00 00 	movl   $0x0,0x24(%eax)
  Fcb->RFCB.AllocationSize.QuadPart = PAGE_SIZE;//Vcb->CdInfo.RootSize;
   12007:	c7 40 10 00 10 00 00 	movl   $0x1000,0x10(%eax)
   1200e:	c7 40 14 00 00 00 00 	movl   $0x0,0x14(%eax)

  NtfsFCBInitializeCache(Vcb, Fcb);
   12015:	58                   	pop    %eax
   12016:	5a                   	pop    %edx
   12017:	53                   	push   %ebx
   12018:	56                   	push   %esi
   12019:	e8 12 ff ff ff       	call   11f30 <_NtfsFCBInitializeCache>
  NtfsAddFCBToTable(Vcb, Fcb);
   1201e:	59                   	pop    %ecx
   1201f:	58                   	pop    %eax
   12020:	53                   	push   %ebx
   12021:	56                   	push   %esi
   12022:	e8 09 fe ff ff       	call   11e30 <_NtfsAddFCBToTable>
  NtfsGrabFCB(Vcb, Fcb);
   12027:	58                   	pop    %eax
   12028:	5a                   	pop    %edx
   12029:	53                   	push   %ebx
   1202a:	56                   	push   %esi
   1202b:	e8 40 fd ff ff       	call   11d70 <_NtfsGrabFCB>

  return(Fcb);
}
   12030:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   12033:	89 d8                	mov    %ebx,%eax
   12035:	5b                   	pop    %ebx
   12036:	5e                   	pop    %esi
   12037:	5d                   	pop    %ebp
   12038:	c3                   	ret    
   12039:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00012040 <_NtfsOpenRootFCB>:


PFCB
NtfsOpenRootFCB(PDEVICE_EXTENSION Vcb)
{
   12040:	55                   	push   %ebp
   12041:	89 e5                	mov    %esp,%ebp
   12043:	53                   	push   %ebx
   12044:	83 ec 0c             	sub    $0xc,%esp
   12047:	8b 5d 08             	mov    0x8(%ebp),%ebx
  PFCB Fcb;

  Fcb = NtfsGrabFCBFromTable(Vcb, L"\\");
   1204a:	68 90 42 01 00       	push   $0x14290
   1204f:	53                   	push   %ebx
   12050:	e8 2b fe ff ff       	call   11e80 <_NtfsGrabFCBFromTable>
  if (Fcb == NULL)
   12055:	83 c4 10             	add    $0x10,%esp
   12058:	85 c0                	test   %eax,%eax
   1205a:	74 05                	je     12061 <_NtfsOpenRootFCB+0x21>
    {
      Fcb = NtfsMakeRootFCB(Vcb);
    }

  return(Fcb);
}
   1205c:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   1205f:	c9                   	leave  
   12060:	c3                   	ret    
   12061:	83 ec 0c             	sub    $0xc,%esp
   12064:	53                   	push   %ebx
   12065:	e8 56 ff ff ff       	call   11fc0 <_NtfsMakeRootFCB>
   1206a:	83 c4 10             	add    $0x10,%esp
   1206d:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   12070:	c9                   	leave  
   12071:	c3                   	ret    
   12072:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   12079:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00012080 <_NtfsAttachFCBToFileObject>:


#if 0
static VOID
NtfsGetDirEntryName(PDEVICE_EXTENSION DeviceExt,
		    PDIR_RECORD Record,
		    PWSTR Name)
/*
 * FUNCTION: Retrieves the file name, be it in short or long file name format
 */
{
  if (Record->FileIdLength == 1 && Record->FileId[0] == 0)
    {
      wcscpy(Name, L".");
    }
  else if (Record->FileIdLength == 1 && Record->FileId[0] == 1)
    {
      wcscpy(Name, L"..");
    }
  else
    {
      if (DeviceExt->CdInfo.JolietLevel == 0)
	{
	  ULONG i;

	  for (i = 0; i < Record->FileIdLength && Record->FileId[i] != ';'; i++)
	    Name[i] = (WCHAR)Record->FileId[i];
	  Name[i] = 0;
	}
      else
	{
	  NtfsSwapString(Name, Record->FileId, Record->FileIdLength);
	}
    }

  DPRINT("Name '%S'\n", Name);
}


NTSTATUS
NtfsMakeFCBFromDirEntry(PVCB Vcb,
			PFCB DirectoryFCB,
			PWSTR Name,
			PDIR_RECORD Record,
			PFCB * fileFCB)
{
  WCHAR pathName[MAX_PATH];
  PFCB rcFCB;
  ULONG Size;

  if (Name [0] != 0 && wcslen (DirectoryFCB->PathName) +
        sizeof(WCHAR) + wcslen (Name) > MAX_PATH)
    {
      return(STATUS_OBJECT_NAME_INVALID);
    }

  wcscpy(pathName, DirectoryFCB->PathName);
  if (!NtfsFCBIsRoot(DirectoryFCB))
    {
      wcscat(pathName, L"\\");
    }

  if (Name[0] != 0)
    {
      wcscat(pathName, Name);
    }
  else
    {
      WCHAR entryName[MAX_PATH];

      NtfsGetDirEntryName(Vcb, Record, entryName);
      wcscat(pathName, entryName);
    }

  rcFCB = NtfsCreateFCB(pathName);
  memcpy(&rcFCB->Entry, Record, sizeof(DIR_RECORD));

  Size = rcFCB->Entry.DataLengthL;

  rcFCB->RFCB.FileSize.QuadPart = Size;
  rcFCB->RFCB.ValidDataLength.QuadPart = Size;
  rcFCB->RFCB.AllocationSize.QuadPart = ROUND_UP(Size, BLOCKSIZE);
//  DPRINT1("%S %d %d\n", longName, Size, (ULONG)rcFCB->RFCB.AllocationSize.QuadPart);
  NtfsFCBInitializeCache(Vcb, rcFCB);
  rcFCB->RefCount++;
  NtfsAddFCBToTable(Vcb, rcFCB);
  *fileFCB = rcFCB;

  return(STATUS_SUCCESS);
}
#endif


NTSTATUS
NtfsAttachFCBToFileObject(PDEVICE_EXTENSION Vcb,
			  PFCB Fcb,
			  PFILE_OBJECT FileObject)
{
   12080:	55                   	push   %ebp
   12081:	89 e5                	mov    %esp,%ebp
   12083:	57                   	push   %edi
   12084:	56                   	push   %esi
   12085:	53                   	push   %ebx
   12086:	83 ec 10             	sub    $0x10,%esp
   12089:	8b 5d 0c             	mov    0xc(%ebp),%ebx
   1208c:	8b 75 10             	mov    0x10(%ebp),%esi
  PCCB  newCCB;

  newCCB = ExAllocatePoolWithTag(NonPagedPool, sizeof(CCB), TAG_CCB);
   1208f:	68 49 43 43 42       	push   $0x42434349
   12094:	6a 28                	push   $0x28
   12096:	6a 00                	push   $0x0
   12098:	e8 b3 1a 00 00       	call   13b50 <_ExAllocatePoolWithTag@12>
   1209d:	89 c2                	mov    %eax,%edx
  if (newCCB == NULL)
   1209f:	5f                   	pop    %edi
    {
      return(STATUS_INSUFFICIENT_RESOURCES);
   120a0:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   120a5:	85 d2                	test   %edx,%edx
   120a7:	74 2c                	je     120d5 <_NtfsAttachFCBToFileObject+0x55>
    }
  memset(newCCB, 0, sizeof(CCB));
   120a9:	fc                   	cld    
   120aa:	31 c0                	xor    %eax,%eax
   120ac:	b9 0a 00 00 00       	mov    $0xa,%ecx
   120b1:	89 d7                	mov    %edx,%edi
   120b3:	f3 ab                	repz stos %eax,%es:(%edi)

  FileObject->SectionObjectPointer = &Fcb->SectionObjectPointers;
   120b5:	8d 43 28             	lea    0x28(%ebx),%eax
  FileObject->FsContext = Fcb;
   120b8:	89 5e 0c             	mov    %ebx,0xc(%esi)
   120bb:	89 46 14             	mov    %eax,0x14(%esi)
  FileObject->FsContext2 = newCCB;
  newCCB->PtrFileObject = FileObject;
  Fcb->DevExt = Vcb;
   120be:	8b 45 08             	mov    0x8(%ebp),%eax
   120c1:	89 56 10             	mov    %edx,0x10(%esi)
   120c4:	89 72 08             	mov    %esi,0x8(%edx)
   120c7:	89 43 38             	mov    %eax,0x38(%ebx)

  if (!(Fcb->Flags & FCB_CACHE_INITIALIZED))
   120ca:	f6 83 cc 02 00 00 01 	testb  $0x1,0x2cc(%ebx)
   120d1:	74 0d                	je     120e0 <_NtfsAttachFCBToFileObject+0x60>
    {
#ifdef ROS_USE_CC_AND_FS
      NTSTATUS Status;
      Status = CcRosInitializeFileCache(FileObject,
					CACHEPAGESIZE(Vcb));
      if (!NT_SUCCESS(Status))
	{
	  DbgPrint("CcRosInitializeFileCache failed\n");
	  KEBUGCHECK(0);
	}
#else
  CcInitializeCacheMap(FileObject,
                       (PCC_FILE_SIZES)(&Fcb->RFCB.AllocationSize),
                       FALSE,
                       NULL,
                       NULL);
#endif
      Fcb->Flags |= FCB_CACHE_INITIALIZED;
    }

  //DPRINT("file open: fcb:%x file size: %d\n", Fcb, Fcb->Entry.DataLengthL);

  return(STATUS_SUCCESS);
   120d3:	31 c0                	xor    %eax,%eax
}
   120d5:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   120d8:	5b                   	pop    %ebx
   120d9:	5e                   	pop    %esi
   120da:	5f                   	pop    %edi
   120db:	5d                   	pop    %ebp
   120dc:	c3                   	ret    
   120dd:	8d 76 00             	lea    0x0(%esi),%esi
   120e0:	83 ec 0c             	sub    $0xc,%esp
   120e3:	8d 43 10             	lea    0x10(%ebx),%eax
   120e6:	6a 00                	push   $0x0
   120e8:	6a 00                	push   $0x0
   120ea:	6a 00                	push   $0x0
   120ec:	50                   	push   %eax
   120ed:	56                   	push   %esi
   120ee:	e8 bd 1a 00 00       	call   13bb0 <_CcInitializeCacheMap@20>
   120f3:	8b 8b cc 02 00 00    	mov    0x2cc(%ebx),%ecx
   120f9:	83 c4 0c             	add    $0xc,%esp
   120fc:	83 c9 01             	or     $0x1,%ecx
   120ff:	89 8b cc 02 00 00    	mov    %ecx,0x2cc(%ebx)
   12105:	eb cc                	jmp    120d3 <_NtfsAttachFCBToFileObject+0x53>
   12107:	89 f6                	mov    %esi,%esi
   12109:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00012110 <_NtfsDirFindFile>:


NTSTATUS
NtfsDirFindFile(PDEVICE_EXTENSION DeviceExt,
		PFCB DirectoryFcb,
		PWSTR FileToFind,
		PFCB *FoundFCB)
{
   12110:	55                   	push   %ebp
#if 0
  WCHAR TempName[2];
  WCHAR Name[256];
  PVOID Block;
  ULONG FirstSector;
  ULONG DirSize;
  PDIR_RECORD Record;
  ULONG Offset;
  ULONG BlockOffset;
  NTSTATUS Status;

  LARGE_INTEGER StreamOffset;
  PVOID Context;

  ASSERT(DeviceExt);
  ASSERT(DirectoryFcb);
  ASSERT(FileToFind);

  DPRINT("NtfsDirFindFile(VCB:%08x, dirFCB:%08x, File:%S)\n",
	 DeviceExt,
	 DirectoryFcb,
	 FileToFind);
  DPRINT("Dir Path:%S\n", DirectoryFcb->PathName);

  /*  default to '.' if no filename specified */
  if (wcslen(FileToFind) == 0)
    {
      TempName[0] = L'.';
      TempName[1] = 0;
      FileToFind = TempName;
    }

  DirSize = DirectoryFcb->Entry.DataLengthL;
  StreamOffset.QuadPart = (LONGLONG)DirectoryFcb->Entry.ExtentLocationL * (LONGLONG)BLOCKSIZE;

  if(!CcMapData(DeviceExt->StreamFileObject, &StreamOffset,
		BLOCKSIZE, TRUE, &Context, &Block))
  {
    DPRINT("CcMapData() failed\n");
    return(STATUS_UNSUCCESSFUL);
  }

  Offset = 0;
  BlockOffset = 0;
  Record = (PDIR_RECORD)Block;
  while(TRUE)
    {
      if (Record->RecordLength == 0)
	{
	  DPRINT("RecordLength == 0  Stopped!\n");
	  break;
	}
	
      DPRINT("RecordLength %u  ExtAttrRecordLength %u  NameLength %u\n",
	     Record->RecordLength, Record->ExtAttrRecordLength, Record->FileIdLength);

      NtfsGetDirEntryName(DeviceExt, Record, Name);
      DPRINT("Name '%S'\n", Name);

      if (wstrcmpjoki(Name, FileToFind))
	{
	  DPRINT("Match found, %S\n", Name);
	  Status = NtfsMakeFCBFromDirEntry(DeviceExt,
					   DirectoryFcb,
					   Name,
					   Record,
					   FoundFCB);

	  CcUnpinData(Context);

	  return(Status);
	}

      Offset += Record->RecordLength;
      BlockOffset += Record->RecordLength;
      Record = (PDIR_RECORD)(Block + BlockOffset);
      if (BlockOffset >= BLOCKSIZE || Record->RecordLength == 0)
	{
	  DPRINT("Map next sector\n");
	  CcUnpinData(Context);
	  StreamOffset.QuadPart += BLOCKSIZE;
	  Offset = ROUND_UP(Offset, BLOCKSIZE);
	  BlockOffset = 0;

	  if (!CcMapData(DeviceExt->StreamFileObject,
			 &StreamOffset,
			 BLOCKSIZE, TRUE,
			 &Context, &Block))
	    {
	      DPRINT("CcMapData() failed\n");
	      return(STATUS_UNSUCCESSFUL);
	    }
	  Record = (PDIR_RECORD)(Block + BlockOffset);
	}

      if (Offset >= DirSize)
	break;
    }

  CcUnpinData(Context);
#endif
  return(STATUS_OBJECT_NAME_NOT_FOUND);
}
   12111:	b8 34 00 00 c0       	mov    $0xc0000034,%eax
   12116:	89 e5                	mov    %esp,%ebp
   12118:	5d                   	pop    %ebp
   12119:	c3                   	ret    
   1211a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

00012120 <_NtfsGetFCBForFile>:


NTSTATUS
NtfsGetFCBForFile(PDEVICE_EXTENSION Vcb,
		  PFCB *pParentFCB,
		  PFCB *pFCB,
		  const PWSTR pFileName)
{
   12120:	55                   	push   %ebp
   12121:	89 e5                	mov    %esp,%ebp
   12123:	57                   	push   %edi
   12124:	56                   	push   %esi
   12125:	53                   	push   %ebx
   12126:	81 ec 3c 04 00 00    	sub    $0x43c,%esp
   1212c:	8b 45 14             	mov    0x14(%ebp),%eax
   1212f:	89 85 c0 fb ff ff    	mov    %eax,0xfffffbc0(%ebp)
  NTSTATUS Status;
  WCHAR  pathName [MAX_PATH];
  WCHAR  elementName [MAX_PATH];
  PWCHAR  currentElement;
  PFCB  FCB;
  PFCB  parentFCB;

  DPRINT("NtfsGetFCBForFile(%x, %x, %x, '%S')\n",
	 Vcb,
	 pParentFCB,
	 pFCB,
	 pFileName);

  /* Dummy code */
//  FCB = NtfsOpenRootFCB(Vcb);
//  *pFCB = FCB;
//  *pParentFCB = NULL;

#if 1
  /* Trivial case, open of the root directory on volume */
  if (pFileName [0] == L'\0' || wcscmp(pFileName, L"\\") == 0)
   12135:	66 83 38 00          	cmpw   $0x0,(%eax)
   12139:	74 14                	je     1214f <_NtfsGetFCBForFile+0x2f>
   1213b:	52                   	push   %edx
   1213c:	52                   	push   %edx
   1213d:	68 90 42 01 00       	push   $0x14290
   12142:	50                   	push   %eax
   12143:	e8 88 1a 00 00       	call   13bd0 <_wcscmp>
   12148:	83 c4 10             	add    $0x10,%esp
   1214b:	85 c0                	test   %eax,%eax
   1214d:	75 38                	jne    12187 <_NtfsGetFCBForFile+0x67>
    {
      DPRINT("returning root FCB\n");

      FCB = NtfsOpenRootFCB(Vcb);
   1214f:	83 ec 0c             	sub    $0xc,%esp
   12152:	8b 7d 08             	mov    0x8(%ebp),%edi
   12155:	57                   	push   %edi
   12156:	e8 e5 fe ff ff       	call   12040 <_NtfsOpenRootFCB>
      *pFCB = FCB;
   1215b:	8b 55 10             	mov    0x10(%ebp),%edx
      *pParentFCB = NULL;

      return((FCB != NULL) ? STATUS_SUCCESS : STATUS_OBJECT_PATH_NOT_FOUND);
   1215e:	83 c4 10             	add    $0x10,%esp
   12161:	89 85 c4 fb ff ff    	mov    %eax,0xfffffbc4(%ebp)
   12167:	83 f8 01             	cmp    $0x1,%eax
   1216a:	89 02                	mov    %eax,(%edx)
   1216c:	8b 55 0c             	mov    0xc(%ebp),%edx
   1216f:	c7 02 00 00 00 00    	movl   $0x0,(%edx)
   12175:	19 d2                	sbb    %edx,%edx
   12177:	81 e2 3a 00 00 c0    	and    $0xc000003a,%edx
    }
  else
    {
      currentElement = pFileName + 1;
      wcscpy (pathName, L"\\");
      FCB = NtfsOpenRootFCB (Vcb);
    }
  parentFCB = NULL;

  /* Parse filename and check each path element for existance and access */
  while (NtfsGetNextPathElement(currentElement) != 0)
    {
      /*  Skip blank directory levels */
      if ((NtfsGetNextPathElement(currentElement) - currentElement) == 0)
	{
	  currentElement++;
	  continue;
	}

      DPRINT("Parsing, currentElement:%S\n", currentElement);
      DPRINT("  parentFCB:%x FCB:%x\n", parentFCB, FCB);

      /* Descend to next directory level */
      if (parentFCB)
	{
	  NtfsReleaseFCB(Vcb, parentFCB);
	  parentFCB = NULL;
	}

      /* fail if element in FCB is not a directory */
      if (!NtfsFCBIsDirectory(FCB))
	{
	  DPRINT("Element in requested path is not a directory\n");

	  NtfsReleaseFCB(Vcb, FCB);
	  FCB = 0;
	  *pParentFCB = NULL;
	  *pFCB = NULL;

	  return(STATUS_OBJECT_PATH_NOT_FOUND);
	}
      parentFCB = FCB;

      /* Extract next directory level into dirName */
      NtfsWSubString(pathName,
		     pFileName,
		     NtfsGetNextPathElement(currentElement) - pFileName);
      DPRINT("  pathName:%S\n", pathName);

      FCB = NtfsGrabFCBFromTable(Vcb, pathName);
      if (FCB == NULL)
	{
	  NtfsWSubString(elementName,
			 currentElement,
			 NtfsGetNextPathElement(currentElement) - currentElement);
	  DPRINT("  elementName:%S\n", elementName);

	  Status = NtfsDirFindFile(Vcb, parentFCB, elementName, &FCB);
	  if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
	    {
	      *pParentFCB = parentFCB;
	      *pFCB = NULL;
	      currentElement = NtfsGetNextPathElement(currentElement);
	      if (*currentElement == L'\0' || NtfsGetNextPathElement(currentElement + 1) == 0)
		{
		  return(STATUS_OBJECT_NAME_NOT_FOUND);
		}
	      else
		{
		  return(STATUS_OBJECT_PATH_NOT_FOUND);
		}
	    }
	  else if (!NT_SUCCESS(Status))
	    {
	      NtfsReleaseFCB(Vcb, parentFCB);
	      *pParentFCB = NULL;
	      *pFCB = NULL;

	      return(Status);
	    }
	}
      currentElement = NtfsGetNextPathElement(currentElement);
    }

  *pParentFCB = parentFCB;
  *pFCB = FCB;
#endif

  return(STATUS_SUCCESS);
}
   1217d:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   12180:	89 d0                	mov    %edx,%eax
   12182:	5b                   	pop    %ebx
   12183:	5e                   	pop    %esi
   12184:	5f                   	pop    %edi
   12185:	5d                   	pop    %ebp
   12186:	c3                   	ret    
   12187:	50                   	push   %eax
   12188:	50                   	push   %eax
   12189:	8d 85 d8 fd ff ff    	lea    0xfffffdd8(%ebp),%eax
   1218f:	68 90 42 01 00       	push   $0x14290
   12194:	8b b5 c0 fb ff ff    	mov    0xfffffbc0(%ebp),%esi
   1219a:	50                   	push   %eax
   1219b:	e8 70 19 00 00       	call   13b10 <_wcscpy>
   121a0:	58                   	pop    %eax
   121a1:	8b 45 08             	mov    0x8(%ebp),%eax
   121a4:	50                   	push   %eax
   121a5:	e8 96 fe ff ff       	call   12040 <_NtfsOpenRootFCB>
   121aa:	83 c6 02             	add    $0x2,%esi
   121ad:	83 c4 10             	add    $0x10,%esp
   121b0:	89 85 c4 fb ff ff    	mov    %eax,0xfffffbc4(%ebp)
   121b6:	31 ff                	xor    %edi,%edi
   121b8:	89 f0                	mov    %esi,%eax
   121ba:	e8 51 fa ff ff       	call   11c10 <_NtfsGetNextPathElement>
   121bf:	85 c0                	test   %eax,%eax
   121c1:	74 1d                	je     121e0 <_NtfsGetFCBForFile+0xc0>
   121c3:	89 f0                	mov    %esi,%eax
   121c5:	e8 46 fa ff ff       	call   11c10 <_NtfsGetNextPathElement>
   121ca:	29 f0                	sub    %esi,%eax
   121cc:	d1 f8                	sar    %eax
   121ce:	85 c0                	test   %eax,%eax
   121d0:	75 22                	jne    121f4 <_NtfsGetFCBForFile+0xd4>
   121d2:	83 c6 02             	add    $0x2,%esi
   121d5:	89 f0                	mov    %esi,%eax
   121d7:	e8 34 fa ff ff       	call   11c10 <_NtfsGetNextPathElement>
   121dc:	85 c0                	test   %eax,%eax
   121de:	75 e3                	jne    121c3 <_NtfsGetFCBForFile+0xa3>
   121e0:	8b 55 0c             	mov    0xc(%ebp),%edx
   121e3:	89 3a                	mov    %edi,(%edx)
   121e5:	8b 55 10             	mov    0x10(%ebp),%edx
   121e8:	8b 85 c4 fb ff ff    	mov    0xfffffbc4(%ebp),%eax
   121ee:	89 02                	mov    %eax,(%edx)
   121f0:	31 d2                	xor    %edx,%edx
   121f2:	eb 89                	jmp    1217d <_NtfsGetFCBForFile+0x5d>
   121f4:	85 ff                	test   %edi,%edi
   121f6:	74 0f                	je     12207 <_NtfsGetFCBForFile+0xe7>
   121f8:	50                   	push   %eax
   121f9:	50                   	push   %eax
   121fa:	8b 45 08             	mov    0x8(%ebp),%eax
   121fd:	57                   	push   %edi
   121fe:	50                   	push   %eax
   121ff:	e8 ac fb ff ff       	call   11db0 <_NtfsReleaseFCB>
   12204:	83 c4 10             	add    $0x10,%esp
   12207:	8b 9d c4 fb ff ff    	mov    0xfffffbc4(%ebp),%ebx
   1220d:	53                   	push   %ebx
   1220e:	e8 1d fb ff ff       	call   11d30 <_NtfsFCBIsDirectory>
   12213:	5f                   	pop    %edi
   12214:	84 c0                	test   %al,%al
   12216:	0f 84 99 00 00 00    	je     122b5 <_NtfsGetFCBForFile+0x195>
   1221c:	83 ec 0c             	sub    $0xc,%esp
   1221f:	89 f0                	mov    %esi,%eax
   12221:	e8 ea f9 ff ff       	call   11c10 <_NtfsGetNextPathElement>
   12226:	8b 8d c0 fb ff ff    	mov    0xfffffbc0(%ebp),%ecx
   1222c:	29 c8                	sub    %ecx,%eax
   1222e:	8b 95 c0 fb ff ff    	mov    0xfffffbc0(%ebp),%edx
   12234:	d1 f8                	sar    %eax
   12236:	89 df                	mov    %ebx,%edi
   12238:	50                   	push   %eax
   12239:	8d 85 d8 fd ff ff    	lea    0xfffffdd8(%ebp),%eax
   1223f:	e8 0c fa ff ff       	call   11c50 <_NtfsWSubString>
   12244:	58                   	pop    %eax
   12245:	8b 45 08             	mov    0x8(%ebp),%eax
   12248:	5a                   	pop    %edx
   12249:	8d 95 d8 fd ff ff    	lea    0xfffffdd8(%ebp),%edx
   1224f:	52                   	push   %edx
   12250:	50                   	push   %eax
   12251:	e8 2a fc ff ff       	call   11e80 <_NtfsGrabFCBFromTable>
   12256:	83 c4 10             	add    $0x10,%esp
   12259:	85 c0                	test   %eax,%eax
   1225b:	89 85 c4 fb ff ff    	mov    %eax,0xfffffbc4(%ebp)
   12261:	75 44                	jne    122a7 <_NtfsGetFCBForFile+0x187>
   12263:	83 ec 0c             	sub    $0xc,%esp
   12266:	89 f0                	mov    %esi,%eax
   12268:	e8 a3 f9 ff ff       	call   11c10 <_NtfsGetNextPathElement>
   1226d:	89 f2                	mov    %esi,%edx
   1226f:	29 f0                	sub    %esi,%eax
   12271:	d1 f8                	sar    %eax
   12273:	50                   	push   %eax
   12274:	8d 85 c8 fb ff ff    	lea    0xfffffbc8(%ebp),%eax
   1227a:	e8 d1 f9 ff ff       	call   11c50 <_NtfsWSubString>
   1227f:	8d 85 c4 fb ff ff    	lea    0xfffffbc4(%ebp),%eax
   12285:	50                   	push   %eax
   12286:	8d 85 c8 fb ff ff    	lea    0xfffffbc8(%ebp),%eax
   1228c:	50                   	push   %eax
   1228d:	8b 45 08             	mov    0x8(%ebp),%eax
   12290:	53                   	push   %ebx
   12291:	50                   	push   %eax
   12292:	e8 79 fe ff ff       	call   12110 <_NtfsDirFindFile>
   12297:	83 c4 20             	add    $0x20,%esp
   1229a:	89 c3                	mov    %eax,%ebx
   1229c:	3d 34 00 00 c0       	cmp    $0xc0000034,%eax
   122a1:	74 44                	je     122e7 <_NtfsGetFCBForFile+0x1c7>
   122a3:	85 c0                	test   %eax,%eax
   122a5:	78 7a                	js     12321 <_NtfsGetFCBForFile+0x201>
   122a7:	89 f0                	mov    %esi,%eax
   122a9:	e8 62 f9 ff ff       	call   11c10 <_NtfsGetNextPathElement>
   122ae:	89 c6                	mov    %eax,%esi
   122b0:	e9 03 ff ff ff       	jmp    121b8 <_NtfsGetFCBForFile+0x98>
   122b5:	8b 4d 08             	mov    0x8(%ebp),%ecx
   122b8:	56                   	push   %esi
   122b9:	56                   	push   %esi
   122ba:	53                   	push   %ebx
   122bb:	51                   	push   %ecx
   122bc:	e8 ef fa ff ff       	call   11db0 <_NtfsReleaseFCB>
   122c1:	8b 55 10             	mov    0x10(%ebp),%edx
   122c4:	8b 45 0c             	mov    0xc(%ebp),%eax
   122c7:	c7 85 c4 fb ff ff 00 	movl   $0x0,0xfffffbc4(%ebp)
   122ce:	00 00 00 
   122d1:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
   122d7:	c7 02 00 00 00 00    	movl   $0x0,(%edx)
   122dd:	ba 3a 00 00 c0       	mov    $0xc000003a,%edx
   122e2:	e9 96 fe ff ff       	jmp    1217d <_NtfsGetFCBForFile+0x5d>
   122e7:	8b 45 10             	mov    0x10(%ebp),%eax
   122ea:	8b 55 0c             	mov    0xc(%ebp),%edx
   122ed:	89 3a                	mov    %edi,(%edx)
   122ef:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
   122f5:	89 f0                	mov    %esi,%eax
   122f7:	e8 14 f9 ff ff       	call   11c10 <_NtfsGetNextPathElement>
   122fc:	66 83 38 00          	cmpw   $0x0,(%eax)
   12300:	74 15                	je     12317 <_NtfsGetFCBForFile+0x1f7>
   12302:	8d 40 02             	lea    0x2(%eax),%eax
   12305:	e8 06 f9 ff ff       	call   11c10 <_NtfsGetNextPathElement>
   1230a:	ba 3a 00 00 c0       	mov    $0xc000003a,%edx
   1230f:	85 c0                	test   %eax,%eax
   12311:	0f 85 66 fe ff ff    	jne    1217d <_NtfsGetFCBForFile+0x5d>
   12317:	ba 34 00 00 c0       	mov    $0xc0000034,%edx
   1231c:	e9 5c fe ff ff       	jmp    1217d <_NtfsGetFCBForFile+0x5d>
   12321:	8b 45 08             	mov    0x8(%ebp),%eax
   12324:	52                   	push   %edx
   12325:	52                   	push   %edx
   12326:	57                   	push   %edi
   12327:	50                   	push   %eax
   12328:	e8 83 fa ff ff       	call   11db0 <_NtfsReleaseFCB>
   1232d:	8b 55 10             	mov    0x10(%ebp),%edx
   12330:	8b 45 0c             	mov    0xc(%ebp),%eax
   12333:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
   12339:	c7 02 00 00 00 00    	movl   $0x0,(%edx)
   1233f:	89 da                	mov    %ebx,%edx
   12341:	e9 37 fe ff ff       	jmp    1217d <_NtfsGetFCBForFile+0x5d>
   12346:	90                   	nop    
   12347:	90                   	nop    
   12348:	90                   	nop    
   12349:	90                   	nop    
   1234a:	90                   	nop    
   1234b:	90                   	nop    
   1234c:	90                   	nop    
   1234d:	90                   	nop    
   1234e:	90                   	nop    
   1234f:	90                   	nop    

00012350 <_NtfsQueryInformation@8>:
   12350:	55                   	push   %ebp
   12351:	89 e5                	mov    %esp,%ebp
   12353:	57                   	push   %edi
   12354:	56                   	push   %esi
   12355:	53                   	push   %ebx
   12356:	83 ec 1c             	sub    $0x1c,%esp
   12359:	8b 45 0c             	mov    0xc(%ebp),%eax
   1235c:	8b 4d 0c             	mov    0xc(%ebp),%ecx
   1235f:	8b 40 60             	mov    0x60(%eax),%eax
   12362:	89 45 e4             	mov    %eax,0xffffffe4(%ebp)
   12365:	89 c2                	mov    %eax,%edx
   12367:	8b 49 0c             	mov    0xc(%ecx),%ecx
   1236a:	8b 40 18             	mov    0x18(%eax),%eax
   1236d:	89 4d f0             	mov    %ecx,0xfffffff0(%ebp)
   12370:	8b 72 04             	mov    0x4(%edx),%esi
   12373:	8b 58 0c             	mov    0xc(%eax),%ebx
   12376:	89 75 e0             	mov    %esi,0xffffffe0(%ebp)
   12379:	8b 42 08             	mov    0x8(%edx),%eax
   1237c:	83 e8 04             	sub    $0x4,%eax
   1237f:	83 f8 11             	cmp    $0x11,%eax
   12382:	77 0c                	ja     12390 <_NtfsQueryInformation@8+0x40>
   12384:	ff 24 85 ac 42 01 00 	jmp    *0x142ac(,%eax,4)
   1238b:	90                   	nop    
   1238c:	8d 74 26 00          	lea    0x0(%esi),%esi
   12390:	bb bb 00 00 c0       	mov    $0xc00000bb,%ebx
   12395:	8b 55 0c             	mov    0xc(%ebp),%edx
   12398:	85 db                	test   %ebx,%ebx
   1239a:	89 5a 18             	mov    %ebx,0x18(%edx)
   1239d:	78 27                	js     123c6 <_NtfsQueryInformation@8+0x76>
   1239f:	8b 4d e4             	mov    0xffffffe4(%ebp),%ecx
   123a2:	8b 41 04             	mov    0x4(%ecx),%eax
   123a5:	8b 4d e0             	mov    0xffffffe0(%ebp),%ecx
   123a8:	29 c8                	sub    %ecx,%eax
   123aa:	89 42 1c             	mov    %eax,0x1c(%edx)
   123ad:	52                   	push   %edx
   123ae:	52                   	push   %edx
   123af:	6a 00                	push   $0x0
   123b1:	8b 45 0c             	mov    0xc(%ebp),%eax
   123b4:	50                   	push   %eax
   123b5:	e8 16 17 00 00       	call   13ad0 <_IoCompleteRequest@8>
   123ba:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   123bd:	89 d8                	mov    %ebx,%eax
   123bf:	5b                   	pop    %ebx
   123c0:	5e                   	pop    %esi
   123c1:	5f                   	pop    %edi
   123c2:	5d                   	pop    %ebp
   123c3:	c2 08 00             	ret    $0x8
   123c6:	8b 75 0c             	mov    0xc(%ebp),%esi
   123c9:	c7 46 1c 00 00 00 00 	movl   $0x0,0x1c(%esi)
   123d0:	52                   	push   %edx
   123d1:	52                   	push   %edx
   123d2:	6a 00                	push   $0x0
   123d4:	8b 45 0c             	mov    0xc(%ebp),%eax
   123d7:	50                   	push   %eax
   123d8:	e8 f3 16 00 00       	call   13ad0 <_IoCompleteRequest@8>
   123dd:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   123e0:	89 d8                	mov    %ebx,%eax
   123e2:	5b                   	pop    %ebx
   123e3:	5e                   	pop    %esi
   123e4:	5f                   	pop    %edi
   123e5:	5d                   	pop    %ebp
   123e6:	c2 08 00             	ret    $0x8
   123e9:	8b 75 f0             	mov    0xfffffff0(%ebp),%esi
   123ec:	85 f6                	test   %esi,%esi
   123ee:	0f 84 4d 01 00 00    	je     12541 <_NtfsQueryInformation@8+0x1f1>
   123f4:	85 db                	test   %ebx,%ebx
   123f6:	75 19                	jne    12411 <_NtfsQueryInformation@8+0xc1>
   123f8:	68 a0 42 01 00       	push   $0x142a0
   123fd:	68 a9 00 00 00       	push   $0xa9
   12402:	68 a1 42 01 00       	push   $0x142a1
   12407:	68 a9 42 01 00       	push   $0x142a9
   1240c:	e8 df 16 00 00       	call   13af0 <_RtlAssert@16>
   12411:	b8 05 00 00 80       	mov    $0x80000005,%eax
   12416:	83 7d e0 07          	cmpl   $0x7,0xffffffe0(%ebp)
   1241a:	76 1b                	jbe    12437 <_NtfsQueryInformation@8+0xe7>
   1241c:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   1241f:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
   12425:	c7 40 04 00 00 00 00 	movl   $0x0,0x4(%eax)
   1242c:	8b 5d e0             	mov    0xffffffe0(%ebp),%ebx
   1242f:	31 c0                	xor    %eax,%eax
   12431:	83 eb 08             	sub    $0x8,%ebx
   12434:	89 5d e0             	mov    %ebx,0xffffffe0(%ebp)
   12437:	89 c3                	mov    %eax,%ebx
   12439:	e9 57 ff ff ff       	jmp    12395 <_NtfsQueryInformation@8+0x45>
   1243e:	bb 02 00 00 c0       	mov    $0xc0000002,%ebx
   12443:	e9 4d ff ff ff       	jmp    12395 <_NtfsQueryInformation@8+0x45>
   12448:	b8 05 00 00 80       	mov    $0x80000005,%eax
   1244d:	83 7d e0 27          	cmpl   $0x27,0xffffffe0(%ebp)
   12451:	76 e4                	jbe    12437 <_NtfsQueryInformation@8+0xe7>
   12453:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   12456:	83 e8 28             	sub    $0x28,%eax
   12459:	89 45 e0             	mov    %eax,0xffffffe0(%ebp)
   1245c:	31 c0                	xor    %eax,%eax
   1245e:	eb d7                	jmp    12437 <_NtfsQueryInformation@8+0xe7>
   12460:	b8 05 00 00 80       	mov    $0x80000005,%eax
   12465:	83 7d e0 17          	cmpl   $0x17,0xffffffe0(%ebp)
   12469:	76 cc                	jbe    12437 <_NtfsQueryInformation@8+0xe7>
   1246b:	8b 55 f0             	mov    0xfffffff0(%ebp),%edx
   1246e:	85 d2                	test   %edx,%edx
   12470:	0f 84 40 01 00 00    	je     125b6 <_NtfsQueryInformation@8+0x266>
   12476:	85 db                	test   %ebx,%ebx
   12478:	0f 84 1d 01 00 00    	je     1259b <_NtfsQueryInformation@8+0x24b>
   1247e:	50                   	push   %eax
   1247f:	50                   	push   %eax
   12480:	6a 18                	push   $0x18
   12482:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   12485:	50                   	push   %eax
   12486:	e8 a5 15 00 00       	call   13a30 <_RtlZeroMemory@8>
   1248b:	50                   	push   %eax
   1248c:	8b 7d f0             	mov    0xfffffff0(%ebp),%edi
   1248f:	8b 43 10             	mov    0x10(%ebx),%eax
   12492:	8b 53 14             	mov    0x14(%ebx),%edx
   12495:	89 57 04             	mov    %edx,0x4(%edi)
   12498:	89 07                	mov    %eax,(%edi)
   1249a:	8b 43 18             	mov    0x18(%ebx),%eax
   1249d:	8b 53 1c             	mov    0x1c(%ebx),%edx
   124a0:	89 57 0c             	mov    %edx,0xc(%edi)
   124a3:	89 47 08             	mov    %eax,0x8(%edi)
   124a6:	c7 47 10 00 00 00 00 	movl   $0x0,0x10(%edi)
   124ad:	c6 47 14 00          	movb   $0x0,0x14(%edi)
   124b1:	53                   	push   %ebx
   124b2:	e8 79 f8 ff ff       	call   11d30 <_NtfsFCBIsDirectory>
   124b7:	83 c4 10             	add    $0x10,%esp
   124ba:	88 47 15             	mov    %al,0x15(%edi)
   124bd:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   124c0:	83 e8 18             	sub    $0x18,%eax
   124c3:	89 45 e0             	mov    %eax,0xffffffe0(%ebp)
   124c6:	eb 94                	jmp    1245c <_NtfsQueryInformation@8+0x10c>
   124c8:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   124cb:	85 c0                	test   %eax,%eax
   124cd:	0f 84 aa 00 00 00    	je     1257d <_NtfsQueryInformation@8+0x22d>
   124d3:	85 db                	test   %ebx,%ebx
   124d5:	0f 84 84 00 00 00    	je     1255f <_NtfsQueryInformation@8+0x20f>
   124db:	83 ec 0c             	sub    $0xc,%esp
   124de:	83 c3 40             	add    $0x40,%ebx
   124e1:	89 5d ec             	mov    %ebx,0xffffffec(%ebp)
   124e4:	53                   	push   %ebx
   124e5:	e8 36 16 00 00       	call   13b20 <_wcslen>
   124ea:	01 c0                	add    %eax,%eax
   124ec:	83 c4 10             	add    $0x10,%esp
   124ef:	89 45 e8             	mov    %eax,0xffffffe8(%ebp)
   124f2:	83 c0 04             	add    $0x4,%eax
   124f5:	ba 05 00 00 80       	mov    $0x80000005,%edx
   124fa:	39 45 e0             	cmp    %eax,0xffffffe0(%ebp)
   124fd:	72 3b                	jb     1253a <_NtfsQueryInformation@8+0x1ea>
   124ff:	8b 4d e8             	mov    0xffffffe8(%ebp),%ecx
   12502:	8b 55 f0             	mov    0xfffffff0(%ebp),%edx
   12505:	89 c8                	mov    %ecx,%eax
   12507:	89 d3                	mov    %edx,%ebx
   12509:	83 c0 02             	add    $0x2,%eax
   1250c:	89 0a                	mov    %ecx,(%edx)
   1250e:	83 c3 04             	add    $0x4,%ebx
   12511:	8b 55 ec             	mov    0xffffffec(%ebp),%edx
   12514:	fc                   	cld    
   12515:	89 c1                	mov    %eax,%ecx
   12517:	89 df                	mov    %ebx,%edi
   12519:	c1 e9 02             	shr    $0x2,%ecx
   1251c:	89 d6                	mov    %edx,%esi
   1251e:	f3 a5                	repz movsl %ds:(%esi),%es:(%edi)
   12520:	a8 02                	test   $0x2,%al
   12522:	74 06                	je     1252a <_NtfsQueryInformation@8+0x1da>
   12524:	66 8b 06             	mov    (%esi),%ax
   12527:	66 89 07             	mov    %ax,(%edi)
   1252a:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   1252d:	8b 7d e8             	mov    0xffffffe8(%ebp),%edi
   12530:	29 f8                	sub    %edi,%eax
   12532:	31 d2                	xor    %edx,%edx
   12534:	83 e8 06             	sub    $0x6,%eax
   12537:	89 45 e0             	mov    %eax,0xffffffe0(%ebp)
   1253a:	89 d3                	mov    %edx,%ebx
   1253c:	e9 54 fe ff ff       	jmp    12395 <_NtfsQueryInformation@8+0x45>
   12541:	68 a0 42 01 00       	push   $0x142a0
   12546:	68 a8 00 00 00       	push   $0xa8
   1254b:	68 a1 42 01 00       	push   $0x142a1
   12550:	68 a9 42 01 00       	push   $0x142a9
   12555:	e8 96 15 00 00       	call   13af0 <_RtlAssert@16>
   1255a:	e9 95 fe ff ff       	jmp    123f4 <_NtfsQueryInformation@8+0xa4>
   1255f:	68 a0 42 01 00       	push   $0x142a0
   12564:	68 8d 00 00 00       	push   $0x8d
   12569:	68 a1 42 01 00       	push   $0x142a1
   1256e:	68 a9 42 01 00       	push   $0x142a9
   12573:	e8 78 15 00 00       	call   13af0 <_RtlAssert@16>
   12578:	e9 5e ff ff ff       	jmp    124db <_NtfsQueryInformation@8+0x18b>
   1257d:	68 a0 42 01 00       	push   $0x142a0
   12582:	68 8c 00 00 00       	push   $0x8c
   12587:	68 a1 42 01 00       	push   $0x142a1
   1258c:	68 a9 42 01 00       	push   $0x142a9
   12591:	e8 5a 15 00 00       	call   13af0 <_RtlAssert@16>
   12596:	e9 38 ff ff ff       	jmp    124d3 <_NtfsQueryInformation@8+0x183>
   1259b:	68 a0 42 01 00       	push   $0x142a0
   125a0:	6a 38                	push   $0x38
   125a2:	68 a1 42 01 00       	push   $0x142a1
   125a7:	68 a9 42 01 00       	push   $0x142a9
   125ac:	e8 3f 15 00 00       	call   13af0 <_RtlAssert@16>
   125b1:	e9 c8 fe ff ff       	jmp    1247e <_NtfsQueryInformation@8+0x12e>
   125b6:	68 a0 42 01 00       	push   $0x142a0
   125bb:	6a 37                	push   $0x37
   125bd:	68 a1 42 01 00       	push   $0x142a1
   125c2:	68 a9 42 01 00       	push   $0x142a9
   125c7:	e8 24 15 00 00       	call   13af0 <_RtlAssert@16>
   125cc:	e9 a5 fe ff ff       	jmp    12476 <_NtfsQueryInformation@8+0x126>
   125d1:	90                   	nop    
   125d2:	90                   	nop    
   125d3:	90                   	nop    
   125d4:	90                   	nop    
   125d5:	90                   	nop    
   125d6:	90                   	nop    
   125d7:	90                   	nop    
   125d8:	90                   	nop    
   125d9:	90                   	nop    
   125da:	90                   	nop    
   125db:	90                   	nop    
   125dc:	90                   	nop    
   125dd:	90                   	nop    
   125de:	90                   	nop    
   125df:	90                   	nop    

000125e0 <_NtfsFileSystemControl@8>:
   125e0:	55                   	push   %ebp
   125e1:	89 e5                	mov    %esp,%ebp
   125e3:	57                   	push   %edi
   125e4:	56                   	push   %esi
   125e5:	53                   	push   %ebx
   125e6:	81 ec f0 00 00 00    	sub    $0xf0,%esp
   125ec:	68 cb 01 00 00       	push   $0x1cb
   125f1:	68 00 43 01 00       	push   $0x14300
   125f6:	68 08 43 01 00       	push   $0x14308
   125fb:	e8 50 14 00 00       	call   13a50 <_DbgPrint>
   12600:	c7 04 24 14 43 01 00 	movl   $0x14314,(%esp)
   12607:	e8 44 14 00 00       	call   13a50 <_DbgPrint>
   1260c:	8b 45 0c             	mov    0xc(%ebp),%eax
   1260f:	8b 58 60             	mov    0x60(%eax),%ebx
   12612:	31 c0                	xor    %eax,%eax
   12614:	83 c4 10             	add    $0x10,%esp
   12617:	8a 43 01             	mov    0x1(%ebx),%al
   1261a:	83 f8 01             	cmp    $0x1,%eax
   1261d:	0f 84 7f 00 00 00    	je     126a2 <_NtfsFileSystemControl@8+0xc2>
   12623:	7e 5b                	jle    12680 <_NtfsFileSystemControl@8+0xa0>
   12625:	83 f8 02             	cmp    $0x2,%eax
   12628:	0f 84 42 01 00 00    	je     12770 <_NtfsFileSystemControl@8+0x190>
   1262e:	56                   	push   %esi
   1262f:	68 e1 01 00 00       	push   $0x1e1
   12634:	68 00 43 01 00       	push   $0x14300
   12639:	68 08 43 01 00       	push   $0x14308
   1263e:	e8 0d 14 00 00       	call   13a50 <_DbgPrint>
   12643:	31 c0                	xor    %eax,%eax
   12645:	5a                   	pop    %edx
   12646:	8a 43 01             	mov    0x1(%ebx),%al
   12649:	59                   	pop    %ecx
   1264a:	50                   	push   %eax
   1264b:	68 34 43 01 00       	push   $0x14334
   12650:	e8 fb 13 00 00       	call   13a50 <_DbgPrint>
   12655:	8b 55 0c             	mov    0xc(%ebp),%edx
   12658:	83 c4 10             	add    $0x10,%esp
   1265b:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   12660:	89 5a 18             	mov    %ebx,0x18(%edx)
   12663:	c7 42 1c 00 00 00 00 	movl   $0x0,0x1c(%edx)
   1266a:	50                   	push   %eax
   1266b:	50                   	push   %eax
   1266c:	6a 00                	push   $0x0
   1266e:	52                   	push   %edx
   1266f:	e8 5c 14 00 00       	call   13ad0 <_IoCompleteRequest@8>
   12674:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   12677:	89 d8                	mov    %ebx,%eax
   12679:	5b                   	pop    %ebx
   1267a:	5e                   	pop    %esi
   1267b:	5f                   	pop    %edi
   1267c:	5d                   	pop    %ebp
   1267d:	c2 08 00             	ret    $0x8
   12680:	85 c0                	test   %eax,%eax
   12682:	75 aa                	jne    1262e <_NtfsFileSystemControl@8+0x4e>
   12684:	53                   	push   %ebx
   12685:	68 d2 01 00 00       	push   $0x1d2
   1268a:	68 00 43 01 00       	push   $0x14300
   1268f:	68 08 43 01 00       	push   $0x14308
   12694:	e8 b7 13 00 00       	call   13a50 <_DbgPrint>
   12699:	c7 04 24 50 43 01 00 	movl   $0x14350,(%esp)
   126a0:	eb ae                	jmp    12650 <_NtfsFileSystemControl@8+0x70>
   126a2:	51                   	push   %ecx
   126a3:	68 d7 01 00 00       	push   $0x1d7
   126a8:	68 00 43 01 00       	push   $0x14300
   126ad:	68 08 43 01 00       	push   $0x14308
   126b2:	e8 99 13 00 00       	call   13a50 <_DbgPrint>
   126b7:	c7 04 24 6e 43 01 00 	movl   $0x1436e,(%esp)
   126be:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   126c3:	e8 88 13 00 00       	call   13a50 <_DbgPrint>
   126c8:	83 c4 0c             	add    $0xc,%esp
   126cb:	c7 45 80 00 00 00 00 	movl   $0x0,0xffffff80(%ebp)
   126d2:	c7 85 70 ff ff ff 00 	movl   $0x0,0xffffff70(%ebp)
   126d9:	00 00 00 
   126dc:	c7 85 6c ff ff ff 00 	movl   $0x0,0xffffff6c(%ebp)
   126e3:	00 00 00 
   126e6:	68 2f 01 00 00       	push   $0x12f
   126eb:	68 00 43 01 00       	push   $0x14300
   126f0:	68 08 43 01 00       	push   $0x14308
   126f5:	e8 56 13 00 00       	call   13a50 <_DbgPrint>
   126fa:	c7 04 24 89 43 01 00 	movl   $0x14389,(%esp)
   12701:	e8 4a 13 00 00       	call   13a50 <_DbgPrint>
   12706:	8b 15 00 50 01 00    	mov    0x15000,%edx
   1270c:	8b 45 08             	mov    0x8(%ebp),%eax
   1270f:	83 c4 10             	add    $0x10,%esp
   12712:	39 42 04             	cmp    %eax,0x4(%edx)
   12715:	0f 84 d5 00 00 00    	je     127f0 <_NtfsFileSystemControl@8+0x210>
   1271b:	8b 45 80             	mov    0xffffff80(%ebp),%eax
   1271e:	85 c0                	test   %eax,%eax
   12720:	0f 85 b9 00 00 00    	jne    127df <_NtfsFileSystemControl@8+0x1ff>
   12726:	51                   	push   %ecx
   12727:	68 b4 01 00 00       	push   $0x1b4
   1272c:	68 00 43 01 00       	push   $0x14300
   12731:	68 08 43 01 00       	push   $0x14308
   12736:	e8 15 13 00 00       	call   13a50 <_DbgPrint>
   1273b:	58                   	pop    %eax
   1273c:	5a                   	pop    %edx
   1273d:	53                   	push   %ebx
   1273e:	68 a4 43 01 00       	push   $0x143a4
   12743:	e8 08 13 00 00       	call   13a50 <_DbgPrint>
   12748:	8b 55 0c             	mov    0xc(%ebp),%edx
   1274b:	83 c4 10             	add    $0x10,%esp
   1274e:	89 5a 18             	mov    %ebx,0x18(%edx)
   12751:	c7 42 1c 00 00 00 00 	movl   $0x0,0x1c(%edx)
   12758:	50                   	push   %eax
   12759:	50                   	push   %eax
   1275a:	6a 00                	push   $0x0
   1275c:	52                   	push   %edx
   1275d:	e8 6e 13 00 00       	call   13ad0 <_IoCompleteRequest@8>
   12762:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   12765:	89 d8                	mov    %ebx,%eax
   12767:	5b                   	pop    %ebx
   12768:	5e                   	pop    %esi
   12769:	5f                   	pop    %edi
   1276a:	5d                   	pop    %ebp
   1276b:	c2 08 00             	ret    $0x8
   1276e:	89 f6                	mov    %esi,%esi
   12770:	57                   	push   %edi
   12771:	68 dc 01 00 00       	push   $0x1dc
   12776:	68 00 43 01 00       	push   $0x14300
   1277b:	68 08 43 01 00       	push   $0x14308
   12780:	e8 cb 12 00 00       	call   13a50 <_DbgPrint>
   12785:	c7 04 24 ca 43 01 00 	movl   $0x143ca,(%esp)
   1278c:	bb 12 00 00 c0       	mov    $0xc0000012,%ebx
   12791:	e8 ba 12 00 00       	call   13a50 <_DbgPrint>
   12796:	83 c4 0c             	add    $0xc,%esp
   12799:	68 be 01 00 00       	push   $0x1be
   1279e:	68 00 43 01 00       	push   $0x14300
   127a3:	68 08 43 01 00       	push   $0x14308
   127a8:	e8 a3 12 00 00       	call   13a50 <_DbgPrint>
   127ad:	c7 04 24 e6 43 01 00 	movl   $0x143e6,(%esp)
   127b4:	e8 97 12 00 00       	call   13a50 <_DbgPrint>
   127b9:	8b 55 0c             	mov    0xc(%ebp),%edx
   127bc:	83 c4 10             	add    $0x10,%esp
   127bf:	89 5a 18             	mov    %ebx,0x18(%edx)
   127c2:	c7 42 1c 00 00 00 00 	movl   $0x0,0x1c(%edx)
   127c9:	50                   	push   %eax
   127ca:	50                   	push   %eax
   127cb:	6a 00                	push   $0x0
   127cd:	52                   	push   %edx
   127ce:	e8 fd 12 00 00       	call   13ad0 <_IoCompleteRequest@8>
   127d3:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   127d6:	89 d8                	mov    %ebx,%eax
   127d8:	5b                   	pop    %ebx
   127d9:	5e                   	pop    %esi
   127da:	5f                   	pop    %edi
   127db:	5d                   	pop    %ebp
   127dc:	c2 08 00             	ret    $0x8
   127df:	83 ec 0c             	sub    $0xc,%esp
   127e2:	50                   	push   %eax
   127e3:	e8 28 14 00 00       	call   13c10 <_IoDeleteDevice@4>
   127e8:	83 c4 0c             	add    $0xc,%esp
   127eb:	e9 36 ff ff ff       	jmp    12726 <_NtfsFileSystemControl@8+0x146>
   127f0:	8b 4d 0c             	mov    0xc(%ebp),%ecx
   127f3:	8d 5d 84             	lea    0xffffff84(%ebp),%ebx
   127f6:	8b 41 60             	mov    0x60(%ecx),%eax
   127f9:	8b 40 08             	mov    0x8(%eax),%eax
   127fc:	89 85 74 ff ff ff    	mov    %eax,0xffffff74(%ebp)
   12802:	52                   	push   %edx
   12803:	6a 36                	push   $0x36
   12805:	68 00 43 01 00       	push   $0x14300
   1280a:	68 08 43 01 00       	push   $0x14308
   1280f:	e8 3c 12 00 00       	call   13a50 <_DbgPrint>
   12814:	c7 04 24 01 44 01 00 	movl   $0x14401,(%esp)
   1281b:	e8 30 12 00 00       	call   13a50 <_DbgPrint>
   12820:	83 c4 0c             	add    $0xc,%esp
   12823:	8d 45 a8             	lea    0xffffffa8(%ebp),%eax
   12826:	c7 45 84 18 00 00 00 	movl   $0x18,0xffffff84(%ebp)
   1282d:	6a 01                	push   $0x1
   1282f:	53                   	push   %ebx
   12830:	50                   	push   %eax
   12831:	6a 00                	push   $0x0
   12833:	6a 00                	push   $0x0
   12835:	68 00 00 07 00       	push   $0x70000
   1283a:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   12840:	50                   	push   %eax
   12841:	e8 6a ee ff ff       	call   116b0 <_NtfsDeviceIoControl>
   12846:	83 c4 20             	add    $0x20,%esp
   12849:	89 c6                	mov    %eax,%esi
   1284b:	85 c0                	test   %eax,%eax
   1284d:	0f 88 90 08 00 00    	js     130e3 <_NtfsFileSystemControl@8+0xb03>
   12853:	83 7d b0 0c          	cmpl   $0xc,0xffffffb0(%ebp)
   12857:	0f 84 f6 07 00 00    	je     13053 <_NtfsFileSystemControl@8+0xa73>
   1285d:	51                   	push   %ecx
   1285e:	6a 5e                	push   $0x5e
   12860:	68 00 43 01 00       	push   $0x14300
   12865:	68 08 43 01 00       	push   $0x14308
   1286a:	e8 e1 11 00 00       	call   13a50 <_DbgPrint>
   1286f:	58                   	pop    %eax
   12870:	8b 45 bc             	mov    0xffffffbc(%ebp),%eax
   12873:	5a                   	pop    %edx
   12874:	50                   	push   %eax
   12875:	68 1d 44 01 00       	push   $0x1441d
   1287a:	e8 d1 11 00 00       	call   13a50 <_DbgPrint>
   1287f:	8b 5d bc             	mov    0xffffffbc(%ebp),%ebx
   12882:	5e                   	pop    %esi
   12883:	5f                   	pop    %edi
   12884:	53                   	push   %ebx
   12885:	6a 00                	push   $0x0
   12887:	e8 54 12 00 00       	call   13ae0 <_ExAllocatePool@8>
   1288c:	89 c7                	mov    %eax,%edi
   1288e:	5a                   	pop    %edx
   1288f:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   12894:	59                   	pop    %ecx
   12895:	85 ff                	test   %edi,%edi
   12897:	74 6d                	je     12906 <_NtfsFileSystemControl@8+0x326>
   12899:	50                   	push   %eax
   1289a:	50                   	push   %eax
   1289b:	6a 01                	push   $0x1
   1289d:	57                   	push   %edi
   1289e:	8b 45 bc             	mov    0xffffffbc(%ebp),%eax
   128a1:	50                   	push   %eax
   128a2:	6a 01                	push   $0x1
   128a4:	6a 00                	push   $0x0
   128a6:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   128ac:	50                   	push   %eax
   128ad:	e8 3e ed ff ff       	call   115f0 <_NtfsReadSectors>
   128b2:	83 c4 20             	add    $0x20,%esp
   128b5:	89 c6                	mov    %eax,%esi
   128b7:	85 c0                	test   %eax,%eax
   128b9:	78 3d                	js     128f8 <_NtfsFileSystemControl@8+0x318>
   128bb:	50                   	push   %eax
   128bc:	6a 6e                	push   $0x6e
   128be:	68 00 43 01 00       	push   $0x14300
   128c3:	68 08 43 01 00       	push   $0x14308
   128c8:	e8 83 11 00 00       	call   13a50 <_DbgPrint>
   128cd:	59                   	pop    %ecx
   128ce:	5b                   	pop    %ebx
   128cf:	8d 5f 03             	lea    0x3(%edi),%ebx
   128d2:	53                   	push   %ebx
   128d3:	68 32 44 01 00       	push   $0x14432
   128d8:	e8 73 11 00 00       	call   13a50 <_DbgPrint>
   128dd:	83 c4 0c             	add    $0xc,%esp
   128e0:	6a 08                	push   $0x8
   128e2:	68 4b 44 01 00       	push   $0x1444b
   128e7:	53                   	push   %ebx
   128e8:	e8 33 13 00 00       	call   13c20 <_RtlCompareMemory@12>
   128ed:	5a                   	pop    %edx
   128ee:	83 f8 08             	cmp    $0x8,%eax
   128f1:	74 05                	je     128f8 <_NtfsFileSystemControl@8+0x318>
   128f3:	be 4f 01 00 c0       	mov    $0xc000014f,%esi
   128f8:	83 ec 0c             	sub    $0xc,%esp
   128fb:	57                   	push   %edi
   128fc:	e8 7f 12 00 00       	call   13b80 <_ExFreePool@4>
   12901:	83 c4 0c             	add    $0xc,%esp
   12904:	89 f0                	mov    %esi,%eax
   12906:	89 c3                	mov    %eax,%ebx
   12908:	85 c0                	test   %eax,%eax
   1290a:	0f 88 0b fe ff ff    	js     1271b <_NtfsFileSystemControl@8+0x13b>
   12910:	8d 45 80             	lea    0xffffff80(%ebp),%eax
   12913:	57                   	push   %edi
   12914:	50                   	push   %eax
   12915:	6a 00                	push   $0x0
   12917:	6a 00                	push   $0x0
   12919:	6a 09                	push   $0x9
   1291b:	6a 00                	push   $0x0
   1291d:	68 d0 00 00 00       	push   $0xd0
   12922:	a1 00 50 01 00       	mov    0x15000,%eax
   12927:	8b 30                	mov    (%eax),%esi
   12929:	56                   	push   %esi
   1292a:	e8 f1 10 00 00       	call   13a20 <_IoCreateDevice@28>
   1292f:	5b                   	pop    %ebx
   12930:	85 c0                	test   %eax,%eax
   12932:	89 c3                	mov    %eax,%ebx
   12934:	0f 88 e1 fd ff ff    	js     1271b <_NtfsFileSystemControl@8+0x13b>
   1293a:	8b 45 80             	mov    0xffffff80(%ebp),%eax
   1293d:	8b 48 1c             	mov    0x1c(%eax),%ecx
   12940:	83 c9 10             	or     $0x10,%ecx
   12943:	89 48 1c             	mov    %ecx,0x1c(%eax)
   12946:	8b 40 28             	mov    0x28(%eax),%eax
   12949:	89 85 78 ff ff ff    	mov    %eax,0xffffff78(%ebp)
   1294f:	52                   	push   %edx
   12950:	52                   	push   %edx
   12951:	68 d0 00 00 00       	push   $0xd0
   12956:	50                   	push   %eax
   12957:	e8 d4 10 00 00       	call   13a30 <_RtlZeroMemory@8>
   1295c:	8b bd 78 ff ff ff    	mov    0xffffff78(%ebp),%edi
   12962:	c7 04 24 89 00 00 00 	movl   $0x89,(%esp)
   12969:	68 00 43 01 00       	push   $0x14300
   1296e:	68 08 43 01 00       	push   $0x14308
   12973:	e8 d8 10 00 00       	call   13a50 <_DbgPrint>
   12978:	c7 04 24 54 44 01 00 	movl   $0x14454,(%esp)
   1297f:	83 c7 50             	add    $0x50,%edi
   12982:	e8 c9 10 00 00       	call   13a50 <_DbgPrint>
   12987:	83 c4 0c             	add    $0xc,%esp
   1298a:	8d 85 7c ff ff ff    	lea    0xffffff7c(%ebp),%eax
   12990:	c7 85 7c ff ff ff 18 	movl   $0x18,0xffffff7c(%ebp)
   12997:	00 00 00 
   1299a:	6a 01                	push   $0x1
   1299c:	50                   	push   %eax
   1299d:	8d 45 88             	lea    0xffffff88(%ebp),%eax
   129a0:	50                   	push   %eax
   129a1:	6a 00                	push   $0x0
   129a3:	6a 00                	push   $0x0
   129a5:	68 00 00 07 00       	push   $0x70000
   129aa:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   129b0:	50                   	push   %eax
   129b1:	e8 fa ec ff ff       	call   116b0 <_NtfsDeviceIoControl>
   129b6:	83 c4 20             	add    $0x20,%esp
   129b9:	89 c3                	mov    %eax,%ebx
   129bb:	85 c0                	test   %eax,%eax
   129bd:	0f 88 f6 06 00 00    	js     130b9 <_NtfsFileSystemControl@8+0xad9>
   129c3:	51                   	push   %ecx
   129c4:	68 99 00 00 00       	push   $0x99
   129c9:	68 00 43 01 00       	push   $0x14300
   129ce:	68 08 43 01 00       	push   $0x14308
   129d3:	e8 78 10 00 00       	call   13a50 <_DbgPrint>
   129d8:	58                   	pop    %eax
   129d9:	8b 45 9c             	mov    0xffffff9c(%ebp),%eax
   129dc:	5a                   	pop    %edx
   129dd:	50                   	push   %eax
   129de:	68 1d 44 01 00       	push   $0x1441d
   129e3:	e8 68 10 00 00       	call   13a50 <_DbgPrint>
   129e8:	5e                   	pop    %esi
   129e9:	8b 5d 9c             	mov    0xffffff9c(%ebp),%ebx
   129ec:	58                   	pop    %eax
   129ed:	53                   	push   %ebx
   129ee:	6a 00                	push   $0x0
   129f0:	e8 eb 10 00 00       	call   13ae0 <_ExAllocatePool@8>
   129f5:	89 c6                	mov    %eax,%esi
   129f7:	5a                   	pop    %edx
   129f8:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   129fd:	59                   	pop    %ecx
   129fe:	85 f6                	test   %esi,%esi
   12a00:	0f 84 f9 02 00 00    	je     12cff <_NtfsFileSystemControl@8+0x71f>
   12a06:	50                   	push   %eax
   12a07:	50                   	push   %eax
   12a08:	6a 01                	push   $0x1
   12a0a:	56                   	push   %esi
   12a0b:	8b 5d 9c             	mov    0xffffff9c(%ebp),%ebx
   12a0e:	53                   	push   %ebx
   12a0f:	6a 01                	push   $0x1
   12a11:	6a 00                	push   $0x0
   12a13:	8b 8d 74 ff ff ff    	mov    0xffffff74(%ebp),%ecx
   12a19:	51                   	push   %ecx
   12a1a:	e8 d1 eb ff ff       	call   115f0 <_NtfsReadSectors>
   12a1f:	83 c4 20             	add    $0x20,%esp
   12a22:	89 c3                	mov    %eax,%ebx
   12a24:	85 c0                	test   %eax,%eax
   12a26:	0f 88 f9 06 00 00    	js     13125 <_NtfsFileSystemControl@8+0xb45>
   12a2c:	66 8b 46 0b          	mov    0xb(%esi),%ax
   12a30:	8b 5e 2c             	mov    0x2c(%esi),%ebx
   12a33:	89 c1                	mov    %eax,%ecx
   12a35:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12a3b:	81 e1 ff ff 00 00    	and    $0xffff,%ecx
   12a41:	89 48 50             	mov    %ecx,0x50(%eax)
   12a44:	31 c0                	xor    %eax,%eax
   12a46:	8a 46 0d             	mov    0xd(%esi),%al
   12a49:	89 47 04             	mov    %eax,0x4(%edi)
   12a4c:	31 c0                	xor    %eax,%eax
   12a4e:	8a 46 0d             	mov    0xd(%esi),%al
   12a51:	0f af c8             	imul   %eax,%ecx
   12a54:	89 8d 60 ff ff ff    	mov    %ecx,0xffffff60(%ebp)
   12a5a:	89 4f 08             	mov    %ecx,0x8(%edi)
   12a5d:	8b 4e 28             	mov    0x28(%esi),%ecx
   12a60:	89 5f 14             	mov    %ebx,0x14(%edi)
   12a63:	89 4f 10             	mov    %ecx,0x10(%edi)
   12a66:	8b 4e 30             	mov    0x30(%esi),%ecx
   12a69:	8b 5e 34             	mov    0x34(%esi),%ebx
   12a6c:	89 5f 1c             	mov    %ebx,0x1c(%edi)
   12a6f:	89 4f 18             	mov    %ecx,0x18(%edi)
   12a72:	8b 4e 38             	mov    0x38(%esi),%ecx
   12a75:	8b 5e 3c             	mov    0x3c(%esi),%ebx
   12a78:	89 5f 24             	mov    %ebx,0x24(%edi)
   12a7b:	89 4f 20             	mov    %ecx,0x20(%edi)
   12a7e:	8b 4e 48             	mov    0x48(%esi),%ecx
   12a81:	8b 5e 4c             	mov    0x4c(%esi),%ebx
   12a84:	89 5f 34             	mov    %ebx,0x34(%edi)
   12a87:	89 4f 30             	mov    %ecx,0x30(%edi)
   12a8a:	8a 46 40             	mov    0x40(%esi),%al
   12a8d:	84 c0                	test   %al,%al
   12a8f:	0f 8e 7f 06 00 00    	jle    13114 <_NtfsFileSystemControl@8+0xb34>
   12a95:	0f be c0             	movsbl %al,%eax
   12a98:	8b 95 60 ff ff ff    	mov    0xffffff60(%ebp),%edx
   12a9e:	0f af c2             	imul   %edx,%eax
   12aa1:	83 ec 0c             	sub    $0xc,%esp
   12aa4:	89 47 28             	mov    %eax,0x28(%edi)
   12aa7:	68 70 44 01 00       	push   $0x14470
   12aac:	e8 9f 0f 00 00       	call   13a50 <_DbgPrint>
   12ab1:	5b                   	pop    %ebx
   12ab2:	58                   	pop    %eax
   12ab3:	66 8b 46 0b          	mov    0xb(%esi),%ax
   12ab7:	25 ff ff 00 00       	and    $0xffff,%eax
   12abc:	50                   	push   %eax
   12abd:	68 8c 44 01 00       	push   $0x1448c
   12ac2:	e8 89 0f 00 00       	call   13a50 <_DbgPrint>
   12ac7:	31 c0                	xor    %eax,%eax
   12ac9:	5a                   	pop    %edx
   12aca:	8a 46 0d             	mov    0xd(%esi),%al
   12acd:	59                   	pop    %ecx
   12ace:	50                   	push   %eax
   12acf:	68 ac 44 01 00       	push   $0x144ac
   12ad4:	e8 77 0f 00 00       	call   13a50 <_DbgPrint>
   12ad9:	83 c4 0c             	add    $0xc,%esp
   12adc:	8b 46 2c             	mov    0x2c(%esi),%eax
   12adf:	50                   	push   %eax
   12ae0:	8b 46 28             	mov    0x28(%esi),%eax
   12ae3:	50                   	push   %eax
   12ae4:	68 cc 44 01 00       	push   $0x144cc
   12ae9:	e8 62 0f 00 00       	call   13a50 <_DbgPrint>
   12aee:	83 c4 0c             	add    $0xc,%esp
   12af1:	8b 46 34             	mov    0x34(%esi),%eax
   12af4:	50                   	push   %eax
   12af5:	8b 46 30             	mov    0x30(%esi),%eax
   12af8:	50                   	push   %eax
   12af9:	68 f0 44 01 00       	push   $0x144f0
   12afe:	e8 4d 0f 00 00       	call   13a50 <_DbgPrint>
   12b03:	83 c4 0c             	add    $0xc,%esp
   12b06:	8b 46 3c             	mov    0x3c(%esi),%eax
   12b09:	50                   	push   %eax
   12b0a:	8b 46 38             	mov    0x38(%esi),%eax
   12b0d:	50                   	push   %eax
   12b0e:	68 14 45 01 00       	push   $0x14514
   12b13:	e8 38 0f 00 00       	call   13a50 <_DbgPrint>
   12b18:	59                   	pop    %ecx
   12b19:	0f be 46 40          	movsbl 0x40(%esi),%eax
   12b1d:	5b                   	pop    %ebx
   12b1e:	50                   	push   %eax
   12b1f:	68 38 45 01 00       	push   $0x14538
   12b24:	e8 27 0f 00 00       	call   13a50 <_DbgPrint>
   12b29:	58                   	pop    %eax
   12b2a:	0f be 46 44          	movsbl 0x44(%esi),%eax
   12b2e:	5a                   	pop    %edx
   12b2f:	50                   	push   %eax
   12b30:	68 58 45 01 00       	push   $0x14558
   12b35:	e8 16 0f 00 00       	call   13a50 <_DbgPrint>
   12b3a:	83 c4 0c             	add    $0xc,%esp
   12b3d:	8b 46 4c             	mov    0x4c(%esi),%eax
   12b40:	50                   	push   %eax
   12b41:	8b 46 48             	mov    0x48(%esi),%eax
   12b44:	50                   	push   %eax
   12b45:	68 78 45 01 00       	push   $0x14578
   12b4a:	e8 01 0f 00 00       	call   13a50 <_DbgPrint>
   12b4f:	89 34 24             	mov    %esi,(%esp)
   12b52:	e8 29 10 00 00       	call   13b80 <_ExFreePool@4>
   12b57:	8b 77 28             	mov    0x28(%edi),%esi
   12b5a:	58                   	pop    %eax
   12b5b:	56                   	push   %esi
   12b5c:	6a 00                	push   $0x0
   12b5e:	e8 7d 0f 00 00       	call   13ae0 <_ExAllocatePool@8>
   12b63:	59                   	pop    %ecx
   12b64:	5b                   	pop    %ebx
   12b65:	89 85 68 ff ff ff    	mov    %eax,0xffffff68(%ebp)
   12b6b:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   12b70:	8b 95 68 ff ff ff    	mov    0xffffff68(%ebp),%edx
   12b76:	85 d2                	test   %edx,%edx
   12b78:	0f 84 81 01 00 00    	je     12cff <_NtfsFileSystemControl@8+0x71f>
   12b7e:	56                   	push   %esi
   12b7f:	56                   	push   %esi
   12b80:	6a 01                	push   $0x1
   12b82:	8b 9d 68 ff ff ff    	mov    0xffffff68(%ebp),%ebx
   12b88:	31 d2                	xor    %edx,%edx
   12b8a:	53                   	push   %ebx
   12b8b:	8b 0f                	mov    (%edi),%ecx
   12b8d:	51                   	push   %ecx
   12b8e:	8b 47 28             	mov    0x28(%edi),%eax
   12b91:	f7 37                	divl   (%edi)
   12b93:	50                   	push   %eax
   12b94:	8b 47 04             	mov    0x4(%edi),%eax
   12b97:	8b 57 18             	mov    0x18(%edi),%edx
   12b9a:	0f af c2             	imul   %edx,%eax
   12b9d:	50                   	push   %eax
   12b9e:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   12ba4:	50                   	push   %eax
   12ba5:	e8 46 ea ff ff       	call   115f0 <_NtfsReadSectors>
   12baa:	83 c4 20             	add    $0x20,%esp
   12bad:	89 c3                	mov    %eax,%ebx
   12baf:	85 c0                	test   %eax,%eax
   12bb1:	0f 88 34 01 00 00    	js     12ceb <_NtfsFileSystemControl@8+0x70b>
   12bb7:	56                   	push   %esi
   12bb8:	56                   	push   %esi
   12bb9:	8b 5f 28             	mov    0x28(%edi),%ebx
   12bbc:	53                   	push   %ebx
   12bbd:	6a 00                	push   $0x0
   12bbf:	e8 1c 0f 00 00       	call   13ae0 <_ExAllocatePool@8>
   12bc4:	5a                   	pop    %edx
   12bc5:	85 c0                	test   %eax,%eax
   12bc7:	59                   	pop    %ecx
   12bc8:	89 85 64 ff ff ff    	mov    %eax,0xffffff64(%ebp)
   12bce:	0f 84 59 05 00 00    	je     1312d <_NtfsFileSystemControl@8+0xb4d>
   12bd4:	8b 8d 78 ff ff ff    	mov    0xffffff78(%ebp),%ecx
   12bda:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   12be0:	89 41 48             	mov    %eax,0x48(%ecx)
   12be3:	8b 85 68 ff ff ff    	mov    0xffffff68(%ebp),%eax
   12be9:	50                   	push   %eax
   12bea:	8b 85 64 ff ff ff    	mov    0xffffff64(%ebp),%eax
   12bf0:	50                   	push   %eax
   12bf1:	6a 03                	push   $0x3
   12bf3:	51                   	push   %ecx
   12bf4:	e8 a7 08 00 00       	call   134a0 <_ReadFileRecord>
   12bf9:	83 c4 10             	add    $0x10,%esp
   12bfc:	89 c3                	mov    %eax,%ebx
   12bfe:	85 c0                	test   %eax,%eax
   12c00:	0f 88 e5 00 00 00    	js     12ceb <_NtfsFileSystemControl@8+0x70b>
   12c06:	83 ec 0c             	sub    $0xc,%esp
   12c09:	68 99 45 01 00       	push   $0x14599
   12c0e:	e8 3d 0e 00 00       	call   13a50 <_DbgPrint>
   12c13:	58                   	pop    %eax
   12c14:	8b 85 68 ff ff ff    	mov    0xffffff68(%ebp),%eax
   12c1a:	50                   	push   %eax
   12c1b:	e8 b0 e6 ff ff       	call   112d0 <_NtfsDumpFileAttributes>
   12c20:	c7 04 24 99 45 01 00 	movl   $0x14599,(%esp)
   12c27:	e8 24 0e 00 00       	call   13a50 <_DbgPrint>
   12c2c:	c7 04 24 99 45 01 00 	movl   $0x14599,(%esp)
   12c33:	e8 18 0e 00 00       	call   13a50 <_DbgPrint>
   12c38:	58                   	pop    %eax
   12c39:	8b b5 64 ff ff ff    	mov    0xffffff64(%ebp),%esi
   12c3f:	56                   	push   %esi
   12c40:	e8 8b e6 ff ff       	call   112d0 <_NtfsDumpFileAttributes>
   12c45:	c7 04 24 99 45 01 00 	movl   $0x14599,(%esp)
   12c4c:	e8 ff 0d 00 00       	call   13a50 <_DbgPrint>
   12c51:	83 c4 0c             	add    $0xc,%esp
   12c54:	6a 00                	push   $0x0
   12c56:	6a 60                	push   $0x60
   12c58:	8b 8d 64 ff ff ff    	mov    0xffffff64(%ebp),%ecx
   12c5e:	51                   	push   %ecx
   12c5f:	e8 fc 05 00 00       	call   13260 <_FindAttribute>
   12c64:	83 c4 0c             	add    $0xc,%esp
   12c67:	89 c6                	mov    %eax,%esi
   12c69:	68 fe 00 00 00       	push   $0xfe
   12c6e:	68 00 43 01 00       	push   $0x14300
   12c73:	68 08 43 01 00       	push   $0x14308
   12c78:	e8 d3 0d 00 00       	call   13a50 <_DbgPrint>
   12c7d:	58                   	pop    %eax
   12c7e:	5a                   	pop    %edx
   12c7f:	56                   	push   %esi
   12c80:	68 9c 45 01 00       	push   $0x1459c
   12c85:	e8 c6 0d 00 00       	call   13a50 <_DbgPrint>
   12c8a:	83 c4 10             	add    $0x10,%esp
   12c8d:	85 f6                	test   %esi,%esi
   12c8f:	74 0b                	je     12c9c <_NtfsFileSystemControl@8+0x6bc>
   12c91:	8b 46 10             	mov    0x10(%esi),%eax
   12c94:	85 c0                	test   %eax,%eax
   12c96:	0f 85 03 05 00 00    	jne    1319f <_NtfsFileSystemControl@8+0xbbf>
   12c9c:	66 c7 47 38 00 00    	movw   $0x0,0x38(%edi)
   12ca2:	56                   	push   %esi
   12ca3:	6a 00                	push   $0x0
   12ca5:	6a 70                	push   $0x70
   12ca7:	8b 8d 64 ff ff ff    	mov    0xffffff64(%ebp),%ecx
   12cad:	51                   	push   %ecx
   12cae:	e8 ad 05 00 00       	call   13260 <_FindAttribute>
   12cb3:	83 c4 0c             	add    $0xc,%esp
   12cb6:	89 c6                	mov    %eax,%esi
   12cb8:	68 10 01 00 00       	push   $0x110
   12cbd:	68 00 43 01 00       	push   $0x14300
   12cc2:	68 08 43 01 00       	push   $0x14308
   12cc7:	e8 84 0d 00 00       	call   13a50 <_DbgPrint>
   12ccc:	58                   	pop    %eax
   12ccd:	5a                   	pop    %edx
   12cce:	56                   	push   %esi
   12ccf:	68 9c 45 01 00       	push   $0x1459c
   12cd4:	e8 77 0d 00 00       	call   13a50 <_DbgPrint>
   12cd9:	83 c4 10             	add    $0x10,%esp
   12cdc:	85 f6                	test   %esi,%esi
   12cde:	74 0b                	je     12ceb <_NtfsFileSystemControl@8+0x70b>
   12ce0:	8b 46 10             	mov    0x10(%esi),%eax
   12ce3:	85 c0                	test   %eax,%eax
   12ce5:	0f 85 63 04 00 00    	jne    1314e <_NtfsFileSystemControl@8+0xb6e>
   12ceb:	83 ec 0c             	sub    $0xc,%esp
   12cee:	8b b5 68 ff ff ff    	mov    0xffffff68(%ebp),%esi
   12cf4:	56                   	push   %esi
   12cf5:	e8 86 0e 00 00       	call   13b80 <_ExFreePool@4>
   12cfa:	83 c4 0c             	add    $0xc,%esp
   12cfd:	89 d8                	mov    %ebx,%eax
   12cff:	89 c3                	mov    %eax,%ebx
   12d01:	85 c0                	test   %eax,%eax
   12d03:	0f 88 ee 02 00 00    	js     12ff7 <_NtfsFileSystemControl@8+0xa17>
   12d09:	8b 95 74 ff ff ff    	mov    0xffffff74(%ebp),%edx
   12d0f:	8b 4d 80             	mov    0xffffff80(%ebp),%ecx
   12d12:	8b 42 24             	mov    0x24(%edx),%eax
   12d15:	89 41 24             	mov    %eax,0x24(%ecx)
   12d18:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12d1e:	89 50 48             	mov    %edx,0x48(%eax)
   12d21:	8b 42 24             	mov    0x24(%edx),%eax
   12d24:	8b 95 78 ff ff ff    	mov    0xffffff78(%ebp),%edx
   12d2a:	89 48 08             	mov    %ecx,0x8(%eax)
   12d2d:	8b 5a 48             	mov    0x48(%edx),%ebx
   12d30:	8b 43 24             	mov    0x24(%ebx),%eax
   12d33:	89 58 0c             	mov    %ebx,0xc(%eax)
   12d36:	8b 5a 48             	mov    0x48(%edx),%ebx
   12d39:	8b 43 24             	mov    0x24(%ebx),%eax
   12d3c:	66 83 48 04 01       	orw    $0x1,0x4(%eax)
   12d41:	8a 43 30             	mov    0x30(%ebx),%al
   12d44:	bb 9a 00 00 c0       	mov    $0xc000009a,%ebx
   12d49:	40                   	inc    %eax
   12d4a:	88 41 30             	mov    %al,0x30(%ecx)
   12d4d:	8b 45 80             	mov    0xffffff80(%ebp),%eax
   12d50:	8b 48 1c             	mov    0x1c(%eax),%ecx
   12d53:	80 e1 7f             	and    $0x7f,%cl
   12d56:	89 48 1c             	mov    %ecx,0x1c(%eax)
   12d59:	50                   	push   %eax
   12d5a:	50                   	push   %eax
   12d5b:	8b 42 48             	mov    0x48(%edx),%eax
   12d5e:	50                   	push   %eax
   12d5f:	6a 00                	push   $0x0
   12d61:	e8 3a 0e 00 00       	call   13ba0 <_IoCreateStreamFileObject@8>
   12d66:	57                   	push   %edi
   12d67:	8b 8d 78 ff ff ff    	mov    0xffffff78(%ebp),%ecx
   12d6d:	89 41 4c             	mov    %eax,0x4c(%ecx)
   12d70:	6a 00                	push   $0x0
   12d72:	e8 f9 ee ff ff       	call   11c70 <_NtfsCreateFCB>
   12d77:	83 c4 10             	add    $0x10,%esp
   12d7a:	85 c0                	test   %eax,%eax
   12d7c:	89 85 70 ff ff ff    	mov    %eax,0xffffff70(%ebp)
   12d82:	0f 84 6f 02 00 00    	je     12ff7 <_NtfsFileSystemControl@8+0xa17>
   12d88:	56                   	push   %esi
   12d89:	68 49 43 43 42       	push   $0x42434349
   12d8e:	6a 28                	push   $0x28
   12d90:	6a 00                	push   $0x0
   12d92:	e8 b9 0d 00 00       	call   13b50 <_ExAllocatePoolWithTag@12>
   12d97:	59                   	pop    %ecx
   12d98:	85 c0                	test   %eax,%eax
   12d9a:	89 85 6c ff ff ff    	mov    %eax,0xffffff6c(%ebp)
   12da0:	0f 84 51 02 00 00    	je     12ff7 <_NtfsFileSystemControl@8+0xa17>
   12da6:	52                   	push   %edx
   12da7:	52                   	push   %edx
   12da8:	6a 28                	push   $0x28
   12daa:	50                   	push   %eax
   12dab:	e8 80 0c 00 00       	call   13a30 <_RtlZeroMemory@8>
   12db0:	57                   	push   %edi
   12db1:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12db7:	8b 95 70 ff ff ff    	mov    0xffffff70(%ebp),%edx
   12dbd:	8b 48 4c             	mov    0x4c(%eax),%ecx
   12dc0:	8b 85 6c ff ff ff    	mov    0xffffff6c(%ebp),%eax
   12dc6:	89 51 0c             	mov    %edx,0xc(%ecx)
   12dc9:	89 41 10             	mov    %eax,0x10(%ecx)
   12dcc:	89 d0                	mov    %edx,%eax
   12dce:	8b 95 78 ff ff ff    	mov    0xffffff78(%ebp),%edx
   12dd4:	83 c0 28             	add    $0x28,%eax
   12dd7:	c7 41 18 00 00 00 00 	movl   $0x0,0x18(%ecx)
   12dde:	89 41 14             	mov    %eax,0x14(%ecx)
   12de1:	8b 42 44             	mov    0x44(%edx),%eax
   12de4:	89 41 08             	mov    %eax,0x8(%ecx)
   12de7:	8b 85 6c ff ff ff    	mov    0xffffff6c(%ebp),%eax
   12ded:	89 48 08             	mov    %ecx,0x8(%eax)
   12df0:	8b 8d 78 ff ff ff    	mov    0xffffff78(%ebp),%ecx
   12df6:	8b 42 4c             	mov    0x4c(%edx),%eax
   12df9:	8b 95 70 ff ff ff    	mov    0xffffff70(%ebp),%edx
   12dff:	89 42 34             	mov    %eax,0x34(%edx)
   12e02:	c7 82 cc 02 00 00 02 	movl   $0x2,0x2cc(%edx)
   12e09:	00 00 00 
   12e0c:	8b 41 48             	mov    0x48(%ecx),%eax
   12e0f:	89 42 38             	mov    %eax,0x38(%edx)
   12e12:	8b 41 50             	mov    0x50(%ecx),%eax
   12e15:	89 85 50 ff ff ff    	mov    %eax,0xffffff50(%ebp)
   12e1b:	89 c8                	mov    %ecx,%eax
   12e1d:	31 d2                	xor    %edx,%edx
   12e1f:	8b 49 60             	mov    0x60(%ecx),%ecx
   12e22:	8b 58 64             	mov    0x64(%eax),%ebx
   12e25:	8b 85 50 ff ff ff    	mov    0xffffff50(%ebp),%eax
   12e2b:	89 95 54 ff ff ff    	mov    %edx,0xffffff54(%ebp)
   12e31:	f7 e1                	mul    %ecx
   12e33:	89 95 4c ff ff ff    	mov    %edx,0xffffff4c(%ebp)
   12e39:	8b 95 54 ff ff ff    	mov    0xffffff54(%ebp),%edx
   12e3f:	0f af d1             	imul   %ecx,%edx
   12e42:	8b 8d 50 ff ff ff    	mov    0xffffff50(%ebp),%ecx
   12e48:	8b bd 4c ff ff ff    	mov    0xffffff4c(%ebp),%edi
   12e4e:	0f af cb             	imul   %ebx,%ecx
   12e51:	01 d7                	add    %edx,%edi
   12e53:	89 85 48 ff ff ff    	mov    %eax,0xffffff48(%ebp)
   12e59:	01 cf                	add    %ecx,%edi
   12e5b:	8b 8d 70 ff ff ff    	mov    0xffffff70(%ebp),%ecx
   12e61:	89 bd 4c ff ff ff    	mov    %edi,0xffffff4c(%ebp)
   12e67:	8b 85 48 ff ff ff    	mov    0xffffff48(%ebp),%eax
   12e6d:	8b 95 4c ff ff ff    	mov    0xffffff4c(%ebp),%edx
   12e73:	89 41 18             	mov    %eax,0x18(%ecx)
   12e76:	89 51 1c             	mov    %edx,0x1c(%ecx)
   12e79:	8b 95 78 ff ff ff    	mov    0xffffff78(%ebp),%edx
   12e7f:	8b 42 50             	mov    0x50(%edx),%eax
   12e82:	31 d2                	xor    %edx,%edx
   12e84:	89 85 38 ff ff ff    	mov    %eax,0xffffff38(%ebp)
   12e8a:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12e90:	89 95 3c ff ff ff    	mov    %edx,0xffffff3c(%ebp)
   12e96:	8b 48 60             	mov    0x60(%eax),%ecx
   12e99:	8b 58 64             	mov    0x64(%eax),%ebx
   12e9c:	8b 85 38 ff ff ff    	mov    0xffffff38(%ebp),%eax
   12ea2:	f7 e1                	mul    %ecx
   12ea4:	89 95 34 ff ff ff    	mov    %edx,0xffffff34(%ebp)
   12eaa:	8b 95 3c ff ff ff    	mov    0xffffff3c(%ebp),%edx
   12eb0:	0f af d1             	imul   %ecx,%edx
   12eb3:	8b 8d 38 ff ff ff    	mov    0xffffff38(%ebp),%ecx
   12eb9:	8b b5 34 ff ff ff    	mov    0xffffff34(%ebp),%esi
   12ebf:	0f af cb             	imul   %ebx,%ecx
   12ec2:	01 d6                	add    %edx,%esi
   12ec4:	89 85 30 ff ff ff    	mov    %eax,0xffffff30(%ebp)
   12eca:	01 ce                	add    %ecx,%esi
   12ecc:	8b 8d 70 ff ff ff    	mov    0xffffff70(%ebp),%ecx
   12ed2:	89 b5 34 ff ff ff    	mov    %esi,0xffffff34(%ebp)
   12ed8:	8b 85 30 ff ff ff    	mov    0xffffff30(%ebp),%eax
   12ede:	8b 95 34 ff ff ff    	mov    0xffffff34(%ebp),%edx
   12ee4:	89 41 20             	mov    %eax,0x20(%ecx)
   12ee7:	89 51 24             	mov    %edx,0x24(%ecx)
   12eea:	8b 95 78 ff ff ff    	mov    0xffffff78(%ebp),%edx
   12ef0:	8b 42 50             	mov    0x50(%edx),%eax
   12ef3:	31 d2                	xor    %edx,%edx
   12ef5:	89 85 20 ff ff ff    	mov    %eax,0xffffff20(%ebp)
   12efb:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12f01:	89 95 24 ff ff ff    	mov    %edx,0xffffff24(%ebp)
   12f07:	8b 48 60             	mov    0x60(%eax),%ecx
   12f0a:	8b 58 64             	mov    0x64(%eax),%ebx
   12f0d:	8b 85 20 ff ff ff    	mov    0xffffff20(%ebp),%eax
   12f13:	f7 e1                	mul    %ecx
   12f15:	89 95 1c ff ff ff    	mov    %edx,0xffffff1c(%ebp)
   12f1b:	8b 95 24 ff ff ff    	mov    0xffffff24(%ebp),%edx
   12f21:	0f af d1             	imul   %ecx,%edx
   12f24:	8b 8d 20 ff ff ff    	mov    0xffffff20(%ebp),%ecx
   12f2a:	89 95 14 ff ff ff    	mov    %edx,0xffffff14(%ebp)
   12f30:	0f af cb             	imul   %ebx,%ecx
   12f33:	8b 95 1c ff ff ff    	mov    0xffffff1c(%ebp),%edx
   12f39:	8b b5 14 ff ff ff    	mov    0xffffff14(%ebp),%esi
   12f3f:	01 f2                	add    %esi,%edx
   12f41:	89 85 18 ff ff ff    	mov    %eax,0xffffff18(%ebp)
   12f47:	01 ca                	add    %ecx,%edx
   12f49:	89 95 1c ff ff ff    	mov    %edx,0xffffff1c(%ebp)
   12f4f:	8b 8d 70 ff ff ff    	mov    0xffffff70(%ebp),%ecx
   12f55:	8b 85 18 ff ff ff    	mov    0xffffff18(%ebp),%eax
   12f5b:	8b 95 1c ff ff ff    	mov    0xffffff1c(%ebp),%edx
   12f61:	89 41 10             	mov    %eax,0x10(%ecx)
   12f64:	89 c8                	mov    %ecx,%eax
   12f66:	83 c0 10             	add    $0x10,%eax
   12f69:	89 51 14             	mov    %edx,0x14(%ecx)
   12f6c:	6a 00                	push   $0x0
   12f6e:	6a 00                	push   $0x0
   12f70:	6a 00                	push   $0x0
   12f72:	50                   	push   %eax
   12f73:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12f79:	8b 58 4c             	mov    0x4c(%eax),%ebx
   12f7c:	53                   	push   %ebx
   12f7d:	e8 2e 0c 00 00       	call   13bb0 <_CcInitializeCacheMap@20>
   12f82:	8b 8d 78 ff ff ff    	mov    0xffffff78(%ebp),%ecx
   12f88:	51                   	push   %ecx
   12f89:	e8 d2 0b 00 00       	call   13b60 <_ExInitializeResourceLite@4>
   12f8e:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12f94:	83 c0 38             	add    $0x38,%eax
   12f97:	50                   	push   %eax
   12f98:	e8 93 0c 00 00       	call   13c30 <_KeInitializeSpinLock@4>
   12f9d:	58                   	pop    %eax
 */
static __inline VOID
InitializeListHead(
	IN PLIST_ENTRY  ListHead)
{
   12f9e:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12fa4:	5a                   	pop    %edx
   12fa5:	83 c0 3c             	add    $0x3c,%eax
   12fa8:	8b 95 78 ff ff ff    	mov    0xffffff78(%ebp),%edx
   12fae:	89 40 04             	mov    %eax,0x4(%eax)
   12fb1:	89 42 3c             	mov    %eax,0x3c(%edx)
   12fb4:	8b 45 80             	mov    0xffffff80(%ebp),%eax
   12fb7:	8b 48 24             	mov    0x24(%eax),%ecx
   12fba:	8b 82 80 00 00 00    	mov    0x80(%edx),%eax
   12fc0:	89 41 10             	mov    %eax,0x10(%ecx)
   12fc3:	66 8b 82 88 00 00 00 	mov    0x88(%edx),%ax
   12fca:	66 89 41 06          	mov    %ax,0x6(%ecx)
   12fce:	8d 59 18             	lea    0x18(%ecx),%ebx
   12fd1:	66 8b 82 88 00 00 00 	mov    0x88(%edx),%ax
   12fd8:	89 d1                	mov    %edx,%ecx
   12fda:	25 ff ff 00 00       	and    $0xffff,%eax
   12fdf:	81 c1 8a 00 00 00    	add    $0x8a,%ecx
   12fe5:	50                   	push   %eax
   12fe6:	51                   	push   %ecx
   12fe7:	53                   	push   %ebx
   12fe8:	e8 53 0b 00 00       	call   13b40 <_memcpy>
   12fed:	31 db                	xor    %ebx,%ebx
   12fef:	83 c4 10             	add    $0x10,%esp
   12ff2:	e9 2f f7 ff ff       	jmp    12726 <_NtfsFileSystemControl@8+0x146>
   12ff7:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   12ffd:	85 c0                	test   %eax,%eax
   12fff:	74 11                	je     13012 <_NtfsFileSystemControl@8+0xa32>
   13001:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
   13007:	8b 48 4c             	mov    0x4c(%eax),%ecx
   1300a:	85 c9                	test   %ecx,%ecx
   1300c:	0f 85 f8 00 00 00    	jne    1310a <_NtfsFileSystemControl@8+0xb2a>
   13012:	8b 85 70 ff ff ff    	mov    0xffffff70(%ebp),%eax
   13018:	85 c0                	test   %eax,%eax
   1301a:	74 12                	je     1302e <_NtfsFileSystemControl@8+0xa4e>
   1301c:	83 ec 0c             	sub    $0xc,%esp
   1301f:	8b 85 70 ff ff ff    	mov    0xffffff70(%ebp),%eax
   13025:	50                   	push   %eax
   13026:	e8 55 0b 00 00       	call   13b80 <_ExFreePool@4>
   1302b:	83 c4 0c             	add    $0xc,%esp
   1302e:	8b bd 6c ff ff ff    	mov    0xffffff6c(%ebp),%edi
   13034:	85 ff                	test   %edi,%edi
   13036:	0f 84 df f6 ff ff    	je     1271b <_NtfsFileSystemControl@8+0x13b>
   1303c:	83 ec 0c             	sub    $0xc,%esp
   1303f:	8b b5 6c ff ff ff    	mov    0xffffff6c(%ebp),%esi
   13045:	56                   	push   %esi
   13046:	e8 35 0b 00 00       	call   13b80 <_ExFreePool@4>
   1304b:	83 c4 0c             	add    $0xc,%esp
   1304e:	e9 c8 f6 ff ff       	jmp    1271b <_NtfsFileSystemControl@8+0x13b>
   13053:	c7 45 84 20 00 00 00 	movl   $0x20,0xffffff84(%ebp)
   1305a:	50                   	push   %eax
   1305b:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   1305e:	6a 01                	push   $0x1
   13060:	53                   	push   %ebx
   13061:	50                   	push   %eax
   13062:	6a 00                	push   $0x0
   13064:	6a 00                	push   $0x0
   13066:	68 04 40 07 00       	push   $0x74004
   1306b:	8b 85 74 ff ff ff    	mov    0xffffff74(%ebp),%eax
   13071:	50                   	push   %eax
   13072:	e8 39 e6 ff ff       	call   116b0 <_NtfsDeviceIoControl>
   13077:	83 c4 20             	add    $0x20,%esp
   1307a:	89 c6                	mov    %eax,%esi
   1307c:	85 c0                	test   %eax,%eax
   1307e:	0f 88 c5 00 00 00    	js     13149 <_NtfsFileSystemControl@8+0xb69>
   13084:	80 7d e0 07          	cmpb   $0x7,0xffffffe0(%ebp)
   13088:	0f 84 cf f7 ff ff    	je     1285d <_NtfsFileSystemControl@8+0x27d>
   1308e:	53                   	push   %ebx
   1308f:	6a 59                	push   $0x59
   13091:	68 00 43 01 00       	push   $0x14300
   13096:	68 08 43 01 00       	push   $0x14308
   1309b:	e8 b0 09 00 00       	call   13a50 <_DbgPrint>
   130a0:	c7 04 24 aa 45 01 00 	movl   $0x145aa,(%esp)
   130a7:	e8 a4 09 00 00       	call   13a50 <_DbgPrint>
   130ac:	83 c4 10             	add    $0x10,%esp
   130af:	b8 4f 01 00 c0       	mov    $0xc000014f,%eax
   130b4:	e9 4d f8 ff ff       	jmp    12906 <_NtfsFileSystemControl@8+0x326>
   130b9:	50                   	push   %eax
   130ba:	68 95 00 00 00       	push   $0x95
   130bf:	68 00 43 01 00       	push   $0x14300
   130c4:	68 08 43 01 00       	push   $0x14308
   130c9:	e8 82 09 00 00       	call   13a50 <_DbgPrint>
   130ce:	5e                   	pop    %esi
   130cf:	5f                   	pop    %edi
   130d0:	53                   	push   %ebx
   130d1:	68 c4 45 01 00       	push   $0x145c4
   130d6:	e8 75 09 00 00       	call   13a50 <_DbgPrint>
   130db:	83 c4 10             	add    $0x10,%esp
   130de:	e9 1a fc ff ff       	jmp    12cfd <_NtfsFileSystemControl@8+0x71d>
   130e3:	50                   	push   %eax
   130e4:	6a 42                	push   $0x42
   130e6:	68 00 43 01 00       	push   $0x14300
   130eb:	68 08 43 01 00       	push   $0x14308
   130f0:	e8 5b 09 00 00       	call   13a50 <_DbgPrint>
   130f5:	5f                   	pop    %edi
   130f6:	58                   	pop    %eax
   130f7:	56                   	push   %esi
   130f8:	68 c4 45 01 00       	push   $0x145c4
   130fd:	e8 4e 09 00 00       	call   13a50 <_DbgPrint>
   13102:	83 c4 10             	add    $0x10,%esp
   13105:	e9 fa f7 ff ff       	jmp    12904 <_NtfsFileSystemControl@8+0x324>
   1310a:	e8 b1 0a 00 00       	call   13bc0 <@ObfDereferenceObject@4>
   1310f:	e9 fe fe ff ff       	jmp    13012 <_NtfsFileSystemControl@8+0xa32>
   13114:	0f be c8             	movsbl %al,%ecx
   13117:	f7 d9                	neg    %ecx
   13119:	b8 01 00 00 00       	mov    $0x1,%eax
   1311e:	d3 e0                	shl    %cl,%eax
   13120:	e9 7c f9 ff ff       	jmp    12aa1 <_NtfsFileSystemControl@8+0x4c1>
   13125:	83 ec 0c             	sub    $0xc,%esp
   13128:	e9 c7 fb ff ff       	jmp    12cf4 <_NtfsFileSystemControl@8+0x714>
   1312d:	83 ec 0c             	sub    $0xc,%esp
   13130:	8b 85 68 ff ff ff    	mov    0xffffff68(%ebp),%eax
   13136:	50                   	push   %eax
   13137:	e8 44 0a 00 00       	call   13b80 <_ExFreePool@4>
   1313c:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   13141:	83 c4 0c             	add    $0xc,%esp
   13144:	e9 b6 fb ff ff       	jmp    12cff <_NtfsFileSystemControl@8+0x71f>
   13149:	50                   	push   %eax
   1314a:	6a 53                	push   $0x53
   1314c:	eb 98                	jmp    130e6 <_NtfsFileSystemControl@8+0xb06>
   1314e:	50                   	push   %eax
   1314f:	68 14 01 00 00       	push   $0x114
   13154:	68 00 43 01 00       	push   $0x14300
   13159:	68 08 43 01 00       	push   $0x14308
   1315e:	e8 ed 08 00 00       	call   13a50 <_DbgPrint>
   13163:	89 34 24             	mov    %esi,(%esp)
   13166:	e8 35 01 00 00       	call   132a0 <_AttributeDataLength>
   1316b:	5a                   	pop    %edx
   1316c:	59                   	pop    %ecx
   1316d:	50                   	push   %eax
   1316e:	68 ef 45 01 00       	push   $0x145ef
   13173:	e8 d8 08 00 00       	call   13a50 <_DbgPrint>
   13178:	66 8b 46 14          	mov    0x14(%esi),%ax
   1317c:	25 ff ff 00 00       	and    $0xffff,%eax
   13181:	83 c4 10             	add    $0x10,%esp
   13184:	01 f0                	add    %esi,%eax
   13186:	8a 48 08             	mov    0x8(%eax),%cl
   13189:	88 4f 7a             	mov    %cl,0x7a(%edi)
   1318c:	8a 48 09             	mov    0x9(%eax),%cl
   1318f:	88 4f 7b             	mov    %cl,0x7b(%edi)
   13192:	66 8b 40 0a          	mov    0xa(%eax),%ax
   13196:	66 89 47 7c          	mov    %ax,0x7c(%edi)
   1319a:	e9 4c fb ff ff       	jmp    12ceb <_NtfsFileSystemControl@8+0x70b>
   1319f:	51                   	push   %ecx
   131a0:	68 02 01 00 00       	push   $0x102
   131a5:	68 00 43 01 00       	push   $0x14300
   131aa:	68 08 43 01 00       	push   $0x14308
   131af:	e8 9c 08 00 00       	call   13a50 <_DbgPrint>
   131b4:	89 34 24             	mov    %esi,(%esp)
   131b7:	e8 e4 00 00 00       	call   132a0 <_AttributeDataLength>
   131bc:	59                   	pop    %ecx
   131bd:	5a                   	pop    %edx
   131be:	50                   	push   %eax
   131bf:	68 ef 45 01 00       	push   $0x145ef
   131c4:	e8 87 08 00 00       	call   13a50 <_DbgPrint>
   131c9:	8b 46 10             	mov    0x10(%esi),%eax
   131cc:	83 c4 10             	add    $0x10,%esp
   131cf:	83 f8 20             	cmp    $0x20,%eax
   131d2:	76 05                	jbe    131d9 <_NtfsFileSystemControl@8+0xbf9>
   131d4:	b8 20 00 00 00       	mov    $0x20,%eax
   131d9:	66 89 47 38          	mov    %ax,0x38(%edi)
   131dd:	25 ff ff 00 00       	and    $0xffff,%eax
   131e2:	66 8b 4e 14          	mov    0x14(%esi),%cx
   131e6:	81 e1 ff ff 00 00    	and    $0xffff,%ecx
   131ec:	89 8d 58 ff ff ff    	mov    %ecx,0xffffff58(%ebp)
   131f2:	8d 4f 3a             	lea    0x3a(%edi),%ecx
   131f5:	8b 95 58 ff ff ff    	mov    0xffffff58(%ebp),%edx
   131fb:	01 d6                	add    %edx,%esi
   131fd:	52                   	push   %edx
   131fe:	50                   	push   %eax
   131ff:	56                   	push   %esi
   13200:	51                   	push   %ecx
   13201:	e8 3a 09 00 00       	call   13b40 <_memcpy>
   13206:	83 c4 10             	add    $0x10,%esp
   13209:	e9 94 fa ff ff       	jmp    12ca2 <_NtfsFileSystemControl@8+0x6c2>
   1320e:	90                   	nop    
   1320f:	90                   	nop    

00013210 <_FixupUpdateSequenceArray>:
   13210:	55                   	push   %ebp
   13211:	b9 01 00 00 00       	mov    $0x1,%ecx
   13216:	89 e5                	mov    %esp,%ebp
   13218:	56                   	push   %esi
   13219:	53                   	push   %ebx
   1321a:	8b 5d 08             	mov    0x8(%ebp),%ebx
   1321d:	89 da                	mov    %ebx,%edx
   1321f:	66 8b 43 04          	mov    0x4(%ebx),%ax
   13223:	25 ff ff 00 00       	and    $0xffff,%eax
   13228:	66 83 7b 06 01       	cmpw   $0x1,0x6(%ebx)
   1322d:	8d 34 18             	lea    (%eax,%ebx,1),%esi
   13230:	eb 1d                	jmp    1324f <_FixupUpdateSequenceArray+0x3f>
   13232:	66 8b 04 4e          	mov    (%esi,%ecx,2),%ax
   13236:	41                   	inc    %ecx
   13237:	66 89 82 fe 01 00 00 	mov    %ax,0x1fe(%edx)
   1323e:	81 c2 00 02 00 00    	add    $0x200,%edx
   13244:	66 8b 43 06          	mov    0x6(%ebx),%ax
   13248:	25 ff ff 00 00       	and    $0xffff,%eax
   1324d:	39 c8                	cmp    %ecx,%eax
   1324f:	77 e1                	ja     13232 <_FixupUpdateSequenceArray+0x22>
   13251:	5b                   	pop    %ebx
   13252:	5e                   	pop    %esi
   13253:	5d                   	pop    %ebp
   13254:	c3                   	ret    
   13255:	8d 74 26 00          	lea    0x0(%esi),%esi
   13259:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00013260 <_FindAttribute>:
   13260:	55                   	push   %ebp
   13261:	89 e5                	mov    %esp,%ebp
   13263:	53                   	push   %ebx
   13264:	8b 55 08             	mov    0x8(%ebp),%edx
   13267:	8b 5d 0c             	mov    0xc(%ebp),%ebx
   1326a:	66 8b 42 14          	mov    0x14(%edx),%ax
   1326e:	8b 4a 18             	mov    0x18(%edx),%ecx
   13271:	25 ff ff 00 00       	and    $0xffff,%eax
   13276:	01 d1                	add    %edx,%ecx
   13278:	01 d0                	add    %edx,%eax
   1327a:	eb 0d                	jmp    13289 <_FindAttribute+0x29>
   1327c:	8d 74 26 00          	lea    0x0(%esi),%esi
   13280:	39 da                	cmp    %ebx,%edx
   13282:	74 12                	je     13296 <_FindAttribute+0x36>
   13284:	8b 50 04             	mov    0x4(%eax),%edx
   13287:	01 d0                	add    %edx,%eax
   13289:	39 c1                	cmp    %eax,%ecx
   1328b:	76 07                	jbe    13294 <_FindAttribute+0x34>
   1328d:	8b 10                	mov    (%eax),%edx
   1328f:	83 fa ff             	cmp    $0xffffffff,%edx
   13292:	75 ec                	jne    13280 <_FindAttribute+0x20>
   13294:	31 c0                	xor    %eax,%eax
   13296:	5b                   	pop    %ebx
   13297:	5d                   	pop    %ebp
   13298:	c3                   	ret    
   13299:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

