{$E sys}

library rramdisk;


procedure KfReleaseSpinLock; external 'HAL.dll';
procedure KfAcquireSpinLock; external 'HAL.dll';



procedure IoAcquireRemoveLockEx; external 'NTOSKRNL.exe';
procedure MmMapLockedPagesSpecifyCache; external 'NTOSKRNL.exe';
procedure MmUnmapLockedPages; external 'NTOSKRNL.exe';
procedure memmove; external 'NTOSKRNL.exe';
procedure RtlCopyUnicodeString; external 'NTOSKRNL.exe';
procedure RtlQueryRegistryValues; external 'NTOSKRNL.exe';
procedure ExAllocatePoolWithTag; external 'NTOSKRNL.exe';
procedure RtlInitUnicodeString; external 'NTOSKRNL.exe';
procedure strncpy; external 'NTOSKRNL.exe';
procedure IoAllocateDriverObjectExtension; external 'NTOSKRNL.exe';
procedure ExFreePoolWithTag; external 'NTOSKRNL.exe';
procedure IoGetDriverObjectExtension; external 'NTOSKRNL.exe';
procedure PoCallDriver; external 'NTOSKRNL.exe';
procedure PoStartNextPowerIrp; external 'NTOSKRNL.exe';
procedure IoReleaseRemoveLockEx; external 'NTOSKRNL.exe';
procedure KeSetEvent; external 'NTOSKRNL.exe';
procedure IoDeleteDevice; external 'NTOSKRNL.exe';
procedure IoDetachDevice; external 'NTOSKRNL.exe';
procedure MmFreePagesFromMdl; external 'NTOSKRNL.exe';
procedure IoDeleteSymbolicLink; external 'NTOSKRNL.exe';
procedure IoReleaseRemoveLockAndWaitEx; external 'NTOSKRNL.exe';
procedure IoAttachDeviceToDeviceStack; external 'NTOSKRNL.exe';
procedure IoCreateSymbolicLink; external 'NTOSKRNL.exe';
procedure RtlAppendUnicodeStringToString; external 'NTOSKRNL.exe';
procedure MmAllocatePagesForMdl; external 'NTOSKRNL.exe';
procedure KeInitializeSpinLock; external 'NTOSKRNL.exe';
procedure IoInitializeRemoveLockEx; external 'NTOSKRNL.exe';
procedure IoCreateDevice; external 'NTOSKRNL.exe';
procedure KeWaitForSingleObject; external 'NTOSKRNL.exe';
procedure KeInitializeEvent; external 'NTOSKRNL.exe';
procedure IofCompleteRequest; external 'NTOSKRNL.exe';
procedure IofCallDriver; external 'NTOSKRNL.exe';








//procedure loc_401F46; external;
procedure loc_401200; external;
procedure sub_4006C4; external;
procedure sub_400496; external;
procedure sub_400E2E; external;
procedure loc_400944; external;
procedure loc_400994; external;
procedure sub_400B14; external;
procedure sub_401DFC; external;

{$L !rramdisk}

procedure DriverEntry;

const
DriverObjectExtension = $08;
SourceString    =  $0C;

asm
        push    ebp
        mov ebp, esp
        push    esi
        mov esi, [ebp+DriverObjectExtension]
        lea eax, [ebp+DriverObjectExtension]
        push    eax     //; DriverObjectExtension
        push    0Ch     //; DriverObjectExtensionSize
        push    offset DriverEntry //; ClientIdentificationAddress
        push    esi     //; DriverObject
        call    IoAllocateDriverObjectExtension
        test    eax, eax
        jl  @@loc_401F46
        mov ecx, [ebp+DriverObjectExtension]
        push    edi
        mov edi, [ebp+SourceString]
        mov ax, [edi]
        mov [ecx], ax
        mov ax, [edi+2]
        mov ecx, [ebp+DriverObjectExtension]
        add ax, 2
        mov [ecx+2], ax
        mov eax, [ebp+DriverObjectExtension]
        movzx   eax, word ptr [eax+2]
        push    '1maR'          //; Tag
        push    eax     //; NumberOfBytes
        push    1       //; PoolType
        call    ExAllocatePoolWithTag
        mov ecx, [ebp+DriverObjectExtension]
        mov [ecx+4], eax
        mov eax, [ebp+DriverObjectExtension]
        cmp dword ptr [eax+4], 0
        jnz @@loc_401EE8
        mov eax, 0C000009Ah
        jmp @@loc_401F45
//; ---------------------------------------------------------------------------

@@loc_401EE8:               //; CODE XREF: DriverEntry+5Fj
        push    edi     //; SourceString
        push    eax     //; DestinationString
        call    RtlCopyUnicodeString
        mov eax, [ebp+DriverObjectExtension]
        and dword ptr [eax+8], 0
        mov eax, offset loc_401200
        mov [esi+38h], eax
        mov [esi+40h], eax
        mov eax, offset sub_4006C4
        mov [esi+44h], eax
        mov [esi+48h], eax
        mov eax, [esi+18h]
        mov dword ptr [esi+70h], offset sub_400496
        mov dword ptr [esi+0A4h], offset sub_400E2E
        mov dword ptr [esi+90h], offset loc_400944
        mov dword ptr [esi+94h], offset loc_400994
        mov dword ptr [eax+4], offset sub_400B14
        mov dword ptr [esi+34h], offset sub_401DFC
        xor eax, eax

@@loc_401F45:               //; CODE XREF: DriverEntry+66j
        pop edi

@@loc_401F46:               //; CODE XREF: DriverEntry+1Bj
        pop esi
        pop ebp
        ret 8
end;








//procedure DriverEntry;external;

asm jmp DriverEntry
end.




; ---------------------------------------------------------------------------

_RTL_QUERY_REGISTRY_TABLE struc ; (sizeof=0x1C, standard type)
QueryRoutine    dd ?            ; offset
Flags       dd ?
Name        dd ?            ; offset
EntryContext    dd ?            ; offset
DefaultType dd ?
DefaultData dd ?            ; offset
DefaultLength   dd ?
_RTL_QUERY_REGISTRY_TABLE ends

; ---------------------------------------------------------------------------

LIST_ENTRY  struc ; (sizeof=0x8, standard type)
Flink       dd ?            ; offset
Blink       dd ?            ; offset
LIST_ENTRY  ends


; ---------------------------------------------------------------------------

PHYSICAL_ADDRESS struc ; (sizeof=0x8, standard type)
LowPart     dd ?
HighPart    dd ?
PHYSICAL_ADDRESS ends

; ---------------------------------------------------------------------------

UNICODE_STRING  struc ; (sizeof=0x8, standard type)
Length      dw ?
MaximumLength   dw ?
Buffer      dd ?            ; offset
UNICODE_STRING  ends


;
; +-------------------------------------------------------------------------+
; |   This file has been generated by The Interactive Disassembler (IDA)    |
; |       Copyright (c) 2011 Hex-Rays, <support@hex-rays.com>       |
; |          License info: 48-327F-7274-B7              |
; |                ESET spol. s r.o.                |
; +-------------------------------------------------------------------------+
;
; Input MD5   : CAE382E4306ED6D112D174CE8C4A98B8
; Input CRC32 : 8DABBE34


        include uni.inc ; see unicode subdir of ida for info on unicode

        .686p
        .mmx
        .model flat
        extrn DriverEntry:proc
; ===========================================================================

; [00000480 BYTES: COLLAPSED SEGMENT HEADER. PRESS KEYPAD "+" TO EXPAND]
; File Name   : A:\!files\rramdisk.sys
; Format      : Portable executable for 80386 (PE)
; Imagebase   : 400000
; Section 1. (virtual address 00000480)
; Virtual size          : 00000B34 (   2868.)
; Section size in file      : 00000B80 (   2944.)
; Offset to raw data for section: 00000480
; Flags 68000020: Text Not pageable Executable Readable
; Alignment : default
; ===========================================================================

; Segment type: Pure code
; Segment permissions: Read/Execute
;_text      segment para public 'CODE' use32
;       assume cs:_text
        ;org 400480h
;       assume es:nothing, ss:nothing, _data, fs:nothing, gs:nothing
.code
; char File[]
File        db 'd:\work\rd\ramdisk.c',0 ; DATA XREF: sub_400496+1Bo
        align 2

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

; int __stdcall sub_400496(PIO_REMOVE_LOCK RemoveLock, PVOID Irp)
public sub_400496
sub_400496  proc near       ; DATA XREF: DriverEntry+90o

var_4       = dword ptr -4
RemoveLock  = dword ptr  8
Irp     = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        push    ecx
        mov eax, [ebp+RemoveLock]
        and [ebp+var_4], 0
        push    ebx
        mov ebx, [ebp+Irp]
        push    esi
        mov esi, [eax+28h]
        push    edi
        push    18h     ; RemlockSize
        push    12Bh        ; Line
        push    offset File ; "d:\\work\\rd\\ramdisk.c"
        lea eax, [esi+10h]
        push    ebx     ; Tag
        push    eax     ; RemoveLock
        mov [ebp+RemoveLock], eax
        call    IoAcquireRemoveLockEx
        mov edi, eax
        xor edx, edx
        cmp edi, edx
        jge short loc_4004E3
        mov [ebx+1Ch], edx
        xor dl, dl      ; PriorityBoost
        mov ecx, ebx    ; Irp
        mov [ebx+18h], edi
        call    IofCompleteRequest
        mov eax, edi
        jmp loc_40060F
; ---------------------------------------------------------------------------

loc_4004E3:             ; CODE XREF: sub_400496+34j
        mov eax, [ebx+60h]
        mov edi, [eax+0Ch]
        mov ecx, 7405Ch
        cmp edi, ecx
        ja  loc_4005BE
        jz  loc_4005A1
        sub edi, 70000h
        jz  short loc_400579
        sub edi, 14h
        jz  loc_4005EC
        sub edi, 10h
        jz  loc_4005EC
        sub edi, 0BDCh
        jz  short loc_400579
        sub edi, 3404h
        jnz loc_4005D8
        push    20h
        pop edi
        cmp [eax+4], edi
        mov [ebp+var_4], edi
        jnb short loc_40053F
        mov esi, 0C0000023h
        jmp loc_4005EE
; ---------------------------------------------------------------------------

loc_40053F:             ; CODE XREF: sub_400496+9Dj
        mov cl, byte_40119C
        mov eax, [ebx+0Ch]
        mov [eax], edx
        mov [eax+4], edx
        mov [eax+18h], cl
        mov byte ptr [eax+19h], 0
        mov byte ptr [eax+1Ah], 1
        mov byte ptr [eax+1Bh], 0
        mov ecx, [esi+64h]
        xor edx, edx
        shld    edx, ecx, 0Ah
        shl ecx, 0Ah
        xor esi, esi
        or  dword ptr [eax+14h], 0FFFFFFFFh
        mov [eax+8], ecx
        mov [eax+0Ch], edx
        mov [eax+10h], esi
        jmp short loc_4005EE
; ---------------------------------------------------------------------------

loc_400579:             ; CODE XREF: sub_400496+6Cj
                    ; sub_400496+86j
        cmp dword ptr [eax+4], 18h
        jnb short loc_40058D
        mov esi, 0C0000023h
        mov [ebp+var_4], 20h
        jmp short loc_4005EE
; ---------------------------------------------------------------------------

loc_40058D:             ; CODE XREF: sub_400496+E7j
        mov edi, [ebx+0Ch]
        push    6
        add esi, 48h
        pop ecx
        rep movsd
        mov [ebp+var_4], 18h
        jmp short loc_4005EC
; ---------------------------------------------------------------------------

loc_4005A1:             ; CODE XREF: sub_400496+60j
        mov eax, [esi+64h]
        mov esi, [ebx+0Ch]
        xor ecx, ecx
        shld    ecx, eax, 0Ah
        shl eax, 0Ah
        mov [esi], eax
        mov [esi+4], ecx
        mov [ebp+var_4], 8
        jmp short loc_4005EC
; ---------------------------------------------------------------------------

loc_4005BE:             ; CODE XREF: sub_400496+5Aj
        sub edi, 74800h
        jz  short loc_4005EC
        sub edi, 4
        jz  short loc_4005EC
        sub edi, 7804h
        jz  short loc_4005DF
        sub edi, 10h
        jz  short loc_4005EC

loc_4005D8:             ; CODE XREF: sub_400496+8Ej
        mov esi, 0C0000010h
        jmp short loc_4005EE
; ---------------------------------------------------------------------------

loc_4005DF:             ; CODE XREF: sub_400496+13Bj
        mov eax, [ebx+0Ch]
        mov al, [eax]
        mov [ebp+var_4], edx
        mov byte_40119C, al

loc_4005EC:             ; CODE XREF: sub_400496+71j
                    ; sub_400496+7Aj ...
        xor esi, esi

loc_4005EE:             ; CODE XREF: sub_400496+A4j
                    ; sub_400496+E1j ...
        mov eax, [ebp+var_4]
        xor dl, dl      ; PriorityBoost
        mov ecx, ebx    ; Irp
        mov [ebx+18h], esi
        mov [ebx+1Ch], eax
        call    IofCompleteRequest
        push    18h     ; RemlockSize
        push    ebx     ; Tag
        push    [ebp+RemoveLock] ; RemoveLock
        call    IoReleaseRemoveLockEx
        mov eax, esi

loc_40060F:             ; CODE XREF: sub_400496+48j
        pop edi
        pop esi
        pop ebx
        leave
        retn    8
sub_400496  endp


; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

sub_400616  proc near       ; CODE XREF: sub_4006C4+127p
                    ; sub_4006C4+16Ep ...

arg_0       = dword ptr  8
arg_4       = dword ptr  0Ch
arg_8       = dword ptr  10h
arg_C       = dword ptr  14h

        push    ebp
        mov ebp, esp
        mov ecx, eax
        and ecx, 1Fh
        shl ecx, 9
        add [ebp+arg_0], ecx
        mov ecx, [ebp+arg_4]
        mov edx, [ebp+arg_0]
        add edx, ecx
        mov ecx, 4000h
        shr eax, 5
        cmp edx, ecx
        jle short loc_40063E
        sub ecx, [ebp+arg_0]
        mov [ebp+arg_4], ecx

loc_40063E:             ; CODE XREF: sub_400616+20j
        cmp eax, [esi+40h]
        jb  short loc_400648
        or  eax, 0FFFFFFFFh
        jmp short loc_4006AA
; ---------------------------------------------------------------------------

loc_400648:             ; CODE XREF: sub_400616+2Bj
        mov ecx, [esi+38h]
        push    ebx
        push    edi
        mov edi, eax
        shr eax, 6
        mov ebx, eax
        mov eax, [esi+34h]
        shl ebx, 2
        and edi, 3Fh
        cmp [ebx+ecx], eax
        jz  short loc_400688
        push    eax     ; MemoryDescriptorList
        push    dword ptr [esi+30h] ; BaseAddress
        call    MmUnmapLockedPages
        mov eax, [esi+38h]
        mov ebx, [ebx+eax]
        push    20h     ; Priority
        xor eax, eax
        push    eax     ; BugCheckOnFailure
        push    eax     ; BaseAddress
        push    1       ; CacheType
        push    eax     ; AccessMode
        push    ebx     ; MemoryDescriptorList
        mov [esi+34h], ebx
        call    MmMapLockedPagesSpecifyCache
        mov [esi+30h], eax

loc_400688:             ; CODE XREF: sub_400616+4Aj
        mov eax, [ebp+arg_8]
        test    eax, eax
        jz  short loc_40069A
        shl edi, 0Eh
        add edi, [esi+30h]
        add edi, [ebp+arg_0]
        mov [eax], edi

loc_40069A:             ; CODE XREF: sub_400616+77j
        mov eax, [ebp+arg_C]
        test    eax, eax
        pop edi
        pop ebx
        jz  short loc_4006A8
        mov ecx, [ebp+arg_4]
        mov [eax], ecx

loc_4006A8:             ; CODE XREF: sub_400616+8Bj
        xor eax, eax

loc_4006AA:             ; CODE XREF: sub_400616+30j
        pop ebp
        retn    10h
sub_400616  endp

; ---------------------------------------------------------------------------
; char aDWorkRdRamdi_0[]
aDWorkRdRamdi_0 db 'd:\work\rd\ramdisk.c',0 ; DATA XREF: sub_4006C4+36o
        align 4

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame
public sub_4006C4
; int __stdcall sub_4006C4(KIRQL NewIrql, PIRP Tag)
sub_4006C4  proc near       ; DATA XREF: DriverEntry+82o

RemoveLock  = dword ptr -1Ch
SpinLock    = dword ptr -18h
var_14      = dword ptr -14h
var_10      = dword ptr -10h
var_C       = dword ptr -0Ch
var_8       = dword ptr -8
var_4       = dword ptr -4
NewIrql     = byte ptr  8
Tag     = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        sub esp, 1Ch
        mov eax, dword ptr [ebp+NewIrql]
        push    esi
        mov esi, [eax+28h]
        cmp dword ptr [esi+0Ch], 1
        push    edi
        mov edi, [ebp+Tag]
        mov [ebp+var_C], esi
        jz  short loc_4006F3
        and dword ptr [edi+1Ch], 0
        xor dl, dl      ; PriorityBoost
        mov ecx, edi    ; Irp
        mov dword ptr [edi+18h], 0C0000184h
        call    IofCompleteRequest

loc_4006F3:             ; CODE XREF: sub_4006C4+18j
        push    18h     ; RemlockSize
        push    24Ah        ; Line
        push    offset aDWorkRdRamdi_0 ; "d:\\work\\rd\\ramdisk.c"
        lea eax, [esi+10h]
        push    edi     ; Tag
        push    eax     ; RemoveLock
        mov [ebp+RemoveLock], eax
        call    IoAcquireRemoveLockEx
        mov esi, eax
        test    esi, esi
        jge short loc_400729
        and dword ptr [edi+1Ch], 0
        xor dl, dl      ; PriorityBoost
        mov ecx, edi    ; Irp
        mov [edi+18h], esi
        call    IofCompleteRequest
        jmp loc_400899
; ---------------------------------------------------------------------------

loc_400729:             ; CODE XREF: sub_4006C4+4Dj
        mov esi, [edi+60h]
        mov edx, [esi+0Ch]
        mov eax, [esi+4]
        push    ebx
        mov ebx, [esi+10h]
        mov ecx, edx
        shr ecx, 9
        shl ebx, 17h
        add ebx, ecx
        mov ecx, 1FFh
        test    ecx, eax
        mov [ebp+var_8], eax
        mov [ebp+var_4], eax
        jnz loc_400875
        test    ecx, edx
        jnz loc_400875
        mov edx, [ebp+var_C]
        mov edx, [edx+64h]
        mov ecx, eax
        shr ecx, 9
        add ecx, ebx
        shl edx, 1
        cmp ecx, edx
        ja  loc_400875
        mov ecx, [edi+4]
        test    byte ptr [ecx+6], 5
        jz  short loc_400783
        mov ecx, [ecx+0Ch]
        mov [ebp+Tag], ecx
        jmp short loc_400799
; ---------------------------------------------------------------------------

loc_400783:             ; CODE XREF: sub_4006C4+B5j
        push    10h     ; Priority
        xor eax, eax
        push    eax     ; BugCheckOnFailure
        push    eax     ; BaseAddress
        push    1       ; CacheType
        push    eax     ; AccessMode
        push    ecx     ; MemoryDescriptorList
        call    MmMapLockedPagesSpecifyCache
        mov [ebp+Tag], eax
        mov eax, [ebp+var_8]

loc_400799:             ; CODE XREF: sub_4006C4+BDj
        cmp [ebp+Tag], 0
        jnz short loc_4007A9
        mov ecx, 0C000009Ah
        jmp loc_40087A
; ---------------------------------------------------------------------------

loc_4007A9:             ; CODE XREF: sub_4006C4+D9j
        mov ecx, [ebp+var_C]
        add ecx, 2Ch    ; SpinLock
        mov [ebp+SpinLock], ecx
        call    KfAcquireSpinLock
        mov [ebp+0Bh], al
        movzx   eax, byte ptr [esi]
        sub eax, 3
        jz  short loc_40081A
        dec eax
        jz  short loc_4007CF
        and [ebp+var_8], 0
        jmp loc_40085F
; ---------------------------------------------------------------------------

loc_4007CF:             ; CODE XREF: sub_4006C4+100j
        cmp [ebp+var_8], 0
        jbe loc_40085F

loc_4007D9:             ; CODE XREF: sub_4006C4+152j
        mov esi, [ebp+var_C]
        lea eax, [ebp+var_10]
        push    eax
        lea eax, [ebp+var_14]
        push    eax
        push    [ebp+var_4]
        mov eax, ebx
        push    0
        call    sub_400616
        test    eax, eax
        jnz short loc_40085F
        mov esi, [ebp+var_10]
        push    esi     ; size_t
        push    [ebp+Tag]   ; void *
        push    [ebp+var_14]    ; void *
        call    memmove
        add [ebp+Tag], esi
        sub [ebp+var_4], esi
        shr esi, 9
        add esp, 0Ch
        add ebx, esi
        cmp [ebp+var_4], 0
        ja  short loc_4007D9
        jmp short loc_40085F
; ---------------------------------------------------------------------------

loc_40081A:             ; CODE XREF: sub_4006C4+FDj
        cmp [ebp+var_8], 0
        jbe short loc_40085F

loc_400820:             ; CODE XREF: sub_4006C4+199j
        mov esi, [ebp+var_C]
        lea eax, [ebp+var_10]
        push    eax
        lea eax, [ebp+var_14]
        push    eax
        push    [ebp+var_4]
        mov eax, ebx
        push    0
        call    sub_400616
        test    eax, eax
        jnz short loc_40085F
        mov esi, [ebp+var_10]
        push    esi     ; size_t
        push    [ebp+var_14]    ; void *
        push    [ebp+Tag]   ; void *
        call    memmove
        add [ebp+Tag], esi
        sub [ebp+var_4], esi
        shr esi, 9
        add esp, 0Ch
        add ebx, esi
        cmp [ebp+var_4], 0
        ja  short loc_400820

loc_40085F:             ; CODE XREF: sub_4006C4+106j
                    ; sub_4006C4+10Fj ...
        mov dl, [ebp+0Bh]   ; NewIrql
        mov ecx, [ebp+SpinLock] ; SpinLock
        call    KfReleaseSpinLock
        mov eax, [ebp+var_8]
        xor esi, esi
        mov [edi+18h], esi
        jmp short loc_40087F
; ---------------------------------------------------------------------------

loc_400875:             ; CODE XREF: sub_4006C4+89j
                    ; sub_4006C4+91j ...
        mov ecx, 0C000000Dh

loc_40087A:             ; CODE XREF: sub_4006C4+E0j
        mov [edi+18h], ecx
        mov esi, ecx

loc_40087F:             ; CODE XREF: sub_4006C4+1AFj
        xor dl, dl      ; PriorityBoost
        mov ecx, edi    ; Irp
        mov [edi+1Ch], eax
        call    IofCompleteRequest
        push    18h     ; RemlockSize
        push    edi     ; Tag
        push    [ebp+RemoveLock] ; RemoveLock
        call    IoReleaseRemoveLockEx
        pop ebx

loc_400899:             ; CODE XREF: sub_4006C4+60j
        pop edi
        mov eax, esi
        pop esi
        leave
        retn    8
sub_4006C4  endp

; ---------------------------------------------------------------------------
        align 2

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

sub_4008A2  proc near       ; CODE XREF: sub_4015DC+165p
                    ; sub_4015DC+192p ...

arg_0       = dword ptr  8
arg_4       = dword ptr  0Ch
arg_8       = dword ptr  10h
arg_C       = dword ptr  14h
arg_10      = dword ptr  18h
arg_14      = dword ptr  1Ch
arg_18      = byte ptr  20h

        push    ebp
        mov ebp, esp
        mov ecx, [ebp+arg_10]
        mov edx, [ebp+arg_C]
        mov eax, [ebp+arg_14]
        push    esi
        mov esi, [ebp+arg_8]
        test    esi, esi
        push    edi
        jnz short loc_4008D6
        movsx   edi, [ebp+arg_18]
        push    ebx
        mov ebx, [eax]
        shr ebx, 8
        shl edi, 18h
        or  edi, ebx
        mov bl, [ebp+arg_18]
        mov [eax], edi
        mov eax, [edx]
        mov [eax], bl
        inc dword ptr [edx]
        dec dword ptr [ecx]
        pop ebx
        jmp short loc_4008FB
; ---------------------------------------------------------------------------

loc_4008D6:             ; CODE XREF: sub_4008A2+13j
        cmp esi, 1
        jnz short loc_4008E0
        shr dword ptr [eax], 8
        jmp short loc_4008FB
; ---------------------------------------------------------------------------

loc_4008E0:             ; CODE XREF: sub_4008A2+37j
        cmp esi, 2
        jnz short loc_4008ED
        movzx   edi, word ptr [eax+2]

loc_4008E9:             ; CODE XREF: sub_4008A2+54j
        mov [eax], edi
        jmp short loc_4008FB
; ---------------------------------------------------------------------------

loc_4008ED:             ; CODE XREF: sub_4008A2+41j
        cmp esi, 3
        jnz short loc_4008F8
        movzx   edi, byte ptr [eax+3]
        jmp short loc_4008E9
; ---------------------------------------------------------------------------

loc_4008F8:             ; CODE XREF: sub_4008A2+4Ej
        and dword ptr [eax], 0

loc_4008FB:             ; CODE XREF: sub_4008A2+32j
                    ; sub_4008A2+3Cj ...
        add [edx], esi
        sub [ecx], esi
        mov eax, [ecx]
        test    eax, eax
        jle short loc_400909
        xor eax, eax
        jmp short loc_40093D
; ---------------------------------------------------------------------------

loc_400909:             ; CODE XREF: sub_4008A2+61j
        mov esi, [ebp+arg_4]
        neg eax
        sar eax, 0Eh
        push    ecx
        inc eax
        add [esi], eax
        mov ecx, [ecx]
        mov eax, [esi]
        mov esi, [ebp+arg_0]
        push    edx
        neg ecx
        push    4000h
        and ecx, 3FFFh
        push    ecx
        shl eax, 5
        call    sub_400616
        xor ecx, ecx
        test    eax, eax
        setnl   cl
        dec ecx
        mov eax, ecx

loc_40093D:             ; CODE XREF: sub_4008A2+65j
        pop edi
        pop esi
        pop ebp
        retn    1Ch
sub_4008A2  endp

; ---------------------------------------------------------------------------
        align 4
public loc_400944
loc_400944:             ; DATA XREF: DriverEntry+A1o
        mov eax, [esp+4]
        push    esi
        mov esi, [esp+0Ch]
        push    edi
        mov edi, [eax+28h]
        cmp dword ptr [edi+0Ch], 5
        push    esi
        jnz short loc_400978
        call    PoStartNextPowerIrp
        and dword ptr [esi+1Ch], 0
        mov edi, 0C0000056h
        xor dl, dl
        mov ecx, esi
        mov [esi+18h], edi
        call    IofCompleteRequest
        mov eax, edi
        jmp short loc_40098F
; ---------------------------------------------------------------------------

loc_400978:             ; CODE XREF: .text:00400956j
        call    PoStartNextPowerIrp
        inc byte ptr [esi+23h]
        add dword ptr [esi+60h], 24h
        push    esi
        push    dword ptr [edi+4]
        call    PoCallDriver

loc_40098F:             ; CODE XREF: .text:00400976j
        pop edi
        pop esi
        retn    8
; ---------------------------------------------------------------------------
public loc_400994
loc_400994:             ; DATA XREF: DriverEntry+ABo
        mov edx, [esp+8]
        mov eax, [esp+4]
        mov eax, [eax+28h]
        inc byte ptr [edx+23h]
        add dword ptr [edx+60h], 24h
        mov ecx, [eax+4]
        call    IofCallDriver
        retn    8
; ---------------------------------------------------------------------------

loc_4009B2:             ; DATA XREF: sub_400E2E+DFo
        push    0
        push    0
        push    dword ptr [esp+14h]
        call    KeSetEvent
        mov eax, 0C0000016h
        retn    0Ch

; =============== S U B R O U T I N E =======================================


sub_4009C8  proc near       ; CODE XREF: sub_400A70+4Bp
                    ; sub_400B14+95p ...

arg_0       = dword ptr  4

        mov eax, [esp+arg_0]
        push    esi
        mov esi, [eax+28h]
        test    byte ptr [esi+28h], 1
        jz  short loc_4009E3
        lea eax, [esi+84h]
        push    eax     ; SymbolicLinkName
        call    IoDeleteSymbolicLink

loc_4009E3:             ; CODE XREF: sub_4009C8+Cj
        mov eax, [esi+88h]
        push    ebp
        xor ebp, ebp
        cmp eax, ebp
        push    edi
;       mov edi, offset ExFreePoolWithTag
        jz  short loc_4009FB
        push    ebp     ; Tag
        push    eax     ; P
        call    ExFreePoolWithTag

loc_4009FB:             ; CODE XREF: sub_4009C8+2Dj
        mov eax, [esi+80h]
        cmp eax, ebp
        jz  short loc_400A09
        push    ebp     ; Tag
        push    eax     ; P
        call    ExFreePoolWithTag

loc_400A09:             ; CODE XREF: sub_4009C8+3Bj
        mov eax, [esi+7Ch]
        cmp eax, ebp
        jz  short loc_400A14
        push    ebp     ; Tag
        push    eax     ; P
        call    ExFreePoolWithTag

loc_400A14:             ; CODE XREF: sub_4009C8+46j
        mov eax, [esi+30h]
        cmp eax, ebp
        jz  short loc_400A25
        push    dword ptr [esi+34h] ; MemoryDescriptorList
        push    eax     ; BaseAddress
        call    MmUnmapLockedPages

loc_400A25:             ; CODE XREF: sub_4009C8+51j
        cmp [esi+38h], ebp
        jz  short loc_400A59
        push    ebx
        xor ebx, ebx
        cmp [esi+3Ch], ebp
        jbe short loc_400A52

loc_400A32:             ; CODE XREF: sub_4009C8+88j
        mov eax, [esi+38h]
        mov eax, [eax+ebx*4]
        cmp eax, ebp
        jz  short loc_400A4C
        push    eax     ; MemoryDescriptorList
        call    MmFreePagesFromMdl
        mov eax, [esi+38h]
        push    ebp     ; Tag
        push    dword ptr [eax+ebx*4] ; P
        call    ExFreePoolWithTag

loc_400A4C:             ; CODE XREF: sub_4009C8+72j
        inc ebx
        cmp ebx, [esi+3Ch]
        jb  short loc_400A32

loc_400A52:             ; CODE XREF: sub_4009C8+68j
        push    ebp     ; Tag
        push    dword ptr [esi+38h] ; P
        call    ExFreePoolWithTag
        pop ebx

loc_400A59:             ; CODE XREF: sub_4009C8+60j
        mov esi, [esi+4]
        pop edi
        cmp esi, ebp
        pop ebp
        jz  short loc_400A69
        push    esi     ; TargetDevice
        call    IoDetachDevice

loc_400A69:             ; CODE XREF: sub_4009C8+98j
        pop esi
        jmp IoDeleteDevice
sub_4009C8  endp


; =============== S U B R O U T I N E =======================================


; int __stdcall sub_400A70(int, PIRP Tag)
sub_400A70  proc near       ; CODE XREF: sub_400E2E+A0p

arg_0       = dword ptr  4
Tag     = dword ptr  8

        push    ebx
        mov ebx, [esp+4+arg_0]
        push    esi
        mov esi, [esp+8+Tag]
        push    edi
        mov edi, [ebx+28h]
        and dword ptr [esi+18h], 0
        inc byte ptr [esi+23h]
        add dword ptr [esi+60h], 24h
        mov ecx, [edi+4]    ; DeviceObject
        mov edx, esi    ; Irp
        call    IofCallDriver
        push    18h     ; RemlockSize
        mov dword ptr [edi+0Ch], 5
        push    esi     ; Tag
        add edi, 10h
        push    edi     ; RemoveLock
        call    IoReleaseRemoveLockAndWaitEx
        push    offset DriverEntry ; ClientIdentificationAddress
        push    dword ptr [ebx+8] ; DriverObject
        call    IoGetDriverObjectExtension
        and dword ptr [eax+8], 0
        push    ebx
        call    sub_4009C8
        pop edi
        pop esi
        pop ebx
        retn    8
sub_400A70  endp

; ---------------------------------------------------------------------------
; const WCHAR srcstring
srcstring   dw 5Ch          ; DATA XREF: sub_400B14+2Fo
aDeviceHarddisk:
        unicode 0, <Device\HarddiskVolumeRD>,0
        db 2 dup(0)
; const WCHAR word_400AFA
word_400AFA dw 5Ch          ; DATA XREF: sub_400B14+276o
aDosdevices:
        unicode 0, <DosDevices\>,0

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame
public sub_400B14
; int __stdcall sub_400B14(PDRIVER_OBJECT DriverObject, PDEVICE_OBJECT TargetDevice)
sub_400B14  proc near       ; DATA XREF: DriverEntry+B5o

var_28      = dword ptr -28h
SourceString    = UNICODE_STRING ptr -24h
DestinationString= UNICODE_STRING ptr -1Ch
var_14      = dword ptr -14h
var_10      = dword ptr -10h
LowAddress  = PHYSICAL_ADDRESS ptr -0Ch
SourceDevice    = dword ptr -4
DriverObject    = dword ptr  8
TargetDevice    = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        sub esp, 2Ch
        push    esi
        push    offset DriverEntry ; ClientIdentificationAddress
        push    [ebp+DriverObject] ; DriverObject
        xor esi, esi
        inc esi
        mov [ebp+LowAddress.HighPart], esi
        call    IoGetDriverObjectExtension
        cmp [eax+8], esi
        mov [ebp+var_14], eax
        jnz short loc_400B41
        mov eax, 0C0000038h
        jmp loc_400E16
; ---------------------------------------------------------------------------

loc_400B41:             ; CODE XREF: sub_400B14+21j
        push    ebx
        push    edi
        push    offset srcstring ; SourceString
        lea eax, [ebp+DestinationString]
        push    eax     ; DestinationString
        call    RtlInitUnicodeString
        lea eax, [ebp+SourceDevice]
        push    eax
        xor ebx, ebx
        push    ebx
        push    100h
        push    24h
        jmp short loc_400BE1
; ---------------------------------------------------------------------------

loc_400B62:             ; CODE XREF: sub_400B14+E4j
        mov eax, [ebp+SourceDevice]
        mov esi, [eax+28h]
        push    24h
        pop ecx
        push    316D6152h   ; Tag
        xor eax, eax
        mov edi, esi
        push    14h     ; NumberOfBytes
        rep stosd
        mov edi, offset ExAllocatePoolWithTag
        push    1       ; PoolType
        call    edi ; ExAllocatePoolWithTag
        cmp eax, ebx
        mov [esi+7Ch], eax
        jz  short loc_400C03
        lea eax, [esi+60h]
        push    eax
        push    [ebp+var_14]
        mov word ptr [esi+7Ah], 14h
        call    sub_401300
        mov eax, [esi+6Ch]
        cmp eax, [ebp+LowAddress.HighPart]
        jz  short loc_400C17
        push    [ebp+SourceDevice]
        mov [ebp+LowAddress.HighPart], eax
        call    sub_4009C8
        mov eax, [ebp+LowAddress.HighPart]
        dec eax
        jz  short loc_400BD0
        dec eax
        jz  short loc_400BCC
        dec eax
        jz  short loc_400BC5
        dec eax
        jnz short loc_400C0D
        push    7
        pop ecx
        push    5
        pop eax
        jmp short loc_400BD5
; ---------------------------------------------------------------------------

loc_400BC5:             ; CODE XREF: sub_400B14+A4j
        xor eax, eax
        push    7
        inc eax
        jmp short loc_400BD4
; ---------------------------------------------------------------------------

loc_400BCC:             ; CODE XREF: sub_400B14+A1j
        push    7
        jmp short loc_400BD2
; ---------------------------------------------------------------------------

loc_400BD0:             ; CODE XREF: sub_400B14+9Ej
        push    24h

loc_400BD2:             ; CODE XREF: sub_400B14+BAj
        xor eax, eax

loc_400BD4:             ; CODE XREF: sub_400B14+B6j
        pop ecx

loc_400BD5:             ; CODE XREF: sub_400B14+AFj
        lea edx, [ebp+SourceDevice]
        push    edx     ; DeviceObject
        push    ebx     ; Exclusive
        or  eax, 100h
        push    eax     ; DeviceCharacteristics
        push    ecx     ; DeviceType

loc_400BE1:             ; CODE XREF: sub_400B14+4Cj
        lea eax, [ebp+DestinationString]
        push    eax     ; DeviceName
        push    90h     ; DeviceExtensionSize
        push    [ebp+DriverObject] ; DriverObject
        call    IoCreateDevice
        cmp eax, ebx
        mov [ebp+var_10], eax
        jge loc_400B62
        jmp loc_400E14
; ---------------------------------------------------------------------------

loc_400C03:             ; CODE XREF: sub_400B14+73j
                    ; sub_400B14+20Ej ...
        mov edi, 0C000009Ah
        jmp loc_400DF7
; ---------------------------------------------------------------------------

loc_400C0D:             ; CODE XREF: sub_400B14+A7j
        mov eax, 0C000009Ah
        jmp loc_400E14
; ---------------------------------------------------------------------------

loc_400C17:             ; CODE XREF: sub_400B14+8Dj
        mov eax, [ebp+TargetDevice]
        push    18h     ; RemlockSize
        push    0Ah     ; HighWatermark
        mov [esi+8], eax
        mov eax, [ebp+SourceDevice]
        push    1       ; MaxLockedMinutes
        mov [esi], eax
        push    'lmaR'          ; AllocateTag
        lea eax, [esi+10h]
        push    eax     ; Lock
        mov [esi+0Ch], ebx
        call    IoInitializeRemoveLockEx
        mov eax, [ebp+SourceDevice]
        or  byte ptr [eax+1Dh], 20h
        mov eax, [ebp+SourceDevice]
        or  dword ptr [eax+1Ch], 10h
        lea eax, [esi+2Ch]
        push    eax     ; SpinLock
        call    KeInitializeSpinLock
        mov eax, [esi+68h]
        mov ecx, eax
        shl ecx, 6
        mov [esi+44h], ecx
        mov ecx, [esi+60h]
        mov [esi+3Ch], eax
        push    '1maR'          ; Tag
        shl eax, 2
        push    eax     ; NumberOfBytes
        shl ecx, 6
        push    ebx     ; PoolType
        mov [esi+40h], ecx
        call    edi ; ExAllocatePoolWithTag
        mov ecx, [esi+3Ch]
        or  [ebp+var_28], 0FFFFFFFFh
        shl ecx, 2
        mov edx, ecx
        shr ecx, 2
        mov edi, eax
        xor eax, eax
        mov [esi+38h], edi
        rep stosd
        mov ecx, edx
        and ecx, 3
        rep stosb
        cmp [esi+3Ch], ebx
        mov [ebp+LowAddress.LowPart], ebx
        mov [ebp+LowAddress.HighPart], 1
        mov [ebp+DriverObject], ebx
        jbe short loc_400D1C
        mov edi, 100000h

loc_400CAB:             ; CODE XREF: sub_400B14+1FBj
                    ; sub_400B14+206j
        push    edi     ; TotalBytes
        xor eax, eax
        push    eax
        push    eax     ; SkipBytes
        push    [ebp+var_28]
        or  eax, 0FFFFFFFFh
        push    eax     ; HighAddress
        push    [ebp+LowAddress.HighPart]
        push    [ebp+LowAddress.LowPart] ; LowAddress
        call    MmAllocatePagesForMdl
        mov ecx, [esi+38h]
        mov edx, [ebp+DriverObject]
        mov [ecx+edx*4], eax
        mov eax, [esi+38h]
        mov ecx, edx
        mov eax, [eax+ecx*4]
        cmp eax, ebx
        jz  short loc_400CF8
        cmp [eax+14h], edi
        jnb short loc_400D13
        cmp eax, ebx
        jz  short loc_400CF8
        push    eax     ; MemoryDescriptorList
        call    MmFreePagesFromMdl
        mov eax, [esi+38h]
        mov ecx, [ebp+DriverObject]
        push    ebx     ; Tag
        push    dword ptr [eax+ecx*4] ; P
        call    ExFreePoolWithTag

loc_400CF8:             ; CODE XREF: sub_400B14+1C2j
                    ; sub_400B14+1CBj
        mov eax, [ebp+LowAddress.LowPart]
        mov ecx, [ebp+LowAddress.HighPart]
        shrd    eax, ecx, 1
        shr ecx, 1
        cmp eax, 1000000h
        mov [ebp+LowAddress.LowPart], eax
        mov [ebp+LowAddress.HighPart], ecx
        jnb short loc_400CAB
        jmp short loc_400D1C
; ---------------------------------------------------------------------------

loc_400D13:             ; CODE XREF: sub_400B14+1C7j
        inc ecx
        cmp ecx, [esi+3Ch]
        mov [ebp+DriverObject], ecx
        jb  short loc_400CAB

loc_400D1C:             ; CODE XREF: sub_400B14+190j
                    ; sub_400B14+1FDj
        mov eax, [ebp+DriverObject]
        cmp eax, [esi+3Ch]
        jb  loc_400C03
        mov eax, [esi+38h]
        mov eax, [eax]
        push    20h     ; Priority
        push    ebx     ; BugCheckOnFailure
        push    ebx     ; BaseAddress
        push    1       ; CacheType
        push    ebx     ; AccessMode
        push    eax     ; MemoryDescriptorList
        mov [esi+34h], eax
        call    MmMapLockedPagesSpecifyCache
        cmp eax, ebx
        mov [esi+30h], eax
        jz  loc_400C03
        push    [ebp+SourceDevice]
        call    sub_4015DC
        lea edi, [esi+80h]
        mov eax, [edi]
        cmp eax, ebx
        jz  short loc_400D67
        push    ebx     ; Tag
        push    eax     ; P
        call    ExFreePoolWithTag
        mov [edi], ebx

loc_400D67:             ; CODE XREF: sub_400B14+247j
        push    316D6152h   ; Tag
        push    2Eh     ; NumberOfBytes
        push    1       ; PoolType
        call    ExAllocatePoolWithTag
        cmp eax, ebx
        mov [esi+88h], eax
        jz  loc_400C03
        cmp [esi+78h], bx
        jz  short loc_400DDC
        push    offset word_400AFA ; SourceString
        lea eax, [ebp+SourceString]
        push    eax     ; DestinationString
        call    RtlInitUnicodeString
        mov word ptr [esi+86h], 2Eh
        mov ax, [ebp+SourceString.Length]
        lea edi, [esi+84h]
        mov [edi], ax
        lea eax, [ebp+SourceString]
        push    eax     ; SourceString
        push    edi     ; DestinationString
        call    RtlCopyUnicodeString
        lea eax, [esi+78h]
        push    eax     ; Source
        push    edi     ; Destination
        call    RtlAppendUnicodeStringToString
        lea eax, [ebp+DestinationString]
        push    eax     ; DeviceName
        push    edi     ; SymbolicLinkName
        call    IoCreateSymbolicLink
        mov edi, eax
        cmp edi, ebx
        jl  short loc_400DF7
        or  dword ptr [esi+28h], 1
        jmp short loc_400DDF
; ---------------------------------------------------------------------------

loc_400DDC:             ; CODE XREF: sub_400B14+274j
        mov edi, [ebp+var_10]

loc_400DDF:             ; CODE XREF: sub_400B14+2C6j
        push    [ebp+TargetDevice] ; TargetDevice
        push    [ebp+SourceDevice] ; SourceDevice
        call    IoAttachDeviceToDeviceStack
        cmp eax, ebx
        mov [esi+4], eax
        jnz short loc_400E01
        mov edi, 0C000000Eh

loc_400DF7:             ; CODE XREF: sub_400B14+F4j
                    ; sub_400B14+2C0j
        push    [ebp+SourceDevice]
        call    sub_4009C8
        jmp short loc_400E12
; ---------------------------------------------------------------------------

loc_400E01:             ; CODE XREF: sub_400B14+2DCj
        mov eax, [ebp+var_14]
        mov dword ptr [eax+8], 1
        mov eax, [ebp+SourceDevice]
        and byte ptr [eax+1Ch], 7Fh

loc_400E12:             ; CODE XREF: sub_400B14+2EBj
        mov eax, edi

loc_400E14:             ; CODE XREF: sub_400B14+EAj
                    ; sub_400B14+FEj
        pop edi
        pop ebx

loc_400E16:             ; CODE XREF: sub_400B14+28j
        pop esi
        leave
        retn    8
sub_400B14  endp

; ---------------------------------------------------------------------------
        align 4
; char aDWorkRdPnp_c[]
aDWorkRdPnp_c   db 'd:\work\rd\pnp.c',0 ; DATA XREF: sub_400E2E+1Fo
        align 2

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame
public sub_400E2E
; int __stdcall sub_400E2E(int, PVOID Irp)
sub_400E2E  proc near       ; DATA XREF: DriverEntry+97o

Event       = dword ptr -18h;_KEVENT ptr -18h
RemoveLock  = dword ptr -8
var_4       = dword ptr -4
arg_0       = dword ptr  8
Irp     = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        sub esp, 18h
        push    ebx
        mov ebx, [ebp+Irp]
        mov eax, [ebx+60h]
        push    esi
        push    edi
        push    18h     ; RemlockSize
        mov [ebp+Irp], eax
        mov eax, [ebp+arg_0]
        mov esi, [eax+28h]
        push    181h        ; Line
        push    offset aDWorkRdPnp_c ; "d:\\work\\rd\\pnp.c"
        lea eax, [esi+10h]
        push    ebx     ; Tag
        push    eax     ; RemoveLock
        mov [ebp+var_4], esi
        mov [ebp+RemoveLock], eax
        call    IoAcquireRemoveLockEx
        mov edi, eax
        xor eax, eax
        cmp edi, eax
        jge short loc_400E80
        xor dl, dl      ; PriorityBoost
        mov ecx, ebx    ; Irp
        mov [ebx+18h], edi
        mov [ebx+1Ch], eax
        call    IofCompleteRequest
        jmp loc_400FAB
; ---------------------------------------------------------------------------

loc_400E80:             ; CODE XREF: sub_400E2E+3Bj
        mov ecx, [ebp+Irp]
        movzx   ecx, byte ptr [ecx+1]
        push    4
        pop edx
        cmp ecx, edx
        jg  loc_400F5C
        jz  loc_400F57
        sub ecx, eax
        jz  short loc_400EE4
        dec ecx
        jz  short loc_400ED8
        dec ecx
        jz  short loc_400ECA
        dec ecx
        jnz loc_400F8B
        cmp dword ptr [esi+0Ch], 3
        jz  loc_400F78

loc_400EB3:             ; CODE XREF: sub_400E2E+144j
        xor edi, edi
        mov [ebx+18h], eax
        mov [ebx+1Ch], eax

loc_400EBB:             ; CODE XREF: sub_400E2E+124j
        xor dl, dl      ; PriorityBoost
        mov ecx, ebx    ; Irp
        call    IofCompleteRequest
        jmp loc_400F9F
; ---------------------------------------------------------------------------

loc_400ECA:             ; CODE XREF: sub_400E2E+72j
        push    ebx     ; Tag
        push    [ebp+arg_0] ; int
        call    sub_400A70
        jmp loc_400FAB
; ---------------------------------------------------------------------------

loc_400ED8:             ; CODE XREF: sub_400E2E+6Fj
        mov dword ptr [esi+0Ch], 3
        jmp loc_400F88
; ---------------------------------------------------------------------------

loc_400EE4:             ; CODE XREF: sub_400E2E+6Cj
        push    eax     ; State
        push    eax     ; Type
        lea eax, [ebp+Event]
        push    eax     ; Event
        call    KeInitializeEvent
        mov esi, [ebx+60h]
        lea eax, [esi-24h]
        push    7
        mov edi, eax
        pop ecx
        rep movsd
        mov esi, [ebp+var_4]
        mov byte ptr [eax+3], 0
        mov eax, [ebx+60h]
        sub eax, 24h
        lea ecx, [ebp+Event]
        mov dword ptr [eax+1Ch], offset loc_4009B2
        mov [eax+20h], ecx
        mov byte ptr [eax+3], 0E0h
        mov ecx, [esi+4]    ; DeviceObject
        mov edx, ebx    ; Irp
        call    IofCallDriver
        mov edi, eax
        cmp edi, 103h
        jnz short loc_400F40
        xor eax, eax
        push    eax     ; Timeout
        push    eax     ; Alertable
        push    eax     ; WaitMode
        push    eax     ; WaitReason
        lea eax, [ebp+Event]
        push    eax     ; Object
        call    KeWaitForSingleObject

loc_400F40:             ; CODE XREF: sub_400E2E+100j
        test    edi, edi
        jl  short loc_400F4B
        mov dword ptr [esi+0Ch], 1

loc_400F4B:             ; CODE XREF: sub_400E2E+114j
        and dword ptr [ebx+1Ch], 0
        mov [ebx+18h], edi
        jmp loc_400EBB
; ---------------------------------------------------------------------------

loc_400F57:             ; CODE XREF: sub_400E2E+64j
        mov [esi+0Ch], eax
        jmp short loc_400F88
; ---------------------------------------------------------------------------

loc_400F5C:             ; CODE XREF: sub_400E2E+5Ej
        sub ecx, 5
        jz  short loc_400F81
        dec ecx
        jz  short loc_400F6E
        sub ecx, 11h
        jnz short loc_400F8B
        mov [esi+0Ch], edx
        jmp short loc_400F88
; ---------------------------------------------------------------------------

loc_400F6E:             ; CODE XREF: sub_400E2E+134j
        cmp dword ptr [esi+0Ch], 2
        jnz loc_400EB3

loc_400F78:             ; CODE XREF: sub_400E2E+7Fj
        mov dword ptr [esi+0Ch], 1
        jmp short loc_400F88
; ---------------------------------------------------------------------------

loc_400F81:             ; CODE XREF: sub_400E2E+131j
        mov dword ptr [esi+0Ch], 2

loc_400F88:             ; CODE XREF: sub_400E2E+B1j
                    ; sub_400E2E+12Cj ...
        mov [ebx+18h], eax

loc_400F8B:             ; CODE XREF: sub_400E2E+75j
                    ; sub_400E2E+139j
        add dword ptr [ebx+60h], 24h
        inc byte ptr [ebx+23h]
        mov ecx, [esi+4]    ; DeviceObject
        mov edx, ebx    ; Irp
        call    IofCallDriver
        mov edi, eax

loc_400F9F:             ; CODE XREF: sub_400E2E+97j
        push    18h     ; RemlockSize
        push    ebx     ; Tag
        push    [ebp+RemoveLock] ; RemoveLock
        call    IoReleaseRemoveLockEx

loc_400FAB:             ; CODE XREF: sub_400E2E+4Dj
                    ; sub_400E2E+A5j
        mov eax, edi
        pop edi
        pop esi
        pop ebx
        leave
        retn    8
sub_400E2E  endp

; ---------------------------------------------------------------------------
;       align 80h
;_text      ends



; ===========================================================================

; Segment type: Pure data
; Segment permissions: Read
;_rdata     segment para public 'DATA' use32
;       assume cs:_rdata
        ;org 401090h
        db    0
        db    0
        db    0
        db    0
        db 0B7h ; ·
        db  2Dh ; -
        db 0D5h ; Х
        db  3Fh ; ?
        db    0
        db    0
        db    0
        db    0
        db    2
        db    0
        db    0
        db    0
        db  44h ; D
        db    0
        db    0
        db    0
        db 0F8h ; ш
        db  10h
        db    0
        db    0
        db 0F8h ; ш
        db  10h
        db    0
        db    0
aUnknown    db 'UNKNOWN',0          ; DATA XREF: .data:00401198o
aRemoved    db 'REMOVED',0          ; DATA XREF: .data:00401194o
aSurpriseremove db 'SURPRISEREMOVED',0  ; DATA XREF: .data:00401190o
aPendingremove  db 'PENDINGREMOVE',0    ; DATA XREF: .data:0040118Co
        db    0
        db    0
aPendingstop    db 'PENDINGSTOP',0      ; DATA XREF: .data:00401188o
aWorking    db 'WORKING',0          ; DATA XREF: .data:00401184o
aStopped    db 'STOPPED',0          ; DATA XREF: .data:00401180o

        db    0
        db    0
;_rdata     ends

; Section 3. (virtual address 00001180)
; Virtual size          : 0000001D (     29.)
; Section size in file      : 00000080 (    128.)
; Offset to raw data for section: 00001180
; Flags C8000040: Data Not pageable Readable Writable
; Alignment : default
; ===========================================================================

; Segment type: Pure data
; Segment permissions: Read/Write
;_data      segment para public 'DATA' use32
;       assume cs:_data
        ;org 401180h
        dd offset aStopped  ; "STOPPED"
        dd offset aWorking  ; "WORKING"
        dd offset aPendingstop  ; "PENDINGSTOP"
        dd offset aPendingremove ; "PENDINGREMOVE"
        dd offset aSurpriseremove ; "SURPRISEREMOVED"
        dd offset aRemoved  ; "REMOVED"
        dd offset aUnknown  ; "UNKNOWN"
byte_40119C db 0            ; DATA XREF: sub_400496:loc_40053Fr
                    ; sub_400496+151w ...
;       align 80h
;_data      ends

; Section 4. (virtual address 00001200)
; Virtual size          : 00000C1E (   3102.)
; Section size in file      : 00000C80 (   3200.)
; Offset to raw data for section: 00001200
; Flags 60000020: Text Executable Readable
; Alignment : default
; ===========================================================================

; Segment type: Pure code
; Segment permissions: Read/Execute
;PAGE       segment para public 'CODE' use32
;       assume cs:PAGE
;       ;org 401200h
;       assume es:nothing, ss:nothing, _data, fs:nothing, gs:nothing

public loc_401200
loc_401200:             ; DATA XREF: DriverEntry+77o
        mov ecx, [esp+8]
        mov eax, [ecx+60h]
        movzx   eax, byte ptr [eax]
        xor edx, edx
        push    esi
        xor esi, esi
        sub eax, edx
        mov [ecx+1Ch], edx
        jz  short loc_401226
        dec eax
        dec eax
        jz  short loc_401226
        mov eax, 0C0000002h
        mov esi, eax
        mov [ecx+18h], eax
        jmp short loc_401229
; ---------------------------------------------------------------------------

loc_401226:             ; CODE XREF: PAGE:00401214j
                    ; PAGE:00401218j
        mov [ecx+18h], edx

loc_401229:             ; CODE XREF: PAGE:00401224j
        xor dl, dl
        call    IofCompleteRequest
        mov eax, esi
        pop esi
        retn    8
; ---------------------------------------------------------------------------
        align 4
; const WCHAR aR
aR:                 ; DATA XREF: sub_401300+Co
        unicode 0, <R:>,0
        align 10h
dword_401240    dd 0            ; DATA XREF: sub_401300+32o
aParameters:                ; DATA XREF: sub_401300+F0o
        unicode 0, <Parameters>,0
        align 4
aDisksizem:             ; DATA XREF: sub_401300+100o
        unicode 0, <DiskSizeM>,0
aDisksizek:             ; DATA XREF: sub_401300+122o
        unicode 0, <DiskSizeK>,0
aRootdirentries:            ; DATA XREF: sub_401300+13Eo
        unicode 0, <RootDirEntries>,0
        align 4
aDriveletter:               ; DATA XREF: sub_401300+15Ao
        unicode 0, <DriveLetter>,0
aMediatype:             ; DATA XREF: sub_401300+17Ao
        unicode 0, <MediaType>,0
aSectorsperclus:            ; DATA XREF: sub_401300+1C5o
        unicode 0, <SectorsPerCluster>,0
aImage:                 ; DATA XREF: sub_401300+1D5o
        unicode 0, <Image>,0

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

sub_401300  proc near       ; CODE XREF: sub_400B14+82p

QueryTable  = _RTL_QUERY_REGISTRY_TABLE ptr -124h
var_104     = dword ptr -104h
var_100     = dword ptr -100h
var_FC      = dword ptr -0FCh
var_F8      = dword ptr -0F8h
var_F4      = dword ptr -0F4h
var_F0      = dword ptr -0F0h
var_E8      = dword ptr -0E8h
var_E4      = dword ptr -0E4h
var_E0      = dword ptr -0E0h
var_DC      = dword ptr -0DCh
var_D8      = dword ptr -0D8h
var_D4      = dword ptr -0D4h
var_CC      = dword ptr -0CCh
var_C8      = dword ptr -0C8h
var_C4      = dword ptr -0C4h
var_C0      = dword ptr -0C0h
var_BC      = dword ptr -0BCh
var_B8      = dword ptr -0B8h
var_B0      = dword ptr -0B0h
var_AC      = dword ptr -0ACh
var_A8      = dword ptr -0A8h
var_A4      = dword ptr -0A4h
var_A0      = dword ptr -0A0h
var_9C      = dword ptr -9Ch
var_94      = dword ptr -94h
var_90      = dword ptr -90h
var_8C      = dword ptr -8Ch
var_88      = dword ptr -88h
var_84      = dword ptr -84h
var_80      = dword ptr -80h
var_78      = dword ptr -78h
var_74      = dword ptr -74h
var_70      = dword ptr -70h
var_6C      = dword ptr -6Ch
var_68      = dword ptr -68h
var_64      = dword ptr -64h
var_5C      = dword ptr -5Ch
var_58      = dword ptr -58h
var_54      = dword ptr -54h
var_50      = dword ptr -50h
var_4C      = dword ptr -4Ch
var_48      = dword ptr -48h
var_28      = dword ptr -28h
var_24      = dword ptr -24h
var_20      = dword ptr -20h
var_18      = dword ptr -18h
var_14      = dword ptr -14h
var_10      = dword ptr -10h
DestinationString= UNICODE_STRING ptr -0Ch
var_4       = dword ptr -4
arg_0       = dword ptr  8
arg_4       = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        sub esp, 124h
        push    ebx
        push    esi
        push    edi
        push    offset aR   ; "R:"
        lea eax, [ebp+DestinationString]
        xor esi, esi
        push    eax     ; DestinationString
        mov [ebp+var_24], 8
        mov [ebp+var_20], esi
        mov [ebp+var_18], 2
        mov [ebp+var_14], 200h
        mov [ebp+var_10], esi
        mov [ebp+var_4], offset dword_401240
        call    RtlInitUnicodeString
        push    3Fh
        pop ecx
        push    316D6152h   ; Tag
        push    10000h      ; NumberOfBytes
        xor eax, eax
        lea edi, [ebp+QueryTable]
        push    1       ; PoolType
        rep stosd
        call    ExAllocatePoolWithTag
        mov ebx, [ebp+arg_4]
        mov edi, eax
        xor eax, eax
        mov [ebx+20h], edi
        mov ecx, 4000h
        rep stosd
        mov eax, [ebx+20h]
        mov dword ptr [eax], 0FFFF0000h
        lea eax, [ebp+var_24]
        mov [ebp+var_F4], eax
        lea eax, [ebx+4]
        mov [ebp+var_E0], eax
        lea eax, [ebp+var_20]
        mov [ebp+var_D8], eax
        lea eax, [ebx+10h]
        mov [ebp+var_C4], eax
        lea eax, [ebp+var_14]
        mov [ebp+var_BC], eax
        lea eax, [ebx+18h]
        mov [ebp+var_A8], eax
        mov eax, [ebp+DestinationString.Buffer]
        push    20h
        pop edi
        mov [ebp+var_A0], eax
        lea eax, [ebx+0Ch]
        push    4
        mov [ebp+QueryTable.EntryContext], esi
        mov [ebp+QueryTable.DefaultType], esi
        mov [ebp+QueryTable.DefaultData], esi
        mov [ebp+QueryTable.DefaultLength], esi
        pop esi
        mov [ebp+arg_4], eax
        mov [ebp+var_8C], eax
        xor ecx, ecx
        lea eax, [ebp+var_18]
        mov [ebp+QueryTable.Flags], 1
        mov [ebp+QueryTable.Name], offset aParameters ; "Parameters"
        mov [ebp+var_104], edi
        mov [ebp+var_100], offset aDisksizem ; "DiskSizeM"
        mov [ebp+var_FC], ebx
        mov [ebp+var_F8], esi
        mov [ebp+var_F0], esi
        mov [ebp+var_E8], edi
        mov [ebp+var_E4], offset aDisksizek ; "DiskSizeK"
        mov [ebp+var_DC], esi
        mov [ebp+var_D4], esi
        mov [ebp+var_CC], edi
        mov [ebp+var_C8], offset aRootdirentries ; "RootDirEntries"
        mov [ebp+var_C0], esi
        mov [ebp+var_B8], esi
        mov [ebp+var_B0], edi
        mov [ebp+var_AC], offset aDriveletter ; "DriveLetter"
        mov [ebp+var_A4], 1
        mov [ebp+var_9C], ecx
        mov [ebp+var_94], edi
        mov [ebp+var_90], offset aMediatype ; "MediaType"
        mov [ebp+var_88], esi
        mov [ebp+var_84], eax
        lea eax, [ebx+14h]
        mov [ebp+var_28], eax
        mov [ebp+var_70], eax
        lea eax, [ebp+var_10]
        mov [ebp+var_68], eax
        mov eax, [ebx+20h]
        mov [ebp+var_54], eax
        mov eax, [ebp+var_4]
        push    ecx     ; Environment
        mov [ebp+var_4C], eax
        push    ecx     ; Context
        lea eax, [ebp+QueryTable]
        push    eax     ; QueryTable
        mov eax, [ebp+arg_0]
        push    dword ptr [eax+4] ; Path
        mov [ebp+var_80], esi
        push    80000000h   ; RelativeTo
        mov [ebp+var_78], edi
        mov [ebp+var_74], offset aSectorsperclus ; "SectorsPerCluster"
        mov [ebp+var_6C], esi
        mov [ebp+var_64], esi
        mov [ebp+var_5C], edi
        mov [ebp+var_58], offset aImage ; "Image"
        mov [ebp+var_50], 3
        mov [ebp+var_48], esi
        call    RtlQueryRegistryValues
        test    eax, eax
        jge short loc_40150D
        mov eax, [ebp+var_24]
        and dword ptr [ebx+4], 0
        mov [ebx], eax
        mov eax, [ebp+var_14]
        mov [ebx+10h], eax
        lea eax, [ebp+DestinationString]
        push    eax     ; SourceString
        lea eax, [ebx+18h]
        push    eax     ; DestinationString
        call    RtlCopyUnicodeString

loc_40150D:             ; CODE XREF: sub_401300+1EEj
        mov eax, [ebx+4]
        test    eax, eax
        jnz short loc_40151E
        mov eax, [ebx]
        shl eax, 0Ah
        mov [ebx+4], eax
        jmp short loc_401528
; ---------------------------------------------------------------------------

loc_40151E:             ; CODE XREF: sub_401300+212j
        add eax, 3FFh
        shr eax, 0Ah
        mov [ebx], eax

loc_401528:             ; CODE XREF: sub_401300+21Cj
        mov eax, [ebx]
        mov [ebx+8], eax
        mov eax, [ebp+arg_4]
        cmp dword ptr [eax], 0
        jnz short loc_40153A
        mov ecx, [ebp+var_18]
        mov [eax], ecx

loc_40153A:             ; CODE XREF: sub_401300+233j
        mov ecx, [ebp+var_28]
        mov eax, [ecx]
        cmp eax, 10h
        ja  short loc_401558
        jz  short loc_401568
        test    eax, eax
        jbe short loc_401565
        cmp eax, 2
        jbe short loc_401568
        cmp eax, esi
        jz  short loc_401568
        cmp eax, 8
        jmp short loc_401563
; ---------------------------------------------------------------------------

loc_401558:             ; CODE XREF: sub_401300+242j
        sub eax, edi
        jz  short loc_401568
        sub eax, edi
        jz  short loc_401568
        sub eax, 40h

loc_401563:             ; CODE XREF: sub_401300+256j
        jz  short loc_401568

loc_401565:             ; CODE XREF: sub_401300+248j
        and dword ptr [ecx], 0

loc_401568:             ; CODE XREF: sub_401300+244j
                    ; sub_401300+24Dj ...
        pop edi
        pop esi
        pop ebx
        leave
        retn    8
sub_401300  endp

; ---------------------------------------------------------------------------
        align 10h
; char aMswin4_0[9]
aMswin4_0   db 'MSWIN4.0',0         ; DATA XREF: sub_4015DC+549o
                db    0
                db    0
                db    0

