
secur32.nostrip.dll:     file format pei-i386

Disassembly of section .text:

10001000 <_LsaDeregisterLogonProcess@4>:
 * @implemented
 */
NTSTATUS STDCALL
LsaDeregisterLogonProcess(HANDLE LsaHandle)
{
10001000:	55                   	push   %ebp
10001001:	89 e5                	mov    %esp,%ebp
10001003:	81 ec 8c 01 00 00    	sub    $0x18c,%esp
   LSASS_REQUEST Request;
   LSASS_REPLY Reply;
   NTSTATUS Status;
      
   Request.Header.DataSize = 0;
   Request.Header.MessageSize = sizeof(LSASS_REQUEST);
   Request.Type = LSASS_REQUEST_DEREGISTER_LOGON_PROCESS;
   Status = NtRequestWaitReplyPort(LsaHandle,
10001009:	8d 85 78 fe ff ff    	lea    0xfffffe78(%ebp),%eax
1000100f:	8b 55 08             	mov    0x8(%ebp),%edx
10001012:	50                   	push   %eax
10001013:	8d 85 d8 fe ff ff    	lea    0xfffffed8(%ebp),%eax
10001019:	50                   	push   %eax
1000101a:	66 c7 85 d8 fe ff ff 	movw   $0x0,0xfffffed8(%ebp)
10001021:	00 00 
10001023:	52                   	push   %edx
10001024:	66 c7 85 da fe ff ff 	movw   $0x120,0xfffffeda(%ebp)
1000102b:	20 01 
1000102d:	c7 85 f0 fe ff ff 03 	movl   $0x3,0xfffffef0(%ebp)
10001034:	00 00 00 
10001037:	e8 d4 04 00 00       	call   10001510 <_NtRequestWaitReplyPort@12>
1000103c:	89 c2                	mov    %eax,%edx
				   &Request.Header,
				   &Reply.Header);
   if (!NT_SUCCESS(Status))
1000103e:	58                   	pop    %eax
1000103f:	85 d2                	test   %edx,%edx
     {
	return(Status);
10001041:	89 d0                	mov    %edx,%eax
10001043:	78 0c                	js     10001051 <_LsaDeregisterLogonProcess@4+0x51>
     }
   
   if (!NT_SUCCESS(Reply.Status))
10001045:	8b 85 90 fe ff ff    	mov    0xfffffe90(%ebp),%eax
1000104b:	85 c0                	test   %eax,%eax
1000104d:	78 02                	js     10001051 <_LsaDeregisterLogonProcess@4+0x51>
     {
	return(Reply.Status);
     }
   
   return(Status);
1000104f:	89 d0                	mov    %edx,%eax
}
10001051:	c9                   	leave  
10001052:	c2 04 00             	ret    $0x4
10001055:	8d 74 26 00          	lea    0x0(%esi),%esi
10001059:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

10001060 <_LsaConnectUntrusted@4>:

/*
 * @unimplemented
 */
NTSTATUS STDCALL
LsaConnectUntrusted(PHANDLE LsaHandle)
{
10001060:	55                   	push   %ebp
  return(STATUS_UNSUCCESSFUL);
}
10001061:	b8 01 00 00 c0       	mov    $0xc0000001,%eax
10001066:	89 e5                	mov    %esp,%ebp
10001068:	5d                   	pop    %ebp
10001069:	c2 04 00             	ret    $0x4
1000106c:	8d 74 26 00          	lea    0x0(%esi),%esi

10001070 <_LsaCallAuthenticationPackage@28>:

/*
 * @implemented
 */
NTSTATUS STDCALL
LsaCallAuthenticationPackage(HANDLE LsaHandle,
			     ULONG AuthenticationPackage,
			     PVOID ProtocolSubmitBuffer,
			     ULONG SubmitBufferLength,
			     PVOID* ProtocolReturnBuffer,
			     PULONG ReturnBufferLength,
			     PNTSTATUS ProtocolStatus)
{
10001070:	55                   	push   %ebp
10001071:	89 e5                	mov    %esp,%ebp
10001073:	56                   	push   %esi
10001074:	53                   	push   %ebx
10001075:	81 ec 64 02 00 00    	sub    $0x264,%esp
   PLSASS_REQUEST Request;
   PLSASS_REPLY Reply;
   UCHAR RawRequest[MAX_MESSAGE_DATA];
   UCHAR RawReply[MAX_MESSAGE_DATA];
   NTSTATUS Status;
   ULONG OutBufferSize;

   Request = (PLSASS_REQUEST)RawRequest;
   Reply = (PLSASS_REPLY)RawReply;
   
