
fs_rec.nostrip.sys:     file format pei-i386

Disassembly of section .text:

00011000 <_FsRecReadSectors>:
		 IN ULONG DiskSector,
		 IN ULONG SectorCount,
		 IN ULONG SectorSize,
		 IN OUT PUCHAR Buffer)
{
   11000:	55                   	push   %ebp
   11001:	89 e5                	mov    %esp,%ebp
   11003:	57                   	push   %edi
   11004:	56                   	push   %esi
   11005:	53                   	push   %ebx
   11006:	83 ec 24             	sub    $0x24,%esp
   11009:	8b 5d 10             	mov    0x10(%ebp),%ebx
   1100c:	8b 7d 14             	mov    0x14(%ebp),%edi
  IO_STATUS_BLOCK IoStatus;
  LARGE_INTEGER Offset;
  ULONG BlockSize;
  PKEVENT Event;
  PIRP Irp;
  NTSTATUS Status;

  Event = ExAllocatePool(NonPagedPool, sizeof(KEVENT));
   1100f:	6a 10                	push   $0x10
   11011:	6a 00                	push   $0x0
   11013:	e8 c8 0b 00 00       	call   11be0 <_ExAllocatePool@8>
   11018:	89 c6                	mov    %eax,%esi
  if (Event == NULL)
   1101a:	58                   	pop    %eax
   1101b:	85 f6                	test   %esi,%esi
   1101d:	5a                   	pop    %edx
    {
      return(STATUS_INSUFFICIENT_RESOURCES);
   1101e:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11023:	74 57                	je     1107c <_FsRecReadSectors+0x7c>
    }

  KeInitializeEvent(Event,
   11025:	50                   	push   %eax
   11026:	6a 00                	push   $0x0
   11028:	6a 00                	push   $0x0
   1102a:	56                   	push   %esi
   1102b:	e8 c0 0b 00 00       	call   11bf0 <_KeInitializeEvent@12>
		    NotificationEvent,
		    FALSE);

  Offset.QuadPart = (LONGLONG)DiskSector * (LONGLONG)SectorSize;
   11030:	8b 45 0c             	mov    0xc(%ebp),%eax
  BlockSize = SectorCount * SectorSize;

  DPRINT("FsrecReadSectors(DeviceObject %x, DiskSector %d, Buffer %x)\n",
	 DeviceObject, DiskSector, Buffer);
  DPRINT("Offset %I64x BlockSize %ld\n",
	 Offset.QuadPart,
	 BlockSize);

  DPRINT("Building synchronous FSD Request...\n");
  Irp = IoBuildSynchronousFsdRequest(IRP_MJ_READ,
   11033:	8b 4d 08             	mov    0x8(%ebp),%ecx
   11036:	f7 e7                	mul    %edi
   11038:	0f af df             	imul   %edi,%ebx
   1103b:	89 45 e0             	mov    %eax,0xffffffe0(%ebp)
   1103e:	8d 45 e8             	lea    0xffffffe8(%ebp),%eax
   11041:	50                   	push   %eax
   11042:	8d 45 e0             	lea    0xffffffe0(%ebp),%eax
   11045:	56                   	push   %esi
   11046:	50                   	push   %eax
   11047:	53                   	push   %ebx
   11048:	8b 5d 18             	mov    0x18(%ebp),%ebx
   1104b:	53                   	push   %ebx
   1104c:	89 55 e4             	mov    %edx,0xffffffe4(%ebp)
   1104f:	51                   	push   %ecx
   11050:	6a 03                	push   $0x3
   11052:	e8 a9 0b 00 00       	call   11c00 <_IoBuildSynchronousFsdRequest@28>
				     DeviceObject,
				     Buffer,
				     BlockSize,
				     &Offset,
				     Event,
				     &IoStatus);
  if (Irp == NULL)
   11057:	5a                   	pop    %edx
   11058:	85 c0                	test   %eax,%eax
   1105a:	74 3e                	je     1109a <_FsRecReadSectors+0x9a>
    {
      DPRINT("IoBuildSynchronousFsdRequest failed\n");
      ExFreePool(Event);
      return(STATUS_INSUFFICIENT_RESOURCES);
    }

  DPRINT("Calling IO Driver... with irp %x\n", Irp);
  Status = IoCallDriver(DeviceObject, Irp);
   1105c:	8b 5d 08             	mov    0x8(%ebp),%ebx
   1105f:	57                   	push   %edi
   11060:	57                   	push   %edi
   11061:	50                   	push   %eax
   11062:	53                   	push   %ebx
   11063:	e8 a8 0b 00 00       	call   11c10 <_IoCallDriver@8>
  if (Status == STATUS_PENDING)
   11068:	5a                   	pop    %edx
   11069:	3d 03 01 00 00       	cmp    $0x103,%eax
   1106e:	59                   	pop    %ecx
   1106f:	74 13                	je     11084 <_FsRecReadSectors+0x84>
    {
      DPRINT("Operation pending\n");
      KeWaitForSingleObject(Event, Suspended, KernelMode, FALSE, NULL);
      Status = IoStatus.Status;
    }

  ExFreePool(Event);
   11071:	83 ec 0c             	sub    $0xc,%esp
   11074:	56                   	push   %esi
   11075:	e8 a6 0b 00 00       	call   11c20 <_ExFreePool@4>

  return(STATUS_SUCCESS);
   1107a:	31 c0                	xor    %eax,%eax
}
   1107c:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1107f:	5b                   	pop    %ebx
   11080:	5e                   	pop    %esi
   11081:	5f                   	pop    %edi
   11082:	5d                   	pop    %ebp
   11083:	c3                   	ret    
   11084:	83 ec 0c             	sub    $0xc,%esp
   11087:	6a 00                	push   $0x0
   11089:	6a 00                	push   $0x0
   1108b:	6a 00                	push   $0x0
   1108d:	6a 05                	push   $0x5
   1108f:	56                   	push   %esi
   11090:	e8 9b 0b 00 00       	call   11c30 <_KeWaitForSingleObject@20>
   11095:	83 c4 0c             	add    $0xc,%esp
   11098:	eb d7                	jmp    11071 <_FsRecReadSectors+0x71>
   1109a:	83 ec 0c             	sub    $0xc,%esp
   1109d:	56                   	push   %esi
   1109e:	e8 7d 0b 00 00       	call   11c20 <_ExFreePool@4>
   110a3:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   110a8:	eb d2                	jmp    1107c <_FsRecReadSectors+0x7c>
   110aa:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi

000110b0 <_FsRecDeviceIoControl>:


NTSTATUS
FsRecDeviceIoControl(IN PDEVICE_OBJECT DeviceObject,
		     IN ULONG ControlCode,
		     IN PVOID InputBuffer,
		     IN ULONG InputBufferSize,
		     IN OUT PVOID OutputBuffer,
		     IN OUT PULONG OutputBufferSize)
{
   110b0:	55                   	push   %ebp
   110b1:	89 e5                	mov    %esp,%ebp
   110b3:	57                   	push   %edi
   110b4:	56                   	push   %esi
   110b5:	53                   	push   %ebx
   110b6:	83 ec 0c             	sub    $0xc,%esp
  ULONG BufferSize = 0;
   110b9:	31 db                	xor    %ebx,%ebx
   110bb:	8b 7d 1c             	mov    0x1c(%ebp),%edi
  PKEVENT Event;
  PIRP Irp;
  IO_STATUS_BLOCK IoStatus;
  NTSTATUS Status;

  if (OutputBufferSize != NULL)
   110be:	85 ff                	test   %edi,%edi
   110c0:	74 02                	je     110c4 <_FsRecDeviceIoControl+0x14>
    {
      BufferSize = *OutputBufferSize;
   110c2:	8b 1f                	mov    (%edi),%ebx
    }

  Event = ExAllocatePool(NonPagedPool, sizeof(KEVENT));
   110c4:	51                   	push   %ecx
   110c5:	51                   	push   %ecx
   110c6:	6a 10                	push   $0x10
   110c8:	6a 00                	push   $0x0
   110ca:	e8 11 0b 00 00       	call   11be0 <_ExAllocatePool@8>
   110cf:	89 c6                	mov    %eax,%esi
  if (Event == NULL)
   110d1:	58                   	pop    %eax
   110d2:	85 f6                	test   %esi,%esi
   110d4:	5a                   	pop    %edx
    {
      return(STATUS_INSUFFICIENT_RESOURCES);
   110d5:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   110da:	74 61                	je     1113d <_FsRecDeviceIoControl+0x8d>
    }

  KeInitializeEvent(Event, NotificationEvent, FALSE);
   110dc:	50                   	push   %eax
   110dd:	6a 00                	push   $0x0
   110df:	6a 00                	push   $0x0
   110e1:	56                   	push   %esi
   110e2:	e8 09 0b 00 00       	call   11bf0 <_KeInitializeEvent@12>

  DPRINT("Building device I/O control request ...\n");
  Irp = IoBuildDeviceIoControlRequest(ControlCode,
   110e7:	8b 4d 0c             	mov    0xc(%ebp),%ecx
   110ea:	50                   	push   %eax
   110eb:	50                   	push   %eax
   110ec:	8d 45 e8             	lea    0xffffffe8(%ebp),%eax
   110ef:	50                   	push   %eax
   110f0:	8b 45 18             	mov    0x18(%ebp),%eax
   110f3:	56                   	push   %esi
   110f4:	6a 00                	push   $0x0
   110f6:	53                   	push   %ebx
   110f7:	50                   	push   %eax
   110f8:	8b 45 14             	mov    0x14(%ebp),%eax
   110fb:	8b 5d 08             	mov    0x8(%ebp),%ebx
   110fe:	50                   	push   %eax
   110ff:	8b 45 10             	mov    0x10(%ebp),%eax
   11102:	50                   	push   %eax
   11103:	53                   	push   %ebx
   11104:	51                   	push   %ecx
   11105:	e8 36 0b 00 00       	call   11c40 <_IoBuildDeviceIoControlRequest@36>
				      DeviceObject,
				      InputBuffer,
				      InputBufferSize,
				      OutputBuffer,
				      BufferSize,
				      FALSE,
				      Event,
				      &IoStatus);
  if (Irp == NULL)
   1110a:	83 c4 0c             	add    $0xc,%esp
   1110d:	85 c0                	test   %eax,%eax
   1110f:	74 4d                	je     1115e <_FsRecDeviceIoControl+0xae>
    {
      DPRINT("IoBuildDeviceIoControlRequest() failed\n");
      ExFreePool(Event);
      return(STATUS_INSUFFICIENT_RESOURCES);
    }

  DPRINT("Calling IO Driver... with irp %x\n", Irp);
  Status = IoCallDriver(DeviceObject, Irp);
   11111:	52                   	push   %edx
   11112:	52                   	push   %edx
   11113:	50                   	push   %eax
   11114:	8b 45 08             	mov    0x8(%ebp),%eax
   11117:	50                   	push   %eax
   11118:	e8 f3 0a 00 00       	call   11c10 <_IoCallDriver@8>
   1111d:	89 c3                	mov    %eax,%ebx
  if (Status == STATUS_PENDING)
   1111f:	59                   	pop    %ecx
   11120:	81 fb 03 01 00 00    	cmp    $0x103,%ebx
   11126:	58                   	pop    %eax
   11127:	74 1c                	je     11145 <_FsRecDeviceIoControl+0x95>
    {
      KeWaitForSingleObject(Event, Suspended, KernelMode, FALSE, NULL);
      Status = IoStatus.Status;
    }

  if (OutputBufferSize != NULL)
   11129:	85 ff                	test   %edi,%edi
   1112b:	74 05                	je     11132 <_FsRecDeviceIoControl+0x82>
    {
      *OutputBufferSize = IoStatus.Information;
   1112d:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   11130:	89 07                	mov    %eax,(%edi)
    }

  ExFreePool(Event);
   11132:	83 ec 0c             	sub    $0xc,%esp
   11135:	56                   	push   %esi
   11136:	e8 e5 0a 00 00       	call   11c20 <_ExFreePool@4>

  return(Status);
   1113b:	89 d8                	mov    %ebx,%eax
}
   1113d:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11140:	5b                   	pop    %ebx
   11141:	5e                   	pop    %esi
   11142:	5f                   	pop    %edi
   11143:	5d                   	pop    %ebp
   11144:	c3                   	ret    
   11145:	83 ec 0c             	sub    $0xc,%esp
   11148:	6a 00                	push   $0x0
   1114a:	6a 00                	push   $0x0
   1114c:	6a 00                	push   $0x0
   1114e:	6a 05                	push   $0x5
   11150:	56                   	push   %esi
   11151:	e8 da 0a 00 00       	call   11c30 <_KeWaitForSingleObject@20>
   11156:	8b 5d e8             	mov    0xffffffe8(%ebp),%ebx
   11159:	83 c4 0c             	add    $0xc,%esp
   1115c:	eb cb                	jmp    11129 <_FsRecDeviceIoControl+0x79>
   1115e:	83 ec 0c             	sub    $0xc,%esp
   11161:	56                   	push   %esi
   11162:	e8 b9 0a 00 00       	call   11c20 <_ExFreePool@4>
   11167:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   1116c:	eb cf                	jmp    1113d <_FsRecDeviceIoControl+0x8d>
   1116e:	90                   	nop    
   1116f:	90                   	nop    

00011170 <_FsRecCreate@8>:

NTSTATUS STDCALL
FsRecCreate(IN PDEVICE_OBJECT DeviceObject,
	    IN PIRP Irp)
{
   11170:	55                   	push   %ebp
   11171:	89 e5                	mov    %esp,%ebp
   11173:	83 ec 10             	sub    $0x10,%esp
   11176:	8b 45 0c             	mov    0xc(%ebp),%eax
  NTSTATUS Status;


  Status = STATUS_SUCCESS;


  Irp->IoStatus.Status = Status;
   11179:	c7 40 18 00 00 00 00 	movl   $0x0,0x18(%eax)
  IoCompleteRequest(Irp,
   11180:	6a 00                	push   $0x0
   11182:	50                   	push   %eax
   11183:	e8 c8 0a 00 00       	call   11c50 <_IoCompleteRequest@8>
		    IO_NO_INCREMENT);

  return(Status);
}
   11188:	31 c0                	xor    %eax,%eax
   1118a:	c9                   	leave  
   1118b:	c2 08 00             	ret    $0x8
   1118e:	89 f6                	mov    %esi,%esi

00011190 <_FsRecClose@8>:


NTSTATUS STDCALL
FsRecClose(IN PDEVICE_OBJECT DeviceObject,
	   IN PIRP Irp)
{
   11190:	55                   	push   %ebp
   11191:	89 e5                	mov    %esp,%ebp
   11193:	83 ec 10             	sub    $0x10,%esp
   11196:	8b 45 0c             	mov    0xc(%ebp),%eax
  Irp->IoStatus.Status = STATUS_SUCCESS;
   11199:	c7 40 18 00 00 00 00 	movl   $0x0,0x18(%eax)
  IoCompleteRequest(Irp,
   111a0:	6a 00                	push   $0x0
   111a2:	50                   	push   %eax
   111a3:	e8 a8 0a 00 00       	call   11c50 <_IoCompleteRequest@8>
		    IO_NO_INCREMENT);

  return(STATUS_SUCCESS);
}
   111a8:	31 c0                	xor    %eax,%eax
   111aa:	c9                   	leave  
   111ab:	c2 08 00             	ret    $0x8
   111ae:	89 f6                	mov    %esi,%esi

000111b0 <_FsRecFsControl@8>:


NTSTATUS STDCALL
FsRecFsControl(IN PDEVICE_OBJECT DeviceObject,
	       IN PIRP Irp)
{
   111b0:	55                   	push   %ebp
   111b1:	89 e5                	mov    %esp,%ebp
   111b3:	56                   	push   %esi
   111b4:	53                   	push   %ebx
   111b5:	8b 55 08             	mov    0x8(%ebp),%edx
   111b8:	8b 75 0c             	mov    0xc(%ebp),%esi
  PDEVICE_EXTENSION DeviceExt;
  NTSTATUS Status;

  DeviceExt = DeviceObject->DeviceExtension;
   111bb:	8b 42 28             	mov    0x28(%edx),%eax
  switch (DeviceExt->FsType)
   111be:	8b 00                	mov    (%eax),%eax
   111c0:	83 f8 02             	cmp    $0x2,%eax
   111c3:	74 6b                	je     11230 <_FsRecFsControl@8+0x80>
   111c5:	76 29                	jbe    111f0 <_FsRecFsControl@8+0x40>
   111c7:	83 f8 03             	cmp    $0x3,%eax
   111ca:	74 74                	je     11240 <_FsRecFsControl@8+0x90>
   111cc:	83 f8 04             	cmp    $0x4,%eax
   111cf:	74 48                	je     11219 <_FsRecFsControl@8+0x69>
    {
      case FS_TYPE_VFAT:
	Status = FsRecVfatFsControl(DeviceObject, Irp);
	break;

      case FS_TYPE_NTFS:
	Status = FsRecNtfsFsControl(DeviceObject, Irp);
	break;

      case FS_TYPE_CDFS:
	Status = FsRecCdfsFsControl(DeviceObject, Irp);
	break;

      case FS_TYPE_UDFS:
	Status = FsRecUdfsFsControl(DeviceObject, Irp);
	break;

      default:
	Status = STATUS_INVALID_DEVICE_REQUEST;
   111d1:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
    }

  Irp->IoStatus.Status = Status;
   111d6:	89 5e 18             	mov    %ebx,0x18(%esi)
  IoCompleteRequest(Irp,
   111d9:	50                   	push   %eax
   111da:	50                   	push   %eax
   111db:	6a 00                	push   $0x0
   111dd:	56                   	push   %esi
   111de:	e8 6d 0a 00 00       	call   11c50 <_IoCompleteRequest@8>
		    IO_NO_INCREMENT);

  return(Status);
}
   111e3:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   111e6:	89 d8                	mov    %ebx,%eax
   111e8:	5b                   	pop    %ebx
   111e9:	5e                   	pop    %esi
   111ea:	5d                   	pop    %ebp
   111eb:	c2 08 00             	ret    $0x8
   111ee:	89 f6                	mov    %esi,%esi
   111f0:	48                   	dec    %eax
   111f1:	75 de                	jne    111d1 <_FsRecFsControl@8+0x21>
   111f3:	50                   	push   %eax
   111f4:	50                   	push   %eax
   111f5:	56                   	push   %esi
   111f6:	52                   	push   %edx
   111f7:	e8 74 03 00 00       	call   11570 <_FsRecVfatFsControl>
   111fc:	83 c4 10             	add    $0x10,%esp
   111ff:	89 c3                	mov    %eax,%ebx
   11201:	89 5e 18             	mov    %ebx,0x18(%esi)
   11204:	50                   	push   %eax
   11205:	50                   	push   %eax
   11206:	6a 00                	push   $0x0
   11208:	56                   	push   %esi
   11209:	e8 42 0a 00 00       	call   11c50 <_IoCompleteRequest@8>
   1120e:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11211:	89 d8                	mov    %ebx,%eax
   11213:	5b                   	pop    %ebx
   11214:	5e                   	pop    %esi
   11215:	5d                   	pop    %ebp
   11216:	c2 08 00             	ret    $0x8
   11219:	51                   	push   %ecx
   1121a:	51                   	push   %ecx
   1121b:	56                   	push   %esi
   1121c:	52                   	push   %edx
   1121d:	e8 4e 07 00 00       	call   11970 <_FsRecUdfsFsControl>
   11222:	83 c4 10             	add    $0x10,%esp
   11225:	89 c3                	mov    %eax,%ebx
   11227:	eb d8                	jmp    11201 <_FsRecFsControl@8+0x51>
   11229:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   11230:	50                   	push   %eax
   11231:	50                   	push   %eax
   11232:	56                   	push   %esi
   11233:	52                   	push   %edx
   11234:	e8 17 06 00 00       	call   11850 <_FsRecNtfsFsControl>
   11239:	83 c4 10             	add    $0x10,%esp
   1123c:	89 c3                	mov    %eax,%ebx
   1123e:	eb c1                	jmp    11201 <_FsRecFsControl@8+0x51>
   11240:	53                   	push   %ebx
   11241:	53                   	push   %ebx
   11242:	56                   	push   %esi
   11243:	52                   	push   %edx
   11244:	e8 e7 01 00 00       	call   11430 <_FsRecCdfsFsControl>
   11249:	83 c4 10             	add    $0x10,%esp
   1124c:	89 c3                	mov    %eax,%ebx
   1124e:	eb b1                	jmp    11201 <_FsRecFsControl@8+0x51>

00011250 <_FsRecUnload@4>:


VOID STDCALL
FsRecUnload(IN PDRIVER_OBJECT DriverObject)
{
   11250:	55                   	push   %ebp
   11251:	89 e5                	mov    %esp,%ebp
   11253:	53                   	push   %ebx
   11254:	50                   	push   %eax
  PDEVICE_OBJECT NextDevice;
  PDEVICE_OBJECT ThisDevice;