; char aRamdisk[12]
aRamdisk    db 'RamDisk    ',0      ; DATA XREF: sub_4015DC+5DBo
; char aFat1?[9]
aFat1?      db 'FAT1?   ',0         ; DATA XREF: sub_4015DC+5F3o
        align 4
; char aRamdisk_0[12]
aRamdisk_0  db 'RamDisk    ',0      ; DATA XREF: sub_4015DC+668o
; char aFat32[9]
aFat32      db 'FAT32   ',0         ; DATA XREF: sub_4015DC+684o
                db    0
                db    0
                db    0


;loc_4015AC:                ; DATA XREF: sub_4015DC+764o
aRamdisk_1      db 'RamDisk    ',0      ; DATA XREF: sub_4015DC+764o

                db    0
                db    0
                db    0

loc_4015B7:             ; DATA XREF: sub_4015DC+779o
aTemp           db 'TEMP       ',0      ; DATA XREF: sub_4015DC+779o
                db    0
                db    0
                db    0

loc_4015C4:             ; DATA XREF: sub_4015DC+7D7o
a_              db '.          ',0      ; DATA XREF: sub_4015DC+7D7o
                db    0
                db    0
                db    0

loc_4015CF:             ; DATA XREF: sub_4015DC+7ECo

a__             db '..         ',0      ; DATA XREF: sub_4015DC+7ECo
                db    0
                db    0
                db    0
                db    0
                db    0
                db    0

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

sub_4015DC  proc near       ; CODE XREF: sub_400B14+238p

var_24      = dword ptr -24h
var_1C      = dword ptr -1Ch
var_14      = dword ptr -14h
var_10      = dword ptr -10h
var_C       = dword ptr -0Ch
var_8       = dword ptr -8
var_4       = dword ptr -4
arg_0       = dword ptr  8

        push    ebp
        mov ebp, esp
        sub esp, 24h
        mov eax, [ebp+arg_0]
        push    ebx
        mov ebx, [eax+28h]
        push    esi
        push    edi
        xor edi, edi
        push    edi
        lea eax, [ebp+var_C]
        push    eax
        push    4000h
        push    edi
        xor eax, eax
        mov esi, ebx
        call    sub_400616
        mov ecx, [ebx+64h]
        cmp ecx, 4B0h
        mov esi, [ebp+var_C]
        push    2
        pop edx
        mov [ebx+4Ch], edi
        mov dword ptr [ebx+5Ch], 200h
        jz  short loc_401665
        cmp ecx, 5A0h
        jz  short loc_401659
        cmp ecx, 0B40h
        jz  short loc_401649
        mov eax, [ebx+60h]
        mov dword ptr [ebx+58h], 20h
        mov dword ptr [ebx+54h], 40h
        mov [ebx+48h], eax
        mov dword ptr [ebx+50h], 0Ch
        jmp short loc_40167D
; ---------------------------------------------------------------------------

loc_401649:             ; CODE XREF: sub_4015DC+4Ej
        mov dword ptr [ebx+58h], 24h
        mov dword ptr [ebx+50h], 3
        jmp short loc_401673
; ---------------------------------------------------------------------------

loc_401659:             ; CODE XREF: sub_4015DC+46j
        mov dword ptr [ebx+58h], 12h
        mov [ebx+50h], edx
        jmp short loc_401673
; ---------------------------------------------------------------------------

loc_401665:             ; CODE XREF: sub_4015DC+3Ej
        mov dword ptr [ebx+58h], 0Fh
        mov dword ptr [ebx+50h], 1

loc_401673:             ; CODE XREF: sub_4015DC+7Bj
                    ; sub_4015DC+87j
        mov [ebx+54h], edx
        mov dword ptr [ebx+48h], 50h

loc_40167D:             ; CODE XREF: sub_4015DC+6Bj
        mov eax, [ebx+80h]
        cmp eax, edi
        jz  loc_401903
        mov edi, [eax]
        test    edi, edi
        jz  loc_401903
        cmp edi, ecx
        jnz loc_401DF3
        mov ecx, [eax+4]
        cmp ecx, 10000h
        ja  loc_401DF3
        and [ebp+var_4], 0
        lea edi, [eax+8]
        lea eax, [ecx+edi-8]
        cmp edi, eax
        mov [ebp+var_14], eax
        mov [ebp+var_8], esi
        mov [ebp+arg_0], 4000h
        jnb loc_401DF3
        jmp short loc_4016D1
; ---------------------------------------------------------------------------

loc_4016CE:             ; CODE XREF: sub_4015DC+24Cj
        mov eax, [ebp+var_14]

loc_4016D1:             ; CODE XREF: sub_4015DC+F0j
        movzx   esi, byte ptr [edi]
        inc edi
        cmp esi, 80h
        jnb loc_401781
        mov ecx, esi
        and ecx, 40h
        mov [ebp+var_10], ecx
        jz  short loc_4016F9
        mov ecx, esi
        shr ecx, 4
        sub ecx, 3
        mov [ebp+var_10], ecx
        and esi, 0Fh

loc_4016F9:             ; CODE XREF: sub_4015DC+10Dj
        inc esi
        lea ecx, [esi+edi]
        cmp ecx, eax
        jbe short loc_40174B

loc_401701:             ; CODE XREF: sub_4015DC+16Dj
                    ; sub_4015DC+199j ...
        push    0
        lea eax, [ebp+var_C]
        push    eax
        push    4000h
        push    0
        xor eax, eax
        mov esi, ebx
        call    sub_400616
        mov edi, [ebp+var_C]
        mov ecx, 80h
        xor eax, eax
        rep stosd
        jmp loc_401DF3
; ---------------------------------------------------------------------------

loc_401728:             ; CODE XREF: sub_4015DC+171j
        xor eax, eax
        mov al, [edi]
        dec esi
        push    eax
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        inc edi
        test    eax, eax
        jnz short loc_401701

loc_40174B:             ; CODE XREF: sub_4015DC+123j
        test    esi, esi
        jnz short loc_401728
        cmp [ebp+var_10], esi
        jz  loc_401825

loc_401758:             ; CODE XREF: sub_4015DC+19Ej
        dec [ebp+var_10]
        push    esi
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    esi
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        test    eax, eax
        jnz short loc_401701
        cmp [ebp+var_10], esi
        jnz short loc_401758
        jmp loc_401825
; ---------------------------------------------------------------------------

loc_401781:             ; CODE XREF: sub_4015DC+FFj
        mov edx, esi
        and esi, 3Fh
        mov ecx, esi
        and edx, 40h
        sub ecx, 3Ch
        jz  short loc_4017E1
        dec ecx
        jz  short loc_4017CB
        dec ecx
        jz  short loc_4017AB
        dec ecx
        jz  short loc_40179C
        inc esi
        jmp short loc_4017F4
; ---------------------------------------------------------------------------

loc_40179C:             ; CODE XREF: sub_4015DC+1BBj
        lea ecx, [edi+4]
        cmp ecx, eax
        ja  loc_401701
        mov esi, [edi]
        jmp short loc_4017F2
; ---------------------------------------------------------------------------

loc_4017AB:             ; CODE XREF: sub_4015DC+1B8j
        lea ecx, [edi+3]
        cmp ecx, eax
        ja  loc_401701
        movzx   esi, word ptr [edi]
        inc edi
        inc edi
        movzx   eax, byte ptr [edi]
        shl eax, 10h
        lea esi, [esi+eax+1013Dh]
        inc edi
        jmp short loc_4017F4
; ---------------------------------------------------------------------------

loc_4017CB:             ; CODE XREF: sub_4015DC+1B5j
        lea ecx, [edi+2]
        cmp ecx, eax
        ja  loc_401701
        movzx   esi, word ptr [edi]
        add esi, 13Dh
        jmp short loc_4017F2
; ---------------------------------------------------------------------------

loc_4017E1:             ; CODE XREF: sub_4015DC+1B2j
        lea ecx, [edi+1]
        cmp ecx, eax
        ja  loc_401701
        movzx   esi, byte ptr [edi]
        add esi, 3Dh

loc_4017F2:             ; CODE XREF: sub_4015DC+1CDj
                    ; sub_4015DC+203j
        mov edi, ecx

loc_4017F4:             ; CODE XREF: sub_4015DC+1BEj
                    ; sub_4015DC+1EDj
        test    edx, edx
        jnz loc_4018C9
        cmp byte ptr [ebp+var_1C+3], dl
        jnz loc_4018FA
        push    edx
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    esi
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701

loc_401825:             ; CODE XREF: sub_4015DC+176j
                    ; sub_4015DC+1A0j ...
        cmp edi, [ebp+var_14]
        jb  loc_4016CE
        jmp loc_401DF3
; ---------------------------------------------------------------------------

loc_401833:             ; CODE XREF: sub_4015DC+2EFj
        mov eax, [ebp+var_1C]
        add eax, 20002h
        push    eax
        mov [ebp+var_24], eax
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        dec esi
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701
        push    [ebp+var_24+1]
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701
        push    [ebp+var_24+2]
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701
        push    [ebp+var_24+3]
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701

loc_4018C9:             ; CODE XREF: sub_4015DC+21Aj
        test    esi, esi
        jnz loc_401833
        jmp loc_401825
; ---------------------------------------------------------------------------

loc_4018D6:             ; CODE XREF: sub_4015DC+320j
        push    [ebp+var_1C+3]
        lea eax, [ebp+var_1C]
        push    eax
        lea eax, [ebp+arg_0]
        push    eax
        lea eax, [ebp+var_8]
        push    eax
        push    0
        lea eax, [ebp+var_4]
        push    eax
        push    ebx
        dec esi
        call    sub_4008A2
        test    eax, eax
        jnz loc_401701

loc_4018FA:             ; CODE XREF: sub_4015DC+223j
        test    esi, esi
        jnz short loc_4018D6
        jmp loc_401825
; ---------------------------------------------------------------------------

loc_401903:             ; CODE XREF: sub_4015DC+A9j
                    ; sub_4015DC+B3j
        mov eax, [ebx+70h]
        test    eax, eax
        mov [ebp+var_C], eax
        jnz short loc_401914
        mov [ebp+var_C], 200h

loc_401914:             ; CODE XREF: sub_4015DC+32Fj
        mov eax, [ebp+var_C]
        test    al, 0Fh
        jz  short loc_401924
        add eax, 0Fh
        and eax, 0FFFFFFF0h
        mov [ebp+var_C], eax

loc_401924:             ; CODE XREF: sub_4015DC+33Dj
        mov eax, [ebp+var_C]
        shr eax, 4
        lea edi, [ecx+ecx]
        sub edi, eax
        mov eax, [ebx+74h]
        sub edi, 101h
        test    eax, eax
        mov [ebp+var_10], edi
        jz  short loc_401992
        mov [ebp+arg_0], eax
        xor edx, edx
        mov eax, edi
        div [ebp+arg_0]
        cmp eax, 0FFF6h
        jbe short loc_401957

loc_401950:             ; CODE XREF: sub_4015DC+3EBj
        mov byte_40119C, 0Bh

loc_401957:             ; CODE XREF: sub_4015DC+372j
                    ; sub_4015DC+3C5j ...
        cmp byte_40119C, 0Bh
        jnz loc_401A77
        mov eax, [ebx+64h]
        and [ebp+var_C], 0
        cmp dword ptr [ebx+74h], 0
        lea eax, [eax+eax-7FE2h]
        mov [ebp+var_10], eax
        jnz loc_401A24
        cmp eax, 3FFFEh
        ja  short loc_4019D2
        mov [ebp+arg_0], 1
        jmp loc_401A24
; ---------------------------------------------------------------------------

loc_401992:             ; CODE XREF: sub_4015DC+361j
        cmp edi, 0FFF6h
        ja  short loc_4019A3
        mov [ebp+arg_0], 1
        jmp short loc_401957
; ---------------------------------------------------------------------------

loc_4019A3:             ; CODE XREF: sub_4015DC+3BCj
        cmp edi, 1FFECh
        ja  short loc_4019B0
        mov [ebp+arg_0], edx
        jmp short loc_401957
; ---------------------------------------------------------------------------

loc_4019B0:             ; CODE XREF: sub_4015DC+3CDj
        cmp edi, 3FFD8h
        ja  short loc_4019C1
        mov [ebp+arg_0], 4
        jmp short loc_401957
; ---------------------------------------------------------------------------

loc_4019C1:             ; CODE XREF: sub_4015DC+3DAj
        cmp edi, 7FFB0h
        ja  short loc_401950
        mov [ebp+arg_0], 8
        jmp short loc_401957
; ---------------------------------------------------------------------------

loc_4019D2:             ; CODE XREF: sub_4015DC+3A8j
        cmp eax, 7FFFCh
        ja  short loc_4019E2
        mov [ebp+arg_0], 2
        jmp short loc_401A24
; ---------------------------------------------------------------------------

loc_4019E2:             ; CODE XREF: sub_4015DC+3FBj
        cmp eax, 0FFFF8h
        ja  short loc_4019F2
        mov [ebp+arg_0], 4
        jmp short loc_401A24
; ---------------------------------------------------------------------------

loc_4019F2:             ; CODE XREF: sub_4015DC+40Bj
        cmp eax, 1FDFFF0h
        ja  short loc_401A02
        mov [ebp+arg_0], 8
        jmp short loc_401A24
; ---------------------------------------------------------------------------

loc_401A02:             ; CODE XREF: sub_4015DC+41Bj
        cmp eax, 3FBFFE0h
        ja  short loc_401A12
        mov [ebp+arg_0], 10h
        jmp short loc_401A24
; ---------------------------------------------------------------------------

loc_401A12:             ; CODE XREF: sub_4015DC+42Bj
        mov ecx, 7F7FFC0h
        cmp ecx, eax
        sbb ecx, ecx
        and ecx, 20h
        add ecx, 20h
        mov [ebp+arg_0], ecx

loc_401A24:             ; CODE XREF: sub_4015DC+39Dj
                    ; sub_4015DC+3B1j ...
        mov ecx, [ebp+arg_0]
        imul    ecx, 3FBFFEh
        cmp eax, ecx
        jbe short loc_401A36
        mov eax, ecx
        mov [ebp+var_10], eax

loc_401A36:             ; CODE XREF: sub_4015DC+453j
        xor edx, edx
        div [ebp+arg_0]
        lea eax, 207h[eax*4]
        shr eax, 9
        mov [ebp+var_8], eax

loc_401A48:             ; CODE XREF: sub_4015DC+494j
        mov ecx, [ebp+var_8]
        mov eax, [ebp+var_10]
        sub eax, ecx
        add eax, 7FE0h
        xor edx, edx
        div [ebp+arg_0]
        mov [ebp+var_4], ecx
        mov edi, eax
        inc edi
        inc edi
        lea eax, 1FFh[edi*4]
        shr eax, 9
        cmp ecx, eax
        mov [ebp+var_8], eax
        jnz short loc_401A48
        jmp loc_401B1D
; ---------------------------------------------------------------------------

loc_401A77:             ; CODE XREF: sub_4015DC+382j
        lea eax, [edi+0F4h]
        xor edx, edx
        mov [ebp+var_14], eax
        div [ebp+arg_0]
        xor edx, edx
        cmp eax, 0FF6h
        ja  short loc_401ADA
        mov eax, [ebp+var_14]
        div [ebp+arg_0]
        mov byte_40119C, 1
        lea eax, [eax+eax*2+7]
        shr eax, 1
        add eax, 1FFh
        shr eax, 9
        mov [ebp+var_8], eax

loc_401AAC:             ; CODE XREF: sub_4015DC+4FAj
        mov ecx, [ebp+var_8]
        mov eax, [ebp+var_14]
        sub eax, ecx
        add eax, 0Ch
        xor edx, edx
        div [ebp+arg_0]
        mov [ebp+var_4], ecx
        mov edi, eax
        inc edi
        inc edi
        lea eax, [edi+edi*2+1]
        shr eax, 1
        add eax, 1FFh
        shr eax, 9
        cmp ecx, eax
        mov [ebp+var_8], eax
        jnz short loc_401AAC
        jmp short loc_401B1D
; ---------------------------------------------------------------------------

loc_401ADA:             ; CODE XREF: sub_4015DC+4B0j
        mov eax, edi
        div [ebp+arg_0]
        mov byte_40119C, 4
        lea eax, [eax+eax+203h]
        shr eax, 9
        mov [ebp+var_8], eax

loc_401AF3:             ; CODE XREF: sub_4015DC+53Fj
        mov ecx, [ebp+var_8]
        mov eax, [ebp+var_10]
        sub eax, ecx
        add eax, 100h
        xor edx, edx
        div [ebp+arg_0]
        mov [ebp+var_4], ecx
        mov edi, eax
        inc edi
        inc edi
        lea eax, [edi+edi+1FFh]
        shr eax, 9
        cmp ecx, eax
        mov [ebp+var_8], eax
        jnz short loc_401AF3

loc_401B1D:             ; CODE XREF: sub_4015DC+496j
                    ; sub_4015DC+4FCj
        push    8       ; size_t
        mov byte ptr [esi], 0EBh
        lea eax, [esi+3]
        push    offset aMswin4_0 ; "MSWIN4.0"
        mov byte ptr [esi+1], 3Ch
        push    eax     ; char *
        mov byte ptr [esi+2], 90h
        call    strncpy
        mov ax, [ebx+5Ch]
        mov [esi+0Bh], ax
        mov byte ptr [esi+10h], 1
        mov ecx, [ebx+64h]
        lea eax, [esi+20h]
        shl ecx, 1
        mov [eax], ecx
        add esp, 0Ch
        mov byte ptr [esi+15h], 0F8h
        cmp dword ptr [eax], 10000h
        jnb short loc_401B6B
        mov cx, [eax]
        mov [esi+13h], cx
        xor ecx, ecx
        mov [eax], ecx
        jmp short loc_401B6D
; ---------------------------------------------------------------------------

loc_401B6B:             ; CODE XREF: sub_4015DC+580j
        xor ecx, ecx

loc_401B6D:             ; CODE XREF: sub_4015DC+58Dj
        mov ax, [ebx+58h]
        mov [esi+18h], ax
        mov ax, [ebx+54h]
        mov [esi+1Ah], ax
        cmp byte_40119C, 0Bh
        jz  short loc_401C01
        mov ax, word ptr [ebp+var_C]
        mov word ptr [esi+0Eh], 1
        mov [esi+11h], ax
        mov al, byte ptr [ebp+arg_0]
        mov [esi+0Dh], al
        mov ax, word ptr [ebp+var_8]
        mov [esi+16h], ax
        cmp dword ptr [ebx+6Ch], 4
        jz  short loc_401BAC
        mov byte ptr [esi+24h], 80h

loc_401BAC:             ; CODE XREF: sub_4015DC+5CAj
        mov edi, offset strncpy
        push    0Bh     ; size_t
        lea eax, [esi+2Bh]
        push    offset aRamdisk ; "RamDisk    "
        mov byte ptr [esi+26h], 29h
        push    eax     ; char *
        mov dword ptr [esi+27h], 12345678h
        call    edi ; strncpy
        push    8       ; size_t
        lea eax, [esi+36h]
        push    offset aFat1?   ; "FAT1?   "
        push    eax     ; char *
        call    edi ; strncpy
        add esp, 18h
        cmp byte_40119C, 4
        setz    al
        lea eax, 32h[eax*4]
        mov [esi+3Ah], al
        mov byte ptr [esi+1FEh], 55h
        mov byte ptr [esi+1FFh], 0AAh
        jmp loc_401CB2
; ---------------------------------------------------------------------------

loc_401C01:             ; CODE XREF: sub_4015DC+5A8j
        mov al, byte ptr [ebp+arg_0]
        mov edx, [ebp+var_8]
        mov [esi+0Dh], al
        push    2
        pop eax
        mov [esi+16h], cx
        mov [esi+0Eh], ax
        mov [esi+11h], cx
        mov [esi+24h], edx
        mov [esi+28h], cx
        mov byte ptr [esi+2Ah], 0
        mov byte ptr [esi+2Bh], 0
        mov [esi+2Ch], eax
        mov word ptr [esi+30h], 1
        mov [esi+32h], cx
        cmp dword ptr [ebx+6Ch], 4
        jz  short loc_401C3F
        mov byte ptr [esi+40h], 80h

loc_401C3F:             ; CODE XREF: sub_4015DC+65Dj
        push    0Bh     ; size_t
        lea eax, [esi+47h]
        push    offset aRamdisk_0 ; "RamDisk    "
        push    eax     ; char *
        mov byte ptr [esi+42h], 29h
        mov dword ptr [esi+43h], 12345678h
        call    strncpy
        push    8       ; size_t
        lea eax, [esi+52h]
        push    offset aFat32   ; "FAT32   "
        push    eax     ; char *
        call    strncpy
        mov byte ptr [esi+1FEh], 55h
        mov byte ptr [esi+1FFh], 0AAh
        add esp, 18h
        add edi, 0FFFFFFFCh
        mov dword ptr [esi+200h], 61417272h
        mov dword ptr [esi+3E4h], 41615252h
        mov [esi+3E8h], edi
        mov dword ptr [esi+3ECh], 3
        mov byte ptr [esi+3FEh], 55h
        mov byte ptr [esi+3FFh], 0AAh

loc_401CB2:             ; CODE XREF: sub_4015DC+620j
        movzx   eax, word ptr [esi+0Eh]
        mov cl, byte_40119C
        shl eax, 9
        add eax, esi
        cmp cl, 0Bh
        jnz short loc_401CF5
        mov cl, 0FFh
        mov byte ptr [eax+3], 0Fh
        mov [eax+4], cl
        mov [eax+5], cl
        mov [eax+6], cl
        mov byte ptr [eax+7], 0Fh
        mov [eax+8], cl
        mov [eax+9], cl
        mov [eax+0Ah], cl
        mov byte ptr [eax+0Bh], 0Fh
        mov [eax+0Ch], cl
        mov [eax+0Dh], cl
        mov [eax+0Eh], cl
        mov byte ptr [eax+0Fh], 0Fh
        jmp short loc_401D0B
; ---------------------------------------------------------------------------

loc_401CF5:             ; CODE XREF: sub_4015DC+6E8j
        cmp cl, 4
        mov cl, 0FFh
        mov [eax+3], cl
        jnz short loc_401D07
        mov [eax+4], cl
        mov [eax+5], cl
        jmp short loc_401D0B
; ---------------------------------------------------------------------------

loc_401D07:             ; CODE XREF: sub_4015DC+721j
        mov byte ptr [eax+4], 0Fh

loc_401D0B:             ; CODE XREF: sub_4015DC+717j
                    ; sub_4015DC+729j
        mov [eax+1], cl
        mov [eax+2], cl
        mov byte ptr [eax], 0F8h
        xor eax, eax
        cmp byte_40119C, 0Bh
        push    0
        setz    al
        lea ecx, [ebp+var_8]
        push    ecx
        push    200h
        push    0
        mov esi, ebx
        inc eax
        add eax, [ebp+var_8]
        mov [ebp+var_10], eax
        call    sub_400616
        mov eax, [ebp+var_8]
        mov edi, eax
                mov     esi, offset aRamdisk_1 ; "RamDisk    "
        movsd
        movsd
        movsd
        mov byte ptr [eax+0Bh], 8
        mov word ptr [eax+18h], 2E21h
        add eax, 20h
        mov esi, offset aTemp
        mov edi, eax
        movsd
        movsd
        movsd
        xor ecx, ecx
        mov byte ptr [eax+0Bh], 10h
        cmp byte_40119C, 0Bh
        mov [ebp+var_8], eax
        setz    cl
        inc ecx
        inc ecx
        mov [eax+1Ah], cx
        mov word ptr [eax+18h], 2E21h
        cmp byte_40119C, 0Bh
        jnz short loc_401D8F
        mov eax, [ebp+arg_0]
        shl eax, 9
        jmp short loc_401D95
; ---------------------------------------------------------------------------

loc_401D8F:             ; CODE XREF: sub_4015DC+7A9j
        mov eax, [ebp+var_C]
        shr eax, 4

loc_401D95:             ; CODE XREF: sub_4015DC+7B1j
        push    0
        lea ecx, [ebp+var_8]
        push    ecx
        mov ecx, [ebp+var_10]
        push    200h
        push    0
        add eax, ecx
        mov esi, ebx
        call    sub_400616
        mov eax, [ebp+var_8]
        mov edi, eax
        mov esi, offset loc_4015C4
        movsd
        movsd
        movsd
        mov byte ptr [eax+0Bh], 10h
        xor ecx, ecx
        cmp byte_40119C, 0Bh
        mov esi, offset loc_4015CF
        setz    cl
        add eax, 20h
        mov edi, eax
        inc ecx
        inc ecx
        mov [eax-6], cx
        mov word ptr [eax-8], 2E21h
        movsd
        movsd
        movsd
        mov byte ptr [eax+0Bh], 10h
        and word ptr [eax+1Ah], 0
        mov word ptr [eax+18h], 2E21h

loc_401DF3:             ; CODE XREF: sub_4015DC+BBj
                    ; sub_4015DC+CAj ...
        pop edi
        pop esi
        xor eax, eax
        pop ebx
        leave
        retn    4
sub_4015DC  endp


; =============== S U B R O U T I N E =======================================

public sub_401DFC
; int __stdcall sub_401DFC(PDRIVER_OBJECT DriverObject)
sub_401DFC  proc near       ; DATA XREF: DriverEntry+BCo

DriverObject    = dword ptr  4

        push    offset DriverEntry ; ClientIdentificationAddress
        push    [esp+4+DriverObject] ; DriverObject
        call    IoGetDriverObjectExtension
        mov eax, [eax+4]
        test    eax, eax
        jz  short locret_401E1B
        push    0       ; Tag
        push    eax     ; P
        call    ExFreePoolWithTag

locret_401E1B:              ; CODE XREF: sub_401DFC+14j
        retn    4
sub_401DFC  endp

; ---------------------------------------------------------------------------
;       align 80h
;PAGE       ends

; Section 5. (virtual address 00001E80)
; Virtual size          : 000004B4 (   1204.)
; Section size in file      : 00000500 (   1280.)
; Offset to raw data for section: 00001E80
; Flags E2000020: Text Discardable Executable Readable Writable
; Alignment : default
; ===========================================================================

; Segment type: Pure code
; Segment permissions: Read/Write/Execute
;INIT       segment para public 'CODE' use32
;       assume cs:INIT
        ;org 401E80h
;       assume es:nothing, ss:nothing, _data, fs:nothing, gs:nothing

; =============== S U B R O U T I N E =======================================

; Attributes: bp-based frame

; NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
        public DriverEntryx
DriverEntryx    proc near       ; DATA XREF: sub_400A70+38o
                    ; sub_400B14+7o ...