   Request->Header.DataSize = sizeof(LSASS_REQUEST) + SubmitBufferLength -
     sizeof(LPC_MESSAGE);
   Request->Header.MessageSize = 
     Request->Header.DataSize + sizeof(LPC_MESSAGE);
   Request->Type = LSASS_REQUEST_CALL_AUTHENTICATION_PACKAGE;
1000107b:	c7 85 e0 fe ff ff 02 	movl   $0x2,0xfffffee0(%ebp)
10001082:	00 00 00 
10001085:	8b 55 14             	mov    0x14(%ebp),%edx
10001088:	8d b5 c8 fe ff ff    	lea    0xfffffec8(%ebp),%esi
   Request->d.CallAuthenticationPackageRequest.AuthenticationPackage =
     AuthenticationPackage;
   Request->d.CallAuthenticationPackageRequest.InBufferLength =
     SubmitBufferLength;
   memcpy(Request->d.CallAuthenticationPackageRequest.InBuffer,
1000108e:	52                   	push   %edx
1000108f:	89 95 e8 fe ff ff    	mov    %edx,0xfffffee8(%ebp)
10001095:	8d 82 08 01 00 00    	lea    0x108(%edx),%eax
1000109b:	8d 9d 98 fd ff ff    	lea    0xfffffd98(%ebp),%ebx
100010a1:	66 89 85 c8 fe ff ff 	mov    %ax,0xfffffec8(%ebp)
100010a8:	83 c0 18             	add    $0x18,%eax
100010ab:	66 89 85 ca fe ff ff 	mov    %ax,0xfffffeca(%ebp)
100010b2:	8b 45 0c             	mov    0xc(%ebp),%eax
100010b5:	89 85 e4 fe ff ff    	mov    %eax,0xfffffee4(%ebp)
100010bb:	8b 45 10             	mov    0x10(%ebp),%eax
100010be:	50                   	push   %eax
100010bf:	8d 85 ec fe ff ff    	lea    0xfffffeec(%ebp),%eax
100010c5:	50                   	push   %eax
100010c6:	e8 a5 04 00 00       	call   10001570 <_memcpy>
	  ProtocolSubmitBuffer,
	  SubmitBufferLength);
   
   Status = NtRequestWaitReplyPort(LsaHandle,
100010cb:	83 c4 0c             	add    $0xc,%esp
100010ce:	8b 45 08             	mov    0x8(%ebp),%eax
100010d1:	53                   	push   %ebx
100010d2:	56                   	push   %esi
100010d3:	50                   	push   %eax
100010d4:	e8 37 04 00 00       	call   10001510 <_NtRequestWaitReplyPort@12>
100010d9:	89 c6                	mov    %eax,%esi
				   &Request->Header,
				   &Reply->Header);
   if (!NT_SUCCESS(Status))
100010db:	58                   	pop    %eax
100010dc:	85 f6                	test   %esi,%esi
     {
	return(Status);
100010de:	89 f0                	mov    %esi,%eax
100010e0:	78 3a                	js     1000111c <_LsaCallAuthenticationPackage@28+0xac>
     }
   
   if (!NT_SUCCESS(Reply->Status))
100010e2:	8b 85 b0 fd ff ff    	mov    0xfffffdb0(%ebp),%eax
100010e8:	85 c0                	test   %eax,%eax
100010ea:	78 30                	js     1000111c <_LsaCallAuthenticationPackage@28+0xac>
     {
	return(Reply->Status);
     }
   
   OutBufferSize = Reply->d.CallAuthenticationPackageReply.OutBufferLength;
100010ec:	8b 9d b8 fd ff ff    	mov    0xfffffdb8(%ebp),%ebx
   *ProtocolReturnBuffer = RtlAllocateHeap(Secur32Heap,
100010f2:	8b 0d 00 30 00 10    	mov    0x10003000,%ecx
100010f8:	50                   	push   %eax
100010f9:	53                   	push   %ebx
100010fa:	6a 00                	push   $0x0
100010fc:	51                   	push   %ecx
100010fd:	e8 1e 04 00 00       	call   10001520 <_RtlAllocateHeap@12>
10001102:	8b 55 18             	mov    0x18(%ebp),%edx
10001105:	89 02                	mov    %eax,(%edx)
					   0,
					   OutBufferSize);
   *ReturnBufferLength = OutBufferSize;
10001107:	8b 55 1c             	mov    0x1c(%ebp),%edx
1000110a:	89 1a                	mov    %ebx,(%edx)
   memcpy(*ProtocolReturnBuffer,
1000110c:	8d 95 bc fd ff ff    	lea    0xfffffdbc(%ebp),%edx
10001112:	53                   	push   %ebx
10001113:	52                   	push   %edx
10001114:	50                   	push   %eax
10001115:	e8 56 04 00 00       	call   10001570 <_memcpy>
	  Reply->d.CallAuthenticationPackageReply.OutBuffer,
	  *ReturnBufferLength);
   
   return(Status);
1000111a:	89 f0                	mov    %esi,%eax
}
1000111c:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
1000111f:	5b                   	pop    %ebx
10001120:	5e                   	pop    %esi
10001121:	5d                   	pop    %ebp
10001122:	c2 1c 00             	ret    $0x1c
10001125:	8d 74 26 00          	lea    0x0(%esi),%esi
10001129:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

10001130 <_LsaFreeReturnBuffer@4>:


/*
 * @implemented
 */
NTSTATUS STDCALL
LsaFreeReturnBuffer(PVOID Buffer)
{
10001130:	55                   	push   %ebp
10001131:	89 e5                	mov    %esp,%ebp
10001133:	83 ec 0c             	sub    $0xc,%esp
   return(RtlFreeHeap(Secur32Heap, 0, Buffer));
10001136:	8b 45 08             	mov    0x8(%ebp),%eax
10001139:	50                   	push   %eax
1000113a:	a1 00 30 00 10       	mov    0x10003000,%eax
1000113f:	6a 00                	push   $0x0
10001141:	50                   	push   %eax
10001142:	e8 e9 03 00 00       	call   10001530 <_RtlFreeHeap@12>
}
10001147:	c9                   	leave  
10001148:	25 ff 00 00 00       	and    $0xff,%eax
1000114d:	c2 04 00             	ret    $0x4

