NtCreateTimer2

NTSTATUS __stdcall NtCreateTimer2(
        VOID **TimerHandle,
        VOID *Reserved1,
        VOID *Reserved2,
        UINT64 Attributes,
        UINT64 DesiredAccess){
  unsigned int v5; 
  UINT64 v7; 
  UINT64 v8; 
  _DWORD *v9; 
  char v10; 
  __int64 v11; 
  int inserted; 
  _QWORD *v13; 
  NTSTATUS result; 
  VOID *v15; 
  INT64 v16; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 v19; 
  INT8 PreviousMode[4]; 
  PVOID Object; 
  PVOID v22; 

  v5 = Attributes;
  v22 = 0i64;
  Object = 0i64;
  if( !ExpExTimerAttributesAreValid((unsigned int)Attributes) )
    return -1073741582;
  if( v8 )
    return -1073741583;
  if( v9 && (v5 & 2) == 0 )
    return -1073741584;
  *(_DWORD *)PreviousMode = 0;
  v10 = KeGetCurrentThread()->PreviousMode;
  if( v10 )
  {
    v11 = 0x7FFFFFFF0000i64;
    v7 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)TimerHandle < 0x7FFFFFFF0000i64 )
      v7 = (UINT64)TimerHandle;
    *(_QWORD *)v7 = *(_QWORD *)v7;
    if( v9 )
    {
      if( (unsigned __int64)v9 < 0x7FFFFFFF0000i64 )
        v11 = (__int64)v9;
      *(_DWORD *)PreviousMode = *(_DWORD *)v11;
    }
  }
  else if( v9 )
  {
    *(_DWORD *)PreviousMode = *v9;
  }
  if( (v5 & 2) == 0 || (result = ExpCheckIRTimerAccess(PreviousMode[0]), result >= 0) )
  {
    LODWORD(v19) = 0;
    LODWORD(Handle) = 0;
    LODWORD(ObjectBodySize) = 168;
    LOBYTE(v8) = v10;
    LOBYTE(v7) = v10;
    inserted = ObCreateObjectEx(
                 v7,
                 ExpIRTimerObjectType,
                 0i64,
                 v8,
                 v15,
                 ObjectBodySize,
                 (UINT64)Handle,
                 v19,
                 &Object,
                 0i64);
    if( inserted >= 0 )
    {
      v13 = Object;
      if( (v5 & 2) != 0 )
      {
        LODWORD(v16) = v5;
        KeInitializeIRTimer((INT64)Object, 0i64, 0i64, (UINT8 *)PreviousMode, v16);
      }
      else
      {
        KeInitializeTimer2((INT64)Object, 0i64, 0i64, v5);
      }
      v13[17] = 0i64;
      *((_DWORD *)v13 + 40) = v5;
      LODWORD(v16) = 0;
      inserted = ObInsertObjectEx(v13, 0i64, (unsigned int)DesiredAccess, 0i64, v16, 0i64, &v22);
      *(_DWORD *)PreviousMode = inserted;
      if( inserted >= 0 )
        *TimerHandle = v22;
    }
    return inserted;
  }
  return result;
}

Referenced by: