
services.nostrip.exe:     file format pei-i386

Disassembly of section .text:

00401000 <___crt_xc_end__>:
  401000:	55                   	push   %ebp
  401001:	89 e5                	mov    %esp,%ebp
  401003:	83 ec 18             	sub    $0x18,%esp
  401006:	89 5d f8             	mov    %ebx,0xfffffff8(%ebp)
  401009:	8b 55 08             	mov    0x8(%ebp),%edx
  40100c:	31 db                	xor    %ebx,%ebx
  40100e:	89 75 fc             	mov    %esi,0xfffffffc(%ebp)
  401011:	8b 02                	mov    (%edx),%eax
  401013:	31 f6                	xor    %esi,%esi
  401015:	8b 00                	mov    (%eax),%eax
  401017:	3d 91 00 00 c0       	cmp    $0xc0000091,%eax
  40101c:	77 43                	ja     401061 <___crt_xc_end__+0x61>
  40101e:	3d 8d 00 00 c0       	cmp    $0xc000008d,%eax
  401023:	72 5b                	jb     401080 <___crt_xc_end__+0x80>
  401025:	be 01 00 00 00       	mov    $0x1,%esi
  40102a:	c7 04 24 08 00 00 00 	movl   $0x8,(%esp)
  401031:	31 c0                	xor    %eax,%eax
  401033:	89 44 24 04          	mov    %eax,0x4(%esp)
  401037:	e8 74 1b 00 00       	call   402bb0 <_signal>
  40103c:	83 f8 01             	cmp    $0x1,%eax
  40103f:	74 6c                	je     4010ad <___crt_xc_end__+0xad>
  401041:	85 c0                	test   %eax,%eax
  401043:	74 2a                	je     40106f <___crt_xc_end__+0x6f>
  401045:	c7 04 24 08 00 00 00 	movl   $0x8,(%esp)
  40104c:	ff d0                	call   *%eax
  40104e:	bb ff ff ff ff       	mov    $0xffffffff,%ebx
  401053:	89 d8                	mov    %ebx,%eax
  401055:	8b 75 fc             	mov    0xfffffffc(%ebp),%esi
  401058:	8b 5d f8             	mov    0xfffffff8(%ebp),%ebx
  40105b:	89 ec                	mov    %ebp,%esp
  40105d:	5d                   	pop    %ebp
  40105e:	c2 04 00             	ret    $0x4
  401061:	3d 93 00 00 c0       	cmp    $0xc0000093,%eax
  401066:	74 bd                	je     401025 <___crt_xc_end__+0x25>
  401068:	3d 94 00 00 c0       	cmp    $0xc0000094,%eax
  40106d:	74 bb                	je     40102a <___crt_xc_end__+0x2a>
  40106f:	89 d8                	mov    %ebx,%eax
  401071:	8b 75 fc             	mov    0xfffffffc(%ebp),%esi
  401074:	8b 5d f8             	mov    0xfffffff8(%ebp),%ebx
  401077:	89 ec                	mov    %ebp,%esp
  401079:	5d                   	pop    %ebp
  40107a:	c2 04 00             	ret    $0x4
  40107d:	8d 76 00             	lea    0x0(%esi),%esi
  401080:	3d 05 00 00 c0       	cmp    $0xc0000005,%eax
  401085:	75 e8                	jne    40106f <___crt_xc_end__+0x6f>
  401087:	c7 04 24 0b 00 00 00 	movl   $0xb,(%esp)
  40108e:	31 f6                	xor    %esi,%esi
  401090:	89 74 24 04          	mov    %esi,0x4(%esp)
  401094:	e8 17 1b 00 00       	call   402bb0 <_signal>
  401099:	83 f8 01             	cmp    $0x1,%eax
  40109c:	74 34                	je     4010d2 <___crt_xc_end__+0xd2>
  40109e:	85 c0                	test   %eax,%eax
  4010a0:	74 cd                	je     40106f <___crt_xc_end__+0x6f>
  4010a2:	c7 04 24 0b 00 00 00 	movl   $0xb,(%esp)
  4010a9:	ff d0                	call   *%eax
  4010ab:	eb a1                	jmp    40104e <___crt_xc_end__+0x4e>
  4010ad:	c7 04 24 08 00 00 00 	movl   $0x8,(%esp)
  4010b4:	bb 01 00 00 00       	mov    $0x1,%ebx
  4010b9:	89 5c 24 04          	mov    %ebx,0x4(%esp)
  4010bd:	e8 ee 1a 00 00       	call   402bb0 <_signal>
  4010c2:	85 f6                	test   %esi,%esi
  4010c4:	74 88                	je     40104e <___crt_xc_end__+0x4e>
  4010c6:	e8 25 16 00 00       	call   4026f0 <__fpreset>
  4010cb:	bb ff ff ff ff       	mov    $0xffffffff,%ebx
  4010d0:	eb 81                	jmp    401053 <___crt_xc_end__+0x53>
  4010d2:	c7 04 24 0b 00 00 00 	movl   $0xb,(%esp)
  4010d9:	b9 01 00 00 00       	mov    $0x1,%ecx
  4010de:	bb ff ff ff ff       	mov    $0xffffffff,%ebx
  4010e3:	89 4c 24 04          	mov    %ecx,0x4(%esp)
  4010e7:	e8 c4 1a 00 00       	call   402bb0 <_signal>
  4010ec:	e9 62 ff ff ff       	jmp    401053 <___crt_xc_end__+0x53>
  4010f1:	eb 0d                	jmp    401100 <___mingw_CRTStartup>
  4010f3:	90                   	nop    
  4010f4:	90                   	nop    
  4010f5:	90                   	nop    
  4010f6:	90                   	nop    
  4010f7:	90                   	nop    
  4010f8:	90                   	nop    
  4010f9:	90                   	nop    
  4010fa:	90                   	nop    
  4010fb:	90                   	nop    
  4010fc:	90                   	nop    
  4010fd:	90                   	nop    
  4010fe:	90                   	nop    
  4010ff:	90                   	nop    

00401100 <___mingw_CRTStartup>:
  401100:	55                   	push   %ebp
  401101:	89 e5                	mov    %esp,%ebp
  401103:	53                   	push   %ebx
  401104:	83 ec 24             	sub    $0x24,%esp
  401107:	8d 5d f8             	lea    0xfffffff8(%ebp),%ebx
  40110a:	c7 04 24 00 10 40 00 	movl   $0x401000,(%esp)
  401111:	e8 ea 12 00 00       	call   402400 <_SetUnhandledExceptionFilter@4>
  401116:	83 ec 04             	sub    $0x4,%esp
  401119:	e8 d2 15 00 00       	call   4026f0 <__fpreset>
  40111e:	c7 45 f8 00 00 00 00 	movl   $0x0,0xfffffff8(%ebp)
  401125:	b8 00 50 40 00       	mov    $0x405000,%eax
  40112a:	8d 55 f4             	lea    0xfffffff4(%ebp),%edx
  40112d:	89 5c 24 10          	mov    %ebx,0x10(%esp)
  401131:	8b 0d 00 30 40 00    	mov    0x403000,%ecx
  401137:	89 44 24 04          	mov    %eax,0x4(%esp)
  40113b:	89 54 24 08          	mov    %edx,0x8(%esp)
  40113f:	89 4c 24 0c          	mov    %ecx,0xc(%esp)
  401143:	c7 04 24 04 50 40 00 	movl   $0x405004,(%esp)
  40114a:	e8 91 1a 00 00       	call   402be0 <___getmainargs>
  40114f:	a1 10 50 40 00       	mov    0x405010,%eax
  401154:	85 c0                	test   %eax,%eax
  401156:	74 58                	je     4011b0 <___mingw_CRTStartup+0xb0>
  401158:	a3 10 30 40 00       	mov    %eax,0x403010
  40115d:	8b 15 d8 62 40 00    	mov    0x4062d8,%edx
  401163:	85 d2                	test   %edx,%edx
  401165:	0f 85 8b 00 00 00    	jne    4011f6 <___mingw_CRTStartup+0xf6>
  40116b:	83 fa e0             	cmp    $0xffffffe0,%edx
  40116e:	74 20                	je     401190 <___mingw_CRTStartup+0x90>
  401170:	a1 10 50 40 00       	mov    0x405010,%eax
  401175:	89 44 24 04          	mov    %eax,0x4(%esp)
  401179:	8b 1d d8 62 40 00    	mov    0x4062d8,%ebx
  40117f:	8b 4b 30             	mov    0x30(%ebx),%ecx
  401182:	89 0c 24             	mov    %ecx,(%esp)
  401185:	e8 46 1a 00 00       	call   402bd0 <__setmode>
  40118a:	8b 15 d8 62 40 00    	mov    0x4062d8,%edx
  401190:	83 fa c0             	cmp    $0xffffffc0,%edx
  401193:	74 1b                	je     4011b0 <___mingw_CRTStartup+0xb0>
  401195:	8b 1d 10 50 40 00    	mov    0x405010,%ebx
  40119b:	89 5c 24 04          	mov    %ebx,0x4(%esp)
  40119f:	8b 0d d8 62 40 00    	mov    0x4062d8,%ecx
  4011a5:	8b 51 50             	mov    0x50(%ecx),%edx
  4011a8:	89 14 24             	mov    %edx,(%esp)
  4011ab:	e8 20 1a 00 00       	call   402bd0 <__setmode>
  4011b0:	e8 0b 1a 00 00       	call   402bc0 <___p__fmode>
  4011b5:	8b 1d 10 30 40 00    	mov    0x403010,%ebx
  4011bb:	89 18                	mov    %ebx,(%eax)
  4011bd:	e8 fe 14 00 00       	call   4026c0 <__pei386_runtime_relocator>
  4011c2:	83 e4 f0             	and    $0xfffffff0,%esp
  4011c5:	e8 d6 19 00 00       	call   402ba0 <___p__environ>
  4011ca:	8b 08                	mov    (%eax),%ecx
  4011cc:	89 4c 24 08          	mov    %ecx,0x8(%esp)
  4011d0:	8b 15 00 50 40 00    	mov    0x405000,%edx
  4011d6:	89 54 24 04          	mov    %edx,0x4(%esp)
  4011da:	a1 04 50 40 00       	mov    0x405004,%eax
  4011df:	89 04 24             	mov    %eax,(%esp)
  4011e2:	e8 b9 13 00 00       	call   4025a0 <_main>
  4011e7:	89 c3                	mov    %eax,%ebx
  4011e9:	e8 a2 19 00 00       	call   402b90 <__cexit>
  4011ee:	89 1c 24             	mov    %ebx,(%esp)
  4011f1:	e8 1a 12 00 00       	call   402410 <_ExitProcess@4>
  4011f6:	89 44 24 04          	mov    %eax,0x4(%esp)
  4011fa:	8b 15 d8 62 40 00    	mov    0x4062d8,%edx
  401200:	8b 42 10             	mov    0x10(%edx),%eax
  401203:	89 04 24             	mov    %eax,(%esp)
  401206:	e8 c5 19 00 00       	call   402bd0 <__setmode>
  40120b:	8b 15 d8 62 40 00    	mov    0x4062d8,%edx
  401211:	e9 55 ff ff ff       	jmp    40116b <___mingw_CRTStartup+0x6b>
  401216:	8d 76 00             	lea    0x0(%esi),%esi
  401219:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00401220 <_mainCRTStartup>:
  401220:	55                   	push   %ebp
  401221:	89 e5                	mov    %esp,%ebp
  401223:	83 ec 08             	sub    $0x8,%esp
  401226:	c7 04 24 01 00 00 00 	movl   $0x1,(%esp)
  40122d:	ff 15 d0 62 40 00    	call   *0x4062d0
  401233:	e8 c8 fe ff ff       	call   401100 <___mingw_CRTStartup>
  401238:	90                   	nop    
  401239:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00401240 <_WinMainCRTStartup>:
  401240:	55                   	push   %ebp
  401241:	89 e5                	mov    %esp,%ebp
  401243:	83 ec 08             	sub    $0x8,%esp
  401246:	c7 04 24 02 00 00 00 	movl   $0x2,(%esp)
  40124d:	ff 15 d0 62 40 00    	call   *0x4062d0
  401253:	e8 a8 fe ff ff       	call   401100 <___mingw_CRTStartup>
  401258:	90                   	nop    
  401259:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00401260 <_atexit>:
  401260:	55                   	push   %ebp
  401261:	8b 0d e8 62 40 00    	mov    0x4062e8,%ecx
  401267:	89 e5                	mov    %esp,%ebp
  401269:	5d                   	pop    %ebp
  40126a:	ff e1                	jmp    *%ecx
  40126c:	8d 74 26 00          	lea    0x0(%esi),%esi

00401270 <__onexit>:
  401270:	55                   	push   %ebp
  401271:	8b 0d dc 62 40 00    	mov    0x4062dc,%ecx
  401277:	89 e5                	mov    %esp,%ebp
  401279:	5d                   	pop    %ebp
  40127a:	ff e1                	jmp    *%ecx
  40127c:	90                   	nop    
  40127d:	90                   	nop    
  40127e:	90                   	nop    
  40127f:	90                   	nop    

00401280 <___do_sjlj_init>:
  401280:	55                   	push   %ebp
  401281:	89 e5                	mov    %esp,%ebp
  401283:	5d                   	pop    %ebp
  401284:	e9 37 16 00 00       	jmp    4028c0 <___w32_sharedptr_initialize>
  401289:	90                   	nop    
  40128a:	90                   	nop    
  40128b:	90                   	nop    
  40128c:	90                   	nop    
  40128d:	90                   	nop    
  40128e:	90                   	nop    
  40128f:	90                   	nop    

00401290 <_PrintString>:
/* FUNCTIONS *****************************************************************/

void
PrintString(char* fmt,...)
{
  401290:	55                   	push   %ebp
  401291:	89 e5                	mov    %esp,%ebp
  401293:	5d                   	pop    %ebp
  401294:	c3                   	ret    
  401295:	8d 74 26 00          	lea    0x0(%esi),%esi
  401299:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

004012a0 <_ScmCreateStartEvent>:
#ifdef DBG
    char buffer[512];
    va_list ap;

    va_start(ap, fmt);
    vsprintf(buffer, fmt, ap);
    va_end(ap);

    OutputDebugStringA(buffer);
#endif
}


BOOL
ScmCreateStartEvent(PHANDLE StartEvent)
{
  4012a0:	55                   	push   %ebp
  4012a1:	89 e5                	mov    %esp,%ebp
  4012a3:	51                   	push   %ecx
  4012a4:	51                   	push   %ecx
    HANDLE hEvent;

    hEvent = CreateEvent(NULL,
  4012a5:	68 00 40 40 00       	push   $0x404000
  4012aa:	6a 00                	push   $0x0
  4012ac:	6a 01                	push   $0x1
  4012ae:	6a 00                	push   $0x0
  4012b0:	e8 6b 11 00 00       	call   402420 <_CreateEventA@16>
  4012b5:	89 c2                	mov    %eax,%edx
                         TRUE,
                         FALSE,
                         _T("SvcctrlStartEvent_A3725DX"));
    if (hEvent == NULL) {
  4012b7:	85 c0                	test   %eax,%eax
  4012b9:	74 0e                	je     4012c9 <_ScmCreateStartEvent+0x29>
        if (GetLastError() == ERROR_ALREADY_EXISTS) {
            hEvent = OpenEvent(EVENT_ALL_ACCESS,
                               FALSE,
                               _T("SvcctrlStartEvent_A3725DX"));
            if (hEvent == NULL) {
                return FALSE;
            }
        } else {
            return FALSE;
        }
    }
    *StartEvent = hEvent;
  4012bb:	8b 45 08             	mov    0x8(%ebp),%eax
    return TRUE;
  4012be:	b9 01 00 00 00       	mov    $0x1,%ecx
  4012c3:	89 10                	mov    %edx,(%eax)
}
  4012c5:	89 c8                	mov    %ecx,%eax
  4012c7:	c9                   	leave  
  4012c8:	c3                   	ret    
  4012c9:	e8 62 11 00 00       	call   402430 <_GetLastError@0>
  4012ce:	31 c9                	xor    %ecx,%ecx
  4012d0:	3d b7 00 00 00       	cmp    $0xb7,%eax
  4012d5:	75 ee                	jne    4012c5 <_ScmCreateStartEvent+0x25>
  4012d7:	52                   	push   %edx
  4012d8:	68 00 40 40 00       	push   $0x404000
  4012dd:	6a 00                	push   $0x0
  4012df:	68 03 00 1f 00       	push   $0x1f0003
  4012e4:	e8 57 11 00 00       	call   402440 <_OpenEventA@12>
  4012e9:	89 c2                	mov    %eax,%edx
  4012eb:	31 c9                	xor    %ecx,%ecx
  4012ed:	58                   	pop    %eax
  4012ee:	85 d2                	test   %edx,%edx
  4012f0:	75 c9                	jne    4012bb <_ScmCreateStartEvent+0x1b>
  4012f2:	89 c8                	mov    %ecx,%eax
  4012f4:	c9                   	leave  
  4012f5:	c3                   	ret    
  4012f6:	8d 76 00             	lea    0x0(%esi),%esi
  4012f9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00401300 <_ScmNamedPipeHandleRequest>:


BOOL
ScmNamedPipeHandleRequest(
    PVOID Request,
    DWORD RequestSize,
    PVOID Reply,
    LPDWORD ReplySize)
{
  401300:	55                   	push   %ebp
  401301:	89 e5                	mov    %esp,%ebp
  401303:	83 ec 10             	sub    $0x10,%esp
    DbgPrint("SCM READ: %s\n", Request);
  401306:	8b 45 08             	mov    0x8(%ebp),%eax
  401309:	50                   	push   %eax
  40130a:	68 1a 40 40 00       	push   $0x40401a
  40130f:	e8 dc 0f 00 00       	call   4022f0 <_DbgPrint>

    *ReplySize = 0;
  401314:	8b 45 14             	mov    0x14(%ebp),%eax
  401317:	c7 00 00 00 00 00    	movl   $0x0,(%eax)
    return FALSE;
}
  40131d:	31 c0                	xor    %eax,%eax
  40131f:	c9                   	leave  
  401320:	c3                   	ret    
  401321:	eb 0d                	jmp    401330 <_ScmNamedPipeThread@4>
  401323:	90                   	nop    
  401324:	90                   	nop    
  401325:	90                   	nop    
  401326:	90                   	nop    
  401327:	90                   	nop    
  401328:	90                   	nop    
  401329:	90                   	nop    
  40132a:	90                   	nop    
  40132b:	90                   	nop    
  40132c:	90                   	nop    
  40132d:	90                   	nop    
  40132e:	90                   	nop    
  40132f:	90                   	nop    

00401330 <_ScmNamedPipeThread@4>:


DWORD
WINAPI
ScmNamedPipeThread(LPVOID Context)
{
  401330:	55                   	push   %ebp
  401331:	89 e5                	mov    %esp,%ebp
  401333:	57                   	push   %edi
  401334:	56                   	push   %esi
  401335:	53                   	push   %ebx
  401336:	81 ec 1c 08 00 00    	sub    $0x81c,%esp
  40133c:	8d b5 e8 fb ff ff    	lea    0xfffffbe8(%ebp),%esi
  401342:	8b 5d 08             	mov    0x8(%ebp),%ebx
  401345:	8d bd e8 f7 ff ff    	lea    0xfffff7e8(%ebp),%edi
  40134b:	90                   	nop    
  40134c:	8d 74 26 00          	lea    0x0(%esi),%esi
    CHAR chRequest[PIPE_BUFSIZE];
    CHAR chReply[PIPE_BUFSIZE];
    DWORD cbReplyBytes;
    DWORD cbBytesRead;
    DWORD cbWritten;
    BOOL fSuccess;
    HANDLE hPipe;

    hPipe = (HANDLE)Context;

    DPRINT("ScmNamedPipeThread(%x) - Accepting SCM commands through named pipe\n", hPipe);
    
    for (;;) {
        fSuccess = ReadFile(hPipe,
  401350:	83 ec 0c             	sub    $0xc,%esp
  401353:	8d 85 e4 f7 ff ff    	lea    0xfffff7e4(%ebp),%eax
  401359:	6a 00                	push   $0x0
  40135b:	50                   	push   %eax
  40135c:	68 00 04 00 00       	push   $0x400
  401361:	56                   	push   %esi
  401362:	53                   	push   %ebx
  401363:	e8 e8 10 00 00       	call   402450 <_ReadFile@20>
                            &chRequest,
                            PIPE_BUFSIZE,
                            &cbBytesRead,
                            NULL);
        if (!fSuccess || cbBytesRead == 0) {
  401368:	83 c4 0c             	add    $0xc,%esp
  40136b:	85 c0                	test   %eax,%eax
  40136d:	74 4f                	je     4013be <_ScmNamedPipeThread@4+0x8e>
  40136f:	8b 95 e4 f7 ff ff    	mov    0xfffff7e4(%ebp),%edx
  401375:	85 d2                	test   %edx,%edx
  401377:	74 45                	je     4013be <_ScmNamedPipeThread@4+0x8e>
            break;
        }
        if (ScmNamedPipeHandleRequest(&chRequest, cbBytesRead, &chReply, &cbReplyBytes)) {
  401379:	8d 85 e0 f7 ff ff    	lea    0xfffff7e0(%ebp),%eax
  40137f:	50                   	push   %eax
  401380:	57                   	push   %edi
  401381:	52                   	push   %edx
  401382:	56                   	push   %esi
  401383:	e8 78 ff ff ff       	call   401300 <_ScmNamedPipeHandleRequest>
  401388:	83 c4 10             	add    $0x10,%esp
  40138b:	85 c0                	test   %eax,%eax
  40138d:	74 c1                	je     401350 <_ScmNamedPipeThread@4+0x20>
            fSuccess = WriteFile(hPipe,
  40138f:	83 ec 0c             	sub    $0xc,%esp
  401392:	8d 85 dc f7 ff ff    	lea    0xfffff7dc(%ebp),%eax
  401398:	6a 00                	push   $0x0
  40139a:	50                   	push   %eax
  40139b:	8b 85 e0 f7 ff ff    	mov    0xfffff7e0(%ebp),%eax
  4013a1:	50                   	push   %eax
  4013a2:	57                   	push   %edi
  4013a3:	53                   	push   %ebx
  4013a4:	e8 b7 10 00 00       	call   402460 <_WriteFile@20>
                                 &chReply,
                                 cbReplyBytes,
                                 &cbWritten,
                                 NULL);
            if (!fSuccess || cbReplyBytes != cbWritten) {
  4013a9:	83 c4 0c             	add    $0xc,%esp
  4013ac:	85 c0                	test   %eax,%eax
  4013ae:	74 0e                	je     4013be <_ScmNamedPipeThread@4+0x8e>
  4013b0:	8b 85 dc f7 ff ff    	mov    0xfffff7dc(%ebp),%eax
  4013b6:	39 85 e0 f7 ff ff    	cmp    %eax,0xfffff7e0(%ebp)
  4013bc:	74 92                	je     401350 <_ScmNamedPipeThread@4+0x20>
                break;
            }
        }
    }
    DPRINT("ScmNamedPipeThread(%x) - Disconnecting named pipe connection\n", hPipe);
    FlushFileBuffers(hPipe);
  4013be:	83 ec 0c             	sub    $0xc,%esp
  4013c1:	53                   	push   %ebx
  4013c2:	e8 a9 10 00 00       	call   402470 <_FlushFileBuffers@4>
    DisconnectNamedPipe(hPipe);
  4013c7:	53                   	push   %ebx
  4013c8:	e8 b3 10 00 00       	call   402480 <_DisconnectNamedPipe@4>
    CloseHandle(hPipe);
  4013cd:	53                   	push   %ebx
  4013ce:	e8 bd 10 00 00       	call   402490 <_CloseHandle@4>
    DPRINT("ScmNamedPipeThread(%x) - Done.\n", hPipe);
    return ERROR_SUCCESS;
}
  4013d3:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  4013d6:	31 c0                	xor    %eax,%eax
  4013d8:	5b                   	pop    %ebx
  4013d9:	5e                   	pop    %esi
  4013da:	5f                   	pop    %edi
  4013db:	5d                   	pop    %ebp
  4013dc:	c2 04 00             	ret    $0x4
  4013df:	90                   	nop    

004013e0 <_ScmCreateNamedPipe>:

BOOL ScmCreateNamedPipe(VOID)
{
  4013e0:	55                   	push   %ebp
  4013e1:	89 e5                	mov    %esp,%ebp
  4013e3:	53                   	push   %ebx
  4013e4:	50                   	push   %eax
    DWORD dwThreadId;
    BOOL fConnected;
    HANDLE hThread;
    HANDLE hPipe;

    DPRINT("ScmCreateNamedPipe() - CreateNamedPipe(\"\\\\.\\pipe\\Ntsvcs\")\n");

    hPipe = CreateNamedPipe("\\\\.\\pipe\\Ntsvcs",
  4013e5:	6a 00                	push   $0x0
  4013e7:	68 e8 03 00 00       	push   $0x3e8
  4013ec:	68 00 04 00 00       	push   $0x400
  4013f1:	68 00 04 00 00       	push   $0x400
  4013f6:	68 ff 00 00 00       	push   $0xff
  4013fb:	6a 06                	push   $0x6
  4013fd:	6a 03                	push   $0x3
  4013ff:	68 28 40 40 00       	push   $0x404028
  401404:	e8 97 10 00 00       	call   4024a0 <_CreateNamedPipeA@32>
              PIPE_ACCESS_DUPLEX,
              PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
              PIPE_UNLIMITED_INSTANCES,
              PIPE_BUFSIZE,
              PIPE_BUFSIZE,
              PIPE_TIMEOUT,
              NULL);
    if (hPipe == INVALID_HANDLE_VALUE) {
        DPRINT("CreateNamedPipe() failed (%d)\n", GetLastError());
        return FALSE;
  401409:	31 d2                	xor    %edx,%edx
  40140b:	89 c3                	mov    %eax,%ebx
  40140d:	83 f8 ff             	cmp    $0xffffffff,%eax
  401410:	74 32                	je     401444 <_ScmCreateNamedPipe+0x64>
    }

    DPRINT("CreateNamedPipe() - calling ConnectNamedPipe(%x)\n", hPipe);
    fConnected = ConnectNamedPipe(hPipe,
  401412:	50                   	push   %eax
  401413:	50                   	push   %eax
  401414:	6a 00                	push   $0x0
  401416:	53                   	push   %ebx
  401417:	e8 94 10 00 00       	call   4024b0 <_ConnectNamedPipe@8>
  40141c:	5a                   	pop    %edx
  40141d:	85 c0                	test   %eax,%eax
  40141f:	59                   	pop    %ecx
  401420:	74 2e                	je     401450 <_ScmCreateNamedPipe+0x70>
                   NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);
    DPRINT("CreateNamedPipe() - ConnectNamedPipe() returned %d\n", fConnected);

    if (fConnected) {
        DPRINT("Pipe connected\n");
        hThread = CreateThread(NULL,
  401422:	50                   	push   %eax
  401423:	50                   	push   %eax
  401424:	8d 45 f8             	lea    0xfffffff8(%ebp),%eax
  401427:	50                   	push   %eax
  401428:	6a 00                	push   $0x0
  40142a:	53                   	push   %ebx
  40142b:	68 30 13 40 00       	push   $0x401330
  401430:	6a 00                	push   $0x0
  401432:	6a 00                	push   $0x0
  401434:	e8 87 10 00 00       	call   4024c0 <_CreateThread@24>
                               0,
                               ScmNamedPipeThread,
                               (LPVOID)hPipe,
                               0,
                               &dwThreadId);
        if (!hThread) {
  401439:	5a                   	pop    %edx
  40143a:	85 c0                	test   %eax,%eax
  40143c:	59                   	pop    %ecx
            DPRINT("Could not create thread (%d)\n", GetLastError());
            DisconnectNamedPipe(hPipe);
            CloseHandle(hPipe);
            DPRINT("CreateNamedPipe() - returning FALSE\n");
           return FALSE;
        }
    } else {
        DPRINT("Pipe not connected\n");
        CloseHandle(hPipe);
        DPRINT("CreateNamedPipe() - returning FALSE\n");
        return FALSE;
    }
    DPRINT("CreateNamedPipe() - returning TRUE\n");
    return TRUE;
  40143d:	ba 01 00 00 00       	mov    $0x1,%edx
  401442:	74 2a                	je     40146e <_ScmCreateNamedPipe+0x8e>
}
  401444:	89 d0                	mov    %edx,%eax
  401446:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  401449:	c9                   	leave  
  40144a:	c3                   	ret    
  40144b:	90                   	nop    
  40144c:	8d 74 26 00          	lea    0x0(%esi),%esi
  401450:	e8 db 0f 00 00       	call   402430 <_GetLastError@0>
  401455:	3d 17 02 00 00       	cmp    $0x217,%eax
  40145a:	74 c6                	je     401422 <_ScmCreateNamedPipe+0x42>
  40145c:	83 ec 0c             	sub    $0xc,%esp
  40145f:	53                   	push   %ebx
  401460:	e8 2b 10 00 00       	call   402490 <_CloseHandle@4>
  401465:	31 d2                	xor    %edx,%edx
  401467:	89 d0                	mov    %edx,%eax
  401469:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  40146c:	c9                   	leave  
  40146d:	c3                   	ret    
  40146e:	83 ec 0c             	sub    $0xc,%esp
  401471:	53                   	push   %ebx
  401472:	e8 09 10 00 00       	call   402480 <_DisconnectNamedPipe@4>
  401477:	53                   	push   %ebx
  401478:	e8 13 10 00 00       	call   402490 <_CloseHandle@4>
  40147d:	31 d2                	xor    %edx,%edx
  40147f:	eb e6                	jmp    401467 <_ScmCreateNamedPipe+0x87>
  401481:	eb 0d                	jmp    401490 <_ScmNamedPipeListenerThread@4>
  401483:	90                   	nop    
  401484:	90                   	nop    
  401485:	90                   	nop    
  401486:	90                   	nop    
  401487:	90                   	nop    
  401488:	90                   	nop    
  401489:	90                   	nop    
  40148a:	90                   	nop    
  40148b:	90                   	nop    
  40148c:	90                   	nop    
  40148d:	90                   	nop    
  40148e:	90                   	nop    
  40148f:	90                   	nop    

00401490 <_ScmNamedPipeListenerThread@4>:

DWORD
WINAPI
ScmNamedPipeListenerThread(LPVOID Context)
{
  401490:	55                   	push   %ebp
  401491:	89 e5                	mov    %esp,%ebp
  401493:	50                   	push   %eax
  401494:	50                   	push   %eax
  401495:	eb 0d                	jmp    4014a4 <_ScmNamedPipeListenerThread@4+0x14>
//    HANDLE hPipe;
    DPRINT("ScmNamedPipeListenerThread(%x) - aka SCM.\n", Context);

//    hPipe = (HANDLE)Context;
    for (;;) {
        DPRINT("SCM: Waiting for new connection on named pipe...\n");
        /* Create named pipe */
        if (!ScmCreateNamedPipe()) {
            DPRINT1("\nSCM: Failed to create named pipe\n");
            break;
            //ExitThread(0);
        }
        DPRINT("\nSCM: named pipe session created.\n");
        Sleep(10);
  401497:	83 ec 0c             	sub    $0xc,%esp
  40149a:	6a 0a                	push   $0xa
  40149c:	e8 2f 10 00 00       	call   4024d0 <_Sleep@4>
  4014a1:	83 c4 0c             	add    $0xc,%esp
  4014a4:	e8 37 ff ff ff       	call   4013e0 <_ScmCreateNamedPipe>
  4014a9:	85 c0                	test   %eax,%eax
  4014ab:	75 ea                	jne    401497 <_ScmNamedPipeListenerThread@4+0x7>
  4014ad:	50                   	push   %eax
  4014ae:	68 d9 00 00 00       	push   $0xd9
  4014b3:	68 38 40 40 00       	push   $0x404038
  4014b8:	68 43 40 40 00       	push   $0x404043
  4014bd:	e8 2e 0e 00 00       	call   4022f0 <_DbgPrint>
  4014c2:	c7 04 24 4c 40 40 00 	movl   $0x40404c,(%esp)
  4014c9:	e8 22 0e 00 00       	call   4022f0 <_DbgPrint>
  4014ce:	83 c4 10             	add    $0x10,%esp
    }
    DPRINT("\n\nWARNING: ScmNamedPipeListenerThread(%x) - Aborted.\n\n", Context);
    return ERROR_SUCCESS;
}
  4014d1:	31 c0                	xor    %eax,%eax
  4014d3:	c9                   	leave  
  4014d4:	c2 04 00             	ret    $0x4
  4014d7:	89 f6                	mov    %esi,%esi
  4014d9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

004014e0 <_StartScmNamedPipeThreadListener>:

BOOL StartScmNamedPipeThreadListener(void)
{
  4014e0:	55                   	push   %ebp
  4014e1:	89 e5                	mov    %esp,%ebp
  4014e3:	83 ec 10             	sub    $0x10,%esp
    DWORD dwThreadId;
    HANDLE hThread;

    hThread = CreateThread(NULL,
  4014e6:	8d 45 fc             	lea    0xfffffffc(%ebp),%eax
  4014e9:	50                   	push   %eax
  4014ea:	6a 00                	push   $0x0
  4014ec:	6a 00                	push   $0x0
  4014ee:	68 90 14 40 00       	push   $0x401490
  4014f3:	6a 00                	push   $0x0
  4014f5:	6a 00                	push   $0x0
  4014f7:	e8 c4 0f 00 00       	call   4024c0 <_CreateThread@24>
                 0,
                 ScmNamedPipeListenerThread,
                 NULL, /*(LPVOID)hPipe,*/
                 0,
                 &dwThreadId);

    if (!hThread) {
  4014fc:	5a                   	pop    %edx
  4014fd:	85 c0                	test   %eax,%eax
  4014ff:	59                   	pop    %ecx
        DPRINT1("SERVICES: Could not create thread (Status %lx)\n", GetLastError());
        return FALSE;
    }
    return TRUE;
  401500:	ba 01 00 00 00       	mov    $0x1,%edx
  401505:	74 04                	je     40150b <_StartScmNamedPipeThreadListener+0x2b>
}
  401507:	89 d0                	mov    %edx,%eax
  401509:	c9                   	leave  
  40150a:	c3                   	ret    
  40150b:	50                   	push   %eax
  40150c:	68 f1 00 00 00       	push   $0xf1
  401511:	68 38 40 40 00       	push   $0x404038
  401516:	68 43 40 40 00       	push   $0x404043
  40151b:	e8 d0 0d 00 00       	call   4022f0 <_DbgPrint>
  401520:	e8 0b 0f 00 00       	call   402430 <_GetLastError@0>
  401525:	5a                   	pop    %edx
  401526:	59                   	pop    %ecx
  401527:	50                   	push   %eax
  401528:	68 70 40 40 00       	push   $0x404070
  40152d:	e8 be 0d 00 00       	call   4022f0 <_DbgPrint>
  401532:	31 d2                	xor    %edx,%edx
  401534:	89 d0                	mov    %edx,%eax
  401536:	c9                   	leave  
  401537:	c3                   	ret    
  401538:	90                   	nop    
  401539:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00401540 <@AcquireLoadDriverPrivilege@0>:

VOID FASTCALL
AcquireLoadDriverPrivilege(VOID)
{
  401540:	55                   	push   %ebp
  401541:	89 e5                	mov    %esp,%ebp
  401543:	53                   	push   %ebx
  401544:	83 ec 28             	sub    $0x28,%esp
    HANDLE hToken; 
    TOKEN_PRIVILEGES tkp; 

    /* Get a token for this process.  */
    if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
  401547:	8d 45 e4             	lea    0xffffffe4(%ebp),%eax
  40154a:	50                   	push   %eax
  40154b:	6a 28                	push   $0x28
  40154d:	51                   	push   %ecx
  40154e:	e8 8d 0f 00 00       	call   4024e0 <_GetCurrentProcess@0>
  401553:	89 04 24             	mov    %eax,(%esp)
  401556:	e8 45 17 00 00       	call   402ca0 <_OpenProcessToken@12>
  40155b:	5a                   	pop    %edx
  40155c:	85 c0                	test   %eax,%eax
  40155e:	75 05                	jne    401565 <@AcquireLoadDriverPrivilege@0+0x25>
        /* Get the LUID for the debug privilege.  */
        LookupPrivilegeValue(NULL, SE_LOAD_DRIVER_NAME, &tkp.Privileges[0].Luid); 

        tkp.PrivilegeCount = 1;  /* one privilege to set */
        tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

        /* Get the debug privilege for this process. */
        AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0); 
    }
}
  401560:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  401563:	c9                   	leave  
  401564:	c3                   	ret    
  401565:	50                   	push   %eax
  401566:	8d 45 ec             	lea    0xffffffec(%ebp),%eax
  401569:	8d 5d e8             	lea    0xffffffe8(%ebp),%ebx
  40156c:	50                   	push   %eax
  40156d:	68 a0 40 40 00       	push   $0x4040a0
  401572:	6a 00                	push   $0x0
  401574:	e8 37 17 00 00       	call   402cb0 <_LookupPrivilegeValueA@12>
  401579:	c7 45 e8 01 00 00 00 	movl   $0x1,0xffffffe8(%ebp)
  401580:	c7 45 f4 02 00 00 00 	movl   $0x2,0xfffffff4(%ebp)
  401587:	50                   	push   %eax
  401588:	6a 00                	push   $0x0
  40158a:	6a 00                	push   $0x0
  40158c:	6a 00                	push   $0x0
  40158e:	53                   	push   %ebx
  40158f:	6a 00                	push   $0x0
  401591:	8b 45 e4             	mov    0xffffffe4(%ebp),%eax
  401594:	50                   	push   %eax
  401595:	e8 26 17 00 00       	call   402cc0 <_AdjustTokenPrivileges@24>
  40159a:	5b                   	pop    %ebx
  40159b:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  40159e:	58                   	pop    %eax
  40159f:	c9                   	leave  
  4015a0:	c3                   	ret    
  4015a1:	eb 0d                	jmp    4015b0 <_WinMain@16>
  4015a3:	90                   	nop    
  4015a4:	90                   	nop    
  4015a5:	90                   	nop    
  4015a6:	90                   	nop    
  4015a7:	90                   	nop    
  4015a8:	90                   	nop    
  4015a9:	90                   	nop    
  4015aa:	90                   	nop    
  4015ab:	90                   	nop    
  4015ac:	90                   	nop    
  4015ad:	90                   	nop    
  4015ae:	90                   	nop    
  4015af:	90                   	nop    

004015b0 <_WinMain@16>:

int STDCALL
WinMain(HINSTANCE hInstance,
    HINSTANCE hPrevInstance,
    LPSTR lpCmdLine,
    int nShowCmd)
{
  4015b0:	55                   	push   %ebp
  4015b1:	89 e5                	mov    %esp,%ebp
  4015b3:	53                   	push   %ebx
  4015b4:	50                   	push   %eax
  HANDLE hScmStartEvent;
  HANDLE hEvent;
  NTSTATUS Status;

  DPRINT("SERVICES: Service Control Manager\n");

  /* Acquire privileges to load drivers */
  AcquireLoadDriverPrivilege();
  4015b5:	e8 86 ff ff ff       	call   401540 <@AcquireLoadDriverPrivilege@0>

  /* Create start event */
  if (!ScmCreateStartEvent(&hScmStartEvent))
  4015ba:	83 ec 0c             	sub    $0xc,%esp
  4015bd:	8d 45 f8             	lea    0xfffffff8(%ebp),%eax
  4015c0:	50                   	push   %eax
  4015c1:	e8 da fc ff ff       	call   4012a0 <_ScmCreateStartEvent>
  4015c6:	83 c4 10             	add    $0x10,%esp
  4015c9:	85 c0                	test   %eax,%eax
  4015cb:	74 42                	je     40160f <_WinMain@16+0x5f>
    {
      DPRINT1("SERVICES: Failed to create start event\n");
      ExitThread(0);
    }

  DPRINT("SERVICES: created start event with handle %x.\n", hScmStartEvent);

  /* FIXME: more initialization */


  /* Create the service database */
  Status = ScmCreateServiceDataBase();
  4015cd:	e8 fe 01 00 00       	call   4017d0 <_ScmCreateServiceDataBase>
  4015d2:	89 c3                	mov    %eax,%ebx
  if (!NT_SUCCESS(Status))
  4015d4:	85 c0                	test   %eax,%eax
  4015d6:	78 55                	js     40162d <_WinMain@16+0x7d>
    {
      DPRINT1("SERVICES: failed to create SCM database (Status %lx)\n", Status);
      ExitThread(0);
    }

  /* Update service database */
  ScmGetBootAndSystemDriverState();
  4015d8:	e8 13 06 00 00       	call   401bf0 <_ScmGetBootAndSystemDriverState>

#if 0
    DPRINT("SERVICES: Attempting to create named pipe...\n");
    /* Create named pipe */
    if (!ScmCreateNamedPipe()) {
        DPRINT1("SERVICES: Failed to create named pipe\n");
        ExitThread(0);
    }
    DPRINT("SERVICES: named pipe created successfully.\n");
#else
    DPRINT("SERVICES: Attempting to create named pipe listener...\n");
    if (!StartScmNamedPipeThreadListener()) {
  4015dd:	e8 fe fe ff ff       	call   4014e0 <_StartScmNamedPipeThreadListener>
  4015e2:	85 c0                	test   %eax,%eax
  4015e4:	75 66                	jne    40164c <_WinMain@16+0x9c>
        DPRINT1("SERVICES: Failed to create named pipe listener thread.\n");
  4015e6:	53                   	push   %ebx
  4015e7:	68 3b 01 00 00       	push   $0x13b
  4015ec:	68 38 40 40 00       	push   $0x404038
  4015f1:	68 43 40 40 00       	push   $0x404043
  4015f6:	e8 f5 0c 00 00       	call   4022f0 <_DbgPrint>
  4015fb:	c7 04 24 b8 40 40 00 	movl   $0x4040b8,(%esp)
  401602:	e8 e9 0c 00 00       	call   4022f0 <_DbgPrint>
  401607:	58                   	pop    %eax
        ExitThread(0);
    }
    DPRINT("SERVICES: named pipe listener thread created.\n");
#endif
   /* FIXME: create listener thread for pipe */


  /* Register service process with CSRSS */
  RegisterServicesProcess(GetCurrentProcessId());

  DPRINT("SERVICES: Initialized.\n");

  /* Signal start event */
  SetEvent(hScmStartEvent);

  /* FIXME: register event handler (used for system shutdown) */
//  SetConsoleCtrlHandler(...);


  /* Start auto-start services */
  ScmAutoStartServices();

  /* FIXME: more to do ? */


  DPRINT("SERVICES: Running.\n");

#if 1
  hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
  WaitForSingleObject(hEvent, INFINITE);
#else
    for (;;)
      {
    NtYieldExecution();
      }
#endif

  DPRINT("SERVICES: Finished.\n");

  ExitThread(0);
  401608:	6a 00                	push   $0x0
  40160a:	e8 e1 0e 00 00       	call   4024f0 <_ExitThread@4>
  40160f:	53                   	push   %ebx
  401610:	68 1c 01 00 00       	push   $0x11c
  401615:	68 38 40 40 00       	push   $0x404038
  40161a:	68 43 40 40 00       	push   $0x404043
  40161f:	e8 cc 0c 00 00       	call   4022f0 <_DbgPrint>
  401624:	c7 04 24 f0 40 40 00 	movl   $0x4040f0,(%esp)
  40162b:	eb d5                	jmp    401602 <_WinMain@16+0x52>
  40162d:	51                   	push   %ecx
  40162e:	68 29 01 00 00       	push   $0x129
  401633:	68 38 40 40 00       	push   $0x404038
  401638:	68 43 40 40 00       	push   $0x404043
  40163d:	e8 ae 0c 00 00       	call   4022f0 <_DbgPrint>
  401642:	58                   	pop    %eax
  401643:	5a                   	pop    %edx
  401644:	53                   	push   %ebx
  401645:	68 18 41 40 00       	push   $0x404118
  40164a:	eb b6                	jmp    401602 <_WinMain@16+0x52>
  40164c:	83 ec 10             	sub    $0x10,%esp
  40164f:	e8 ac 0e 00 00       	call   402500 <_GetCurrentProcessId@0>
  401654:	89 04 24             	mov    %eax,(%esp)
  401657:	e8 34 0f 00 00       	call   402590 <_RegisterServicesProcess@4>
  40165c:	8b 4d f8             	mov    0xfffffff8(%ebp),%ecx
  40165f:	51                   	push   %ecx
  401660:	e8 ab 0e 00 00       	call   402510 <_SetEvent@4>
  401665:	83 c4 0c             	add    $0xc,%esp
  401668:	e8 a3 0a 00 00       	call   402110 <_ScmAutoStartServices>
  40166d:	6a 00                	push   $0x0
  40166f:	6a 00                	push   $0x0
  401671:	6a 01                	push   $0x1
  401673:	6a 00                	push   $0x0
  401675:	e8 a6 0d 00 00       	call   402420 <_CreateEventA@16>
  40167a:	52                   	push   %edx
  40167b:	52                   	push   %edx
  40167c:	6a ff                	push   $0xffffffff
  40167e:	50                   	push   %eax
  40167f:	e8 9c 0e 00 00       	call   402520 <_WaitForSingleObject@8>
  401684:	53                   	push   %ebx
  401685:	eb 81                	jmp    401608 <_WinMain@16+0x58>
  401687:	90                   	nop    
  401688:	90                   	nop    
  401689:	90                   	nop    
  40168a:	90                   	nop    
  40168b:	90                   	nop    
  40168c:	90                   	nop    
  40168d:	90                   	nop    
  40168e:	90                   	nop    
  40168f:	90                   	nop    

00401690 <_CreateGroupOrderListRoutine@24>:
			    PVOID ValueData,
			    ULONG ValueLength,
			    PVOID Context,
			    PVOID EntryContext)
{
  401690:	55                   	push   %ebp
  401691:	89 e5                	mov    %esp,%ebp
  401693:	57                   	push   %edi
  401694:	56                   	push   %esi
  401695:	53                   	push   %ebx
  401696:	83 ec 0c             	sub    $0xc,%esp
  401699:	8b 5d 10             	mov    0x10(%ebp),%ebx
  40169c:	8b 75 14             	mov    0x14(%ebp),%esi
  PSERVICE_GROUP Group;

  DPRINT("IopGetGroupOrderList(%S, %x, %x, %x, %x, %x)\n",
         ValueName, ValueType, ValueData, ValueLength, Context, EntryContext);

  if (ValueType == REG_BINARY &&
  40169f:	83 7d 0c 03          	cmpl   $0x3,0xc(%ebp)
  4016a3:	0f 94 c2             	sete   %dl
  4016a6:	85 db                	test   %ebx,%ebx
  4016a8:	8b 7d 18             	mov    0x18(%ebp),%edi
  4016ab:	0f 95 c0             	setne  %al
  4016ae:	25 ff 00 00 00       	and    $0xff,%eax
  4016b3:	85 c2                	test   %eax,%edx
  4016b5:	74 09                	je     4016c0 <_CreateGroupOrderListRoutine@24+0x30>
  4016b7:	83 fe 03             	cmp    $0x3,%esi
  4016ba:	77 14                	ja     4016d0 <_CreateGroupOrderListRoutine@24+0x40>
  4016bc:	8d 74 26 00          	lea    0x0(%esi),%esi
      ValueData != NULL &&
      ValueLength >= sizeof(DWORD) &&
      ValueLength >= (*(PULONG)ValueData + 1) * sizeof(DWORD))
    {
      Group = (PSERVICE_GROUP)Context;
      Group->TagCount = ((PULONG)ValueData)[0];
      if (Group->TagCount > 0)
        {
	  if (ValueLength >= (Group->TagCount + 1) * sizeof(DWORD))
            {
              Group->TagArray = (PULONG)HeapAlloc(GetProcessHeap(),
					          HEAP_ZERO_MEMORY,
					          Group->TagCount * sizeof(DWORD));
	      if (Group->TagArray == NULL)
	        {
		  Group->TagCount = 0;
	          return STATUS_INSUFFICIENT_RESOURCES;
		}
	      RtlCopyMemory(Group->TagArray, 
		            (PULONG)ValueData + 1, 
			    Group->TagCount * sizeof(DWORD));
	    }
	  else
	    {
	      Group->TagCount = 0;
	      return STATUS_UNSUCCESSFUL;
	    }
	}
    }
  return STATUS_SUCCESS;
  4016c0:	31 c0                	xor    %eax,%eax
}
  4016c2:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  4016c5:	5b                   	pop    %ebx
  4016c6:	5e                   	pop    %esi
  4016c7:	5f                   	pop    %edi
  4016c8:	5d                   	pop    %ebp
  4016c9:	c2 18 00             	ret    $0x18
  4016cc:	8d 74 26 00          	lea    0x0(%esi),%esi
  4016d0:	8b 13                	mov    (%ebx),%edx
  4016d2:	8d 0c 95 00 00 00 00 	lea    0x0(,%edx,4),%ecx
  4016d9:	8d 41 04             	lea    0x4(%ecx),%eax
  4016dc:	39 f0                	cmp    %esi,%eax
  4016de:	77 e0                	ja     4016c0 <_CreateGroupOrderListRoutine@24+0x30>
  4016e0:	89 57 14             	mov    %edx,0x14(%edi)
  4016e3:	85 d2                	test   %edx,%edx
  4016e5:	74 d9                	je     4016c0 <_CreateGroupOrderListRoutine@24+0x30>
  4016e7:	50                   	push   %eax
  4016e8:	51                   	push   %ecx
  4016e9:	6a 08                	push   $0x8
  4016eb:	50                   	push   %eax
  4016ec:	e8 3f 0e 00 00       	call   402530 <_GetProcessHeap@0>
  4016f1:	89 04 24             	mov    %eax,(%esp)
  4016f4:	e8 47 0e 00 00       	call   402540 <_HeapAlloc@12>
  4016f9:	89 c1                	mov    %eax,%ecx
  4016fb:	85 c0                	test   %eax,%eax
  4016fd:	89 47 18             	mov    %eax,0x18(%edi)
  401700:	5e                   	pop    %esi
  401701:	74 17                	je     40171a <_CreateGroupOrderListRoutine@24+0x8a>
  401703:	8b 47 14             	mov    0x14(%edi),%eax
  401706:	8d 53 04             	lea    0x4(%ebx),%edx
  401709:	c1 e0 02             	shl    $0x2,%eax
  40170c:	53                   	push   %ebx
  40170d:	50                   	push   %eax
  40170e:	52                   	push   %edx
  40170f:	51                   	push   %ecx
  401710:	e8 ab 0c 00 00       	call   4023c0 <_memcpy>
  401715:	83 c4 10             	add    $0x10,%esp
  401718:	eb a6                	jmp    4016c0 <_CreateGroupOrderListRoutine@24+0x30>
  40171a:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
  40171f:	c7 47 14 00 00 00 00 	movl   $0x0,0x14(%edi)
  401726:	eb 9a                	jmp    4016c2 <_CreateGroupOrderListRoutine@24+0x32>
  401728:	90                   	nop    
  401729:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00401730 <_CreateGroupListRoutine@24>:


static NTSTATUS STDCALL
CreateGroupListRoutine(PWSTR ValueName,
		       ULONG ValueType,
		       PVOID ValueData,
		       ULONG ValueLength,
		       PVOID Context,
		       PVOID EntryContext)
{
  401730:	55                   	push   %ebp
  401731:	89 e5                	mov    %esp,%ebp
  401733:	57                   	push   %edi
  401734:	56                   	push   %esi
  401735:	53                   	push   %ebx
  401736:	83 ec 4c             	sub    $0x4c,%esp
  401739:	8b 7d 10             	mov    0x10(%ebp),%edi
  PSERVICE_GROUP Group;
  RTL_QUERY_REGISTRY_TABLE QueryTable[2];
  NTSTATUS Status;

  if (ValueType == REG_SZ)
  40173c:	83 7d 0c 01          	cmpl   $0x1,0xc(%ebp)
  401740:	74 0e                	je     401750 <_CreateGroupListRoutine@24+0x20>
    {
      DPRINT("Data: '%S'\n", (PWCHAR)ValueData);

      Group = (PSERVICE_GROUP)HeapAlloc(GetProcessHeap(),
					HEAP_ZERO_MEMORY,
					sizeof(SERVICE_GROUP));
      if (Group == NULL)
	{
	  return STATUS_INSUFFICIENT_RESOURCES;
	}

      if (!RtlCreateUnicodeString(&Group->GroupName,
				  (PWSTR)ValueData))
	{
	  return STATUS_INSUFFICIENT_RESOURCES;
	}

      RtlZeroMemory(&QueryTable, sizeof(QueryTable));
      QueryTable[0].Name = (PWSTR)ValueData;
      QueryTable[0].QueryRoutine = CreateGroupOrderListRoutine;

      Status = RtlQueryRegistryValues(RTL_REGISTRY_CONTROL,
				      L"GroupOrderList",
				      QueryTable,
				      (PVOID)Group,
				      NULL);
      DPRINT("%x %d %S\n", Status, Group->TagCount, (PWSTR)ValueData);


      InsertTailList(&GroupListHead,
		     &Group->GroupListEntry);
    }

  return STATUS_SUCCESS;
  401742:	31 d2                	xor    %edx,%edx
}
  401744:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  401747:	89 d0                	mov    %edx,%eax
  401749:	5b                   	pop    %ebx
  40174a:	5e                   	pop    %esi
  40174b:	5f                   	pop    %edi
  40174c:	5d                   	pop    %ebp
  40174d:	c2 18 00             	ret    $0x18
  401750:	50                   	push   %eax
  401751:	6a 1c                	push   $0x1c
  401753:	6a 08                	push   $0x8
  401755:	50                   	push   %eax
  401756:	e8 d5 0d 00 00       	call   402530 <_GetProcessHeap@0>
  40175b:	89 04 24             	mov    %eax,(%esp)
  40175e:	e8 dd 0d 00 00       	call   402540 <_HeapAlloc@12>
  401763:	89 c6                	mov    %eax,%esi
  401765:	ba 9a 00 00 c0       	mov    $0xc000009a,%edx
  40176a:	58                   	pop    %eax
  40176b:	85 f6                	test   %esi,%esi
  40176d:	74 d5                	je     401744 <_CreateGroupListRoutine@24+0x14>
  40176f:	8d 46 08             	lea    0x8(%esi),%eax
  401772:	53                   	push   %ebx
  401773:	53                   	push   %ebx
  401774:	57                   	push   %edi
  401775:	50                   	push   %eax
  401776:	e8 85 0b 00 00       	call   402300 <_RtlCreateUnicodeString@8>
  40177b:	5a                   	pop    %edx
  40177c:	84 c0                	test   %al,%al
  40177e:	59                   	pop    %ecx
  40177f:	ba 9a 00 00 c0       	mov    $0xc000009a,%edx
  401784:	74 be                	je     401744 <_CreateGroupListRoutine@24+0x14>
  401786:	8d 5d a8             	lea    0xffffffa8(%ebp),%ebx
  401789:	50                   	push   %eax
  40178a:	50                   	push   %eax
  40178b:	6a 38                	push   $0x38
  40178d:	53                   	push   %ebx
  40178e:	e8 7d 0b 00 00       	call   402310 <_RtlZeroMemory@8>
  401793:	89 7d b0             	mov    %edi,0xffffffb0(%ebp)
  401796:	c7 45 a8 90 16 40 00 	movl   $0x401690,0xffffffa8(%ebp)
  40179d:	50                   	push   %eax
  40179e:	6a 00                	push   $0x0
  4017a0:	56                   	push   %esi
  4017a1:	53                   	push   %ebx
  4017a2:	68 50 41 40 00       	push   $0x404150
  4017a7:	6a 02                	push   $0x2
  4017a9:	e8 72 0b 00 00       	call   402320 <_RtlQueryRegistryValues@20>
	IN PLIST_ENTRY  ListHead,
	IN PLIST_ENTRY  Entry)
{
	PLIST_ENTRY OldBlink;
	OldBlink = ListHead->Blink;
  4017ae:	a1 74 50 40 00       	mov    0x405074,%eax
  4017b3:	83 c4 0c             	add    $0xc,%esp
	Entry->Flink = ListHead;
  4017b6:	c7 06 70 50 40 00    	movl   $0x405070,(%esi)
	Entry->Blink = OldBlink;
  4017bc:	89 46 04             	mov    %eax,0x4(%esi)
	OldBlink->Flink = Entry;
  4017bf:	89 30                	mov    %esi,(%eax)
	ListHead->Blink = Entry;
  4017c1:	89 35 74 50 40 00    	mov    %esi,0x405074
  4017c7:	e9 76 ff ff ff       	jmp    401742 <_CreateGroupListRoutine@24+0x12>
  4017cc:	8d 74 26 00          	lea    0x0(%esi),%esi

004017d0 <_ScmCreateServiceDataBase>:


static NTSTATUS STDCALL
CreateServiceListEntry(PUNICODE_STRING ServiceName)
{
  RTL_QUERY_REGISTRY_TABLE QueryTable[6];
  PSERVICE Service = NULL;
  NTSTATUS Status;

  DPRINT("Service: '%wZ'\n", ServiceName);

  /* Allocate service entry */
  Service = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
		      sizeof(SERVICE));
  if (Service == NULL)
    {
      return STATUS_INSUFFICIENT_RESOURCES;
    }

  /* Copy service name */
  Service->ServiceName.Length = ServiceName->Length;
  Service->ServiceName.MaximumLength = ServiceName->Length + sizeof(WCHAR);
  Service->ServiceName.Buffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
					  Service->ServiceName.MaximumLength);
  if (Service->ServiceName.Buffer == NULL)
    {
      HeapFree(GetProcessHeap(), 0, Service);
      return STATUS_INSUFFICIENT_RESOURCES;
    }

  RtlCopyMemory(Service->ServiceName.Buffer,
		ServiceName->Buffer,
		ServiceName->Length);
  Service->ServiceName.Buffer[ServiceName->Length / sizeof(WCHAR)] = 0;

  /* Build registry path */
  Service->RegistryPath.MaximumLength = MAX_PATH * sizeof(WCHAR);
  Service->RegistryPath.Buffer = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY,
					   MAX_PATH * sizeof(WCHAR));
  if (Service->ServiceName.Buffer == NULL)
    {
      HeapFree(GetProcessHeap(), 0, Service->ServiceName.Buffer);
      HeapFree(GetProcessHeap(), 0, Service);
      return STATUS_INSUFFICIENT_RESOURCES;
    }

  wcscpy(Service->RegistryPath.Buffer,
	 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\");
  wcscat(Service->RegistryPath.Buffer,
	 Service->ServiceName.Buffer);
  Service->RegistryPath.Length = wcslen(Service->RegistryPath.Buffer) * sizeof(WCHAR);

  /* Get service data */
  RtlZeroMemory(&QueryTable,
		sizeof(QueryTable));

  QueryTable[0].Name = L"Start";
  QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
  QueryTable[0].EntryContext = &Service->Start;

  QueryTable[1].Name = L"Type";
  QueryTable[1].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
  QueryTable[1].EntryContext = &Service->Type;

  QueryTable[2].Name = L"ErrorControl";
  QueryTable[2].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
  QueryTable[2].EntryContext = &Service->ErrorControl;

  QueryTable[3].Name = L"Group";
  QueryTable[3].Flags = RTL_QUERY_REGISTRY_DIRECT;
  QueryTable[3].EntryContext = &Service->ServiceGroup;

  QueryTable[4].Name = L"Tag";
  QueryTable[4].Flags = RTL_QUERY_REGISTRY_DIRECT;
  QueryTable[4].EntryContext = &Service->Tag;

  Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,
				  ServiceName->Buffer,
				  QueryTable,
				  NULL,
				  NULL);
  if (!NT_SUCCESS(Status))
    {
      PrintString("RtlQueryRegistryValues() failed (Status %lx)\n", Status);
      RtlFreeUnicodeString(&Service->RegistryPath);
      RtlFreeUnicodeString(&Service->ServiceName);
      HeapFree(GetProcessHeap(), 0, Service);
      return Status;
    }

  DPRINT("ServiceName: '%wZ'\n", &Service->ServiceName);
  DPRINT("RegistryPath: '%wZ'\n", &Service->RegistryPath);
  DPRINT("ServiceGroup: '%wZ'\n", &Service->ServiceGroup);
  DPRINT("Start %lx  Type %lx  Tag %lx  ErrorControl %lx\n",
	 Service->Start, Service->Type, Service->Tag, Service->ErrorControl);

  /* Append service entry */
  InsertTailList(&ServiceListHead,
		 &Service->ServiceListEntry);

  return STATUS_SUCCESS;
}


NTSTATUS
ScmCreateServiceDataBase(VOID)
{
  4017d0:	55                   	push   %ebp
  4017d1:	89 e5                	mov    %esp,%ebp
  4017d3:	57                   	push   %edi
  4017d4:	56                   	push   %esi
  4017d5:	53                   	push   %ebx
  4017d6:	81 ec 44 01 00 00    	sub    $0x144,%esp
  RTL_QUERY_REGISTRY_TABLE QueryTable[2];
  OBJECT_ATTRIBUTES ObjectAttributes;
  UNICODE_STRING ServicesKeyName;
  UNICODE_STRING SubKeyName;
  HKEY ServicesKey;
  ULONG Index;
  NTSTATUS Status;

  PKEY_BASIC_INFORMATION KeyInfo = NULL;
  ULONG KeyInfoLength = 0;
  ULONG ReturnedLength;

  DPRINT("ScmCreateServiceDataBase() called\n");

  /* Initialize basic variables */
  InitializeListHead(&GroupListHead);
  InitializeListHead(&ServiceListHead);

  /* Build group order list */
  RtlZeroMemory(&QueryTable,
  4017dc:	8d 5d a8             	lea    0xffffffa8(%ebp),%ebx
static __inline VOID
InitializeListHead(
	IN PLIST_ENTRY  ListHead)
{
	ListHead->Flink = ListHead->Blink = ListHead;
  4017df:	c7 05 74 50 40 00 70 	movl   $0x405070,0x405074
  4017e6:	50 40 00 
  4017e9:	c7 05 70 50 40 00 70 	movl   $0x405070,0x405070
  4017f0:	50 40 00 
  4017f3:	6a 38                	push   $0x38
static __inline VOID
InitializeListHead(
	IN PLIST_ENTRY  ListHead)
{
	ListHead->Flink = ListHead->Blink = ListHead;
  4017f5:	c7 05 64 50 40 00 60 	movl   $0x405060,0x405064
  4017fc:	50 40 00 
  4017ff:	c7 05 60 50 40 00 60 	movl   $0x405060,0x405060
  401806:	50 40 00 
  401809:	53                   	push   %ebx
  40180a:	e8 01 0b 00 00       	call   402310 <_RtlZeroMemory@8>
		sizeof(QueryTable));

  QueryTable[0].Name = L"List";
  40180f:	c7 45 b0 6e 41 40 00 	movl   $0x40416e,0xffffffb0(%ebp)
  QueryTable[0].QueryRoutine = CreateGroupListRoutine;
  401816:	c7 45 a8 30 17 40 00 	movl   $0x401730,0xffffffa8(%ebp)

  Status = RtlQueryRegistryValues(RTL_REGISTRY_CONTROL,
  40181d:	50                   	push   %eax
  40181e:	6a 00                	push   $0x0
  401820:	6a 00                	push   $0x0
  401822:	53                   	push   %ebx
  401823:	68 78 41 40 00       	push   $0x404178
  401828:	6a 02                	push   $0x2
  40182a:	e8 f1 0a 00 00       	call   402320 <_RtlQueryRegistryValues@20>
				  L"ServiceGroupOrder",
				  QueryTable,
				  NULL,
				  NULL);
  if (!NT_SUCCESS(Status))
  40182f:	83 c4 0c             	add    $0xc,%esp
  401832:	85 c0                	test   %eax,%eax
  401834:	0f 88 04 01 00 00    	js     40193e <_ScmCreateServiceDataBase+0x16e>
    return Status;

  RtlRosInitUnicodeStringFromLiteral(&ServicesKeyName,
		       L"\\Registry\\Machine\\System\\CurrentControlSet\\Services");

  InitializeObjectAttributes(&ObjectAttributes,
  40183a:	8d 85 d0 fe ff ff    	lea    0xfffffed0(%ebp),%eax
			     &ServicesKeyName,
			     OBJ_CASE_INSENSITIVE,
			     NULL,
			     NULL);

  Status = RtlpNtOpenKey(&ServicesKey,
  401840:	6a 00                	push   $0x0
  401842:	89 45 90             	mov    %eax,0xffffff90(%ebp)
  401845:	8d 45 88             	lea    0xffffff88(%ebp),%eax
  401848:	50                   	push   %eax
  401849:	8d 85 cc fe ff ff    	lea    0xfffffecc(%ebp),%eax
  40184f:	68 01 00 01 00       	push   $0x10001
  401854:	66 c7 85 d0 fe ff ff 	movw   $0x66,0xfffffed0(%ebp)
  40185b:	66 00 
  40185d:	66 c7 85 d2 fe ff ff 	movw   $0x68,0xfffffed2(%ebp)
  401864:	68 00 
  401866:	c7 85 d4 fe ff ff 9c 	movl   $0x40419c,0xfffffed4(%ebp)
  40186d:	41 40 00 
  401870:	c7 45 88 18 00 00 00 	movl   $0x18,0xffffff88(%ebp)
  401877:	c7 45 94 40 00 00 00 	movl   $0x40,0xffffff94(%ebp)
  40187e:	c7 45 8c 00 00 00 00 	movl   $0x0,0xffffff8c(%ebp)
  401885:	c7 45 98 00 00 00 00 	movl   $0x0,0xffffff98(%ebp)
  40188c:	c7 45 9c 00 00 00 00 	movl   $0x0,0xffffff9c(%ebp)
  401893:	50                   	push   %eax
  401894:	e8 97 0a 00 00       	call   402330 <_RtlpNtOpenKey@16>
			 0x10001,
			 &ObjectAttributes,
			 0);
  if (!NT_SUCCESS(Status))
  401899:	85 c0                	test   %eax,%eax
  40189b:	0f 88 9d 00 00 00    	js     40193e <_ScmCreateServiceDataBase+0x16e>
    return Status;

  /* Allocate key info buffer */
  KeyInfoLength = sizeof(KEY_BASIC_INFORMATION) + MAX_PATH * sizeof(WCHAR);
  KeyInfo = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, KeyInfoLength);
  4018a1:	50                   	push   %eax
  4018a2:	68 20 02 00 00       	push   $0x220
  4018a7:	6a 08                	push   $0x8
  4018a9:	50                   	push   %eax
  4018aa:	e8 81 0c 00 00       	call   402530 <_GetProcessHeap@0>
  4018af:	89 04 24             	mov    %eax,(%esp)
  4018b2:	e8 89 0c 00 00       	call   402540 <_HeapAlloc@12>
  4018b7:	89 c6                	mov    %eax,%esi
  if (KeyInfo == NULL)
  4018b9:	58                   	pop    %eax
  4018ba:	85 f6                	test   %esi,%esi
  4018bc:	0f 84 08 03 00 00    	je     401bca <_ScmCreateServiceDataBase+0x3fa>
    {
      NtClose(ServicesKey);
      return STATUS_INSUFFICIENT_RESOURCES;
    }

  Index = 0;
  4018c2:	31 ff                	xor    %edi,%edi
  while (TRUE)
    {
      Status = NtEnumerateKey(ServicesKey,
  4018c4:	50                   	push   %eax
  4018c5:	8b 9d cc fe ff ff    	mov    0xfffffecc(%ebp),%ebx
  4018cb:	50                   	push   %eax
  4018cc:	8d 85 c8 fe ff ff    	lea    0xfffffec8(%ebp),%eax
  4018d2:	50                   	push   %eax
  4018d3:	68 20 02 00 00       	push   $0x220
  4018d8:	56                   	push   %esi
  4018d9:	6a 00                	push   $0x0
  4018db:	57                   	push   %edi
  4018dc:	53                   	push   %ebx
  4018dd:	e8 5e 0a 00 00       	call   402340 <_NtEnumerateKey@24>
			      Index,
			      KeyBasicInformation,
			      KeyInfo,
			      KeyInfoLength,
			      &ReturnedLength);
      if (NT_SUCCESS(Status))
  4018e2:	5a                   	pop    %edx
  4018e3:	85 c0                	test   %eax,%eax
  4018e5:	59                   	pop    %ecx
  4018e6:	78 34                	js     40191c <_ScmCreateServiceDataBase+0x14c>
	{
	  if (KeyInfo->NameLength < MAX_PATH * sizeof(WCHAR))
  4018e8:	8b 4e 0c             	mov    0xc(%esi),%ecx
  4018eb:	81 f9 07 02 00 00    	cmp    $0x207,%ecx
  4018f1:	76 53                	jbe    401946 <_ScmCreateServiceDataBase+0x176>
	    {

	      SubKeyName.Length = KeyInfo->NameLength;
	      SubKeyName.MaximumLength = KeyInfo->NameLength + sizeof(WCHAR);
	      SubKeyName.Buffer = KeyInfo->Name;
	      SubKeyName.Buffer[SubKeyName.Length / sizeof(WCHAR)] = 0;

	      DPRINT("KeyName: '%wZ'\n", &SubKeyName);
	      Status = CreateServiceListEntry(&SubKeyName);

	      /* Ignore services without proper registry. */
	      if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
	        {
	          Status = STATUS_SUCCESS;
	        }
	    }
	}

      if (!NT_SUCCESS(Status))
  4018f3:	85 c0                	test   %eax,%eax
  4018f5:	78 25                	js     40191c <_ScmCreateServiceDataBase+0x14c>
	break;

      Index++;
  4018f7:	47                   	inc    %edi
  4018f8:	8b 9d cc fe ff ff    	mov    0xfffffecc(%ebp),%ebx
  4018fe:	50                   	push   %eax
  4018ff:	50                   	push   %eax
  401900:	8d 85 c8 fe ff ff    	lea    0xfffffec8(%ebp),%eax
  401906:	50                   	push   %eax
  401907:	68 20 02 00 00       	push   $0x220
  40190c:	56                   	push   %esi
  40190d:	6a 00                	push   $0x0
  40190f:	57                   	push   %edi
  401910:	53                   	push   %ebx
  401911:	e8 2a 0a 00 00       	call   402340 <_NtEnumerateKey@24>
  401916:	5a                   	pop    %edx
  401917:	85 c0                	test   %eax,%eax
  401919:	59                   	pop    %ecx
  40191a:	79 cc                	jns    4018e8 <_ScmCreateServiceDataBase+0x118>
    }

  HeapFree(GetProcessHeap(), 0, KeyInfo);
  40191c:	52                   	push   %edx
  40191d:	56                   	push   %esi
  40191e:	6a 00                	push   $0x0
  401920:	50                   	push   %eax
  401921:	e8 0a 0c 00 00       	call   402530 <_GetProcessHeap@0>
  401926:	89 04 24             	mov    %eax,(%esp)
  401929:	e8 22 0c 00 00       	call   402550 <_HeapFree@12>
  NtClose(ServicesKey);
  40192e:	50                   	push   %eax
  40192f:	50                   	push   %eax
  401930:	8b 85 cc fe ff ff    	mov    0xfffffecc(%ebp),%eax
  401936:	50                   	push   %eax
  401937:	e8 14 0a 00 00       	call   402350 <_NtClose@4>

  DPRINT("ScmCreateServiceDataBase() done\n");

  return STATUS_SUCCESS;
  40193c:	31 c0                	xor    %eax,%eax
}
  40193e:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  401941:	5b                   	pop    %ebx
  401942:	5e                   	pop    %esi
  401943:	5f                   	pop    %edi
  401944:	5d                   	pop    %ebp
  401945:	c3                   	ret    
  401946:	8d 41 02             	lea    0x2(%ecx),%eax
  401949:	8d 56 10             	lea    0x10(%esi),%edx
  40194c:	66 89 85 c2 fe ff ff 	mov    %ax,0xfffffec2(%ebp)
  401953:	89 c8                	mov    %ecx,%eax
  401955:	66 d1 e8             	shr    %ax
  401958:	66 89 8d c0 fe ff ff 	mov    %cx,0xfffffec0(%ebp)
  40195f:	25 ff ff 00 00       	and    $0xffff,%eax
  401964:	89 95 c4 fe ff ff    	mov    %edx,0xfffffec4(%ebp)
  40196a:	66 c7 04 42 00 00    	movw   $0x0,(%edx,%eax,2)
  401970:	50                   	push   %eax
  401971:	6a 40                	push   $0x40
  401973:	6a 08                	push   $0x8
  401975:	53                   	push   %ebx
  401976:	e8 b5 0b 00 00       	call   402530 <_GetProcessHeap@0>
  40197b:	89 04 24             	mov    %eax,(%esp)
  40197e:	e8 bd 0b 00 00       	call   402540 <_HeapAlloc@12>
  401983:	89 c3                	mov    %eax,%ebx
  401985:	59                   	pop    %ecx
  401986:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
  40198b:	85 db                	test   %ebx,%ebx
  40198d:	0f 84 ad 01 00 00    	je     401b40 <_ScmCreateServiceDataBase+0x370>
  401993:	8b 85 c0 fe ff ff    	mov    0xfffffec0(%ebp),%eax
  401999:	66 89 43 08          	mov    %ax,0x8(%ebx)
  40199d:	8b 85 c0 fe ff ff    	mov    0xfffffec0(%ebp),%eax
  4019a3:	83 c0 02             	add    $0x2,%eax
  4019a6:	66 89 43 0a          	mov    %ax,0xa(%ebx)
  4019aa:	25 ff ff 00 00       	and    $0xffff,%eax
  4019af:	52                   	push   %edx
  4019b0:	50                   	push   %eax
  4019b1:	6a 08                	push   $0x8
  4019b3:	51                   	push   %ecx
  4019b4:	e8 77 0b 00 00       	call   402530 <_GetProcessHeap@0>
  4019b9:	89 04 24             	mov    %eax,(%esp)
  4019bc:	e8 7f 0b 00 00       	call   402540 <_HeapAlloc@12>
  4019c1:	5a                   	pop    %edx
  4019c2:	85 c0                	test   %eax,%eax
  4019c4:	89 c2                	mov    %eax,%edx
  4019c6:	89 43 0c             	mov    %eax,0xc(%ebx)
  4019c9:	0f 84 96 01 00 00    	je     401b65 <_ScmCreateServiceDataBase+0x395>
  4019cf:	8b 85 c0 fe ff ff    	mov    0xfffffec0(%ebp),%eax
  4019d5:	25 ff ff 00 00       	and    $0xffff,%eax
  4019da:	51                   	push   %ecx
  4019db:	50                   	push   %eax
  4019dc:	8b 85 c4 fe ff ff    	mov    0xfffffec4(%ebp),%eax
  4019e2:	50                   	push   %eax
  4019e3:	52                   	push   %edx
  4019e4:	e8 d7 09 00 00       	call   4023c0 <_memcpy>
  4019e9:	8b 85 c0 fe ff ff    	mov    0xfffffec0(%ebp),%eax
  4019ef:	66 d1 e8             	shr    %ax
  4019f2:	8b 53 0c             	mov    0xc(%ebx),%edx
  4019f5:	25 ff ff 00 00       	and    $0xffff,%eax
  4019fa:	83 c4 0c             	add    $0xc,%esp
  4019fd:	66 c7 04 42 00 00    	movw   $0x0,(%edx,%eax,2)
  401a03:	66 c7 43 12 08 02    	movw   $0x208,0x12(%ebx)
  401a09:	68 08 02 00 00       	push   $0x208
  401a0e:	6a 08                	push   $0x8
  401a10:	51                   	push   %ecx
  401a11:	e8 1a 0b 00 00       	call   402530 <_GetProcessHeap@0>
  401a16:	89 04 24             	mov    %eax,(%esp)
  401a19:	e8 22 0b 00 00       	call   402540 <_HeapAlloc@12>
  401a1e:	8b 4b 0c             	mov    0xc(%ebx),%ecx
  401a21:	5a                   	pop    %edx
  401a22:	85 c9                	test   %ecx,%ecx
  401a24:	89 43 14             	mov    %eax,0x14(%ebx)
  401a27:	0f 84 24 01 00 00    	je     401b51 <_ScmCreateServiceDataBase+0x381>
  401a2d:	50                   	push   %eax
  401a2e:	50                   	push   %eax
  401a2f:	68 04 42 40 00       	push   $0x404204
  401a34:	8b 4b 14             	mov    0x14(%ebx),%ecx
  401a37:	51                   	push   %ecx
  401a38:	e8 b3 09 00 00       	call   4023f0 <_wcscpy>
  401a3d:	58                   	pop    %eax
  401a3e:	8b 43 0c             	mov    0xc(%ebx),%eax
  401a41:	5a                   	pop    %edx
  401a42:	50                   	push   %eax
  401a43:	8b 43 14             	mov    0x14(%ebx),%eax
  401a46:	50                   	push   %eax
  401a47:	e8 94 09 00 00       	call   4023e0 <_wcscat>
  401a4c:	58                   	pop    %eax
  401a4d:	8b 43 14             	mov    0x14(%ebx),%eax
  401a50:	50                   	push   %eax
  401a51:	e8 7a 09 00 00       	call   4023d0 <_wcslen>
  401a56:	01 c0                	add    %eax,%eax
  401a58:	5a                   	pop    %edx
  401a59:	59                   	pop    %ecx
  401a5a:	66 89 43 10          	mov    %ax,0x10(%ebx)
  401a5e:	8d 85 d8 fe ff ff    	lea    0xfffffed8(%ebp),%eax
  401a64:	68 a8 00 00 00       	push   $0xa8
  401a69:	50                   	push   %eax
  401a6a:	e8 a1 08 00 00       	call   402310 <_RtlZeroMemory@8>
  401a6f:	c7 85 e0 fe ff ff 6e 	movl   $0x40426e,0xfffffee0(%ebp)
  401a76:	42 40 00 
  401a79:	c7 85 dc fe ff ff 24 	movl   $0x24,0xfffffedc(%ebp)
  401a80:	00 00 00 
  401a83:	50                   	push   %eax
  401a84:	8d 43 20             	lea    0x20(%ebx),%eax
  401a87:	89 85 e4 fe ff ff    	mov    %eax,0xfffffee4(%ebp)
  401a8d:	8d 43 24             	lea    0x24(%ebx),%eax
  401a90:	89 85 00 ff ff ff    	mov    %eax,0xffffff00(%ebp)
  401a96:	8d 43 28             	lea    0x28(%ebx),%eax
  401a99:	89 85 1c ff ff ff    	mov    %eax,0xffffff1c(%ebp)
  401a9f:	8d 43 18             	lea    0x18(%ebx),%eax
  401aa2:	89 85 38 ff ff ff    	mov    %eax,0xffffff38(%ebp)
  401aa8:	8d 43 2c             	lea    0x2c(%ebx),%eax
  401aab:	89 85 54 ff ff ff    	mov    %eax,0xffffff54(%ebp)
  401ab1:	8d 85 d8 fe ff ff    	lea    0xfffffed8(%ebp),%eax
  401ab7:	6a 00                	push   $0x0
  401ab9:	6a 00                	push   $0x0
  401abb:	50                   	push   %eax
  401abc:	8b 85 c4 fe ff ff    	mov    0xfffffec4(%ebp),%eax
  401ac2:	50                   	push   %eax
  401ac3:	c7 85 fc fe ff ff 7a 	movl   $0x40427a,0xfffffefc(%ebp)
  401aca:	42 40 00 
  401acd:	c7 85 f8 fe ff ff 24 	movl   $0x24,0xfffffef8(%ebp)
  401ad4:	00 00 00 
  401ad7:	c7 85 18 ff ff ff 84 	movl   $0x404284,0xffffff18(%ebp)
  401ade:	42 40 00 
  401ae1:	c7 85 14 ff ff ff 24 	movl   $0x24,0xffffff14(%ebp)
  401ae8:	00 00 00 
  401aeb:	c7 85 34 ff ff ff 9e 	movl   $0x40429e,0xffffff34(%ebp)
  401af2:	42 40 00 
  401af5:	c7 85 30 ff ff ff 20 	movl   $0x20,0xffffff30(%ebp)
  401afc:	00 00 00 
  401aff:	c7 85 50 ff ff ff aa 	movl   $0x4042aa,0xffffff50(%ebp)
  401b06:	42 40 00 
  401b09:	c7 85 4c ff ff ff 20 	movl   $0x20,0xffffff4c(%ebp)
  401b10:	00 00 00 
  401b13:	6a 01                	push   $0x1
  401b15:	e8 06 08 00 00       	call   402320 <_RtlQueryRegistryValues@20>
  401b1a:	83 c4 0c             	add    $0xc,%esp
  401b1d:	85 c0                	test   %eax,%eax
  401b1f:	89 85 bc fe ff ff    	mov    %eax,0xfffffebc(%ebp)
  401b25:	78 63                	js     401b8a <_ScmCreateServiceDataBase+0x3ba>
	IN PLIST_ENTRY  ListHead,
	IN PLIST_ENTRY  Entry)
{
	PLIST_ENTRY OldBlink;
	OldBlink = ListHead->Blink;
  401b27:	a1 64 50 40 00       	mov    0x405064,%eax
	Entry->Flink = ListHead;
  401b2c:	c7 03 60 50 40 00    	movl   $0x405060,(%ebx)
	Entry->Blink = OldBlink;
  401b32:	89 43 04             	mov    %eax,0x4(%ebx)
	OldBlink->Flink = Entry;
	ListHead->Blink = Entry;
  401b35:	89 1d 64 50 40 00    	mov    %ebx,0x405064
  401b3b:	89 18                	mov    %ebx,(%eax)
  401b3d:	31 c0                	xor    %eax,%eax
  401b3f:	90                   	nop    
  401b40:	3d 34 00 00 c0       	cmp    $0xc0000034,%eax
  401b45:	0f 85 a8 fd ff ff    	jne    4018f3 <_ScmCreateServiceDataBase+0x123>
  401b4b:	47                   	inc    %edi
  401b4c:	e9 a7 fd ff ff       	jmp    4018f8 <_ScmCreateServiceDataBase+0x128>
  401b51:	52                   	push   %edx
  401b52:	6a 00                	push   $0x0
  401b54:	6a 00                	push   $0x0
  401b56:	50                   	push   %eax
  401b57:	e8 d4 09 00 00       	call   402530 <_GetProcessHeap@0>
  401b5c:	89 04 24             	mov    %eax,(%esp)
  401b5f:	e8 ec 09 00 00       	call   402550 <_HeapFree@12>
  401b64:	58                   	pop    %eax
  401b65:	50                   	push   %eax
  401b66:	53                   	push   %ebx
  401b67:	6a 00                	push   $0x0
  401b69:	50                   	push   %eax
  401b6a:	e8 c1 09 00 00       	call   402530 <_GetProcessHeap@0>
  401b6f:	89 04 24             	mov    %eax,(%esp)
  401b72:	e8 d9 09 00 00       	call   402550 <_HeapFree@12>
  401b77:	58                   	pop    %eax
  401b78:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
  401b7d:	3d 34 00 00 c0       	cmp    $0xc0000034,%eax
  401b82:	0f 85 6b fd ff ff    	jne    4018f3 <_ScmCreateServiceDataBase+0x123>
  401b88:	eb c1                	jmp    401b4b <_ScmCreateServiceDataBase+0x37b>
  401b8a:	51                   	push   %ecx
  401b8b:	51                   	push   %ecx
  401b8c:	50                   	push   %eax
  401b8d:	68 b4 42 40 00       	push   $0x4042b4
  401b92:	e8 f9 f6 ff ff       	call   401290 <_PrintString>
  401b97:	8d 43 10             	lea    0x10(%ebx),%eax
  401b9a:	89 04 24             	mov    %eax,(%esp)
  401b9d:	e8 be 07 00 00       	call   402360 <_RtlFreeUnicodeString@4>
  401ba2:	8d 43 08             	lea    0x8(%ebx),%eax
  401ba5:	50                   	push   %eax
  401ba6:	e8 b5 07 00 00       	call   402360 <_RtlFreeUnicodeString@4>
  401bab:	58                   	pop    %eax
  401bac:	5a                   	pop    %edx
  401bad:	53                   	push   %ebx
  401bae:	6a 00                	push   $0x0
  401bb0:	53                   	push   %ebx
  401bb1:	e8 7a 09 00 00       	call   402530 <_GetProcessHeap@0>
  401bb6:	89 04 24             	mov    %eax,(%esp)
  401bb9:	e8 92 09 00 00       	call   402550 <_HeapFree@12>
  401bbe:	8b 85 bc fe ff ff    	mov    0xfffffebc(%ebp),%eax
  401bc4:	59                   	pop    %ecx
  401bc5:	e9 76 ff ff ff       	jmp    401b40 <_ScmCreateServiceDataBase+0x370>
  401bca:	83 ec 0c             	sub    $0xc,%esp
  401bcd:	8b 85 cc fe ff ff    	mov    0xfffffecc(%ebp),%eax
  401bd3:	50                   	push   %eax
  401bd4:	e8 77 07 00 00       	call   402350 <_NtClose@4>
  401bd9:	b8 9a 00 00 c0       	mov    $0xc000009a,%eax
  401bde:	e9 5b fd ff ff       	jmp    40193e <_ScmCreateServiceDataBase+0x16e>
  401be3:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  401be9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00401bf0 <_ScmGetBootAndSystemDriverState>:


static NTSTATUS
ScmCheckDriver(PSERVICE Service)
{
  OBJECT_ATTRIBUTES ObjectAttributes;
  UNICODE_STRING DirName;
  HANDLE DirHandle;
  NTSTATUS Status;
  POBJECT_DIRECTORY_INFORMATION DirInfo;
  ULONG BufferLength;
  ULONG DataLength;
  ULONG Index;
  PLIST_ENTRY GroupEntry;
  PSERVICE_GROUP CurrentGroup;

  DPRINT("ScmCheckDriver(%wZ) called\n", &Service->ServiceName);

  if (Service->Type == SERVICE_KERNEL_DRIVER)
    {
      RtlRosInitUnicodeStringFromLiteral(&DirName,
			   L"\\Driver");
    }
  else
    {
      RtlRosInitUnicodeStringFromLiteral(&DirName,
			   L"\\FileSystem");
    }

  InitializeObjectAttributes(&ObjectAttributes,
			     &DirName,
			     0,
			     NULL,
			     NULL);

  Status = NtOpenDirectoryObject(&DirHandle,
				 DIRECTORY_QUERY | DIRECTORY_TRAVERSE,
				 &ObjectAttributes);
  if (!NT_SUCCESS(Status))
    {
      return Status;
    }

  BufferLength = sizeof(OBJECT_DIRECTORY_INFORMATION) +
		 2 * MAX_PATH * sizeof(WCHAR);
  DirInfo = HeapAlloc(GetProcessHeap(),
		      HEAP_ZERO_MEMORY,
		      BufferLength);

  Index = 0;
  while (TRUE)
    {
      Status = NtQueryDirectoryObject(DirHandle,
				      DirInfo,
				      BufferLength,
				      TRUE,
				      FALSE,
				      &Index,
				      &DataLength);
      if (Status == STATUS_NO_MORE_ENTRIES)
	{
	  /* FIXME: Add current service to 'failed service' list */
	  DPRINT("Service '%wZ' failed\n", &Service->ServiceName);
	  break;
	}

      if (!NT_SUCCESS(Status))
	break;

      DPRINT("Comparing: '%wZ'  '%wZ'\n", &Service->ServiceName, &DirInfo->ObjectName);

      if (RtlEqualUnicodeString(&Service->ServiceName, &DirInfo->ObjectName, TRUE))
	{
	  DPRINT("Found: '%wZ'  '%wZ'\n", &Service->ServiceName, &DirInfo->ObjectName);

	  /* Mark service as 'running' */
	  Service->ServiceRunning = TRUE;

	  /* Find the driver's group and mark it as 'running' */
	  if (Service->ServiceGroup.Buffer != NULL)
	    {
	      GroupEntry = GroupListHead.Flink;
	      while (GroupEntry != &GroupListHead)
		{
		  CurrentGroup = CONTAINING_RECORD(GroupEntry, SERVICE_GROUP, GroupListEntry);

		  DPRINT("Checking group '%wZ'\n", &CurrentGroup->GroupName);
		  if (RtlEqualUnicodeString(&Service->ServiceGroup, &CurrentGroup->GroupName, TRUE))
		    {
		      CurrentGroup->ServicesRunning = TRUE;
		    }

		  GroupEntry = GroupEntry->Flink;
		}
	    }
	  break;
	}
    }

  HeapFree(GetProcessHeap(),
	   0,
	   DirInfo);
  NtClose(DirHandle);

  return STATUS_SUCCESS;
}


VOID
ScmGetBootAndSystemDriverState(VOID)
{
  401bf0:	55                   	push   %ebp
  401bf1:	89 e5                	mov    %esp,%ebp
  401bf3:	57                   	push   %edi
  401bf4:	56                   	push   %esi
  401bf5:	53                   	push   %ebx
  401bf6:	83 ec 4c             	sub    $0x4c,%esp
  PLIST_ENTRY ServiceEntry;
  PSERVICE CurrentService;

  DPRINT("ScmGetBootAndSystemDriverState() called\n");

  ServiceEntry = ServiceListHead.Flink;
  401bf9:	8b 35 60 50 40 00    	mov    0x405060,%esi
  while (ServiceEntry != &ServiceListHead)
    {
      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);

      if (CurrentService->Start == SERVICE_BOOT_START ||
	  CurrentService->Start == SERVICE_SYSTEM_START)
	{
	  /* Check driver */
	  DPRINT("  Checking service: %wZ\n", &CurrentService->ServiceName);