  /* Delete all remaining device objects */
  NextDevice = DriverObject->DeviceObject;
   11255:	8b 45 08             	mov    0x8(%ebp),%eax
   11258:	8b 58 04             	mov    0x4(%eax),%ebx
   1125b:	eb 14                	jmp    11271 <_FsRecUnload@4+0x21>
   1125d:	8d 76 00             	lea    0x0(%esi),%esi
  while (NextDevice != NULL)
    {
      ThisDevice = NextDevice;
      NextDevice = NextDevice->NextDevice;
      IoDeleteDevice(ThisDevice);
   11260:	83 ec 0c             	sub    $0xc,%esp
   11263:	89 d8                	mov    %ebx,%eax
   11265:	8b 5b 0c             	mov    0xc(%ebx),%ebx
   11268:	50                   	push   %eax
   11269:	e8 f2 09 00 00       	call   11c60 <_IoDeleteDevice@4>
   1126e:	83 c4 0c             	add    $0xc,%esp
   11271:	85 db                	test   %ebx,%ebx
   11273:	75 eb                	jne    11260 <_FsRecUnload@4+0x10>
   11275:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
   11278:	c9                   	leave  
   11279:	c2 04 00             	ret    $0x4
   1127c:	8d 74 26 00          	lea    0x0(%esi),%esi

00011280 <_FsRecRegisterFs>:
    }
}


static NTSTATUS
FsRecRegisterFs(PDRIVER_OBJECT DriverObject,
		PWSTR FsName,
		PWSTR RecognizerName,
		ULONG DeviceType,
		ULONG FsType)
{
   11280:	55                   	push   %ebp
   11281:	89 e5                	mov    %esp,%ebp
   11283:	56                   	push   %esi
   11284:	53                   	push   %ebx
   11285:	89 c6                	mov    %eax,%esi
   11287:	83 ec 58             	sub    $0x58,%esp
  OBJECT_ATTRIBUTES ObjectAttributes;
  IO_STATUS_BLOCK IoStatus;
  PDEVICE_EXTENSION DeviceExt;
  UNICODE_STRING DeviceName;
  UNICODE_STRING FileName;
  PDEVICE_OBJECT DeviceObject;
  HANDLE FileHandle;
  NTSTATUS Status;

  RtlInitUnicodeString(&FileName,
   1128a:	8d 5d d0             	lea    0xffffffd0(%ebp),%ebx
   1128d:	52                   	push   %edx
   1128e:	53                   	push   %ebx
   1128f:	e8 dc 09 00 00       	call   11c70 <_RtlInitUnicodeString@8>
		       FsName);

  InitializeObjectAttributes(&ObjectAttributes,
			     &FileName,
			     OBJ_CASE_INSENSITIVE,
			     0,
			     NULL);

  Status = ZwCreateFile(&FileHandle,
   11294:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   11297:	89 5d e0             	mov    %ebx,0xffffffe0(%ebp)
   1129a:	c7 45 d8 18 00 00 00 	movl   $0x18,0xffffffd8(%ebp)
   112a1:	c7 45 e4 40 00 00 00 	movl   $0x40,0xffffffe4(%ebp)
   112a8:	c7 45 dc 00 00 00 00 	movl   $0x0,0xffffffdc(%ebp)
   112af:	c7 45 e8 00 00 00 00 	movl   $0x0,0xffffffe8(%ebp)
   112b6:	c7 45 ec 00 00 00 00 	movl   $0x0,0xffffffec(%ebp)
   112bd:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
   112c4:	6a 00                	push   $0x0
   112c6:	6a 00                	push   $0x0
   112c8:	6a 03                	push   $0x3
   112ca:	6a 03                	push   $0x3
   112cc:	6a 00                	push   $0x0
   112ce:	6a 00                	push   $0x0
   112d0:	50                   	push   %eax
   112d1:	8d 45 d8             	lea    0xffffffd8(%ebp),%eax
   112d4:	50                   	push   %eax
   112d5:	8d 45 c4             	lea    0xffffffc4(%ebp),%eax
   112d8:	68 00 00 10 00       	push   $0x100000
   112dd:	50                   	push   %eax
   112de:	e8 9d 09 00 00       	call   11c80 <_ZwCreateFile@44>
   112e3:	89 c3                	mov    %eax,%ebx
			0x100000,
			&ObjectAttributes,
			&IoStatus,
			NULL,
			0,
			FILE_SHARE_READ | FILE_SHARE_WRITE,
			OPEN_EXISTING,
			0,
			NULL,
			0);
  if (NT_SUCCESS(Status))
   112e5:	58                   	pop    %eax
   112e6:	85 db                	test   %ebx,%ebx
   112e8:	79 4d                	jns    11337 <_FsRecRegisterFs+0xb7>
    {
      ZwClose(FileHandle);
      return(STATUS_IMAGE_ALREADY_LOADED);
    }

  /* Create recognizer device object */
  RtlInitUnicodeString(&DeviceName,
   112ea:	52                   	push   %edx
   112eb:	52                   	push   %edx
   112ec:	8d 5d b8             	lea    0xffffffb8(%ebp),%ebx
   112ef:	8b 45 08             	mov    0x8(%ebp),%eax
   112f2:	50                   	push   %eax
   112f3:	53                   	push   %ebx
   112f4:	e8 77 09 00 00       	call   11c70 <_RtlInitUnicodeString@8>
		       RecognizerName);

  Status = IoCreateDevice(DriverObject,
   112f9:	8d 45 b4             	lea    0xffffffb4(%ebp),%eax
   112fc:	89 04 24             	mov    %eax,(%esp)
   112ff:	6a 00                	push   $0x0
   11301:	6a 00                	push   $0x0
   11303:	8b 45 0c             	mov    0xc(%ebp),%eax
   11306:	50                   	push   %eax
   11307:	53                   	push   %ebx
   11308:	6a 04                	push   $0x4
   1130a:	56                   	push   %esi
   1130b:	e8 80 09 00 00       	call   11c90 <_IoCreateDevice@28>
   11310:	89 c3                	mov    %eax,%ebx
			  sizeof(DEVICE_EXTENSION),
			  &DeviceName,
			  DeviceType,
			  0,
			  FALSE,
			  &DeviceObject);

  if (NT_SUCCESS(Status))
   11312:	58                   	pop    %eax
   11313:	85 db                	test   %ebx,%ebx
   11315:	78 17                	js     1132e <_FsRecRegisterFs+0xae>
    {
      DeviceExt = DeviceObject->DeviceExtension;
   11317:	8b 4d b4             	mov    0xffffffb4(%ebp),%ecx
      DeviceExt->FsType = FsType;
   1131a:	8b 45 10             	mov    0x10(%ebp),%eax
      IoRegisterFileSystem(DeviceObject);
   1131d:	83 ec 0c             	sub    $0xc,%esp
   11320:	8b 51 28             	mov    0x28(%ecx),%edx
   11323:	89 02                	mov    %eax,(%edx)
   11325:	51                   	push   %ecx
   11326:	e8 75 09 00 00       	call   11ca0 <_IoRegisterFileSystem@4>
   1132b:	83 c4 0c             	add    $0xc,%esp
      DPRINT("Created recognizer device '%wZ'\n", &DeviceName);
    }

  return(Status);
}
   1132e:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11331:	89 d8                	mov    %ebx,%eax
   11333:	5b                   	pop    %ebx
   11334:	5e                   	pop    %esi
   11335:	5d                   	pop    %ebp
   11336:	c3                   	ret    
   11337:	83 ec 0c             	sub    $0xc,%esp
   1133a:	8b 4d c4             	mov    0xffffffc4(%ebp),%ecx
   1133d:	51                   	push   %ecx
   1133e:	e8 6d 09 00 00       	call   11cb0 <_ZwClose@4>
   11343:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   11346:	b8 0e 01 00 c0       	mov    $0xc000010e,%eax
   1134b:	5b                   	pop    %ebx
   1134c:	5e                   	pop    %esi
   1134d:	5d                   	pop    %ebp
   1134e:	c3                   	ret    
   1134f:	90                   	nop    

00011350 <_DriverEntry@8>:


NTSTATUS STDCALL
DriverEntry(PDRIVER_OBJECT DriverObject,
	    PUNICODE_STRING RegistryPath)
{
   11350:	55                   	push   %ebp
   11351:	89 e5                	mov    %esp,%ebp
   11353:	56                   	push   %esi
   11354:	53                   	push   %ebx
  PCONFIGURATION_INFORMATION ConfigInfo;
  ULONG DeviceCount;
  NTSTATUS Status;

  DPRINT("FileSystem recognizer 0.0.2\n");

  DeviceCount = 0;
   11355:	31 f6                	xor    %esi,%esi
   11357:	8b 5d 08             	mov    0x8(%ebp),%ebx

  DriverObject->MajorFunction[IRP_MJ_CREATE] = FsRecCreate;
   1135a:	c7 43 38 70 11 01 00 	movl   $0x11170,0x38(%ebx)
  DriverObject->MajorFunction[IRP_MJ_CLOSE] = FsRecClose;
   11361:	c7 43 40 90 11 01 00 	movl   $0x11190,0x40(%ebx)
  DriverObject->MajorFunction[IRP_MJ_CLEANUP] = FsRecClose;
   11368:	c7 83 80 00 00 00 90 	movl   $0x11190,0x80(%ebx)
   1136f:	11 01 00 
  DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = FsRecFsControl;
   11372:	c7 43 6c b0 11 01 00 	movl   $0x111b0,0x6c(%ebx)
  DriverObject->DriverUnload = FsRecUnload;
   11379:	c7 43 34 50 12 01 00 	movl   $0x11250,0x34(%ebx)

  ConfigInfo = IoGetConfigurationInformation();
   11380:	e8 3b 09 00 00       	call   11cc0 <_IoGetConfigurationInformation@0>

  if (ConfigInfo->CdRomCount > 0)
   11385:	8b 40 08             	mov    0x8(%eax),%eax
   11388:	85 c0                	test   %eax,%eax
   1138a:	75 54                	jne    113e0 <_DriverEntry@8+0x90>
    {
      Status = FsRecRegisterFs(DriverObject,
			       L"\\Cdfs",
			       L"\\FileSystem\\CdfsRecognizer",
			       FILE_DEVICE_CD_ROM_FILE_SYSTEM,
			       FS_TYPE_CDFS);
      if (NT_SUCCESS(Status))
	{
	  DeviceCount++;
	}

      Status = FsRecRegisterFs(DriverObject,
			       L"\\Udfs",
			       L"\\FileSystem\\UdfsRecognizer",
			       FILE_DEVICE_CD_ROM_FILE_SYSTEM,
			       FS_TYPE_UDFS);
      if (NT_SUCCESS(Status))
	{
	  DeviceCount++;
	}
    }

  Status = FsRecRegisterFs(DriverObject,
   1138c:	ba 00 20 01 00       	mov    $0x12000,%edx
   11391:	50                   	push   %eax
   11392:	89 d8                	mov    %ebx,%eax
   11394:	6a 01                	push   $0x1
   11396:	6a 08                	push   $0x8
   11398:	68 0c 20 01 00       	push   $0x1200c
   1139d:	e8 de fe ff ff       	call   11280 <_FsRecRegisterFs>
			   L"\\Fat",
			   L"\\FileSystem\\FatRecognizer",
			   FILE_DEVICE_DISK_FILE_SYSTEM,
			   FS_TYPE_VFAT);
  if (NT_SUCCESS(Status))
   113a2:	83 c4 0c             	add    $0xc,%esp
    {
      DeviceCount++;
    }

  Status = FsRecRegisterFs(DriverObject,
   113a5:	ba 40 20 01 00       	mov    $0x12040,%edx
   113aa:	3d 00 00 00 80       	cmp    $0x80000000,%eax
   113af:	89 d8                	mov    %ebx,%eax
   113b1:	83 d6 00             	adc    $0x0,%esi
   113b4:	6a 02                	push   $0x2
   113b6:	6a 08                	push   $0x8
   113b8:	68 4c 20 01 00       	push   $0x1204c
   113bd:	e8 be fe ff ff       	call   11280 <_FsRecRegisterFs>
			   L"\\Ntfs",
			   L"\\FileSystem\\NtfsRecognizer",
			   FILE_DEVICE_DISK_FILE_SYSTEM,
			   FS_TYPE_NTFS);
  if (NT_SUCCESS(Status))
   113c2:	83 c4 10             	add    $0x10,%esp
    {
      DeviceCount++;
   113c5:	3d 00 00 00 80       	cmp    $0x80000000,%eax
   113ca:	83 d6 00             	adc    $0x0,%esi
    }

  return((DeviceCount > 0) ? STATUS_SUCCESS : STATUS_UNSUCCESSFUL);
   113cd:	83 fe 01             	cmp    $0x1,%esi
   113d0:	19 c0                	sbb    %eax,%eax
}
   113d2:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   113d5:	25 01 00 00 c0       	and    $0xc0000001,%eax
   113da:	5b                   	pop    %ebx
   113db:	5e                   	pop    %esi
   113dc:	5d                   	pop    %ebp
   113dd:	c2 08 00             	ret    $0x8
   113e0:	ba 82 20 01 00       	mov    $0x12082,%edx
   113e5:	50                   	push   %eax
   113e6:	89 d8                	mov    %ebx,%eax
   113e8:	6a 03                	push   $0x3
   113ea:	6a 03                	push   $0x3
   113ec:	68 90 20 01 00       	push   $0x12090
   113f1:	e8 8a fe ff ff       	call   11280 <_FsRecRegisterFs>
   113f6:	83 c4 10             	add    $0x10,%esp
   113f9:	85 c0                	test   %eax,%eax
   113fb:	78 04                	js     11401 <_DriverEntry@8+0xb1>
   113fd:	66 be 01 00          	mov    $0x1,%si
   11401:	ba c6 20 01 00       	mov    $0x120c6,%edx
   11406:	50                   	push   %eax
   11407:	89 d8                	mov    %ebx,%eax
   11409:	6a 04                	push   $0x4
   1140b:	6a 03                	push   $0x3
   1140d:	68 d4 20 01 00       	push   $0x120d4
   11412:	e8 69 fe ff ff       	call   11280 <_FsRecRegisterFs>
   11417:	83 c4 10             	add    $0x10,%esp
   1141a:	3d 00 00 00 80       	cmp    $0x80000000,%eax
   1141f:	83 d6 00             	adc    $0x0,%esi
   11422:	e9 65 ff ff ff       	jmp    1138c <_DriverEntry@8+0x3c>
   11427:	90                   	nop    
   11428:	90                   	nop    
   11429:	90                   	nop    
   1142a:	90                   	nop    
   1142b:	90                   	nop    
   1142c:	90                   	nop    
   1142d:	90                   	nop    
   1142e:	90                   	nop    
   1142f:	90                   	nop    

00011430 <_FsRecCdfsFsControl>:
   11430:	55                   	push   %ebp
   11431:	89 e5                	mov    %esp,%ebp
   11433:	57                   	push   %edi
   11434:	56                   	push   %esi
   11435:	53                   	push   %ebx
   11436:	83 ec 3c             	sub    $0x3c,%esp
   11439:	8b 45 0c             	mov    0xc(%ebp),%eax
   1143c:	8b 50 60             	mov    0x60(%eax),%edx
   1143f:	31 c0                	xor    %eax,%eax
   11441:	8a 42 01             	mov    0x1(%edx),%al
   11444:	83 f8 01             	cmp    $0x1,%eax
   11447:	74 18                	je     11461 <_FsRecCdfsFsControl+0x31>
   11449:	83 f8 03             	cmp    $0x3,%eax
   1144c:	0f 84 a3 00 00 00    	je     114f5 <_FsRecCdfsFsControl+0xc5>
   11452:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   11457:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1145a:	89 d8                	mov    %ebx,%eax
   1145c:	5b                   	pop    %ebx
   1145d:	5e                   	pop    %esi
   1145e:	5f                   	pop    %edi
   1145f:	5d                   	pop    %ebp
   11460:	c3                   	ret    
   11461:	8b 7a 08             	mov    0x8(%edx),%edi
   11464:	c7 45 c4 18 00 00 00 	movl   $0x18,0xffffffc4(%ebp)
   1146b:	50                   	push   %eax
   1146c:	50                   	push   %eax
   1146d:	8d 45 c4             	lea    0xffffffc4(%ebp),%eax
   11470:	50                   	push   %eax
   11471:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   11474:	50                   	push   %eax
   11475:	6a 00                	push   $0x0
   11477:	6a 00                	push   $0x0
   11479:	68 4c 40 02 00       	push   $0x2404c
   1147e:	57                   	push   %edi
   1147f:	e8 2c fc ff ff       	call   110b0 <_FsRecDeviceIoControl>
   11484:	83 c4 20             	add    $0x20,%esp
   11487:	85 c0                	test   %eax,%eax
   11489:	78 51                	js     114dc <_FsRecCdfsFsControl+0xac>
   1148b:	50                   	push   %eax
   1148c:	50                   	push   %eax
   1148d:	8b 75 dc             	mov    0xffffffdc(%ebp),%esi
   11490:	56                   	push   %esi
   11491:	6a 00                	push   $0x0
   11493:	e8 48 07 00 00       	call   11be0 <_ExAllocatePool@8>
   11498:	89 c6                	mov    %eax,%esi
   1149a:	59                   	pop    %ecx
   1149b:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   114a0:	5b                   	pop    %ebx
   114a1:	85 f6                	test   %esi,%esi
   114a3:	74 37                	je     114dc <_FsRecCdfsFsControl+0xac>
   114a5:	83 ec 0c             	sub    $0xc,%esp
   114a8:	56                   	push   %esi
   114a9:	8b 55 dc             	mov    0xffffffdc(%ebp),%edx
   114ac:	52                   	push   %edx
   114ad:	6a 01                	push   $0x1
   114af:	6a 10                	push   $0x10
   114b1:	57                   	push   %edi
   114b2:	e8 49 fb ff ff       	call   11000 <_FsRecReadSectors>
   114b7:	83 c4 20             	add    $0x20,%esp
   114ba:	89 c3                	mov    %eax,%ebx
   114bc:	85 c0                	test   %eax,%eax
   114be:	78 0e                	js     114ce <_FsRecCdfsFsControl+0x9e>
   114c0:	c6 46 06 00          	movb   $0x0,0x6(%esi)
   114c4:	80 3e 01             	cmpb   $0x1,(%esi)
   114c7:	74 6c                	je     11535 <_FsRecCdfsFsControl+0x105>
   114c9:	bb 4f 01 00 c0       	mov    $0xc000014f,%ebx
   114ce:	83 ec 0c             	sub    $0xc,%esp
   114d1:	56                   	push   %esi
   114d2:	e8 49 07 00 00       	call   11c20 <_ExFreePool@4>
   114d7:	89 d8                	mov    %ebx,%eax
   114d9:	83 c4 0c             	add    $0xc,%esp
   114dc:	89 c3                	mov    %eax,%ebx
   114de:	85 c0                	test   %eax,%eax
   114e0:	0f 88 71 ff ff ff    	js     11457 <_FsRecCdfsFsControl+0x27>
   114e6:	bb 9c 01 00 c0       	mov    $0xc000019c,%ebx
   114eb:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   114ee:	89 d8                	mov    %ebx,%eax
   114f0:	5b                   	pop    %ebx
   114f1:	5e                   	pop    %esi
   114f2:	5f                   	pop    %edi
   114f3:	5d                   	pop    %ebp
   114f4:	c3                   	ret    
   114f5:	83 ec 0c             	sub    $0xc,%esp
   114f8:	66 c7 45 b8 70 00    	movw   $0x70,0xffffffb8(%ebp)
   114fe:	66 c7 45 ba 72 00    	movw   $0x72,0xffffffba(%ebp)
   11504:	c7 45 bc 10 21 01 00 	movl   $0x12110,0xffffffbc(%ebp)
   1150b:	8d 45 b8             	lea    0xffffffb8(%ebp),%eax
   1150e:	50                   	push   %eax
   1150f:	e8 bc 07 00 00       	call   11cd0 <_ZwLoadDriver@4>
   11514:	83 c4 0c             	add    $0xc,%esp
   11517:	89 c3                	mov    %eax,%ebx
   11519:	85 c0                	test   %eax,%eax
   1151b:	0f 88 36 ff ff ff    	js     11457 <_FsRecCdfsFsControl+0x27>
   11521:	83 ec 0c             	sub    $0xc,%esp
   11524:	8b 45 08             	mov    0x8(%ebp),%eax
   11527:	50                   	push   %eax
   11528:	e8 b3 07 00 00       	call   11ce0 <_IoUnregisterFileSystem@4>
   1152d:	83 c4 0c             	add    $0xc,%esp
   11530:	e9 22 ff ff ff       	jmp    11457 <_FsRecCdfsFsControl+0x27>
   11535:	80 7e 01 43          	cmpb   $0x43,0x1(%esi)
   11539:	75 8e                	jne    114c9 <_FsRecCdfsFsControl+0x99>
   1153b:	80 7e 02 44          	cmpb   $0x44,0x2(%esi)
   1153f:	75 88                	jne    114c9 <_FsRecCdfsFsControl+0x99>
   11541:	80 7e 03 30          	cmpb   $0x30,0x3(%esi)
   11545:	75 82                	jne    114c9 <_FsRecCdfsFsControl+0x99>
   11547:	80 7e 04 30          	cmpb   $0x30,0x4(%esi)
   1154b:	0f 85 78 ff ff ff    	jne    114c9 <_FsRecCdfsFsControl+0x99>
   11551:	31 db                	xor    %ebx,%ebx
   11553:	80 7e 05 31          	cmpb   $0x31,0x5(%esi)
   11557:	0f 85 6c ff ff ff    	jne    114c9 <_FsRecCdfsFsControl+0x99>
   1155d:	e9 6c ff ff ff       	jmp    114ce <_FsRecCdfsFsControl+0x9e>
   11562:	90                   	nop    
   11563:	90                   	nop    
   11564:	90                   	nop    
   11565:	90                   	nop    
   11566:	90                   	nop    
   11567:	90                   	nop    
   11568:	90                   	nop    
   11569:	90                   	nop    
   1156a:	90                   	nop    
   1156b:	90                   	nop    
   1156c:	90                   	nop    
   1156d:	90                   	nop    
   1156e:	90                   	nop    
   1156f:	90                   	nop    