000132a0 <_AttributeDataLength>:
   132a0:	55                   	push   %ebp
   132a1:	89 e5                	mov    %esp,%ebp
   132a3:	8b 45 08             	mov    0x8(%ebp),%eax
   132a6:	80 78 08 00          	cmpb   $0x0,0x8(%eax)
   132aa:	74 05                	je     132b1 <_AttributeDataLength+0x11>
   132ac:	8b 40 38             	mov    0x38(%eax),%eax
   132af:	5d                   	pop    %ebp
   132b0:	c3                   	ret    
   132b1:	8b 40 10             	mov    0x10(%eax),%eax
   132b4:	5d                   	pop    %ebp
   132b5:	c3                   	ret    
   132b6:	8d 76 00             	lea    0x0(%esi),%esi
   132b9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

000132c0 <_AttributeAllocatedLength>:
   132c0:	55                   	push   %ebp
   132c1:	89 e5                	mov    %esp,%ebp
   132c3:	8b 45 08             	mov    0x8(%ebp),%eax
   132c6:	80 78 08 00          	cmpb   $0x0,0x8(%eax)
   132ca:	74 05                	je     132d1 <_AttributeAllocatedLength+0x11>
   132cc:	8b 40 30             	mov    0x30(%eax),%eax
   132cf:	5d                   	pop    %ebp
   132d0:	c3                   	ret    
   132d1:	8b 40 10             	mov    0x10(%eax),%eax
   132d4:	5d                   	pop    %ebp
   132d5:	c3                   	ret    
   132d6:	8d 76 00             	lea    0x0(%esi),%esi
   132d9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

000132e0 <_ReadLCN>:
   132e0:	55                   	push   %ebp
   132e1:	89 e5                	mov    %esp,%ebp
   132e3:	83 ec 10             	sub    $0x10,%esp
   132e6:	8b 4d 08             	mov    0x8(%ebp),%ecx
   132e9:	8b 55 18             	mov    0x18(%ebp),%edx
   132ec:	6a 00                	push   $0x0
   132ee:	52                   	push   %edx
   132ef:	8b 41 50             	mov    0x50(%ecx),%eax
   132f2:	50                   	push   %eax
   132f3:	8b 41 54             	mov    0x54(%ecx),%eax
   132f6:	89 c2                	mov    %eax,%edx
   132f8:	0f af 55 14          	imul   0x14(%ebp),%edx
   132fc:	52                   	push   %edx
   132fd:	8b 55 0c             	mov    0xc(%ebp),%edx
   13300:	0f af c2             	imul   %edx,%eax
   13303:	50                   	push   %eax
   13304:	8b 49 48             	mov    0x48(%ecx),%ecx
   13307:	51                   	push   %ecx
   13308:	e8 e3 e2 ff ff       	call   115f0 <_NtfsReadSectors>
   1330d:	c9                   	leave  
   1330e:	c3                   	ret    
   1330f:	90                   	nop    

00013310 <_ReadExternalAttribute>:
   13310:	55                   	push   %ebp
   13311:	89 e5                	mov    %esp,%ebp
   13313:	57                   	push   %edi
   13314:	56                   	push   %esi
   13315:	53                   	push   %ebx
   13316:	83 ec 2c             	sub    $0x2c,%esp
   13319:	8b 45 1c             	mov    0x1c(%ebp),%eax
   1331c:	8b 7d 18             	mov    0x18(%ebp),%edi
   1331f:	89 45 dc             	mov    %eax,0xffffffdc(%ebp)
   13322:	85 ff                	test   %edi,%edi
   13324:	0f 84 81 00 00 00    	je     133ab <_ReadExternalAttribute+0x9b>
   1332a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   13330:	83 ec 0c             	sub    $0xc,%esp
   13333:	8d 55 e8             	lea    0xffffffe8(%ebp),%edx
   13336:	8b 5d 14             	mov    0x14(%ebp),%ebx
   13339:	8b 4d 10             	mov    0x10(%ebp),%ecx
   1333c:	52                   	push   %edx
   1333d:	8d 45 e0             	lea    0xffffffe0(%ebp),%eax
   13340:	8b 55 0c             	mov    0xc(%ebp),%edx
   13343:	50                   	push   %eax
   13344:	53                   	push   %ebx
   13345:	31 db                	xor    %ebx,%ebx
   13347:	51                   	push   %ecx
   13348:	52                   	push   %edx
   13349:	e8 52 de ff ff       	call   111a0 <_FindRun>
   1334e:	8b 55 ec             	mov    0xffffffec(%ebp),%edx
   13351:	83 c4 20             	add    $0x20,%esp
   13354:	89 f9                	mov    %edi,%ecx
   13356:	8b 45 e8             	mov    0xffffffe8(%ebp),%eax
   13359:	39 d3                	cmp    %edx,%ebx
   1335b:	72 06                	jb     13363 <_ReadExternalAttribute+0x53>
   1335d:	77 54                	ja     133b3 <_ReadExternalAttribute+0xa3>
   1335f:	39 c7                	cmp    %eax,%edi
   13361:	77 50                	ja     133b3 <_ReadExternalAttribute+0xa3>
   13363:	8b 55 08             	mov    0x8(%ebp),%edx
   13366:	89 ce                	mov    %ecx,%esi
   13368:	8b 42 58             	mov    0x58(%edx),%eax
   1336b:	8b 55 e4             	mov    0xffffffe4(%ebp),%edx
   1336e:	0f af c1             	imul   %ecx,%eax
   13371:	89 45 d8             	mov    %eax,0xffffffd8(%ebp)
   13374:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   13377:	89 55 d4             	mov    %edx,0xffffffd4(%ebp)
   1337a:	89 45 d0             	mov    %eax,0xffffffd0(%ebp)
   1337d:	09 c2                	or     %eax,%edx
   1337f:	75 52                	jne    133d3 <_ReadExternalAttribute+0xc3>
   13381:	50                   	push   %eax
   13382:	8b 45 d8             	mov    0xffffffd8(%ebp),%eax
   13385:	50                   	push   %eax
   13386:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
   13389:	6a 00                	push   $0x0
   1338b:	50                   	push   %eax
   1338c:	e8 af 08 00 00       	call   13c40 <_memset>
   13391:	83 c4 10             	add    $0x10,%esp
   13394:	31 d2                	xor    %edx,%edx
   13396:	01 75 10             	add    %esi,0x10(%ebp)
   13399:	11 55 14             	adc    %edx,0x14(%ebp)
   1339c:	8b 4d dc             	mov    0xffffffdc(%ebp),%ecx
   1339f:	8b 55 d8             	mov    0xffffffd8(%ebp),%edx
   133a2:	01 d1                	add    %edx,%ecx
   133a4:	29 f7                	sub    %esi,%edi
   133a6:	89 4d dc             	mov    %ecx,0xffffffdc(%ebp)
   133a9:	75 85                	jne    13330 <_ReadExternalAttribute+0x20>
   133ab:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   133ae:	5b                   	pop    %ebx
   133af:	5e                   	pop    %esi
   133b0:	5f                   	pop    %edi
   133b1:	5d                   	pop    %ebp
   133b2:	c3                   	ret    
   133b3:	8b 55 08             	mov    0x8(%ebp),%edx
   133b6:	89 c1                	mov    %eax,%ecx
   133b8:	89 ce                	mov    %ecx,%esi
   133ba:	8b 42 58             	mov    0x58(%edx),%eax
   133bd:	8b 55 e4             	mov    0xffffffe4(%ebp),%edx
   133c0:	0f af c1             	imul   %ecx,%eax
   133c3:	89 45 d8             	mov    %eax,0xffffffd8(%ebp)
   133c6:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
   133c9:	89 55 d4             	mov    %edx,0xffffffd4(%ebp)
   133cc:	89 45 d0             	mov    %eax,0xffffffd0(%ebp)
   133cf:	09 c2                	or     %eax,%edx
   133d1:	74 ae                	je     13381 <_ReadExternalAttribute+0x71>
   133d3:	83 ec 0c             	sub    $0xc,%esp
   133d6:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
   133d9:	8b 5d 08             	mov    0x8(%ebp),%ebx
   133dc:	50                   	push   %eax
   133dd:	8b 45 d4             	mov    0xffffffd4(%ebp),%eax
   133e0:	51                   	push   %ecx
   133e1:	50                   	push   %eax
   133e2:	8b 45 d0             	mov    0xffffffd0(%ebp),%eax
   133e5:	50                   	push   %eax
   133e6:	53                   	push   %ebx
   133e7:	e8 f4 fe ff ff       	call   132e0 <_ReadLCN>
   133ec:	83 c4 20             	add    $0x20,%esp
   133ef:	eb a3                	jmp    13394 <_ReadExternalAttribute+0x84>
   133f1:	eb 0d                	jmp    13400 <_ReadVCN>
   133f3:	90                   	nop    
   133f4:	90                   	nop    
   133f5:	90                   	nop    
   133f6:	90                   	nop    
   133f7:	90                   	nop    
   133f8:	90                   	nop    
   133f9:	90                   	nop    
   133fa:	90                   	nop    
   133fb:	90                   	nop    
   133fc:	90                   	nop    
   133fd:	90                   	nop    
   133fe:	90                   	nop    
   133ff:	90                   	nop    

00013400 <_ReadVCN>:
   13400:	55                   	push   %ebp
   13401:	89 e5                	mov    %esp,%ebp
   13403:	57                   	push   %edi
   13404:	56                   	push   %esi
   13405:	53                   	push   %ebx
   13406:	83 ec 0c             	sub    $0xc,%esp
   13409:	8b 45 08             	mov    0x8(%ebp),%eax
   1340c:	8b 5d 14             	mov    0x14(%ebp),%ebx
   1340f:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
   13412:	8b 45 1c             	mov    0x1c(%ebp),%eax
   13415:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   13418:	8b 45 20             	mov    0x20(%ebp),%eax
   1341b:	89 45 e8             	mov    %eax,0xffffffe8(%ebp)
   1341e:	8b 75 18             	mov    0x18(%ebp),%esi
   13421:	6a 00                	push   $0x0
   13423:	8b 45 10             	mov    0x10(%ebp),%eax
   13426:	50                   	push   %eax
   13427:	8b 7d 0c             	mov    0xc(%ebp),%edi
   1342a:	57                   	push   %edi
   1342b:	e8 30 fe ff ff       	call   13260 <_FindAttribute>
   13430:	83 c4 0c             	add    $0xc,%esp
   13433:	89 c7                	mov    %eax,%edi
   13435:	85 c0                	test   %eax,%eax
   13437:	74 17                	je     13450 <_ReadVCN+0x50>
   13439:	8b 57 14             	mov    0x14(%edi),%edx
   1343c:	8b 40 10             	mov    0x10(%eax),%eax
   1343f:	39 f2                	cmp    %esi,%edx
   13441:	77 0d                	ja     13450 <_ReadVCN+0x50>
   13443:	72 42                	jb     13487 <_ReadVCN+0x87>
   13445:	39 d8                	cmp    %ebx,%eax
   13447:	76 3e                	jbe    13487 <_ReadVCN+0x87>
   13449:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   13450:	83 ec 0c             	sub    $0xc,%esp
   13453:	68 00 46 01 00       	push   $0x14600
   13458:	e8 f3 05 00 00       	call   13a50 <_DbgPrint>
   1345d:	83 c4 10             	add    $0x10,%esp
   13460:	8b 45 e8             	mov    0xffffffe8(%ebp),%eax
   13463:	89 5d 10             	mov    %ebx,0x10(%ebp)
   13466:	89 45 1c             	mov    %eax,0x1c(%ebp)
   13469:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   1346c:	89 45 18             	mov    %eax,0x18(%ebp)
   1346f:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   13472:	89 75 14             	mov    %esi,0x14(%ebp)
   13475:	89 7d 0c             	mov    %edi,0xc(%ebp)
   13478:	89 45 08             	mov    %eax,0x8(%ebp)
   1347b:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1347e:	5b                   	pop    %ebx
   1347f:	5e                   	pop    %esi
   13480:	5f                   	pop    %edi
   13481:	5d                   	pop    %ebp
   13482:	e9 89 fe ff ff       	jmp    13310 <_ReadExternalAttribute>
   13487:	8b 57 1c             	mov    0x1c(%edi),%edx
   1348a:	8b 47 18             	mov    0x18(%edi),%eax
   1348d:	39 f2                	cmp    %esi,%edx
   1348f:	72 bf                	jb     13450 <_ReadVCN+0x50>
   13491:	77 cd                	ja     13460 <_ReadVCN+0x60>
   13493:	39 d8                	cmp    %ebx,%eax
   13495:	73 c9                	jae    13460 <_ReadVCN+0x60>
   13497:	eb b7                	jmp    13450 <_ReadVCN+0x50>
   13499:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

