
debugout.nostrip.sys:     file format pei-i386

Disassembly of section .text:

00011000 <_DebugOutDispatch@8>:

/* FUNCTIONS */
NTSTATUS STDCALL
DebugOutDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
   11000:	55                   	push   %ebp
   11001:	89 e5                	mov    %esp,%ebp
   11003:	57                   	push   %edi
   11004:	56                   	push   %esi
   11005:	53                   	push   %ebx
   11006:	81 ec 2c 02 00 00    	sub    $0x22c,%esp
  PIO_STACK_LOCATION piosStack = IoGetCurrentIrpStackLocation(Irp);
   1100c:	8b 45 0c             	mov    0xc(%ebp),%eax
   1100f:	8b 78 60             	mov    0x60(%eax),%edi
  NTSTATUS nErrCode;
  char *Start;
  char Buf[513];
  unsigned Remaining;
  unsigned Length;
 
  nErrCode = STATUS_SUCCESS;

  switch(piosStack->MajorFunction)
   11012:	31 c0                	xor    %eax,%eax
   11014:	c7 85 d4 fd ff ff 00 	movl   $0x0,0xfffffdd4(%ebp)
   1101b:	00 00 00 
   1101e:	8a 07                	mov    (%edi),%al
   11020:	83 f8 02             	cmp    $0x2,%eax
   11023:	74 1b                	je     11040 <_DebugOutDispatch@8+0x40>
   11025:	7e 3f                	jle    11066 <_DebugOutDispatch@8+0x66>
   11027:	83 f8 03             	cmp    $0x3,%eax
   1102a:	0f 84 c2 00 00 00    	je     110f2 <_DebugOutDispatch@8+0xf2>
   11030:	83 f8 04             	cmp    $0x4,%eax
   11033:	74 41                	je     11076 <_DebugOutDispatch@8+0x76>
    {
      /* opening and closing handles to the device */
      case IRP_MJ_CREATE:
      case IRP_MJ_CLOSE:
        break;

      /* write data */
      case IRP_MJ_WRITE:
	Remaining = piosStack->Parameters.Write.Length;
        Start = Irp->AssociatedIrp.SystemBuffer;
	while (0 < Remaining)
	  {
	    Length = Remaining;
	    if (sizeof(Buf) - 1 < Length)
	      {
		Length = sizeof(Buf) - 1;
	      }
	    RtlCopyMemory(Buf, Start, Length);
	    Buf[Length] = '\0';
	    DbgPrint("%s", Buf);
	    Remaining -= Length;
	    Start += Length;
	  }

        Irp->IoStatus.Information = piosStack->Parameters.Write.Length;
        break;

      /* read data */
      case IRP_MJ_READ:
        Irp->IoStatus.Information = 0;
        nErrCode = STATUS_END_OF_FILE;
        break;

      /* unsupported operations */
      default:
        nErrCode = STATUS_NOT_IMPLEMENTED;
   11035:	c7 85 d4 fd ff ff 02 	movl   $0xc0000002,0xfffffdd4(%ebp)
   1103c:	00 00 c0 
   1103f:	90                   	nop    
    }

  Irp->IoStatus.Status = nErrCode;
   11040:	8b 55 0c             	mov    0xc(%ebp),%edx
   11043:	8b 85 d4 fd ff ff    	mov    0xfffffdd4(%ebp),%eax
   11049:	89 42 18             	mov    %eax,0x18(%edx)
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
   1104c:	50                   	push   %eax
   1104d:	50                   	push   %eax
   1104e:	6a 00                	push   $0x0
   11050:	52                   	push   %edx
   11051:	e8 9a 01 00 00       	call   111f0 <_IoCompleteRequest@8>

  return nErrCode;
}
   11056:	8b 85 d4 fd ff ff    	mov    0xfffffdd4(%ebp),%eax
   1105c:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   1105f:	5b                   	pop    %ebx
   11060:	5e                   	pop    %esi
   11061:	5f                   	pop    %edi
   11062:	5d                   	pop    %ebp
   11063:	c2 08 00             	ret    $0x8
   11066:	85 c0                	test   %eax,%eax
   11068:	74 d6                	je     11040 <_DebugOutDispatch@8+0x40>
   1106a:	c7 85 d4 fd ff ff 02 	movl   $0xc0000002,0xfffffdd4(%ebp)
   11071:	00 00 c0 
   11074:	eb ca                	jmp    11040 <_DebugOutDispatch@8+0x40>
   11076:	8b 55 0c             	mov    0xc(%ebp),%edx
   11079:	8b 47 04             	mov    0x4(%edi),%eax
   1107c:	89 c6                	mov    %eax,%esi
   1107e:	85 c0                	test   %eax,%eax
   11080:	8b 52 0c             	mov    0xc(%edx),%edx
   11083:	89 95 d0 fd ff ff    	mov    %edx,0xfffffdd0(%ebp)
   11089:	74 5c                	je     110e7 <_DebugOutDispatch@8+0xe7>
   1108b:	90                   	nop    
   1108c:	8d 74 26 00          	lea    0x0(%esi),%esi
   11090:	89 f3                	mov    %esi,%ebx
   11092:	81 fe 00 02 00 00    	cmp    $0x200,%esi
   11098:	76 05                	jbe    1109f <_DebugOutDispatch@8+0x9f>
   1109a:	bb 00 02 00 00       	mov    $0x200,%ebx
   1109f:	50                   	push   %eax
   110a0:	53                   	push   %ebx
   110a1:	8b 85 d0 fd ff ff    	mov    0xfffffdd0(%ebp),%eax
   110a7:	50                   	push   %eax
   110a8:	8d 85 d8 fd ff ff    	lea    0xfffffdd8(%ebp),%eax
   110ae:	50                   	push   %eax
   110af:	e8 7c 01 00 00       	call   11230 <_memcpy>
   110b4:	c6 84 2b d8 fd ff ff 	movb   $0x0,0xfffffdd8(%ebx,%ebp,1)
   110bb:	00 
   110bc:	8d 95 d8 fd ff ff    	lea    0xfffffdd8(%ebp),%edx
   110c2:	59                   	pop    %ecx
   110c3:	58                   	pop    %eax
   110c4:	52                   	push   %edx
   110c5:	68 00 20 01 00       	push   $0x12000
   110ca:	e8 71 01 00 00       	call   11240 <_DbgPrint>
   110cf:	8b 95 d0 fd ff ff    	mov    0xfffffdd0(%ebp),%edx
   110d5:	01 da                	add    %ebx,%edx
   110d7:	83 c4 10             	add    $0x10,%esp
   110da:	29 de                	sub    %ebx,%esi
   110dc:	89 95 d0 fd ff ff    	mov    %edx,0xfffffdd0(%ebp)
   110e2:	75 ac                	jne    11090 <_DebugOutDispatch@8+0x90>
   110e4:	8b 47 04             	mov    0x4(%edi),%eax
   110e7:	8b 55 0c             	mov    0xc(%ebp),%edx
   110ea:	89 42 1c             	mov    %eax,0x1c(%edx)
   110ed:	e9 4e ff ff ff       	jmp    11040 <_DebugOutDispatch@8+0x40>
   110f2:	8b 45 0c             	mov    0xc(%ebp),%eax
   110f5:	c7 85 d4 fd ff ff 11 	movl   $0xc0000011,0xfffffdd4(%ebp)
   110fc:	00 00 c0 
   110ff:	8b 55 0c             	mov    0xc(%ebp),%edx
   11102:	c7 40 1c 00 00 00 00 	movl   $0x0,0x1c(%eax)
   11109:	8b 85 d4 fd ff ff    	mov    0xfffffdd4(%ebp),%eax
   1110f:	89 42 18             	mov    %eax,0x18(%edx)
   11112:	50                   	push   %eax
   11113:	50                   	push   %eax
   11114:	6a 00                	push   $0x0
   11116:	52                   	push   %edx
   11117:	e8 d4 00 00 00       	call   111f0 <_IoCompleteRequest@8>
   1111c:	8b 85 d4 fd ff ff    	mov    0xfffffdd4(%ebp),%eax
   11122:	8d 65 f4             	lea    0xfffffff4(%ebp),%esp
   11125:	5b                   	pop    %ebx
   11126:	5e                   	pop    %esi
   11127:	5f                   	pop    %edi
   11128:	5d                   	pop    %ebp
   11129:	c2 08 00             	ret    $0x8
   1112c:	8d 74 26 00          	lea    0x0(%esi),%esi

00011130 <_DebugOutUnload@4>:

VOID STDCALL
DebugOutUnload(PDRIVER_OBJECT DriverObject)
{
   11130:	55                   	push   %ebp
   11131:	89 e5                	mov    %esp,%ebp
   11133:	5d                   	pop    %ebp
   11134:	c2 04 00             	ret    $0x4
   11137:	89 f6                	mov    %esi,%esi
   11139:	8d bc 27 00 00 00 00 	lea    0x0(%edi),%edi

00011140 <_DriverEntry@8>:
}

NTSTATUS STDCALL 
DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
   11140:	55                   	push   %ebp
   11141:	89 e5                	mov    %esp,%ebp
   11143:	56                   	push   %esi
   11144:	53                   	push   %ebx
   11145:	83 ec 24             	sub    $0x24,%esp
  PDEVICE_OBJECT DebugOutDevice;
  UNICODE_STRING DeviceName;
  UNICODE_STRING DosName;
  NTSTATUS Status;

  /* register driver routines */
  DriverObject->MajorFunction[IRP_MJ_CLOSE] = DebugOutDispatch;
  DriverObject->MajorFunction[IRP_MJ_CREATE] = DebugOutDispatch;
  DriverObject->MajorFunction[IRP_MJ_WRITE] = DebugOutDispatch;
  DriverObject->MajorFunction[IRP_MJ_READ] = DebugOutDispatch;
  /* DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = DebugOutDispatch; */
  DriverObject->DriverUnload = DebugOutUnload;

  /* create device */
  RtlRosInitUnicodeStringFromLiteral(&DeviceName, L"\\Device\\DebugOut");

  Status = IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_NULL,
   11148:	8d 45 ec             	lea    0xffffffec(%ebp),%eax
   1114b:	8b 55 08             	mov    0x8(%ebp),%edx
   1114e:	8d 75 f0             	lea    0xfffffff0(%ebp),%esi
   11151:	66 c7 45 f0 20 00    	movw   $0x20,0xfffffff0(%ebp)
   11157:	66 c7 45 f2 22 00    	movw   $0x22,0xfffffff2(%ebp)
   1115d:	c7 42 40 00 10 01 00 	movl   $0x11000,0x40(%edx)
   11164:	c7 42 38 00 10 01 00 	movl   $0x11000,0x38(%edx)
   1116b:	c7 42 48 00 10 01 00 	movl   $0x11000,0x48(%edx)
   11172:	c7 42 44 00 10 01 00 	movl   $0x11000,0x44(%edx)
   11179:	c7 42 34 30 11 01 00 	movl   $0x11130,0x34(%edx)
   11180:	c7 45 f4 04 20 01 00 	movl   $0x12004,0xfffffff4(%ebp)
   11187:	50                   	push   %eax
   11188:	6a 00                	push   $0x0
   1118a:	6a 00                	push   $0x0
   1118c:	6a 15                	push   $0x15
   1118e:	56                   	push   %esi
   1118f:	6a 00                	push   $0x0
   11191:	52                   	push   %edx
   11192:	e8 69 00 00 00       	call   11200 <_IoCreateDevice@28>
   11197:	89 c3                	mov    %eax,%ebx
                            0, FALSE, &DebugOutDevice);
  if (! NT_SUCCESS(Status))
   11199:	58                   	pop    %eax
   1119a:	85 db                	test   %ebx,%ebx
   1119c:	78 33                	js     111d1 <_DriverEntry@8+0x91>
    {
      return Status;
    }

  RtlRosInitUnicodeStringFromLiteral(&DosName, L"\\DosDevices\\DebugOut");
  Status = IoCreateSymbolicLink(&DosName, &DeviceName);
   1119e:	50                   	push   %eax
   1119f:	50                   	push   %eax
   111a0:	8d 45 e0             	lea    0xffffffe0(%ebp),%eax
   111a3:	56                   	push   %esi
   111a4:	66 c7 45 e0 28 00    	movw   $0x28,0xffffffe0(%ebp)
   111aa:	66 c7 45 e2 2a 00    	movw   $0x2a,0xffffffe2(%ebp)
   111b0:	c7 45 e4 28 20 01 00 	movl   $0x12028,0xffffffe4(%ebp)
   111b7:	50                   	push   %eax
   111b8:	e8 53 00 00 00       	call   11210 <_IoCreateSymbolicLink@8>
   111bd:	89 c3                	mov    %eax,%ebx
  if (! NT_SUCCESS(Status))
   111bf:	5e                   	pop    %esi
   111c0:	85 db                	test   %ebx,%ebx
   111c2:	58                   	pop    %eax
   111c3:	78 17                	js     111dc <_DriverEntry@8+0x9c>
    {
    IoDeleteDevice(DebugOutDevice);
    return Status;
    }

  DebugOutDevice->Flags |= DO_BUFFERED_IO;
   111c5:	8b 45 ec             	mov    0xffffffec(%ebp),%eax
   111c8:	8b 50 1c             	mov    0x1c(%eax),%edx
   111cb:	83 ca 04             	or     $0x4,%edx
   111ce:	89 50 1c             	mov    %edx,0x1c(%eax)

  return Status;
}
   111d1:	8d 65 f8             	lea    0xfffffff8(%ebp),%esp
   111d4:	89 d8                	mov    %ebx,%eax
   111d6:	5b                   	pop    %ebx
   111d7:	5e                   	pop    %esi
   111d8:	5d                   	pop    %ebp
   111d9:	c2 08 00             	ret    $0x8
   111dc:	83 ec 0c             	sub    $0xc,%esp
   111df:	8b 4d ec             	mov    0xffffffec(%ebp),%ecx
   111e2:	51                   	push   %ecx
   111e3:	e8 38 00 00 00       	call   11220 <_IoDeleteDevice@4>
   111e8:	eb e7                	jmp    111d1 <_DriverEntry@8+0x91>
   111ea:	90                   	nop    
   111eb:	90                   	nop    
   111ec:	90                   	nop    
   111ed:	90                   	nop    
   111ee:	90                   	nop    
   111ef:	90                   	nop    

000111f0 <_IoCompleteRequest@8>:
   111f0:	ff 25 50 30 01 00    	jmp    *0x13050
   111f6:	90                   	nop    
   111f7:	90                   	nop    
	...

00011200 <_IoCreateDevice@28>:
   11200:	ff 25 54 30 01 00    	jmp    *0x13054
   11206:	90                   	nop    
   11207:	90                   	nop    
	...

00011210 <_IoCreateSymbolicLink@8>:
   11210:	ff 25 58 30 01 00    	jmp    *0x13058
   11216:	90                   	nop    
   11217:	90                   	nop    
	...

00011220 <_IoDeleteDevice@4>:
   11220:	ff 25 5c 30 01 00    	jmp    *0x1305c
   11226:	90                   	nop    
   11227:	90                   	nop    
	...

00011230 <_memcpy>:
   11230:	ff 25 60 30 01 00    	jmp    *0x13060
   11236:	90                   	nop    
   11237:	90                   	nop    
	...

00011240 <_DbgPrint>:
   11240:	ff 25 4c 30 01 00    	jmp    *0x1304c
   11246:	90                   	nop    
   11247:	90                   	nop    
	...

00011250 <__CTOR_LIST__>:
   11250:	ff                   	(bad)  
   11251:	ff                   	(bad)  
   11252:	ff                   	(bad)  
   11253:	ff 00                	incl   (%eax)
   11255:	00 00                	add    %al,(%eax)
	...

00011258 <__DTOR_LIST__>:
   11258:	ff                   	(bad)  
   11259:	ff                   	(bad)  
   1125a:	ff                   	(bad)  
   1125b:	ff 00                	incl   (%eax)
   1125d:	00 00                	add    %al,(%eax)
	...
