WmipDriverEntry

NTSTATUS __stdcall WmipDriverEntry(_DRIVER_OBJECT *DriverObject, _UNICODE_STRING *RegistryPath){
  NTSTATUS result; 
  int v4; 
  UINT64 DeviceCharacteristics; 
  _UNICODE_STRING DeviceName; 
  _STRING DestinationString; 
  _UNICODE_STRING SymbolicLinkName; 

  DeviceName = 0i64;
  SymbolicLinkName = 0i64;
  DestinationString = 0i64;
  KeInitializeMutex((PRKMUTEX)((char *)&ExBootDevicesRemovedEvent + 3072), 0);
  WmipInitializeRegistration(0i64);
  *(&ExBootDevicesRemovedEvent + 395) = 0i64;
  *(&ExBootDevicesRemovedEvent + 392) = 0i64;
  *(&ExBootDevicesRemovedEvent + 396) = 0i64;
  *(&ExBootDevicesRemovedEvent + 394) = WmipEventNotification;
  result = WmipInitializeDataStructs();
  if( result >= 0 )
  {
    RtlInitAnsiString(&DestinationString, "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\WMI");
    RtlAnsiStringToUnicodeString((_UNICODE_STRING *)&ExBootDevicesRemovedEvent + 191, &DestinationString, 1u);
    result = WmipInitializeSecurity();
    if( result >= 0 )
    {
      RtlInitUnicodeString(&DeviceName, L"\\Device\\WMIDataDevice");
      LODWORD(DeviceCharacteristics) = 256;
      result = IoCreateDevice(
                 DriverObject,
                 0i64,
                 &DeviceName,
                 0x22ui64,
                 DeviceCharacteristics,
                 0,
                 (_DEVICE_OBJECT **)&ExBootDevicesRemovedEvent + 391);
      if( result >= 0 )
      {
        RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\WMIDataDevice");
        v4 = IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);
        if( v4 < 0 )
        {
          IoDeleteDevice(*(&ExBootDevicesRemovedEvent + 391));
        }
        else
        {
          *(_BYTE *)(*(&ExBootDevicesRemovedEvent + 391) + 76i64) = 2;
          DriverObject->MajorFunction[14] = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))WmipIoControl;
          DriverObject->MajorFunction[23] = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))WmipSystemControl;
          DriverObject->MajorFunction[0] = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))WmipOpenCloseCleanup;
          DriverObject->MajorFunction[2] = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))WmipOpenCloseCleanup;
          DriverObject->MajorFunction[18] = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *))WmipOpenCloseCleanup;
          *(_DWORD *)(*(&ExBootDevicesRemovedEvent + 391) + 48i64) &= ~0x80u;
          IoWMIRegistrationControl(*(&ExBootDevicesRemovedEvent + 391), 1ui64);
          IoRegisterShutdownNotification(*(&ExBootDevicesRemovedEvent + 391));
        }
        return v4;
      }
    }
  }
  return result;
}

Referenced by: