
psapi.nostrip.dll:     file format pei-i386

Disassembly of section .text:

68f71000 <_MemAlloc@12>:
STDCALL
MemAlloc(IN HANDLE Heap,
         IN PVOID Ptr,
         IN ULONG Size)
{
68f71000:	55                   	push   %ebp
68f71001:	89 e5                	mov    %esp,%ebp
68f71003:	57                   	push   %edi
68f71004:	56                   	push   %esi
68f71005:	53                   	push   %ebx
68f71006:	83 ec 0c             	sub    $0xc,%esp
  PVOID pBuf = NULL;
68f71009:	c7 45 f0 00 00 00 00 	movl   $0x0,0xfffffff0(%ebp)
68f71010:	8b 7d 0c             	mov    0xc(%ebp),%edi
68f71013:	8b 75 10             	mov    0x10(%ebp),%esi

  if(Size == 0 && Ptr == NULL)
68f71016:	85 f6                	test   %esi,%esi
68f71018:	8b 5d 08             	mov    0x8(%ebp),%ebx
68f7101b:	0f 94 c2             	sete   %dl
68f7101e:	85 ff                	test   %edi,%edi
68f71020:	0f 94 c0             	sete   %al
68f71023:	25 ff 00 00 00       	and    $0xff,%eax
  {
    return NULL;
68f71028:	31 c9                	xor    %ecx,%ecx
68f7102a:	85 c2                	test   %eax,%edx
68f7102c:	75 1c                	jne    68f7104a <_MemAlloc@12+0x4a>
  }
  
  if(Heap == NULL)
68f7102e:	85 db                	test   %ebx,%ebx
68f71030:	74 31                	je     68f71063 <_MemAlloc@12+0x63>
  {
    Heap = NtCurrentPeb()->ProcessHeap;
  }
 
  if(Size > 0)
68f71032:	85 f6                	test   %esi,%esi
68f71034:	74 20                	je     68f71056 <_MemAlloc@12+0x56>
  {
    if(Ptr == NULL)
68f71036:	85 ff                	test   %edi,%edi
68f71038:	74 36                	je     68f71070 <_MemAlloc@12+0x70>
      /* malloc */
      pBuf = RtlAllocateHeap(Heap, 0, Size);
    else
      /* realloc */
      pBuf = RtlReAllocateHeap(Heap, 0, Ptr, Size);
68f7103a:	56                   	push   %esi
68f7103b:	57                   	push   %edi
68f7103c:	6a 00                	push   $0x0
68f7103e:	53                   	push   %ebx
68f7103f:	e8 ac 18 00 00       	call   68f728f0 <_RtlReAllocateHeap@16>
68f71044:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
  }
  else
    /* free */
    RtlFreeHeap(Heap, 0, Ptr);

  return pBuf;
68f71047:	8b 4d f0             	mov    0xfffffff0(%ebp),%ecx
}
68f7104a:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f7104d:	89 c8                	mov    %ecx,%eax
68f7104f:	5b                   	pop    %ebx
68f71050:	5e                   	pop    %esi
68f71051:	5f                   	pop    %edi
68f71052:	5d                   	pop    %ebp
68f71053:	c2 0c 00             	ret    $0xc
68f71056:	52                   	push   %edx
68f71057:	57                   	push   %edi
68f71058:	6a 00                	push   $0x0
68f7105a:	53                   	push   %ebx
68f7105b:	e8 a0 18 00 00       	call   68f72900 <_RtlFreeHeap@12>
68f71060:	58                   	pop    %eax
68f71061:	eb e4                	jmp    68f71047 <_MemAlloc@12+0x47>
 struct _PEB * pPeb;

#if defined(__GNUC__)

 __asm__ __volatile__
68f71063:	64 a1 30 00 00 00    	mov    %fs:0x30,%eax
68f71069:	8b 58 18             	mov    0x18(%eax),%ebx
68f7106c:	eb c4                	jmp    68f71032 <_MemAlloc@12+0x32>
68f7106e:	89 f6                	mov    %esi,%esi
68f71070:	51                   	push   %ecx
68f71071:	56                   	push   %esi
68f71072:	6a 00                	push   $0x0
68f71074:	53                   	push   %ebx
68f71075:	e8 96 18 00 00       	call   68f72910 <_RtlAllocateHeap@12>
68f7107a:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
68f7107d:	58                   	pop    %eax
68f7107e:	eb c7                	jmp    68f71047 <_MemAlloc@12+0x47>

68f71080 <_PsaiMalloc>:

void *PsaiMalloc(SIZE_T size)
{
68f71080:	55                   	push   %ebp
68f71081:	89 e5                	mov    %esp,%ebp
68f71083:	83 ec 0c             	sub    $0xc,%esp
 return MemAlloc(NULL, NULL, size);
68f71086:	8b 45 08             	mov    0x8(%ebp),%eax
68f71089:	50                   	push   %eax
68f7108a:	6a 00                	push   $0x0
68f7108c:	6a 00                	push   $0x0
68f7108e:	e8 6d ff ff ff       	call   68f71000 <_MemAlloc@12>
}
68f71093:	c9                   	leave  
68f71094:	c3                   	ret    
68f71095:	8d 74 26 00          	lea    0x0(%esi),%esi
68f71099:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f710a0 <_PsaiRealloc>:

void *PsaiRealloc(void *ptr, SIZE_T size)
{
68f710a0:	55                   	push   %ebp
68f710a1:	89 e5                	mov    %esp,%ebp
68f710a3:	83 ec 0c             	sub    $0xc,%esp
 return MemAlloc(NULL, ptr, size);
68f710a6:	8b 45 0c             	mov    0xc(%ebp),%eax
68f710a9:	50                   	push   %eax
68f710aa:	8b 45 08             	mov    0x8(%ebp),%eax
68f710ad:	50                   	push   %eax
68f710ae:	6a 00                	push   $0x0
68f710b0:	e8 4b ff ff ff       	call   68f71000 <_MemAlloc@12>
}
68f710b5:	c9                   	leave  
68f710b6:	c3                   	ret    
68f710b7:	89 f6                	mov    %esi,%esi
68f710b9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f710c0 <_PsaiFree>:

void PsaiFree(void *ptr)
{
68f710c0:	55                   	push   %ebp
68f710c1:	89 e5                	mov    %esp,%ebp
68f710c3:	83 ec 0c             	sub    $0xc,%esp
 MemAlloc(NULL, ptr, 0);
68f710c6:	8b 45 08             	mov    0x8(%ebp),%eax
68f710c9:	6a 00                	push   $0x0
68f710cb:	50                   	push   %eax
68f710cc:	6a 00                	push   $0x0
68f710ce:	e8 2d ff ff ff       	call   68f71000 <_MemAlloc@12>
68f710d3:	c9                   	leave  
68f710d4:	c3                   	ret    
68f710d5:	90                   	nop    
68f710d6:	90                   	nop    
68f710d7:	90                   	nop    
68f710d8:	90                   	nop    
68f710d9:	90                   	nop    
68f710da:	90                   	nop    
68f710db:	90                   	nop    
68f710dc:	90                   	nop    
68f710dd:	90                   	nop    
68f710de:	90                   	nop    
68f710df:	90                   	nop    

68f710e0 <__SEHCompilerSpecificHandler@4>:
static __declspec(noreturn) __inline void __stdcall _SEHCompilerSpecificHandler
(
 _SEHPortableFrame_t * frame
)
{
68f710e0:	55                   	push   %ebp
68f710e1:	89 e5                	mov    %esp,%ebp
68f710e3:	83 ec 10             	sub    $0x10,%esp
 _SEHFrame_t * myframe;
 myframe = (_SEHFrame_t *)(((char *)frame) - offsetof(_SEHFrame_t, SEH_Header));
 _SEHLongJmp(myframe->SEH_JmpBuf, 1);
68f710e6:	8b 45 08             	mov    0x8(%ebp),%eax
68f710e9:	6a 01                	push   $0x1
68f710eb:	83 c0 14             	add    $0x14,%eax
68f710ee:	50                   	push   %eax
68f710ef:	e8 0d 11 00 00       	call   68f72201 <SEHLongJmp>
68f710f4:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f710fa:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f71100 <_DllMain@12>:
68f71100:	55                   	push   %ebp
68f71101:	89 e5                	mov    %esp,%ebp
68f71103:	52                   	push   %edx
68f71104:	52                   	push   %edx
68f71105:	83 7d 0c 01          	cmpl   $0x1,0xc(%ebp)
68f71109:	74 09                	je     68f71114 <_DllMain@12+0x14>
68f7110b:	b8 01 00 00 00       	mov    $0x1,%eax
68f71110:	c9                   	leave  
68f71111:	c2 0c 00             	ret    $0xc
68f71114:	83 ec 0c             	sub    $0xc,%esp
68f71117:	8b 45 08             	mov    0x8(%ebp),%eax
68f7111a:	50                   	push   %eax
68f7111b:	e8 00 19 00 00       	call   68f72a20 <_DisableThreadLibraryCalls@4>
68f71120:	b8 01 00 00 00       	mov    $0x1,%eax
68f71125:	83 c4 0c             	add    $0xc,%esp
68f71128:	c9                   	leave  
68f71129:	c2 0c 00             	ret    $0xc
68f7112c:	8d 74 26 00          	lea    0x0(%esi),%esi

68f71130 <_EnumDeviceDriversCallback@8>:
68f71130:	55                   	push   %ebp
68f71131:	b8 04 00 00 c0       	mov    $0xc0000004,%eax
68f71136:	89 e5                	mov    %esp,%ebp
68f71138:	53                   	push   %ebx
68f71139:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f7113c:	8b 59 04             	mov    0x4(%ecx),%ebx
68f7113f:	85 db                	test   %ebx,%ebx
68f71141:	74 17                	je     68f7115a <_EnumDeviceDriversCallback@8+0x2a>
68f71143:	8b 45 08             	mov    0x8(%ebp),%eax
68f71146:	8b 11                	mov    (%ecx),%edx
68f71148:	8b 40 08             	mov    0x8(%eax),%eax
68f7114b:	89 02                	mov    %eax,(%edx)
68f7114d:	8d 43 ff             	lea    0xffffffff(%ebx),%eax
68f71150:	83 c2 04             	add    $0x4,%edx
68f71153:	89 41 04             	mov    %eax,0x4(%ecx)
68f71156:	89 11                	mov    %edx,(%ecx)
68f71158:	31 c0                	xor    %eax,%eax
68f7115a:	5b                   	pop    %ebx
68f7115b:	5d                   	pop    %ebp
68f7115c:	c2 08 00             	ret    $0x8
68f7115f:	90                   	nop    

68f71160 <_EnumProcessesCallback@8>:
{
  DWORD *lpidProcess;
  DWORD nCount;
} ENUM_PROCESSES_CONTEXT, *PENUM_PROCESSES_CONTEXT;

NTSTATUS STDCALL
EnumProcessesCallback(IN PSYSTEM_PROCESSES CurrentProcess,
                      IN OUT PVOID CallbackContext)
{
68f71160:	55                   	push   %ebp
  PENUM_PROCESSES_CONTEXT Context = (PENUM_PROCESSES_CONTEXT)CallbackContext;

  /* no more buffer space */
  if(Context->nCount == 0)
  {
    return STATUS_INFO_LENGTH_MISMATCH;
68f71161:	b8 04 00 00 c0       	mov    $0xc0000004,%eax
68f71166:	89 e5                	mov    %esp,%ebp
68f71168:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f7116b:	8b 51 04             	mov    0x4(%ecx),%edx
68f7116e:	85 d2                	test   %edx,%edx
68f71170:	74 18                	je     68f7118a <_EnumProcessesCallback@8+0x2a>
  }

  /* return current process */
  *Context->lpidProcess = (DWORD)CurrentProcess->ProcessId;
68f71172:	8b 55 08             	mov    0x8(%ebp),%edx
68f71175:	8b 01                	mov    (%ecx),%eax
68f71177:	8b 52 44             	mov    0x44(%edx),%edx
68f7117a:	89 10                	mov    %edx,(%eax)

  /* go to next array slot */
  Context->lpidProcess++;
68f7117c:	83 c0 04             	add    $0x4,%eax
68f7117f:	89 01                	mov    %eax,(%ecx)
  Context->nCount--;
68f71181:	8b 41 04             	mov    0x4(%ecx),%eax
68f71184:	48                   	dec    %eax
68f71185:	89 41 04             	mov    %eax,0x4(%ecx)

  return STATUS_SUCCESS;
68f71188:	31 c0                	xor    %eax,%eax
}
68f7118a:	5d                   	pop    %ebp
68f7118b:	c2 08 00             	ret    $0x8
68f7118e:	89 f6                	mov    %esi,%esi

68f71190 <_EnumProcessModulesCallback@12>:


typedef struct _ENUM_PROCESS_MODULES_CONTEXT
{
  HMODULE *lphModule;
  DWORD nCount;
} ENUM_PROCESS_MODULES_CONTEXT, *PENUM_PROCESS_MODULES_CONTEXT;

NTSTATUS STDCALL
EnumProcessModulesCallback(IN HANDLE ProcessHandle,
                           IN PLDR_MODULE CurrentModule,
                           IN OUT PVOID CallbackContext)
{
68f71190:	55                   	push   %ebp
  PENUM_PROCESS_MODULES_CONTEXT Context = (PENUM_PROCESS_MODULES_CONTEXT)CallbackContext;

  /* no more buffer space */
  if(Context->nCount == 0)
  {
    return STATUS_INFO_LENGTH_MISMATCH;
68f71191:	b8 04 00 00 c0       	mov    $0xc0000004,%eax
68f71196:	89 e5                	mov    %esp,%ebp
68f71198:	53                   	push   %ebx
68f71199:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f7119c:	8b 59 04             	mov    0x4(%ecx),%ebx
68f7119f:	85 db                	test   %ebx,%ebx
68f711a1:	74 17                	je     68f711ba <_EnumProcessModulesCallback@12+0x2a>
  }

  /* return current process */
  *Context->lphModule = CurrentModule->BaseAddress;
68f711a3:	8b 45 0c             	mov    0xc(%ebp),%eax
68f711a6:	8b 11                	mov    (%ecx),%edx
68f711a8:	8b 40 18             	mov    0x18(%eax),%eax
68f711ab:	89 02                	mov    %eax,(%edx)

  /* go to next array slot */
  Context->lphModule++;
  Context->nCount--;
68f711ad:	8d 43 ff             	lea    0xffffffff(%ebx),%eax
68f711b0:	83 c2 04             	add    $0x4,%edx
68f711b3:	89 41 04             	mov    %eax,0x4(%ecx)
68f711b6:	89 11                	mov    %edx,(%ecx)

  return STATUS_SUCCESS;
68f711b8:	31 c0                	xor    %eax,%eax
}
68f711ba:	5b                   	pop    %ebx
68f711bb:	5d                   	pop    %ebp
68f711bc:	c2 0c 00             	ret    $0xc
68f711bf:	90                   	nop    

68f711c0 <_GetDeviceDriverNameCallback@8>:


typedef struct _GET_DEVICE_DRIVER_NAME_CONTEXT
{
  LPVOID ImageBase;
  struct
  {
    ULONG bFullName : sizeof(ULONG) * 8 / 2;
    ULONG bUnicode : sizeof(ULONG) * 8 / 2;
  };
  DWORD nSize;
  union
  {
    LPVOID lpName;
    LPSTR lpAnsiName;
    LPWSTR lpUnicodeName;
  };
} GET_DEVICE_DRIVER_NAME_CONTEXT, *PGET_DEVICE_DRIVER_NAME_CONTEXT;

NTSTATUS STDCALL
GetDeviceDriverNameCallback(IN PSYSTEM_MODULE_INFORMATION_ENTRY CurrentModule,
                            IN OUT PVOID CallbackContext)
{
68f711c0:	55                   	push   %ebp
  PGET_DEVICE_DRIVER_NAME_CONTEXT Context = (PGET_DEVICE_DRIVER_NAME_CONTEXT)CallbackContext;

  /* module found */
  if(Context->ImageBase == CurrentModule->Base)
  {
    PCHAR pcModuleName;
    ULONG l;

    /* get the full name or just the filename part */
    if(Context->bFullName)
      pcModuleName = &CurrentModule->ImageName[0];
    else
      pcModuleName = &CurrentModule->ImageName[CurrentModule->PathLength];

    /* get the length of the name */
    l = strlen(pcModuleName);

    if(Context->nSize <= l)
    {
      /* use the user buffer's length */
      l = Context->nSize;
    }
    else
    {
      /* enough space for the null terminator */
      Context->nSize = ++l;
    }

    /* copy the string */
    if(Context->bUnicode)
    {
      ANSI_STRING AnsiString;
      UNICODE_STRING UnicodeString;

      UnicodeString.Length = 0;
      UnicodeString.MaximumLength = l * sizeof(WCHAR);
      UnicodeString.Buffer = Context->lpUnicodeName;

      RtlInitAnsiString(&AnsiString, pcModuleName);
      /* driver names should always be in language-neutral ASCII, so we don't
         bother calling AreFileApisANSI() */
      RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, FALSE);
    }
    else
    {
      memcpy(Context->lpAnsiName, pcModuleName, l);
    }

    /* terminate the enumeration */
    return STATUS_NO_MORE_FILES;
  }
  else
  {
    /* continue searching */
    return STATUS_SUCCESS;
68f711c1:	31 d2                	xor    %edx,%edx
68f711c3:	89 e5                	mov    %esp,%ebp
68f711c5:	56                   	push   %esi
68f711c6:	53                   	push   %ebx
68f711c7:	83 ec 10             	sub    $0x10,%esp
68f711ca:	8b 4d 08             	mov    0x8(%ebp),%ecx
68f711cd:	8b 5d 0c             	mov    0xc(%ebp),%ebx
68f711d0:	8b 41 08             	mov    0x8(%ecx),%eax
68f711d3:	39 03                	cmp    %eax,(%ebx)
68f711d5:	74 0b                	je     68f711e2 <_GetDeviceDriverNameCallback@8+0x22>
  }
}
68f711d7:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f711da:	89 d0                	mov    %edx,%eax
68f711dc:	5b                   	pop    %ebx
68f711dd:	5e                   	pop    %esi
68f711de:	5d                   	pop    %ebp
68f711df:	c2 08 00             	ret    $0x8
68f711e2:	8d 71 1c             	lea    0x1c(%ecx),%esi
68f711e5:	66 83 7b 04 00       	cmpw   $0x0,0x4(%ebx)
68f711ea:	75 0d                	jne    68f711f9 <_GetDeviceDriverNameCallback@8+0x39>
68f711ec:	66 8b 41 1a          	mov    0x1a(%ecx),%ax
68f711f0:	25 ff ff 00 00       	and    $0xffff,%eax
68f711f5:	8d 74 08 1c          	lea    0x1c(%eax,%ecx,1),%esi
68f711f9:	83 ec 0c             	sub    $0xc,%esp
68f711fc:	56                   	push   %esi
68f711fd:	e8 ee 17 00 00       	call   68f729f0 <_strlen>
68f71202:	8b 53 08             	mov    0x8(%ebx),%edx
68f71205:	83 c4 10             	add    $0x10,%esp
68f71208:	39 c2                	cmp    %eax,%edx
68f7120a:	77 59                	ja     68f71265 <_GetDeviceDriverNameCallback@8+0xa5>
68f7120c:	89 d0                	mov    %edx,%eax
68f7120e:	66 83 7b 06 00       	cmpw   $0x0,0x6(%ebx)
68f71213:	74 37                	je     68f7124c <_GetDeviceDriverNameCallback@8+0x8c>
68f71215:	01 c0                	add    %eax,%eax
68f71217:	66 c7 45 f0 00 00    	movw   $0x0,0xfffffff0(%ebp)
68f7121d:	66 89 45 f2          	mov    %ax,0xfffffff2(%ebp)
68f71221:	8b 43 0c             	mov    0xc(%ebx),%eax
68f71224:	53                   	push   %ebx
68f71225:	53                   	push   %ebx
68f71226:	8d 5d e8             	lea    0xffffffe8(%ebp),%ebx
68f71229:	89 45 f4             	mov    %eax,0xfffffff4(%ebp)
68f7122c:	56                   	push   %esi
68f7122d:	53                   	push   %ebx
68f7122e:	e8 ed 16 00 00       	call   68f72920 <_RtlInitAnsiString@8>
68f71233:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
68f71236:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
68f7123d:	53                   	push   %ebx
68f7123e:	50                   	push   %eax
68f7123f:	e8 ec 16 00 00       	call   68f72930 <_RtlAnsiStringToUnicodeString@12>
68f71244:	ba 06 00 00 80       	mov    $0x80000006,%edx
68f71249:	59                   	pop    %ecx
68f7124a:	eb 8b                	jmp    68f711d7 <_GetDeviceDriverNameCallback@8+0x17>
68f7124c:	52                   	push   %edx
68f7124d:	50                   	push   %eax
68f7124e:	56                   	push   %esi
68f7124f:	8b 4b 0c             	mov    0xc(%ebx),%ecx
68f71252:	51                   	push   %ecx
68f71253:	e8 68 17 00 00       	call   68f729c0 <_memcpy>
68f71258:	83 c4 10             	add    $0x10,%esp
68f7125b:	ba 06 00 00 80       	mov    $0x80000006,%edx
68f71260:	e9 72 ff ff ff       	jmp    68f711d7 <_GetDeviceDriverNameCallback@8+0x17>
68f71265:	40                   	inc    %eax
68f71266:	89 43 08             	mov    %eax,0x8(%ebx)
68f71269:	eb a3                	jmp    68f7120e <_GetDeviceDriverNameCallback@8+0x4e>
68f7126b:	90                   	nop    
68f7126c:	8d 74 26 00          	lea    0x0(%esi),%esi

68f71270 <_InternalGetDeviceDriverName>:


static DWORD
InternalGetDeviceDriverName(BOOLEAN bUnicode,
                            BOOLEAN bFullName,
                            LPVOID ImageBase,
                            LPVOID lpName,
                            DWORD nSize)
{
68f71270:	55                   	push   %ebp
68f71271:	88 d1                	mov    %dl,%cl
68f71273:	89 e5                	mov    %esp,%ebp
68f71275:	57                   	push   %edi
68f71276:	56                   	push   %esi
68f71277:	53                   	push   %ebx
68f71278:	83 ec 1c             	sub    $0x1c,%esp
68f7127b:	88 c3                	mov    %al,%bl
68f7127d:	8b 75 10             	mov    0x10(%ebp),%esi
  GET_DEVICE_DRIVER_NAME_CONTEXT Context;
  NTSTATUS Status;

  if(lpName == NULL || nSize == 0)
68f71280:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71283:	85 c0                	test   %eax,%eax
68f71285:	8b 7d 08             	mov    0x8(%ebp),%edi
68f71288:	0f 94 c2             	sete   %dl
68f7128b:	85 f6                	test   %esi,%esi
68f7128d:	0f 94 c0             	sete   %al
68f71290:	09 d0                	or     %edx,%eax
  {
    return 0;
68f71292:	31 d2                	xor    %edx,%edx
68f71294:	a8 01                	test   $0x1,%al
68f71296:	75 4c                	jne    68f712e4 <_InternalGetDeviceDriverName+0x74>
  }

  if(ImageBase == NULL)
68f71298:	85 ff                	test   %edi,%edi
68f7129a:	74 52                	je     68f712ee <_InternalGetDeviceDriverName+0x7e>
  {
    SetLastError(ERROR_INVALID_HANDLE);
    return 0;
  }

  Context.ImageBase = ImageBase;
  Context.bFullName = bFullName;
68f7129c:	31 c0                	xor    %eax,%eax
68f7129e:	89 7d d8             	mov    %edi,0xffffffd8(%ebp)
68f712a1:	88 c8                	mov    %cl,%al
  Context.bUnicode = bUnicode;
  Context.nSize = nSize;
68f712a3:	89 75 e0             	mov    %esi,0xffffffe0(%ebp)
68f712a6:	66 89 45 dc          	mov    %ax,0xffffffdc(%ebp)
68f712aa:	31 c0                	xor    %eax,%eax
68f712ac:	88 d8                	mov    %bl,%al
68f712ae:	66 89 45 de          	mov    %ax,0xffffffde(%ebp)
  Context.lpName = lpName;
68f712b2:	8b 45 0c             	mov    0xc(%ebp),%eax
68f712b5:	89 45 e4             	mov    %eax,0xffffffe4(%ebp)

  /* start the enumeration */
  Status = PsaEnumerateSystemModules(GetDeviceDriverNameCallback, &Context);
68f712b8:	50                   	push   %eax
68f712b9:	50                   	push   %eax
68f712ba:	8d 45 d8             	lea    0xffffffd8(%ebp),%eax
68f712bd:	50                   	push   %eax
68f712be:	68 c0 11 f7 68       	push   $0x68f711c0
68f712c3:	e8 d8 11 00 00       	call   68f724a0 <_PsaEnumerateSystemModules@8>

  if(Status == STATUS_NO_MORE_FILES)
68f712c8:	5e                   	pop    %esi
68f712c9:	3d 06 00 00 80       	cmp    $0x80000006,%eax
68f712ce:	5f                   	pop    %edi
68f712cf:	74 2f                	je     68f71300 <_InternalGetDeviceDriverName+0x90>
  {
    /* module was found, return string size */
    return Context.nSize;
  }
  else if(NT_SUCCESS(Status))
68f712d1:	85 c0                	test   %eax,%eax
68f712d3:	78 38                	js     68f7130d <_InternalGetDeviceDriverName+0x9d>
  {
    /* module was not found */
    SetLastError(ERROR_INVALID_HANDLE);
68f712d5:	83 ec 0c             	sub    $0xc,%esp
68f712d8:	6a 06                	push   $0x6
  }
  else
  {
    /* an error occurred */
    SetLastErrorByStatus(Status);
68f712da:	e8 51 17 00 00       	call   68f72a30 <_SetLastError@4>
  }
  return 0;
68f712df:	31 d2                	xor    %edx,%edx
68f712e1:	83 c4 0c             	add    $0xc,%esp
}
68f712e4:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f712e7:	89 d0                	mov    %edx,%eax
68f712e9:	5b                   	pop    %ebx
68f712ea:	5e                   	pop    %esi
68f712eb:	5f                   	pop    %edi
68f712ec:	5d                   	pop    %ebp
68f712ed:	c3                   	ret    
68f712ee:	83 ec 0c             	sub    $0xc,%esp
68f712f1:	6a 06                	push   $0x6
68f712f3:	e8 38 17 00 00       	call   68f72a30 <_SetLastError@4>
68f712f8:	31 d2                	xor    %edx,%edx
68f712fa:	eb e8                	jmp    68f712e4 <_InternalGetDeviceDriverName+0x74>
68f712fc:	8d 74 26 00          	lea    0x0(%esi),%esi
68f71300:	8b 55 e0             	mov    0xffffffe0(%ebp),%edx
68f71303:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71306:	89 d0                	mov    %edx,%eax
68f71308:	5b                   	pop    %ebx
68f71309:	5e                   	pop    %esi
68f7130a:	5f                   	pop    %edi
68f7130b:	5d                   	pop    %ebp
68f7130c:	c3                   	ret    
68f7130d:	83 ec 0c             	sub    $0xc,%esp
68f71310:	50                   	push   %eax
68f71311:	e8 2a 16 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71316:	50                   	push   %eax
68f71317:	eb c1                	jmp    68f712da <_InternalGetDeviceDriverName+0x6a>
68f71319:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

68f71320 <_InternalGetMappedFileName>:


static DWORD
InternalGetMappedFileName(BOOLEAN bUnicode,
                          HANDLE hProcess,
                          LPVOID lpv,
                          LPVOID lpName,
                          DWORD nSize)
{
68f71320:	55                   	push   %ebp
68f71321:	89 e5                	mov    %esp,%ebp
68f71323:	57                   	push   %edi
68f71324:	56                   	push   %esi
68f71325:	53                   	push   %ebx
68f71326:	83 ec 1c             	sub    $0x1c,%esp
68f71329:	88 45 e7             	mov    %al,0xffffffe7(%ebp)
  PMEMORY_SECTION_NAME pmsnName;
  ULONG nBufSize;
  NTSTATUS Status;

  if(nSize == 0 || lpName == NULL)
68f7132c:	8b 45 10             	mov    0x10(%ebp),%eax
68f7132f:	89 d7                	mov    %edx,%edi
68f71331:	85 c0                	test   %eax,%eax
68f71333:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71336:	0f 94 c2             	sete   %dl
68f71339:	85 c0                	test   %eax,%eax
68f7133b:	0f 94 c0             	sete   %al
68f7133e:	09 d0                	or     %edx,%eax
  {
    return 0;
68f71340:	31 d2                	xor    %edx,%edx
68f71342:	a8 01                	test   $0x1,%al
68f71344:	0f 85 a6 00 00 00    	jne    68f713f0 <_InternalGetMappedFileName+0xd0>
  }

  if(nSize > (0xFFFF / sizeof(WCHAR)))
  {
    /* if the user buffer contains more characters than would fit in an
       UNICODE_STRING, limit the buffer size. RATIONALE: we don't limit buffer
       size elsewhere because here superfluous buffer size will mean a larger
       temporary buffer */
    nBufSize = 0xFFFF / sizeof(WCHAR);
68f7134a:	be ff 7f 00 00       	mov    $0x7fff,%esi
68f7134f:	81 7d 10 ff 7f 00 00 	cmpl   $0x7fff,0x10(%ebp)
68f71356:	0f 86 a4 00 00 00    	jbe    68f71400 <_InternalGetMappedFileName+0xe0>
  }
  else
  {
    nBufSize = nSize * sizeof(WCHAR);
  }

  /* allocate the memory */
  pmsnName = PsaiMalloc(nBufSize + offsetof(MEMORY_SECTION_NAME, NameBuffer));
68f7135c:	83 ec 0c             	sub    $0xc,%esp
68f7135f:	8d 46 08             	lea    0x8(%esi),%eax
68f71362:	50                   	push   %eax
68f71363:	e8 18 fd ff ff       	call   68f71080 <_PsaiMalloc>

  if(pmsnName == NULL)
68f71368:	83 c4 10             	add    $0x10,%esp
68f7136b:	89 c3                	mov    %eax,%ebx
68f7136d:	85 c0                	test   %eax,%eax
68f7136f:	0f 84 e2 00 00 00    	je     68f71457 <_InternalGetMappedFileName+0x137>
  {
    SetLastError(ERROR_OUTOFMEMORY);
    return 0;
  }

   /* initialize the destination buffer */
   pmsnName->SectionFileName.Length = 0;
   pmsnName->SectionFileName.Length = nBufSize;
68f71375:	66 89 30             	mov    %si,(%eax)

#if 0
   __try
   {
#endif
   /* query the name */
   Status = NtQueryVirtualMemory(hProcess,
68f71378:	50                   	push   %eax
68f71379:	50                   	push   %eax
68f7137a:	6a 00                	push   $0x0
68f7137c:	56                   	push   %esi
68f7137d:	53                   	push   %ebx
68f7137e:	6a 02                	push   $0x2
68f71380:	8b 45 08             	mov    0x8(%ebp),%eax
68f71383:	50                   	push   %eax
68f71384:	57                   	push   %edi
68f71385:	e8 c6 15 00 00       	call   68f72950 <_NtQueryVirtualMemory@24>
68f7138a:	89 c6                	mov    %eax,%esi
                                 lpv,
                                 MemorySectionName,
                                 pmsnName,
                                 nBufSize,
                                 NULL);
   if(!NT_SUCCESS(Status))
68f7138c:	5f                   	pop    %edi
68f7138d:	85 f6                	test   %esi,%esi
68f7138f:	58                   	pop    %eax
68f71390:	0f 88 e6 00 00 00    	js     68f7147c <_InternalGetMappedFileName+0x15c>
   {
     PsaiFree(pmsnName);
     SetLastErrorByStatus(Status);
     return 0;
   }

   if(bUnicode)
68f71396:	80 7d e7 00          	cmpb   $0x0,0xffffffe7(%ebp)
68f7139a:	75 74                	jne    68f71410 <_InternalGetMappedFileName+0xf0>
   {
     /* destination is an Unicode string: direct copy */
     memcpy((LPWSTR)lpName, pmsnName->NameBuffer, pmsnName->SectionFileName.Length);

     PsaiFree(pmsnName);

     if(pmsnName->SectionFileName.Length < nSize)
     {
       /* null-terminate the string */
       ((LPWSTR)lpName)[pmsnName->SectionFileName.Length] = 0;
       return pmsnName->SectionFileName.Length + 1;
     }

     return pmsnName->SectionFileName.Length;
   }
   else
   {
     ANSI_STRING AnsiString;

     AnsiString.Length = 0;
     AnsiString.MaximumLength = nSize;
68f7139c:	8b 45 10             	mov    0x10(%ebp),%eax
     AnsiString.Buffer = (LPSTR)lpName;
68f7139f:	8b 55 0c             	mov    0xc(%ebp),%edx
68f713a2:	66 c7 45 e8 00 00    	movw   $0x0,0xffffffe8(%ebp)
68f713a8:	66 89 45 ea          	mov    %ax,0xffffffea(%ebp)
68f713ac:	89 55 ec             	mov    %edx,0xffffffec(%ebp)
68f713af:	8d 75 e8             	lea    0xffffffe8(%ebp),%esi

     if(AreFileApisANSI())
68f713b2:	e8 89 16 00 00       	call   68f72a40 <_AreFileApisANSI@0>
68f713b7:	85 c0                	test   %eax,%eax
68f713b9:	0f 84 ae 00 00 00    	je     68f7146d <_InternalGetMappedFileName+0x14d>
       RtlUnicodeStringToAnsiString(&AnsiString, &pmsnName->SectionFileName, FALSE);
68f713bf:	50                   	push   %eax
68f713c0:	6a 00                	push   $0x0
68f713c2:	53                   	push   %ebx
68f713c3:	56                   	push   %esi
68f713c4:	e8 97 15 00 00       	call   68f72960 <_RtlUnicodeStringToAnsiString@12>
     else
       RtlUnicodeStringToOemString(&AnsiString, &pmsnName->SectionFileName, FALSE);
68f713c9:	50                   	push   %eax
68f713ca:	50                   	push   %eax

     PsaiFree(pmsnName);
68f713cb:	53                   	push   %ebx
68f713cc:	e8 ef fc ff ff       	call   68f710c0 <_PsaiFree>

     if(AnsiString.Length < nSize)
68f713d1:	8b 45 e8             	mov    0xffffffe8(%ebp),%eax
68f713d4:	25 ff ff 00 00       	and    $0xffff,%eax
68f713d9:	83 c4 10             	add    $0x10,%esp
     {
       /* null-terminate the string */
       ((LPSTR)lpName)[AnsiString.Length] = 0;
       return AnsiString.Length + 1;
     }

     return AnsiString.Length;
68f713dc:	89 c2                	mov    %eax,%edx
68f713de:	3b 45 10             	cmp    0x10(%ebp),%eax
68f713e1:	73 0d                	jae    68f713f0 <_InternalGetMappedFileName+0xd0>
68f713e3:	8b 55 0c             	mov    0xc(%ebp),%edx
68f713e6:	c6 04 02 00          	movb   $0x0,(%edx,%eax,1)
68f713ea:	8d 50 01             	lea    0x1(%eax),%edx
68f713ed:	8d 76 00             	lea    0x0(%esi),%esi
   }

#if 0
   }
   __finally
   {
     PsaiFree(pmsnName);
   }
#endif
}
68f713f0:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f713f3:	89 d0                	mov    %edx,%eax
68f713f5:	5b                   	pop    %ebx
68f713f6:	5e                   	pop    %esi
68f713f7:	5f                   	pop    %edi
68f713f8:	5d                   	pop    %ebp
68f713f9:	c3                   	ret    
68f713fa:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71400:	8b 75 10             	mov    0x10(%ebp),%esi
68f71403:	01 f6                	add    %esi,%esi
68f71405:	e9 52 ff ff ff       	jmp    68f7135c <_InternalGetMappedFileName+0x3c>
68f7140a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71410:	66 8b 03             	mov    (%ebx),%ax
68f71413:	8d 53 08             	lea    0x8(%ebx),%edx
68f71416:	25 ff ff 00 00       	and    $0xffff,%eax
68f7141b:	51                   	push   %ecx
68f7141c:	50                   	push   %eax
68f7141d:	52                   	push   %edx
68f7141e:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71421:	50                   	push   %eax
68f71422:	e8 99 15 00 00       	call   68f729c0 <_memcpy>
68f71427:	89 1c 24             	mov    %ebx,(%esp)
68f7142a:	e8 91 fc ff ff       	call   68f710c0 <_PsaiFree>
68f7142f:	66 8b 03             	mov    (%ebx),%ax
68f71432:	25 ff ff 00 00       	and    $0xffff,%eax
68f71437:	83 c4 10             	add    $0x10,%esp
68f7143a:	89 c2                	mov    %eax,%edx
68f7143c:	3b 45 10             	cmp    0x10(%ebp),%eax
68f7143f:	73 af                	jae    68f713f0 <_InternalGetMappedFileName+0xd0>
68f71441:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71444:	66 c7 04 42 00 00    	movw   $0x0,(%edx,%eax,2)
68f7144a:	66 8b 03             	mov    (%ebx),%ax
68f7144d:	25 ff ff 00 00       	and    $0xffff,%eax
68f71452:	8d 50 01             	lea    0x1(%eax),%edx
68f71455:	eb 99                	jmp    68f713f0 <_InternalGetMappedFileName+0xd0>
68f71457:	83 ec 0c             	sub    $0xc,%esp
68f7145a:	6a 0e                	push   $0xe
68f7145c:	e8 cf 15 00 00       	call   68f72a30 <_SetLastError@4>
68f71461:	31 d2                	xor    %edx,%edx
68f71463:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71466:	89 d0                	mov    %edx,%eax
68f71468:	5b                   	pop    %ebx
68f71469:	5e                   	pop    %esi
68f7146a:	5f                   	pop    %edi
68f7146b:	5d                   	pop    %ebp
68f7146c:	c3                   	ret    
68f7146d:	50                   	push   %eax
68f7146e:	6a 00                	push   $0x0
68f71470:	53                   	push   %ebx
68f71471:	56                   	push   %esi
68f71472:	e8 f9 14 00 00       	call   68f72970 <_RtlUnicodeStringToOemString@12>
68f71477:	e9 4d ff ff ff       	jmp    68f713c9 <_InternalGetMappedFileName+0xa9>
68f7147c:	83 ec 0c             	sub    $0xc,%esp
68f7147f:	53                   	push   %ebx
68f71480:	e8 3b fc ff ff       	call   68f710c0 <_PsaiFree>
68f71485:	89 34 24             	mov    %esi,(%esp)
68f71488:	e8 b3 14 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f7148d:	50                   	push   %eax
68f7148e:	eb cc                	jmp    68f7145c <_InternalGetMappedFileName+0x13c>

68f71490 <_GetModuleInformationCallback@12>:


typedef struct _GET_MODULE_INFORMATION_FLAGS
{
  ULONG bWantName : sizeof(ULONG) * 8 / 4;
  ULONG bUnicode : sizeof(ULONG) * 8 / 4;
  ULONG bFullName : sizeof(ULONG) * 8 / 4;
} GET_MODULE_INFORMATION_FLAGS, *PGET_MODULE_INFORMATION_FLAGS;

typedef struct _GET_MODULE_INFORMATION_CONTEXT
{
  HMODULE hModule;
  GET_MODULE_INFORMATION_FLAGS Flags;
  DWORD nBufSize;
  union
  {
    LPWSTR lpUnicodeName;
    LPSTR lpAnsiName;
    LPMODULEINFO lpmodinfo;
    LPVOID lpBuffer;
  };
} GET_MODULE_INFORMATION_CONTEXT, *PGET_MODULE_INFORMATION_CONTEXT;

NTSTATUS STDCALL
GetModuleInformationCallback(IN HANDLE ProcessHandle,
                             IN PLDR_MODULE CurrentModule,
                             IN OUT PVOID CallbackContext)
{
68f71490:	55                   	push   %ebp
  PGET_MODULE_INFORMATION_CONTEXT Context = (PGET_MODULE_INFORMATION_CONTEXT)CallbackContext;

  /* found the module we were looking for */
  if(CurrentModule->BaseAddress == Context->hModule)
  {
    /* we want the module name */
    if(Context->Flags.bWantName)
    {
      PUNICODE_STRING SourceString;
      ULONG l;
      NTSTATUS Status;

      if(Context->Flags.bFullName)
        SourceString = &(CurrentModule->FullDllName);
      else
        SourceString = &(CurrentModule->BaseDllName);

      SourceString->Length -= SourceString->Length % sizeof(WCHAR);

      /* l is the byte size of the user buffer */
      l = Context->nBufSize * sizeof(WCHAR);

      /* if the user buffer has room for the string and a null terminator */
      if(l >= (SourceString->Length + sizeof(WCHAR)))
      {
        /* limit the buffer size */
        l = SourceString->Length;

        /* null-terminate the string */
        if(Context->Flags.bUnicode)
          Context->lpUnicodeName[l / sizeof(WCHAR)] = 0;
        else
          Context->lpAnsiName[l / sizeof(WCHAR)] = 0;
      }

      if(Context->Flags.bUnicode)
      {
        /* Unicode: direct copy */
        /* NOTE: I've chosen not to check for ProcessHandle == NtCurrentProcess(),
                 this function is complicated enough as it is */
        Status = NtReadVirtualMemory(ProcessHandle,
                                     SourceString->Buffer,
                                     Context->lpUnicodeName,
                                     l,
                                     NULL);

        if(!NT_SUCCESS(Status))
        {
          Context->nBufSize = 0;
          return Status;
        }

        Context->nBufSize = l / sizeof(WCHAR);
      }
      else
      {
        /* ANSI/OEM: convert and copy */
        LPWSTR pwcUnicodeBuf;
        ANSI_STRING AnsiString;
        UNICODE_STRING UnicodeString;

        AnsiString.Length = 0;
        AnsiString.MaximumLength = Context->nBufSize;
        AnsiString.Buffer = Context->lpAnsiName;

        /* allocate the local buffer */
        pwcUnicodeBuf = PsaiMalloc(SourceString->Length);

#if 0
        __try
        {
#endif
        if(pwcUnicodeBuf == NULL)
        {
          Status = STATUS_NO_MEMORY;
          goto exitWithStatus;
        }

        /* copy the string in the local buffer */
        Status = NtReadVirtualMemory(ProcessHandle,
                                     SourceString->Buffer,
                                     pwcUnicodeBuf,
                                     l,
                                     NULL);

        if(!NT_SUCCESS(Status))
        {
          goto exitWithStatus;
        }

        /* initialize Unicode string buffer */
        UnicodeString.Length = UnicodeString.MaximumLength = l;
        UnicodeString.Buffer = pwcUnicodeBuf;

        /* convert and copy */
        if(AreFileApisANSI())
          RtlUnicodeStringToAnsiString(&AnsiString, &UnicodeString, FALSE);
        else
          RtlUnicodeStringToOemString(&AnsiString, &UnicodeString, FALSE);

        /* return the string size */
        Context->nBufSize = AnsiString.Length;
#if 0
        }
        __finally
        {
          /* free the buffer */
          PsaiFree(pwcUnicodeBuf);
        }
#else
        Status = STATUS_NO_MORE_FILES;

exitWithStatus:
        /* free the buffer */
        PsaiFree(pwcUnicodeBuf);
        return Status;
#endif
      }
    }
    else
    {
      /* we want other module information */
      ULONG nSize = Context->nBufSize;

      /* base address */
      if(nSize >= sizeof(CurrentModule->BaseAddress))
      {
        Context->lpmodinfo->lpBaseOfDll = CurrentModule->BaseAddress;
        nSize -= sizeof(CurrentModule->BaseAddress);
      }

      /* image size */
      if(nSize >= sizeof(CurrentModule->ResidentSize))
      {
        Context->lpmodinfo->SizeOfImage = CurrentModule->ResidentSize;
        nSize -= sizeof(CurrentModule->ResidentSize);
      }

      /* entry point */
      if(nSize >= sizeof(CurrentModule->EntryPoint))
      {
        /* ??? FIXME? is "EntryPoint" just the offset, or the real address? */
        Context->lpmodinfo->EntryPoint = (PVOID)CurrentModule->EntryPoint;
      }