10001150 <_LsaLookupAuthenticationPackage@12>:


/*
 * @implemented
 */
NTSTATUS STDCALL
LsaLookupAuthenticationPackage(HANDLE LsaHandle,
			       PLSA_STRING PackageName,
			       PULONG AuthenticationPackage)
{
10001150:	55                   	push   %ebp
10001151:	89 e5                	mov    %esp,%ebp
10001153:	81 ec 9c 01 00 00    	sub    $0x19c,%esp
   NTSTATUS Status;
   PLSASS_REQUEST Request;
   UCHAR RawRequest[MAX_MESSAGE_DATA];
   LSASS_REPLY Reply;
   
   Request = (PLSASS_REQUEST)RawRequest;
   Request->Header.DataSize = sizeof(LSASS_REQUEST) + PackageName->Length -
10001159:	8b 45 0c             	mov    0xc(%ebp),%eax
1000115c:	8d 8d c8 fe ff ff    	lea    0xfffffec8(%ebp),%ecx
     sizeof(LPC_MESSAGE);
   Request->Header.MessageSize = Request->Header.DataSize +
     sizeof(LPC_MESSAGE);
   Request->Type = LSASS_REQUEST_LOOKUP_AUTHENTICATION_PACKAGE;
10001162:	c7 85 e0 fe ff ff 05 	movl   $0x5,0xfffffee0(%ebp)
10001169:	00 00 00 
1000116c:	66 8b 00             	mov    (%eax),%ax
1000116f:	8d 90 08 01 00 00    	lea    0x108(%eax),%edx
10001175:	05 20 01 00 00       	add    $0x120,%eax
1000117a:	66 89 85 ca fe ff ff 	mov    %ax,0xfffffeca(%ebp)
   
   Status = NtRequestWaitReplyPort(LsaHandle,
10001181:	8d 85 68 fe ff ff    	lea    0xfffffe68(%ebp),%eax
10001187:	50                   	push   %eax
10001188:	51                   	push   %ecx
10001189:	8b 4d 08             	mov    0x8(%ebp),%ecx
1000118c:	66 89 95 c8 fe ff ff 	mov    %dx,0xfffffec8(%ebp)
10001193:	51                   	push   %ecx
10001194:	e8 77 03 00 00       	call   10001510 <_NtRequestWaitReplyPort@12>
			  &Request->Header,
			  &Reply.Header);
   if (!NT_SUCCESS(Status))
10001199:	5a                   	pop    %edx
1000119a:	85 c0                	test   %eax,%eax
1000119c:	78 19                	js     100011b7 <_LsaLookupAuthenticationPackage@12+0x67>
     {
	return(Status);
     }
   if (!NT_SUCCESS(Reply.Status))
1000119e:	8b 8d 80 fe ff ff    	mov    0xfffffe80(%ebp),%ecx
     {
	return(Reply.Status);
100011a4:	89 c8                	mov    %ecx,%eax
100011a6:	85 c9                	test   %ecx,%ecx
100011a8:	78 0d                	js     100011b7 <_LsaLookupAuthenticationPackage@12+0x67>
     }
   
   *AuthenticationPackage = Reply.d.LookupAuthenticationPackageReply.Package;
100011aa:	8b 45 10             	mov    0x10(%ebp),%eax
100011ad:	8b 95 88 fe ff ff    	mov    0xfffffe88(%ebp),%edx
100011b3:	89 10                	mov    %edx,(%eax)
   
   return(Reply.Status);
100011b5:	89 c8                	mov    %ecx,%eax
}
100011b7:	c9                   	leave  
100011b8:	c2 0c 00             	ret    $0xc
100011bb:	90                   	nop    
100011bc:	8d 74 26 00          	lea    0x0(%esi),%esi

100011c0 <_LsaLogonUser@56>:


/*
 * @implemented
 */
NTSTATUS STDCALL
LsaLogonUser(HANDLE LsaHandle,
	     PLSA_STRING OriginName,
	     SECURITY_LOGON_TYPE LogonType,
	     ULONG AuthenticationPackage,
	     PVOID AuthenticationInformation,
	     ULONG AuthenticationInformationLength,
	     PTOKEN_GROUPS LocalGroups,
	     PTOKEN_SOURCE SourceContext,
	     PVOID* ProfileBuffer,
	     PULONG ProfileBufferLength,
	     PLUID LogonId,
	     PHANDLE Token,
	     PQUOTA_LIMITS Quotas,
	     PNTSTATUS SubStatus)
{
100011c0:	55                   	push   %ebp
100011c1:	89 e5                	mov    %esp,%ebp
100011c3:	57                   	push   %edi
100011c4:	56                   	push   %esi
100011c5:	53                   	push   %ebx
100011c6:	81 ec 90 02 00 00    	sub    $0x290,%esp
100011cc:	8b 5d 0c             	mov    0xc(%ebp),%ebx
   ULONG RequestLength;
   ULONG CurrentLength;
   PLSASS_REQUEST Request;
   UCHAR RawMessage[MAX_MESSAGE_DATA];
   PLSASS_REPLY Reply;
   UCHAR RawReply[MAX_MESSAGE_DATA];
   NTSTATUS Status;
   
   RequestLength = sizeof(LSASS_REQUEST) - sizeof(LPC_MESSAGE);
   RequestLength = RequestLength + (OriginName->Length * sizeof(WCHAR));
   RequestLength = RequestLength + AuthenticationInformationLength;
   RequestLength = RequestLength + 
100011cf:	8b 45 20             	mov    0x20(%ebp),%eax
100011d2:	8b 75 1c             	mov    0x1c(%ebp),%esi
100011d5:	66 8b 13             	mov    (%ebx),%dx
100011d8:	8b 00                	mov    (%eax),%eax
100011da:	81 e2 ff ff 00 00    	and    $0xffff,%edx
     (LocalGroups->GroupCount * sizeof(SID_AND_ATTRIBUTES));
   
   CurrentLength = 0;
   Request = (PLSASS_REQUEST)RawMessage;
   
   Request->d.LogonUserRequest.OriginNameLength = OriginName->Length;
100011e0:	89 95 d4 fe ff ff    	mov    %edx,0xfffffed4(%ebp)
100011e6:	8d 0c 12             	lea    (%edx,%edx,1),%ecx
   Request->d.LogonUserRequest.OriginName = (PWSTR)&RawMessage[CurrentLength];
100011e9:	8d 95 b8 fe ff ff    	lea    0xfffffeb8(%ebp),%edx
   memcpy((PWSTR)&RawMessage[CurrentLength],
100011ef:	51                   	push   %ecx
100011f0:	89 95 d8 fe ff ff    	mov    %edx,0xfffffed8(%ebp)
100011f6:	8d bc 31 08 01 00 00 	lea    0x108(%ecx,%esi,1),%edi
100011fd:	8b 4b 04             	mov    0x4(%ebx),%ecx
10001200:	51                   	push   %ecx
10001201:	52                   	push   %edx
10001202:	8d 3c c7             	lea    (%edi,%eax,8),%edi
10001205:	e8 66 03 00 00       	call   10001570 <_memcpy>
	  OriginName->Buffer,
	  OriginName->Length * sizeof(WCHAR));
   CurrentLength = CurrentLength + (OriginName->Length * sizeof(WCHAR));
1000120a:	66 8b 1b             	mov    (%ebx),%bx
   
   Request->d.LogonUserRequest.LogonType = LogonType;
1000120d:	8b 45 10             	mov    0x10(%ebp),%eax
10001210:	81 e3 ff ff 00 00    	and    $0xffff,%ebx
10001216:	89 85 dc fe ff ff    	mov    %eax,0xfffffedc(%ebp)
   
   Request->d.LogonUserRequest.AuthenticationPackage =
1000121c:	8b 45 14             	mov    0x14(%ebp),%eax
     AuthenticationPackage;
   
   Request->d.LogonUserRequest.AuthenticationInformation = 
     (PVOID)&RawMessage[CurrentLength];
   Request->d.LogonUserRequest.AuthenticationInformationLength =
     AuthenticationInformationLength;
   memcpy((PVOID)&RawMessage[CurrentLength],
1000121f:	83 c4 0c             	add    $0xc,%esp
10001222:	01 db                	add    %ebx,%ebx
10001224:	89 85 e0 fe ff ff    	mov    %eax,0xfffffee0(%ebp)
1000122a:	8d 85 b8 fe ff ff    	lea    0xfffffeb8(%ebp),%eax
10001230:	8b 55 18             	mov    0x18(%ebp),%edx
10001233:	01 d8                	add    %ebx,%eax
10001235:	56                   	push   %esi
10001236:	89 b5 e8 fe ff ff    	mov    %esi,0xfffffee8(%ebp)
1000123c:	52                   	push   %edx
1000123d:	89 85 e4 fe ff ff    	mov    %eax,0xfffffee4(%ebp)
10001243:	50                   	push   %eax
10001244:	e8 27 03 00 00       	call   10001570 <_memcpy>
	  AuthenticationInformation,
	  AuthenticationInformationLength);
   CurrentLength = CurrentLength + AuthenticationInformationLength;
   
   Request->d.LogonUserRequest.LocalGroupsCount = LocalGroups->GroupCount;
10001249:	8b 55 20             	mov    0x20(%ebp),%edx
   Request->d.LogonUserRequest.LocalGroups = 
     (PSID_AND_ATTRIBUTES)&RawMessage[CurrentLength];
   memcpy((PSID_AND_ATTRIBUTES)&RawMessage[CurrentLength],
1000124c:	83 c4 0c             	add    $0xc,%esp
1000124f:	8b 02                	mov    (%edx),%eax
10001251:	01 f3                	add    %esi,%ebx
10001253:	8d 95 b8 fe ff ff    	lea    0xfffffeb8(%ebp),%edx
10001259:	89 85 ec fe ff ff    	mov    %eax,0xfffffeec(%ebp)
1000125f:	c1 e0 03             	shl    $0x3,%eax
10001262:	8d 1c 1a             	lea    (%edx,%ebx,1),%ebx
10001265:	50                   	push   %eax
10001266:	8b 45 20             	mov    0x20(%ebp),%eax
10001269:	83 c0 04             	add    $0x4,%eax
1000126c:	89 9d f0 fe ff ff    	mov    %ebx,0xfffffef0(%ebp)
10001272:	50                   	push   %eax
10001273:	53                   	push   %ebx
10001274:	e8 f7 02 00 00       	call   10001570 <_memcpy>
	  LocalGroups->Groups,
	  LocalGroups->GroupCount * sizeof(SID_AND_ATTRIBUTES));
   
   Request->d.LogonUserRequest.SourceContext = *SourceContext;
10001279:	8b 55 24             	mov    0x24(%ebp),%edx
1000127c:	8b 02                	mov    (%edx),%eax
   
   Request->Type = LSASS_REQUEST_LOGON_USER;
   Request->Header.DataSize = RequestLength - sizeof(LPC_MESSAGE);
   Request->Header.MessageSize = RequestLength + sizeof(LPC_MESSAGE);
   
   Reply = (PLSASS_REPLY)RawReply;
   
   Status = NtRequestWaitReplyPort(LsaHandle,
1000127e:	83 c4 0c             	add    $0xc,%esp
10001281:	89 85 f4 fe ff ff    	mov    %eax,0xfffffef4(%ebp)
10001287:	8d 9d 88 fd ff ff    	lea    0xfffffd88(%ebp),%ebx
1000128d:	8b 42 04             	mov    0x4(%edx),%eax
10001290:	89 85 f8 fe ff ff    	mov    %eax,0xfffffef8(%ebp)
10001296:	8b 42 08             	mov    0x8(%edx),%eax
10001299:	89 85 fc fe ff ff    	mov    %eax,0xfffffefc(%ebp)
1000129f:	8b 42 0c             	mov    0xc(%edx),%eax
100012a2:	53                   	push   %ebx
100012a3:	89 85 00 ff ff ff    	mov    %eax,0xffffff00(%ebp)
100012a9:	8d 47 e8             	lea    0xffffffe8(%edi),%eax
100012ac:	66 89 85 b8 fe ff ff 	mov    %ax,0xfffffeb8(%ebp)
100012b3:	8d 47 18             	lea    0x18(%edi),%eax
100012b6:	66 89 85 ba fe ff ff 	mov    %ax,0xfffffeba(%ebp)
100012bd:	8d 85 b8 fe ff ff    	lea    0xfffffeb8(%ebp),%eax
100012c3:	50                   	push   %eax
100012c4:	8b 45 08             	mov    0x8(%ebp),%eax
100012c7:	c7 85 d0 fe ff ff 04 	movl   $0x4,0xfffffed0(%ebp)
100012ce:	00 00 00 
100012d1:	50                   	push   %eax
100012d2:	e8 39 02 00 00       	call   10001510 <_NtRequestWaitReplyPort@12>
100012d7:	89 c6                	mov    %eax,%esi
				   &Request->Header,
				   &Reply->Header);
   if (!NT_SUCCESS(Status))
100012d9:	58                   	pop    %eax
100012da:	85 f6                	test   %esi,%esi
100012dc:	78 7d                	js     1000135b <_LsaLogonUser@56+0x19b>
     {
	return(Status);
     }

   *SubStatus = Reply->d.LogonUserReply.SubStatus;
100012de:	8b 45 3c             	mov    0x3c(%ebp),%eax
100012e1:	8b 95 e0 fd ff ff    	mov    0xfffffde0(%ebp),%edx
100012e7:	89 10                	mov    %edx,(%eax)
   
   if (!NT_SUCCESS(Reply->Status))
100012e9:	8b 85 a0 fd ff ff    	mov    0xfffffda0(%ebp),%eax
100012ef:	85 c0                	test   %eax,%eax
100012f1:	78 68                	js     1000135b <_LsaLogonUser@56+0x19b>
     {
	return(Status);
     }
   
   *ProfileBuffer = RtlAllocateHeap(Secur32Heap,
100012f3:	8b 0d 00 30 00 10    	mov    0x10003000,%ecx
100012f9:	8b bd ac fd ff ff    	mov    0xfffffdac(%ebp),%edi
100012ff:	50                   	push   %eax
10001300:	57                   	push   %edi
10001301:	6a 00                	push   $0x0
10001303:	51                   	push   %ecx
10001304:	e8 17 02 00 00       	call   10001520 <_RtlAllocateHeap@12>
10001309:	8b 55 28             	mov    0x28(%ebp),%edx
1000130c:	89 02                	mov    %eax,(%edx)
				    0,
				  Reply->d.LogonUserReply.ProfileBufferLength);
   memcpy(*ProfileBuffer,
1000130e:	8b bd a8 fd ff ff    	mov    0xfffffda8(%ebp),%edi
10001314:	8b 95 ac fd ff ff    	mov    0xfffffdac(%ebp),%edx
1000131a:	01 fb                	add    %edi,%ebx
1000131c:	52                   	push   %edx
1000131d:	8d 53 5c             	lea    0x5c(%ebx),%edx
10001320:	52                   	push   %edx
10001321:	50                   	push   %eax
10001322:	e8 49 02 00 00       	call   10001570 <_memcpy>
	  (PVOID)((ULONG)Reply->d.LogonUserReply.Data +
		  (ULONG)Reply->d.LogonUserReply.ProfileBuffer),
	  Reply->d.LogonUserReply.ProfileBufferLength);
   *LogonId = Reply->d.LogonUserReply.LogonId;
10001327:	8b 45 30             	mov    0x30(%ebp),%eax
1000132a:	8b 95 b0 fd ff ff    	mov    0xfffffdb0(%ebp),%edx
10001330:	8b 8d b4 fd ff ff    	mov    0xfffffdb4(%ebp),%ecx
10001336:	89 48 04             	mov    %ecx,0x4(%eax)
10001339:	89 10                	mov    %edx,(%eax)
   *Token = Reply->d.LogonUserReply.Token;
1000133b:	8b 45 34             	mov    0x34(%ebp),%eax
   memcpy(Quotas, 
1000133e:	83 c4 0c             	add    $0xc,%esp
10001341:	8b 95 b8 fd ff ff    	mov    0xfffffdb8(%ebp),%edx
10001347:	8b 5d 38             	mov    0x38(%ebp),%ebx
1000134a:	89 10                	mov    %edx,(%eax)
1000134c:	8d 85 c0 fd ff ff    	lea    0xfffffdc0(%ebp),%eax
10001352:	6a 20                	push   $0x20
10001354:	50                   	push   %eax
10001355:	53                   	push   %ebx
10001356:	e8 15 02 00 00       	call   10001570 <_memcpy>
	  &Reply->d.LogonUserReply.Quotas,
	  sizeof(Reply->d.LogonUserReply.Quotas));
   
   return(Status);
}
1000135b:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
1000135e:	89 f0                	mov    %esi,%eax
10001360:	5b                   	pop    %ebx
10001361:	5e                   	pop    %esi
10001362:	5f                   	pop    %edi
10001363:	5d                   	pop    %ebp
10001364:	c2 38 00             	ret    $0x38
10001367:	89 f6                	mov    %esi,%esi
10001369:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

10001370 <_LsaRegisterLogonProcess@12>:


/*
 * @implemented
 */
NTSTATUS STDCALL
LsaRegisterLogonProcess(PLSA_STRING LsaLogonProcessName,
			PHANDLE Handle,
			PLSA_OPERATIONAL_MODE OperationalMode)
{
10001370:	55                   	push   %ebp
10001371:	89 e5                	mov    %esp,%ebp
10001373:	57                   	push   %edi
10001374:	56                   	push   %esi
10001375:	53                   	push   %ebx
10001376:	81 ec 9c 01 00 00    	sub    $0x19c,%esp
   UNICODE_STRING Portname = ROS_STRING_INITIALIZER(L"\\SeLsaCommandPort");
   ULONG ConnectInfoLength;
   NTSTATUS Status;
   LSASS_REQUEST Request;
   LSASS_REPLY Reply;

   ConnectInfoLength = 0;
   Status = NtConnectPort(Handle,
1000137c:	8d 85 5c fe ff ff    	lea    0xfffffe5c(%ebp),%eax
10001382:	8b 7d 08             	mov    0x8(%ebp),%edi
10001385:	8b 75 0c             	mov    0xc(%ebp),%esi
10001388:	66 c7 85 60 fe ff ff 	movw   $0x22,0xfffffe60(%ebp)
1000138f:	22 00 
10001391:	66 c7 85 62 fe ff ff 	movw   $0x24,0xfffffe62(%ebp)
10001398:	24 00 
1000139a:	c7 85 64 fe ff ff 00 	movl   $0x10002000,0xfffffe64(%ebp)
100013a1:	20 00 10 
100013a4:	c7 85 5c fe ff ff 00 	movl   $0x0,0xfffffe5c(%ebp)
100013ab:	00 00 00 
100013ae:	50                   	push   %eax
100013af:	8d 85 60 fe ff ff    	lea    0xfffffe60(%ebp),%eax
100013b5:	6a 00                	push   $0x0
100013b7:	6a 00                	push   $0x0
100013b9:	6a 00                	push   $0x0
100013bb:	6a 00                	push   $0x0
100013bd:	6a 00                	push   $0x0
100013bf:	50                   	push   %eax
100013c0:	56                   	push   %esi
100013c1:	e8 7a 01 00 00       	call   10001540 <_NtConnectPort@32>
			  &Portname,
			  NULL,
			  NULL,
			  NULL,
			  NULL,
			  NULL,
			  &ConnectInfoLength);
   if (!NT_SUCCESS(Status))
100013c6:	85 c0                	test   %eax,%eax
100013c8:	78 73                	js     1000143d <_LsaRegisterLogonProcess@12+0xcd>
     {
	return(Status);
     }
   
   Request.Type = LSASS_REQUEST_REGISTER_LOGON_PROCESS;
   Request.Header.DataSize = sizeof(LSASS_REQUEST) - 
100013ca:	66 c7 85 c8 fe ff ff 	movw   $0x108,0xfffffec8(%ebp)
100013d1:	08 01 
     sizeof(LPC_MESSAGE);
   Request.Header.MessageSize = sizeof(LSASS_REQUEST);
100013d3:	66 c7 85 ca fe ff ff 	movw   $0x120,0xfffffeca(%ebp)
100013da:	20 01 
   
   Request.d.RegisterLogonProcessRequest.Length = LsaLogonProcessName->Length;
100013dc:	66 8b 07             	mov    (%edi),%ax
100013df:	c7 85 e0 fe ff ff 01 	movl   $0x1,0xfffffee0(%ebp)
100013e6:	00 00 00 
100013e9:	25 ff ff 00 00       	and    $0xffff,%eax
   wcscpy(Request.d.RegisterLogonProcessRequest.LogonProcessNameBuffer,
100013ee:	8d 9d c8 fe ff ff    	lea    0xfffffec8(%ebp),%ebx
100013f4:	89 85 e4 fe ff ff    	mov    %eax,0xfffffee4(%ebp)
100013fa:	50                   	push   %eax
100013fb:	50                   	push   %eax
100013fc:	8b 47 04             	mov    0x4(%edi),%eax
100013ff:	50                   	push   %eax
10001400:	8d 85 e8 fe ff ff    	lea    0xfffffee8(%ebp),%eax
10001406:	50                   	push   %eax
10001407:	e8 54 01 00 00       	call   10001560 <_wcscpy>
	  LsaLogonProcessName->Buffer);
   
