It's simple to write a module for Sysmon.
In src/plugins you can find a module that prints some words in a table. I'll use it as an example to make the comprehension easier.
In the first place you must include modutils.h (located in include/): this file contains the definitions of all the structures and functions you need to write a plug-in.
There are four functions that can be implemented:
        * const char *get_module_name(void) // A module name is returned;
        * const char *get_module_description(void) // A short description is returned;
        * const char *get_module_author(void) // The author name is returned;
        * MODULE *get_module_run(void) // All module data is returned.

Only the last one is necessary, the others, now, aren't considered (the next version is going to have a lot of changes).
The MODULE structure is defined in modutils.h:

struct _info {
        DATA *param;
        DATA *header;
        char *title;
        unsigned int type;
};

typedef struct _info MODULE;

where DATA is a list.

Briefly, to write a module is to fill this structure. To understand better the fields it is necessary to explain how php a script interprets data:

[TITLE_OF_MODULE:TYPE_OF_TABLE]
header1\theader2\theader3\theader4...
data1\tdata2\tdata3\tdata4...

You can set the type of the table, the title, and initialize module structure by using 
info_init().

int info_init(INFO **info, char *title, unsigned int type);
Return value: -1 if an error occurred, 0 in case of success.
Argomenti: The module title,
	   the type of table.

where type can be:

#define HORIZONTAL 1
#define VERTICAL 2

The first defines a table where data is placed side to side to correspondant header as in GENERAL_INFO table:

        GENERAL_INFO
[Description ] home gateway
[uname ] FreeBSD 4.9-RC FreeBSD 4.9-RC #0: Thu Oct 23 1
[cpu load ] 6%
[load averages ] 0.13 0.10 0.08
[...]

In the second, instead, two or more data correspondant to a header:

        Disk Usage
[Filesystem][Size][Used][Available][Use%][Mounted on]
/dev/ad0s1a 126.0M 47.5M 78.4M     37.7% /
/dev/ad0s1e 252.0M 3.1M  248.9M    1.2%  /tmp
/dev/ad0s1g 3.1G   1.9G  1.2G      60.7% /usr
/dev/ad0s1f 252.0M 86.9M 165.1M    34.5% /var
[...]

As you can see in test1 module:

MODULE *get_module_run(void)
{
                                                                                                    
        MODULE *test = NULL;
                                                                                                    
        if(info_init(&test, "Test Module", HORIZONTAL) < 0)
                return NULL;
                                                                                                    
[...]

Now you can insert data and header in module:

int add_header(MODULE *module, char *str);
Return value: -1 if an error occurred, 0 in case of success.
Arguments: a pointer to module structure,
           a string that contains a header.

int add_param(MODULE *module, char *str);
Return value: -1 if an error occurred, 0 in case of success.
Arguments: a pointer to module structure
           a string that contains some data.

int add_row(MODULE *module, char *header, char *param);
Return value: -1 if an error occurred, 0 in case of success.
Arguments: a pointer to module structure,           
	   a string that contains a header,
	   a string that contains some data.
 
The last one is useful in HORIZONTAL table because, by calling only one function, you can insert both header and data.

When you're done, you must "return your_module" and compile your source as a shared library. Then you can place it in the plugins/ directory of Sysmon.