      Context->nBufSize = TRUE;
    }

    return STATUS_NO_MORE_FILES;
  }

  return STATUS_SUCCESS;
68f71491:	31 c0                	xor    %eax,%eax
68f71493:	89 e5                	mov    %esp,%ebp
68f71495:	57                   	push   %edi
68f71496:	56                   	push   %esi
68f71497:	53                   	push   %ebx
68f71498:	83 ec 1c             	sub    $0x1c,%esp
68f7149b:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f7149e:	8b 7d 10             	mov    0x10(%ebp),%edi
68f714a1:	8b 51 18             	mov    0x18(%ecx),%edx
68f714a4:	3b 17                	cmp    (%edi),%edx
68f714a6:	74 0a                	je     68f714b2 <_GetModuleInformationCallback@12+0x22>
}
68f714a8:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f714ab:	5b                   	pop    %ebx
68f714ac:	5e                   	pop    %esi
68f714ad:	5f                   	pop    %edi
68f714ae:	5d                   	pop    %ebp
68f714af:	c2 0c 00             	ret    $0xc
68f714b2:	80 7f 04 00          	cmpb   $0x0,0x4(%edi)
68f714b6:	0f 84 85 01 00 00    	je     68f71641 <_GetModuleInformationCallback@12+0x1b1>
68f714bc:	80 7f 06 00          	cmpb   $0x0,0x6(%edi)
68f714c0:	75 7e                	jne    68f71540 <_GetModuleInformationCallback@12+0xb0>
68f714c2:	83 c1 2c             	add    $0x2c,%ecx
68f714c5:	89 4d dc             	mov    %ecx,0xffffffdc(%ebp)
68f714c8:	8b 55 dc             	mov    0xffffffdc(%ebp),%edx
68f714cb:	66 8b 02             	mov    (%edx),%ax
68f714ce:	83 e0 fe             	and    $0xfffffffe,%eax
68f714d1:	66 89 02             	mov    %ax,(%edx)
68f714d4:	8b 57 08             	mov    0x8(%edi),%edx
68f714d7:	8d 34 12             	lea    (%edx,%edx,1),%esi
68f714da:	89 c2                	mov    %eax,%edx
68f714dc:	81 e2 ff ff 00 00    	and    $0xffff,%edx
68f714e2:	8d 42 02             	lea    0x2(%edx),%eax
68f714e5:	39 f0                	cmp    %esi,%eax
68f714e7:	77 7e                	ja     68f71567 <_GetModuleInformationCallback@12+0xd7>
68f714e9:	89 d6                	mov    %edx,%esi
68f714eb:	8a 57 05             	mov    0x5(%edi),%dl
68f714ee:	84 d2                	test   %dl,%dl
68f714f0:	0f 84 1e 01 00 00    	je     68f71614 <_GetModuleInformationCallback@12+0x184>
68f714f6:	8b 47 0c             	mov    0xc(%edi),%eax
68f714f9:	84 d2                	test   %dl,%dl
68f714fb:	66 c7 04 06 00 00    	movw   $0x0,(%esi,%eax,1)
68f71501:	74 6b                	je     68f7156e <_GetModuleInformationCallback@12+0xde>
68f71503:	83 ec 0c             	sub    $0xc,%esp
68f71506:	6a 00                	push   $0x0
68f71508:	56                   	push   %esi
68f71509:	8b 47 0c             	mov    0xc(%edi),%eax
68f7150c:	50                   	push   %eax
68f7150d:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
68f71510:	8b 40 04             	mov    0x4(%eax),%eax
68f71513:	50                   	push   %eax
68f71514:	8b 45 08             	mov    0x8(%ebp),%eax
68f71517:	50                   	push   %eax
68f71518:	e8 63 14 00 00       	call   68f72980 <_NtReadVirtualMemory@20>
68f7151d:	83 c4 0c             	add    $0xc,%esp
68f71520:	89 c3                	mov    %eax,%ebx
68f71522:	85 c0                	test   %eax,%eax
68f71524:	0f 88 0c 01 00 00    	js     68f71636 <_GetModuleInformationCallback@12+0x1a6>
68f7152a:	d1 ee                	shr    %esi
68f7152c:	b8 06 00 00 80       	mov    $0x80000006,%eax
68f71531:	89 77 08             	mov    %esi,0x8(%edi)
68f71534:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71537:	5b                   	pop    %ebx
68f71538:	5e                   	pop    %esi
68f71539:	5f                   	pop    %edi
68f7153a:	5d                   	pop    %ebp
68f7153b:	c2 0c 00             	ret    $0xc
68f7153e:	89 f6                	mov    %esi,%esi
68f71540:	83 c1 24             	add    $0x24,%ecx
68f71543:	89 4d dc             	mov    %ecx,0xffffffdc(%ebp)
68f71546:	8b 55 dc             	mov    0xffffffdc(%ebp),%edx
68f71549:	66 8b 02             	mov    (%edx),%ax
68f7154c:	83 e0 fe             	and    $0xfffffffe,%eax
68f7154f:	66 89 02             	mov    %ax,(%edx)
68f71552:	8b 57 08             	mov    0x8(%edi),%edx
68f71555:	8d 34 12             	lea    (%edx,%edx,1),%esi
68f71558:	89 c2                	mov    %eax,%edx
68f7155a:	81 e2 ff ff 00 00    	and    $0xffff,%edx
68f71560:	8d 42 02             	lea    0x2(%edx),%eax
68f71563:	39 f0                	cmp    %esi,%eax
68f71565:	76 82                	jbe    68f714e9 <_GetModuleInformationCallback@12+0x59>
68f71567:	8a 57 05             	mov    0x5(%edi),%dl
68f7156a:	84 d2                	test   %dl,%dl
68f7156c:	75 95                	jne    68f71503 <_GetModuleInformationCallback@12+0x73>
68f7156e:	8b 47 08             	mov    0x8(%edi),%eax
68f71571:	66 c7 45 e8 00 00    	movw   $0x0,0xffffffe8(%ebp)
68f71577:	66 89 45 ea          	mov    %ax,0xffffffea(%ebp)
68f7157b:	8b 55 dc             	mov    0xffffffdc(%ebp),%edx
68f7157e:	8b 47 0c             	mov    0xc(%edi),%eax
68f71581:	83 ec 0c             	sub    $0xc,%esp
68f71584:	89 45 ec             	mov    %eax,0xffffffec(%ebp)
68f71587:	66 8b 02             	mov    (%edx),%ax
68f7158a:	25 ff ff 00 00       	and    $0xffff,%eax
68f7158f:	bb 17 00 00 c0       	mov    $0xc0000017,%ebx
68f71594:	50                   	push   %eax
68f71595:	e8 e6 fa ff ff       	call   68f71080 <_PsaiMalloc>
68f7159a:	83 c4 10             	add    $0x10,%esp
68f7159d:	85 c0                	test   %eax,%eax
68f7159f:	89 45 d8             	mov    %eax,0xffffffd8(%ebp)
68f715a2:	74 58                	je     68f715fc <_GetModuleInformationCallback@12+0x16c>
68f715a4:	83 ec 0c             	sub    $0xc,%esp
68f715a7:	6a 00                	push   $0x0
68f715a9:	56                   	push   %esi
68f715aa:	50                   	push   %eax
68f715ab:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
68f715ae:	8b 40 04             	mov    0x4(%eax),%eax
68f715b1:	50                   	push   %eax
68f715b2:	8b 45 08             	mov    0x8(%ebp),%eax
68f715b5:	50                   	push   %eax
68f715b6:	e8 c5 13 00 00       	call   68f72980 <_NtReadVirtualMemory@20>
68f715bb:	83 c4 0c             	add    $0xc,%esp
68f715be:	89 c3                	mov    %eax,%ebx
68f715c0:	85 c0                	test   %eax,%eax
68f715c2:	78 38                	js     68f715fc <_GetModuleInformationCallback@12+0x16c>
68f715c4:	8b 55 d8             	mov    0xffffffd8(%ebp),%edx
68f715c7:	66 89 75 e2          	mov    %si,0xffffffe2(%ebp)
68f715cb:	66 89 75 e0          	mov    %si,0xffffffe0(%ebp)
68f715cf:	89 55 e4             	mov    %edx,0xffffffe4(%ebp)
68f715d2:	e8 69 14 00 00       	call   68f72a40 <_AreFileApisANSI@0>
68f715d7:	8d 5d e0             	lea    0xffffffe0(%ebp),%ebx
68f715da:	85 c0                	test   %eax,%eax
68f715dc:	75 49                	jne    68f71627 <_GetModuleInformationCallback@12+0x197>
68f715de:	8d 55 e8             	lea    0xffffffe8(%ebp),%edx
68f715e1:	51                   	push   %ecx
68f715e2:	6a 00                	push   $0x0
68f715e4:	53                   	push   %ebx
68f715e5:	52                   	push   %edx
68f715e6:	e8 85 13 00 00       	call   68f72970 <_RtlUnicodeStringToOemString@12>
68f715eb:	8b 45 e8             	mov    0xffffffe8(%ebp),%eax
68f715ee:	5a                   	pop    %edx
68f715ef:	25 ff ff 00 00       	and    $0xffff,%eax
68f715f4:	bb 06 00 00 80       	mov    $0x80000006,%ebx
68f715f9:	89 47 08             	mov    %eax,0x8(%edi)
68f715fc:	83 ec 0c             	sub    $0xc,%esp
68f715ff:	8b 45 d8             	mov    0xffffffd8(%ebp),%eax
68f71602:	50                   	push   %eax
68f71603:	e8 b8 fa ff ff       	call   68f710c0 <_PsaiFree>
68f71608:	89 d8                	mov    %ebx,%eax
68f7160a:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f7160d:	5b                   	pop    %ebx
68f7160e:	5e                   	pop    %esi
68f7160f:	5f                   	pop    %edi
68f71610:	5d                   	pop    %ebp
68f71611:	c2 0c 00             	ret    $0xc
68f71614:	89 f2                	mov    %esi,%edx
68f71616:	8b 47 0c             	mov    0xc(%edi),%eax
68f71619:	d1 ea                	shr    %edx
68f7161b:	c6 04 02 00          	movb   $0x0,(%edx,%eax,1)
68f7161f:	8a 57 05             	mov    0x5(%edi),%dl
68f71622:	e9 43 ff ff ff       	jmp    68f7156a <_GetModuleInformationCallback@12+0xda>
68f71627:	8d 45 e8             	lea    0xffffffe8(%ebp),%eax
68f7162a:	56                   	push   %esi
68f7162b:	6a 00                	push   $0x0
68f7162d:	53                   	push   %ebx
68f7162e:	50                   	push   %eax
68f7162f:	e8 2c 13 00 00       	call   68f72960 <_RtlUnicodeStringToAnsiString@12>
68f71634:	eb b5                	jmp    68f715eb <_GetModuleInformationCallback@12+0x15b>
68f71636:	89 d8                	mov    %ebx,%eax
68f71638:	c7 47 08 00 00 00 00 	movl   $0x0,0x8(%edi)
68f7163f:	eb c9                	jmp    68f7160a <_GetModuleInformationCallback@12+0x17a>
68f71641:	8b 5f 08             	mov    0x8(%edi),%ebx
68f71644:	83 fb 03             	cmp    $0x3,%ebx
68f71647:	76 27                	jbe    68f71670 <_GetModuleInformationCallback@12+0x1e0>
68f71649:	8b 47 0c             	mov    0xc(%edi),%eax
68f7164c:	83 eb 04             	sub    $0x4,%ebx
68f7164f:	83 fb 03             	cmp    $0x3,%ebx
68f71652:	89 10                	mov    %edx,(%eax)
68f71654:	76 1a                	jbe    68f71670 <_GetModuleInformationCallback@12+0x1e0>
68f71656:	8b 57 0c             	mov    0xc(%edi),%edx
68f71659:	8b 41 20             	mov    0x20(%ecx),%eax
68f7165c:	83 eb 04             	sub    $0x4,%ebx
68f7165f:	89 42 04             	mov    %eax,0x4(%edx)
68f71662:	83 fb 03             	cmp    $0x3,%ebx
68f71665:	76 09                	jbe    68f71670 <_GetModuleInformationCallback@12+0x1e0>
68f71667:	8b 57 0c             	mov    0xc(%edi),%edx
68f7166a:	8b 41 1c             	mov    0x1c(%ecx),%eax
68f7166d:	89 42 08             	mov    %eax,0x8(%edx)
68f71670:	b8 06 00 00 80       	mov    $0x80000006,%eax
68f71675:	c7 47 08 01 00 00 00 	movl   $0x1,0x8(%edi)
68f7167c:	e9 b3 fe ff ff       	jmp    68f71534 <_GetModuleInformationCallback@12+0xa4>
68f71681:	eb 0d                	jmp    68f71690 <_InternalGetModuleInformation>
68f71683:	90                   	nop    
68f71684:	90                   	nop    
68f71685:	90                   	nop    
68f71686:	90                   	nop    
68f71687:	90                   	nop    
68f71688:	90                   	nop    
68f71689:	90                   	nop    
68f7168a:	90                   	nop    
68f7168b:	90                   	nop    
68f7168c:	90                   	nop    
68f7168d:	90                   	nop    
68f7168e:	90                   	nop    
68f7168f:	90                   	nop    

68f71690 <_InternalGetModuleInformation>:


static DWORD
InternalGetModuleInformation(HANDLE hProcess,
                             HMODULE hModule,
                             GET_MODULE_INFORMATION_FLAGS Flags,
                             LPVOID lpBuffer,
                             DWORD nBufSize)
{
68f71690:	55                   	push   %ebp
68f71691:	89 e5                	mov    %esp,%ebp
68f71693:	83 ec 1c             	sub    $0x1c,%esp
  GET_MODULE_INFORMATION_CONTEXT Context;
  NTSTATUS Status;

  Context.hModule = hModule;
68f71696:	89 55 e8             	mov    %edx,0xffffffe8(%ebp)
  Context.Flags = Flags;
68f71699:	8b 55 08             	mov    0x8(%ebp),%edx
68f7169c:	89 55 ec             	mov    %edx,0xffffffec(%ebp)
  Context.nBufSize = nBufSize;
68f7169f:	8b 55 10             	mov    0x10(%ebp),%edx
68f716a2:	89 55 f0             	mov    %edx,0xfffffff0(%ebp)
  Context.lpBuffer = lpBuffer;
68f716a5:	8b 55 0c             	mov    0xc(%ebp),%edx
68f716a8:	89 55 f4             	mov    %edx,0xfffffff4(%ebp)

  Status = PsaEnumerateProcessModules(hProcess, GetModuleInformationCallback, &Context);
68f716ab:	8d 55 e8             	lea    0xffffffe8(%ebp),%edx
68f716ae:	52                   	push   %edx
68f716af:	68 90 14 f7 68       	push   $0x68f71490
68f716b4:	50                   	push   %eax
68f716b5:	e8 56 0e 00 00       	call   68f72510 <_PsaEnumerateProcessModules@12>

  if(Status == STATUS_NO_MORE_FILES)
68f716ba:	5a                   	pop    %edx
68f716bb:	3d 06 00 00 80       	cmp    $0x80000006,%eax
68f716c0:	74 15                	je     68f716d7 <_InternalGetModuleInformation+0x47>
  {
    /* module was found, return string size */
    return Context.nBufSize;
  }
  else if(NT_SUCCESS(Status))
68f716c2:	85 c0                	test   %eax,%eax
68f716c4:	78 1a                	js     68f716e0 <_InternalGetModuleInformation+0x50>
  {
    /* module was not found */
    SetLastError(ERROR_INVALID_HANDLE);
68f716c6:	83 ec 0c             	sub    $0xc,%esp
68f716c9:	6a 06                	push   $0x6
  }
  else
  {
    /* an error occurred */
    SetLastErrorByStatus(Status);
68f716cb:	e8 60 13 00 00       	call   68f72a30 <_SetLastError@4>
  }
  return 0;
68f716d0:	31 c0                	xor    %eax,%eax
68f716d2:	83 c4 0c             	add    $0xc,%esp
}
68f716d5:	c9                   	leave  
68f716d6:	c3                   	ret    
68f716d7:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
68f716da:	c9                   	leave  
68f716db:	c3                   	ret    
68f716dc:	8d 74 26 00          	lea    0x0(%esi),%esi
68f716e0:	83 ec 0c             	sub    $0xc,%esp
68f716e3:	50                   	push   %eax
68f716e4:	e8 57 12 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f716e9:	50                   	push   %eax
68f716ea:	eb df                	jmp    68f716cb <_InternalGetModuleInformation+0x3b>
68f716ec:	8d 74 26 00          	lea    0x0(%esi),%esi

68f716f0 <_InternalAnsiPageFileCallback>:


typedef struct _INTERNAL_ENUM_PAGE_FILES_CONTEXT
{
  PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine;
  LPVOID lpContext;
} INTERNAL_ENUM_PAGE_FILES_CONTEXT, *PINTERNAL_ENUM_PAGE_FILES_CONTEXT;


static BOOL
InternalAnsiPageFileCallback(LPVOID pContext,
                             PENUM_PAGE_FILE_INFORMATION pPageFileInfo,
                             LPCWSTR lpFilename)
{
68f716f0:	55                   	push   %ebp
68f716f1:	89 e5                	mov    %esp,%ebp
68f716f3:	57                   	push   %edi
68f716f4:	56                   	push   %esi
68f716f5:	53                   	push   %ebx
68f716f6:	83 ec 18             	sub    $0x18,%esp
68f716f9:	8b 7d 10             	mov    0x10(%ebp),%edi
  size_t slen;
  LPSTR AnsiFileName;
  PINTERNAL_ENUM_PAGE_FILES_CONTEXT Context = (PINTERNAL_ENUM_PAGE_FILES_CONTEXT)pContext;

  slen = wcslen(lpFilename);
68f716fc:	57                   	push   %edi
68f716fd:	e8 de 12 00 00       	call   68f729e0 <_wcslen>

  AnsiFileName = (LPSTR)LocalAlloc(LMEM_FIXED, (slen + 1) * sizeof(CHAR));
68f71702:	59                   	pop    %ecx
68f71703:	5b                   	pop    %ebx
68f71704:	8d 58 01             	lea    0x1(%eax),%ebx
68f71707:	53                   	push   %ebx
68f71708:	6a 00                	push   $0x0
68f7170a:	e8 41 13 00 00       	call   68f72a50 <_LocalAlloc@8>
68f7170f:	89 c6                	mov    %eax,%esi
  if(AnsiFileName != NULL)
68f71711:	58                   	pop    %eax
  {
    BOOL Ret;

    WideCharToMultiByte(CP_ACP,
                        0,
                        lpFilename,
                        -1, /* only works if the string is NULL-terminated!!! */
                        AnsiFileName,
                        (slen + 1) * sizeof(CHAR),
                        NULL,
                        NULL);

    Ret = Context->pCallbackRoutine(Context->lpContext, pPageFileInfo, AnsiFileName);

    LocalFree((HLOCAL)AnsiFileName);

    return Ret;
  }

  return FALSE;
68f71712:	31 c0                	xor    %eax,%eax
68f71714:	5a                   	pop    %edx
68f71715:	85 f6                	test   %esi,%esi
68f71717:	74 2d                	je     68f71746 <_InternalAnsiPageFileCallback+0x56>
68f71719:	6a 00                	push   $0x0
68f7171b:	6a 00                	push   $0x0
68f7171d:	53                   	push   %ebx
68f7171e:	56                   	push   %esi
68f7171f:	6a ff                	push   $0xffffffff
68f71721:	57                   	push   %edi
68f71722:	6a 00                	push   $0x0
68f71724:	6a 00                	push   $0x0
68f71726:	e8 35 13 00 00       	call   68f72a60 <_WideCharToMultiByte@32>
68f7172b:	8b 5d 0c             	mov    0xc(%ebp),%ebx
68f7172e:	8b 45 08             	mov    0x8(%ebp),%eax
68f71731:	57                   	push   %edi
68f71732:	56                   	push   %esi
68f71733:	53                   	push   %ebx
68f71734:	8b 48 04             	mov    0x4(%eax),%ecx
68f71737:	51                   	push   %ecx
68f71738:	ff 10                	call   *(%eax)
68f7173a:	89 c3                	mov    %eax,%ebx
68f7173c:	89 34 24             	mov    %esi,(%esp)
68f7173f:	e8 2c 13 00 00       	call   68f72a70 <_LocalFree@4>
68f71744:	89 d8                	mov    %ebx,%eax
}
68f71746:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71749:	5b                   	pop    %ebx
68f7174a:	5e                   	pop    %esi
68f7174b:	5f                   	pop    %edi
68f7174c:	5d                   	pop    %ebp
68f7174d:	c3                   	ret    
68f7174e:	89 f6                	mov    %esi,%esi

68f71750 <_EmptyWorkingSet@4>:

/* PUBLIC *********************************************************************/

/*
 * @implemented
 */
BOOL
STDCALL
EmptyWorkingSet(HANDLE hProcess)
{
68f71750:	55                   	push   %ebp
68f71751:	89 e5                	mov    %esp,%ebp
68f71753:	56                   	push   %esi
68f71754:	53                   	push   %ebx
68f71755:	83 ec 2c             	sub    $0x2c,%esp
  QUOTA_LIMITS QuotaLimits;
  NTSTATUS Status;

  /* query the working set */
  Status = NtQueryInformationProcess(hProcess,
68f71758:	8d 5d d8             	lea    0xffffffd8(%ebp),%ebx
68f7175b:	8b 75 08             	mov    0x8(%ebp),%esi
68f7175e:	6a 00                	push   $0x0
68f71760:	6a 20                	push   $0x20
68f71762:	53                   	push   %ebx
68f71763:	6a 01                	push   $0x1
68f71765:	56                   	push   %esi
68f71766:	e8 25 12 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
                                     ProcessQuotaLimits,
                                     &QuotaLimits,
                                     sizeof(QuotaLimits),
                                     NULL);

  if(!NT_SUCCESS(Status))
68f7176b:	83 c4 0c             	add    $0xc,%esp
68f7176e:	85 c0                	test   %eax,%eax
68f71770:	78 2e                	js     68f717a0 <_EmptyWorkingSet@4+0x50>
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  /* empty the working set */
  QuotaLimits.MinimumWorkingSetSize = -1;
68f71772:	c7 45 e0 ff ff ff ff 	movl   $0xffffffff,0xffffffe0(%ebp)
  QuotaLimits.MaximumWorkingSetSize = -1;
68f71779:	c7 45 e4 ff ff ff ff 	movl   $0xffffffff,0xffffffe4(%ebp)

  /* set the working set */
  Status = NtSetInformationProcess(hProcess,
68f71780:	6a 20                	push   $0x20
68f71782:	53                   	push   %ebx
68f71783:	6a 01                	push   $0x1
68f71785:	56                   	push   %esi
68f71786:	e8 15 12 00 00       	call   68f729a0 <_NtSetInformationProcess@16>
                                   ProcessQuotaLimits,
                                   &QuotaLimits,
                                   sizeof(QuotaLimits));
  if(!NT_SUCCESS(Status))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }
  
  return TRUE;
68f7178b:	ba 01 00 00 00       	mov    $0x1,%edx
68f71790:	85 c0                	test   %eax,%eax
68f71792:	78 0c                	js     68f717a0 <_EmptyWorkingSet@4+0x50>
}
68f71794:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f71797:	89 d0                	mov    %edx,%eax
68f71799:	5b                   	pop    %ebx
68f7179a:	5e                   	pop    %esi
68f7179b:	5d                   	pop    %ebp
68f7179c:	c2 04 00             	ret    $0x4
68f7179f:	90                   	nop    
68f717a0:	83 ec 0c             	sub    $0xc,%esp
68f717a3:	50                   	push   %eax
68f717a4:	e8 97 11 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f717a9:	50                   	push   %eax
68f717aa:	e8 81 12 00 00       	call   68f72a30 <_SetLastError@4>
68f717af:	31 d2                	xor    %edx,%edx
68f717b1:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f717b4:	89 d0                	mov    %edx,%eax
68f717b6:	5b                   	pop    %ebx
68f717b7:	5e                   	pop    %esi
68f717b8:	5d                   	pop    %ebp
68f717b9:	c2 04 00             	ret    $0x4
68f717bc:	8d 74 26 00          	lea    0x0(%esi),%esi

68f717c0 <_EnumDeviceDrivers@12>:


/*
 * @implemented
 */
BOOL
STDCALL
EnumDeviceDrivers(LPVOID *lpImageBase,
                  DWORD cb,
                  LPDWORD lpcbNeeded)
{
68f717c0:	55                   	push   %ebp
68f717c1:	89 e5                	mov    %esp,%ebp
68f717c3:	57                   	push   %edi
68f717c4:	56                   	push   %esi
68f717c5:	53                   	push   %ebx
68f717c6:	83 ec 0c             	sub    $0xc,%esp
68f717c9:	8b 75 08             	mov    0x8(%ebp),%esi
68f717cc:	8b 4d 0c             	mov    0xc(%ebp),%ecx
  ENUM_DEVICE_DRIVERS_CONTEXT Context;
  NTSTATUS Status;
 
  if(cb == 0 || lpImageBase == NULL)
68f717cf:	85 c9                	test   %ecx,%ecx
68f717d1:	8b 7d 10             	mov    0x10(%ebp),%edi
68f717d4:	0f 94 c2             	sete   %dl
68f717d7:	85 f6                	test   %esi,%esi
68f717d9:	0f 94 c0             	sete   %al
68f717dc:	09 d0                	or     %edx,%eax
68f717de:	a8 01                	test   $0x1,%al
68f717e0:	74 1e                	je     68f71800 <_EnumDeviceDrivers@12+0x40>
  {
    *lpcbNeeded = 0;
68f717e2:	c7 07 00 00 00 00    	movl   $0x0,(%edi)
    return TRUE;
68f717e8:	b9 01 00 00 00       	mov    $0x1,%ecx
  }
 
  cb /= sizeof(PVOID);

  Context.lpImageBase = lpImageBase;
  Context.nCount = cb;

  Status = PsaEnumerateSystemModules(EnumDeviceDriversCallback, &Context);

  /* return the count of bytes returned */
  *lpcbNeeded = (cb - Context.nCount) * sizeof(PVOID);

  if(!NT_SUCCESS(Status) && (Status != STATUS_INFO_LENGTH_MISMATCH))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  return TRUE;
}
68f717ed:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f717f0:	89 c8                	mov    %ecx,%eax
68f717f2:	5b                   	pop    %ebx
68f717f3:	5e                   	pop    %esi
68f717f4:	5f                   	pop    %edi
68f717f5:	5d                   	pop    %ebp
68f717f6:	c2 0c 00             	ret    $0xc
68f717f9:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71800:	89 cb                	mov    %ecx,%ebx
68f71802:	c1 eb 02             	shr    $0x2,%ebx
68f71805:	50                   	push   %eax
68f71806:	50                   	push   %eax
68f71807:	8d 45 e8             	lea    0xffffffe8(%ebp),%eax
68f7180a:	89 75 e8             	mov    %esi,0xffffffe8(%ebp)
68f7180d:	89 5d ec             	mov    %ebx,0xffffffec(%ebp)
68f71810:	50                   	push   %eax
68f71811:	68 30 11 f7 68       	push   $0x68f71130
68f71816:	e8 85 0c 00 00       	call   68f724a0 <_PsaEnumerateSystemModules@8>
68f7181b:	b9 01 00 00 00       	mov    $0x1,%ecx
68f71820:	89 c6                	mov    %eax,%esi
68f71822:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
68f71825:	29 c3                	sub    %eax,%ebx
68f71827:	89 f2                	mov    %esi,%edx
68f71829:	c1 e3 02             	shl    $0x2,%ebx
68f7182c:	c1 ea 1f             	shr    $0x1f,%edx
68f7182f:	89 1f                	mov    %ebx,(%edi)
68f71831:	81 fe 04 00 00 c0    	cmp    $0xc0000004,%esi
68f71837:	5f                   	pop    %edi
68f71838:	58                   	pop    %eax
68f71839:	0f 95 c0             	setne  %al
68f7183c:	85 d0                	test   %edx,%eax
68f7183e:	74 ad                	je     68f717ed <_EnumDeviceDrivers@12+0x2d>
68f71840:	83 ec 0c             	sub    $0xc,%esp
68f71843:	56                   	push   %esi
68f71844:	e8 f7 10 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71849:	50                   	push   %eax
68f7184a:	e8 e1 11 00 00       	call   68f72a30 <_SetLastError@4>
68f7184f:	31 c9                	xor    %ecx,%ecx
68f71851:	eb 9a                	jmp    68f717ed <_EnumDeviceDrivers@12+0x2d>
68f71853:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71859:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71860 <_EnumProcesses@12>:


/*
 * @implemented
 */
BOOL
STDCALL
EnumProcesses(DWORD *lpidProcess,
              DWORD cb,
              LPDWORD lpcbNeeded)
{
68f71860:	55                   	push   %ebp
68f71861:	89 e5                	mov    %esp,%ebp
68f71863:	56                   	push   %esi
68f71864:	53                   	push   %ebx
68f71865:	83 ec 10             	sub    $0x10,%esp
68f71868:	8b 45 0c             	mov    0xc(%ebp),%eax
68f7186b:	8b 4d 08             	mov    0x8(%ebp),%ecx
  ENUM_PROCESSES_CONTEXT Context;
  NTSTATUS Status;
  
  cb /= sizeof(DWORD);
  
  if(cb == 0 || lpidProcess == NULL)
68f7186e:	89 c3                	mov    %eax,%ebx
68f71870:	8b 75 10             	mov    0x10(%ebp),%esi
68f71873:	c1 eb 02             	shr    $0x2,%ebx
68f71876:	0f 94 c2             	sete   %dl
68f71879:	85 c9                	test   %ecx,%ecx
68f7187b:	0f 94 c0             	sete   %al
68f7187e:	09 d0                	or     %edx,%eax
68f71880:	a8 01                	test   $0x1,%al
68f71882:	74 1c                	je     68f718a0 <_EnumProcesses@12+0x40>
  {
    *lpcbNeeded = 0;
68f71884:	c7 06 00 00 00 00    	movl   $0x0,(%esi)
    return TRUE;
68f7188a:	bb 01 00 00 00       	mov    $0x1,%ebx
  }
  
  Context.lpidProcess = lpidProcess;
  Context.nCount = cb;

  /* enumerate the process ids */
  Status = PsaEnumerateProcesses(EnumProcessesCallback, &Context);

  *lpcbNeeded = (cb - Context.nCount) * sizeof(DWORD);

  if(!NT_SUCCESS(Status) && (Status != STATUS_INFO_LENGTH_MISMATCH))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  return TRUE;
}
68f7188f:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f71892:	89 d8                	mov    %ebx,%eax
68f71894:	5b                   	pop    %ebx
68f71895:	5e                   	pop    %esi
68f71896:	5d                   	pop    %ebp
68f71897:	c2 0c 00             	ret    $0xc
68f7189a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f718a0:	50                   	push   %eax
68f718a1:	50                   	push   %eax
68f718a2:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
68f718a5:	89 4d f0             	mov    %ecx,0xfffffff0(%ebp)
68f718a8:	89 5d f4             	mov    %ebx,0xfffffff4(%ebp)
68f718ab:	50                   	push   %eax
68f718ac:	68 60 11 f7 68       	push   $0x68f71160
68f718b1:	e8 fa 0f 00 00       	call   68f728b0 <_PsaEnumerateProcesses@8>
68f718b6:	89 c1                	mov    %eax,%ecx
68f718b8:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f718bb:	29 c3                	sub    %eax,%ebx
68f718bd:	89 ca                	mov    %ecx,%edx
68f718bf:	c1 ea 1f             	shr    $0x1f,%edx
68f718c2:	81 f9 04 00 00 c0    	cmp    $0xc0000004,%ecx
68f718c8:	8d 04 9d 00 00 00 00 	lea    0x0(,%ebx,4),%eax
68f718cf:	89 06                	mov    %eax,(%esi)
68f718d1:	58                   	pop    %eax
68f718d2:	5b                   	pop    %ebx
68f718d3:	0f 95 c0             	setne  %al
68f718d6:	bb 01 00 00 00       	mov    $0x1,%ebx
68f718db:	85 d0                	test   %edx,%eax
68f718dd:	74 b0                	je     68f7188f <_EnumProcesses@12+0x2f>
68f718df:	83 ec 0c             	sub    $0xc,%esp
68f718e2:	30 db                	xor    %bl,%bl
68f718e4:	51                   	push   %ecx
68f718e5:	e8 56 10 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f718ea:	50                   	push   %eax
68f718eb:	e8 40 11 00 00       	call   68f72a30 <_SetLastError@4>
68f718f0:	eb 9d                	jmp    68f7188f <_EnumProcesses@12+0x2f>
68f718f2:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f718f9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71900 <_EnumProcessModules@16>:


/*
 * @implemented
 */
BOOL
STDCALL
EnumProcessModules(HANDLE hProcess,
                   HMODULE *lphModule,
                   DWORD cb,
                   LPDWORD lpcbNeeded)
{
68f71900:	55                   	push   %ebp
68f71901:	89 e5                	mov    %esp,%ebp
68f71903:	56                   	push   %esi
68f71904:	53                   	push   %ebx
68f71905:	83 ec 10             	sub    $0x10,%esp
68f71908:	8b 45 10             	mov    0x10(%ebp),%eax
68f7190b:	8b 4d 0c             	mov    0xc(%ebp),%ecx
  ENUM_PROCESS_MODULES_CONTEXT Context;
  NTSTATUS Status;
  
  cb /= sizeof(HMODULE);
  
  if(cb == 0 || lphModule == NULL)
68f7190e:	89 c3                	mov    %eax,%ebx
68f71910:	8b 75 14             	mov    0x14(%ebp),%esi
68f71913:	c1 eb 02             	shr    $0x2,%ebx
68f71916:	0f 94 c2             	sete   %dl
68f71919:	85 c9                	test   %ecx,%ecx
68f7191b:	0f 94 c0             	sete   %al
68f7191e:	09 d0                	or     %edx,%eax
68f71920:	a8 01                	test   $0x1,%al
68f71922:	74 1c                	je     68f71940 <_EnumProcessModules@16+0x40>
  {
    *lpcbNeeded = 0;
68f71924:	c7 06 00 00 00 00    	movl   $0x0,(%esi)
    return TRUE;
68f7192a:	bb 01 00 00 00       	mov    $0x1,%ebx
  }

  Context.lphModule = lphModule;
  Context.nCount = cb;

  /* enumerate the process modules */
  Status = PsaEnumerateProcessModules(hProcess, EnumProcessModulesCallback, &Context);

  *lpcbNeeded = (cb - Context.nCount) * sizeof(DWORD);

  if(!NT_SUCCESS(Status) && (Status != STATUS_INFO_LENGTH_MISMATCH))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }
  
  return TRUE;
}
68f7192f:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f71932:	89 d8                	mov    %ebx,%eax
68f71934:	5b                   	pop    %ebx
68f71935:	5e                   	pop    %esi
68f71936:	5d                   	pop    %ebp
68f71937:	c2 10 00             	ret    $0x10
68f7193a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71940:	50                   	push   %eax
68f71941:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
68f71944:	89 4d f0             	mov    %ecx,0xfffffff0(%ebp)
68f71947:	50                   	push   %eax
68f71948:	8b 45 08             	mov    0x8(%ebp),%eax
68f7194b:	89 5d f4             	mov    %ebx,0xfffffff4(%ebp)
68f7194e:	68 90 11 f7 68       	push   $0x68f71190
68f71953:	50                   	push   %eax
68f71954:	e8 b7 0b 00 00       	call   68f72510 <_PsaEnumerateProcessModules@12>
68f71959:	89 c1                	mov    %eax,%ecx
68f7195b:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f7195e:	29 c3                	sub    %eax,%ebx
68f71960:	89 ca                	mov    %ecx,%edx
68f71962:	c1 ea 1f             	shr    $0x1f,%edx
68f71965:	81 f9 04 00 00 c0    	cmp    $0xc0000004,%ecx
68f7196b:	8d 04 9d 00 00 00 00 	lea    0x0(,%ebx,4),%eax
68f71972:	bb 01 00 00 00       	mov    $0x1,%ebx
68f71977:	89 06                	mov    %eax,(%esi)
68f71979:	58                   	pop    %eax
68f7197a:	0f 95 c0             	setne  %al
68f7197d:	85 d0                	test   %edx,%eax
68f7197f:	74 ae                	je     68f7192f <_EnumProcessModules@16+0x2f>
68f71981:	83 ec 0c             	sub    $0xc,%esp
68f71984:	30 db                	xor    %bl,%bl
68f71986:	51                   	push   %ecx
68f71987:	e8 b4 0f 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f7198c:	50                   	push   %eax
68f7198d:	e8 9e 10 00 00       	call   68f72a30 <_SetLastError@4>
68f71992:	eb 9b                	jmp    68f7192f <_EnumProcessModules@16+0x2f>
68f71994:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f7199a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f719a0 <_GetDeviceDriverBaseNameA@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetDeviceDriverBaseNameA(LPVOID ImageBase,
                         LPSTR lpBaseName,
                         DWORD nSize)
{
68f719a0:	55                   	push   %ebp
68f719a1:	89 e5                	mov    %esp,%ebp
68f719a3:	83 ec 0c             	sub    $0xc,%esp
  return InternalGetDeviceDriverName(FALSE, FALSE, ImageBase, lpBaseName, nSize);
68f719a6:	8b 45 10             	mov    0x10(%ebp),%eax
68f719a9:	8b 55 08             	mov    0x8(%ebp),%edx
68f719ac:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f719af:	50                   	push   %eax
68f719b0:	31 c0                	xor    %eax,%eax
68f719b2:	51                   	push   %ecx
68f719b3:	52                   	push   %edx
68f719b4:	31 d2                	xor    %edx,%edx
68f719b6:	e8 b5 f8 ff ff       	call   68f71270 <_InternalGetDeviceDriverName>
}
68f719bb:	c9                   	leave  
68f719bc:	c2 0c 00             	ret    $0xc
68f719bf:	90                   	nop    

68f719c0 <_GetDeviceDriverFileNameA@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetDeviceDriverFileNameA(LPVOID ImageBase,
                         LPSTR lpFilename,
                         DWORD nSize)
{
68f719c0:	55                   	push   %ebp
  return InternalGetDeviceDriverName(FALSE, TRUE, ImageBase, lpFilename, nSize);
68f719c1:	ba 01 00 00 00       	mov    $0x1,%edx
68f719c6:	89 e5                	mov    %esp,%ebp
68f719c8:	83 ec 0c             	sub    $0xc,%esp
68f719cb:	8b 45 10             	mov    0x10(%ebp),%eax
68f719ce:	50                   	push   %eax
68f719cf:	8b 45 0c             	mov    0xc(%ebp),%eax
68f719d2:	50                   	push   %eax
68f719d3:	8b 45 08             	mov    0x8(%ebp),%eax
68f719d6:	50                   	push   %eax
68f719d7:	31 c0                	xor    %eax,%eax
68f719d9:	e8 92 f8 ff ff       	call   68f71270 <_InternalGetDeviceDriverName>
}
68f719de:	c9                   	leave  
68f719df:	c2 0c 00             	ret    $0xc
68f719e2:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f719e9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f719f0 <_GetDeviceDriverBaseNameW@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetDeviceDriverBaseNameW(LPVOID ImageBase,
                         LPWSTR lpBaseName,
                         DWORD nSize)
{
68f719f0:	55                   	push   %ebp
68f719f1:	89 e5                	mov    %esp,%ebp
68f719f3:	83 ec 0c             	sub    $0xc,%esp
  return InternalGetDeviceDriverName(TRUE, FALSE, ImageBase, lpBaseName, nSize);
68f719f6:	8b 55 10             	mov    0x10(%ebp),%edx
68f719f9:	8b 45 0c             	mov    0xc(%ebp),%eax
68f719fc:	52                   	push   %edx
68f719fd:	50                   	push   %eax
68f719fe:	8b 45 08             	mov    0x8(%ebp),%eax
68f71a01:	31 d2                	xor    %edx,%edx
68f71a03:	50                   	push   %eax
68f71a04:	b8 01 00 00 00       	mov    $0x1,%eax
68f71a09:	e8 62 f8 ff ff       	call   68f71270 <_InternalGetDeviceDriverName>
}
68f71a0e:	c9                   	leave  
68f71a0f:	c2 0c 00             	ret    $0xc
68f71a12:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71a19:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71a20 <_GetDeviceDriverFileNameW@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetDeviceDriverFileNameW(LPVOID ImageBase,
                         LPWSTR lpFilename,
                         DWORD nSize)
{
68f71a20:	55                   	push   %ebp
  return InternalGetDeviceDriverName(TRUE, TRUE, ImageBase, lpFilename, nSize);
68f71a21:	ba 01 00 00 00       	mov    $0x1,%edx
68f71a26:	89 e5                	mov    %esp,%ebp
68f71a28:	83 ec 0c             	sub    $0xc,%esp
68f71a2b:	8b 45 10             	mov    0x10(%ebp),%eax
68f71a2e:	8b 4d 08             	mov    0x8(%ebp),%ecx
68f71a31:	50                   	push   %eax
68f71a32:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71a35:	50                   	push   %eax
68f71a36:	b8 01 00 00 00       	mov    $0x1,%eax
68f71a3b:	51                   	push   %ecx
68f71a3c:	e8 2f f8 ff ff       	call   68f71270 <_InternalGetDeviceDriverName>
}
68f71a41:	c9                   	leave  
68f71a42:	c2 0c 00             	ret    $0xc
68f71a45:	8d 74 26 00          	lea    0x0(%esi),%esi
68f71a49:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71a50 <_GetMappedFileNameA@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetMappedFileNameA(HANDLE hProcess,
                   LPVOID lpv,
                   LPSTR lpFilename,
                   DWORD nSize)
{
68f71a50:	55                   	push   %ebp
68f71a51:	89 e5                	mov    %esp,%ebp
68f71a53:	83 ec 0c             	sub    $0xc,%esp
  return InternalGetMappedFileName(FALSE, hProcess, lpv, lpFilename, nSize);
68f71a56:	8b 45 14             	mov    0x14(%ebp),%eax
68f71a59:	8b 55 08             	mov    0x8(%ebp),%edx
68f71a5c:	50                   	push   %eax
68f71a5d:	8b 45 10             	mov    0x10(%ebp),%eax
68f71a60:	50                   	push   %eax
68f71a61:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71a64:	50                   	push   %eax
68f71a65:	31 c0                	xor    %eax,%eax
68f71a67:	e8 b4 f8 ff ff       	call   68f71320 <_InternalGetMappedFileName>
}
68f71a6c:	c9                   	leave  
68f71a6d:	c2 10 00             	ret    $0x10

68f71a70 <_GetMappedFileNameW@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetMappedFileNameW(HANDLE hProcess,
                   LPVOID lpv,
                   LPWSTR lpFilename,
                   DWORD nSize)
{
68f71a70:	55                   	push   %ebp
68f71a71:	89 e5                	mov    %esp,%ebp
68f71a73:	83 ec 0c             	sub    $0xc,%esp
  return InternalGetMappedFileName(TRUE, hProcess, lpv, lpFilename, nSize);
68f71a76:	8b 45 14             	mov    0x14(%ebp),%eax
68f71a79:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f71a7c:	50                   	push   %eax
68f71a7d:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71a80:	51                   	push   %ecx
68f71a81:	8b 55 08             	mov    0x8(%ebp),%edx
68f71a84:	50                   	push   %eax
68f71a85:	b8 01 00 00 00       	mov    $0x1,%eax
68f71a8a:	e8 91 f8 ff ff       	call   68f71320 <_InternalGetMappedFileName>
}
68f71a8f:	c9                   	leave  
68f71a90:	c2 10 00             	ret    $0x10
68f71a93:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71a99:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71aa0 <_GetModuleBaseNameA@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetModuleBaseNameA(HANDLE hProcess,
                   HMODULE hModule,
                   LPSTR lpBaseName,
                   DWORD nSize)
{
68f71aa0:	55                   	push   %ebp
68f71aa1:	89 e5                	mov    %esp,%ebp
68f71aa3:	83 ec 0c             	sub    $0xc,%esp
  GET_MODULE_INFORMATION_FLAGS Flags = {TRUE, FALSE, FALSE};
  return InternalGetModuleInformation(hProcess, hModule, Flags, lpBaseName, nSize);
68f71aa6:	8b 4d 14             	mov    0x14(%ebp),%ecx
68f71aa9:	8b 45 08             	mov    0x8(%ebp),%eax
68f71aac:	51                   	push   %ecx
68f71aad:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71ab0:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f71ab3:	51                   	push   %ecx
68f71ab4:	6a 01                	push   $0x1
68f71ab6:	e8 d5 fb ff ff       	call   68f71690 <_InternalGetModuleInformation>
}
68f71abb:	c9                   	leave  
68f71abc:	c2 10 00             	ret    $0x10
68f71abf:	90                   	nop    

68f71ac0 <_GetModuleBaseNameW@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetModuleBaseNameW(HANDLE hProcess,
                   HMODULE hModule,
                   LPWSTR lpBaseName,
                   DWORD nSize)
{
68f71ac0:	55                   	push   %ebp
  GET_MODULE_INFORMATION_FLAGS Flags = {TRUE, TRUE, FALSE};
68f71ac1:	31 c9                	xor    %ecx,%ecx
68f71ac3:	89 e5                	mov    %esp,%ebp
68f71ac5:	83 ec 0c             	sub    $0xc,%esp
68f71ac8:	b1 01                	mov    $0x1,%cl
  return InternalGetModuleInformation(hProcess, hModule, Flags, lpBaseName, nSize);
68f71aca:	ff 75 14             	pushl  0x14(%ebp)
68f71acd:	ff 75 10             	pushl  0x10(%ebp)
68f71ad0:	8b 45 08             	mov    0x8(%ebp),%eax
68f71ad3:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71ad6:	b5 01                	mov    $0x1,%ch
68f71ad8:	51                   	push   %ecx
68f71ad9:	e8 b2 fb ff ff       	call   68f71690 <_InternalGetModuleInformation>
}
68f71ade:	c9                   	leave  
68f71adf:	c2 10 00             	ret    $0x10
68f71ae2:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71ae9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71af0 <_GetModuleFileNameExA@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetModuleFileNameExA(HANDLE hProcess,
                     HMODULE hModule,
                     LPSTR lpFilename,
                     DWORD nSize)
{
68f71af0:	55                   	push   %ebp
68f71af1:	89 e5                	mov    %esp,%ebp
68f71af3:	83 ec 0c             	sub    $0xc,%esp
  GET_MODULE_INFORMATION_FLAGS Flags = {TRUE, FALSE, TRUE};
  return InternalGetModuleInformation(hProcess, hModule, Flags, lpFilename, nSize);
68f71af6:	8b 4d 14             	mov    0x14(%ebp),%ecx
68f71af9:	8b 45 08             	mov    0x8(%ebp),%eax
68f71afc:	51                   	push   %ecx
68f71afd:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71b00:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f71b03:	51                   	push   %ecx
68f71b04:	68 01 00 01 00       	push   $0x10001
68f71b09:	e8 82 fb ff ff       	call   68f71690 <_InternalGetModuleInformation>
}
68f71b0e:	c9                   	leave  
68f71b0f:	c2 10 00             	ret    $0x10
68f71b12:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71b19:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71b20 <_GetModuleFileNameExW@16>:


/*
 * @implemented
 */
DWORD
STDCALL
GetModuleFileNameExW(HANDLE hProcess,
                     HMODULE hModule,
                     LPWSTR lpFilename,
                     DWORD nSize)
{
68f71b20:	55                   	push   %ebp
  GET_MODULE_INFORMATION_FLAGS Flags = {TRUE, TRUE, TRUE};
68f71b21:	31 c9                	xor    %ecx,%ecx
68f71b23:	89 e5                	mov    %esp,%ebp
68f71b25:	83 ec 0c             	sub    $0xc,%esp
68f71b28:	b1 01                	mov    $0x1,%cl
  return InternalGetModuleInformation(hProcess, hModule, Flags, lpFilename, nSize);
68f71b2a:	ff 75 14             	pushl  0x14(%ebp)
68f71b2d:	b5 01                	mov    $0x1,%ch
68f71b2f:	8b 45 08             	mov    0x8(%ebp),%eax
68f71b32:	ff 75 10             	pushl  0x10(%ebp)
68f71b35:	81 e1 ff ff 00 ff    	and    $0xff00ffff,%ecx
68f71b3b:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71b3e:	81 c9 00 00 01 00    	or     $0x10000,%ecx
68f71b44:	51                   	push   %ecx
68f71b45:	e8 46 fb ff ff       	call   68f71690 <_InternalGetModuleInformation>
}
68f71b4a:	c9                   	leave  
68f71b4b:	c2 10 00             	ret    $0x10
68f71b4e:	89 f6                	mov    %esi,%esi

68f71b50 <_GetModuleInformation@16>:


/*
 * @implemented
 */
BOOL
STDCALL
GetModuleInformation(HANDLE hProcess,
                     HMODULE hModule,
                     LPMODULEINFO lpmodinfo,
                     DWORD cb)
{
68f71b50:	55                   	push   %ebp
68f71b51:	89 e5                	mov    %esp,%ebp
68f71b53:	83 ec 0c             	sub    $0xc,%esp
  GET_MODULE_INFORMATION_FLAGS Flags = {FALSE, FALSE, FALSE};
  return (BOOL)InternalGetModuleInformation(hProcess, hModule, Flags, lpmodinfo, cb);
68f71b56:	8b 4d 14             	mov    0x14(%ebp),%ecx
68f71b59:	8b 45 08             	mov    0x8(%ebp),%eax
68f71b5c:	51                   	push   %ecx
68f71b5d:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71b60:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f71b63:	51                   	push   %ecx
68f71b64:	6a 00                	push   $0x0
68f71b66:	e8 25 fb ff ff       	call   68f71690 <_InternalGetModuleInformation>
}
68f71b6b:	c9                   	leave  
68f71b6c:	c2 10 00             	ret    $0x10
68f71b6f:	90                   	nop    

68f71b70 <_InitializeProcessForWsWatch@4>:


/*
 * @implemented
 */
BOOL
STDCALL
InitializeProcessForWsWatch(HANDLE hProcess)
{
68f71b70:	55                   	push   %ebp
68f71b71:	89 e5                	mov    %esp,%ebp
68f71b73:	50                   	push   %eax
68f71b74:	50                   	push   %eax
  NTSTATUS Status;

  Status = NtSetInformationProcess(hProcess,
68f71b75:	6a 00                	push   $0x0
68f71b77:	6a 00                	push   $0x0
68f71b79:	6a 0f                	push   $0xf
68f71b7b:	8b 45 08             	mov    0x8(%ebp),%eax
68f71b7e:	50                   	push   %eax
68f71b7f:	e8 1c 0e 00 00       	call   68f729a0 <_NtSetInformationProcess@16>
                                   ProcessWorkingSetWatch,
                                   NULL,
                                   0);
  if(!NT_SUCCESS(Status))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  return TRUE;
68f71b84:	ba 01 00 00 00       	mov    $0x1,%edx
68f71b89:	85 c0                	test   %eax,%eax
68f71b8b:	78 06                	js     68f71b93 <_InitializeProcessForWsWatch@4+0x23>
}
68f71b8d:	89 d0                	mov    %edx,%eax
68f71b8f:	c9                   	leave  
68f71b90:	c2 04 00             	ret    $0x4
68f71b93:	83 ec 0c             	sub    $0xc,%esp
68f71b96:	50                   	push   %eax
68f71b97:	e8 a4 0d 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71b9c:	50                   	push   %eax
68f71b9d:	e8 8e 0e 00 00       	call   68f72a30 <_SetLastError@4>
68f71ba2:	31 d2                	xor    %edx,%edx
68f71ba4:	c9                   	leave  
68f71ba5:	89 d0                	mov    %edx,%eax
68f71ba7:	c2 04 00             	ret    $0x4
68f71baa:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

68f71bb0 <_GetWsChanges@12>:


/*
 * @implemented
 */
BOOL
STDCALL
GetWsChanges(HANDLE hProcess,
             PPSAPI_WS_WATCH_INFORMATION lpWatchInfo,
             DWORD cb)
{
68f71bb0:	55                   	push   %ebp
68f71bb1:	89 e5                	mov    %esp,%ebp
68f71bb3:	83 ec 14             	sub    $0x14,%esp
  NTSTATUS Status;

  Status = NtQueryInformationProcess(hProcess,
68f71bb6:	6a 00                	push   $0x0
68f71bb8:	8b 45 10             	mov    0x10(%ebp),%eax
68f71bbb:	50                   	push   %eax
68f71bbc:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71bbf:	50                   	push   %eax
68f71bc0:	6a 0f                	push   $0xf
68f71bc2:	8b 45 08             	mov    0x8(%ebp),%eax
68f71bc5:	50                   	push   %eax
68f71bc6:	e8 c5 0d 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
                                     ProcessWorkingSetWatch,
                                     (PVOID)lpWatchInfo,
                                     cb,
                                     NULL);
  if(!NT_SUCCESS(Status))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  return TRUE;
68f71bcb:	ba 01 00 00 00       	mov    $0x1,%edx
68f71bd0:	83 c4 0c             	add    $0xc,%esp
68f71bd3:	85 c0                	test   %eax,%eax
68f71bd5:	78 09                	js     68f71be0 <_GetWsChanges@12+0x30>
}
68f71bd7:	89 d0                	mov    %edx,%eax
68f71bd9:	c9                   	leave  
68f71bda:	c2 0c 00             	ret    $0xc
68f71bdd:	8d 76 00             	lea    0x0(%esi),%esi
68f71be0:	83 ec 0c             	sub    $0xc,%esp
68f71be3:	50                   	push   %eax
68f71be4:	e8 57 0d 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71be9:	50                   	push   %eax
68f71bea:	e8 41 0e 00 00       	call   68f72a30 <_SetLastError@4>
68f71bef:	31 d2                	xor    %edx,%edx
68f71bf1:	c9                   	leave  
68f71bf2:	89 d0                	mov    %edx,%eax
68f71bf4:	c2 0c 00             	ret    $0xc
68f71bf7:	89 f6                	mov    %esi,%esi
68f71bf9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71c00 <_GetProcessImageFileNameW@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetProcessImageFileNameW(HANDLE hProcess,
                         LPWSTR lpImageFileName,
                         DWORD nSize)
{
68f71c00:	55                   	push   %ebp
68f71c01:	89 e5                	mov    %esp,%ebp
68f71c03:	57                   	push   %edi
68f71c04:	56                   	push   %esi
68f71c05:	53                   	push   %ebx
68f71c06:	83 ec 14             	sub    $0x14,%esp
  PUNICODE_STRING ImageFileName;
  SIZE_T BufferSize;
  NTSTATUS Status;
  DWORD Ret = 0;
68f71c09:	31 ff                	xor    %edi,%edi

  BufferSize = sizeof(UNICODE_STRING) + (nSize * sizeof(WCHAR));
68f71c0b:	8b 45 10             	mov    0x10(%ebp),%eax
68f71c0e:	8d 74 00 08          	lea    0x8(%eax,%eax,1),%esi

  ImageFileName = (PUNICODE_STRING)LocalAlloc(LMEM_FIXED, BufferSize);
68f71c12:	56                   	push   %esi
68f71c13:	6a 00                	push   $0x0
68f71c15:	e8 36 0e 00 00       	call   68f72a50 <_LocalAlloc@8>
68f71c1a:	89 c3                	mov    %eax,%ebx
  if(ImageFileName != NULL)
68f71c1c:	58                   	pop    %eax
68f71c1d:	85 db                	test   %ebx,%ebx
68f71c1f:	5a                   	pop    %edx
68f71c20:	74 61                	je     68f71c83 <_GetProcessImageFileNameW@12+0x83>
  {
    Status = NtQueryInformationProcess(hProcess,
68f71c22:	83 ec 0c             	sub    $0xc,%esp
68f71c25:	6a 00                	push   $0x0
68f71c27:	56                   	push   %esi
68f71c28:	8b 75 08             	mov    0x8(%ebp),%esi
68f71c2b:	53                   	push   %ebx
68f71c2c:	6a 1b                	push   $0x1b
68f71c2e:	56                   	push   %esi
68f71c2f:	e8 5c 0d 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
                                       ProcessImageFileName,
                                       ImageFileName,
                                       BufferSize,
                                       NULL);
    if(NT_SUCCESS(Status))
68f71c34:	83 c4 0c             	add    $0xc,%esp
68f71c37:	85 c0                	test   %eax,%eax
68f71c39:	78 55                	js     68f71c90 <_GetProcessImageFileNameW@12+0x90>
    {
      memcpy(lpImageFileName, ImageFileName->Buffer, ImageFileName->Length);
68f71c3b:	66 8b 03             	mov    (%ebx),%ax
68f71c3e:	25 ff ff 00 00       	and    $0xffff,%eax
68f71c43:	51                   	push   %ecx
68f71c44:	50                   	push   %eax
68f71c45:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71c48:	8b 53 04             	mov    0x4(%ebx),%edx
68f71c4b:	52                   	push   %edx
68f71c4c:	50                   	push   %eax
68f71c4d:	e8 6e 0d 00 00       	call   68f729c0 <_memcpy>

      /* make sure the string is null-terminated! */
      lpImageFileName[ImageFileName->Length / sizeof(WCHAR)] = L'\0';
68f71c52:	66 8b 03             	mov    (%ebx),%ax
68f71c55:	66 d1 e8             	shr    %ax
68f71c58:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71c5b:	25 ff ff 00 00       	and    $0xffff,%eax
      Ret = ImageFileName->Length / sizeof(WCHAR);
68f71c60:	83 c4 10             	add    $0x10,%esp
68f71c63:	66 c7 04 42 00 00    	movw   $0x0,(%edx,%eax,2)
68f71c69:	66 8b 03             	mov    (%ebx),%ax
68f71c6c:	66 d1 e8             	shr    %ax
68f71c6f:	89 c7                	mov    %eax,%edi
68f71c71:	81 e7 ff ff 00 00    	and    $0xffff,%edi
    }
    else if(Status == STATUS_INFO_LENGTH_MISMATCH)
    {
      /* XP sets this error code for some reason if the buffer is too small */
      SetLastError(ERROR_INSUFFICIENT_BUFFER);
    }
    else
    {
      SetLastErrorByStatus(Status);
    }

    LocalFree((HLOCAL)ImageFileName);
68f71c77:	83 ec 0c             	sub    $0xc,%esp
68f71c7a:	53                   	push   %ebx
68f71c7b:	e8 f0 0d 00 00       	call   68f72a70 <_LocalFree@4>
68f71c80:	83 c4 0c             	add    $0xc,%esp
  }

  return Ret;
}
68f71c83:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71c86:	89 f8                	mov    %edi,%eax
68f71c88:	5b                   	pop    %ebx
68f71c89:	5e                   	pop    %esi
68f71c8a:	5f                   	pop    %edi
68f71c8b:	5d                   	pop    %ebp
68f71c8c:	c2 0c 00             	ret    $0xc
68f71c8f:	90                   	nop    
68f71c90:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f71c95:	74 14                	je     68f71cab <_GetProcessImageFileNameW@12+0xab>
68f71c97:	83 ec 0c             	sub    $0xc,%esp
68f71c9a:	50                   	push   %eax
68f71c9b:	e8 a0 0c 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71ca0:	50                   	push   %eax
68f71ca1:	e8 8a 0d 00 00       	call   68f72a30 <_SetLastError@4>
68f71ca6:	83 c4 0c             	add    $0xc,%esp
68f71ca9:	eb cc                	jmp    68f71c77 <_GetProcessImageFileNameW@12+0x77>
68f71cab:	83 ec 0c             	sub    $0xc,%esp
68f71cae:	6a 7a                	push   $0x7a
68f71cb0:	eb ef                	jmp    68f71ca1 <_GetProcessImageFileNameW@12+0xa1>
68f71cb2:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71cb9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71cc0 <_GetProcessImageFileNameA@12>:


/*
 * @implemented
 */
DWORD
STDCALL
GetProcessImageFileNameA(HANDLE hProcess,
                         LPSTR lpImageFileName,
                         DWORD nSize)
{
68f71cc0:	55                   	push   %ebp
68f71cc1:	89 e5                	mov    %esp,%ebp
68f71cc3:	57                   	push   %edi
68f71cc4:	56                   	push   %esi
68f71cc5:	53                   	push   %ebx
68f71cc6:	83 ec 14             	sub    $0x14,%esp
  PUNICODE_STRING ImageFileName;
  SIZE_T BufferSize;
  NTSTATUS Status;
  DWORD Ret = 0;
68f71cc9:	c7 45 f0 00 00 00 00 	movl   $0x0,0xfffffff0(%ebp)
68f71cd0:	8b 7d 10             	mov    0x10(%ebp),%edi

  BufferSize = sizeof(UNICODE_STRING) + (nSize * sizeof(WCHAR));
68f71cd3:	8d 74 3f 08          	lea    0x8(%edi,%edi,1),%esi

  ImageFileName = (PUNICODE_STRING)LocalAlloc(LMEM_FIXED, BufferSize);
68f71cd7:	56                   	push   %esi
68f71cd8:	6a 00                	push   $0x0
68f71cda:	e8 71 0d 00 00       	call   68f72a50 <_LocalAlloc@8>
68f71cdf:	89 c3                	mov    %eax,%ebx
  if(ImageFileName != NULL)
68f71ce1:	58                   	pop    %eax
68f71ce2:	85 db                	test   %ebx,%ebx
68f71ce4:	5a                   	pop    %edx
68f71ce5:	74 67                	je     68f71d4e <_GetProcessImageFileNameA@12+0x8e>
  {
    Status = NtQueryInformationProcess(hProcess,
68f71ce7:	83 ec 0c             	sub    $0xc,%esp
68f71cea:	8b 45 08             	mov    0x8(%ebp),%eax
68f71ced:	6a 00                	push   $0x0
68f71cef:	56                   	push   %esi
68f71cf0:	53                   	push   %ebx
68f71cf1:	6a 1b                	push   $0x1b
68f71cf3:	50                   	push   %eax
68f71cf4:	e8 97 0c 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
                                       ProcessImageFileName,
                                       ImageFileName,
                                       BufferSize,
                                       NULL);
    if(NT_SUCCESS(Status))
68f71cf9:	83 c4 0c             	add    $0xc,%esp
68f71cfc:	85 c0                	test   %eax,%eax
68f71cfe:	78 60                	js     68f71d60 <_GetProcessImageFileNameA@12+0xa0>
    {
      WideCharToMultiByte(CP_ACP,
68f71d00:	8b 75 0c             	mov    0xc(%ebp),%esi
68f71d03:	6a 00                	push   $0x0
68f71d05:	6a 00                	push   $0x0
68f71d07:	57                   	push   %edi
68f71d08:	56                   	push   %esi
68f71d09:	66 8b 03             	mov    (%ebx),%ax
68f71d0c:	66 d1 e8             	shr    %ax
68f71d0f:	25 ff ff 00 00       	and    $0xffff,%eax
68f71d14:	50                   	push   %eax
68f71d15:	8b 4b 04             	mov    0x4(%ebx),%ecx
68f71d18:	51                   	push   %ecx
68f71d19:	6a 00                	push   $0x0
68f71d1b:	6a 00                	push   $0x0
68f71d1d:	e8 3e 0d 00 00       	call   68f72a60 <_WideCharToMultiByte@32>
                          0,
                          ImageFileName->Buffer,
                          ImageFileName->Length / sizeof(WCHAR),
                          lpImageFileName,
                          nSize,
                          NULL,
                          NULL);

      /* make sure the string is null-terminated! */
      lpImageFileName[ImageFileName->Length / sizeof(WCHAR)] = '\0';
68f71d22:	66 8b 03             	mov    (%ebx),%ax
68f71d25:	8b 55 0c             	mov    0xc(%ebp),%edx
68f71d28:	66 d1 e8             	shr    %ax
68f71d2b:	25 ff ff 00 00       	and    $0xffff,%eax
68f71d30:	c6 04 02 00          	movb   $0x0,(%edx,%eax,1)
      Ret = ImageFileName->Length / sizeof(WCHAR);
68f71d34:	66 8b 03             	mov    (%ebx),%ax
68f71d37:	66 d1 e8             	shr    %ax
68f71d3a:	25 ff ff 00 00       	and    $0xffff,%eax
68f71d3f:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
    }
    else if(Status == STATUS_INFO_LENGTH_MISMATCH)
    {
      /* XP sets this error code for some reason if the buffer is too small */
      SetLastError(ERROR_INSUFFICIENT_BUFFER);
    }
    else
    {
      SetLastErrorByStatus(Status);
    }

    LocalFree((HLOCAL)ImageFileName);
68f71d42:	83 ec 0c             	sub    $0xc,%esp
68f71d45:	53                   	push   %ebx
68f71d46:	e8 25 0d 00 00       	call   68f72a70 <_LocalFree@4>
68f71d4b:	83 c4 0c             	add    $0xc,%esp
  }

  return Ret;
}
68f71d4e:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
68f71d51:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71d54:	5b                   	pop    %ebx
68f71d55:	5e                   	pop    %esi
68f71d56:	5f                   	pop    %edi
68f71d57:	5d                   	pop    %ebp
68f71d58:	c2 0c 00             	ret    $0xc
68f71d5b:	90                   	nop    
68f71d5c:	8d 74 26 00          	lea    0x0(%esi),%esi
68f71d60:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f71d65:	74 14                	je     68f71d7b <_GetProcessImageFileNameA@12+0xbb>
68f71d67:	83 ec 0c             	sub    $0xc,%esp
68f71d6a:	50                   	push   %eax
68f71d6b:	e8 d0 0b 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71d70:	50                   	push   %eax
68f71d71:	e8 ba 0c 00 00       	call   68f72a30 <_SetLastError@4>
68f71d76:	83 c4 0c             	add    $0xc,%esp
68f71d79:	eb c7                	jmp    68f71d42 <_GetProcessImageFileNameA@12+0x82>
68f71d7b:	83 ec 0c             	sub    $0xc,%esp
68f71d7e:	6a 7a                	push   $0x7a
68f71d80:	eb ef                	jmp    68f71d71 <_GetProcessImageFileNameA@12+0xb1>
68f71d82:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f71d89:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f71d90 <_EnumPageFilesW@8>:


/*
 * @implemented
 */
BOOL
STDCALL
EnumPageFilesA(PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine,
               LPVOID lpContext)
{
  INTERNAL_ENUM_PAGE_FILES_CONTEXT Context;
  
  Context.pCallbackRoutine = pCallbackRoutine;
  Context.lpContext = lpContext;
  
  return EnumPageFilesW(InternalAnsiPageFileCallback, &Context);
}


/*
 * @implemented
 */
BOOL
STDCALL
EnumPageFilesW(PENUM_PAGE_FILE_CALLBACKW pCallbackRoutine,
               LPVOID lpContext)
{
68f71d90:	55                   	push   %ebp
68f71d91:	89 e5                	mov    %esp,%ebp
68f71d93:	57                   	push   %edi
68f71d94:	56                   	push   %esi
68f71d95:	53                   	push   %ebx
68f71d96:	83 ec 2c             	sub    $0x2c,%esp
  NTSTATUS Status;
  PVOID Buffer;
  ULONG BufferSize = 0;
68f71d99:	31 db                	xor    %ebx,%ebx
  BOOL Ret = FALSE;
68f71d9b:	31 ff                	xor    %edi,%edi
68f71d9d:	eb 1f                	jmp    68f71dbe <_EnumPageFilesW@8+0x2e>
68f71d9f:	90                   	nop    

  for(;;)
  {
    BufferSize += 0x1000;
    Buffer = LocalAlloc(LMEM_FIXED, BufferSize);
    if(Buffer == NULL)
    {
      return FALSE;
    }

    Status = NtQuerySystemInformation(SystemPagefileInformation,
68f71da0:	6a 00                	push   $0x0
68f71da2:	53                   	push   %ebx
68f71da3:	56                   	push   %esi
68f71da4:	6a 12                	push   $0x12
68f71da6:	e8 05 0c 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
                                      Buffer,
                                      BufferSize,
                                      NULL);
    if(Status == STATUS_INFO_LENGTH_MISMATCH)
68f71dab:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f71db0:	75 30                	jne    68f71de2 <_EnumPageFilesW@8+0x52>
    {
      LocalFree((HLOCAL)Buffer);
68f71db2:	83 ec 0c             	sub    $0xc,%esp
68f71db5:	56                   	push   %esi
68f71db6:	e8 b5 0c 00 00       	call   68f72a70 <_LocalFree@4>
68f71dbb:	83 c4 0c             	add    $0xc,%esp
68f71dbe:	81 c3 00 10 00 00    	add    $0x1000,%ebx
68f71dc4:	51                   	push   %ecx
68f71dc5:	51                   	push   %ecx
68f71dc6:	53                   	push   %ebx
68f71dc7:	6a 00                	push   $0x0
68f71dc9:	e8 82 0c 00 00       	call   68f72a50 <_LocalAlloc@8>
68f71dce:	89 c6                	mov    %eax,%esi
68f71dd0:	58                   	pop    %eax
68f71dd1:	85 f6                	test   %esi,%esi
68f71dd3:	5a                   	pop    %edx
68f71dd4:	75 ca                	jne    68f71da0 <_EnumPageFilesW@8+0x10>
    }
    else
    {
      break;
    }
  }

  if(NT_SUCCESS(Status))
  {
    ENUM_PAGE_FILE_INFORMATION Information;
    PSYSTEM_PAGEFILE_INFORMATION pfi = (PSYSTEM_PAGEFILE_INFORMATION)Buffer;
    ULONG Offset = 0;

    do
    {
      PWCHAR Colon;

      pfi = (PSYSTEM_PAGEFILE_INFORMATION)((ULONG_PTR)pfi + Offset);

      Information.cb = sizeof(Information);
      Information.Reserved = 0;
      Information.TotalSize = pfi->TotalSize;
      Information.TotalInUse = pfi->TotalInUse;
      Information.PeakUsage = pfi->PeakUsage;

      /* strip the \??\ prefix from the file name. We do this by searching for the first
         : character and then just change Buffer to point to the previous character. */

      Colon = wcschr(pfi->PageFileName.Buffer, L':');
      if(Colon != NULL)
      {
        pfi->PageFileName.Buffer = --Colon;
      }

      /* FIXME - looks like the PageFileName string is always NULL-terminated on win.
                 At least I haven't encountered a different case so far, we should
                 propably manually NULL-terminate the string here... */

      if(!pCallbackRoutine(lpContext, &Information, pfi->PageFileName.Buffer))
      {
        break;
      }

      Offset = pfi->NextEntryOffset;
    } while(Offset != 0);

    Ret = TRUE;
  }
  else
  {
    SetLastErrorByStatus(Status);
  }

  LocalFree((HLOCAL)Buffer);

  return Ret;
}
68f71dd6:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71dd9:	31 c0                	xor    %eax,%eax
68f71ddb:	5b                   	pop    %ebx
68f71ddc:	5e                   	pop    %esi
68f71ddd:	5f                   	pop    %edi
68f71dde:	5d                   	pop    %ebp
68f71ddf:	c2 08 00             	ret    $0x8
68f71de2:	85 c0                	test   %eax,%eax
68f71de4:	78 7a                	js     68f71e60 <_EnumPageFilesW@8+0xd0>
68f71de6:	89 f3                	mov    %esi,%ebx
68f71de8:	31 c0                	xor    %eax,%eax
68f71dea:	8d 7d c8             	lea    0xffffffc8(%ebp),%edi
68f71ded:	8d 76 00             	lea    0x0(%esi),%esi
68f71df0:	01 c3                	add    %eax,%ebx
68f71df2:	c7 45 c8 14 00 00 00 	movl   $0x14,0xffffffc8(%ebp)
68f71df9:	c7 45 cc 00 00 00 00 	movl   $0x0,0xffffffcc(%ebp)
68f71e00:	8b 43 04             	mov    0x4(%ebx),%eax
68f71e03:	89 45 d0             	mov    %eax,0xffffffd0(%ebp)
68f71e06:	8b 43 08             	mov    0x8(%ebx),%eax
68f71e09:	89 45 d4             	mov    %eax,0xffffffd4(%ebp)
68f71e0c:	8b 43 0c             	mov    0xc(%ebx),%eax
68f71e0f:	89 45 d8             	mov    %eax,0xffffffd8(%ebp)
68f71e12:	50                   	push   %eax
68f71e13:	50                   	push   %eax
68f71e14:	6a 3a                	push   $0x3a
68f71e16:	8b 43 14             	mov    0x14(%ebx),%eax
68f71e19:	50                   	push   %eax
68f71e1a:	e8 b1 0b 00 00       	call   68f729d0 <_wcschr>
68f71e1f:	83 c4 10             	add    $0x10,%esp
68f71e22:	85 c0                	test   %eax,%eax
68f71e24:	74 06                	je     68f71e2c <_EnumPageFilesW@8+0x9c>
68f71e26:	83 e8 02             	sub    $0x2,%eax
68f71e29:	89 43 14             	mov    %eax,0x14(%ebx)
68f71e2c:	50                   	push   %eax
68f71e2d:	8b 43 14             	mov    0x14(%ebx),%eax
68f71e30:	50                   	push   %eax
68f71e31:	57                   	push   %edi
68f71e32:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f71e35:	51                   	push   %ecx
68f71e36:	ff 55 08             	call   *0x8(%ebp)
68f71e39:	83 c4 10             	add    $0x10,%esp
68f71e3c:	85 c0                	test   %eax,%eax
68f71e3e:	74 06                	je     68f71e46 <_EnumPageFilesW@8+0xb6>
68f71e40:	8b 03                	mov    (%ebx),%eax
68f71e42:	85 c0                	test   %eax,%eax
68f71e44:	75 aa                	jne    68f71df0 <_EnumPageFilesW@8+0x60>
68f71e46:	bf 01 00 00 00       	mov    $0x1,%edi
68f71e4b:	83 ec 0c             	sub    $0xc,%esp
68f71e4e:	56                   	push   %esi
68f71e4f:	e8 1c 0c 00 00       	call   68f72a70 <_LocalFree@4>
68f71e54:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71e57:	89 f8                	mov    %edi,%eax
68f71e59:	5b                   	pop    %ebx
68f71e5a:	5e                   	pop    %esi
68f71e5b:	5f                   	pop    %edi
68f71e5c:	5d                   	pop    %ebp
68f71e5d:	c2 08 00             	ret    $0x8
68f71e60:	83 ec 0c             	sub    $0xc,%esp
68f71e63:	50                   	push   %eax
68f71e64:	e8 d7 0a 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71e69:	50                   	push   %eax
68f71e6a:	e8 c1 0b 00 00       	call   68f72a30 <_SetLastError@4>
68f71e6f:	83 c4 0c             	add    $0xc,%esp
68f71e72:	eb d7                	jmp    68f71e4b <_EnumPageFilesW@8+0xbb>
68f71e74:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71e7a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f71e80 <_EnumPageFilesA@8>:
68f71e80:	55                   	push   %ebp
68f71e81:	89 e5                	mov    %esp,%ebp
68f71e83:	83 ec 10             	sub    $0x10,%esp
68f71e86:	8b 45 08             	mov    0x8(%ebp),%eax
68f71e89:	89 45 f8             	mov    %eax,0xfffffff8(%ebp)
68f71e8c:	8b 45 0c             	mov    0xc(%ebp),%eax
68f71e8f:	89 45 fc             	mov    %eax,0xfffffffc(%ebp)
68f71e92:	8d 45 f8             	lea    0xfffffff8(%ebp),%eax
68f71e95:	50                   	push   %eax
68f71e96:	68 f0 16 f7 68       	push   $0x68f716f0
68f71e9b:	e8 f0 fe ff ff       	call   68f71d90 <_EnumPageFilesW@8>
68f71ea0:	c9                   	leave  
68f71ea1:	c2 08 00             	ret    $0x8
68f71ea4:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f71eaa:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f71eb0 <_GetPerformanceInfo@8>:


/*
 * @implemented
 */
BOOL
STDCALL
GetPerformanceInfo(PPERFORMANCE_INFORMATION pPerformanceInformation,
                   DWORD cb)
{
68f71eb0:	55                   	push   %ebp
68f71eb1:	89 e5                	mov    %esp,%ebp
68f71eb3:	57                   	push   %edi
68f71eb4:	56                   	push   %esi
68f71eb5:	53                   	push   %ebx
68f71eb6:	81 ec ac 01 00 00    	sub    $0x1ac,%esp
  SYSTEM_PERFORMANCE_INFORMATION spi;
  SYSTEM_BASIC_INFORMATION sbi;
  SYSTEM_HANDLE_INFORMATION shi;
  PSYSTEM_PROCESS_INFORMATION ProcessInfo;
  ULONG BufferSize, ProcOffset, ProcessCount, ThreadCount;
  PVOID Buffer;
  NTSTATUS Status;

  Status = NtQuerySystemInformation(SystemPerformanceInformation,
68f71ebc:	8d 85 a8 fe ff ff    	lea    0xfffffea8(%ebp),%eax
68f71ec2:	6a 00                	push   $0x0
68f71ec4:	68 38 01 00 00       	push   $0x138
68f71ec9:	50                   	push   %eax
68f71eca:	6a 02                	push   $0x2
68f71ecc:	e8 df 0a 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f71ed1:	89 c3                	mov    %eax,%ebx
                                    &spi,
                                    sizeof(spi),
                                    NULL);
  if(!NT_SUCCESS(Status))
68f71ed3:	85 c0                	test   %eax,%eax
68f71ed5:	78 60                	js     68f71f37 <_GetPerformanceInfo@8+0x87>
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  Status = NtQuerySystemInformation(SystemBasicInformation,
68f71ed7:	8d 85 78 fe ff ff    	lea    0xfffffe78(%ebp),%eax
68f71edd:	6a 00                	push   $0x0
68f71edf:	6a 2c                	push   $0x2c
68f71ee1:	50                   	push   %eax
68f71ee2:	6a 00                	push   $0x0
68f71ee4:	e8 c7 0a 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
                                    &sbi,
                                    sizeof(sbi),
                                    NULL);
  if(!NT_SUCCESS(Status))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  /*
   * allocate enough memory to get a dump of all processes and threads
   */
  BufferSize = 0;
68f71ee9:	31 ff                	xor    %edi,%edi
68f71eeb:	89 c3                	mov    %eax,%ebx
68f71eed:	85 c0                	test   %eax,%eax
68f71eef:	79 22                	jns    68f71f13 <_GetPerformanceInfo@8+0x63>
68f71ef1:	eb 44                	jmp    68f71f37 <_GetPerformanceInfo@8+0x87>
  for(;;)
  {
    BufferSize += 0x10000;
    Buffer = (PVOID)LocalAlloc(LMEM_FIXED, BufferSize);
    if(Buffer == NULL)
    {
      return FALSE;
    }

    Status = NtQuerySystemInformation(SystemProcessInformation,
68f71ef3:	6a 00                	push   $0x0
68f71ef5:	57                   	push   %edi
68f71ef6:	56                   	push   %esi
68f71ef7:	6a 05                	push   $0x5
68f71ef9:	e8 b2 0a 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f71efe:	89 c3                	mov    %eax,%ebx
                                      Buffer,
                                      BufferSize,
                                      NULL);
    if(Status == STATUS_INFO_LENGTH_MISMATCH)
68f71f00:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f71f05:	75 41                	jne    68f71f48 <_GetPerformanceInfo@8+0x98>
    {
      LocalFree((HLOCAL)Buffer);
68f71f07:	83 ec 0c             	sub    $0xc,%esp
68f71f0a:	56                   	push   %esi
68f71f0b:	e8 60 0b 00 00       	call   68f72a70 <_LocalFree@4>
68f71f10:	83 c4 0c             	add    $0xc,%esp
68f71f13:	81 c7 00 00 01 00    	add    $0x10000,%edi
68f71f19:	51                   	push   %ecx
68f71f1a:	51                   	push   %ecx
68f71f1b:	57                   	push   %edi
68f71f1c:	6a 00                	push   $0x0
68f71f1e:	e8 2d 0b 00 00       	call   68f72a50 <_LocalAlloc@8>
68f71f23:	89 c6                	mov    %eax,%esi
68f71f25:	58                   	pop    %eax
68f71f26:	85 f6                	test   %esi,%esi
68f71f28:	5a                   	pop    %edx
68f71f29:	75 c8                	jne    68f71ef3 <_GetPerformanceInfo@8+0x43>
    }
    else
    {
      break;
    }
  }

  if(!NT_SUCCESS(Status))
  {
    LocalFree((HLOCAL)Buffer);
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  /*
   * determine the process and thread count
   */
  ProcessCount = ThreadCount = ProcOffset = 0;
  ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)Buffer;
  do
  {
    ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
    ProcessCount++;
    ThreadCount += ProcessInfo->NumberOfThreads;

    ProcOffset = ProcessInfo->NextEntryOffset;
  } while(ProcOffset != 0);

  LocalFree((HLOCAL)Buffer);

  /*
   * it's enough to supply a SYSTEM_HANDLE_INFORMATION structure as buffer. Even
   * though it returns STATUS_INFO_LENGTH_MISMATCH, it already sets the NumberOfHandles
   * field which is all we're looking for anyway.
   */
  Status = NtQuerySystemInformation(SystemHandleInformation,
                                    &shi,
                                    sizeof(shi),
                                    NULL);
  if(!NT_SUCCESS(Status) && (Status != STATUS_INFO_LENGTH_MISMATCH))
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  /*
   * all required information collected, fill the structure
   */

  pPerformanceInformation->cb = sizeof(PERFORMANCE_INFORMATION);
  pPerformanceInformation->CommitTotal = spi.TotalCommittedPages;
  pPerformanceInformation->CommitLimit = spi.TotalCommitLimit;
  pPerformanceInformation->CommitPeak = spi.PeakCommitment;
  pPerformanceInformation->PhysicalTotal = sbi.NumberOfPhysicalPages;
  pPerformanceInformation->PhysicalAvailable = spi.AvailablePages;
  pPerformanceInformation->SystemCache = 0; /* FIXME - where to get this information from? */
  pPerformanceInformation->KernelTotal = spi.PagedPoolUsage + spi.NonPagedPoolUsage;
  pPerformanceInformation->KernelPaged = spi.PagedPoolUsage;
  pPerformanceInformation->KernelNonpaged = spi.NonPagedPoolUsage;
  pPerformanceInformation->PageSize = sbi.PhysicalPageSize;
  pPerformanceInformation->HandleCount = shi.NumberOfHandles;
  pPerformanceInformation->ProcessCount = ProcessCount;
  pPerformanceInformation->ThreadCount = ThreadCount;

  return TRUE;
}
68f71f2b:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f71f2e:	31 c0                	xor    %eax,%eax
68f71f30:	5b                   	pop    %ebx
68f71f31:	5e                   	pop    %esi
68f71f32:	5f                   	pop    %edi
68f71f33:	5d                   	pop    %ebp
68f71f34:	c2 08 00             	ret    $0x8
68f71f37:	83 ec 0c             	sub    $0xc,%esp
68f71f3a:	53                   	push   %ebx
68f71f3b:	e8 00 0a 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f71f40:	50                   	push   %eax
68f71f41:	e8 ea 0a 00 00       	call   68f72a30 <_SetLastError@4>
68f71f46:	eb e3                	jmp    68f71f2b <_GetPerformanceInfo@8+0x7b>
68f71f48:	85 c0                	test   %eax,%eax
68f71f4a:	0f 88 dd 00 00 00    	js     68f7202d <_GetPerformanceInfo@8+0x17d>
68f71f50:	31 d2                	xor    %edx,%edx
68f71f52:	c7 85 54 fe ff ff 00 	movl   $0x0,0xfffffe54(%ebp)
68f71f59:	00 00 00 
68f71f5c:	31 ff                	xor    %edi,%edi
68f71f5e:	89 f0                	mov    %esi,%eax
68f71f60:	01 d0                	add    %edx,%eax
68f71f62:	8b 9d 54 fe ff ff    	mov    0xfffffe54(%ebp),%ebx
68f71f68:	47                   	inc    %edi
68f71f69:	8b 50 04             	mov    0x4(%eax),%edx
68f71f6c:	01 d3                	add    %edx,%ebx
68f71f6e:	8b 10                	mov    (%eax),%edx
68f71f70:	89 9d 54 fe ff ff    	mov    %ebx,0xfffffe54(%ebp)
68f71f76:	85 d2                	test   %edx,%edx
68f71f78:	75 e6                	jne    68f71f60 <_GetPerformanceInfo@8+0xb0>
68f71f7a:	83 ec 0c             	sub    $0xc,%esp
68f71f7d:	56                   	push   %esi
68f71f7e:	e8 ed 0a 00 00       	call   68f72a70 <_LocalFree@4>
68f71f83:	83 c4 0c             	add    $0xc,%esp
68f71f86:	8d 85 58 fe ff ff    	lea    0xfffffe58(%ebp),%eax
68f71f8c:	6a 00                	push   $0x0
68f71f8e:	6a 14                	push   $0x14
68f71f90:	50                   	push   %eax
68f71f91:	6a 10                	push   $0x10
68f71f93:	e8 18 0a 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f71f98:	89 c2                	mov    %eax,%edx
68f71f9a:	89 c3                	mov    %eax,%ebx
68f71f9c:	c1 ea 1f             	shr    $0x1f,%edx
68f71f9f:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f71fa4:	0f 95 c0             	setne  %al
68f71fa7:	85 d0                	test   %edx,%eax
68f71fa9:	75 8c                	jne    68f71f37 <_GetPerformanceInfo@8+0x87>
68f71fab:	8b 5d 08             	mov    0x8(%ebp),%ebx
68f71fae:	c7 03 38 00 00 00    	movl   $0x38,(%ebx)
68f71fb4:	8b 85 d8 fe ff ff    	mov    0xfffffed8(%ebp),%eax
68f71fba:	89 43 04             	mov    %eax,0x4(%ebx)
68f71fbd:	8b 85 dc fe ff ff    	mov    0xfffffedc(%ebp),%eax
68f71fc3:	89 43 08             	mov    %eax,0x8(%ebx)
68f71fc6:	8b 85 e0 fe ff ff    	mov    0xfffffee0(%ebp),%eax
68f71fcc:	89 43 0c             	mov    %eax,0xc(%ebx)
68f71fcf:	8b 85 84 fe ff ff    	mov    0xfffffe84(%ebp),%eax
68f71fd5:	89 43 10             	mov    %eax,0x10(%ebx)
68f71fd8:	8b 85 d4 fe ff ff    	mov    0xfffffed4(%ebp),%eax
68f71fde:	c7 43 18 00 00 00 00 	movl   $0x0,0x18(%ebx)
68f71fe5:	89 43 14             	mov    %eax,0x14(%ebx)
68f71fe8:	8b 95 18 ff ff ff    	mov    0xffffff18(%ebp),%edx
68f71fee:	8b 8d 1c ff ff ff    	mov    0xffffff1c(%ebp),%ecx
68f71ff4:	89 4b 24             	mov    %ecx,0x24(%ebx)
68f71ff7:	89 53 20             	mov    %edx,0x20(%ebx)
68f71ffa:	8d 04 0a             	lea    (%edx,%ecx,1),%eax
68f71ffd:	89 43 1c             	mov    %eax,0x1c(%ebx)
68f72000:	8b 85 80 fe ff ff    	mov    0xfffffe80(%ebp),%eax
68f72006:	89 43 28             	mov    %eax,0x28(%ebx)
68f72009:	8b 85 58 fe ff ff    	mov    0xfffffe58(%ebp),%eax
68f7200f:	89 7b 30             	mov    %edi,0x30(%ebx)
68f72012:	89 43 2c             	mov    %eax,0x2c(%ebx)
68f72015:	8b 85 54 fe ff ff    	mov    0xfffffe54(%ebp),%eax
68f7201b:	89 43 34             	mov    %eax,0x34(%ebx)
68f7201e:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f72021:	b8 01 00 00 00       	mov    $0x1,%eax
68f72026:	5b                   	pop    %ebx
68f72027:	5e                   	pop    %esi
68f72028:	5f                   	pop    %edi
68f72029:	5d                   	pop    %ebp
68f7202a:	c2 08 00             	ret    $0x8
68f7202d:	83 ec 0c             	sub    $0xc,%esp
68f72030:	56                   	push   %esi
68f72031:	e8 3a 0a 00 00       	call   68f72a70 <_LocalFree@4>
68f72036:	53                   	push   %ebx
68f72037:	e8 04 09 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f7203c:	50                   	push   %eax
68f7203d:	e8 ee 09 00 00       	call   68f72a30 <_SetLastError@4>
68f72042:	e9 e4 fe ff ff       	jmp    68f71f2b <_GetPerformanceInfo@8+0x7b>
68f72047:	89 f6                	mov    %esi,%esi
68f72049:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f72050 <_GetProcessMemoryInfo@12>:


/*
 * @implemented
 */
BOOL
STDCALL
GetProcessMemoryInfo(HANDLE Process,
                     PPROCESS_MEMORY_COUNTERS ppsmemCounters,
                     DWORD cb)
{
68f72050:	55                   	push   %ebp
68f72051:	89 e5                	mov    %esp,%ebp
68f72053:	57                   	push   %edi
68f72054:	56                   	push   %esi
68f72055:	53                   	push   %ebx
68f72056:	81 ec 8c 00 00 00    	sub    $0x8c,%esp
  NTSTATUS Status;
  VM_COUNTERS vmc;
  BOOL Ret = FALSE;

  /* XP's implementation secures access to ppsmemCounters in SEH, we should behave
     similar so we can return the proper error codes when bad pointers are passed
     to this function! */

  _SEH_TRY
68f7205c:	8d 45 a8             	lea    0xffffffa8(%ebp),%eax
68f7205f:	c7 45 ac e0 10 f7 68 	movl   $0x68f710e0,0xffffffac(%ebp)
68f72066:	c7 45 a8 03 00 00 00 	movl   $0x3,0xffffffa8(%ebp)
68f7206d:	8d 5c 24 0f          	lea    0xf(%esp),%ebx
68f72071:	83 ec 0c             	sub    $0xc,%esp
68f72074:	83 e3 f0             	and    $0xfffffff0,%ebx
68f72077:	c7 45 b0 00 00 00 00 	movl   $0x0,0xffffffb0(%ebp)
68f7207e:	8b 75 0c             	mov    0xc(%ebp),%esi
68f72081:	31 ff                	xor    %edi,%edi
68f72083:	89 43 10             	mov    %eax,0x10(%ebx)
68f72086:	c7 43 2c 10 50 f7 68 	movl   $0x68f75010,0x2c(%ebx)
68f7208d:	8d 43 14             	lea    0x14(%ebx),%eax
68f72090:	50                   	push   %eax
68f72091:	e8 4a 01 00 00       	call   68f721e0 <SEHSetJmp>
68f72096:	83 c4 0c             	add    $0xc,%esp
68f72099:	85 c0                	test   %eax,%eax
68f7209b:	0f 85 a0 00 00 00    	jne    68f72141 <_GetProcessMemoryInfo@12+0xf1>
68f720a1:	83 ec 0c             	sub    $0xc,%esp
68f720a4:	53                   	push   %ebx
68f720a5:	e8 56 02 00 00       	call   68f72300 <__SEHEnter@4>
  {
    if(cb < sizeof(PROCESS_MEMORY_COUNTERS))
68f720aa:	83 c4 0c             	add    $0xc,%esp
68f720ad:	83 7d 10 27          	cmpl   $0x27,0x10(%ebp)
68f720b1:	0f 86 b9 00 00 00    	jbe    68f72170 <_GetProcessMemoryInfo@12+0x120>
    {
      SetLastError(ERROR_INSUFFICIENT_BUFFER);
      _SEH_LEAVE;
    }

    /* ppsmemCounters->cb isn't checked at all! */

    Status = NtQueryInformationProcess(Process,
68f720b7:	83 ec 0c             	sub    $0xc,%esp
68f720ba:	8d 45 b8             	lea    0xffffffb8(%ebp),%eax
68f720bd:	6a 00                	push   $0x0
68f720bf:	6a 2c                	push   $0x2c
68f720c1:	50                   	push   %eax
68f720c2:	6a 03                	push   $0x3
68f720c4:	8b 45 08             	mov    0x8(%ebp),%eax
68f720c7:	50                   	push   %eax
68f720c8:	e8 c3 08 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
                                       ProcessVmCounters,
                                       &vmc,
                                       sizeof(vmc),
                                       NULL);
    if(!NT_SUCCESS(Status))
68f720cd:	83 c4 0c             	add    $0xc,%esp
68f720d0:	85 c0                	test   %eax,%eax
68f720d2:	0f 88 a7 00 00 00    	js     68f7217f <_GetProcessMemoryInfo@12+0x12f>
    {
      SetLastErrorByStatus(Status);
      _SEH_LEAVE;
    }

    /* fill the structure with the collected information, in case of bad pointers
       SEH will catch the exception and set the appropriate error code */
    ppsmemCounters->cb = sizeof(PROCESS_MEMORY_COUNTERS);
68f720d8:	c7 06 28 00 00 00    	movl   $0x28,(%esi)
    ppsmemCounters->PageFaultCount = vmc.PageFaultCount;
    ppsmemCounters->PeakWorkingSetSize = vmc.PeakWorkingSetSize;
    ppsmemCounters->WorkingSetSize = vmc.WorkingSetSize;
    ppsmemCounters->QuotaPeakPagedPoolUsage = vmc.QuotaPeakPagedPoolUsage;
    ppsmemCounters->QuotaPagedPoolUsage = vmc.QuotaPagedPoolUsage;
    ppsmemCounters->QuotaPeakNonPagedPoolUsage = vmc.QuotaPeakNonPagedPoolUsage;
    ppsmemCounters->QuotaNonPagedPoolUsage = vmc.QuotaNonPagedPoolUsage;
    ppsmemCounters->PagefileUsage = vmc.PagefileUsage;
    ppsmemCounters->PeakPagefileUsage = vmc.PeakPagefileUsage;

    Ret = TRUE;
68f720de:	bf 01 00 00 00       	mov    $0x1,%edi
68f720e3:	8b 45 c0             	mov    0xffffffc0(%ebp),%eax
68f720e6:	89 46 04             	mov    %eax,0x4(%esi)
68f720e9:	8b 45 c4             	mov    0xffffffc4(%ebp),%eax
68f720ec:	89 46 08             	mov    %eax,0x8(%esi)
68f720ef:	8b 45 c8             	mov    0xffffffc8(%ebp),%eax
68f720f2:	89 46 0c             	mov    %eax,0xc(%esi)
68f720f5:	8b 45 cc             	mov    0xffffffcc(%ebp),%eax
68f720f8:	89 46 10             	mov    %eax,0x10(%esi)
68f720fb:	8b 45 d0             	mov    0xffffffd0(%ebp),%eax
68f720fe:	89 46 14             	mov    %eax,0x14(%esi)
68f72101:	8b 45 d4             	mov    0xffffffd4(%ebp),%eax
68f72104:	89 46 18             	mov    %eax,0x18(%esi)
68f72107:	8b 45 d8             	mov    0xffffffd8(%ebp),%eax
68f7210a:	89 46 1c             	mov    %eax,0x1c(%esi)
68f7210d:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
68f72110:	89 46 20             	mov    %eax,0x20(%esi)
68f72113:	8b 45 e0             	mov    0xffffffe0(%ebp),%eax
68f72116:	89 46 24             	mov    %eax,0x24(%esi)
  }
  _SEH_HANDLE
68f72119:	83 ec 0c             	sub    $0xc,%esp
68f7211c:	53                   	push   %ebx
68f7211d:	e8 0e 02 00 00       	call   68f72330 <__SEHLeave@4>
  {
    SetLastErrorByStatus(_SEH_GetExceptionCode());
  }
  _SEH_END;
68f72122:	8b 45 b0             	mov    0xffffffb0(%ebp),%eax
68f72125:	83 c4 0c             	add    $0xc,%esp
68f72128:	85 c0                	test   %eax,%eax
68f7212a:	74 37                	je     68f72163 <_GetProcessMemoryInfo@12+0x113>
68f7212c:	83 ec 0c             	sub    $0xc,%esp
68f7212f:	53                   	push   %ebx
68f72130:	ff d0                	call   *%eax

  return Ret;
}
68f72132:	89 f8                	mov    %edi,%eax
68f72134:	83 c4 0c             	add    $0xc,%esp
68f72137:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f7213a:	5b                   	pop    %ebx
68f7213b:	5e                   	pop    %esi
68f7213c:	5f                   	pop    %edi
68f7213d:	5d                   	pop    %ebp
68f7213e:	c2 0c 00             	ret    $0xc
68f72141:	83 ec 0c             	sub    $0xc,%esp
68f72144:	53                   	push   %ebx
68f72145:	e8 e6 01 00 00       	call   68f72330 <__SEHLeave@4>
68f7214a:	8b 43 08             	mov    0x8(%ebx),%eax
68f7214d:	50                   	push   %eax
68f7214e:	e8 ed 07 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f72153:	50                   	push   %eax
68f72154:	e8 d7 08 00 00       	call   68f72a30 <_SetLastError@4>
68f72159:	8b 45 b0             	mov    0xffffffb0(%ebp),%eax
68f7215c:	83 c4 0c             	add    $0xc,%esp
68f7215f:	85 c0                	test   %eax,%eax
68f72161:	75 c9                	jne    68f7212c <_GetProcessMemoryInfo@12+0xdc>
68f72163:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f72166:	89 f8                	mov    %edi,%eax
68f72168:	5b                   	pop    %ebx
68f72169:	5e                   	pop    %esi
68f7216a:	5f                   	pop    %edi
68f7216b:	5d                   	pop    %ebp
68f7216c:	c2 0c 00             	ret    $0xc
68f7216f:	90                   	nop    
68f72170:	83 ec 0c             	sub    $0xc,%esp
68f72173:	6a 7a                	push   $0x7a
68f72175:	e8 b6 08 00 00       	call   68f72a30 <_SetLastError@4>
68f7217a:	83 c4 0c             	add    $0xc,%esp
68f7217d:	eb 9a                	jmp    68f72119 <_GetProcessMemoryInfo@12+0xc9>
68f7217f:	83 ec 0c             	sub    $0xc,%esp
68f72182:	50                   	push   %eax
68f72183:	e8 b8 07 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f72188:	50                   	push   %eax
68f72189:	eb ea                	jmp    68f72175 <_GetProcessMemoryInfo@12+0x125>
68f7218b:	90                   	nop    
68f7218c:	8d 74 26 00          	lea    0x0(%esi),%esi

68f72190 <_QueryWorkingSet@12>:


/*
 * @implemented
 */
BOOL
STDCALL
QueryWorkingSet(HANDLE hProcess,
                PVOID pv,
                DWORD cb)
{
68f72190:	55                   	push   %ebp
68f72191:	89 e5                	mov    %esp,%ebp
68f72193:	83 ec 10             	sub    $0x10,%esp
  NTSTATUS Status;

  Status = NtQueryVirtualMemory(hProcess,
68f72196:	6a 00                	push   $0x0
68f72198:	8b 45 10             	mov    0x10(%ebp),%eax
68f7219b:	50                   	push   %eax
68f7219c:	8b 45 0c             	mov    0xc(%ebp),%eax
68f7219f:	50                   	push   %eax
68f721a0:	6a 01                	push   $0x1
68f721a2:	6a 00                	push   $0x0
68f721a4:	8b 45 08             	mov    0x8(%ebp),%eax
68f721a7:	50                   	push   %eax
68f721a8:	e8 a3 07 00 00       	call   68f72950 <_NtQueryVirtualMemory@24>
                                NULL,
                                MemoryWorkingSetList,
                                pv,
                                cb,
                                NULL);
  if(!NT_SUCCESS(Status))
68f721ad:	5a                   	pop    %edx
68f721ae:	85 c0                	test   %eax,%eax
68f721b0:	59                   	pop    %ecx
  {
    SetLastErrorByStatus(Status);
    return FALSE;
  }

  return TRUE;
68f721b1:	ba 01 00 00 00       	mov    $0x1,%edx
68f721b6:	78 08                	js     68f721c0 <_QueryWorkingSet@12+0x30>
}
68f721b8:	89 d0                	mov    %edx,%eax
68f721ba:	c9                   	leave  
68f721bb:	c2 0c 00             	ret    $0xc
68f721be:	89 f6                	mov    %esi,%esi
68f721c0:	83 ec 0c             	sub    $0xc,%esp
68f721c3:	50                   	push   %eax
68f721c4:	e8 77 07 00 00       	call   68f72940 <_RtlNtStatusToDosError@4>
68f721c9:	50                   	push   %eax
68f721ca:	e8 61 08 00 00       	call   68f72a30 <_SetLastError@4>
68f721cf:	31 d2                	xor    %edx,%edx
68f721d1:	c9                   	leave  
68f721d2:	89 d0                	mov    %edx,%eax
68f721d4:	c2 0c 00             	ret    $0xc
68f721d7:	90                   	nop    
68f721d8:	90                   	nop    
68f721d9:	90                   	nop    
68f721da:	90                   	nop    
68f721db:	90                   	nop    
68f721dc:	90                   	nop    
68f721dd:	90                   	nop    
68f721de:	90                   	nop    
68f721df:	90                   	nop    

68f721e0 <SEHSetJmp>:
68f721e0:	8b 44 24 04          	mov    0x4(%esp),%eax
68f721e4:	8b 0c 24             	mov    (%esp),%ecx
68f721e7:	8d 54 24 04          	lea    0x4(%esp),%edx
68f721eb:	89 28                	mov    %ebp,(%eax)
68f721ed:	89 50 04             	mov    %edx,0x4(%eax)
68f721f0:	89 48 08             	mov    %ecx,0x8(%eax)
68f721f3:	89 58 0c             	mov    %ebx,0xc(%eax)
68f721f6:	89 70 10             	mov    %esi,0x10(%eax)
68f721f9:	89 78 14             	mov    %edi,0x14(%eax)
68f721fc:	31 c0                	xor    %eax,%eax
68f721fe:	c2 04 00             	ret    $0x4

68f72201 <SEHLongJmp>:
68f72201:	8b 44 24 08          	mov    0x8(%esp),%eax
68f72205:	8b 4c 24 04          	mov    0x4(%esp),%ecx
68f72209:	8b 29                	mov    (%ecx),%ebp
68f7220b:	8b 61 04             	mov    0x4(%ecx),%esp
68f7220e:	8b 51 08             	mov    0x8(%ecx),%edx
68f72211:	8b 59 0c             	mov    0xc(%ecx),%ebx
68f72214:	8b 71 10             	mov    0x10(%ecx),%esi
68f72217:	8b 79 14             	mov    0x14(%ecx),%edi
68f7221a:	ff e2                	jmp    *%edx

68f7221c <SEHLongJmp_KeepEsp>:
68f7221c:	8b 44 24 08          	mov    0x8(%esp),%eax
68f72220:	8b 4c 24 04          	mov    0x4(%esp),%ecx
68f72224:	8b 29                	mov    (%ecx),%ebp
68f72226:	8b 51 08             	mov    0x8(%ecx),%edx
68f72229:	8b 59 0c             	mov    0xc(%ecx),%ebx
68f7222c:	8b 71 10             	mov    0x10(%ecx),%esi
68f7222f:	8b 79 14             	mov    0x14(%ecx),%edi
68f72232:	ff e2                	jmp    *%edx
	...

68f72240 <__SEHCallHandler>:
extern void __stdcall RtlUnwind(void *, void *, void *, void *);
void const * _SEHRtlUnwind = RtlUnwind;

__declspec(noreturn) void __cdecl _SEHCallHandler(_SEHPortableFrame_t * frame)
{
68f72240:	55                   	push   %ebp
68f72241:	89 e5                	mov    %esp,%ebp
68f72243:	53                   	push   %ebx
68f72244:	83 ec 10             	sub    $0x10,%esp
68f72247:	8b 5d 08             	mov    0x8(%ebp),%ebx
 frame->SPF_Handling = 1;
68f7224a:	c7 43 0c 01 00 00 00 	movl   $0x1,0xc(%ebx)
 _SEHUnwind(frame);
68f72251:	53                   	push   %ebx
68f72252:	e8 1d 01 00 00       	call   68f72374 <__SEHUnwind>
 frame->SPF_Handlers->SH_Handler(frame);
68f72257:	8b 43 10             	mov    0x10(%ebx),%eax
68f7225a:	89 1c 24             	mov    %ebx,(%esp)
68f7225d:	ff 50 04             	call   *0x4(%eax)

68f72260 <__SEHFrameHandler>:
}

int __cdecl _SEHFrameHandler
(
 struct _EXCEPTION_RECORD * ExceptionRecord,
 void * EstablisherFrame,
 struct _CONTEXT * ContextRecord,
 void * DispatcherContext
)
{
68f72260:	55                   	push   %ebp
68f72261:	89 e5                	mov    %esp,%ebp
68f72263:	56                   	push   %esi
68f72264:	53                   	push   %ebx
68f72265:	83 ec 10             	sub    $0x10,%esp
68f72268:	8b 5d 08             	mov    0x8(%ebp),%ebx
68f7226b:	8b 75 0c             	mov    0xc(%ebp),%esi
 _SEHPortableFrame_t * frame;

 _SEHCleanHandlerEnvironment();
68f7226e:	e8 dd 00 00 00       	call   68f72350 <__SEHCleanHandlerEnvironment>

 frame = EstablisherFrame;

 /* Unwinding */
 if(ExceptionRecord->ExceptionFlags & (4 | 2))
68f72273:	f6 43 04 06          	testb  $0x6,0x4(%ebx)
68f72277:	74 17                	je     68f72290 <__SEHFrameHandler+0x30>
 {
  if(frame->SPF_Handlers->SH_Finally && !frame->SPF_Handling)
68f72279:	8b 46 10             	mov    0x10(%esi),%eax
68f7227c:	8b 40 08             	mov    0x8(%eax),%eax
68f7227f:	85 c0                	test   %eax,%eax
68f72281:	75 3d                	jne    68f722c0 <__SEHFrameHandler+0x60>
   frame->SPF_Handlers->SH_Finally(frame);
 }
 /* Handling */
 else
 {
  int ret;

  if(ExceptionRecord->ExceptionCode)
   frame->SPF_Code = ExceptionRecord->ExceptionCode;
  else
   frame->SPF_Code = 0xC0000001; 

  switch((UINT_PTR)frame->SPF_Handlers->SH_Filter)
  {
   case (UINT_PTR)_SEH_STATIC_FILTER(_SEH_EXECUTE_HANDLER):
   case (UINT_PTR)_SEH_STATIC_FILTER(_SEH_CONTINUE_SEARCH):
   case (UINT_PTR)_SEH_STATIC_FILTER(_SEH_CONTINUE_EXECUTION):
   {
    ret = (int)((UINT_PTR)frame->SPF_Handlers->SH_Filter) - 2;
    break;
   }

   default:
   {
    if(frame->SPF_Handlers->SH_Filter)
    {
     EXCEPTION_POINTERS ep;
 
     ep.ExceptionRecord = ExceptionRecord;
     ep.ContextRecord = ContextRecord;
 
     ret = frame->SPF_Handlers->SH_Filter(&ep, frame);
    }
    else
     ret = _SEH_CONTINUE_SEARCH;

    break;
   }
  }

  /* _SEH_CONTINUE_EXECUTION */
  if(ret < 0)
   return ExceptionContinueExecution;
  /* _SEH_EXECUTE_HANDLER */
  else if(ret > 0)
   _SEHCallHandler(frame);
  /* _SEH_CONTINUE_SEARCH */
  else
   /* fall through */;
 }

 return ExceptionContinueSearch;
68f72283:	b8 01 00 00 00       	mov    $0x1,%eax
}
68f72288:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f7228b:	5b                   	pop    %ebx
68f7228c:	5e                   	pop    %esi
68f7228d:	5d                   	pop    %ebp
68f7228e:	c3                   	ret    
68f7228f:	90                   	nop    
68f72290:	8b 03                	mov    (%ebx),%eax
68f72292:	85 c0                	test   %eax,%eax
68f72294:	75 3c                	jne    68f722d2 <__SEHFrameHandler+0x72>
68f72296:	8b 46 10             	mov    0x10(%esi),%eax
68f72299:	c7 46 08 01 00 00 c0 	movl   $0xc0000001,0x8(%esi)
68f722a0:	8b 10                	mov    (%eax),%edx
68f722a2:	8d 42 ff             	lea    0xffffffff(%edx),%eax
68f722a5:	83 f8 02             	cmp    $0x2,%eax
68f722a8:	77 38                	ja     68f722e2 <__SEHFrameHandler+0x82>
68f722aa:	83 ea 02             	sub    $0x2,%edx
68f722ad:	31 c0                	xor    %eax,%eax
68f722af:	85 d2                	test   %edx,%edx
68f722b1:	7c d5                	jl     68f72288 <__SEHFrameHandler+0x28>
68f722b3:	7e ce                	jle    68f72283 <__SEHFrameHandler+0x23>
68f722b5:	83 ec 0c             	sub    $0xc,%esp
68f722b8:	56                   	push   %esi
68f722b9:	e8 82 ff ff ff       	call   68f72240 <__SEHCallHandler>
68f722be:	89 f6                	mov    %esi,%esi
68f722c0:	8b 56 0c             	mov    0xc(%esi),%edx
68f722c3:	85 d2                	test   %edx,%edx
68f722c5:	75 bc                	jne    68f72283 <__SEHFrameHandler+0x23>
68f722c7:	83 ec 0c             	sub    $0xc,%esp
68f722ca:	56                   	push   %esi
68f722cb:	ff d0                	call   *%eax
68f722cd:	83 c4 0c             	add    $0xc,%esp
68f722d0:	eb b1                	jmp    68f72283 <__SEHFrameHandler+0x23>
68f722d2:	89 46 08             	mov    %eax,0x8(%esi)
68f722d5:	8b 46 10             	mov    0x10(%esi),%eax
68f722d8:	8b 10                	mov    (%eax),%edx
68f722da:	8d 42 ff             	lea    0xffffffff(%edx),%eax
68f722dd:	83 f8 02             	cmp    $0x2,%eax
68f722e0:	76 c8                	jbe    68f722aa <__SEHFrameHandler+0x4a>
68f722e2:	85 d2                	test   %edx,%edx
68f722e4:	74 9d                	je     68f72283 <__SEHFrameHandler+0x23>
68f722e6:	8b 45 10             	mov    0x10(%ebp),%eax
68f722e9:	89 5d f0             	mov    %ebx,0xfffffff0(%ebp)
68f722ec:	89 45 f4             	mov    %eax,0xfffffff4(%ebp)
68f722ef:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
68f722f2:	53                   	push   %ebx
68f722f3:	53                   	push   %ebx
68f722f4:	56                   	push   %esi
68f722f5:	50                   	push   %eax
68f722f6:	ff d2                	call   *%edx
68f722f8:	89 c2                	mov    %eax,%edx
68f722fa:	58                   	pop    %eax
68f722fb:	59                   	pop    %ecx
68f722fc:	eb af                	jmp    68f722ad <__SEHFrameHandler+0x4d>
68f722fe:	89 f6                	mov    %esi,%esi

68f72300 <__SEHEnter@4>:

void __stdcall _SEHEnter(_SEHPortableFrame_t * frame)
{
68f72300:	55                   	push   %ebp
68f72301:	89 e5                	mov    %esp,%ebp
68f72303:	83 ec 14             	sub    $0x14,%esp
68f72306:	8b 45 08             	mov    0x8(%ebp),%eax
 frame->SPF_Registration.SER_Handler = _SEHFrameHandler;
68f72309:	c7 40 04 60 22 f7 68 	movl   $0x68f72260,0x4(%eax)
 frame->SPF_Code = 0;
68f72310:	c7 40 08 00 00 00 00 	movl   $0x0,0x8(%eax)
 frame->SPF_Handling = 0;
68f72317:	c7 40 0c 00 00 00 00 	movl   $0x0,0xc(%eax)
 _SEHRegisterFrame(&frame->SPF_Registration);
68f7231e:	50                   	push   %eax
68f7231f:	e8 2e 00 00 00       	call   68f72352 <__SEHRegisterFrame>
68f72324:	c9                   	leave  
68f72325:	c2 04 00             	ret    $0x4
68f72328:	90                   	nop    
68f72329:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

68f72330 <__SEHLeave@4>:
}

void __stdcall _SEHLeave(_SEHPortableFrame_t * frame)
{
68f72330:	55                   	push   %ebp
68f72331:	89 e5                	mov    %esp,%ebp
68f72333:	83 ec 14             	sub    $0x14,%esp
 _SEHUnregisterFrame(&frame->SPF_Registration);
68f72336:	8b 4d 08             	mov    0x8(%ebp),%ecx
68f72339:	51                   	push   %ecx
68f7233a:	e8 27 00 00 00       	call   68f72366 <__SEHUnregisterFrame>
68f7233f:	c9                   	leave  
68f72340:	c2 04 00             	ret    $0x4
68f72343:	90                   	nop    
68f72344:	90                   	nop    
68f72345:	90                   	nop    
68f72346:	90                   	nop    
68f72347:	90                   	nop    
68f72348:	90                   	nop    
68f72349:	90                   	nop    
68f7234a:	90                   	nop    
68f7234b:	90                   	nop    
68f7234c:	90                   	nop    
68f7234d:	90                   	nop    
68f7234e:	90                   	nop    
68f7234f:	90                   	nop    

68f72350 <__SEHCleanHandlerEnvironment>:
68f72350:	fc                   	cld    
68f72351:	c3                   	ret    

68f72352 <__SEHRegisterFrame>:
68f72352:	8b 4c 24 04          	mov    0x4(%esp),%ecx
68f72356:	64 a1 00 00 00 00    	mov    %fs:0x0,%eax
68f7235c:	89 01                	mov    %eax,(%ecx)
68f7235e:	64 89 0d 00 00 00 00 	mov    %ecx,%fs:0x0
68f72365:	c3                   	ret    

68f72366 <__SEHUnregisterFrame>:
68f72366:	8b 4c 24 04          	mov    0x4(%esp),%ecx
68f7236a:	8b 09                	mov    (%ecx),%ecx
68f7236c:	64 89 0d 00 00 00 00 	mov    %ecx,%fs:0x0
68f72373:	c3                   	ret    

68f72374 <__SEHUnwind>:
68f72374:	8b 4c 24 04          	mov    0x4(%esp),%ecx
68f72378:	56                   	push   %esi
68f72379:	57                   	push   %edi
68f7237a:	53                   	push   %ebx
68f7237b:	31 c0                	xor    %eax,%eax
68f7237d:	50                   	push   %eax
68f7237e:	50                   	push   %eax
68f7237f:	50                   	push   %eax
68f72380:	51                   	push   %ecx
68f72381:	ff 15 00 30 f7 68    	call   *0x68f73000
68f72387:	5b                   	pop    %ebx
68f72388:	5f                   	pop    %edi
68f72389:	5e                   	pop    %esi
68f7238a:	c3                   	ret    
68f7238b:	00 00                	add    %al,(%eax)
68f7238d:	00 00                	add    %al,(%eax)
	...

68f72390 <_PsaWalkSystemModules@12>:
}

/* EOF */
68f72390:	55                   	push   %ebp
68f72391:	89 e5                	mov    %esp,%ebp
68f72393:	57                   	push   %edi
68f72394:	56                   	push   %esi
68f72395:	53                   	push   %ebx
68f72396:	83 ec 0c             	sub    $0xc,%esp
68f72399:	31 f6                	xor    %esi,%esi
68f7239b:	8b 7d 08             	mov    0x8(%ebp),%edi
68f7239e:	8b 07                	mov    (%edi),%eax
68f723a0:	85 c0                	test   %eax,%eax
68f723a2:	74 1e                	je     68f723c2 <_PsaWalkSystemModules@12+0x32>
68f723a4:	8d 5f 04             	lea    0x4(%edi),%ebx
68f723a7:	50                   	push   %eax
68f723a8:	50                   	push   %eax
68f723a9:	8b 45 10             	mov    0x10(%ebp),%eax
68f723ac:	50                   	push   %eax
68f723ad:	53                   	push   %ebx
68f723ae:	ff 55 0c             	call   *0xc(%ebp)
68f723b1:	5a                   	pop    %edx
68f723b2:	85 c0                	test   %eax,%eax
68f723b4:	59                   	pop    %ecx
68f723b5:	78 0d                	js     68f723c4 <_PsaWalkSystemModules@12+0x34>
68f723b7:	46                   	inc    %esi
68f723b8:	81 c3 1c 01 00 00    	add    $0x11c,%ebx
68f723be:	39 37                	cmp    %esi,(%edi)
68f723c0:	77 e5                	ja     68f723a7 <_PsaWalkSystemModules@12+0x17>
68f723c2:	31 c0                	xor    %eax,%eax
68f723c4:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f723c7:	5b                   	pop    %ebx
68f723c8:	5e                   	pop    %esi
68f723c9:	5f                   	pop    %edi
68f723ca:	5d                   	pop    %ebp
68f723cb:	c2 0c 00             	ret    $0xc
68f723ce:	89 f6                	mov    %esi,%esi

68f723d0 <_PsaCaptureSystemModules@4>:
68f723d0:	55                   	push   %ebp
68f723d1:	89 e5                	mov    %esp,%ebp
68f723d3:	56                   	push   %esi
68f723d4:	53                   	push   %ebx
68f723d5:	31 f6                	xor    %esi,%esi
68f723d7:	83 ec 10             	sub    $0x10,%esp
68f723da:	8d 45 f4             	lea    0xfffffff4(%ebp),%eax
68f723dd:	c7 45 f4 00 00 00 00 	movl   $0x0,0xfffffff4(%ebp)
68f723e4:	6a 00                	push   $0x0
68f723e6:	6a 04                	push   $0x4
68f723e8:	50                   	push   %eax
68f723e9:	6a 0b                	push   $0xb
68f723eb:	e8 c0 05 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f723f0:	89 c2                	mov    %eax,%edx
68f723f2:	89 c3                	mov    %eax,%ebx
68f723f4:	c1 ea 1f             	shr    $0x1f,%edx
68f723f7:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f723fc:	0f 95 c0             	setne  %al
68f723ff:	85 d0                	test   %edx,%eax
68f72401:	75 63                	jne    68f72466 <_PsaCaptureSystemModules@4+0x96>
68f72403:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f72406:	8d 04 c0             	lea    (%eax,%eax,8),%eax
68f72409:	c1 e0 05             	shl    $0x5,%eax
68f7240c:	05 20 01 00 00       	add    $0x120,%eax
68f72411:	89 45 f4             	mov    %eax,0xfffffff4(%ebp)
68f72414:	83 ec 0c             	sub    $0xc,%esp
68f72417:	56                   	push   %esi
68f72418:	e8 a3 ec ff ff       	call   68f710c0 <_PsaiFree>
68f7241d:	5a                   	pop    %edx
68f7241e:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f72421:	50                   	push   %eax
68f72422:	e8 59 ec ff ff       	call   68f71080 <_PsaiMalloc>
68f72427:	83 c4 10             	add    $0x10,%esp
68f7242a:	85 c0                	test   %eax,%eax
68f7242c:	74 53                	je     68f72481 <_PsaCaptureSystemModules@4+0xb1>
68f7242e:	6a 00                	push   $0x0
68f72430:	89 c6                	mov    %eax,%esi
68f72432:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f72435:	50                   	push   %eax
68f72436:	56                   	push   %esi
68f72437:	6a 0b                	push   $0xb
68f72439:	e8 72 05 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f7243e:	89 c3                	mov    %eax,%ebx
68f72440:	8b 45 f4             	mov    0xfffffff4(%ebp),%eax
68f72443:	01 c0                	add    %eax,%eax
68f72445:	81 fb 04 00 00 c0    	cmp    $0xc0000004,%ebx
68f7244b:	89 45 f4             	mov    %eax,0xfffffff4(%ebp)
68f7244e:	74 c4                	je     68f72414 <_PsaCaptureSystemModules@4+0x44>
68f72450:	85 db                	test   %ebx,%ebx
68f72452:	78 16                	js     68f7246a <_PsaCaptureSystemModules@4+0x9a>
68f72454:	8b 45 08             	mov    0x8(%ebp),%eax
68f72457:	31 db                	xor    %ebx,%ebx
68f72459:	89 30                	mov    %esi,(%eax)
68f7245b:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f7245e:	89 d8                	mov    %ebx,%eax
68f72460:	5b                   	pop    %ebx
68f72461:	5e                   	pop    %esi
68f72462:	5d                   	pop    %ebp
68f72463:	c2 04 00             	ret    $0x4
68f72466:	85 db                	test   %ebx,%ebx
68f72468:	79 f1                	jns    68f7245b <_PsaCaptureSystemModules@4+0x8b>
68f7246a:	83 ec 0c             	sub    $0xc,%esp
68f7246d:	56                   	push   %esi
68f7246e:	e8 4d ec ff ff       	call   68f710c0 <_PsaiFree>
68f72473:	83 c4 10             	add    $0x10,%esp
68f72476:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
68f72479:	89 d8                	mov    %ebx,%eax
68f7247b:	5b                   	pop    %ebx
68f7247c:	5e                   	pop    %esi
68f7247d:	5d                   	pop    %ebp
68f7247e:	c2 04 00             	ret    $0x4
68f72481:	83 ec 0c             	sub    $0xc,%esp
68f72484:	bb 17 00 00 c0       	mov    $0xc0000017,%ebx
68f72489:	56                   	push   %esi
68f7248a:	e8 31 ec ff ff       	call   68f710c0 <_PsaiFree>
68f7248f:	83 c4 10             	add    $0x10,%esp
68f72492:	eb e2                	jmp    68f72476 <_PsaCaptureSystemModules@4+0xa6>
68f72494:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f7249a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f724a0 <_PsaEnumerateSystemModules@8>:
68f724a0:	55                   	push   %ebp
68f724a1:	89 e5                	mov    %esp,%ebp
68f724a3:	53                   	push   %ebx
68f724a4:	83 ec 10             	sub    $0x10,%esp
68f724a7:	8d 45 f8             	lea    0xfffffff8(%ebp),%eax
68f724aa:	50                   	push   %eax
68f724ab:	e8 20 ff ff ff       	call   68f723d0 <_PsaCaptureSystemModules@4>
68f724b0:	83 c4 0c             	add    $0xc,%esp
68f724b3:	89 c3                	mov    %eax,%ebx
68f724b5:	85 c0                	test   %eax,%eax
68f724b7:	78 15                	js     68f724ce <_PsaEnumerateSystemModules@8+0x2e>
68f724b9:	50                   	push   %eax
68f724ba:	8b 45 0c             	mov    0xc(%ebp),%eax
68f724bd:	50                   	push   %eax
68f724be:	8b 45 08             	mov    0x8(%ebp),%eax
68f724c1:	50                   	push   %eax
68f724c2:	8b 45 f8             	mov    0xfffffff8(%ebp),%eax
68f724c5:	50                   	push   %eax
68f724c6:	e8 c5 fe ff ff       	call   68f72390 <_PsaWalkSystemModules@12>
68f724cb:	89 c3                	mov    %eax,%ebx
68f724cd:	58                   	pop    %eax
68f724ce:	83 ec 0c             	sub    $0xc,%esp
68f724d1:	8b 4d f8             	mov    0xfffffff8(%ebp),%ecx
68f724d4:	51                   	push   %ecx
68f724d5:	e8 06 03 00 00       	call   68f727e0 <_PsaFreeCapture@4>
68f724da:	89 d8                	mov    %ebx,%eax
68f724dc:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
68f724df:	c9                   	leave  
68f724e0:	c2 08 00             	ret    $0x8
68f724e3:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f724e9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f724f0 <@PsaWalkFirstSystemModule@4>:
68f724f0:	55                   	push   %ebp
68f724f1:	8d 41 04             	lea    0x4(%ecx),%eax
68f724f4:	89 e5                	mov    %esp,%ebp
68f724f6:	5d                   	pop    %ebp
68f724f7:	c3                   	ret    
68f724f8:	90                   	nop    
68f724f9:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

68f72500 <@PsaWalkNextSystemModule@4>:
68f72500:	55                   	push   %ebp
68f72501:	8d 81 1c 01 00 00    	lea    0x11c(%ecx),%eax
68f72507:	89 e5                	mov    %esp,%ebp
68f72509:	5d                   	pop    %ebp
68f7250a:	c3                   	ret    
68f7250b:	90                   	nop    
68f7250c:	90                   	nop    
68f7250d:	90                   	nop    
68f7250e:	90                   	nop    
68f7250f:	90                   	nop    

68f72510 <_PsaEnumerateProcessModules@12>:
68f72510:	55                   	push   %ebp
68f72511:	89 e5                	mov    %esp,%ebp
68f72513:	57                   	push   %edi
68f72514:	56                   	push   %esi
68f72515:	53                   	push   %ebx
68f72516:	81 ec 8c 00 00 00    	sub    $0x8c,%esp
68f7251c:	8b 75 08             	mov    0x8(%ebp),%esi
68f7251f:	83 fe ff             	cmp    $0xffffffff,%esi
68f72522:	0f 84 b8 00 00 00    	je     68f725e0 <_PsaEnumerateProcessModules@12+0xd0>
68f72528:	83 ec 0c             	sub    $0xc,%esp
68f7252b:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
68f7252e:	6a 00                	push   $0x0
68f72530:	6a 18                	push   $0x18
68f72532:	50                   	push   %eax
68f72533:	6a 00                	push   $0x0
68f72535:	56                   	push   %esi
68f72536:	e8 55 04 00 00       	call   68f72990 <_NtQueryInformationProcess@20>
68f7253b:	83 c4 0c             	add    $0xc,%esp
68f7253e:	85 c0                	test   %eax,%eax
68f72540:	0f 88 8e 00 00 00    	js     68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f72546:	83 ec 0c             	sub    $0xc,%esp
68f72549:	8d 85 74 ff ff ff    	lea    0xffffff74(%ebp),%eax
68f7254f:	6a 00                	push   $0x0
68f72551:	6a 04                	push   $0x4
68f72553:	50                   	push   %eax
68f72554:	8b 45 cc             	mov    0xffffffcc(%ebp),%eax
68f72557:	83 c0 0c             	add    $0xc,%eax
68f7255a:	50                   	push   %eax
68f7255b:	56                   	push   %esi
68f7255c:	e8 1f 04 00 00       	call   68f72980 <_NtReadVirtualMemory@20>
68f72561:	83 c4 0c             	add    $0xc,%esp
68f72564:	85 c0                	test   %eax,%eax
68f72566:	78 6c                	js     68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f72568:	83 ec 0c             	sub    $0xc,%esp
68f7256b:	8b 9d 74 ff ff ff    	mov    0xffffff74(%ebp),%ebx
68f72571:	83 c3 0c             	add    $0xc,%ebx
68f72574:	8d 85 70 ff ff ff    	lea    0xffffff70(%ebp),%eax
68f7257a:	6a 00                	push   $0x0
68f7257c:	6a 04                	push   $0x4
68f7257e:	50                   	push   %eax
68f7257f:	53                   	push   %ebx
68f72580:	56                   	push   %esi
68f72581:	e8 fa 03 00 00       	call   68f72980 <_NtReadVirtualMemory@20>
68f72586:	83 c4 0c             	add    $0xc,%esp
68f72589:	39 9d 70 ff ff ff    	cmp    %ebx,0xffffff70(%ebp)
68f7258f:	74 41                	je     68f725d2 <_PsaEnumerateProcessModules@12+0xc2>
68f72591:	8d bd 78 ff ff ff    	lea    0xffffff78(%ebp),%edi
68f72597:	83 ec 0c             	sub    $0xc,%esp
68f7259a:	8b 85 70 ff ff ff    	mov    0xffffff70(%ebp),%eax
68f725a0:	6a 00                	push   $0x0
68f725a2:	6a 48                	push   $0x48
68f725a4:	57                   	push   %edi
68f725a5:	50                   	push   %eax
68f725a6:	56                   	push   %esi
68f725a7:	e8 d4 03 00 00       	call   68f72980 <_NtReadVirtualMemory@20>
68f725ac:	83 c4 0c             	add    $0xc,%esp
68f725af:	85 c0                	test   %eax,%eax
68f725b1:	78 21                	js     68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f725b3:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f725b6:	50                   	push   %eax
68f725b7:	51                   	push   %ecx
68f725b8:	57                   	push   %edi
68f725b9:	56                   	push   %esi
68f725ba:	ff 55 0c             	call   *0xc(%ebp)
68f725bd:	5a                   	pop    %edx
68f725be:	85 c0                	test   %eax,%eax
68f725c0:	78 12                	js     68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f725c2:	8b 85 78 ff ff ff    	mov    0xffffff78(%ebp),%eax
68f725c8:	89 85 70 ff ff ff    	mov    %eax,0xffffff70(%ebp)
68f725ce:	39 d8                	cmp    %ebx,%eax
68f725d0:	75 c5                	jne    68f72597 <_PsaEnumerateProcessModules@12+0x87>
68f725d2:	31 c0                	xor    %eax,%eax
68f725d4:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f725d7:	5b                   	pop    %ebx
68f725d8:	5e                   	pop    %esi
68f725d9:	5f                   	pop    %edi
68f725da:	5d                   	pop    %ebp
68f725db:	c2 0c 00             	ret    $0xc
68f725de:	89 f6                	mov    %esi,%esi
 struct _PEB * pPeb;

#if defined(__GNUC__)

 __asm__ __volatile__
68f725e0:	64 a1 30 00 00 00    	mov    %fs:0x30,%eax
68f725e6:	8b 40 0c             	mov    0xc(%eax),%eax
68f725e9:	8d 70 0c             	lea    0xc(%eax),%esi
68f725ec:	8b 58 0c             	mov    0xc(%eax),%ebx
68f725ef:	eb 12                	jmp    68f72603 <_PsaEnumerateProcessModules@12+0xf3>
68f725f1:	8b 4d 10             	mov    0x10(%ebp),%ecx
68f725f4:	57                   	push   %edi
68f725f5:	51                   	push   %ecx
68f725f6:	53                   	push   %ebx
68f725f7:	6a ff                	push   $0xffffffff
68f725f9:	ff 55 0c             	call   *0xc(%ebp)
68f725fc:	5a                   	pop    %edx
68f725fd:	85 c0                	test   %eax,%eax
68f725ff:	78 d3                	js     68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f72601:	8b 1b                	mov    (%ebx),%ebx
68f72603:	39 f3                	cmp    %esi,%ebx
68f72605:	75 ea                	jne    68f725f1 <_PsaEnumerateProcessModules@12+0xe1>
        goto Failure;
      }
    