00011570 <_FsRecVfatFsControl>:
   11570:	55                   	push   %ebp
   11571:	89 e5                	mov    %esp,%ebp
   11573:	57                   	push   %edi
   11574:	56                   	push   %esi
   11575:	53                   	push   %ebx
   11576:	83 ec 5c             	sub    $0x5c,%esp
   11579:	8b 45 0c             	mov    0xc(%ebp),%eax
   1157c:	8b 50 60             	mov    0x60(%eax),%edx
   1157f:	31 c0                	xor    %eax,%eax
   11581:	8a 42 01             	mov    0x1(%edx),%al
   11584:	83 f8 01             	cmp    $0x1,%eax
   11587:	74 18                	je     115a1 <_FsRecVfatFsControl+0x31>
   11589:	83 f8 03             	cmp    $0x3,%eax
   1158c:	0f 84 ce 00 00 00    	je     11660 <_FsRecVfatFsControl+0xf0>
   11592:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   11597:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1159a:	89 d8                	mov    %ebx,%eax
   1159c:	5b                   	pop    %ebx
   1159d:	5e                   	pop    %esi
   1159e:	5f                   	pop    %edi
   1159f:	5d                   	pop    %ebp
   115a0:	c3                   	ret    
   115a1:	8b 72 08             	mov    0x8(%edx),%esi
   115a4:	c7 45 a4 18 00 00 00 	movl   $0x18,0xffffffa4(%ebp)
   115ab:	8d 5d a4             	lea    0xffffffa4(%ebp),%ebx
   115ae:	50                   	push   %eax
   115af:	50                   	push   %eax
   115b0:	8d 45 a8             	lea    0xffffffa8(%ebp),%eax
   115b3:	53                   	push   %ebx
   115b4:	50                   	push   %eax
   115b5:	6a 00                	push   $0x0
   115b7:	6a 00                	push   $0x0
   115b9:	68 00 00 07 00       	push   $0x70000
   115be:	56                   	push   %esi
   115bf:	e8 ec fa ff ff       	call   110b0 <_FsRecDeviceIoControl>
   115c4:	31 ff                	xor    %edi,%edi
   115c6:	83 c4 20             	add    $0x20,%esp
   115c9:	85 c0                	test   %eax,%eax
   115cb:	78 7a                	js     11647 <_FsRecVfatFsControl+0xd7>
   115cd:	8b 4d b0             	mov    0xffffffb0(%ebp),%ecx
   115d0:	8d 41 f5             	lea    0xfffffff5(%ecx),%eax
   115d3:	83 f8 01             	cmp    $0x1,%eax
   115d6:	0f 86 b4 01 00 00    	jbe    11790 <_FsRecVfatFsControl+0x220>
   115dc:	8d 41 ff             	lea    0xffffffff(%ecx),%eax
   115df:	83 f8 09             	cmp    $0x9,%eax
   115e2:	0f 87 b8 00 00 00    	ja     116a0 <_FsRecVfatFsControl+0x130>
   115e8:	bf 01 00 00 00       	mov    $0x1,%edi
   115ed:	50                   	push   %eax
   115ee:	50                   	push   %eax
   115ef:	8b 45 bc             	mov    0xffffffbc(%ebp),%eax
   115f2:	50                   	push   %eax
   115f3:	6a 00                	push   $0x0
   115f5:	e8 e6 05 00 00       	call   11be0 <_ExAllocatePool@8>
   115fa:	59                   	pop    %ecx
   115fb:	5b                   	pop    %ebx
   115fc:	89 c3                	mov    %eax,%ebx
   115fe:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11603:	85 db                	test   %ebx,%ebx
   11605:	74 40                	je     11647 <_FsRecVfatFsControl+0xd7>
   11607:	83 ec 0c             	sub    $0xc,%esp
   1160a:	53                   	push   %ebx
   1160b:	8b 55 bc             	mov    0xffffffbc(%ebp),%edx
   1160e:	52                   	push   %edx
   1160f:	6a 01                	push   $0x1
   11611:	6a 00                	push   $0x0
   11613:	56                   	push   %esi
   11614:	e8 e7 f9 ff ff       	call   11000 <_FsRecReadSectors>
   11619:	83 c4 20             	add    $0x20,%esp
   1161c:	85 c0                	test   %eax,%eax
   1161e:	78 27                	js     11647 <_FsRecVfatFsControl+0xd7>
   11620:	66 81 bb fe 01 00 00 	cmpw   $0xaa55,0x1fe(%ebx)
   11627:	55 aa 
   11629:	0f 84 7f 00 00 00    	je     116ae <_FsRecVfatFsControl+0x13e>
   1162f:	31 ff                	xor    %edi,%edi
   11631:	83 ec 0c             	sub    $0xc,%esp
   11634:	53                   	push   %ebx
   11635:	e8 e6 05 00 00       	call   11c20 <_ExFreePool@4>
   1163a:	83 c4 0c             	add    $0xc,%esp
   1163d:	83 ff 01             	cmp    $0x1,%edi
   11640:	19 c0                	sbb    %eax,%eax
   11642:	25 4f 01 00 c0       	and    $0xc000014f,%eax
   11647:	89 c3                	mov    %eax,%ebx
   11649:	85 c0                	test   %eax,%eax
   1164b:	0f 88 46 ff ff ff    	js     11597 <_FsRecVfatFsControl+0x27>
   11651:	bb 9c 01 00 c0       	mov    $0xc000019c,%ebx
   11656:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11659:	89 d8                	mov    %ebx,%eax
   1165b:	5b                   	pop    %ebx
   1165c:	5e                   	pop    %esi
   1165d:	5f                   	pop    %edi
   1165e:	5d                   	pop    %ebp
   1165f:	c3                   	ret    
   11660:	83 ec 0c             	sub    $0xc,%esp
   11663:	66 c7 45 98 74 00    	movw   $0x74,0xffffff98(%ebp)
   11669:	66 c7 45 9a 76 00    	movw   $0x76,0xffffff9a(%ebp)
   1166f:	c7 45 9c 90 21 01 00 	movl   $0x12190,0xffffff9c(%ebp)
   11676:	8d 45 98             	lea    0xffffff98(%ebp),%eax
   11679:	50                   	push   %eax
   1167a:	e8 51 06 00 00       	call   11cd0 <_ZwLoadDriver@4>
   1167f:	83 c4 0c             	add    $0xc,%esp
   11682:	89 c3                	mov    %eax,%ebx
   11684:	85 c0                	test   %eax,%eax
   11686:	0f 88 0b ff ff ff    	js     11597 <_FsRecVfatFsControl+0x27>
   1168c:	83 ec 0c             	sub    $0xc,%esp
   1168f:	8b 45 08             	mov    0x8(%ebp),%eax
   11692:	50                   	push   %eax
   11693:	e8 48 06 00 00       	call   11ce0 <_IoUnregisterFileSystem@4>
   11698:	83 c4 0c             	add    $0xc,%esp
   1169b:	e9 f7 fe ff ff       	jmp    11597 <_FsRecVfatFsControl+0x27>
   116a0:	b8 4f 01 00 c0       	mov    $0xc000014f,%eax
   116a5:	85 ff                	test   %edi,%edi
   116a7:	74 9e                	je     11647 <_FsRecVfatFsControl+0xd7>
   116a9:	e9 3f ff ff ff       	jmp    115ed <_FsRecVfatFsControl+0x7d>
   116ae:	85 ff                	test   %edi,%edi
   116b0:	0f 84 7b ff ff ff    	je     11631 <_FsRecVfatFsControl+0xc1>
   116b6:	66 8b 43 0b          	mov    0xb(%ebx),%ax
   116ba:	66 3d 00 02          	cmp    $0x200,%ax
   116be:	74 16                	je     116d6 <_FsRecVfatFsControl+0x166>
   116c0:	66 3d 00 04          	cmp    $0x400,%ax
   116c4:	74 10                	je     116d6 <_FsRecVfatFsControl+0x166>
   116c6:	66 3d 00 08          	cmp    $0x800,%ax
   116ca:	74 0a                	je     116d6 <_FsRecVfatFsControl+0x166>
   116cc:	66 3d 00 10          	cmp    $0x1000,%ax
   116d0:	0f 84 59 ff ff ff    	je     1162f <_FsRecVfatFsControl+0xbf>
   116d6:	85 ff                	test   %edi,%edi
   116d8:	0f 84 53 ff ff ff    	je     11631 <_FsRecVfatFsControl+0xc1>
   116de:	8a 53 10             	mov    0x10(%ebx),%dl
   116e1:	80 fa 01             	cmp    $0x1,%dl
   116e4:	74 09                	je     116ef <_FsRecVfatFsControl+0x17f>
   116e6:	80 fa 02             	cmp    $0x2,%dl
   116e9:	0f 85 40 ff ff ff    	jne    1162f <_FsRecVfatFsControl+0xbf>
   116ef:	85 ff                	test   %edi,%edi
   116f1:	0f 84 3a ff ff ff    	je     11631 <_FsRecVfatFsControl+0xc1>
   116f7:	8a 53 15             	mov    0x15(%ebx),%dl
   116fa:	80 fa f0             	cmp    $0xf0,%dl
   116fd:	74 2b                	je     1172a <_FsRecVfatFsControl+0x1ba>
   116ff:	80 fa f8             	cmp    $0xf8,%dl
   11702:	74 26                	je     1172a <_FsRecVfatFsControl+0x1ba>
   11704:	80 fa f9             	cmp    $0xf9,%dl
   11707:	74 21                	je     1172a <_FsRecVfatFsControl+0x1ba>
   11709:	80 fa fa             	cmp    $0xfa,%dl
   1170c:	74 1c                	je     1172a <_FsRecVfatFsControl+0x1ba>
   1170e:	80 fa fb             	cmp    $0xfb,%dl
   11711:	74 17                	je     1172a <_FsRecVfatFsControl+0x1ba>
   11713:	80 fa fc             	cmp    $0xfc,%dl
   11716:	74 12                	je     1172a <_FsRecVfatFsControl+0x1ba>
   11718:	80 fa fd             	cmp    $0xfd,%dl
   1171b:	74 0d                	je     1172a <_FsRecVfatFsControl+0x1ba>
   1171d:	80 fa fe             	cmp    $0xfe,%dl
   11720:	74 08                	je     1172a <_FsRecVfatFsControl+0x1ba>
   11722:	fe c2                	inc    %dl
   11724:	0f 85 05 ff ff ff    	jne    1162f <_FsRecVfatFsControl+0xbf>
   1172a:	85 ff                	test   %edi,%edi
   1172c:	0f 84 ff fe ff ff    	je     11631 <_FsRecVfatFsControl+0xc1>
   11732:	8a 53 0d             	mov    0xd(%ebx),%dl
   11735:	80 fa 01             	cmp    $0x1,%dl
   11738:	74 27                	je     11761 <_FsRecVfatFsControl+0x1f1>
   1173a:	80 fa 02             	cmp    $0x2,%dl
   1173d:	74 22                	je     11761 <_FsRecVfatFsControl+0x1f1>
   1173f:	80 fa 04             	cmp    $0x4,%dl
   11742:	74 1d                	je     11761 <_FsRecVfatFsControl+0x1f1>
   11744:	80 fa 08             	cmp    $0x8,%dl
   11747:	74 18                	je     11761 <_FsRecVfatFsControl+0x1f1>
   11749:	80 fa 10             	cmp    $0x10,%dl
   1174c:	74 13                	je     11761 <_FsRecVfatFsControl+0x1f1>
   1174e:	80 fa 20             	cmp    $0x20,%dl
   11751:	74 0e                	je     11761 <_FsRecVfatFsControl+0x1f1>
   11753:	80 fa 40             	cmp    $0x40,%dl
   11756:	74 09                	je     11761 <_FsRecVfatFsControl+0x1f1>
   11758:	80 fa 80             	cmp    $0x80,%dl
   1175b:	0f 85 ce fe ff ff    	jne    1162f <_FsRecVfatFsControl+0xbf>
   11761:	85 ff                	test   %edi,%edi
   11763:	0f 84 c8 fe ff ff    	je     11631 <_FsRecVfatFsControl+0xc1>
   11769:	25 ff ff 00 00       	and    $0xffff,%eax
   1176e:	81 e2 ff 00 00 00    	and    $0xff,%edx
   11774:	0f af c2             	imul   %edx,%eax
   11777:	3d 01 80 00 00       	cmp    $0x8001,%eax
   1177c:	0f 9c c0             	setl   %al
   1177f:	25 ff 00 00 00       	and    $0xff,%eax
   11784:	f7 d8                	neg    %eax
   11786:	21 c7                	and    %eax,%edi
   11788:	e9 a4 fe ff ff       	jmp    11631 <_FsRecVfatFsControl+0xc1>
   1178d:	8d 76 00             	lea    0x0(%esi),%esi
   11790:	c7 45 a4 20 00 00 00 	movl   $0x20,0xffffffa4(%ebp)
   11797:	50                   	push   %eax
   11798:	50                   	push   %eax
   11799:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   1179c:	53                   	push   %ebx
   1179d:	50                   	push   %eax
   1179e:	6a 00                	push   $0x0
   117a0:	6a 00                	push   $0x0
   117a2:	68 04 40 07 00       	push   $0x74004
   117a7:	56                   	push   %esi
   117a8:	e8 03 f9 ff ff       	call   110b0 <_FsRecDeviceIoControl>
   117ad:	83 c4 20             	add    $0x20,%esp
   117b0:	85 c0                	test   %eax,%eax
   117b2:	0f 88 8f fe ff ff    	js     11647 <_FsRecVfatFsControl+0xd7>
   117b8:	8a 4d e0             	mov    0xffffffe0(%ebp),%cl
   117bb:	84 c9                	test   %cl,%cl
   117bd:	74 3b                	je     117fa <_FsRecVfatFsControl+0x28a>
   117bf:	80 f9 01             	cmp    $0x1,%cl
   117c2:	0f 94 c2             	sete   %dl
   117c5:	80 f9 04             	cmp    $0x4,%cl
   117c8:	0f 94 c0             	sete   %al
   117cb:	09 d0                	or     %edx,%eax
   117cd:	a8 01                	test   $0x1,%al
   117cf:	75 1c                	jne    117ed <_FsRecVfatFsControl+0x27d>
   117d1:	80 f9 06             	cmp    $0x6,%cl
   117d4:	74 17                	je     117ed <_FsRecVfatFsControl+0x27d>
   117d6:	80 f9 0b             	cmp    $0xb,%cl
   117d9:	74 12                	je     117ed <_FsRecVfatFsControl+0x27d>
   117db:	80 f9 0c             	cmp    $0xc,%cl
   117de:	74 0d                	je     117ed <_FsRecVfatFsControl+0x27d>
   117e0:	80 f9 0e             	cmp    $0xe,%cl
   117e3:	74 08                	je     117ed <_FsRecVfatFsControl+0x27d>
   117e5:	8b 4d b0             	mov    0xffffffb0(%ebp),%ecx
   117e8:	e9 ef fd ff ff       	jmp    115dc <_FsRecVfatFsControl+0x6c>
   117ed:	bf 01 00 00 00       	mov    $0x1,%edi
   117f2:	8b 4d b0             	mov    0xffffffb0(%ebp),%ecx
   117f5:	e9 e2 fd ff ff       	jmp    115dc <_FsRecVfatFsControl+0x6c>
   117fa:	8b 4d b0             	mov    0xffffffb0(%ebp),%ecx
   117fd:	83 f9 0b             	cmp    $0xb,%ecx
   11800:	0f 85 d6 fd ff ff    	jne    115dc <_FsRecVfatFsControl+0x6c>
   11806:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
   11809:	85 c0                	test   %eax,%eax
   1180b:	0f 84 cb fd ff ff    	je     115dc <_FsRecVfatFsControl+0x6c>
   11811:	8b 55 cc             	mov    0xffffffcc(%ebp),%edx
   11814:	8b 45 c8             	mov    0xffffffc8(%ebp),%eax
   11817:	89 d3                	mov    %edx,%ebx
   11819:	09 c3                	or     %eax,%ebx
   1181b:	0f 85 bb fd ff ff    	jne    115dc <_FsRecVfatFsControl+0x6c>
   11821:	8b 55 d4             	mov    0xffffffd4(%ebp),%edx
   11824:	8b 45 d0             	mov    0xffffffd0(%ebp),%eax
   11827:	85 d2                	test   %edx,%edx
   11829:	0f 8c ad fd ff ff    	jl     115dc <_FsRecVfatFsControl+0x6c>
   1182f:	7e 0a                	jle    1183b <_FsRecVfatFsControl+0x2cb>
   11831:	bf 01 00 00 00       	mov    $0x1,%edi
   11836:	e9 a1 fd ff ff       	jmp    115dc <_FsRecVfatFsControl+0x6c>
   1183b:	83 f8 00             	cmp    $0x0,%eax
   1183e:	0f 86 98 fd ff ff    	jbe    115dc <_FsRecVfatFsControl+0x6c>
   11844:	bf 01 00 00 00       	mov    $0x1,%edi
   11849:	e9 8e fd ff ff       	jmp    115dc <_FsRecVfatFsControl+0x6c>
   1184e:	90                   	nop    
   1184f:	90                   	nop    