   Status = NtRequestWaitReplyPort(*Handle,
1000140c:	83 c4 0c             	add    $0xc,%esp
1000140f:	8d 85 68 fe ff ff    	lea    0xfffffe68(%ebp),%eax
10001415:	50                   	push   %eax
10001416:	53                   	push   %ebx
10001417:	8b 06                	mov    (%esi),%eax
10001419:	50                   	push   %eax
1000141a:	e8 f1 00 00 00       	call   10001510 <_NtRequestWaitReplyPort@12>
1000141f:	89 c3                	mov    %eax,%ebx
				   &Request.Header,
				   &Reply.Header);
   if (!NT_SUCCESS(Status))
10001421:	58                   	pop    %eax
10001422:	85 db                	test   %ebx,%ebx
10001424:	78 21                	js     10001447 <_LsaRegisterLogonProcess@12+0xd7>
     {
	NtClose(*Handle);
	*Handle = INVALID_HANDLE_VALUE;
	return(Status);
     }
   
   if (!NT_SUCCESS(Reply.Status))
10001426:	8b 8d 80 fe ff ff    	mov    0xfffffe80(%ebp),%ecx
1000142c:	85 c9                	test   %ecx,%ecx
1000142e:	78 17                	js     10001447 <_LsaRegisterLogonProcess@12+0xd7>
     {
	NtClose(*Handle);
	*Handle = INVALID_HANDLE_VALUE;
	return(Status);
     }
   
   *OperationalMode = Reply.d.RegisterLogonProcessReply.OperationalMode;
10001430:	8b 45 10             	mov    0x10(%ebp),%eax
10001433:	8b 95 88 fe ff ff    	mov    0xfffffe88(%ebp),%edx
10001439:	89 10                	mov    %edx,(%eax)
   
   return(Reply.Status);
1000143b:	89 c8                	mov    %ecx,%eax
}
1000143d:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
10001440:	5b                   	pop    %ebx
10001441:	5e                   	pop    %esi
10001442:	5f                   	pop    %edi
10001443:	5d                   	pop    %ebp
10001444:	c2 0c 00             	ret    $0xc
10001447:	83 ec 0c             	sub    $0xc,%esp
1000144a:	8b 3e                	mov    (%esi),%edi
1000144c:	57                   	push   %edi
1000144d:	e8 fe 00 00 00       	call   10001550 <_NtClose@4>
10001452:	c7 06 ff ff ff ff    	movl   $0xffffffff,(%esi)
10001458:	89 d8                	mov    %ebx,%eax
1000145a:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
1000145d:	5b                   	pop    %ebx
1000145e:	5e                   	pop    %esi
1000145f:	5f                   	pop    %edi
10001460:	5d                   	pop    %ebp
10001461:	c2 0c 00             	ret    $0xc
10001464:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
1000146a:	8d bf 00 00 00 00    	lea    0x0(%edi),%edi

10001470 <_LsaEnumerateLogonSessions@8>:

/*
 * @unimplemented
 */
NTSTATUS
STDCALL
LsaEnumerateLogonSessions(
PULONG LogonSessionCount,
PLUID * LogonSessionList
)
{
10001470:	55                   	push   %ebp
  return(FALSE);
}
10001471:	31 c0                	xor    %eax,%eax
10001473:	89 e5                	mov    %esp,%ebp
10001475:	5d                   	pop    %ebp
10001476:	c2 08 00             	ret    $0x8
10001479:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

10001480 <_LsaGetLogonSessionData@8>:

/*
 * @unimplemented
 */
NTSTATUS
STDCALL
LsaGetLogonSessionData(
PLUID LogonId,
PSECURITY_LOGON_SESSION_DATA * ppLogonSessionData
)
{
10001480:	55                   	push   %ebp
  return(FALSE);
}
10001481:	31 c0                	xor    %eax,%eax
10001483:	89 e5                	mov    %esp,%ebp
10001485:	5d                   	pop    %ebp
10001486:	c2 08 00             	ret    $0x8
10001489:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

10001490 <_LsaRegisterPolicyChangeNotification@8>:

/*
 * @unimplemented
 */
NTSTATUS
STDCALL
LsaRegisterPolicyChangeNotification(
POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass,
HANDLE NotificationEventHandle
)
{
10001490:	55                   	push   %ebp
  return(FALSE);
}
10001491:	31 c0                	xor    %eax,%eax
10001493:	89 e5                	mov    %esp,%ebp
10001495:	5d                   	pop    %ebp
10001496:	c2 08 00             	ret    $0x8
10001499:	8d b4 26 00 00 00 00 	lea    0x0(%esi),%esi

100014a0 <_LsaUnregisterPolicyChangeNotification@8>:

/*
 * @unimplemented
 */
NTSTATUS
STDCALL
LsaUnregisterPolicyChangeNotification(
POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass,
HANDLE NotificationEventHandle
)
{
100014a0:	55                   	push   %ebp
  return(FALSE);
}
100014a1:	31 c0                	xor    %eax,%eax
100014a3:	89 e5                	mov    %esp,%ebp
100014a5:	5d                   	pop    %ebp
100014a6:	c2 08 00             	ret    $0x8
100014a9:	90                   	nop    
100014aa:	90                   	nop    
100014ab:	90                   	nop    
100014ac:	90                   	nop    
100014ad:	90                   	nop    
100014ae:	90                   	nop    
100014af:	90                   	nop    