      /* address of the next module in the list */
      Current = LoaderModule.InLoadOrderModuleList.Flink;
    }
  }

  return STATUS_SUCCESS;
68f72607:	31 c0                	xor    %eax,%eax
68f72609:	eb c9                	jmp    68f725d4 <_PsaEnumerateProcessModules@12+0xc4>
68f7260b:	90                   	nop    
68f7260c:	90                   	nop    
68f7260d:	90                   	nop    
68f7260e:	90                   	nop    
68f7260f:	90                   	nop    

68f72610 <_PsaCaptureProcessesAndThreads@4>:
68f72610:	55                   	push   %ebp
68f72611:	b8 ef 00 00 c0       	mov    $0xc00000ef,%eax
68f72616:	89 e5                	mov    %esp,%ebp
68f72618:	57                   	push   %edi
68f72619:	56                   	push   %esi
68f7261a:	53                   	push   %ebx
68f7261b:	83 ec 0c             	sub    $0xc,%esp
68f7261e:	31 f6                	xor    %esi,%esi
68f72620:	8b 4d 08             	mov    0x8(%ebp),%ecx
68f72623:	bb 00 80 00 00       	mov    $0x8000,%ebx
68f72628:	85 c9                	test   %ecx,%ecx
68f7262a:	74 3f                	je     68f7266b <_PsaCaptureProcessesAndThreads@4+0x5b>
68f7262c:	8d 74 26 00          	lea    0x0(%esi),%esi
68f72630:	83 ec 0c             	sub    $0xc,%esp
68f72633:	56                   	push   %esi
68f72634:	e8 87 ea ff ff       	call   68f710c0 <_PsaiFree>
68f72639:	89 1c 24             	mov    %ebx,(%esp)
68f7263c:	e8 3f ea ff ff       	call   68f71080 <_PsaiMalloc>
68f72641:	83 c4 10             	add    $0x10,%esp
68f72644:	85 c0                	test   %eax,%eax
68f72646:	74 2d                	je     68f72675 <_PsaCaptureProcessesAndThreads@4+0x65>
68f72648:	6a 00                	push   $0x0
68f7264a:	89 c6                	mov    %eax,%esi
68f7264c:	53                   	push   %ebx
68f7264d:	50                   	push   %eax
68f7264e:	6a 05                	push   $0x5
68f72650:	e8 5b 03 00 00       	call   68f729b0 <_NtQuerySystemInformation@16>
68f72655:	01 db                	add    %ebx,%ebx
68f72657:	89 c7                	mov    %eax,%edi
68f72659:	3d 04 00 00 c0       	cmp    $0xc0000004,%eax
68f7265e:	74 d0                	je     68f72630 <_PsaCaptureProcessesAndThreads@4+0x20>
68f72660:	85 c0                	test   %eax,%eax
68f72662:	78 42                	js     68f726a6 <_PsaCaptureProcessesAndThreads@4+0x96>
68f72664:	8b 45 08             	mov    0x8(%ebp),%eax
68f72667:	89 30                	mov    %esi,(%eax)
68f72669:	31 c0                	xor    %eax,%eax
68f7266b:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f7266e:	5b                   	pop    %ebx
68f7266f:	5e                   	pop    %esi
68f72670:	5f                   	pop    %edi
68f72671:	5d                   	pop    %ebp
68f72672:	c2 04 00             	ret    $0x4
68f72675:	52                   	push   %edx
68f72676:	6a 45                	push   $0x45
68f72678:	68 00 40 f7 68       	push   $0x68f74000
68f7267d:	68 11 40 f7 68       	push   $0x68f74011
68f72682:	e8 89 03 00 00       	call   68f72a10 <_DbgPrint>
68f72687:	83 c4 0c             	add    $0xc,%esp
68f7268a:	bf 17 00 00 c0       	mov    $0xc0000017,%edi
68f7268f:	68 17 00 00 c0       	push   $0xc0000017
68f72694:	68 1a 40 f7 68       	push   $0x68f7401a
68f72699:	68 28 40 f7 68       	push   $0x68f74028
68f7269e:	e8 6d 03 00 00       	call   68f72a10 <_DbgPrint>
68f726a3:	83 c4 10             	add    $0x10,%esp
68f726a6:	50                   	push   %eax
68f726a7:	6a 58                	push   $0x58
68f726a9:	68 00 40 f7 68       	push   $0x68f74000
68f726ae:	68 11 40 f7 68       	push   $0x68f74011
68f726b3:	e8 58 03 00 00       	call   68f72a10 <_DbgPrint>
68f726b8:	83 c4 0c             	add    $0xc,%esp
68f726bb:	57                   	push   %edi
68f726bc:	68 4b 40 f7 68       	push   $0x68f7404b
68f726c1:	68 28 40 f7 68       	push   $0x68f74028
68f726c6:	e8 45 03 00 00       	call   68f72a10 <_DbgPrint>
68f726cb:	89 f8                	mov    %edi,%eax
68f726cd:	83 c4 10             	add    $0x10,%esp
68f726d0:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f726d3:	5b                   	pop    %ebx
68f726d4:	5e                   	pop    %esi
68f726d5:	5f                   	pop    %edi
68f726d6:	5d                   	pop    %ebp
68f726d7:	c2 04 00             	ret    $0x4
68f726da:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

68f726e0 <@PsaWalkFirstProcess@4>:

Failure:
  return Status;
}

/* EOF */
68f726e0:	55                   	push   %ebp
68f726e1:	89 c8                	mov    %ecx,%eax
68f726e3:	89 e5                	mov    %esp,%ebp
68f726e5:	5d                   	pop    %ebp
68f726e6:	c3                   	ret    
68f726e7:	89 f6                	mov    %esi,%esi
68f726e9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f726f0 <@PsaWalkFirstThread@4>:
68f726f0:	55                   	push   %ebp
68f726f1:	8d 81 b8 00 00 00    	lea    0xb8(%ecx),%eax
68f726f7:	89 e5                	mov    %esp,%ebp
68f726f9:	c7 05 20 50 f7 68 b8 	movl   $0xb8,0x68f75020
68f72700:	00 00 00 
68f72703:	5d                   	pop    %ebp
68f72704:	c3                   	ret    
68f72705:	8d 74 26 00          	lea    0x0(%esi),%esi
68f72709:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f72710 <@PsaWalkNextThread@4>:
68f72710:	55                   	push   %ebp
68f72711:	8d 41 40             	lea    0x40(%ecx),%eax
68f72714:	89 e5                	mov    %esp,%ebp
68f72716:	5d                   	pop    %ebp
68f72717:	c3                   	ret    
68f72718:	90                   	nop    
68f72719:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

68f72720 <@PsaWalkNextProcess@4>:
68f72720:	55                   	push   %ebp
68f72721:	8b 11                	mov    (%ecx),%edx
68f72723:	31 c0                	xor    %eax,%eax
68f72725:	89 e5                	mov    %esp,%ebp
68f72727:	85 d2                	test   %edx,%edx
68f72729:	74 03                	je     68f7272e <@PsaWalkNextProcess@4+0xe>
68f7272b:	8d 04 0a             	lea    (%edx,%ecx,1),%eax
68f7272e:	5d                   	pop    %ebp
68f7272f:	c3                   	ret    

68f72730 <_PsaWalkProcessesAndThreads@20>:
68f72730:	55                   	push   %ebp
68f72731:	b8 0d 00 00 c0       	mov    $0xc000000d,%eax
68f72736:	89 e5                	mov    %esp,%ebp
68f72738:	57                   	push   %edi
68f72739:	56                   	push   %esi
68f7273a:	53                   	push   %ebx
68f7273b:	83 ec 0c             	sub    $0xc,%esp
68f7273e:	8b 55 0c             	mov    0xc(%ebp),%edx
68f72741:	8b 75 08             	mov    0x8(%ebp),%esi
68f72744:	0b 55 14             	or     0x14(%ebp),%edx
68f72747:	74 5a                	je     68f727a3 <_PsaWalkProcessesAndThreads@20+0x73>
68f72749:	89 f1                	mov    %esi,%ecx
68f7274b:	c7 45 f0 00 00 00 00 	movl   $0x0,0xfffffff0(%ebp)
68f72752:	e8 89 ff ff ff       	call   68f726e0 <@PsaWalkFirstProcess@4>
68f72757:	89 c6                	mov    %eax,%esi
68f72759:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f72760:	8b 45 0c             	mov    0xc(%ebp),%eax
68f72763:	85 c0                	test   %eax,%eax
68f72765:	74 13                	je     68f7277a <_PsaWalkProcessesAndThreads@20+0x4a>
68f72767:	8b 5d 10             	mov    0x10(%ebp),%ebx
68f7276a:	57                   	push   %edi
68f7276b:	57                   	push   %edi
68f7276c:	53                   	push   %ebx
68f7276d:	56                   	push   %esi
68f7276e:	ff 55 0c             	call   *0xc(%ebp)
68f72771:	5a                   	pop    %edx
68f72772:	85 c0                	test   %eax,%eax
68f72774:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
68f72777:	59                   	pop    %ecx
68f72778:	78 26                	js     68f727a0 <_PsaWalkProcessesAndThreads@20+0x70>
68f7277a:	8b 45 14             	mov    0x14(%ebp),%eax
68f7277d:	85 c0                	test   %eax,%eax
68f7277f:	74 12                	je     68f72793 <_PsaWalkProcessesAndThreads@20+0x63>
68f72781:	89 f1                	mov    %esi,%ecx
68f72783:	31 ff                	xor    %edi,%edi
68f72785:	e8 66 ff ff ff       	call   68f726f0 <@PsaWalkFirstThread@4>
68f7278a:	89 c3                	mov    %eax,%ebx
68f7278c:	8b 46 04             	mov    0x4(%esi),%eax
68f7278f:	85 c0                	test   %eax,%eax
68f72791:	75 2c                	jne    68f727bf <_PsaWalkProcessesAndThreads@20+0x8f>
68f72793:	89 f1                	mov    %esi,%ecx
68f72795:	e8 86 ff ff ff       	call   68f72720 <@PsaWalkNextProcess@4>
68f7279a:	89 c6                	mov    %eax,%esi
68f7279c:	85 c0                	test   %eax,%eax
68f7279e:	75 c0                	jne    68f72760 <_PsaWalkProcessesAndThreads@20+0x30>
68f727a0:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
68f727a3:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f727a6:	5b                   	pop    %ebx
68f727a7:	5e                   	pop    %esi
68f727a8:	5f                   	pop    %edi
68f727a9:	5d                   	pop    %ebp
68f727aa:	c2 14 00             	ret    $0x14
68f727ad:	8d 76 00             	lea    0x0(%esi),%esi
68f727b0:	89 d9                	mov    %ebx,%ecx
68f727b2:	47                   	inc    %edi
68f727b3:	e8 58 ff ff ff       	call   68f72710 <@PsaWalkNextThread@4>
68f727b8:	39 7e 04             	cmp    %edi,0x4(%esi)
68f727bb:	89 c3                	mov    %eax,%ebx
68f727bd:	76 d4                	jbe    68f72793 <_PsaWalkProcessesAndThreads@20+0x63>
68f727bf:	50                   	push   %eax
68f727c0:	50                   	push   %eax
68f727c1:	8b 45 18             	mov    0x18(%ebp),%eax
68f727c4:	50                   	push   %eax
68f727c5:	53                   	push   %ebx
68f727c6:	ff 55 14             	call   *0x14(%ebp)
68f727c9:	5a                   	pop    %edx
68f727ca:	85 c0                	test   %eax,%eax
68f727cc:	89 45 f0             	mov    %eax,0xfffffff0(%ebp)
68f727cf:	59                   	pop    %ecx
68f727d0:	79 de                	jns    68f727b0 <_PsaWalkProcessesAndThreads@20+0x80>
68f727d2:	eb cc                	jmp    68f727a0 <_PsaWalkProcessesAndThreads@20+0x70>
68f727d4:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f727da:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

68f727e0 <_PsaFreeCapture@4>:
68f727e0:	55                   	push   %ebp
68f727e1:	89 e5                	mov    %esp,%ebp
68f727e3:	83 ec 14             	sub    $0x14,%esp
68f727e6:	8b 45 08             	mov    0x8(%ebp),%eax
68f727e9:	50                   	push   %eax
68f727ea:	e8 d1 e8 ff ff       	call   68f710c0 <_PsaiFree>
68f727ef:	c9                   	leave  
68f727f0:	c2 04 00             	ret    $0x4
68f727f3:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
68f727f9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f72800 <_PsaEnumerateProcessesAndThreads@16>:
68f72800:	55                   	push   %ebp
68f72801:	b8 0d 00 00 c0       	mov    $0xc000000d,%eax
68f72806:	89 e5                	mov    %esp,%ebp
68f72808:	57                   	push   %edi
68f72809:	56                   	push   %esi
68f7280a:	53                   	push   %ebx
68f7280b:	83 ec 0c             	sub    $0xc,%esp
68f7280e:	8b 7d 08             	mov    0x8(%ebp),%edi
68f72811:	8b 75 10             	mov    0x10(%ebp),%esi
68f72814:	89 fa                	mov    %edi,%edx
68f72816:	09 f2                	or     %esi,%edx
68f72818:	74 3e                	je     68f72858 <_PsaEnumerateProcessesAndThreads@16+0x58>
68f7281a:	83 ec 0c             	sub    $0xc,%esp
68f7281d:	8d 45 f0             	lea    0xfffffff0(%ebp),%eax
68f72820:	50                   	push   %eax
68f72821:	e8 ea fd ff ff       	call   68f72610 <_PsaCaptureProcessesAndThreads@4>
68f72826:	83 c4 0c             	add    $0xc,%esp
68f72829:	89 c3                	mov    %eax,%ebx
68f7282b:	85 c0                	test   %eax,%eax
68f7282d:	78 1b                	js     68f7284a <_PsaEnumerateProcessesAndThreads@16+0x4a>
68f7282f:	83 ec 0c             	sub    $0xc,%esp
68f72832:	8b 45 14             	mov    0x14(%ebp),%eax
68f72835:	50                   	push   %eax
68f72836:	8b 45 0c             	mov    0xc(%ebp),%eax
68f72839:	56                   	push   %esi
68f7283a:	50                   	push   %eax
68f7283b:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
68f7283e:	57                   	push   %edi
68f7283f:	50                   	push   %eax
68f72840:	e8 eb fe ff ff       	call   68f72730 <_PsaWalkProcessesAndThreads@20>
68f72845:	89 c3                	mov    %eax,%ebx
68f72847:	83 c4 0c             	add    $0xc,%esp
68f7284a:	83 ec 0c             	sub    $0xc,%esp
68f7284d:	8b 45 f0             	mov    0xfffffff0(%ebp),%eax
68f72850:	50                   	push   %eax
68f72851:	e8 8a ff ff ff       	call   68f727e0 <_PsaFreeCapture@4>
68f72856:	89 d8                	mov    %ebx,%eax
68f72858:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
68f7285b:	5b                   	pop    %ebx
68f7285c:	5e                   	pop    %esi
68f7285d:	5f                   	pop    %edi
68f7285e:	5d                   	pop    %ebp
68f7285f:	c2 10 00             	ret    $0x10
68f72862:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
68f72869:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

68f72870 <_PsaWalkProcesses@12>:
68f72870:	55                   	push   %ebp
68f72871:	89 e5                	mov    %esp,%ebp
68f72873:	83 ec 14             	sub    $0x14,%esp
68f72876:	8b 45 10             	mov    0x10(%ebp),%eax
68f72879:	8b 4d 0c             	mov    0xc(%ebp),%ecx
68f7287c:	8b 55 08             	mov    0x8(%ebp),%edx
68f7287f:	6a 00                	push   $0x0
68f72881:	6a 00                	push   $0x0
68f72883:	50                   	push   %eax
68f72884:	51                   	push   %ecx
68f72885:	52                   	push   %edx
68f72886:	e8 a5 fe ff ff       	call   68f72730 <_PsaWalkProcessesAndThreads@20>
68f7288b:	c9                   	leave  
68f7288c:	c2 0c 00             	ret    $0xc
68f7288f:	90                   	nop    

68f72890 <_PsaWalkThreads@12>:
68f72890:	55                   	push   %ebp
68f72891:	89 e5                	mov    %esp,%ebp
68f72893:	83 ec 14             	sub    $0x14,%esp
68f72896:	8b 45 10             	mov    0x10(%ebp),%eax
68f72899:	50                   	push   %eax
68f7289a:	8b 45 0c             	mov    0xc(%ebp),%eax
68f7289d:	50                   	push   %eax
68f7289e:	8b 45 08             	mov    0x8(%ebp),%eax
68f728a1:	6a 00                	push   $0x0
68f728a3:	6a 00                	push   $0x0
68f728a5:	50                   	push   %eax
68f728a6:	e8 85 fe ff ff       	call   68f72730 <_PsaWalkProcessesAndThreads@20>
68f728ab:	c9                   	leave  
68f728ac:	c2 0c 00             	ret    $0xc
68f728af:	90                   	nop    

68f728b0 <_PsaEnumerateProcesses@8>:
68f728b0:	55                   	push   %ebp
68f728b1:	89 e5                	mov    %esp,%ebp
68f728b3:	52                   	push   %edx
68f728b4:	52                   	push   %edx
68f728b5:	6a 00                	push   $0x0
68f728b7:	8b 45 0c             	mov    0xc(%ebp),%eax
68f728ba:	6a 00                	push   $0x0
68f728bc:	50                   	push   %eax
68f728bd:	8b 45 08             	mov    0x8(%ebp),%eax
68f728c0:	50                   	push   %eax
68f728c1:	e8 3a ff ff ff       	call   68f72800 <_PsaEnumerateProcessesAndThreads@16>
68f728c6:	c9                   	leave  
68f728c7:	c2 08 00             	ret    $0x8
68f728ca:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

68f728d0 <_PsaEnumerateThreads@8>:
68f728d0:	55                   	push   %ebp
68f728d1:	89 e5                	mov    %esp,%ebp
68f728d3:	50                   	push   %eax
68f728d4:	50                   	push   %eax
68f728d5:	8b 45 0c             	mov    0xc(%ebp),%eax
68f728d8:	8b 4d 08             	mov    0x8(%ebp),%ecx
68f728db:	50                   	push   %eax
68f728dc:	51                   	push   %ecx
68f728dd:	6a 00                	push   $0x0
68f728df:	6a 00                	push   $0x0
68f728e1:	e8 1a ff ff ff       	call   68f72800 <_PsaEnumerateProcessesAndThreads@16>
68f728e6:	c9                   	leave  
68f728e7:	c2 08 00             	ret    $0x8
68f728ea:	90                   	nop    
68f728eb:	90                   	nop    
68f728ec:	90                   	nop    
68f728ed:	90                   	nop    
68f728ee:	90                   	nop    
68f728ef:	90                   	nop    

68f728f0 <_RtlReAllocateHeap@16>:
68f728f0:	ff 25 00 71 f7 68    	jmp    *0x68f77100
68f728f6:	90                   	nop    
68f728f7:	90                   	nop    
	...

68f72900 <_RtlFreeHeap@12>:
68f72900:	ff 25 f4 70 f7 68    	jmp    *0x68f770f4
68f72906:	90                   	nop    
68f72907:	90                   	nop    
	...

68f72910 <_RtlAllocateHeap@12>:
68f72910:	ff 25 ec 70 f7 68    	jmp    *0x68f770ec
68f72916:	90                   	nop    
68f72917:	90                   	nop    
	...

68f72920 <_RtlInitAnsiString@8>:
68f72920:	ff 25 f8 70 f7 68    	jmp    *0x68f770f8
68f72926:	90                   	nop    
68f72927:	90                   	nop    
	...

68f72930 <_RtlAnsiStringToUnicodeString@12>:
68f72930:	ff 25 f0 70 f7 68    	jmp    *0x68f770f0
68f72936:	90                   	nop    
68f72937:	90                   	nop    
	...

68f72940 <_RtlNtStatusToDosError@4>:
68f72940:	ff 25 fc 70 f7 68    	jmp    *0x68f770fc
68f72946:	90                   	nop    
68f72947:	90                   	nop    
	...

68f72950 <_NtQueryVirtualMemory@24>:
68f72950:	ff 25 e0 70 f7 68    	jmp    *0x68f770e0
68f72956:	90                   	nop    
68f72957:	90                   	nop    
	...

68f72960 <_RtlUnicodeStringToAnsiString@12>:
68f72960:	ff 25 04 71 f7 68    	jmp    *0x68f77104
68f72966:	90                   	nop    
68f72967:	90                   	nop    
	...

68f72970 <_RtlUnicodeStringToOemString@12>:
68f72970:	ff 25 08 71 f7 68    	jmp    *0x68f77108
68f72976:	90                   	nop    
68f72977:	90                   	nop    
	...

68f72980 <_NtReadVirtualMemory@20>:
68f72980:	ff 25 e4 70 f7 68    	jmp    *0x68f770e4
68f72986:	90                   	nop    
68f72987:	90                   	nop    
	...

68f72990 <_NtQueryInformationProcess@20>:
68f72990:	ff 25 d8 70 f7 68    	jmp    *0x68f770d8
68f72996:	90                   	nop    
68f72997:	90                   	nop    
	...

68f729a0 <_NtSetInformationProcess@16>:
68f729a0:	ff 25 e8 70 f7 68    	jmp    *0x68f770e8
68f729a6:	90                   	nop    
68f729a7:	90                   	nop    
	...

68f729b0 <_NtQuerySystemInformation@16>:
68f729b0:	ff 25 dc 70 f7 68    	jmp    *0x68f770dc
68f729b6:	90                   	nop    
68f729b7:	90                   	nop    
	...

68f729c0 <_memcpy>:
68f729c0:	ff 25 10 71 f7 68    	jmp    *0x68f77110
68f729c6:	90                   	nop    
68f729c7:	90                   	nop    
	...

68f729d0 <_wcschr>:
68f729d0:	ff 25 18 71 f7 68    	jmp    *0x68f77118
68f729d6:	90                   	nop    
68f729d7:	90                   	nop    
	...

68f729e0 <_wcslen>:
68f729e0:	ff 25 1c 71 f7 68    	jmp    *0x68f7711c
68f729e6:	90                   	nop    
68f729e7:	90                   	nop    
	...

68f729f0 <_strlen>:
68f729f0:	ff 25 14 71 f7 68    	jmp    *0x68f77114
68f729f6:	90                   	nop    
68f729f7:	90                   	nop    
	...

68f72a00 <_RtlUnwind@16>:
68f72a00:	ff 25 0c 71 f7 68    	jmp    *0x68f7710c
68f72a06:	90                   	nop    
68f72a07:	90                   	nop    
	...

68f72a10 <_DbgPrint>:
68f72a10:	ff 25 d4 70 f7 68    	jmp    *0x68f770d4
68f72a16:	90                   	nop    
68f72a17:	90                   	nop    
	...

68f72a20 <_DisableThreadLibraryCalls@4>:
68f72a20:	ff 25 b8 70 f7 68    	jmp    *0x68f770b8
68f72a26:	90                   	nop    
68f72a27:	90                   	nop    
	...

68f72a30 <_SetLastError@4>:
68f72a30:	ff 25 c4 70 f7 68    	jmp    *0x68f770c4
68f72a36:	90                   	nop    
68f72a37:	90                   	nop    
	...

68f72a40 <_AreFileApisANSI@0>:
68f72a40:	ff 25 b4 70 f7 68    	jmp    *0x68f770b4
68f72a46:	90                   	nop    
68f72a47:	90                   	nop    
	...

68f72a50 <_LocalAlloc@8>:
68f72a50:	ff 25 bc 70 f7 68    	jmp    *0x68f770bc
68f72a56:	90                   	nop    
68f72a57:	90                   	nop    
	...

68f72a60 <_WideCharToMultiByte@32>:
68f72a60:	ff 25 c8 70 f7 68    	jmp    *0x68f770c8
68f72a66:	90                   	nop    
68f72a67:	90                   	nop    
	...

68f72a70 <_LocalFree@4>:
68f72a70:	ff 25 c0 70 f7 68    	jmp    *0x68f770c0
68f72a76:	90                   	nop    
68f72a77:	90                   	nop    
	...

68f72a80 <__CTOR_LIST__>:
68f72a80:	ff                   	(bad)  
68f72a81:	ff                   	(bad)  
68f72a82:	ff                   	(bad)  
68f72a83:	ff 00                	incl   (%eax)
68f72a85:	00 00                	add    %al,(%eax)
	...

68f72a88 <__DTOR_LIST__>:
68f72a88:	ff                   	(bad)  
68f72a89:	ff                   	(bad)  
68f72a8a:	ff                   	(bad)  
68f72a8b:	ff 00                	incl   (%eax)
68f72a8d:	00 00                	add    %al,(%eax)
	...