00011850 <_FsRecNtfsFsControl>:
   11850:	55                   	push   %ebp
   11851:	89 e5                	mov    %esp,%ebp
   11853:	57                   	push   %edi
   11854:	56                   	push   %esi
   11855:	53                   	push   %ebx
   11856:	83 ec 3c             	sub    $0x3c,%esp
   11859:	8b 45 0c             	mov    0xc(%ebp),%eax
   1185c:	8b 50 60             	mov    0x60(%eax),%edx
   1185f:	31 c0                	xor    %eax,%eax
   11861:	8a 42 01             	mov    0x1(%edx),%al
   11864:	83 f8 01             	cmp    $0x1,%eax
   11867:	74 18                	je     11881 <_FsRecNtfsFsControl+0x31>
   11869:	83 f8 03             	cmp    $0x3,%eax
   1186c:	0f 84 be 00 00 00    	je     11930 <_FsRecNtfsFsControl+0xe0>
   11872:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   11877:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1187a:	89 d8                	mov    %ebx,%eax
   1187c:	5b                   	pop    %ebx
   1187d:	5e                   	pop    %esi
   1187e:	5f                   	pop    %edi
   1187f:	5d                   	pop    %ebp
   11880:	c3                   	ret    
   11881:	8b 7a 08             	mov    0x8(%edx),%edi
   11884:	c7 45 c4 18 00 00 00 	movl   $0x18,0xffffffc4(%ebp)
   1188b:	50                   	push   %eax
   1188c:	50                   	push   %eax
   1188d:	8d 45 c4             	lea    0xffffffc4(%ebp),%eax
   11890:	50                   	push   %eax
   11891:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   11894:	50                   	push   %eax
   11895:	6a 00                	push   $0x0
   11897:	6a 00                	push   $0x0
   11899:	68 00 00 07 00       	push   $0x70000
   1189e:	57                   	push   %edi
   1189f:	e8 0c f8 ff ff       	call   110b0 <_FsRecDeviceIoControl>
   118a4:	83 c4 20             	add    $0x20,%esp
   118a7:	85 c0                	test   %eax,%eax
   118a9:	78 66                	js     11911 <_FsRecNtfsFsControl+0xc1>
   118ab:	56                   	push   %esi
   118ac:	56                   	push   %esi
   118ad:	8b 5d dc             	mov    0xffffffdc(%ebp),%ebx
   118b0:	53                   	push   %ebx
   118b1:	6a 00                	push   $0x0
   118b3:	e8 28 03 00 00       	call   11be0 <_ExAllocatePool@8>
   118b8:	89 c6                	mov    %eax,%esi
   118ba:	5a                   	pop    %edx
   118bb:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   118c0:	59                   	pop    %ecx
   118c1:	85 f6                	test   %esi,%esi
   118c3:	74 4c                	je     11911 <_FsRecNtfsFsControl+0xc1>
   118c5:	83 ec 0c             	sub    $0xc,%esp
   118c8:	56                   	push   %esi
   118c9:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
   118cc:	50                   	push   %eax
   118cd:	6a 01                	push   $0x1
   118cf:	6a 00                	push   $0x0
   118d1:	57                   	push   %edi
   118d2:	e8 29 f7 ff ff       	call   11000 <_FsRecReadSectors>
   118d7:	83 c4 20             	add    $0x20,%esp
   118da:	89 c3                	mov    %eax,%ebx
   118dc:	85 c0                	test   %eax,%eax
   118de:	78 23                	js     11903 <_FsRecNtfsFsControl+0xb3>
   118e0:	8d 46 03             	lea    0x3(%esi),%eax
   118e3:	57                   	push   %edi
   118e4:	6a 08                	push   $0x8
   118e6:	68 10 22 01 00       	push   $0x12210
   118eb:	50                   	push   %eax
   118ec:	e8 ff 03 00 00       	call   11cf0 <_RtlCompareMemory@12>
   118f1:	83 f8 08             	cmp    $0x8,%eax
   118f4:	5b                   	pop    %ebx
   118f5:	0f 94 c0             	sete   %al
   118f8:	31 db                	xor    %ebx,%ebx
   118fa:	88 c3                	mov    %al,%bl
   118fc:	4b                   	dec    %ebx
   118fd:	81 e3 4f 01 00 c0    	and    $0xc000014f,%ebx
   11903:	83 ec 0c             	sub    $0xc,%esp
   11906:	56                   	push   %esi
   11907:	e8 14 03 00 00       	call   11c20 <_ExFreePool@4>
   1190c:	89 d8                	mov    %ebx,%eax
   1190e:	83 c4 0c             	add    $0xc,%esp
   11911:	89 c3                	mov    %eax,%ebx
   11913:	85 c0                	test   %eax,%eax
   11915:	0f 88 5c ff ff ff    	js     11877 <_FsRecNtfsFsControl+0x27>
   1191b:	bb 9c 01 00 c0       	mov    $0xc000019c,%ebx
   11920:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11923:	89 d8                	mov    %ebx,%eax
   11925:	5b                   	pop    %ebx
   11926:	5e                   	pop    %esi
   11927:	5f                   	pop    %edi
   11928:	5d                   	pop    %ebp
   11929:	c3                   	ret    
   1192a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
   11930:	8d 5d b8             	lea    0xffffffb8(%ebp),%ebx
   11933:	51                   	push   %ecx
   11934:	51                   	push   %ecx
   11935:	68 1c 22 01 00       	push   $0x1221c
   1193a:	53                   	push   %ebx
   1193b:	e8 30 03 00 00       	call   11c70 <_RtlInitUnicodeString@8>
   11940:	52                   	push   %edx
   11941:	53                   	push   %ebx
   11942:	e8 89 03 00 00       	call   11cd0 <_ZwLoadDriver@4>
   11947:	83 c4 0c             	add    $0xc,%esp
   1194a:	89 c3                	mov    %eax,%ebx
   1194c:	85 c0                	test   %eax,%eax
   1194e:	0f 88 23 ff ff ff    	js     11877 <_FsRecNtfsFsControl+0x27>
   11954:	83 ec 0c             	sub    $0xc,%esp
   11957:	8b 45 08             	mov    0x8(%ebp),%eax
   1195a:	50                   	push   %eax
   1195b:	e8 80 03 00 00       	call   11ce0 <_IoUnregisterFileSystem@4>
   11960:	83 c4 0c             	add    $0xc,%esp
   11963:	e9 0f ff ff ff       	jmp    11877 <_FsRecNtfsFsControl+0x27>
   11968:	90                   	nop    
   11969:	90                   	nop    
   1196a:	90                   	nop    
   1196b:	90                   	nop    
   1196c:	90                   	nop    
   1196d:	90                   	nop    
   1196e:	90                   	nop    
   1196f:	90                   	nop    