000134a0 <_ReadFileRecord>:
   134a0:	55                   	push   %ebp
   134a1:	31 d2                	xor    %edx,%edx
   134a3:	89 e5                	mov    %esp,%ebp
   134a5:	57                   	push   %edi
   134a6:	56                   	push   %esi
   134a7:	53                   	push   %ebx
   134a8:	83 ec 0c             	sub    $0xc,%esp
   134ab:	8b 45 08             	mov    0x8(%ebp),%eax
   134ae:	8b 58 78             	mov    0x78(%eax),%ebx
   134b1:	8b 48 58             	mov    0x58(%eax),%ecx
   134b4:	89 d8                	mov    %ebx,%eax
   134b6:	f7 f1                	div    %ecx
   134b8:	89 c6                	mov    %eax,%esi
   134ba:	83 f8 01             	cmp    $0x1,%eax
   134bd:	73 05                	jae    134c4 <_ReadFileRecord+0x24>
   134bf:	be 01 00 00 00       	mov    $0x1,%esi
   134c4:	0f af ce             	imul   %esi,%ecx
   134c7:	57                   	push   %edi
   134c8:	57                   	push   %edi
   134c9:	51                   	push   %ecx
   134ca:	6a 00                	push   $0x0
   134cc:	e8 0f 06 00 00       	call   13ae0 <_ExAllocatePool@8>
   134d1:	8b 4d 08             	mov    0x8(%ebp),%ecx
   134d4:	89 c7                	mov    %eax,%edi
   134d6:	8b 45 0c             	mov    0xc(%ebp),%eax
   134d9:	0f af c3             	imul   %ebx,%eax
   134dc:	31 d2                	xor    %edx,%edx
   134de:	f7 71 58             	divl   0x58(%ecx)
   134e1:	89 3c 24             	mov    %edi,(%esp)
   134e4:	31 d2                	xor    %edx,%edx
   134e6:	56                   	push   %esi
   134e7:	8b 75 14             	mov    0x14(%ebp),%esi
   134ea:	52                   	push   %edx
   134eb:	50                   	push   %eax
   134ec:	68 80 00 00 00       	push   $0x80
   134f1:	56                   	push   %esi
   134f2:	51                   	push   %ecx
   134f3:	e8 08 ff ff ff       	call   13400 <_ReadVCN>
   134f8:	8b 55 08             	mov    0x8(%ebp),%edx
   134fb:	83 c4 20             	add    $0x20,%esp
   134fe:	8b 42 58             	mov    0x58(%edx),%eax
   13501:	31 d2                	xor    %edx,%edx
   13503:	f7 f3                	div    %ebx
   13505:	48                   	dec    %eax
   13506:	31 d2                	xor    %edx,%edx
   13508:	85 c0                	test   %eax,%eax
   1350a:	7e 05                	jle    13511 <_ReadFileRecord+0x71>
   1350c:	8b 55 0c             	mov    0xc(%ebp),%edx
   1350f:	21 c2                	and    %eax,%edx
   13511:	0f af d3             	imul   %ebx,%edx
   13514:	8d 04 17             	lea    (%edi,%edx,1),%eax
   13517:	52                   	push   %edx
   13518:	53                   	push   %ebx
   13519:	50                   	push   %eax
   1351a:	8b 45 10             	mov    0x10(%ebp),%eax
   1351d:	50                   	push   %eax
   1351e:	e8 1d 06 00 00       	call   13b40 <_memcpy>
   13523:	89 3c 24             	mov    %edi,(%esp)
   13526:	e8 55 06 00 00       	call   13b80 <_ExFreePool@4>
   1352b:	8b 45 10             	mov    0x10(%ebp),%eax
   1352e:	50                   	push   %eax
   1352f:	e8 dc fc ff ff       	call   13210 <_FixupUpdateSequenceArray>
   13534:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   13537:	31 c0                	xor    %eax,%eax
   13539:	5b                   	pop    %ebx
   1353a:	5e                   	pop    %esi
   1353b:	5f                   	pop    %edi
   1353c:	5d                   	pop    %ebp
   1353d:	c3                   	ret    
   1353e:	89 f6                	mov    %esi,%esi

00013540 <_NtfsOpenMft>:
   13540:	55                   	push   %ebp
   13541:	89 e5                	mov    %esp,%ebp
   13543:	57                   	push   %edi
   13544:	56                   	push   %esi
   13545:	53                   	push   %ebx
   13546:	83 ec 10             	sub    $0x10,%esp
   13549:	6a 3d                	push   $0x3d
   1354b:	68 0b 46 01 00       	push   $0x1460b
   13550:	68 11 46 01 00       	push   $0x14611
   13555:	e8 f6 04 00 00       	call   13a50 <_DbgPrint>
   1355a:	c7 04 24 1a 46 01 00 	movl   $0x1461a,(%esp)
   13561:	e8 ea 04 00 00       	call   13a50 <_DbgPrint>
   13566:	8b 45 08             	mov    0x8(%ebp),%eax
   13569:	59                   	pop    %ecx
   1356a:	5e                   	pop    %esi
   1356b:	8b 58 78             	mov    0x78(%eax),%ebx
   1356e:	53                   	push   %ebx
   1356f:	6a 00                	push   $0x0
   13571:	e8 6a 05 00 00       	call   13ae0 <_ExAllocatePool@8>
   13576:	89 c7                	mov    %eax,%edi
   13578:	58                   	pop    %eax
   13579:	85 ff                	test   %edi,%edi
   1357b:	5a                   	pop    %edx
   1357c:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   13581:	0f 84 a0 00 00 00    	je     13627 <_NtfsOpenMft+0xe7>
   13587:	8b 55 08             	mov    0x8(%ebp),%edx
   1358a:	50                   	push   %eax
   1358b:	50                   	push   %eax
   1358c:	6a 00                	push   $0x0
   1358e:	57                   	push   %edi
   1358f:	8b 42 50             	mov    0x50(%edx),%eax
   13592:	89 d1                	mov    %edx,%ecx
   13594:	50                   	push   %eax
   13595:	31 d2                	xor    %edx,%edx
   13597:	89 d8                	mov    %ebx,%eax
   13599:	f7 71 50             	divl   0x50(%ecx)
   1359c:	50                   	push   %eax
   1359d:	8b 41 54             	mov    0x54(%ecx),%eax
   135a0:	8b 71 68             	mov    0x68(%ecx),%esi
   135a3:	0f af c6             	imul   %esi,%eax
   135a6:	50                   	push   %eax
   135a7:	8b 49 48             	mov    0x48(%ecx),%ecx
   135aa:	51                   	push   %ecx
   135ab:	e8 40 e0 ff ff       	call   115f0 <_NtfsReadSectors>
   135b0:	83 c4 20             	add    $0x20,%esp
   135b3:	85 c0                	test   %eax,%eax
   135b5:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
   135b8:	0f 88 93 00 00 00    	js     13651 <_NtfsOpenMft+0x111>
   135be:	57                   	push   %edi
   135bf:	e8 4c fc ff ff       	call   13210 <_FixupUpdateSequenceArray>
   135c4:	6a 00                	push   $0x0
   135c6:	68 80 00 00 00       	push   $0x80
   135cb:	57                   	push   %edi
   135cc:	e8 8f fc ff ff       	call   13260 <_FindAttribute>
   135d1:	83 c4 0c             	add    $0xc,%esp
   135d4:	50                   	push   %eax
   135d5:	e8 c6 fc ff ff       	call   132a0 <_AttributeDataLength>
   135da:	31 d2                	xor    %edx,%edx
   135dc:	53                   	push   %ebx
   135dd:	f7 f3                	div    %ebx
   135df:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
   135e2:	6a 00                	push   $0x0
   135e4:	e8 f7 04 00 00       	call   13ae0 <_ExAllocatePool@8>
   135e9:	89 c3                	mov    %eax,%ebx
   135eb:	58                   	pop    %eax
   135ec:	85 db                	test   %ebx,%ebx
   135ee:	5a                   	pop    %edx
   135ef:	74 6e                	je     1365f <_NtfsOpenMft+0x11f>
   135f1:	31 f6                	xor    %esi,%esi
   135f3:	3b 75 ec             	cmp    0xffffffec(%ebp),%esi
   135f6:	73 1d                	jae    13615 <_NtfsOpenMft+0xd5>
   135f8:	8b 45 08             	mov    0x8(%ebp),%eax
   135fb:	57                   	push   %edi
   135fc:	53                   	push   %ebx
   135fd:	56                   	push   %esi
   135fe:	50                   	push   %eax
   135ff:	e8 9c fe ff ff       	call   134a0 <_ReadFileRecord>
   13604:	83 c4 10             	add    $0x10,%esp
   13607:	81 3b 46 49 4c 45    	cmpl   $0x454c4946,(%ebx)
   1360d:	74 21                	je     13630 <_NtfsOpenMft+0xf0>
   1360f:	46                   	inc    %esi
   13610:	3b 75 ec             	cmp    0xffffffec(%ebp),%esi
   13613:	72 e3                	jb     135f8 <_NtfsOpenMft+0xb8>
   13615:	83 ec 0c             	sub    $0xc,%esp
   13618:	53                   	push   %ebx
   13619:	e8 62 05 00 00       	call   13b80 <_ExFreePool@4>
   1361e:	57                   	push   %edi
   1361f:	e8 5c 05 00 00       	call   13b80 <_ExFreePool@4>
   13624:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   13627:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1362a:	5b                   	pop    %ebx
   1362b:	5e                   	pop    %esi
   1362c:	5f                   	pop    %edi
   1362d:	5d                   	pop    %ebp
   1362e:	c3                   	ret    
   1362f:	90                   	nop    
   13630:	f6 43 16 01          	testb  $0x1,0x16(%ebx)
   13634:	74 d9                	je     1360f <_NtfsOpenMft+0xcf>
   13636:	83 ec 0c             	sub    $0xc,%esp
   13639:	46                   	inc    %esi
   1363a:	53                   	push   %ebx
   1363b:	e8 90 dc ff ff       	call   112d0 <_NtfsDumpFileAttributes>
   13640:	c7 04 24 30 46 01 00 	movl   $0x14630,(%esp)
   13647:	e8 04 04 00 00       	call   13a50 <_DbgPrint>
   1364c:	83 c4 10             	add    $0x10,%esp
   1364f:	eb bf                	jmp    13610 <_NtfsOpenMft+0xd0>
   13651:	83 ec 0c             	sub    $0xc,%esp
   13654:	57                   	push   %edi
   13655:	e8 26 05 00 00       	call   13b80 <_ExFreePool@4>
   1365a:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
   1365d:	eb c8                	jmp    13627 <_NtfsOpenMft+0xe7>
   1365f:	83 ec 0c             	sub    $0xc,%esp
   13662:	57                   	push   %edi
   13663:	e8 18 05 00 00       	call   13b80 <_ExFreePool@4>
   13668:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   1366d:	eb b8                	jmp    13627 <_NtfsOpenMft+0xe7>
   1366f:	90                   	nop    

00013670 <_ReadAttribute>:
   13670:	55                   	push   %ebp
   13671:	89 e5                	mov    %esp,%ebp
   13673:	56                   	push   %esi
   13674:	53                   	push   %ebx
   13675:	8b 5d 08             	mov    0x8(%ebp),%ebx
   13678:	8b 75 0c             	mov    0xc(%ebp),%esi
   1367b:	80 7b 08 00          	cmpb   $0x0,0x8(%ebx)
   1367f:	74 1f                	je     136a0 <_ReadAttribute+0x30>
   13681:	50                   	push   %eax
   13682:	50                   	push   %eax
   13683:	56                   	push   %esi
   13684:	8b 43 18             	mov    0x18(%ebx),%eax
   13687:	40                   	inc    %eax
   13688:	50                   	push   %eax
   13689:	6a 00                	push   $0x0
   1368b:	6a 00                	push   $0x0
   1368d:	53                   	push   %ebx
   1368e:	8b 45 10             	mov    0x10(%ebp),%eax
   13691:	50                   	push   %eax
   13692:	e8 79 fc ff ff       	call   13310 <_ReadExternalAttribute>
   13697:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   1369a:	5b                   	pop    %ebx
   1369b:	5e                   	pop    %esi
   1369c:	5d                   	pop    %ebp
   1369d:	c3                   	ret    
   1369e:	89 f6                	mov    %esi,%esi
   136a0:	66 8b 43 14          	mov    0x14(%ebx),%ax
   136a4:	25 ff ff 00 00       	and    $0xffff,%eax
   136a9:	51                   	push   %ecx
   136aa:	8b 53 10             	mov    0x10(%ebx),%edx
   136ad:	8d 04 03             	lea    (%ebx,%eax,1),%eax
   136b0:	52                   	push   %edx
   136b1:	50                   	push   %eax
   136b2:	56                   	push   %esi
   136b3:	e8 88 04 00 00       	call   13b40 <_memcpy>
   136b8:	83 c4 10             	add    $0x10,%esp
   136bb:	50                   	push   %eax
   136bc:	50                   	push   %eax
   136bd:	56                   	push   %esi
   136be:	8b 43 18             	mov    0x18(%ebx),%eax
   136c1:	40                   	inc    %eax
   136c2:	50                   	push   %eax
   136c3:	6a 00                	push   $0x0
   136c5:	6a 00                	push   $0x0
   136c7:	53                   	push   %ebx
   136c8:	8b 45 10             	mov    0x10(%ebp),%eax
   136cb:	50                   	push   %eax
   136cc:	e8 3f fc ff ff       	call   13310 <_ReadExternalAttribute>
   136d1:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   136d4:	5b                   	pop    %ebx
   136d5:	5e                   	pop    %esi
   136d6:	5d                   	pop    %ebp
   136d7:	c3                   	ret    
   136d8:	90                   	nop    
   136d9:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

000136e0 <_bitset>:
   136e0:	55                   	push   %ebp
   136e1:	89 e5                	mov    %esp,%ebp
   136e3:	8b 4d 0c             	mov    0xc(%ebp),%ecx
   136e6:	8b 45 08             	mov    0x8(%ebp),%eax
   136e9:	89 ca                	mov    %ecx,%edx
   136eb:	83 e1 07             	and    $0x7,%ecx
   136ee:	c1 ea 03             	shr    $0x3,%edx
   136f1:	5d                   	pop    %ebp
   136f2:	8a 04 10             	mov    (%eax,%edx,1),%al
   136f5:	25 ff 00 00 00       	and    $0xff,%eax
   136fa:	d3 f8                	sar    %cl,%eax
   136fc:	83 e0 01             	and    $0x1,%eax
   136ff:	c3                   	ret    

00013700 <_NtfsQueryVolumeInformation@8>:
   13700:	55                   	push   %ebp
   13701:	89 e5                	mov    %esp,%ebp
   13703:	57                   	push   %edi
   13704:	56                   	push   %esi
   13705:	53                   	push   %ebx
   13706:	83 ec 0c             	sub    $0xc,%esp
   13709:	8b 45 0c             	mov    0xc(%ebp),%eax
   1370c:	8b 55 0c             	mov    0xc(%ebp),%edx
   1370f:	8b 78 60             	mov    0x60(%eax),%edi
   13712:	8b 5a 0c             	mov    0xc(%edx),%ebx
   13715:	8b 47 08             	mov    0x8(%edi),%eax
   13718:	8b 77 04             	mov    0x4(%edi),%esi
   1371b:	83 f8 03             	cmp    $0x3,%eax
   1371e:	0f 84 a2 00 00 00    	je     137c6 <_NtfsQueryVolumeInformation@8+0xc6>
   13724:	76 42                	jbe    13768 <_NtfsQueryVolumeInformation@8+0x68>
   13726:	83 f8 04             	cmp    $0x4,%eax
   13729:	0f 84 17 01 00 00    	je     13846 <_NtfsQueryVolumeInformation@8+0x146>
   1372f:	83 f8 05             	cmp    $0x5,%eax
   13732:	0f 84 cf 00 00 00    	je     13807 <_NtfsQueryVolumeInformation@8+0x107>
   13738:	bb bb 00 00 c0       	mov    $0xc00000bb,%ebx
   1373d:	8b 55 0c             	mov    0xc(%ebp),%edx
   13740:	85 db                	test   %ebx,%ebx
   13742:	89 5a 18             	mov    %ebx,0x18(%edx)
   13745:	78 5c                	js     137a3 <_NtfsQueryVolumeInformation@8+0xa3>
   13747:	8b 47 04             	mov    0x4(%edi),%eax
   1374a:	29 f0                	sub    %esi,%eax
   1374c:	89 42 1c             	mov    %eax,0x1c(%edx)
   1374f:	52                   	push   %edx
   13750:	52                   	push   %edx
   13751:	6a 00                	push   $0x0
   13753:	8b 45 0c             	mov    0xc(%ebp),%eax
   13756:	50                   	push   %eax
   13757:	e8 74 03 00 00       	call   13ad0 <_IoCompleteRequest@8>
   1375c:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1375f:	89 d8                	mov    %ebx,%eax
   13761:	5b                   	pop    %ebx
   13762:	5e                   	pop    %esi
   13763:	5f                   	pop    %edi
   13764:	5d                   	pop    %ebp
   13765:	c2 08 00             	ret    $0x8
   13768:	48                   	dec    %eax
   13769:	75 cd                	jne    13738 <_NtfsQueryVolumeInformation@8+0x38>
   1376b:	ba 04 00 00 c0       	mov    $0xc0000004,%edx
   13770:	83 fe 17             	cmp    $0x17,%esi
   13773:	76 22                	jbe    13797 <_NtfsQueryVolumeInformation@8+0x97>
   13775:	8b 45 08             	mov    0x8(%ebp),%eax
   13778:	ba 05 00 00 80       	mov    $0x80000005,%edx
   1377d:	8b 48 24             	mov    0x24(%eax),%ecx
   13780:	66 8b 41 06          	mov    0x6(%ecx),%ax
   13784:	25 ff ff 00 00       	and    $0xffff,%eax
   13789:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
   1378c:	83 c0 18             	add    $0x18,%eax
   1378f:	39 c6                	cmp    %eax,%esi
   13791:	0f 83 cd 00 00 00    	jae    13864 <_NtfsQueryVolumeInformation@8+0x164>
   13797:	89 d3                	mov    %edx,%ebx
   13799:	8b 55 0c             	mov    0xc(%ebp),%edx
   1379c:	85 db                	test   %ebx,%ebx
   1379e:	89 5a 18             	mov    %ebx,0x18(%edx)
   137a1:	79 a4                	jns    13747 <_NtfsQueryVolumeInformation@8+0x47>
   137a3:	8b 45 0c             	mov    0xc(%ebp),%eax
   137a6:	c7 40 1c 00 00 00 00 	movl   $0x0,0x1c(%eax)
   137ad:	52                   	push   %edx
   137ae:	52                   	push   %edx
   137af:	6a 00                	push   $0x0
   137b1:	8b 45 0c             	mov    0xc(%ebp),%eax
   137b4:	50                   	push   %eax
   137b5:	e8 16 03 00 00       	call   13ad0 <_IoCompleteRequest@8>
   137ba:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   137bd:	89 d8                	mov    %ebx,%eax
   137bf:	5b                   	pop    %ebx
   137c0:	5e                   	pop    %esi
   137c1:	5f                   	pop    %edi
   137c2:	5d                   	pop    %ebp
   137c3:	c2 08 00             	ret    $0x8
   137c6:	b8 05 00 00 80       	mov    $0x80000005,%eax
   137cb:	83 fe 17             	cmp    $0x17,%esi
   137ce:	76 30                	jbe    13800 <_NtfsQueryVolumeInformation@8+0x100>
   137d0:	8b 45 08             	mov    0x8(%ebp),%eax
   137d3:	83 ee 18             	sub    $0x18,%esi
   137d6:	8b 48 28             	mov    0x28(%eax),%ecx
   137d9:	c7 43 08 00 00 00 00 	movl   $0x0,0x8(%ebx)
   137e0:	c7 43 0c 00 00 00 00 	movl   $0x0,0xc(%ebx)
   137e7:	8b 41 60             	mov    0x60(%ecx),%eax
   137ea:	8b 51 64             	mov    0x64(%ecx),%edx
   137ed:	89 53 04             	mov    %edx,0x4(%ebx)
   137f0:	89 03                	mov    %eax,(%ebx)
   137f2:	8b 41 54             	mov    0x54(%ecx),%eax
   137f5:	89 43 10             	mov    %eax,0x10(%ebx)
   137f8:	8b 41 50             	mov    0x50(%ecx),%eax
   137fb:	89 43 14             	mov    %eax,0x14(%ebx)
   137fe:	31 c0                	xor    %eax,%eax
   13800:	89 c3                	mov    %eax,%ebx
   13802:	e9 36 ff ff ff       	jmp    1373d <_NtfsQueryVolumeInformation@8+0x3d>
   13807:	b8 04 00 00 c0       	mov    $0xc0000004,%eax
   1380c:	83 fe 0b             	cmp    $0xb,%esi
   1380f:	76 ef                	jbe    13800 <_NtfsQueryVolumeInformation@8+0x100>
   13811:	b8 05 00 00 80       	mov    $0x80000005,%eax
   13816:	83 fe 13             	cmp    $0x13,%esi
   13819:	76 e5                	jbe    13800 <_NtfsQueryVolumeInformation@8+0x100>
   1381b:	a1 40 46 01 00       	mov    0x14640,%eax
   13820:	83 ee 14             	sub    $0x14,%esi
   13823:	89 43 0c             	mov    %eax,0xc(%ebx)
   13826:	a1 44 46 01 00       	mov    0x14644,%eax
   1382b:	89 43 10             	mov    %eax,0x10(%ebx)
   1382e:	31 c0                	xor    %eax,%eax
   13830:	c7 03 06 00 00 00    	movl   $0x6,(%ebx)
   13836:	c7 43 04 ff 00 00 00 	movl   $0xff,0x4(%ebx)
   1383d:	c7 43 08 08 00 00 00 	movl   $0x8,0x8(%ebx)
   13844:	eb ba                	jmp    13800 <_NtfsQueryVolumeInformation@8+0x100>
   13846:	b8 05 00 00 80       	mov    $0x80000005,%eax
   1384b:	83 fe 07             	cmp    $0x7,%esi
   1384e:	76 b0                	jbe    13800 <_NtfsQueryVolumeInformation@8+0x100>
   13850:	83 ee 08             	sub    $0x8,%esi
   13853:	31 c0                	xor    %eax,%eax
   13855:	c7 03 07 00 00 00    	movl   $0x7,(%ebx)
   1385b:	c7 43 04 00 00 00 00 	movl   $0x0,0x4(%ebx)
   13862:	eb 9c                	jmp    13800 <_NtfsQueryVolumeInformation@8+0x100>
   13864:	8b 41 10             	mov    0x10(%ecx),%eax
   13867:	8b 55 f0             	mov    0xfffffff0(%ebp),%edx
   1386a:	89 43 08             	mov    %eax,0x8(%ebx)
   1386d:	89 53 0c             	mov    %edx,0xc(%ebx)
   13870:	8d 41 18             	lea    0x18(%ecx),%eax
   13873:	51                   	push   %ecx
   13874:	8d 53 12             	lea    0x12(%ebx),%edx
   13877:	8b 4d f0             	mov    0xfffffff0(%ebp),%ecx
   1387a:	51                   	push   %ecx
   1387b:	50                   	push   %eax
   1387c:	52                   	push   %edx
   1387d:	e8 be 02 00 00       	call   13b40 <_memcpy>
   13882:	c6 43 10 00          	movb   $0x0,0x10(%ebx)
   13886:	c7 03 00 00 00 00    	movl   $0x0,(%ebx)
   1388c:	8b 55 08             	mov    0x8(%ebp),%edx
   1388f:	c7 43 04 00 00 00 00 	movl   $0x0,0x4(%ebx)
   13896:	83 c4 10             	add    $0x10,%esp
   13899:	8b 42 24             	mov    0x24(%edx),%eax
   1389c:	31 d2                	xor    %edx,%edx
   1389e:	89 d3                	mov    %edx,%ebx
   138a0:	66 8b 40 06          	mov    0x6(%eax),%ax
   138a4:	25 ff ff 00 00       	and    $0xffff,%eax
   138a9:	29 c6                	sub    %eax,%esi
   138ab:	8d 76 e8             	lea    0xffffffe8(%esi),%esi
   138ae:	e9 e6 fe ff ff       	jmp    13799 <_NtfsQueryVolumeInformation@8+0x99>
   138b3:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   138b9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