DriverObjectExtension= dword ptr  8
SourceString    = dword ptr  0Ch

        push    ebp
        mov ebp, esp
        push    esi
        mov esi, [ebp+DriverObjectExtension]
        lea eax, [ebp+DriverObjectExtension]
        push    eax     ; DriverObjectExtension
        push    0Ch     ; DriverObjectExtensionSize
        push    offset DriverEntry ; ClientIdentificationAddress
        push    esi     ; DriverObject
        call    IoAllocateDriverObjectExtension
        test    eax, eax
        jl  loc_401F46
        mov ecx, [ebp+DriverObjectExtension]
        push    edi
        mov edi, [ebp+SourceString]
        mov ax, [edi]
        mov [ecx], ax
        mov ax, [edi+2]
        mov ecx, [ebp+DriverObjectExtension]
        add ax, 2
        mov [ecx+2], ax
        mov eax, [ebp+DriverObjectExtension]
        movzx   eax, word ptr [eax+2]
        push    '1maR'          ; Tag
        push    eax     ; NumberOfBytes
        push    1       ; PoolType
        call    ExAllocatePoolWithTag
        mov ecx, [ebp+DriverObjectExtension]
        mov [ecx+4], eax
        mov eax, [ebp+DriverObjectExtension]
        cmp dword ptr [eax+4], 0
        jnz short loc_401EE8
        mov eax, 0C000009Ah
        jmp short loc_401F45
; ---------------------------------------------------------------------------

loc_401EE8:             ; CODE XREF: DriverEntry+5Fj
        push    edi     ; SourceString
        push    eax     ; DestinationString
        call    RtlCopyUnicodeString
        mov eax, [ebp+DriverObjectExtension]
        and dword ptr [eax+8], 0
        mov eax, offset loc_401200
        mov [esi+38h], eax
        mov [esi+40h], eax
        mov eax, offset sub_4006C4
        mov [esi+44h], eax
        mov [esi+48h], eax
        mov eax, [esi+18h]
        mov dword ptr [esi+70h], offset sub_400496
        mov dword ptr [esi+0A4h], offset sub_400E2E
        mov dword ptr [esi+90h], offset loc_400944
        mov dword ptr [esi+94h], offset loc_400994
        mov dword ptr [eax+4], offset sub_400B14
        mov dword ptr [esi+34h], offset sub_401DFC
        xor eax, eax

loc_401F45:             ; CODE XREF: DriverEntry+66j
        pop edi

loc_401F46:             ; CODE XREF: DriverEntry+1Bj
        pop esi
        pop ebp
        retn    8
DriverEntryx    endp

; ---------------------------------------------------------------------------
;INIT       ends
ends


; Section 2. (virtual address 00001000)
; Virtual size          : 0000013C (    316.)
; Section size in file      : 00000180 (    384.)
; Offset to raw data for section: 00001000
; Flags 48000040: Data Not pageable Readable
; Alignment : default
;
; Imports from HAL.dll
;
; ===========================================================================

; Segment type: Externs
; _idata
; void __fastcall KfReleaseSpinLock(PKSPIN_LOCK SpinLock, KIRQL NewIrql)
        extrn KfReleaseSpinLock:proc  ; CODE XREF: sub_4006C4+1A1p
                    ; DATA XREF: sub_4006C4+1A1r ...
; KIRQL __fastcall KfAcquireSpinLock(PKSPIN_LOCK SpinLock)
        extrn KfAcquireSpinLock:proc  ; CODE XREF: sub_4006C4+EEp
                    ; DATA XREF: sub_4006C4+EEr

;
; Imports from ntoskrnl.exe
;
; NTSTATUS __stdcall IoAcquireRemoveLockEx(PIO_REMOVE_LOCK RemoveLock, PVOID Tag, PCSTR File, ULONG Line, ULONG RemlockSize)
        extrn IoAcquireRemoveLockEx:proc  ; CODE XREF: sub_400496+28p
                    ; sub_4006C4+43p ...
; PVOID __stdcall MmMapLockedPagesSpecifyCache(PMDL MemoryDescriptorList, KPROCESSOR_MODE AccessMode, MEMORY_CACHING_TYPE CacheType, PVOID BaseAddress, ULONG BugCheckOnFailure, MM_PAGE_PRIORITY Priority)
        extrn MmMapLockedPagesSpecifyCache:proc  ; CODE XREF: sub_400616+69p
                    ; sub_4006C4+C9p ...
; void __stdcall MmUnmapLockedPages(PVOID BaseAddress, PMDL MemoryDescriptorList)
        extrn MmUnmapLockedPages:proc  ; CODE XREF: sub_400616+50p
                    ; sub_4009C8+57p
                    ; DATA XREF: ...
; void *__cdecl memmove(void *, const void *, size_t)
        extrn memmove:proc  ; CODE XREF: sub_4006C4+13Ap
                    ; sub_4006C4+181p
                    ; DATA XREF: ...
; void __stdcall RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PCUNICODE_STRING SourceString)
        extrn RtlCopyUnicodeString:proc  ; CODE XREF: sub_400B14+2A0p
                    ; sub_401300+207p ...
; NTSTATUS __stdcall RtlQueryRegistryValues(ULONG RelativeTo, PCWSTR Path, PRTL_QUERY_REGISTRY_TABLE QueryTable, PVOID Context, PVOID Environment)
        extrn RtlQueryRegistryValues:proc  ; CODE XREF: sub_401300+1E6p
                    ; DATA XREF: sub_401300+1E6r
; PVOID __stdcall ExAllocatePoolWithTag(POOL_TYPE PoolType, SIZE_T NumberOfBytes, ULONG Tag)
        extrn ExAllocatePoolWithTag:proc  ; CODE XREF: sub_400B14+6Cp
                    ; sub_400B14+15Fp ...
; void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
        extrn RtlInitUnicodeString:proc  ; CODE XREF: sub_400B14+38p
                    ; sub_400B14+27Fp ...
; char *__cdecl strncpy(char *, const char *, size_t)
        extrn strncpy:proc  ; CODE XREF: sub_4015DC+557p
                    ; sub_4015DC+5ECp ...
; NTSTATUS __stdcall IoAllocateDriverObjectExtension(PDRIVER_OBJECT DriverObject, PVOID ClientIdentificationAddress, ULONG DriverObjectExtensionSize, PVOID *DriverObjectExtension)
        extrn IoAllocateDriverObjectExtension:proc  ; CODE XREF: DriverEntry+13p
                    ; DATA XREF: DriverEntry+13r
; void __stdcall ExFreePoolWithTag(PVOID P, ULONG Tag)
        extrn ExFreePoolWithTag:proc  ; CODE XREF: sub_4009C8+31p
                    ; sub_4009C8+3Fp ...
; PVOID __stdcall IoGetDriverObjectExtension(PDRIVER_OBJECT DriverObject, PVOID ClientIdentificationAddress)
        extrn IoGetDriverObjectExtension:proc  ; CODE XREF: sub_400A70+40p
                    ; sub_400B14+15p ...
; NTSTATUS __stdcall PoCallDriver(PDEVICE_OBJECT DeviceObject, PIRP Irp)
        extrn PoCallDriver:proc  ; CODE XREF: .text:00400989p
                    ; DATA XREF: .text:00400989r
; void __stdcall PoStartNextPowerIrp(PIRP Irp)
        extrn PoStartNextPowerIrp:proc  ; CODE XREF: .text:00400958p
                    ; .text:loc_400978p
                    ; DATA XREF: ...
; void __stdcall IoReleaseRemoveLockEx(PIO_REMOVE_LOCK RemoveLock, PVOID Tag, ULONG RemlockSize)
        extrn IoReleaseRemoveLockEx:proc  ; CODE XREF: sub_400496+171p
                    ; sub_4006C4+1CEp ...
; LONG __stdcall KeSetEvent(PRKEVENT Event, KPRIORITY Increment, BOOLEAN Wait)
        extrn KeSetEvent:proc   ; CODE XREF: .text:004009BAp
                    ; DATA XREF: .text:004009BAr
; void __stdcall IoDeleteDevice(PDEVICE_OBJECT DeviceObject)
        extrn IoDeleteDevice:proc  ; DATA XREF: sub_4009C8+A2r
; void __stdcall IoDetachDevice(PDEVICE_OBJECT TargetDevice)
        extrn IoDetachDevice:proc  ; CODE XREF: sub_4009C8+9Bp
                    ; DATA XREF: sub_4009C8+9Br
; void __stdcall MmFreePagesFromMdl(PMDL MemoryDescriptorList)
        extrn MmFreePagesFromMdl:proc  ; CODE XREF: sub_4009C8+75p
                    ; sub_400B14+1CEp
                    ; DATA XREF: ...
; NTSTATUS __stdcall IoDeleteSymbolicLink(PUNICODE_STRING SymbolicLinkName)
        extrn IoDeleteSymbolicLink:proc  ; CODE XREF: sub_4009C8+15p
                    ; DATA XREF: sub_4009C8+15r
; void __stdcall IoReleaseRemoveLockAndWaitEx(PIO_REMOVE_LOCK RemoveLock, PVOID Tag, ULONG RemlockSize)
        extrn IoReleaseRemoveLockAndWaitEx:proc  ; CODE XREF: sub_400A70+32p
                    ; DATA XREF: sub_400A70+32r
; PDEVICE_OBJECT __stdcall IoAttachDeviceToDeviceStack(PDEVICE_OBJECT SourceDevice, PDEVICE_OBJECT TargetDevice)
        extrn IoAttachDeviceToDeviceStack:proc  ; CODE XREF: sub_400B14+2D1p
                    ; DATA XREF: sub_400B14+2D1r
; NTSTATUS __stdcall IoCreateSymbolicLink(PUNICODE_STRING SymbolicLinkName, PUNICODE_STRING DeviceName)
        extrn IoCreateSymbolicLink:proc  ; CODE XREF: sub_400B14+2B6p
                    ; DATA XREF: sub_400B14+2B6r
; NTSTATUS __stdcall RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PCUNICODE_STRING Source)
        extrn RtlAppendUnicodeStringToString:proc  ; CODE XREF: sub_400B14+2ABp
                    ; DATA XREF: sub_400B14+2ABr
; PMDL __stdcall MmAllocatePagesForMdl(PHYSICAL_ADDRESS LowAddress, PHYSICAL_ADDRESS HighAddress, PHYSICAL_ADDRESS SkipBytes, SIZE_T TotalBytes)
        extrn MmAllocatePagesForMdl:proc  ; CODE XREF: sub_400B14+1A9p
                    ; DATA XREF: sub_400B14+1A9r
; void __stdcall KeInitializeSpinLock(PKSPIN_LOCK SpinLock)
        extrn KeInitializeSpinLock:proc  ; CODE XREF: sub_400B14+138p
                    ; DATA XREF: sub_400B14+138r
; void __stdcall IoInitializeRemoveLockEx(PIO_REMOVE_LOCK Lock, ULONG AllocateTag, ULONG MaxLockedMinutes, ULONG HighWatermark, ULONG RemlockSize)
        extrn IoInitializeRemoveLockEx:proc  ; CODE XREF: sub_400B14+120p
                    ; DATA XREF: sub_400B14+120r
; NTSTATUS __stdcall IoCreateDevice(PDRIVER_OBJECT DriverObject, ULONG DeviceExtensionSize, PUNICODE_STRING DeviceName, ULONG DeviceType, ULONG DeviceCharacteristics, BOOLEAN Exclusive, PDEVICE_OBJECT *DeviceObject)
        extrn IoCreateDevice:proc  ; CODE XREF: sub_400B14+D9p
                    ; DATA XREF: sub_400B14+D9r
; NTSTATUS __stdcall KeWaitForSingleObject(PVOID Object, KWAIT_REASON WaitReason, KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Timeout)
        extrn KeWaitForSingleObject:proc  ; CODE XREF: sub_400E2E+10Cp
                    ; DATA XREF: sub_400E2E+10Cr
; void __stdcall KeInitializeEvent(PRKEVENT Event, EVENT_TYPE Type, BOOLEAN State)
        extrn KeInitializeEvent:proc  ; CODE XREF: sub_400E2E+BCp
                    ; DATA XREF: sub_400E2E+BCr
; void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost)
        extrn IofCompleteRequest:proc  ; CODE XREF: sub_400496+40p
                    ; sub_400496+165p ...
; NTSTATUS __fastcall IofCallDriver(PDEVICE_OBJECT DeviceObject, PIRP Irp)
        extrn IofCallDriver:proc
 ; CODE XREF: .text:004009A9p
                    ; sub_400A70+1Ep ...




end