100014b0 <_DllMain@12>:

/* FUNCTIONS *****************************************************************/

BOOL STDCALL DllMain(HINSTANCE hInstance, ULONG Reason, PVOID Reserved)
{
100014b0:	55                   	push   %ebp
100014b1:	89 e5                	mov    %esp,%ebp
100014b3:	50                   	push   %eax
100014b4:	50                   	push   %eax
100014b5:	8b 45 0c             	mov    0xc(%ebp),%eax
   switch (Reason)
100014b8:	85 c0                	test   %eax,%eax
100014ba:	74 14                	je     100014d0 <_DllMain@12+0x20>
100014bc:	48                   	dec    %eax
100014bd:	74 31                	je     100014f0 <_DllMain@12+0x40>
     {
      case DLL_PROCESS_ATTACH:
	Secur32Heap = RtlCreateHeap(0, NULL, 0, 4096, NULL, NULL);
	if (Secur32Heap == 0)
	  {
	     return(FALSE);
	  }
	break;
	
      case DLL_PROCESS_DETACH:
	if (!RtlDestroyHeap(Secur32Heap))
	  {
	     return(FALSE);
	  }
	break;
     }
   return(TRUE);
100014bf:	ba 01 00 00 00       	mov    $0x1,%edx
}
100014c4:	c9                   	leave  
100014c5:	89 d0                	mov    %edx,%eax
100014c7:	c2 0c 00             	ret    $0xc
100014ca:	8d b6 00 00 00 00    	lea    0x0(%esi),%esi
100014d0:	83 ec 0c             	sub    $0xc,%esp
100014d3:	a1 00 30 00 10       	mov    0x10003000,%eax
100014d8:	50                   	push   %eax
100014d9:	e8 a2 00 00 00       	call   10001580 <_RtlDestroyHeap@4>
100014de:	83 c4 0c             	add    $0xc,%esp
100014e1:	31 d2                	xor    %edx,%edx
100014e3:	85 c0                	test   %eax,%eax
100014e5:	75 d8                	jne    100014bf <_DllMain@12+0xf>
100014e7:	89 d0                	mov    %edx,%eax
100014e9:	c9                   	leave  
100014ea:	c2 0c 00             	ret    $0xc
100014ed:	8d 76 00             	lea    0x0(%esi),%esi
100014f0:	50                   	push   %eax
100014f1:	50                   	push   %eax
100014f2:	6a 00                	push   $0x0
100014f4:	6a 00                	push   $0x0
100014f6:	68 00 10 00 00       	push   $0x1000
100014fb:	6a 00                	push   $0x0
100014fd:	6a 00                	push   $0x0
100014ff:	6a 00                	push   $0x0
10001501:	e8 8a 00 00 00       	call   10001590 <_RtlCreateHeap@24>
10001506:	a3 00 30 00 10       	mov    %eax,0x10003000
1000150b:	5a                   	pop    %edx
1000150c:	59                   	pop    %ecx
1000150d:	eb d2                	jmp    100014e1 <_DllMain@12+0x31>
1000150f:	90                   	nop    

10001510 <_NtRequestWaitReplyPort@12>:
10001510:	ff 25 60 50 00 10    	jmp    *0x10005060
10001516:	90                   	nop    
10001517:	90                   	nop    
	...

10001520 <_RtlAllocateHeap@12>:
10001520:	ff 25 64 50 00 10    	jmp    *0x10005064
10001526:	90                   	nop    
10001527:	90                   	nop    
	...

10001530 <_RtlFreeHeap@12>:
10001530:	ff 25 70 50 00 10    	jmp    *0x10005070
10001536:	90                   	nop    
10001537:	90                   	nop    
	...

10001540 <_NtConnectPort@32>:
10001540:	ff 25 5c 50 00 10    	jmp    *0x1000505c
10001546:	90                   	nop    
10001547:	90                   	nop    
	...

10001550 <_NtClose@4>:
10001550:	ff 25 58 50 00 10    	jmp    *0x10005058
10001556:	90                   	nop    
10001557:	90                   	nop    
	...

10001560 <_wcscpy>:
10001560:	ff 25 78 50 00 10    	jmp    *0x10005078
10001566:	90                   	nop    
10001567:	90                   	nop    
	...

10001570 <_memcpy>:
10001570:	ff 25 74 50 00 10    	jmp    *0x10005074
10001576:	90                   	nop    
10001577:	90                   	nop    
	...

10001580 <_RtlDestroyHeap@4>:
10001580:	ff 25 6c 50 00 10    	jmp    *0x1000506c
10001586:	90                   	nop    
10001587:	90                   	nop    
	...

10001590 <_RtlCreateHeap@24>:
10001590:	ff 25 68 50 00 10    	jmp    *0x10005068
10001596:	90                   	nop    
10001597:	90                   	nop    
	...

100015a0 <__CTOR_LIST__>:
100015a0:	ff                   	(bad)  
100015a1:	ff                   	(bad)  
100015a2:	ff                   	(bad)  
100015a3:	ff 00                	incl   (%eax)
100015a5:	00 00                	add    %al,(%eax)
	...

100015a8 <__DTOR_LIST__>:
100015a8:	ff                   	(bad)  
100015a9:	ff                   	(bad)  
100015aa:	ff                   	(bad)  
100015ab:	ff 00                	incl   (%eax)
100015ad:	00 00                	add    %al,(%eax)
	...