000138c0 <_NtfsSetVolumeInformation@8>:
   138c0:	55                   	push   %ebp
   138c1:	89 e5                	mov    %esp,%ebp
   138c3:	83 ec 10             	sub    $0x10,%esp
   138c6:	8b 45 0c             	mov    0xc(%ebp),%eax
   138c9:	c7 40 18 bb 00 00 c0 	movl   $0xc00000bb,0x18(%eax)
   138d0:	c7 40 1c 00 00 00 00 	movl   $0x0,0x1c(%eax)
   138d7:	6a 00                	push   $0x0
   138d9:	50                   	push   %eax
   138da:	e8 f1 01 00 00       	call   13ad0 <_IoCompleteRequest@8>
   138df:	b8 bb 00 00 c0       	mov    $0xc00000bb,%eax
   138e4:	c9                   	leave  
   138e5:	c2 08 00             	ret    $0x8
   138e8:	90                   	nop    
   138e9:	90                   	nop    
   138ea:	90                   	nop    
   138eb:	90                   	nop    
   138ec:	90                   	nop    
   138ed:	90                   	nop    
   138ee:	90                   	nop    
   138ef:	90                   	nop    

000138f0 <_NtfsClose@8>:
   138f0:	55                   	push   %ebp
   138f1:	a1 00 50 01 00       	mov    0x15000,%eax
   138f6:	89 e5                	mov    %esp,%ebp
   138f8:	56                   	push   %esi
   138f9:	53                   	push   %ebx
   138fa:	8b 55 08             	mov    0x8(%ebp),%edx
   138fd:	8b 75 0c             	mov    0xc(%ebp),%esi
   13900:	39 50 04             	cmp    %edx,0x4(%eax)
   13903:	74 31                	je     13936 <_NtfsClose@8+0x46>
   13905:	8b 46 60             	mov    0x60(%esi),%eax
   13908:	8b 52 28             	mov    0x28(%edx),%edx
   1390b:	8b 40 18             	mov    0x18(%eax),%eax
   1390e:	8b 58 10             	mov    0x10(%eax),%ebx
   13911:	85 db                	test   %ebx,%ebx
   13913:	74 21                	je     13936 <_NtfsClose@8+0x46>
   13915:	8b 48 34             	mov    0x34(%eax),%ecx
   13918:	c7 40 10 00 00 00 00 	movl   $0x0,0x10(%eax)
   1391f:	85 c9                	test   %ecx,%ecx
   13921:	75 4d                	jne    13970 <_NtfsClose@8+0x80>
   13923:	8b 43 1c             	mov    0x1c(%ebx),%eax
   13926:	85 c0                	test   %eax,%eax
   13928:	75 36                	jne    13960 <_NtfsClose@8+0x70>
   1392a:	83 ec 0c             	sub    $0xc,%esp
   1392d:	53                   	push   %ebx
   1392e:	e8 4d 02 00 00       	call   13b80 <_ExFreePool@4>
   13933:	83 c4 0c             	add    $0xc,%esp
   13936:	c7 46 18 00 00 00 00 	movl   $0x0,0x18(%esi)
   1393d:	c7 46 1c 00 00 00 00 	movl   $0x0,0x1c(%esi)
   13944:	50                   	push   %eax
   13945:	50                   	push   %eax
   13946:	6a 00                	push   $0x0
   13948:	56                   	push   %esi
   13949:	e8 82 01 00 00       	call   13ad0 <_IoCompleteRequest@8>
   1394e:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   13951:	31 c0                	xor    %eax,%eax
   13953:	5b                   	pop    %ebx
   13954:	5e                   	pop    %esi
   13955:	5d                   	pop    %ebp
   13956:	c2 08 00             	ret    $0x8
   13959:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   13960:	83 ec 0c             	sub    $0xc,%esp
   13963:	50                   	push   %eax
   13964:	e8 17 02 00 00       	call   13b80 <_ExFreePool@4>
   13969:	83 c4 0c             	add    $0xc,%esp
   1396c:	eb bc                	jmp    1392a <_NtfsClose@8+0x3a>
   1396e:	89 f6                	mov    %esi,%esi
   13970:	51                   	push   %ecx
   13971:	51                   	push   %ecx
   13972:	8b 48 0c             	mov    0xc(%eax),%ecx
   13975:	51                   	push   %ecx
   13976:	52                   	push   %edx
   13977:	e8 34 e4 ff ff       	call   11db0 <_NtfsReleaseFCB>
   1397c:	83 c4 10             	add    $0x10,%esp
   1397f:	eb a2                	jmp    13923 <_NtfsClose@8+0x33>
   13981:	90                   	nop    
   13982:	90                   	nop    
   13983:	90                   	nop    
   13984:	90                   	nop    
   13985:	90                   	nop    
   13986:	90                   	nop    
   13987:	90                   	nop    
   13988:	90                   	nop    
   13989:	90                   	nop    
   1398a:	90                   	nop    
   1398b:	90                   	nop    
   1398c:	90                   	nop    
   1398d:	90                   	nop    
   1398e:	90                   	nop    
   1398f:	90                   	nop    

00013990 <_NtfsRead@8>:

NTSTATUS STDCALL
NtfsRead(PDEVICE_OBJECT DeviceObject,
	 PIRP Irp)
{
   13990:	55                   	push   %ebp
   13991:	89 e5                	mov    %esp,%ebp
   13993:	53                   	push   %ebx
   13994:	50                   	push   %eax
   13995:	8b 5d 0c             	mov    0xc(%ebp),%ebx
  PDEVICE_EXTENSION DeviceExt;
  PIO_STACK_LOCATION Stack;
  PFILE_OBJECT FileObject;
  PVOID Buffer;
  ULONG ReadLength;
  LARGE_INTEGER ReadOffset;
  ULONG ReturnedReadLength = 0;
  NTSTATUS Status = STATUS_SUCCESS;

  DPRINT("NtfsRead(DeviceObject %x, Irp %x)\n",DeviceObject,Irp);

  DeviceExt = DeviceObject->DeviceExtension;
  Stack = IoGetCurrentIrpStackLocation(Irp);
  FileObject = Stack->FileObject;

  ReadLength = Stack->Parameters.Read.Length;
  ReadOffset = Stack->Parameters.Read.ByteOffset;
  Buffer = MmGetSystemAddressForMdl(Irp->MdlAddress);
   13998:	8b 53 04             	mov    0x4(%ebx),%edx
   1399b:	66 8b 42 06          	mov    0x6(%edx),%ax
   1399f:	a8 05                	test   $0x5,%al
   139a1:	74 24                	je     139c7 <_NtfsRead@8+0x37>

  Status = NtfsReadFile(DeviceExt,
			FileObject,
			Buffer,
			ReadLength,
			ReadOffset.u.LowPart,
			Irp->Flags,
			&ReturnedReadLength);

  if (NT_SUCCESS(Status))
    {
      if (FileObject->Flags & FO_SYNCHRONOUS_IO)
	{
	  FileObject->CurrentByteOffset.QuadPart = 
	    ReadOffset.QuadPart + ReturnedReadLength;
	}
      Irp->IoStatus.Information = ReturnedReadLength;
    }
  else
    {
      Irp->IoStatus.Information = 0;
   139a3:	c7 43 1c 00 00 00 00 	movl   $0x0,0x1c(%ebx)
    }

  Irp->IoStatus.Status = Status;
   139aa:	c7 43 18 11 00 00 c0 	movl   $0xc0000011,0x18(%ebx)
  IoCompleteRequest(Irp,IO_NO_INCREMENT);
   139b1:	50                   	push   %eax
   139b2:	50                   	push   %eax
   139b3:	6a 00                	push   $0x0
   139b5:	53                   	push   %ebx
   139b6:	e8 15 01 00 00       	call   13ad0 <_IoCompleteRequest@8>

  return(Status);
}
   139bb:	b8 11 00 00 c0       	mov    $0xc0000011,%eax
   139c0:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   139c3:	c9                   	leave  
   139c4:	c2 08 00             	ret    $0x8
   139c7:	50                   	push   %eax
   139c8:	50                   	push   %eax
   139c9:	6a 00                	push   $0x0
   139cb:	52                   	push   %edx
   139cc:	e8 5f 01 00 00       	call   13b30 <_MmMapLockedPages@8>
   139d1:	5a                   	pop    %edx
   139d2:	59                   	pop    %ecx
   139d3:	c7 43 1c 00 00 00 00 	movl   $0x0,0x1c(%ebx)
   139da:	c7 43 18 11 00 00 c0 	movl   $0xc0000011,0x18(%ebx)
   139e1:	50                   	push   %eax
   139e2:	50                   	push   %eax
   139e3:	6a 00                	push   $0x0
   139e5:	53                   	push   %ebx
   139e6:	e8 e5 00 00 00       	call   13ad0 <_IoCompleteRequest@8>
   139eb:	b8 11 00 00 c0       	mov    $0xc0000011,%eax
   139f0:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   139f3:	c9                   	leave  
   139f4:	c2 08 00             	ret    $0x8
   139f7:	89 f6                	mov    %esi,%esi
   139f9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00013a00 <_NtfsWrite@8>:


NTSTATUS STDCALL
NtfsWrite(PDEVICE_OBJECT DeviceObject,
	  PIRP Irp)
{
   13a00:	55                   	push   %ebp
   13a01:	89 e5                	mov    %esp,%ebp
   13a03:	8b 45 0c             	mov    0xc(%ebp),%eax
  DPRINT("NtfwWrite(DeviceObject %x Irp %x)\n",DeviceObject,Irp);

  Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
   13a06:	c7 40 18 bb 00 00 c0 	movl   $0xc00000bb,0x18(%eax)
  Irp->IoStatus.Information = 0;
   13a0d:	c7 40 1c 00 00 00 00 	movl   $0x0,0x1c(%eax)
  return(STATUS_NOT_SUPPORTED);
}
   13a14:	b8 bb 00 00 c0       	mov    $0xc00000bb,%eax
   13a19:	5d                   	pop    %ebp
   13a1a:	c2 08 00             	ret    $0x8
   13a1d:	90                   	nop    
   13a1e:	90                   	nop    
   13a1f:	90                   	nop    

00013a20 <_IoCreateDevice@28>:
   13a20:	ff 25 30 61 01 00    	jmp    *0x16130
   13a26:	90                   	nop    
   13a27:	90                   	nop    
	...

00013a30 <_RtlZeroMemory@8>:
   13a30:	ff 25 58 61 01 00    	jmp    *0x16158
   13a36:	90                   	nop    
   13a37:	90                   	nop    
	...

00013a40 <_IoRegisterFileSystem@4>:
   13a40:	ff 25 3c 61 01 00    	jmp    *0x1613c
   13a46:	90                   	nop    
   13a47:	90                   	nop    
	...

00013a50 <_DbgPrint>:
   13a50:	ff 25 04 61 01 00    	jmp    *0x16104
   13a56:	90                   	nop    
   13a57:	90                   	nop    
	...

00013a60 <_KeInitializeEvent@12>:
   13a60:	ff 25 40 61 01 00    	jmp    *0x16140
   13a66:	90                   	nop    
   13a67:	90                   	nop    
	...

00013a70 <_IoBuildSynchronousFsdRequest@28>:
   13a70:	ff 25 24 61 01 00    	jmp    *0x16124
   13a76:	90                   	nop    
   13a77:	90                   	nop    
	...

00013a80 <_IoCallDriver@8>:
   13a80:	ff 25 28 61 01 00    	jmp    *0x16128
   13a86:	90                   	nop    
   13a87:	90                   	nop    
	...

00013a90 <_KeWaitForSingleObject@20>:
   13a90:	ff 25 48 61 01 00    	jmp    *0x16148
   13a96:	90                   	nop    
   13a97:	90                   	nop    
	...

00013aa0 <_IoBuildDeviceIoControlRequest@36>:
   13aa0:	ff 25 20 61 01 00    	jmp    *0x16120
   13aa6:	90                   	nop    
   13aa7:	90                   	nop    
	...

00013ab0 <_ExAcquireResourceExclusiveLite@8>:
   13ab0:	ff 25 08 61 01 00    	jmp    *0x16108
   13ab6:	90                   	nop    
   13ab7:	90                   	nop    
	...

00013ac0 <@ExReleaseResourceLite@4>:
   13ac0:	ff 25 f4 60 01 00    	jmp    *0x160f4
   13ac6:	90                   	nop    
   13ac7:	90                   	nop    
	...

00013ad0 <_IoCompleteRequest@8>:
   13ad0:	ff 25 2c 61 01 00    	jmp    *0x1612c
   13ad6:	90                   	nop    
   13ad7:	90                   	nop    
	...

00013ae0 <_ExAllocatePool@8>:
   13ae0:	ff 25 0c 61 01 00    	jmp    *0x1610c
   13ae6:	90                   	nop    
   13ae7:	90                   	nop    
	...

00013af0 <_RtlAssert@16>:
   13af0:	ff 25 50 61 01 00    	jmp    *0x16150
   13af6:	90                   	nop    
   13af7:	90                   	nop    
	...

00013b00 <_wcscat>:
   13b00:	ff 25 68 61 01 00    	jmp    *0x16168
   13b06:	90                   	nop    
   13b07:	90                   	nop    
	...

00013b10 <_wcscpy>:
   13b10:	ff 25 70 61 01 00    	jmp    *0x16170
   13b16:	90                   	nop    
   13b17:	90                   	nop    
	...

00013b20 <_wcslen>:
   13b20:	ff 25 74 61 01 00    	jmp    *0x16174
   13b26:	90                   	nop    
   13b27:	90                   	nop    
	...

00013b30 <_MmMapLockedPages@8>:
   13b30:	ff 25 4c 61 01 00    	jmp    *0x1614c
   13b36:	90                   	nop    
   13b37:	90                   	nop    
	...

00013b40 <_memcpy>:
   13b40:	ff 25 60 61 01 00    	jmp    *0x16160
   13b46:	90                   	nop    
   13b47:	90                   	nop    
	...

00013b50 <_ExAllocatePoolWithTag@12>:
   13b50:	ff 25 10 61 01 00    	jmp    *0x16110
   13b56:	90                   	nop    
   13b57:	90                   	nop    
	...

00013b60 <_ExInitializeResourceLite@4>:
   13b60:	ff 25 1c 61 01 00    	jmp    *0x1611c
   13b66:	90                   	nop    
   13b67:	90                   	nop    
	...

00013b70 <_ExDeleteResourceLite@4>:
   13b70:	ff 25 14 61 01 00    	jmp    *0x16114
   13b76:	90                   	nop    
   13b77:	90                   	nop    
	...

00013b80 <_ExFreePool@4>:
   13b80:	ff 25 18 61 01 00    	jmp    *0x16118
   13b86:	90                   	nop    
   13b87:	90                   	nop    
	...

00013b90 <_CcRosReleaseFileCache@4>:
   13b90:	ff 25 00 61 01 00    	jmp    *0x16100
   13b96:	90                   	nop    
   13b97:	90                   	nop    
	...

00013ba0 <_IoCreateStreamFileObject@8>:
   13ba0:	ff 25 34 61 01 00    	jmp    *0x16134
   13ba6:	90                   	nop    
   13ba7:	90                   	nop    
	...

00013bb0 <_CcInitializeCacheMap@20>:
   13bb0:	ff 25 fc 60 01 00    	jmp    *0x160fc
   13bb6:	90                   	nop    
   13bb7:	90                   	nop    
	...

00013bc0 <@ObfDereferenceObject@4>:
   13bc0:	ff 25 f8 60 01 00    	jmp    *0x160f8
   13bc6:	90                   	nop    
   13bc7:	90                   	nop    
	...

00013bd0 <_wcscmp>:
   13bd0:	ff 25 6c 61 01 00    	jmp    *0x1616c
   13bd6:	90                   	nop    
   13bd7:	90                   	nop    
	...

00013be0 <_wcsrchr>:
   13be0:	ff 25 7c 61 01 00    	jmp    *0x1617c
   13be6:	90                   	nop    
   13be7:	90                   	nop    
	...

00013bf0 <_wcsncpy>:
   13bf0:	ff 25 78 61 01 00    	jmp    *0x16178
   13bf6:	90                   	nop    
   13bf7:	90                   	nop    
	...

00013c00 <__wcsicmp>:
   13c00:	ff 25 5c 61 01 00    	jmp    *0x1615c
   13c06:	90                   	nop    
   13c07:	90                   	nop    
	...

00013c10 <_IoDeleteDevice@4>:
   13c10:	ff 25 38 61 01 00    	jmp    *0x16138
   13c16:	90                   	nop    
   13c17:	90                   	nop    
	...

00013c20 <_RtlCompareMemory@12>:
   13c20:	ff 25 54 61 01 00    	jmp    *0x16154
   13c26:	90                   	nop    
   13c27:	90                   	nop    
	...

00013c30 <_KeInitializeSpinLock@4>:
   13c30:	ff 25 44 61 01 00    	jmp    *0x16144
   13c36:	90                   	nop    
   13c37:	90                   	nop    
	...

00013c40 <_memset>:
   13c40:	ff 25 64 61 01 00    	jmp    *0x16164
   13c46:	90                   	nop    
   13c47:	90                   	nop    
	...

00013c50 <_KeAcquireSpinLock@8>:
   13c50:	ff 25 e4 60 01 00    	jmp    *0x160e4
   13c56:	90                   	nop    
   13c57:	90                   	nop    
	...

00013c60 <_KeReleaseSpinLock@8>:
   13c60:	ff 25 e8 60 01 00    	jmp    *0x160e8
   13c66:	90                   	nop    
   13c67:	90                   	nop    
	...

00013c70 <__CTOR_LIST__>:
   13c70:	ff                   	(bad)  
   13c71:	ff                   	(bad)  
   13c72:	ff                   	(bad)  
   13c73:	ff 00                	incl   (%eax)
   13c75:	00 00                	add    %al,(%eax)
	...

00013c78 <__DTOR_LIST__>:
   13c78:	ff                   	(bad)  
   13c79:	ff                   	(bad)  
   13c7a:	ff                   	(bad)  
   13c7b:	ff 00                	incl   (%eax)
   13c7d:	00 00                	add    %al,(%eax)
	...
