.text:
00017006
; void __stdcall FltPerformSynchronousIo(PFLT_CALLBACK_DATA CallbackData)
.text:
00017006
public _FltPerformSynchronousIo@
4
.text:
00017006
_FltPerformSynchronousIo@
4
proc near ; CODE XREF: FltReadFile(x,x,x,x,x,x,x,x,x)
+
2E8
↓p
.text:
00017006
; FltWriteFile(x,x,x,x,x,x,x,x,x)
+
2FB
↓p ...
.text:
00017006
.text:
00017006
var_18
=
dword ptr
-
18h
.text:
00017006
var_14
=
dword ptr
-
14h
.text:
00017006
var_10
=
dword ptr
-
10h
.text:
00017006
var_C
=
dword ptr
-
0Ch
.text:
00017006
var_8
=
dword ptr
-
8
.text:
00017006
var_4
=
dword ptr
-
4
.text:
00017006
CallbackData
=
dword ptr
8
.text:
00017006
.text:
00017006
mov edi, edi
.text:
00017008
push ebp
.text:
00017009
mov ebp, esp
.text:
0001700B
sub esp,
18h
.text:
0001700E
push esi
.text:
0001700F
mov esi, [ebp
+
CallbackData]
.text:
00017012
lea eax, [esi
-
60h
]
.text:
00017015
mov ecx, [eax
+
3Ch
]
.text:
00017018
mov ecx, [ecx
+
28h
]
.text:
0001701B
mov ecx, [ecx
+
2Ch
]
.text:
0001701E
or
[ebp
+
var_C],
0FFFFFFFFh
.text:
00017022
mov [ebp
+
var_18], ecx
…………省略部分…………
.text:
000170A4
push edi
.text:
000170A5
lea eax, [ebp
+
var_18]
.text:
000170A8
push eax
.text:
000170A9
call _FltpPassThroughInternal@
8
; FltpPassThroughInternal(x,x)
…………省略部分…………