	  ScmCheckDriver(CurrentService);
	}
      ServiceEntry = ServiceEntry->Flink;
  401bff:	81 fe 60 50 40 00    	cmp    $0x405060,%esi
  401c05:	0f 84 39 01 00 00    	je     401d44 <_ScmGetBootAndSystemDriverState+0x154>
  401c0b:	90                   	nop    
  401c0c:	8d 74 26 00          	lea    0x0(%esi),%esi
  401c10:	83 7e 20 01          	cmpl   $0x1,0x20(%esi)
  401c14:	0f 87 1c 01 00 00    	ja     401d36 <_ScmGetBootAndSystemDriverState+0x146>
  401c1a:	83 7e 24 01          	cmpl   $0x1,0x24(%esi)
  401c1e:	0f 84 28 01 00 00    	je     401d4c <_ScmGetBootAndSystemDriverState+0x15c>
  401c24:	66 c7 45 c0 16 00    	movw   $0x16,0xffffffc0(%ebp)
  401c2a:	8d 45 c0             	lea    0xffffffc0(%ebp),%eax
  401c2d:	66 c7 45 c2 18 00    	movw   $0x18,0xffffffc2(%ebp)
  401c33:	c7 45 c4 e2 42 40 00 	movl   $0x4042e2,0xffffffc4(%ebp)
  401c3a:	89 45 d0             	mov    %eax,0xffffffd0(%ebp)
  401c3d:	50                   	push   %eax
  401c3e:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
  401c41:	50                   	push   %eax
  401c42:	8d 45 bc             	lea    0xffffffbc(%ebp),%eax
  401c45:	6a 03                	push   $0x3
  401c47:	c7 45 c8 18 00 00 00 	movl   $0x18,0xffffffc8(%ebp)
  401c4e:	c7 45 d4 00 00 00 00 	movl   $0x0,0xffffffd4(%ebp)
  401c55:	c7 45 cc 00 00 00 00 	movl   $0x0,0xffffffcc(%ebp)
  401c5c:	c7 45 d8 00 00 00 00 	movl   $0x0,0xffffffd8(%ebp)
  401c63:	c7 45 dc 00 00 00 00 	movl   $0x0,0xffffffdc(%ebp)
  401c6a:	50                   	push   %eax
  401c6b:	e8 00 07 00 00       	call   402370 <_NtOpenDirectoryObject@12>
  401c70:	5f                   	pop    %edi
  401c71:	85 c0                	test   %eax,%eax
  401c73:	0f 88 bd 00 00 00    	js     401d36 <_ScmGetBootAndSystemDriverState+0x146>
  401c79:	53                   	push   %ebx
  401c7a:	68 20 04 00 00       	push   $0x420
  401c7f:	6a 08                	push   $0x8
  401c81:	51                   	push   %ecx
  401c82:	e8 a9 08 00 00       	call   402530 <_GetProcessHeap@0>
  401c87:	89 04 24             	mov    %eax,(%esp)
  401c8a:	e8 b1 08 00 00       	call   402540 <_HeapAlloc@12>
  401c8f:	89 c7                	mov    %eax,%edi
  401c91:	8d 46 18             	lea    0x18(%esi),%eax
  401c94:	5a                   	pop    %edx
  401c95:	c7 45 b4 00 00 00 00 	movl   $0x0,0xffffffb4(%ebp)
  401c9c:	89 45 b0             	mov    %eax,0xffffffb0(%ebp)
  401c9f:	90                   	nop    
  401ca0:	50                   	push   %eax
  401ca1:	8d 45 b8             	lea    0xffffffb8(%ebp),%eax
  401ca4:	50                   	push   %eax
  401ca5:	8d 45 b4             	lea    0xffffffb4(%ebp),%eax
  401ca8:	50                   	push   %eax
  401ca9:	8b 45 bc             	mov    0xffffffbc(%ebp),%eax
  401cac:	6a 00                	push   $0x0
  401cae:	6a 01                	push   $0x1
  401cb0:	68 20 04 00 00       	push   $0x420
  401cb5:	57                   	push   %edi
  401cb6:	50                   	push   %eax
  401cb7:	e8 c4 06 00 00       	call   402380 <_NtQueryDirectoryObject@28>
  401cbc:	5b                   	pop    %ebx
  401cbd:	3d 1a 00 00 80       	cmp    $0x8000001a,%eax
  401cc2:	74 52                	je     401d16 <_ScmGetBootAndSystemDriverState+0x126>
  401cc4:	85 c0                	test   %eax,%eax
  401cc6:	78 4e                	js     401d16 <_ScmGetBootAndSystemDriverState+0x126>
  401cc8:	8d 46 08             	lea    0x8(%esi),%eax
  401ccb:	51                   	push   %ecx
  401ccc:	6a 01                	push   $0x1
  401cce:	57                   	push   %edi
  401ccf:	50                   	push   %eax
  401cd0:	e8 bb 06 00 00       	call   402390 <_RtlEqualUnicodeString@12>
  401cd5:	5a                   	pop    %edx
  401cd6:	84 c0                	test   %al,%al
  401cd8:	74 c6                	je     401ca0 <_ScmGetBootAndSystemDriverState+0xb0>
  401cda:	8b 46 1c             	mov    0x1c(%esi),%eax
  401cdd:	c6 46 30 01          	movb   $0x1,0x30(%esi)
  401ce1:	85 c0                	test   %eax,%eax
  401ce3:	74 31                	je     401d16 <_ScmGetBootAndSystemDriverState+0x126>
  401ce5:	8b 1d 70 50 40 00    	mov    0x405070,%ebx
  401ceb:	81 fb 70 50 40 00    	cmp    $0x405070,%ebx
  401cf1:	74 23                	je     401d16 <_ScmGetBootAndSystemDriverState+0x126>
  401cf3:	8b 4d b0             	mov    0xffffffb0(%ebp),%ecx
  401cf6:	50                   	push   %eax
  401cf7:	8d 43 08             	lea    0x8(%ebx),%eax
  401cfa:	6a 01                	push   $0x1
  401cfc:	50                   	push   %eax
  401cfd:	51                   	push   %ecx
  401cfe:	e8 8d 06 00 00       	call   402390 <_RtlEqualUnicodeString@12>
  401d03:	5a                   	pop    %edx
  401d04:	84 c0                	test   %al,%al
  401d06:	74 04                	je     401d0c <_ScmGetBootAndSystemDriverState+0x11c>
  401d08:	c6 43 10 01          	movb   $0x1,0x10(%ebx)
  401d0c:	8b 1b                	mov    (%ebx),%ebx
  401d0e:	81 fb 70 50 40 00    	cmp    $0x405070,%ebx
  401d14:	75 dd                	jne    401cf3 <_ScmGetBootAndSystemDriverState+0x103>
  401d16:	50                   	push   %eax
  401d17:	57                   	push   %edi
  401d18:	6a 00                	push   $0x0
  401d1a:	53                   	push   %ebx
  401d1b:	e8 10 08 00 00       	call   402530 <_GetProcessHeap@0>
  401d20:	89 04 24             	mov    %eax,(%esp)
  401d23:	e8 28 08 00 00       	call   402550 <_HeapFree@12>
  401d28:	8b 55 bc             	mov    0xffffffbc(%ebp),%edx
  401d2b:	51                   	push   %ecx
  401d2c:	51                   	push   %ecx
  401d2d:	52                   	push   %edx
  401d2e:	e8 1d 06 00 00       	call   402350 <_NtClose@4>
  401d33:	83 c4 0c             	add    $0xc,%esp
  401d36:	8b 36                	mov    (%esi),%esi
  401d38:	81 fe 60 50 40 00    	cmp    $0x405060,%esi
  401d3e:	0f 85 cc fe ff ff    	jne    401c10 <_ScmGetBootAndSystemDriverState+0x20>
  401d44:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  401d47:	5b                   	pop    %ebx
  401d48:	5e                   	pop    %esi
  401d49:	5f                   	pop    %edi
  401d4a:	5d                   	pop    %ebp
  401d4b:	c3                   	ret    
  401d4c:	8d 45 c0             	lea    0xffffffc0(%ebp),%eax
  401d4f:	66 c7 45 c0 0e 00    	movw   $0xe,0xffffffc0(%ebp)
  401d55:	66 c7 45 c2 10 00    	movw   $0x10,0xffffffc2(%ebp)
  401d5b:	c7 45 c4 fa 42 40 00 	movl   $0x4042fa,0xffffffc4(%ebp)
  401d62:	e9 d3 fe ff ff       	jmp    401c3a <_ScmGetBootAndSystemDriverState+0x4a>
  401d67:	89 f6                	mov    %esi,%esi
  401d69:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00401d70 <_ScmStartService>:
    }

  DPRINT("ScmGetBootAndSystemDriverState() done\n");
}


static NTSTATUS
ScmSendStartCommand(PSERVICE Service, LPWSTR Arguments)
{
  PSCM_START_PACKET StartPacket;
  DWORD TotalLength;
#if 0
  DWORD Length;
#endif
  PWSTR Ptr;
  DWORD Count;

  DPRINT("ScmSendStartCommand() called\n");

  /* Calculate the total length of the start command line */
  TotalLength = wcslen(Service->ServiceName.Buffer) + 1;
#if 0
  if (Arguments != NULL)
  {
    Ptr = Arguments;
    while (*Ptr)
    {
      Length = wcslen(Ptr) + 1;
      TotalLength += Length;
      Ptr += Length;
    }
  }
#endif
  TotalLength++;

  /* Allocate start command packet */
  StartPacket = HeapAlloc(GetProcessHeap(),
			  HEAP_ZERO_MEMORY,
			  sizeof(SCM_START_PACKET) + (TotalLength - 1) * sizeof(WCHAR));
  if (StartPacket == NULL)
    return STATUS_INSUFFICIENT_RESOURCES;

  StartPacket->Command = SCM_START_COMMAND;
  StartPacket->Size = TotalLength;
  Ptr = &StartPacket->Arguments[0];
  wcscpy(Ptr, Service->ServiceName.Buffer);
  Ptr += (wcslen(Service->ServiceName.Buffer) + 1);

  /* FIXME: Copy argument list */

  *Ptr = 0;

  /* Send the start command */
  WriteFile(Service->ControlPipeHandle,
	    StartPacket,
	    sizeof(SCM_START_PACKET) + (TotalLength - 1) * sizeof(WCHAR),
	    &Count,
	    NULL);

  /* FIXME: Read the reply */

  HeapFree(GetProcessHeap(),
           0,
           StartPacket);

  DPRINT("ScmSendStartCommand() done\n");

  return STATUS_SUCCESS;
}


static NTSTATUS
ScmStartUserModeService(PSERVICE Service)
{
  RTL_QUERY_REGISTRY_TABLE QueryTable[3];
  PROCESS_INFORMATION ProcessInformation;
  STARTUPINFOW StartupInfo;
  UNICODE_STRING ImagePath;
  ULONG Type;
  BOOL Result;
  NTSTATUS Status;

  RtlInitUnicodeString(&ImagePath, NULL);

  /* Get service data */
  RtlZeroMemory(&QueryTable,
		sizeof(QueryTable));

  QueryTable[0].Name = L"Type";
  QueryTable[0].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
  QueryTable[0].EntryContext = &Type;

  QueryTable[1].Name = L"ImagePath";
  QueryTable[1].Flags = RTL_QUERY_REGISTRY_DIRECT | RTL_QUERY_REGISTRY_REQUIRED;
  QueryTable[1].EntryContext = &ImagePath;

  Status = RtlQueryRegistryValues(RTL_REGISTRY_SERVICES,
				  Service->ServiceName.Buffer,
				  QueryTable,
				  NULL,
				  NULL);
  if (!NT_SUCCESS(Status))
    {
      DPRINT1("RtlQueryRegistryValues() failed (Status %lx)\n", Status);
      return Status;
    }
  DPRINT("ImagePath: '%S'\n", ImagePath.Buffer);
  DPRINT("Type: %lx\n", Type);

  /* Create '\\.\pipe\net\NtControlPipe' instance */
  Service->ControlPipeHandle = CreateNamedPipeW(L"\\\\.\\pipe\\net\\NtControlPipe",
						PIPE_ACCESS_DUPLEX,
						PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
						100,
						8000,
						4,
						30000,
						NULL);
  DPRINT("CreateNamedPipeW() done\n");
  if (Service->ControlPipeHandle == INVALID_HANDLE_VALUE)
    {
      DPRINT1("Failed to create control pipe!\n");
      return STATUS_UNSUCCESSFUL;
    }

  StartupInfo.cb = sizeof(StartupInfo);
  StartupInfo.lpReserved = NULL;
  StartupInfo.lpDesktop = NULL;
  StartupInfo.lpTitle = NULL;
  StartupInfo.dwFlags = 0;
  StartupInfo.cbReserved2 = 0;
  StartupInfo.lpReserved2 = 0;

  Result = CreateProcessW(ImagePath.Buffer,
			  NULL,
			  NULL,
			  NULL,
			  FALSE,
			  DETACHED_PROCESS | CREATE_SUSPENDED,
			  NULL,
			  NULL,
			  &StartupInfo,
			  &ProcessInformation);
  RtlFreeUnicodeString(&ImagePath);

  if (!Result)
    {
      /* Close control pipe */
      CloseHandle(Service->ControlPipeHandle);
      Service->ControlPipeHandle = INVALID_HANDLE_VALUE;

      DPRINT1("Starting '%S' failed!\n", Service->ServiceName.Buffer);
      return STATUS_UNSUCCESSFUL;
    }

  DPRINT("Process Id: %lu  Handle %lx\n",
	 ProcessInformation.dwProcessId,
	 ProcessInformation.hProcess);
  DPRINT("Thread Id: %lu  Handle %lx\n",
	 ProcessInformation.dwThreadId,
	 ProcessInformation.hThread);

  /* Get process and thread ids */
  Service->ProcessId = ProcessInformation.dwProcessId;
  Service->ThreadId = ProcessInformation.dwThreadId;

  /* Resume Thread */
  ResumeThread(ProcessInformation.hThread);

  /* Connect control pipe */
  if (ConnectNamedPipe(Service->ControlPipeHandle, NULL))
    {
      DWORD dwProcessId = 0;
      DWORD dwRead = 0;

      DPRINT("Control pipe connected!\n");

      /* Read thread id from pipe */
      if (!ReadFile(Service->ControlPipeHandle,
		    (LPVOID)&dwProcessId,
		    sizeof(DWORD),
		    &dwRead,
		    NULL))
	{
	  DPRINT1("Reading the service control pipe failed (Error %lu)\n",
		  GetLastError());
	  Status = STATUS_UNSUCCESSFUL;
	}
      else
	{
	  DPRINT("Received process id %lu\n", dwProcessId);

	  /* FIXME: Send start command */

	  Status = STATUS_SUCCESS;
	}
    }
  else
    {
      DPRINT("Connecting control pipe failed!\n");

      /* Close control pipe */
      CloseHandle(Service->ControlPipeHandle);
      Service->ControlPipeHandle = INVALID_HANDLE_VALUE;
      Service->ProcessId = 0;
      Service->ThreadId = 0;
      Status = STATUS_UNSUCCESSFUL;
    }

  ScmSendStartCommand(Service, NULL);

  /* Close process and thread handle */
  CloseHandle(ProcessInformation.hThread);
  CloseHandle(ProcessInformation.hProcess);

  return Status;
}


static NTSTATUS
ScmStartService(PSERVICE Service,
		PSERVICE_GROUP Group)
{
  401d70:	55                   	push   %ebp
  401d71:	89 e5                	mov    %esp,%ebp
  401d73:	57                   	push   %edi
  401d74:	56                   	push   %esi
  401d75:	53                   	push   %ebx
  401d76:	81 ec fc 00 00 00    	sub    $0xfc,%esp
  401d7c:	89 95 0c ff ff ff    	mov    %edx,0xffffff0c(%ebp)
  NTSTATUS Status;

  DPRINT("ScmStartService() called\n");

  Service->ControlPipeHandle = INVALID_HANDLE_VALUE;
  DPRINT("Service->Type: %u\n", Service->Type);

  if (Service->Type == SERVICE_KERNEL_DRIVER ||
  401d82:	8b 50 24             	mov    0x24(%eax),%edx
  401d85:	89 c6                	mov    %eax,%esi
  401d87:	c7 40 34 ff ff ff ff 	movl   $0xffffffff,0x34(%eax)
  401d8e:	8d 42 ff             	lea    0xffffffff(%edx),%eax
  401d91:	83 f8 01             	cmp    $0x1,%eax
  401d94:	0f 96 c1             	setbe  %cl
  401d97:	83 fa 08             	cmp    $0x8,%edx
  401d9a:	0f 94 c0             	sete   %al
  401d9d:	09 c8                	or     %ecx,%eax
  401d9f:	a8 01                	test   $0x1,%al
  401da1:	74 33                	je     401dd6 <_ScmStartService+0x66>
      Service->Type == SERVICE_FILE_SYSTEM_DRIVER ||
      Service->Type == SERVICE_RECOGNIZER_DRIVER)
    {
      /* Load driver */
      DPRINT("  Path: %wZ\n", &Service->RegistryPath);
      Status = NtLoadDriver(&Service->RegistryPath);
  401da3:	83 ec 0c             	sub    $0xc,%esp
  401da6:	8d 46 10             	lea    0x10(%esi),%eax
  401da9:	50                   	push   %eax
  401daa:	e8 f1 05 00 00       	call   4023a0 <_NtLoadDriver@4>
  401daf:	83 c4 0c             	add    $0xc,%esp
    }
  else
    {
      /* Start user-mode service */
      Status = ScmStartUserModeService(Service);
    }

  DPRINT("ScmStartService() done (Status %lx)\n", Status);

  if (NT_SUCCESS(Status))
  401db2:	85 c0                	test   %eax,%eax
  401db4:	78 18                	js     401dce <_ScmStartService+0x5e>
    {
      if (Group != NULL)
  401db6:	8b 95 0c ff ff ff    	mov    0xffffff0c(%ebp),%edx
  401dbc:	85 d2                	test   %edx,%edx
  401dbe:	74 0a                	je     401dca <_ScmStartService+0x5a>
	{
	  Group->ServicesRunning = TRUE;
  401dc0:	8b 95 0c ff ff ff    	mov    0xffffff0c(%ebp),%edx
  401dc6:	c6 42 10 01          	movb   $0x1,0x10(%edx)
	}
      Service->ServiceRunning = TRUE;
  401dca:	c6 46 30 01          	movb   $0x1,0x30(%esi)
    }
#if 0
  else
    {
      switch (Service->ErrorControl)
	{
	  case SERVICE_ERROR_NORMAL:
	    /* FIXME: Log error */
	    break;

	  case SERVICE_ERROR_SEVERE:
	    if (IsLastKnownGood == FALSE)
	      {
		/* FIXME: Boot last known good configuration */
	      }
	    break;

	  case SERVICE_ERROR_CRITICAL:
	    if (IsLastKnownGood == FALSE)
	      {
		/* FIXME: Boot last known good configuration */
	      }
	    else
	      {
		/* FIXME: BSOD! */
	      }
	    break;
	}
    }
#endif

  return Status;
}
  401dce:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  401dd1:	5b                   	pop    %ebx
  401dd2:	5e                   	pop    %esi
  401dd3:	5f                   	pop    %edi
  401dd4:	5d                   	pop    %ebp
  401dd5:	c3                   	ret    
  401dd6:	50                   	push   %eax
  401dd7:	50                   	push   %eax
  401dd8:	8d 85 20 ff ff ff    	lea    0xffffff20(%ebp),%eax
  401dde:	6a 00                	push   $0x0
  401de0:	50                   	push   %eax
  401de1:	e8 ca 05 00 00       	call   4023b0 <_RtlInitUnicodeString@8>
  401de6:	8d 5d 88             	lea    0xffffff88(%ebp),%ebx
  401de9:	6a 54                	push   $0x54
  401deb:	53                   	push   %ebx
  401dec:	e8 1f 05 00 00       	call   402310 <_RtlZeroMemory@8>
  401df1:	8d 85 1c ff ff ff    	lea    0xffffff1c(%ebp),%eax
  401df7:	8d 95 20 ff ff ff    	lea    0xffffff20(%ebp),%edx
  401dfd:	57                   	push   %edi
  401dfe:	6a 00                	push   $0x0
  401e00:	6a 00                	push   $0x0
  401e02:	53                   	push   %ebx
  401e03:	8b 5e 0c             	mov    0xc(%esi),%ebx
  401e06:	c7 45 90 7a 42 40 00 	movl   $0x40427a,0xffffff90(%ebp)
  401e0d:	53                   	push   %ebx
  401e0e:	c7 45 8c 24 00 00 00 	movl   $0x24,0xffffff8c(%ebp)
  401e15:	89 45 94             	mov    %eax,0xffffff94(%ebp)
  401e18:	c7 45 ac 0a 43 40 00 	movl   $0x40430a,0xffffffac(%ebp)
  401e1f:	c7 45 a8 24 00 00 00 	movl   $0x24,0xffffffa8(%ebp)
  401e26:	89 55 b0             	mov    %edx,0xffffffb0(%ebp)
  401e29:	6a 01                	push   $0x1
  401e2b:	e8 f0 04 00 00       	call   402320 <_RtlQueryRegistryValues@20>
  401e30:	83 c4 0c             	add    $0xc,%esp
  401e33:	89 c7                	mov    %eax,%edi
  401e35:	85 c0                	test   %eax,%eax
  401e37:	0f 88 59 02 00 00    	js     402096 <_ScmStartService+0x326>
  401e3d:	6a 00                	push   $0x0
  401e3f:	68 30 75 00 00       	push   $0x7530
  401e44:	6a 04                	push   $0x4
  401e46:	68 40 1f 00 00       	push   $0x1f40
  401e4b:	6a 64                	push   $0x64
  401e4d:	6a 06                	push   $0x6
  401e4f:	6a 03                	push   $0x3
  401e51:	68 20 43 40 00       	push   $0x404320
  401e56:	e8 05 07 00 00       	call   402560 <_CreateNamedPipeW@32>
  401e5b:	89 46 34             	mov    %eax,0x34(%esi)
  401e5e:	40                   	inc    %eax
  401e5f:	0f 84 5d 02 00 00    	je     4020c2 <_ScmStartService+0x352>
  401e65:	8d 85 78 ff ff ff    	lea    0xffffff78(%ebp),%eax
  401e6b:	8b 8d 24 ff ff ff    	mov    0xffffff24(%ebp),%ecx
  401e71:	53                   	push   %ebx
  401e72:	53                   	push   %ebx
  401e73:	50                   	push   %eax
  401e74:	8d 85 28 ff ff ff    	lea    0xffffff28(%ebp),%eax
  401e7a:	c7 85 28 ff ff ff 44 	movl   $0x44,0xffffff28(%ebp)
  401e81:	00 00 00 
  401e84:	50                   	push   %eax
  401e85:	c7 85 2c ff ff ff 00 	movl   $0x0,0xffffff2c(%ebp)
  401e8c:	00 00 00 
  401e8f:	6a 00                	push   $0x0
  401e91:	c7 85 30 ff ff ff 00 	movl   $0x0,0xffffff30(%ebp)
  401e98:	00 00 00 
  401e9b:	6a 00                	push   $0x0
  401e9d:	c7 85 34 ff ff ff 00 	movl   $0x0,0xffffff34(%ebp)
  401ea4:	00 00 00 
  401ea7:	6a 0c                	push   $0xc
  401ea9:	c7 85 54 ff ff ff 00 	movl   $0x0,0xffffff54(%ebp)
  401eb0:	00 00 00 
  401eb3:	6a 00                	push   $0x0
  401eb5:	66 c7 85 5a ff ff ff 	movw   $0x0,0xffffff5a(%ebp)
  401ebc:	00 00 
  401ebe:	6a 00                	push   $0x0
  401ec0:	c7 85 5c ff ff ff 00 	movl   $0x0,0xffffff5c(%ebp)
  401ec7:	00 00 00 
  401eca:	6a 00                	push   $0x0
  401ecc:	6a 00                	push   $0x0
  401ece:	51                   	push   %ecx
  401ecf:	e8 9c 06 00 00       	call   402570 <_CreateProcessW@40>
  401ed4:	89 c3                	mov    %eax,%ebx
  401ed6:	8d 85 20 ff ff ff    	lea    0xffffff20(%ebp),%eax
  401edc:	52                   	push   %edx
  401edd:	50                   	push   %eax
  401ede:	e8 7d 04 00 00       	call   402360 <_RtlFreeUnicodeString@4>
  401ee3:	83 c4 0c             	add    $0xc,%esp
  401ee6:	85 db                	test   %ebx,%ebx
  401ee8:	75 46                	jne    401f30 <_ScmStartService+0x1c0>
  401eea:	83 ec 0c             	sub    $0xc,%esp
  401eed:	8b 7e 34             	mov    0x34(%esi),%edi
  401ef0:	57                   	push   %edi
  401ef1:	e8 9a 05 00 00       	call   402490 <_CloseHandle@4>
  401ef6:	c7 46 34 ff ff ff ff 	movl   $0xffffffff,0x34(%esi)
  401efd:	59                   	pop    %ecx
  401efe:	5b                   	pop    %ebx
  401eff:	68 9d 02 00 00       	push   $0x29d
  401f04:	68 56 43 40 00       	push   $0x404356
  401f09:	68 61 43 40 00       	push   $0x404361
  401f0e:	e8 dd 03 00 00       	call   4022f0 <_DbgPrint>
  401f13:	58                   	pop    %eax
  401f14:	8b 46 0c             	mov    0xc(%esi),%eax
  401f17:	5a                   	pop    %edx
  401f18:	50                   	push   %eax
  401f19:	68 6a 43 40 00       	push   $0x40436a
  401f1e:	e8 cd 03 00 00       	call   4022f0 <_DbgPrint>
  401f23:	83 c4 10             	add    $0x10,%esp
  401f26:	b8 01 00 00 c0       	mov    $0xc0000001,%eax
  401f2b:	e9 82 fe ff ff       	jmp    401db2 <_ScmStartService+0x42>
  401f30:	8b 45 80             	mov    0xffffff80(%ebp),%eax
  401f33:	83 ec 0c             	sub    $0xc,%esp
  401f36:	89 46 38             	mov    %eax,0x38(%esi)
  401f39:	8b 45 84             	mov    0xffffff84(%ebp),%eax
  401f3c:	8b bd 7c ff ff ff    	mov    0xffffff7c(%ebp),%edi
  401f42:	89 46 3c             	mov    %eax,0x3c(%esi)
  401f45:	57                   	push   %edi
  401f46:	e8 35 06 00 00       	call   402580 <_ResumeThread@4>
  401f4b:	8b 5e 34             	mov    0x34(%esi),%ebx
  401f4e:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
  401f55:	53                   	push   %ebx
  401f56:	e8 55 05 00 00       	call   4024b0 <_ConnectNamedPipe@8>
  401f5b:	5a                   	pop    %edx
  401f5c:	85 c0                	test   %eax,%eax
  401f5e:	59                   	pop    %ecx
  401f5f:	0f 84 7e 01 00 00    	je     4020e3 <_ScmStartService+0x373>
  401f65:	83 ec 0c             	sub    $0xc,%esp
  401f68:	8d 85 18 ff ff ff    	lea    0xffffff18(%ebp),%eax
  401f6e:	8b 7e 34             	mov    0x34(%esi),%edi
  401f71:	c7 85 14 ff ff ff 00 	movl   $0x0,0xffffff14(%ebp)
  401f78:	00 00 00 
  401f7b:	6a 00                	push   $0x0
  401f7d:	50                   	push   %eax
  401f7e:	8d 85 14 ff ff ff    	lea    0xffffff14(%ebp),%eax
  401f84:	6a 04                	push   $0x4
  401f86:	c7 85 18 ff ff ff 00 	movl   $0x0,0xffffff18(%ebp)
  401f8d:	00 00 00 
  401f90:	50                   	push   %eax
  401f91:	57                   	push   %edi
  401f92:	e8 b9 04 00 00       	call   402450 <_ReadFile@20>
  401f97:	31 ff                	xor    %edi,%edi
  401f99:	83 c4 0c             	add    $0xc,%esp
  401f9c:	85 c0                	test   %eax,%eax
  401f9e:	75 2f                	jne    401fcf <_ScmStartService+0x25f>
  401fa0:	53                   	push   %ebx
  401fa1:	68 be 02 00 00       	push   $0x2be
  401fa6:	68 56 43 40 00       	push   $0x404356
  401fab:	68 61 43 40 00       	push   $0x404361
  401fb0:	e8 3b 03 00 00       	call   4022f0 <_DbgPrint>
  401fb5:	e8 76 04 00 00       	call   402430 <_GetLastError@0>
  401fba:	5a                   	pop    %edx
  401fbb:	59                   	pop    %ecx
  401fbc:	50                   	push   %eax
  401fbd:	68 84 43 40 00       	push   $0x404384
  401fc2:	e8 29 03 00 00       	call   4022f0 <_DbgPrint>
  401fc7:	83 c4 10             	add    $0x10,%esp
  401fca:	bf 01 00 00 c0       	mov    $0xc0000001,%edi
  401fcf:	83 ec 0c             	sub    $0xc,%esp
  401fd2:	8b 5e 0c             	mov    0xc(%esi),%ebx
  401fd5:	53                   	push   %ebx
  401fd6:	e8 f5 03 00 00       	call   4023d0 <_wcslen>
  401fdb:	83 c4 0c             	add    $0xc,%esp
  401fde:	8d 58 02             	lea    0x2(%eax),%ebx
  401fe1:	8d 54 1b 0a          	lea    0xa(%ebx,%ebx,1),%edx
  401fe5:	52                   	push   %edx
  401fe6:	89 95 04 ff ff ff    	mov    %edx,0xffffff04(%ebp)
  401fec:	6a 08                	push   $0x8
  401fee:	51                   	push   %ecx
  401fef:	e8 3c 05 00 00       	call   402530 <_GetProcessHeap@0>
  401ff4:	89 04 24             	mov    %eax,(%esp)
  401ff7:	e8 44 05 00 00       	call   402540 <_HeapAlloc@12>
  401ffc:	5a                   	pop    %edx
  401ffd:	85 c0                	test   %eax,%eax
  401fff:	89 85 08 ff ff ff    	mov    %eax,0xffffff08(%ebp)
  402005:	74 6a                	je     402071 <_ScmStartService+0x301>
  402007:	89 58 04             	mov    %ebx,0x4(%eax)
  40200a:	89 c3                	mov    %eax,%ebx
  40200c:	c7 00 01 00 00 00    	movl   $0x1,(%eax)
  402012:	83 c3 08             	add    $0x8,%ebx
  402015:	50                   	push   %eax
  402016:	50                   	push   %eax
  402017:	8b 46 0c             	mov    0xc(%esi),%eax
  40201a:	50                   	push   %eax
  40201b:	53                   	push   %ebx
  40201c:	e8 cf 03 00 00       	call   4023f0 <_wcscpy>
  402021:	58                   	pop    %eax
  402022:	8b 46 0c             	mov    0xc(%esi),%eax
  402025:	50                   	push   %eax
  402026:	e8 a5 03 00 00       	call   4023d0 <_wcslen>
  40202b:	8b 4e 34             	mov    0x34(%esi),%ecx
  40202e:	66 c7 44 43 02 00 00 	movw   $0x0,0x2(%ebx,%eax,2)
  402035:	8d 85 10 ff ff ff    	lea    0xffffff10(%ebp),%eax
  40203b:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
  402042:	8b 9d 08 ff ff ff    	mov    0xffffff08(%ebp),%ebx
  402048:	50                   	push   %eax
  402049:	8b 85 04 ff ff ff    	mov    0xffffff04(%ebp),%eax
  40204f:	50                   	push   %eax
  402050:	53                   	push   %ebx
  402051:	51                   	push   %ecx
  402052:	e8 09 04 00 00       	call   402460 <_WriteFile@20>
  402057:	58                   	pop    %eax
  402058:	8b 85 08 ff ff ff    	mov    0xffffff08(%ebp),%eax
  40205e:	5a                   	pop    %edx
  40205f:	50                   	push   %eax
  402060:	6a 00                	push   $0x0
  402062:	50                   	push   %eax
  402063:	e8 c8 04 00 00       	call   402530 <_GetProcessHeap@0>
  402068:	89 04 24             	mov    %eax,(%esp)
  40206b:	e8 e0 04 00 00       	call   402550 <_HeapFree@12>
  402070:	58                   	pop    %eax
  402071:	83 ec 0c             	sub    $0xc,%esp
  402074:	8b 9d 7c ff ff ff    	mov    0xffffff7c(%ebp),%ebx
  40207a:	53                   	push   %ebx
  40207b:	e8 10 04 00 00       	call   402490 <_CloseHandle@4>
  402080:	8b 8d 78 ff ff ff    	mov    0xffffff78(%ebp),%ecx
  402086:	51                   	push   %ecx
  402087:	e8 04 04 00 00       	call   402490 <_CloseHandle@4>
  40208c:	89 f8                	mov    %edi,%eax
  40208e:	83 c4 0c             	add    $0xc,%esp
  402091:	e9 1c fd ff ff       	jmp    401db2 <_ScmStartService+0x42>
  402096:	51                   	push   %ecx
  402097:	68 6d 02 00 00       	push   $0x26d
  40209c:	68 56 43 40 00       	push   $0x404356
  4020a1:	68 61 43 40 00       	push   $0x404361
  4020a6:	e8 45 02 00 00       	call   4022f0 <_DbgPrint>
  4020ab:	58                   	pop    %eax
  4020ac:	5a                   	pop    %edx
  4020ad:	57                   	push   %edi
  4020ae:	68 b4 42 40 00       	push   $0x4042b4
  4020b3:	e8 38 02 00 00       	call   4022f0 <_DbgPrint>
  4020b8:	83 c4 10             	add    $0x10,%esp
  4020bb:	89 f8                	mov    %edi,%eax
  4020bd:	e9 f0 fc ff ff       	jmp    401db2 <_ScmStartService+0x42>
  4020c2:	57                   	push   %edi
  4020c3:	68 7f 02 00 00       	push   $0x27f
  4020c8:	68 56 43 40 00       	push   $0x404356
  4020cd:	68 61 43 40 00       	push   $0x404361
  4020d2:	e8 19 02 00 00       	call   4022f0 <_DbgPrint>
  4020d7:	c7 04 24 bc 43 40 00 	movl   $0x4043bc,(%esp)
  4020de:	e9 3b fe ff ff       	jmp    401f1e <_ScmStartService+0x1ae>
  4020e3:	83 ec 0c             	sub    $0xc,%esp
  4020e6:	8b 7e 34             	mov    0x34(%esi),%edi
  4020e9:	57                   	push   %edi
  4020ea:	e8 a1 03 00 00       	call   402490 <_CloseHandle@4>
  4020ef:	83 c4 0c             	add    $0xc,%esp
  4020f2:	c7 46 34 ff ff ff ff 	movl   $0xffffffff,0x34(%esi)
  4020f9:	c7 46 38 00 00 00 00 	movl   $0x0,0x38(%esi)
  402100:	c7 46 3c 00 00 00 00 	movl   $0x0,0x3c(%esi)
  402107:	e9 be fe ff ff       	jmp    401fca <_ScmStartService+0x25a>
  40210c:	8d 74 26 00          	lea    0x0(%esi),%esi

00402110 <_ScmAutoStartServices>:


VOID
ScmAutoStartServices(VOID)
{
  402110:	55                   	push   %ebp
  402111:	89 e5                	mov    %esp,%ebp
  402113:	57                   	push   %edi
  402114:	56                   	push   %esi
  402115:	53                   	push   %ebx
  402116:	83 ec 0c             	sub    $0xc,%esp
  PLIST_ENTRY GroupEntry;
  PLIST_ENTRY ServiceEntry;
  PSERVICE_GROUP CurrentGroup;
  PSERVICE CurrentService;
  ULONG i;

  /* Clear 'ServiceVisited' flag */
  ServiceEntry = ServiceListHead.Flink;
  402119:	8b 1d 60 50 40 00    	mov    0x405060,%ebx
  40211f:	89 da                	mov    %ebx,%edx
  while (ServiceEntry != &ServiceListHead)
    {
      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
      CurrentService->ServiceVisited = FALSE;
      ServiceEntry = ServiceEntry->Flink;
  402121:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402127:	74 14                	je     40213d <_ScmAutoStartServices+0x2d>
  402129:	c6 43 31 00          	movb   $0x0,0x31(%ebx)
  40212d:	8b 1b                	mov    (%ebx),%ebx
  40212f:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402135:	75 f2                	jne    402129 <_ScmAutoStartServices+0x19>
  402137:	8b 15 60 50 40 00    	mov    0x405060,%edx
    }

  /* Start all services which are members of an existing group */
  GroupEntry = GroupListHead.Flink;
  40213d:	8b 3d 70 50 40 00    	mov    0x405070,%edi
  while (GroupEntry != &GroupListHead)
    {
      CurrentGroup = CONTAINING_RECORD(GroupEntry, SERVICE_GROUP, GroupListEntry);

      DPRINT("Group '%wZ'\n", &CurrentGroup->GroupName);

      /* Start all services witch have a valid tag */
      for (i = 0; i < CurrentGroup->TagCount; i++)
        {
          ServiceEntry = ServiceListHead.Flink;
          while (ServiceEntry != &ServiceListHead)
	    {
	      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);

	      if ((RtlEqualUnicodeString(&CurrentGroup->GroupName, &CurrentService->ServiceGroup, TRUE)) &&
	          (CurrentService->Start == SERVICE_AUTO_START) &&
	          (CurrentService->ServiceVisited == FALSE) &&
		  (CurrentService->Tag == CurrentGroup->TagArray[i]))
	        {
	          CurrentService->ServiceVisited = TRUE;
	          ScmStartService(CurrentService,
			          CurrentGroup);
	        }

	      ServiceEntry = ServiceEntry->Flink;
	    }
        }

      /* Start all services which have an invalid tag or which do not have a tag */ 
      ServiceEntry = ServiceListHead.Flink;
      while (ServiceEntry != &ServiceListHead)
	{
	  CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);

	  if ((RtlEqualUnicodeString(&CurrentGroup->GroupName, &CurrentService->ServiceGroup, TRUE)) &&
	      (CurrentService->Start == SERVICE_AUTO_START) &&
	      (CurrentService->ServiceVisited == FALSE))
	    {
	      CurrentService->ServiceVisited = TRUE;
	      ScmStartService(CurrentService,
			      CurrentGroup);
	    }

	  ServiceEntry = ServiceEntry->Flink;
	}

      GroupEntry = GroupEntry->Flink;
  402143:	81 ff 70 50 40 00    	cmp    $0x405070,%edi
  402149:	0f 84 e8 00 00 00    	je     402237 <_ScmAutoStartServices+0x127>
  40214f:	8b 47 14             	mov    0x14(%edi),%eax
  402152:	c7 45 f0 00 00 00 00 	movl   $0x0,0xfffffff0(%ebp)
  402159:	83 f8 00             	cmp    $0x0,%eax
  40215c:	76 77                	jbe    4021d5 <_ScmAutoStartServices+0xc5>
  40215e:	8d 77 08             	lea    0x8(%edi),%esi
  402161:	89 d3                	mov    %edx,%ebx
  402163:	81 fa 60 50 40 00    	cmp    $0x405060,%edx
  402169:	75 0f                	jne    40217a <_ScmAutoStartServices+0x6a>
  40216b:	eb 5c                	jmp    4021c9 <_ScmAutoStartServices+0xb9>
  40216d:	8d 76 00             	lea    0x0(%esi),%esi
  402170:	8b 1b                	mov    (%ebx),%ebx
  402172:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402178:	74 46                	je     4021c0 <_ScmAutoStartServices+0xb0>
  40217a:	8d 43 18             	lea    0x18(%ebx),%eax
  40217d:	51                   	push   %ecx
  40217e:	6a 01                	push   $0x1
  402180:	50                   	push   %eax
  402181:	56                   	push   %esi
  402182:	e8 09 02 00 00       	call   402390 <_RtlEqualUnicodeString@12>
  402187:	5a                   	pop    %edx
  402188:	84 c0                	test   %al,%al
  40218a:	74 e4                	je     402170 <_ScmAutoStartServices+0x60>
  40218c:	83 7b 20 02          	cmpl   $0x2,0x20(%ebx)
  402190:	75 de                	jne    402170 <_ScmAutoStartServices+0x60>
  402192:	80 7b 31 00          	cmpb   $0x0,0x31(%ebx)
  402196:	75 d8                	jne    402170 <_ScmAutoStartServices+0x60>
  402198:	8b 47 18             	mov    0x18(%edi),%eax
  40219b:	8b 55 f0             	mov    0xfffffff0(%ebp),%edx
  40219e:	8b 04 90             	mov    (%eax,%edx,4),%eax
  4021a1:	39 43 2c             	cmp    %eax,0x2c(%ebx)
  4021a4:	75 ca                	jne    402170 <_ScmAutoStartServices+0x60>
  4021a6:	c6 43 31 01          	movb   $0x1,0x31(%ebx)
  4021aa:	89 d8                	mov    %ebx,%eax
  4021ac:	89 fa                	mov    %edi,%edx
  4021ae:	e8 bd fb ff ff       	call   401d70 <_ScmStartService>
  4021b3:	8b 1b                	mov    (%ebx),%ebx
  4021b5:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  4021bb:	75 bd                	jne    40217a <_ScmAutoStartServices+0x6a>
  4021bd:	8d 76 00             	lea    0x0(%esi),%esi
  4021c0:	8b 15 60 50 40 00    	mov    0x405060,%edx
  4021c6:	8b 47 14             	mov    0x14(%edi),%eax
  4021c9:	8b 5d f0             	mov    0xfffffff0(%ebp),%ebx
  4021cc:	43                   	inc    %ebx
  4021cd:	89 5d f0             	mov    %ebx,0xfffffff0(%ebp)
  4021d0:	3b 45 f0             	cmp    0xfffffff0(%ebp),%eax
  4021d3:	77 8c                	ja     402161 <_ScmAutoStartServices+0x51>
  4021d5:	89 d3                	mov    %edx,%ebx
  4021d7:	81 fa 60 50 40 00    	cmp    $0x405060,%edx
  4021dd:	74 4a                	je     402229 <_ScmAutoStartServices+0x119>
  4021df:	8d 77 08             	lea    0x8(%edi),%esi
  4021e2:	eb 0a                	jmp    4021ee <_ScmAutoStartServices+0xde>
  4021e4:	8b 1b                	mov    (%ebx),%ebx
  4021e6:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  4021ec:	74 35                	je     402223 <_ScmAutoStartServices+0x113>
  4021ee:	8d 43 18             	lea    0x18(%ebx),%eax
  4021f1:	51                   	push   %ecx
  4021f2:	6a 01                	push   $0x1
  4021f4:	50                   	push   %eax
  4021f5:	56                   	push   %esi
  4021f6:	e8 95 01 00 00       	call   402390 <_RtlEqualUnicodeString@12>
  4021fb:	5a                   	pop    %edx
  4021fc:	84 c0                	test   %al,%al
  4021fe:	74 e4                	je     4021e4 <_ScmAutoStartServices+0xd4>
  402200:	83 7b 20 02          	cmpl   $0x2,0x20(%ebx)
  402204:	75 de                	jne    4021e4 <_ScmAutoStartServices+0xd4>
  402206:	80 7b 31 00          	cmpb   $0x0,0x31(%ebx)
  40220a:	75 d8                	jne    4021e4 <_ScmAutoStartServices+0xd4>
  40220c:	c6 43 31 01          	movb   $0x1,0x31(%ebx)
  402210:	89 d8                	mov    %ebx,%eax
  402212:	89 fa                	mov    %edi,%edx
  402214:	e8 57 fb ff ff       	call   401d70 <_ScmStartService>
  402219:	8b 1b                	mov    (%ebx),%ebx
  40221b:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402221:	75 cb                	jne    4021ee <_ScmAutoStartServices+0xde>
  402223:	8b 15 60 50 40 00    	mov    0x405060,%edx
  402229:	8b 3f                	mov    (%edi),%edi
  40222b:	81 ff 70 50 40 00    	cmp    $0x405070,%edi
  402231:	0f 85 18 ff ff ff    	jne    40214f <_ScmAutoStartServices+0x3f>
    }

  /* Start all services which are members of any non-existing group */
  ServiceEntry = ServiceListHead.Flink;
  402237:	89 d3                	mov    %edx,%ebx
  while (ServiceEntry != &ServiceListHead)
    {
      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);

      if ((CurrentService->ServiceGroup.Length != 0) &&
	  (CurrentService->Start == SERVICE_AUTO_START) &&
	  (CurrentService->ServiceVisited == FALSE))
	{
	  CurrentService->ServiceVisited = TRUE;
	  ScmStartService(CurrentService,
			  NULL);
	}

      ServiceEntry = ServiceEntry->Flink;
  402239:	81 fa 60 50 40 00    	cmp    $0x405060,%edx
  40223f:	75 0f                	jne    402250 <_ScmAutoStartServices+0x140>
  402241:	e9 94 00 00 00       	jmp    4022da <_ScmAutoStartServices+0x1ca>
  402246:	8b 1b                	mov    (%ebx),%ebx
  402248:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  40224e:	74 2a                	je     40227a <_ScmAutoStartServices+0x16a>
  402250:	66 83 7b 18 00       	cmpw   $0x0,0x18(%ebx)
  402255:	74 ef                	je     402246 <_ScmAutoStartServices+0x136>
  402257:	83 7b 20 02          	cmpl   $0x2,0x20(%ebx)
  40225b:	75 e9                	jne    402246 <_ScmAutoStartServices+0x136>
  40225d:	80 7b 31 00          	cmpb   $0x0,0x31(%ebx)
  402261:	75 e3                	jne    402246 <_ScmAutoStartServices+0x136>
  402263:	c6 43 31 01          	movb   $0x1,0x31(%ebx)
  402267:	31 d2                	xor    %edx,%edx
  402269:	89 d8                	mov    %ebx,%eax
  40226b:	e8 00 fb ff ff       	call   401d70 <_ScmStartService>
  402270:	8b 1b                	mov    (%ebx),%ebx
  402272:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402278:	75 d6                	jne    402250 <_ScmAutoStartServices+0x140>
  40227a:	8b 1d 60 50 40 00    	mov    0x405060,%ebx
    }

  /* Start all services which are not a member of any group */
  ServiceEntry = ServiceListHead.Flink;
  while (ServiceEntry != &ServiceListHead)
    {
      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);

      if ((CurrentService->ServiceGroup.Length == 0) &&
	  (CurrentService->Start == SERVICE_AUTO_START) &&
	  (CurrentService->ServiceVisited == FALSE))
	{
	  CurrentService->ServiceVisited = TRUE;
	  ScmStartService(CurrentService,
			  NULL);
	}

      ServiceEntry = ServiceEntry->Flink;
  402280:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402286:	75 12                	jne    40229a <_ScmAutoStartServices+0x18a>
  402288:	eb 50                	jmp    4022da <_ScmAutoStartServices+0x1ca>
  40228a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  402290:	8b 1b                	mov    (%ebx),%ebx
  402292:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  402298:	74 2a                	je     4022c4 <_ScmAutoStartServices+0x1b4>
  40229a:	66 83 7b 18 00       	cmpw   $0x0,0x18(%ebx)
  40229f:	75 ef                	jne    402290 <_ScmAutoStartServices+0x180>
  4022a1:	83 7b 20 02          	cmpl   $0x2,0x20(%ebx)
  4022a5:	75 e9                	jne    402290 <_ScmAutoStartServices+0x180>
  4022a7:	80 7b 31 00          	cmpb   $0x0,0x31(%ebx)
  4022ab:	75 e3                	jne    402290 <_ScmAutoStartServices+0x180>
  4022ad:	c6 43 31 01          	movb   $0x1,0x31(%ebx)
  4022b1:	31 d2                	xor    %edx,%edx
  4022b3:	89 d8                	mov    %ebx,%eax
  4022b5:	e8 b6 fa ff ff       	call   401d70 <_ScmStartService>
  4022ba:	8b 1b                	mov    (%ebx),%ebx
  4022bc:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  4022c2:	75 d6                	jne    40229a <_ScmAutoStartServices+0x18a>
  4022c4:	8b 1d 60 50 40 00    	mov    0x405060,%ebx
  4022ca:	eb 06                	jmp    4022d2 <_ScmAutoStartServices+0x1c2>
    }

  /* Clear 'ServiceVisited' flag again */
  ServiceEntry = ServiceListHead.Flink;
  while (ServiceEntry != &ServiceListHead)
    {
      CurrentService = CONTAINING_RECORD(ServiceEntry, SERVICE, ServiceListEntry);
      CurrentService->ServiceVisited = FALSE;
  4022cc:	c6 43 31 00          	movb   $0x0,0x31(%ebx)
      ServiceEntry = ServiceEntry->Flink;
  4022d0:	8b 1b                	mov    (%ebx),%ebx
  4022d2:	81 fb 60 50 40 00    	cmp    $0x405060,%ebx
  4022d8:	75 f2                	jne    4022cc <_ScmAutoStartServices+0x1bc>
  4022da:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  4022dd:	5b                   	pop    %ebx
  4022de:	5e                   	pop    %esi
  4022df:	5f                   	pop    %edi
  4022e0:	5d                   	pop    %ebp
  4022e1:	c3                   	ret    
  4022e2:	90                   	nop    
  4022e3:	90                   	nop    
  4022e4:	90                   	nop    
  4022e5:	90                   	nop    
  4022e6:	90                   	nop    
  4022e7:	90                   	nop    
  4022e8:	90                   	nop    
  4022e9:	90                   	nop    
  4022ea:	90                   	nop    
  4022eb:	90                   	nop    
  4022ec:	90                   	nop    
  4022ed:	90                   	nop    
  4022ee:	90                   	nop    
  4022ef:	90                   	nop    

004022f0 <_DbgPrint>:
  4022f0:	ff 25 38 62 40 00    	jmp    *0x406238
  4022f6:	90                   	nop    
  4022f7:	90                   	nop    
	...

00402300 <_RtlCreateUnicodeString@8>:
  402300:	ff 25 50 62 40 00    	jmp    *0x406250
  402306:	90                   	nop    
  402307:	90                   	nop    
	...

00402310 <_RtlZeroMemory@8>:
  402310:	ff 25 64 62 40 00    	jmp    *0x406264
  402316:	90                   	nop    
  402317:	90                   	nop    
	...

00402320 <_RtlQueryRegistryValues@20>:
  402320:	ff 25 60 62 40 00    	jmp    *0x406260
  402326:	90                   	nop    
  402327:	90                   	nop    
	...

00402330 <_RtlpNtOpenKey@16>:
  402330:	ff 25 68 62 40 00    	jmp    *0x406268
  402336:	90                   	nop    
  402337:	90                   	nop    
	...

00402340 <_NtEnumerateKey@24>:
  402340:	ff 25 40 62 40 00    	jmp    *0x406240
  402346:	90                   	nop    
  402347:	90                   	nop    
	...

00402350 <_NtClose@4>:
  402350:	ff 25 3c 62 40 00    	jmp    *0x40623c
  402356:	90                   	nop    
  402357:	90                   	nop    
	...

00402360 <_RtlFreeUnicodeString@4>:
  402360:	ff 25 58 62 40 00    	jmp    *0x406258
  402366:	90                   	nop    
  402367:	90                   	nop    
	...

00402370 <_NtOpenDirectoryObject@12>:
  402370:	ff 25 48 62 40 00    	jmp    *0x406248
  402376:	90                   	nop    
  402377:	90                   	nop    
	...

00402380 <_NtQueryDirectoryObject@28>:
  402380:	ff 25 4c 62 40 00    	jmp    *0x40624c
  402386:	90                   	nop    
  402387:	90                   	nop    
	...

00402390 <_RtlEqualUnicodeString@12>:
  402390:	ff 25 54 62 40 00    	jmp    *0x406254
  402396:	90                   	nop    
  402397:	90                   	nop    
	...

004023a0 <_NtLoadDriver@4>:
  4023a0:	ff 25 44 62 40 00    	jmp    *0x406244
  4023a6:	90                   	nop    
  4023a7:	90                   	nop    
	...

004023b0 <_RtlInitUnicodeString@8>:
  4023b0:	ff 25 5c 62 40 00    	jmp    *0x40625c
  4023b6:	90                   	nop    
  4023b7:	90                   	nop    
	...

004023c0 <_memcpy>:
  4023c0:	ff 25 6c 62 40 00    	jmp    *0x40626c
  4023c6:	90                   	nop    
  4023c7:	90                   	nop    
	...

004023d0 <_wcslen>:
  4023d0:	ff 25 78 62 40 00    	jmp    *0x406278
  4023d6:	90                   	nop    
  4023d7:	90                   	nop    
	...

004023e0 <_wcscat>:
  4023e0:	ff 25 70 62 40 00    	jmp    *0x406270
  4023e6:	90                   	nop    
  4023e7:	90                   	nop    
	...

004023f0 <_wcscpy>:
  4023f0:	ff 25 74 62 40 00    	jmp    *0x406274
  4023f6:	90                   	nop    
  4023f7:	90                   	nop    
	...

00402400 <_SetUnhandledExceptionFilter@4>:
  402400:	ff 25 20 62 40 00    	jmp    *0x406220
  402406:	90                   	nop    
  402407:	90                   	nop    
	...

00402410 <_ExitProcess@4>:
  402410:	ff 25 ec 61 40 00    	jmp    *0x4061ec
  402416:	90                   	nop    
  402417:	90                   	nop    
	...

00402420 <_CreateEventA@16>:
  402420:	ff 25 d4 61 40 00    	jmp    *0x4061d4
  402426:	90                   	nop    
  402427:	90                   	nop    
	...

00402430 <_GetLastError@0>:
  402430:	ff 25 00 62 40 00    	jmp    *0x406200
  402436:	90                   	nop    
  402437:	90                   	nop    
	...

00402440 <_OpenEventA@12>:
  402440:	ff 25 10 62 40 00    	jmp    *0x406210
  402446:	90                   	nop    
  402447:	90                   	nop    
	...

00402450 <_ReadFile@20>:
  402450:	ff 25 14 62 40 00    	jmp    *0x406214
  402456:	90                   	nop    
  402457:	90                   	nop    
	...

00402460 <_WriteFile@20>:
  402460:	ff 25 2c 62 40 00    	jmp    *0x40622c
  402466:	90                   	nop    
  402467:	90                   	nop    
	...

00402470 <_FlushFileBuffers@4>:
  402470:	ff 25 f4 61 40 00    	jmp    *0x4061f4
  402476:	90                   	nop    
  402477:	90                   	nop    
	...

00402480 <_DisconnectNamedPipe@4>:
  402480:	ff 25 e8 61 40 00    	jmp    *0x4061e8
  402486:	90                   	nop    
  402487:	90                   	nop    
	...

00402490 <_CloseHandle@4>:
  402490:	ff 25 cc 61 40 00    	jmp    *0x4061cc
  402496:	90                   	nop    
  402497:	90                   	nop    
	...

004024a0 <_CreateNamedPipeA@32>:
  4024a0:	ff 25 d8 61 40 00    	jmp    *0x4061d8
  4024a6:	90                   	nop    
  4024a7:	90                   	nop    
	...

004024b0 <_ConnectNamedPipe@8>:
  4024b0:	ff 25 d0 61 40 00    	jmp    *0x4061d0
  4024b6:	90                   	nop    
  4024b7:	90                   	nop    
	...

004024c0 <_CreateThread@24>:
  4024c0:	ff 25 e4 61 40 00    	jmp    *0x4061e4
  4024c6:	90                   	nop    
  4024c7:	90                   	nop    
	...

004024d0 <_Sleep@4>:
  4024d0:	ff 25 24 62 40 00    	jmp    *0x406224
  4024d6:	90                   	nop    
  4024d7:	90                   	nop    
	...

004024e0 <_GetCurrentProcess@0>:
  4024e0:	ff 25 f8 61 40 00    	jmp    *0x4061f8
  4024e6:	90                   	nop    
  4024e7:	90                   	nop    
	...

004024f0 <_ExitThread@4>:
  4024f0:	ff 25 f0 61 40 00    	jmp    *0x4061f0
  4024f6:	90                   	nop    
  4024f7:	90                   	nop    
	...

00402500 <_GetCurrentProcessId@0>:
  402500:	ff 25 fc 61 40 00    	jmp    *0x4061fc
  402506:	90                   	nop    
  402507:	90                   	nop    
	...

00402510 <_SetEvent@4>:
  402510:	ff 25 1c 62 40 00    	jmp    *0x40621c
  402516:	90                   	nop    
  402517:	90                   	nop    
	...

00402520 <_WaitForSingleObject@8>:
  402520:	ff 25 28 62 40 00    	jmp    *0x406228
  402526:	90                   	nop    
  402527:	90                   	nop    
	...

00402530 <_GetProcessHeap@0>:
  402530:	ff 25 04 62 40 00    	jmp    *0x406204
  402536:	90                   	nop    
  402537:	90                   	nop    
	...

00402540 <_HeapAlloc@12>:
  402540:	ff 25 08 62 40 00    	jmp    *0x406208
  402546:	90                   	nop    
  402547:	90                   	nop    
	...

00402550 <_HeapFree@12>:
  402550:	ff 25 0c 62 40 00    	jmp    *0x40620c
  402556:	90                   	nop    
  402557:	90                   	nop    
	...

00402560 <_CreateNamedPipeW@32>:
  402560:	ff 25 dc 61 40 00    	jmp    *0x4061dc
  402566:	90                   	nop    
  402567:	90                   	nop    
	...

00402570 <_CreateProcessW@40>:
  402570:	ff 25 e0 61 40 00    	jmp    *0x4061e0
  402576:	90                   	nop    
  402577:	90                   	nop    
	...

00402580 <_ResumeThread@4>:
  402580:	ff 25 18 62 40 00    	jmp    *0x406218
  402586:	90                   	nop    
  402587:	90                   	nop    
	...

00402590 <_RegisterServicesProcess@4>:
  402590:	ff 25 84 62 40 00    	jmp    *0x406284
  402596:	90                   	nop    
  402597:	90                   	nop    
	...

004025a0 <_main>:
  4025a0:	55                   	push   %ebp
  4025a1:	b8 10 00 00 00       	mov    $0x10,%eax
  4025a6:	89 e5                	mov    %esp,%ebp
  4025a8:	53                   	push   %ebx
  4025a9:	83 ec 64             	sub    $0x64,%esp
  4025ac:	83 e4 f0             	and    $0xfffffff0,%esp
  4025af:	e8 4c 05 00 00       	call   402b00 <___chkstk>
  4025b4:	e8 e7 01 00 00       	call   4027a0 <___main>
  4025b9:	e8 82 06 00 00       	call   402c40 <_GetCommandLineA@0>
  4025be:	89 c3                	mov    %eax,%ebx
  4025c0:	8d 45 a8             	lea    0xffffffa8(%ebp),%eax
  4025c3:	89 04 24             	mov    %eax,(%esp)
  4025c6:	e8 85 06 00 00       	call   402c50 <_GetStartupInfoA@4>
  4025cb:	83 ec 04             	sub    $0x4,%esp
  4025ce:	85 db                	test   %ebx,%ebx
  4025d0:	75 06                	jne    4025d8 <_main+0x38>
  4025d2:	e9 9f 00 00 00       	jmp    402676 <_main+0xd6>
  4025d7:	43                   	inc    %ebx
  4025d8:	0f b6 0b             	movzbl (%ebx),%ecx
  4025db:	80 f9 20             	cmp    $0x20,%cl
  4025de:	0f 94 c0             	sete   %al
  4025e1:	80 f9 09             	cmp    $0x9,%cl
  4025e4:	0f 94 c2             	sete   %dl
  4025e7:	09 d0                	or     %edx,%eax
  4025e9:	a8 01                	test   $0x1,%al
  4025eb:	75 ea                	jne    4025d7 <_main+0x37>
  4025ed:	80 f9 22             	cmp    $0x22,%cl
  4025f0:	74 3e                	je     402630 <_main+0x90>
  4025f2:	80 f9 20             	cmp    $0x20,%cl
  4025f5:	0f 95 c0             	setne  %al
  4025f8:	31 d2                	xor    %edx,%edx
  4025fa:	80 f9 09             	cmp    $0x9,%cl
  4025fd:	0f 95 c2             	setne  %dl
  402600:	85 d0                	test   %edx,%eax
  402602:	74 4c                	je     402650 <_main+0xb0>
  402604:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  40260a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi
  402610:	84 c9                	test   %cl,%cl
  402612:	74 3c                	je     402650 <_main+0xb0>
  402614:	43                   	inc    %ebx
  402615:	0f b6 0b             	movzbl (%ebx),%ecx
  402618:	80 f9 20             	cmp    $0x20,%cl
  40261b:	0f 95 c0             	setne  %al
  40261e:	31 d2                	xor    %edx,%edx
  402620:	80 f9 09             	cmp    $0x9,%cl
  402623:	0f 95 c2             	setne  %dl
  402626:	85 d0                	test   %edx,%eax
  402628:	75 e6                	jne    402610 <_main+0x70>
  40262a:	eb 24                	jmp    402650 <_main+0xb0>
  40262c:	8d 74 26 00          	lea    0x0(%esi),%esi
  402630:	43                   	inc    %ebx
  402631:	0f b6 0b             	movzbl (%ebx),%ecx
  402634:	80 f9 22             	cmp    $0x22,%cl
  402637:	0f 95 c0             	setne  %al
  40263a:	31 d2                	xor    %edx,%edx
  40263c:	84 c9                	test   %cl,%cl
  40263e:	0f 95 c2             	setne  %dl
  402641:	85 d0                	test   %edx,%eax
  402643:	75 eb                	jne    402630 <_main+0x90>
  402645:	80 f9 22             	cmp    $0x22,%cl
  402648:	74 68                	je     4026b2 <_main+0x112>
  40264a:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  402650:	80 f9 20             	cmp    $0x20,%cl
  402653:	0f 94 c0             	sete   %al
  402656:	80 f9 09             	cmp    $0x9,%cl
  402659:	0f 94 c2             	sete   %dl
  40265c:	eb 12                	jmp    402670 <_main+0xd0>
  40265e:	89 f6                	mov    %esi,%esi
  402660:	43                   	inc    %ebx
  402661:	0f b6 0b             	movzbl (%ebx),%ecx
  402664:	80 f9 20             	cmp    $0x20,%cl
  402667:	0f 94 c2             	sete   %dl
  40266a:	80 f9 09             	cmp    $0x9,%cl
  40266d:	0f 94 c0             	sete   %al
  402670:	09 d0                	or     %edx,%eax
  402672:	a8 01                	test   $0x1,%al
  402674:	75 ea                	jne    402660 <_main+0xc0>
  402676:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
  40267d:	e8 de 05 00 00       	call   402c60 <_GetModuleHandleA@4>
  402682:	83 ec 04             	sub    $0x4,%esp
  402685:	f6 45 d4 01          	testb  $0x1,0xffffffd4(%ebp)
  402689:	ba 0a 00 00 00       	mov    $0xa,%edx
  40268e:	74 04                	je     402694 <_main+0xf4>
  402690:	0f b7 55 d8          	movzwl 0xffffffd8(%ebp),%edx
  402694:	89 5c 24 08          	mov    %ebx,0x8(%esp)
  402698:	31 db                	xor    %ebx,%ebx
  40269a:	89 5c 24 04          	mov    %ebx,0x4(%esp)
  40269e:	89 54 24 0c          	mov    %edx,0xc(%esp)
  4026a2:	89 04 24             	mov    %eax,(%esp)
  4026a5:	e8 06 ef ff ff       	call   4015b0 <_WinMain@16>
  4026aa:	83 ec 10             	sub    $0x10,%esp
  4026ad:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  4026b0:	c9                   	leave  
  4026b1:	c3                   	ret    
  4026b2:	43                   	inc    %ebx
  4026b3:	0f b6 0b             	movzbl (%ebx),%ecx
  4026b6:	eb 98                	jmp    402650 <_main+0xb0>
  4026b8:	90                   	nop    
  4026b9:	90                   	nop    
  4026ba:	90                   	nop    
  4026bb:	90                   	nop    
  4026bc:	90                   	nop    
  4026bd:	90                   	nop    
  4026be:	90                   	nop    
  4026bf:	90                   	nop    

004026c0 <__pei386_runtime_relocator>:
  4026c0:	55                   	push   %ebp
  4026c1:	b9 c0 44 40 00       	mov    $0x4044c0,%ecx
  4026c6:	89 e5                	mov    %esp,%ebp
  4026c8:	eb 14                	jmp    4026de <__pei386_runtime_relocator+0x1e>
  4026ca:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  4026d0:	8b 51 04             	mov    0x4(%ecx),%edx
  4026d3:	8b 01                	mov    (%ecx),%eax
  4026d5:	83 c1 08             	add    $0x8,%ecx
  4026d8:	01 82 00 00 40 00    	add    %eax,0x400000(%edx)
  4026de:	81 f9 c0 44 40 00    	cmp    $0x4044c0,%ecx
  4026e4:	72 ea                	jb     4026d0 <__pei386_runtime_relocator+0x10>
  4026e6:	5d                   	pop    %ebp
  4026e7:	c3                   	ret    
  4026e8:	90                   	nop    
  4026e9:	90                   	nop    
  4026ea:	90                   	nop    
  4026eb:	90                   	nop    
  4026ec:	90                   	nop    
  4026ed:	90                   	nop    
  4026ee:	90                   	nop    
  4026ef:	90                   	nop    

004026f0 <__fpreset>:
  4026f0:	55                   	push   %ebp
  4026f1:	89 e5                	mov    %esp,%ebp
  4026f3:	db e3                	fninit 
  4026f5:	5d                   	pop    %ebp
  4026f6:	c3                   	ret    
  4026f7:	90                   	nop    
  4026f8:	90                   	nop    
  4026f9:	90                   	nop    
  4026fa:	90                   	nop    
  4026fb:	90                   	nop    
  4026fc:	90                   	nop    
  4026fd:	90                   	nop    
  4026fe:	90                   	nop    
  4026ff:	90                   	nop    

00402700 <___do_global_dtors>:
  402700:	55                   	push   %ebp
  402701:	89 e5                	mov    %esp,%ebp
  402703:	83 ec 08             	sub    $0x8,%esp
  402706:	a1 20 30 40 00       	mov    0x403020,%eax
  40270b:	8b 08                	mov    (%eax),%ecx
  40270d:	85 c9                	test   %ecx,%ecx
  40270f:	74 26                	je     402737 <___do_global_dtors+0x37>
  402711:	eb 0d                	jmp    402720 <___do_global_dtors+0x20>
  402713:	90                   	nop    
  402714:	90                   	nop    
  402715:	90                   	nop    
  402716:	90                   	nop    
  402717:	90                   	nop    
  402718:	90                   	nop    
  402719:	90                   	nop    
  40271a:	90                   	nop    
  40271b:	90                   	nop    
  40271c:	90                   	nop    
  40271d:	90                   	nop    
  40271e:	90                   	nop    
  40271f:	90                   	nop    
  402720:	ff 10                	call   *(%eax)
  402722:	8b 0d 20 30 40 00    	mov    0x403020,%ecx
  402728:	8b 51 04             	mov    0x4(%ecx),%edx
  40272b:	8d 41 04             	lea    0x4(%ecx),%eax
  40272e:	a3 20 30 40 00       	mov    %eax,0x403020
  402733:	85 d2                	test   %edx,%edx
  402735:	75 e9                	jne    402720 <___do_global_dtors+0x20>
  402737:	c9                   	leave  
  402738:	c3                   	ret    
  402739:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

00402740 <___do_global_ctors>:
  402740:	55                   	push   %ebp
  402741:	89 e5                	mov    %esp,%ebp
  402743:	53                   	push   %ebx
  402744:	83 ec 04             	sub    $0x4,%esp
  402747:	a1 e0 2c 40 00       	mov    0x402ce0,%eax
  40274c:	83 f8 ff             	cmp    $0xffffffff,%eax
  40274f:	74 29                	je     40277a <___do_global_ctors+0x3a>
  402751:	85 c0                	test   %eax,%eax
  402753:	89 c3                	mov    %eax,%ebx
  402755:	74 13                	je     40276a <___do_global_ctors+0x2a>
  402757:	89 f6                	mov    %esi,%esi
  402759:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi
  402760:	ff 14 9d e0 2c 40 00 	call   *0x402ce0(,%ebx,4)
  402767:	4b                   	dec    %ebx
  402768:	75 f6                	jne    402760 <___do_global_ctors+0x20>
  40276a:	c7 04 24 00 27 40 00 	movl   $0x402700,(%esp)
  402771:	e8 ea ea ff ff       	call   401260 <_atexit>
  402776:	5b                   	pop    %ebx
  402777:	5b                   	pop    %ebx
  402778:	5d                   	pop    %ebp
  402779:	c3                   	ret    
  40277a:	8b 0d e4 2c 40 00    	mov    0x402ce4,%ecx
  402780:	31 c0                	xor    %eax,%eax
  402782:	85 c9                	test   %ecx,%ecx
  402784:	eb 0a                	jmp    402790 <___do_global_ctors+0x50>
  402786:	40                   	inc    %eax
  402787:	8b 14 85 e4 2c 40 00 	mov    0x402ce4(,%eax,4),%edx
  40278e:	85 d2                	test   %edx,%edx
  402790:	75 f4                	jne    402786 <___do_global_ctors+0x46>
  402792:	eb bd                	jmp    402751 <___do_global_ctors+0x11>
  402794:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  40279a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

004027a0 <___main>:
  4027a0:	55                   	push   %ebp
  4027a1:	89 e5                	mov    %esp,%ebp
  4027a3:	53                   	push   %ebx
  4027a4:	83 ec 04             	sub    $0x4,%esp
  4027a7:	a1 20 50 40 00       	mov    0x405020,%eax
  4027ac:	85 c0                	test   %eax,%eax
  4027ae:	75 36                	jne    4027e6 <___main+0x46>
  4027b0:	a1 e0 2c 40 00       	mov    0x402ce0,%eax
  4027b5:	bb 01 00 00 00       	mov    $0x1,%ebx
  4027ba:	89 1d 20 50 40 00    	mov    %ebx,0x405020
  4027c0:	83 f8 ff             	cmp    $0xffffffff,%eax
  4027c3:	74 25                	je     4027ea <___main+0x4a>
  4027c5:	85 c0                	test   %eax,%eax
  4027c7:	89 c3                	mov    %eax,%ebx
  4027c9:	74 0f                	je     4027da <___main+0x3a>
  4027cb:	90                   	nop    
  4027cc:	8d 74 26 00          	lea    0x0(%esi),%esi
  4027d0:	ff 14 9d e0 2c 40 00 	call   *0x402ce0(,%ebx,4)
  4027d7:	4b                   	dec    %ebx
  4027d8:	75 f6                	jne    4027d0 <___main+0x30>
  4027da:	c7 04 24 00 27 40 00 	movl   $0x402700,(%esp)
  4027e1:	e8 7a ea ff ff       	call   401260 <_atexit>
  4027e6:	5b                   	pop    %ebx
  4027e7:	5b                   	pop    %ebx
  4027e8:	5d                   	pop    %ebp
  4027e9:	c3                   	ret    
  4027ea:	8b 0d e4 2c 40 00    	mov    0x402ce4,%ecx
  4027f0:	31 c0                	xor    %eax,%eax
  4027f2:	85 c9                	test   %ecx,%ecx
  4027f4:	eb 0a                	jmp    402800 <___main+0x60>
  4027f6:	40                   	inc    %eax
  4027f7:	8b 14 85 e4 2c 40 00 	mov    0x402ce4(,%eax,4),%edx
  4027fe:	85 d2                	test   %edx,%edx
  402800:	75 f4                	jne    4027f6 <___main+0x56>
  402802:	eb c1                	jmp    4027c5 <___main+0x25>
  402804:	90                   	nop    
  402805:	90                   	nop    
  402806:	90                   	nop    
  402807:	90                   	nop    
  402808:	90                   	nop    
  402809:	90                   	nop    
  40280a:	90                   	nop    
  40280b:	90                   	nop    
  40280c:	90                   	nop    
  40280d:	90                   	nop    
  40280e:	90                   	nop    
  40280f:	90                   	nop    

00402810 <___w32_sharedptr_default_unexpected>:
  402810:	55                   	push   %ebp
  402811:	a1 90 50 40 00       	mov    0x405090,%eax
  402816:	89 e5                	mov    %esp,%ebp
  402818:	5d                   	pop    %ebp
  402819:	8b 48 04             	mov    0x4(%eax),%ecx
  40281c:	ff e1                	jmp    *%ecx
  40281e:	89 f6                	mov    %esi,%esi

00402820 <___w32_sharedptr_get>:
  402820:	55                   	push   %ebp
  402821:	ba 42 00 00 00       	mov    $0x42,%edx
  402826:	89 e5                	mov    %esp,%ebp
  402828:	53                   	push   %ebx
  402829:	0f b7 c0             	movzwl %ax,%eax
  40282c:	83 ec 64             	sub    $0x64,%esp
  40282f:	89 54 24 08          	mov    %edx,0x8(%esp)
  402833:	8d 55 a8             	lea    0xffffffa8(%ebp),%edx
  402836:	31 db                	xor    %ebx,%ebx
  402838:	89 54 24 04          	mov    %edx,0x4(%esp)
  40283c:	89 04 24             	mov    %eax,(%esp)
  40283f:	ff 15 ac 62 40 00    	call   *0x4062ac
  402845:	ba 1f 00 00 00       	mov    $0x1f,%edx
  40284a:	b9 01 00 00 00       	mov    $0x1,%ecx
  40284f:	83 ec 0c             	sub    $0xc,%esp
  402852:	85 c0                	test   %eax,%eax
  402854:	75 07                	jne    40285d <___w32_sharedptr_get+0x3d>
  402856:	eb 46                	jmp    40289e <___w32_sharedptr_get+0x7e>
  402858:	01 c9                	add    %ecx,%ecx
  40285a:	4a                   	dec    %edx
  40285b:	78 0e                	js     40286b <___w32_sharedptr_get+0x4b>
  40285d:	80 7c 2a a8 41       	cmpb   $0x41,0xffffffa8(%edx,%ebp,1)
  402862:	75 f4                	jne    402858 <___w32_sharedptr_get+0x38>
  402864:	09 cb                	or     %ecx,%ebx
  402866:	01 c9                	add    %ecx,%ecx
  402868:	4a                   	dec    %edx
  402869:	79 f2                	jns    40285d <___w32_sharedptr_get+0x3d>
  40286b:	83 3b 3c             	cmpl   $0x3c,(%ebx)
  40286e:	75 07                	jne    402877 <___w32_sharedptr_get+0x57>
  402870:	89 d8                	mov    %ebx,%eax
  402872:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  402875:	c9                   	leave  
  402876:	c3                   	ret    
  402877:	b9 04 44 40 00       	mov    $0x404404,%ecx
  40287c:	ba ea 00 00 00       	mov    $0xea,%edx
  402881:	89 4c 24 0c          	mov    %ecx,0xc(%esp)
  402885:	89 54 24 08          	mov    %edx,0x8(%esp)
  402889:	c7 04 24 31 44 40 00 	movl   $0x404431,(%esp)
  402890:	b8 50 44 40 00       	mov    $0x404450,%eax
  402895:	89 44 24 04          	mov    %eax,0x4(%esp)
  402899:	e8 92 02 00 00       	call   402b30 <___eprintf>
  40289e:	b8 7c 44 40 00       	mov    $0x40447c,%eax
  4028a3:	bb e4 00 00 00       	mov    $0xe4,%ebx
  4028a8:	89 44 24 0c          	mov    %eax,0xc(%esp)
  4028ac:	89 5c 24 08          	mov    %ebx,0x8(%esp)
  4028b0:	eb d7                	jmp    402889 <___w32_sharedptr_get+0x69>
  4028b2:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi
  4028b9:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

004028c0 <___w32_sharedptr_initialize>:
  4028c0:	55                   	push   %ebp
  4028c1:	89 e5                	mov    %esp,%ebp
  4028c3:	57                   	push   %edi
  4028c4:	56                   	push   %esi
  4028c5:	53                   	push   %ebx
  4028c6:	81 ec cc 00 00 00    	sub    $0xcc,%esp
  4028cc:	8b 0d 90 50 40 00    	mov    0x405090,%ecx
  4028d2:	85 c9                	test   %ecx,%ecx
  4028d4:	74 08                	je     4028de <___w32_sharedptr_initialize+0x1e>
  4028d6:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  4028d9:	5b                   	pop    %ebx
  4028da:	5e                   	pop    %esi
  4028db:	5f                   	pop    %edi
  4028dc:	5d                   	pop    %ebp
  4028dd:	c3                   	ret    
  4028de:	c7 45 98 41 41 41 41 	movl   $0x41414141,0xffffff98(%ebp)
  4028e5:	a1 e0 43 40 00       	mov    0x4043e0,%eax
  4028ea:	8d 75 98             	lea    0xffffff98(%ebp),%esi
  4028ed:	c7 45 9c 41 41 41 41 	movl   $0x41414141,0xffffff9c(%ebp)
  4028f4:	c7 45 a0 41 41 41 41 	movl   $0x41414141,0xffffffa0(%ebp)
  4028fb:	89 45 b8             	mov    %eax,0xffffffb8(%ebp)
  4028fe:	a1 e4 43 40 00       	mov    0x4043e4,%eax
  402903:	c7 45 a4 41 41 41 41 	movl   $0x41414141,0xffffffa4(%ebp)
  40290a:	c7 45 a8 41 41 41 41 	movl   $0x41414141,0xffffffa8(%ebp)
  402911:	89 45 bc             	mov    %eax,0xffffffbc(%ebp)
  402914:	a1 e8 43 40 00       	mov    0x4043e8,%eax
  402919:	c7 45 ac 41 41 41 41 	movl   $0x41414141,0xffffffac(%ebp)
  402920:	c7 45 b0 41 41 41 41 	movl   $0x41414141,0xffffffb0(%ebp)
  402927:	89 45 c0             	mov    %eax,0xffffffc0(%ebp)
  40292a:	a1 ec 43 40 00       	mov    0x4043ec,%eax
  40292f:	c7 45 b4 41 41 41 41 	movl   $0x41414141,0xffffffb4(%ebp)
  402936:	89 45 c4             	mov    %eax,0xffffffc4(%ebp)
  402939:	a1 f0 43 40 00       	mov    0x4043f0,%eax
  40293e:	89 45 c8             	mov    %eax,0xffffffc8(%ebp)
  402941:	a1 f4 43 40 00       	mov    0x4043f4,%eax
  402946:	89 45 cc             	mov    %eax,0xffffffcc(%ebp)
  402949:	a1 f8 43 40 00       	mov    0x4043f8,%eax
  40294e:	89 45 d0             	mov    %eax,0xffffffd0(%ebp)
  402951:	a1 fc 43 40 00       	mov    0x4043fc,%eax
  402956:	89 45 d4             	mov    %eax,0xffffffd4(%ebp)
  402959:	0f b7 05 00 44 40 00 	movzwl 0x404400,%eax
  402960:	66 89 45 d8          	mov    %ax,0xffffffd8(%ebp)
  402964:	89 34 24             	mov    %esi,(%esp)
  402967:	ff 15 a8 62 40 00    	call   *0x4062a8
  40296d:	0f b7 c0             	movzwl %ax,%eax
  402970:	83 ec 04             	sub    $0x4,%esp
  402973:	85 c0                	test   %eax,%eax
  402975:	89 85 44 ff ff ff    	mov    %eax,0xffffff44(%ebp)
  40297b:	0f 85 3b 01 00 00    	jne    402abc <___w32_sharedptr_initialize+0x1fc>
  402981:	c7 04 24 3c 00 00 00 	movl   $0x3c,(%esp)
  402988:	e8 73 02 00 00       	call   402c00 <_malloc>
  40298d:	85 c0                	test   %eax,%eax
  40298f:	89 c3                	mov    %eax,%ebx
  402991:	0f 84 59 01 00 00    	je     402af0 <___w32_sharedptr_initialize+0x230>
  402997:	fc                   	cld    
  402998:	89 c7                	mov    %eax,%edi
  40299a:	8b 85 44 ff ff ff    	mov    0xffffff44(%ebp),%eax
  4029a0:	b9 0f 00 00 00       	mov    $0xf,%ecx
  4029a5:	f3 ab                	repz stos %eax,%es:(%edi)
  4029a7:	c7 43 04 10 2c 40 00 	movl   $0x402c10,0x4(%ebx)
  4029ae:	b9 01 00 00 00       	mov    $0x1,%ecx
  4029b3:	c7 43 08 10 28 40 00 	movl   $0x402810,0x8(%ebx)
  4029ba:	a1 40 50 40 00       	mov    0x405040,%eax
  4029bf:	c7 03 3c 00 00 00    	movl   $0x3c,(%ebx)
  4029c5:	8b 15 44 50 40 00    	mov    0x405044,%edx
  4029cb:	c7 43 28 00 00 00 00 	movl   $0x0,0x28(%ebx)
  4029d2:	89 43 14             	mov    %eax,0x14(%ebx)
  4029d5:	a1 30 30 40 00       	mov    0x403030,%eax
  4029da:	89 53 18             	mov    %edx,0x18(%ebx)
  4029dd:	8b 15 34 30 40 00    	mov    0x403034,%edx
  4029e3:	89 43 1c             	mov    %eax,0x1c(%ebx)
  4029e6:	a1 50 50 40 00       	mov    0x405050,%eax
  4029eb:	89 53 20             	mov    %edx,0x20(%ebx)
  4029ee:	c7 43 30 ff ff ff ff 	movl   $0xffffffff,0x30(%ebx)
  4029f5:	89 43 2c             	mov    %eax,0x2c(%ebx)
  4029f8:	8b 15 3c 30 40 00    	mov    0x40303c,%edx
  4029fe:	a1 38 30 40 00       	mov    0x403038,%eax
  402a03:	89 53 38             	mov    %edx,0x38(%ebx)
  402a06:	ba 1f 00 00 00       	mov    $0x1f,%edx
  402a0b:	89 43 34             	mov    %eax,0x34(%ebx)
  402a0e:	89 f6                	mov    %esi,%esi
  402a10:	89 d8                	mov    %ebx,%eax
  402a12:	21 c8                	and    %ecx,%eax
  402a14:	83 f8 01             	cmp    $0x1,%eax
  402a17:	19 c0                	sbb    %eax,%eax
  402a19:	24 20                	and    $0x20,%al
  402a1b:	01 c9                	add    %ecx,%ecx
  402a1d:	04 41                	add    $0x41,%al
  402a1f:	88 84 2a 48 ff ff ff 	mov    %al,0xffffff48(%edx,%ebp,1)
  402a26:	4a                   	dec    %edx
  402a27:	79 e7                	jns    402a10 <___w32_sharedptr_initialize+0x150>
  402a29:	a1 e0 43 40 00       	mov    0x4043e0,%eax
  402a2e:	89 85 68 ff ff ff    	mov    %eax,0xffffff68(%ebp)
  402a34:	a1 e4 43 40 00       	mov    0x4043e4,%eax
  402a39:	89 85 6c ff ff ff    	mov    %eax,0xffffff6c(%ebp)
  402a3f:	a1 e8 43 40 00       	mov    0x4043e8,%eax
  402a44:	89 85 70 ff ff ff    	mov    %eax,0xffffff70(%ebp)
  402a4a:	a1 ec 43 40 00       	mov    0x4043ec,%eax
  402a4f:	89 85 74 ff ff ff    	mov    %eax,0xffffff74(%ebp)
  402a55:	a1 f0 43 40 00       	mov    0x4043f0,%eax
  402a5a:	89 85 78 ff ff ff    	mov    %eax,0xffffff78(%ebp)
  402a60:	a1 f4 43 40 00       	mov    0x4043f4,%eax
  402a65:	89 85 7c ff ff ff    	mov    %eax,0xffffff7c(%ebp)
  402a6b:	a1 f8 43 40 00       	mov    0x4043f8,%eax
  402a70:	89 45 80             	mov    %eax,0xffffff80(%ebp)
  402a73:	a1 fc 43 40 00       	mov    0x4043fc,%eax
  402a78:	89 45 84             	mov    %eax,0xffffff84(%ebp)
  402a7b:	0f b7 05 00 44 40 00 	movzwl 0x404400,%eax
  402a82:	66 89 45 88          	mov    %ax,0xffffff88(%ebp)
  402a86:	8d 85 48 ff ff ff    	lea    0xffffff48(%ebp),%eax
  402a8c:	89 04 24             	mov    %eax,(%esp)
  402a8f:	ff 15 a4 62 40 00    	call   *0x4062a4
  402a95:	0f b7 f8             	movzwl %ax,%edi
  402a98:	83 ec 04             	sub    $0x4,%esp
  402a9b:	85 ff                	test   %edi,%edi
  402a9d:	75 42                	jne    402ae1 <___w32_sharedptr_initialize+0x221>
  402a9f:	31 d2                	xor    %edx,%edx
  402aa1:	85 d2                	test   %edx,%edx
  402aa3:	75 1e                	jne    402ac3 <___w32_sharedptr_initialize+0x203>
  402aa5:	89 1c 24             	mov    %ebx,(%esp)
  402aa8:	e8 43 01 00 00       	call   402bf0 <_free>
  402aad:	89 34 24             	mov    %esi,(%esp)
  402ab0:	ff 15 a8 62 40 00    	call   *0x4062a8
  402ab6:	83 ec 04             	sub    $0x4,%esp
  402ab9:	0f b7 c0             	movzwl %ax,%eax
  402abc:	e8 5f fd ff ff       	call   402820 <___w32_sharedptr_get>
  402ac1:	89 c3                	mov    %eax,%ebx
  402ac3:	89 1d 90 50 40 00    	mov    %ebx,0x405090
  402ac9:	8d 43 04             	lea    0x4(%ebx),%eax
  402acc:	a3 80 50 40 00       	mov    %eax,0x405080
  402ad1:	8d 43 08             	lea    0x8(%ebx),%eax
  402ad4:	a3 a0 50 40 00       	mov    %eax,0x4050a0
  402ad9:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
  402adc:	5b                   	pop    %ebx
  402add:	5e                   	pop    %esi
  402ade:	5f                   	pop    %edi
  402adf:	5d                   	pop    %ebp
  402ae0:	c3                   	ret    
  402ae1:	89 f8                	mov    %edi,%eax
  402ae3:	e8 38 fd ff ff       	call   402820 <___w32_sharedptr_get>
  402ae8:	39 d8                	cmp    %ebx,%eax
  402aea:	89 fa                	mov    %edi,%edx
  402aec:	75 b1                	jne    402a9f <___w32_sharedptr_initialize+0x1df>
  402aee:	eb b1                	jmp    402aa1 <___w32_sharedptr_initialize+0x1e1>
  402af0:	e8 1b 01 00 00       	call   402c10 <_abort>
  402af5:	90                   	nop    
  402af6:	90                   	nop    
  402af7:	90                   	nop    
  402af8:	90                   	nop    
  402af9:	90                   	nop    
  402afa:	90                   	nop    
  402afb:	90                   	nop    
  402afc:	90                   	nop    
  402afd:	90                   	nop    
  402afe:	90                   	nop    
  402aff:	90                   	nop    

00402b00 <___chkstk>:
  402b00:	51                   	push   %ecx
  402b01:	89 e1                	mov    %esp,%ecx
  402b03:	83 c1 08             	add    $0x8,%ecx

00402b06 <probe>:
  402b06:	3d 00 10 00 00       	cmp    $0x1000,%eax
  402b0b:	72 10                	jb     402b1d <done>
  402b0d:	81 e9 00 10 00 00    	sub    $0x1000,%ecx
  402b13:	83 09 00             	orl    $0x0,(%ecx)
  402b16:	2d 00 10 00 00       	sub    $0x1000,%eax
  402b1b:	eb e9                	jmp    402b06 <probe>

00402b1d <done>:
  402b1d:	29 c1                	sub    %eax,%ecx
  402b1f:	83 09 00             	orl    $0x0,(%ecx)
  402b22:	89 e0                	mov    %esp,%eax
  402b24:	89 cc                	mov    %ecx,%esp
  402b26:	8b 08                	mov    (%eax),%ecx
  402b28:	8b 40 04             	mov    0x4(%eax),%eax
  402b2b:	ff e0                	jmp    *%eax
  402b2d:	90                   	nop    
  402b2e:	90                   	nop    
  402b2f:	90                   	nop    

00402b30 <___eprintf>:
  402b30:	55                   	push   %ebp
  402b31:	89 e5                	mov    %esp,%ebp
  402b33:	83 ec 18             	sub    $0x18,%esp
  402b36:	8b 45 14             	mov    0x14(%ebp),%eax
  402b39:	89 44 24 10          	mov    %eax,0x10(%esp)
  402b3d:	8b 45 10             	mov    0x10(%ebp),%eax
  402b40:	89 44 24 0c          	mov    %eax,0xc(%esp)
  402b44:	8b 45 0c             	mov    0xc(%ebp),%eax
  402b47:	89 44 24 08          	mov    %eax,0x8(%esp)
  402b4b:	8b 45 08             	mov    0x8(%ebp),%eax
  402b4e:	89 44 24 04          	mov    %eax,0x4(%esp)
  402b52:	a1 d8 62 40 00       	mov    0x4062d8,%eax
  402b57:	83 c0 40             	add    $0x40,%eax
  402b5a:	89 04 24             	mov    %eax,(%esp)
  402b5d:	e8 ce 00 00 00       	call   402c30 <_fprintf>
  402b62:	a1 d8 62 40 00       	mov    0x4062d8,%eax
  402b67:	83 c0 40             	add    $0x40,%eax
  402b6a:	89 04 24             	mov    %eax,(%esp)
  402b6d:	e8 ae 00 00 00       	call   402c20 <_fflush>
  402b72:	e8 99 00 00 00       	call   402c10 <_abort>
  402b77:	90                   	nop    
  402b78:	90                   	nop    
  402b79:	90                   	nop    
  402b7a:	90                   	nop    
  402b7b:	90                   	nop    
  402b7c:	90                   	nop    
  402b7d:	90                   	nop    
  402b7e:	90                   	nop    
  402b7f:	90                   	nop    

00402b80 <___set_app_type>:
  402b80:	ff 25 d0 62 40 00    	jmp    *0x4062d0
  402b86:	90                   	nop    
  402b87:	90                   	nop    
	...

00402b90 <__cexit>:
  402b90:	ff 25 d4 62 40 00    	jmp    *0x4062d4
  402b96:	90                   	nop    
  402b97:	90                   	nop    
	...

00402ba0 <___p__environ>:
  402ba0:	ff 25 c8 62 40 00    	jmp    *0x4062c8
  402ba6:	90                   	nop    
  402ba7:	90                   	nop    
	...

00402bb0 <_signal>:
  402bb0:	ff 25 fc 62 40 00    	jmp    *0x4062fc
  402bb6:	90                   	nop    
  402bb7:	90                   	nop    
	...

00402bc0 <___p__fmode>:
  402bc0:	ff 25 cc 62 40 00    	jmp    *0x4062cc
  402bc6:	90                   	nop    
  402bc7:	90                   	nop    
	...

00402bd0 <__setmode>:
  402bd0:	ff 25 e0 62 40 00    	jmp    *0x4062e0
  402bd6:	90                   	nop    
  402bd7:	90                   	nop    
	...

00402be0 <___getmainargs>:
  402be0:	ff 25 c4 62 40 00    	jmp    *0x4062c4
  402be6:	90                   	nop    
  402be7:	90                   	nop    
	...

00402bf0 <_free>:
  402bf0:	ff 25 f4 62 40 00    	jmp    *0x4062f4
  402bf6:	90                   	nop    
  402bf7:	90                   	nop    
	...

00402c00 <_malloc>:
  402c00:	ff 25 f8 62 40 00    	jmp    *0x4062f8
  402c06:	90                   	nop    
  402c07:	90                   	nop    
	...

00402c10 <_abort>:
  402c10:	ff 25 e4 62 40 00    	jmp    *0x4062e4
  402c16:	90                   	nop    
  402c17:	90                   	nop    
	...

00402c20 <_fflush>:
  402c20:	ff 25 ec 62 40 00    	jmp    *0x4062ec
  402c26:	90                   	nop    
  402c27:	90                   	nop    
	...

00402c30 <_fprintf>:
  402c30:	ff 25 f0 62 40 00    	jmp    *0x4062f0
  402c36:	90                   	nop    
  402c37:	90                   	nop    
	...

00402c40 <_GetCommandLineA@0>:
  402c40:	ff 25 b0 62 40 00    	jmp    *0x4062b0
  402c46:	90                   	nop    
  402c47:	90                   	nop    
	...

00402c50 <_GetStartupInfoA@4>:
  402c50:	ff 25 b8 62 40 00    	jmp    *0x4062b8
  402c56:	90                   	nop    
  402c57:	90                   	nop    
	...

00402c60 <_GetModuleHandleA@4>:
  402c60:	ff 25 b4 62 40 00    	jmp    *0x4062b4
  402c66:	90                   	nop    
  402c67:	90                   	nop    
	...

00402c70 <_GetAtomNameA@12>:
  402c70:	ff 25 ac 62 40 00    	jmp    *0x4062ac
  402c76:	90                   	nop    
  402c77:	90                   	nop    
	...

00402c80 <_FindAtomA@4>:
  402c80:	ff 25 a8 62 40 00    	jmp    *0x4062a8
  402c86:	90                   	nop    
  402c87:	90                   	nop    
	...

00402c90 <_AddAtomA@4>:
  402c90:	ff 25 a4 62 40 00    	jmp    *0x4062a4
  402c96:	90                   	nop    
  402c97:	90                   	nop    
	...

00402ca0 <_OpenProcessToken@12>:
  402ca0:	ff 25 98 62 40 00    	jmp    *0x406298
  402ca6:	90                   	nop    
  402ca7:	90                   	nop    
	...

00402cb0 <_LookupPrivilegeValueA@12>:
  402cb0:	ff 25 94 62 40 00    	jmp    *0x406294
  402cb6:	90                   	nop    
  402cb7:	90                   	nop    
	...

00402cc0 <_AdjustTokenPrivileges@24>:
  402cc0:	ff 25 90 62 40 00    	jmp    *0x406290
  402cc6:	90                   	nop    
  402cc7:	90                   	nop    
	...

00402cd0 <___sjlj_init_ctor>:
  402cd0:	55                   	push   %ebp
  402cd1:	89 e5                	mov    %esp,%ebp
  402cd3:	5d                   	pop    %ebp
  402cd4:	e9 a7 e5 ff ff       	jmp    401280 <___do_sjlj_init>
  402cd9:	90                   	nop    
  402cda:	90                   	nop    
  402cdb:	90                   	nop    
  402cdc:	90                   	nop    
  402cdd:	90                   	nop    
  402cde:	90                   	nop    
  402cdf:	90                   	nop    

00402ce0 <__CTOR_LIST__>:
  402ce0:	ff                   	(bad)  
  402ce1:	ff                   	(bad)  
  402ce2:	ff                   	(bad)  
  402ce3:	ff d0                	call   *%eax

00402ce4 <.ctors>:
  402ce4:	d0 2c 40             	shrb   (%eax,%eax,2)
  402ce7:	00 00                	add    %al,(%eax)
  402ce9:	00 00                	add    %al,(%eax)
	...

00402cec <__DTOR_LIST__>:
  402cec:	ff                   	(bad)  
  402ced:	ff                   	(bad)  
  402cee:	ff                   	(bad)  
  402cef:	ff 00                	incl   (%eax)
  402cf1:	00 00                	add    %al,(%eax)
	...
