
autochk.nostrip.exe:     file format pei-i386

Disassembly of section .text:

00401000 <_DisplayString>:
/* FUNCTIONS ****************************************************************/

void
DisplayString(LPCWSTR lpwString)
{
  401000:	55                   	push   %ebp
  401001:	89 e5                	mov    %esp,%ebp
  401003:	53                   	push   %ebx
  401004:	83 ec 1c             	sub    $0x1c,%esp
  UNICODE_STRING us;

  RtlInitUnicodeString(&us, lpwString);
  401007:	8b 55 08             	mov    0x8(%ebp),%edx
  40100a:	8d 5d f0             	lea    0xfffffff0(%ebp),%ebx
  40100d:	52                   	push   %edx
  40100e:	53                   	push   %ebx
  40100f:	e8 0c 01 00 00       	call   401120 <_RtlInitUnicodeString@8>
  NtDisplayString(&us);
  401014:	50                   	push   %eax
  401015:	53                   	push   %ebx
  401016:	e8 15 01 00 00       	call   401130 <_NtDisplayString@4>
  40101b:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  40101e:	c9                   	leave  
  40101f:	c3                   	ret    

00401020 <_PrintString>:
}


void
PrintString(char* fmt,...)
{
  401020:	55                   	push   %ebp
  401021:	89 e5                	mov    %esp,%ebp
  401023:	53                   	push   %ebx
  401024:	81 ec 18 02 00 00    	sub    $0x218,%esp
  char buffer[512];
  va_list ap;
  UNICODE_STRING UnicodeString;
  ANSI_STRING AnsiString;

  va_start(ap, fmt);
  vsprintf(buffer, fmt, ap);
  40102a:	8b 4d 08             	mov    0x8(%ebp),%ecx
  40102d:	8d 9d f8 fd ff ff    	lea    0xfffffdf8(%ebp),%ebx
  401033:	8d 45 0c             	lea    0xc(%ebp),%eax
  401036:	50                   	push   %eax
  401037:	51                   	push   %ecx
  401038:	53                   	push   %ebx
  401039:	e8 52 01 00 00       	call   401190 <_vsprintf>
  va_end(ap);

  RtlInitAnsiString(&AnsiString, buffer);
  40103e:	58                   	pop    %eax
  40103f:	5a                   	pop    %edx
  401040:	53                   	push   %ebx
  401041:	8d 9d f0 fd ff ff    	lea    0xfffffdf0(%ebp),%ebx
  401047:	53                   	push   %ebx
  401048:	e8 f3 00 00 00       	call   401140 <_RtlInitAnsiString@8>
  RtlAnsiStringToUnicodeString(&UnicodeString,
  40104d:	c7 04 24 01 00 00 00 	movl   $0x1,(%esp)
  401054:	53                   	push   %ebx
  401055:	8d 9d e8 fd ff ff    	lea    0xfffffde8(%ebp),%ebx
  40105b:	53                   	push   %ebx
  40105c:	e8 ef 00 00 00       	call   401150 <_RtlAnsiStringToUnicodeString@12>
			       &AnsiString,
			       TRUE);
  NtDisplayString(&UnicodeString);
  401061:	51                   	push   %ecx
  401062:	51                   	push   %ecx
  401063:	53                   	push   %ebx
  401064:	e8 c7 00 00 00       	call   401130 <_NtDisplayString@4>
  RtlFreeUnicodeString(&UnicodeString);
  401069:	53                   	push   %ebx
  40106a:	e8 f1 00 00 00       	call   401160 <_RtlFreeUnicodeString@4>
  40106f:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  401072:	c9                   	leave  
  401073:	c3                   	ret    
  401074:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
  40107a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

00401080 <_NtProcessStartup@4>:
}


/* Native image's entry point */

VOID STDCALL
NtProcessStartup(PPEB Peb)
{
  401080:	55                   	push   %ebp
  401081:	89 e5                	mov    %esp,%ebp
  401083:	53                   	push   %ebx
  401084:	83 ec 40             	sub    $0x40,%esp
  PROCESS_DEVICEMAP_INFORMATION DeviceMap;
  ULONG i;
  NTSTATUS Status;

  PrintString("Autochk 0.0.1\n");
  401087:	68 00 20 40 00       	push   $0x402000
  40108c:	e8 8f ff ff ff       	call   401020 <_PrintString>
  
  Status = NtQueryInformationProcess(NtCurrentProcess(),
  401091:	8d 45 c8             	lea    0xffffffc8(%ebp),%eax
  401094:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
  40109b:	6a 24                	push   $0x24
  40109d:	50                   	push   %eax
  40109e:	6a 17                	push   $0x17
  4010a0:	6a ff                	push   $0xffffffff
  4010a2:	e8 c9 00 00 00       	call   401170 <_NtQueryInformationProcess@20>
                                     ProcessDeviceMap,
                                     &DeviceMap.Query,
                                     sizeof(DeviceMap.Query),
                                     NULL);
  if(NT_SUCCESS(Status))
  4010a7:	83 c4 0c             	add    $0xc,%esp
  4010aa:	85 c0                	test   %eax,%eax
  4010ac:	78 54                	js     401102 <_NtProcessStartup@4+0x82>
  {
    for (i = 0; i < 26; i++)
  4010ae:	31 db                	xor    %ebx,%ebx
  4010b0:	eb 06                	jmp    4010b8 <_NtProcessStartup@4+0x38>
  4010b2:	43                   	inc    %ebx
  4010b3:	83 fb 19             	cmp    $0x19,%ebx
  4010b6:	77 3a                	ja     4010f2 <_NtProcessStartup@4+0x72>
      {
        if ((DeviceMap.Query.DriveMap & (1 << i)) &&
  4010b8:	b8 01 00 00 00       	mov    $0x1,%eax
  4010bd:	88 d9                	mov    %bl,%cl
  4010bf:	d3 e0                	shl    %cl,%eax
  4010c1:	85 45 c8             	test   %eax,0xffffffc8(%ebp)
  4010c4:	74 ec                	je     4010b2 <_NtProcessStartup@4+0x32>
  4010c6:	80 7c 2b cc 03       	cmpb   $0x3,0xffffffcc(%ebx,%ebp,1)
  4010cb:	75 e5                	jne    4010b2 <_NtProcessStartup@4+0x32>
  	  (DeviceMap.Query.DriveType[i] == DOSDEVICE_DRIVE_FIXED))
  	{
  	  PrintString("  Checking drive %c:", 'A'+i);
  4010cd:	50                   	push   %eax
  4010ce:	50                   	push   %eax
  4010cf:	8d 43 41             	lea    0x41(%ebx),%eax
  4010d2:	50                   	push   %eax
  4010d3:	43                   	inc    %ebx
  4010d4:	68 0f 20 40 00       	push   $0x40200f
  4010d9:	e8 42 ff ff ff       	call   401020 <_PrintString>
  	  PrintString("      OK\n");
  4010de:	c7 04 24 24 20 40 00 	movl   $0x402024,(%esp)
  4010e5:	e8 36 ff ff ff       	call   401020 <_PrintString>
  4010ea:	83 c4 10             	add    $0x10,%esp
  4010ed:	83 fb 19             	cmp    $0x19,%ebx
  4010f0:	76 c6                	jbe    4010b8 <_NtProcessStartup@4+0x38>
  	}
      }
    PrintString("\n");
  4010f2:	83 ec 0c             	sub    $0xc,%esp
  4010f5:	68 2e 20 40 00       	push   $0x40202e
  4010fa:	e8 21 ff ff ff       	call   401020 <_PrintString>
  4010ff:	83 c4 10             	add    $0x10,%esp
  }

  NtTerminateProcess(NtCurrentProcess(), 0);
  401102:	53                   	push   %ebx
  401103:	53                   	push   %ebx
  401104:	6a 00                	push   $0x0
  401106:	6a ff                	push   $0xffffffff
  401108:	e8 73 00 00 00       	call   401180 <_NtTerminateProcess@8>
  40110d:	8b 5d fc             	mov    0xfffffffc(%ebp),%ebx
  401110:	c9                   	leave  
  401111:	c2 04 00             	ret    $0x4
  401114:	90                   	nop    
  401115:	90                   	nop    
  401116:	90                   	nop    
  401117:	90                   	nop    
  401118:	90                   	nop    
  401119:	90                   	nop    
  40111a:	90                   	nop    
  40111b:	90                   	nop    
  40111c:	90                   	nop    
  40111d:	90                   	nop    
  40111e:	90                   	nop    
  40111f:	90                   	nop    

00401120 <_RtlInitUnicodeString@8>:
  401120:	ff 25 6c 30 40 00    	jmp    *0x40306c
  401126:	90                   	nop    
  401127:	90                   	nop    
	...

00401130 <_NtDisplayString@4>:
  401130:	ff 25 54 30 40 00    	jmp    *0x403054
  401136:	90                   	nop    
  401137:	90                   	nop    
	...

00401140 <_RtlInitAnsiString@8>:
  401140:	ff 25 68 30 40 00    	jmp    *0x403068
  401146:	90                   	nop    
  401147:	90                   	nop    
	...

00401150 <_RtlAnsiStringToUnicodeString@12>:
  401150:	ff 25 60 30 40 00    	jmp    *0x403060
  401156:	90                   	nop    
  401157:	90                   	nop    
	...

00401160 <_RtlFreeUnicodeString@4>:
  401160:	ff 25 64 30 40 00    	jmp    *0x403064
  401166:	90                   	nop    
  401167:	90                   	nop    
	...

00401170 <_NtQueryInformationProcess@20>:
  401170:	ff 25 58 30 40 00    	jmp    *0x403058
  401176:	90                   	nop    
  401177:	90                   	nop    
	...

00401180 <_NtTerminateProcess@8>:
  401180:	ff 25 5c 30 40 00    	jmp    *0x40305c
  401186:	90                   	nop    
  401187:	90                   	nop    
	...

00401190 <_vsprintf>:
  401190:	ff 25 70 30 40 00    	jmp    *0x403070
  401196:	90                   	nop    
  401197:	90                   	nop    
	...

004011a0 <__CTOR_LIST__>:
  4011a0:	ff                   	(bad)  
  4011a1:	ff                   	(bad)  
  4011a2:	ff                   	(bad)  
  4011a3:	ff 00                	incl   (%eax)
  4011a5:	00 00                	add    %al,(%eax)
	...

004011a8 <__DTOR_LIST__>:
  4011a8:	ff                   	(bad)  
  4011a9:	ff                   	(bad)  
  4011aa:	ff                   	(bad)  
  4011ab:	ff 00                	incl   (%eax)
  4011ad:	00 00                	add    %al,(%eax)
	...
