__int64 __fastcall DriverEntry(_QWORD *DriverObject1, __int64 a2)
{
unsigned __int16 *RegistryPath;
struct _DRIVER_OBJECT *DriverObject;
__int64 result;
RegistryPath = (unsigned __int16 *)a2;
DriverObject1[13] = sub_1400013DC;
DriverObject = (struct _DRIVER_OBJECT *)DriverObject1;
if ( (_BYTE)KdDebuggerEnabled )
KdDisableDebugger();
result = GetWindowsVersion();
if ( (signed int)result >= 0 )
{
result = sub_140003610(L"\\??\\HideToolz");
if ( (signed int)result < 0 )
{
P = NewRegistryPath(RegistryPath);
if ( P && (qword_14002C128 = (__int64)DriverObject, initDevice(DriverObject) >= 0) )
{
if ( DriverObject->DeviceObject )
{
DriverObject->MajorFunction[0] = (PDRIVER_DISPATCH)DispatchCommon;
DriverObject->MajorFunction[14] = (PDRIVER_DISPATCH)DispatchIoControl;
DriverObject->MajorFunction[2] = (PDRIVER_DISPATCH)DispatchCommon;
}
sub_1400093B4();
RxInitializeTopLevelIrpPackage();
*((_DWORD *)DriverObject->DriverSection + 26) |= 0x20u;
IoRegisterDriverReinitialization(DriverObject, sub_1400013D0, 0i64);
result = 0i64;
}
else
{
result = 3221225473i64;
}
}
}
return result;
}
signed __int64 __fastcall DispatchIoControl(__int64 a1, _IRP *pIrp)
{
_IO_STACK_LOCATION *v2;
_IRP *v3;
__int64 v4;
__int64 v5;
KPROCESSOR_MODE v6;
v2 = pIrp->Tail.Overlay.CurrentStackLocation;
v3 = pIrp;
v4 = v2->Parameters.Read.ByteOffset.LowPart;
v5 = v2->Parameters.Create.Options;
v6 = ExGetPreviousMode();
if ( v6 )
{
if ( v6 )
JUMPOUT(&loc_1400039DC);
JUMPOUT(&loc_1400039DC);
}
v3->IoStatus.Information = 0i64;
v3->IoStatus.Status = 0xC0000001;
IofCompleteRequest(v3, 0);
return 0xC0000001i64;
}