00011970 <_FsRecUdfsFsControl>:

/* EOF */
   11970:	55                   	push   %ebp
   11971:	89 e5                	mov    %esp,%ebp
   11973:	57                   	push   %edi
   11974:	56                   	push   %esi
   11975:	53                   	push   %ebx
   11976:	83 ec 4c             	sub    $0x4c,%esp
   11979:	8b 45 0c             	mov    0xc(%ebp),%eax
   1197c:	8b 50 60             	mov    0x60(%eax),%edx
   1197f:	31 c0                	xor    %eax,%eax
   11981:	8a 42 01             	mov    0x1(%edx),%al
   11984:	83 f8 01             	cmp    $0x1,%eax
   11987:	74 18                	je     119a1 <_FsRecUdfsFsControl+0x31>
   11989:	83 f8 03             	cmp    $0x3,%eax
   1198c:	0f 84 dc 01 00 00    	je     11b6e <_FsRecUdfsFsControl+0x1fe>
   11992:	bb 10 00 00 c0       	mov    $0xc0000010,%ebx
   11997:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1199a:	89 d8                	mov    %ebx,%eax
   1199c:	5b                   	pop    %ebx
   1199d:	5e                   	pop    %esi
   1199e:	5f                   	pop    %edi
   1199f:	5d                   	pop    %ebp
   119a0:	c3                   	ret    
   119a1:	8b 52 08             	mov    0x8(%edx),%edx
   119a4:	8d 45 c4             	lea    0xffffffc4(%ebp),%eax
   119a7:	89 55 b4             	mov    %edx,0xffffffb4(%ebp)
   119aa:	c7 45 c4 18 00 00 00 	movl   $0x18,0xffffffc4(%ebp)
   119b1:	56                   	push   %esi
   119b2:	56                   	push   %esi
   119b3:	50                   	push   %eax
   119b4:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
   119b7:	50                   	push   %eax
   119b8:	6a 00                	push   $0x0
   119ba:	6a 00                	push   $0x0
   119bc:	68 4c 40 02 00       	push   $0x2404c
   119c1:	52                   	push   %edx
   119c2:	e8 e9 f6 ff ff       	call   110b0 <_FsRecDeviceIoControl>
   119c7:	83 c4 20             	add    $0x20,%esp
   119ca:	85 c0                	test   %eax,%eax
   119cc:	0f 88 83 01 00 00    	js     11b55 <_FsRecUdfsFsControl+0x1e5>
   119d2:	8b 45 dc             	mov    0xffffffdc(%ebp),%eax
   119d5:	89 45 b0             	mov    %eax,0xffffffb0(%ebp)
   119d8:	53                   	push   %ebx
   119d9:	53                   	push   %ebx
   119da:	50                   	push   %eax
   119db:	6a 00                	push   $0x0
   119dd:	e8 fe 01 00 00       	call   11be0 <_ExAllocatePool@8>
   119e2:	89 c3                	mov    %eax,%ebx
   119e4:	5a                   	pop    %edx
   119e5:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   119ea:	59                   	pop    %ecx
   119eb:	85 db                	test   %ebx,%ebx
   119ed:	0f 84 0e 01 00 00    	je     11b01 <_FsRecUdfsFsControl+0x191>
   119f3:	31 ff                	xor    %edi,%edi
   119f5:	be 10 00 00 00       	mov    $0x10,%esi
   119fa:	eb 21                	jmp    11a1d <_FsRecUdfsFsControl+0xad>
   119fc:	8d 74 26 00          	lea    0x0(%esi),%esi
   11a00:	83 ff 02             	cmp    $0x2,%edi
   11a03:	0f 84 b8 00 00 00    	je     11ac1 <_FsRecUdfsFsControl+0x151>
   11a09:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
   11a10:	46                   	inc    %esi
   11a11:	81 fe 00 01 00 00    	cmp    $0x100,%esi
   11a17:	0f 84 91 01 00 00    	je     11bae <_FsRecUdfsFsControl+0x23e>
   11a1d:	83 ec 0c             	sub    $0xc,%esp
   11a20:	53                   	push   %ebx
   11a21:	8b 45 b0             	mov    0xffffffb0(%ebp),%eax
   11a24:	50                   	push   %eax
   11a25:	6a 01                	push   $0x1
   11a27:	56                   	push   %esi
   11a28:	8b 45 b4             	mov    0xffffffb4(%ebp),%eax
   11a2b:	50                   	push   %eax
   11a2c:	e8 cf f5 ff ff       	call   11000 <_FsRecReadSectors>
   11a31:	83 c4 20             	add    $0x20,%esp
   11a34:	85 c0                	test   %eax,%eax
   11a36:	0f 88 72 01 00 00    	js     11bae <_FsRecUdfsFsControl+0x23e>
   11a3c:	83 ff 01             	cmp    $0x1,%edi
   11a3f:	74 44                	je     11a85 <_FsRecUdfsFsControl+0x115>
   11a41:	73 bd                	jae    11a00 <_FsRecUdfsFsControl+0x90>
   11a43:	83 fe 10             	cmp    $0x10,%esi
   11a46:	0f 85 62 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a4c:	80 7b 01 42          	cmpb   $0x42,0x1(%ebx)
   11a50:	0f 85 58 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a56:	80 7b 02 45          	cmpb   $0x45,0x2(%ebx)
   11a5a:	0f 85 4e 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a60:	80 7b 03 41          	cmpb   $0x41,0x3(%ebx)
   11a64:	0f 85 44 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a6a:	80 7b 04 30          	cmpb   $0x30,0x4(%ebx)
   11a6e:	0f 85 3a 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a74:	80 7b 05 31          	cmpb   $0x31,0x5(%ebx)
   11a78:	0f 85 30 01 00 00    	jne    11bae <_FsRecUdfsFsControl+0x23e>
   11a7e:	bf 01 00 00 00       	mov    $0x1,%edi
   11a83:	eb 8b                	jmp    11a10 <_FsRecUdfsFsControl+0xa0>
   11a85:	80 7b 01 4e          	cmpb   $0x4e,0x1(%ebx)
   11a89:	75 85                	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11a8b:	80 7b 02 53          	cmpb   $0x53,0x2(%ebx)
   11a8f:	0f 85 7b ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11a95:	80 7b 03 52          	cmpb   $0x52,0x3(%ebx)
   11a99:	0f 85 71 ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11a9f:	80 7b 04 30          	cmpb   $0x30,0x4(%ebx)
   11aa3:	0f 85 67 ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11aa9:	8a 43 05             	mov    0x5(%ebx),%al
   11aac:	83 e8 32             	sub    $0x32,%eax
   11aaf:	3c 01                	cmp    $0x1,%al
   11ab1:	0f 87 59 ff ff ff    	ja     11a10 <_FsRecUdfsFsControl+0xa0>
   11ab7:	bf 02 00 00 00       	mov    $0x2,%edi
   11abc:	e9 4f ff ff ff       	jmp    11a10 <_FsRecUdfsFsControl+0xa0>
   11ac1:	80 7b 01 54          	cmpb   $0x54,0x1(%ebx)
   11ac5:	0f 85 45 ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11acb:	80 7b 02 45          	cmpb   $0x45,0x2(%ebx)
   11acf:	0f 85 3b ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11ad5:	80 7b 03 41          	cmpb   $0x41,0x3(%ebx)
   11ad9:	0f 85 31 ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11adf:	80 7b 04 30          	cmpb   $0x30,0x4(%ebx)
   11ae3:	0f 85 27 ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11ae9:	80 7b 05 31          	cmpb   $0x31,0x5(%ebx)
   11aed:	0f 85 1d ff ff ff    	jne    11a10 <_FsRecUdfsFsControl+0xa0>
   11af3:	83 ec 0c             	sub    $0xc,%esp
   11af6:	53                   	push   %ebx
   11af7:	e8 24 01 00 00       	call   11c20 <_ExFreePool@4>
   11afc:	31 c0                	xor    %eax,%eax
   11afe:	83 c4 0c             	add    $0xc,%esp
   11b01:	85 c0                	test   %eax,%eax
   11b03:	78 50                	js     11b55 <_FsRecUdfsFsControl+0x1e5>
   11b05:	8b 75 dc             	mov    0xffffffdc(%ebp),%esi
   11b08:	57                   	push   %edi
   11b09:	57                   	push   %edi
   11b0a:	56                   	push   %esi
   11b0b:	6a 00                	push   $0x0
   11b0d:	e8 ce 00 00 00       	call   11be0 <_ExAllocatePool@8>
   11b12:	59                   	pop    %ecx
   11b13:	5b                   	pop    %ebx
   11b14:	89 c3                	mov    %eax,%ebx
   11b16:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
   11b1b:	85 db                	test   %ebx,%ebx
   11b1d:	74 30                	je     11b4f <_FsRecUdfsFsControl+0x1df>
   11b1f:	83 ec 0c             	sub    $0xc,%esp
   11b22:	53                   	push   %ebx
   11b23:	56                   	push   %esi
   11b24:	6a 01                	push   $0x1
   11b26:	68 00 01 00 00       	push   $0x100
   11b2b:	8b 55 b4             	mov    0xffffffb4(%ebp),%edx
   11b2e:	52                   	push   %edx
   11b2f:	e8 cc f4 ff ff       	call   11000 <_FsRecReadSectors>
   11b34:	83 c4 20             	add    $0x20,%esp
   11b37:	89 c6                	mov    %eax,%esi
   11b39:	85 c0                	test   %eax,%eax
   11b3b:	0f 88 83 00 00 00    	js     11bc4 <_FsRecUdfsFsControl+0x254>
   11b41:	83 ec 0c             	sub    $0xc,%esp
   11b44:	53                   	push   %ebx
   11b45:	e8 d6 00 00 00       	call   11c20 <_ExFreePool@4>
   11b4a:	31 c0                	xor    %eax,%eax
   11b4c:	83 c4 0c             	add    $0xc,%esp
   11b4f:	85 c0                	test   %eax,%eax
   11b51:	78 02                	js     11b55 <_FsRecUdfsFsControl+0x1e5>
   11b53:	31 c0                	xor    %eax,%eax
   11b55:	89 c3                	mov    %eax,%ebx
   11b57:	85 c0                	test   %eax,%eax
   11b59:	0f 88 38 fe ff ff    	js     11997 <_FsRecUdfsFsControl+0x27>
   11b5f:	bb 9c 01 00 c0       	mov    $0xc000019c,%ebx
   11b64:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11b67:	89 d8                	mov    %ebx,%eax
   11b69:	5b                   	pop    %ebx
   11b6a:	5e                   	pop    %esi
   11b6b:	5f                   	pop    %edi
   11b6c:	5d                   	pop    %ebp
   11b6d:	c3                   	ret    
   11b6e:	83 ec 0c             	sub    $0xc,%esp
   11b71:	66 c7 45 b8 70 00    	movw   $0x70,0xffffffb8(%ebp)
   11b77:	66 c7 45 ba 72 00    	movw   $0x72,0xffffffba(%ebp)
   11b7d:	c7 45 bc 90 22 01 00 	movl   $0x12290,0xffffffbc(%ebp)
   11b84:	8d 45 b8             	lea    0xffffffb8(%ebp),%eax
   11b87:	50                   	push   %eax
   11b88:	e8 43 01 00 00       	call   11cd0 <_ZwLoadDriver@4>
   11b8d:	83 c4 0c             	add    $0xc,%esp
   11b90:	89 c3                	mov    %eax,%ebx
   11b92:	85 c0                	test   %eax,%eax
   11b94:	0f 88 fd fd ff ff    	js     11997 <_FsRecUdfsFsControl+0x27>
   11b9a:	83 ec 0c             	sub    $0xc,%esp
   11b9d:	8b 45 08             	mov    0x8(%ebp),%eax
   11ba0:	50                   	push   %eax
   11ba1:	e8 3a 01 00 00       	call   11ce0 <_IoUnregisterFileSystem@4>
   11ba6:	83 c4 0c             	add    $0xc,%esp
   11ba9:	e9 e9 fd ff ff       	jmp    11997 <_FsRecUdfsFsControl+0x27>
   11bae:	83 ec 0c             	sub    $0xc,%esp
   11bb1:	53                   	push   %ebx
   11bb2:	e8 69 00 00 00       	call   11c20 <_ExFreePool@4>
   11bb7:	b8 4f 01 00 c0       	mov    $0xc000014f,%eax
   11bbc:	83 c4 0c             	add    $0xc,%esp
   11bbf:	e9 3d ff ff ff       	jmp    11b01 <_FsRecUdfsFsControl+0x191>
   11bc4:	83 ec 0c             	sub    $0xc,%esp
   11bc7:	53                   	push   %ebx
   11bc8:	e8 53 00 00 00       	call   11c20 <_ExFreePool@4>
   11bcd:	89 f0                	mov    %esi,%eax
   11bcf:	83 c4 0c             	add    $0xc,%esp
   11bd2:	e9 78 ff ff ff       	jmp    11b4f <_FsRecUdfsFsControl+0x1df>
   11bd7:	90                   	nop    
   11bd8:	90                   	nop    
   11bd9:	90                   	nop    
   11bda:	90                   	nop    
   11bdb:	90                   	nop    
   11bdc:	90                   	nop    
   11bdd:	90                   	nop    
   11bde:	90                   	nop    
   11bdf:	90                   	nop    

00011be0 <_ExAllocatePool@8>:
   11be0:	ff 25 7c 30 01 00    	jmp    *0x1307c
   11be6:	90                   	nop    
   11be7:	90                   	nop    
	...

00011bf0 <_KeInitializeEvent@12>:
   11bf0:	ff 25 a8 30 01 00    	jmp    *0x130a8
   11bf6:	90                   	nop    
   11bf7:	90                   	nop    
	...

00011c00 <_IoBuildSynchronousFsdRequest@28>:
   11c00:	ff 25 88 30 01 00    	jmp    *0x13088
   11c06:	90                   	nop    
   11c07:	90                   	nop    
	...

00011c10 <_IoCallDriver@8>:
   11c10:	ff 25 8c 30 01 00    	jmp    *0x1308c
   11c16:	90                   	nop    
   11c17:	90                   	nop    
	...

00011c20 <_ExFreePool@4>:
   11c20:	ff 25 80 30 01 00    	jmp    *0x13080
   11c26:	90                   	nop    
   11c27:	90                   	nop    
	...

00011c30 <_KeWaitForSingleObject@20>:
   11c30:	ff 25 ac 30 01 00    	jmp    *0x130ac
   11c36:	90                   	nop    
   11c37:	90                   	nop    
	...

00011c40 <_IoBuildDeviceIoControlRequest@36>:
   11c40:	ff 25 84 30 01 00    	jmp    *0x13084
   11c46:	90                   	nop    
   11c47:	90                   	nop    
	...

00011c50 <_IoCompleteRequest@8>:
   11c50:	ff 25 90 30 01 00    	jmp    *0x13090
   11c56:	90                   	nop    
   11c57:	90                   	nop    
	...

00011c60 <_IoDeleteDevice@4>:
   11c60:	ff 25 98 30 01 00    	jmp    *0x13098
   11c66:	90                   	nop    
   11c67:	90                   	nop    
	...

00011c70 <_RtlInitUnicodeString@8>:
   11c70:	ff 25 b4 30 01 00    	jmp    *0x130b4
   11c76:	90                   	nop    
   11c77:	90                   	nop    
	...

00011c80 <_ZwCreateFile@44>:
   11c80:	ff 25 bc 30 01 00    	jmp    *0x130bc
   11c86:	90                   	nop    
   11c87:	90                   	nop    
	...

00011c90 <_IoCreateDevice@28>:
   11c90:	ff 25 94 30 01 00    	jmp    *0x13094
   11c96:	90                   	nop    
   11c97:	90                   	nop    
	...

00011ca0 <_IoRegisterFileSystem@4>:
   11ca0:	ff 25 a0 30 01 00    	jmp    *0x130a0
   11ca6:	90                   	nop    
   11ca7:	90                   	nop    
	...

00011cb0 <_ZwClose@4>:
   11cb0:	ff 25 b8 30 01 00    	jmp    *0x130b8
   11cb6:	90                   	nop    
   11cb7:	90                   	nop    
	...

00011cc0 <_IoGetConfigurationInformation@0>:
   11cc0:	ff 25 9c 30 01 00    	jmp    *0x1309c
   11cc6:	90                   	nop    
   11cc7:	90                   	nop    
	...

00011cd0 <_ZwLoadDriver@4>:
   11cd0:	ff 25 c0 30 01 00    	jmp    *0x130c0
   11cd6:	90                   	nop    
   11cd7:	90                   	nop    
	...

00011ce0 <_IoUnregisterFileSystem@4>:
   11ce0:	ff 25 a4 30 01 00    	jmp    *0x130a4
   11ce6:	90                   	nop    
   11ce7:	90                   	nop    
	...

00011cf0 <_RtlCompareMemory@12>:
   11cf0:	ff 25 b0 30 01 00    	jmp    *0x130b0
   11cf6:	90                   	nop    
   11cf7:	90                   	nop    
	...

00011d00 <__CTOR_LIST__>:
   11d00:	ff                   	(bad)  
   11d01:	ff                   	(bad)  
   11d02:	ff                   	(bad)  
   11d03:	ff 00                	incl   (%eax)
   11d05:	00 00                	add    %al,(%eax)
	...

00011d08 <__DTOR_LIST__>:
   11d08:	ff                   	(bad)  
   11d09:	ff                   	(bad)  
   11d0a:	ff                   	(bad)  
   11d0b:	ff 00                	incl   (%eax)
   11d0d:	00 00                	add    %al,(%eax)
	...
