NtSetTimer

NTSTATUS __stdcall NtSetTimer(
        HANDLE TimerHandle,
        PLARGE_INTEGER DueTime,
        PTIMER_APC_ROUTINE TimerApcRoutine,
        PVOID TimerContext,
        BOOL WakeTimer,
        INT32 Period,
        PBOOLEAN PreviousState){
  PLARGE_INTEGER v9; 
  char v10; 
  KPROCESSOR_MODE v11; 
  __int64 v12; 
  bool v13; 
  void *v14; 
  NTSTATUS v15; 
  NTSTATUS v16; 
  NTSTATUS result; 
  UINT64 v18; 
  UINT64 v19; 
  BOOL v20; 
  LONGLONG v21; 
  void *P[2]; 
  v9 = DueTime;
  v21 = 0i64;
  LOBYTE(v20) = 0;
  P[0] = 0i64;
  v10 = 0;
  v11 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v11 )
  {
    v12 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)DueTime < 0x7FFFFFFF0000i64 )
      v12 = (__int64)DueTime;
    v21 = *(_QWORD *)v12;
    v9 = (PLARGE_INTEGER)&v21;
    P[1] = &v21;
    v13 = WakeTimer;
  }
  else
  {
    v13 = WakeTimer;
    if( WakeTimer && PoPowerDownActionInProgress )
      v10 = 1;
  }
  if( Period < 0 )
    return -1073741580;
  if( !v13 || v10 || (result = PoCaptureReasonContext(0i64, v11, 0i64, 1, &v20, (INT64 *)P), result >= 0) )
  {
    LODWORD(v19) = 0;
    LODWORD(v18) = Period;
    v14 = P[0];
    v15 = ExpSetTimer(
            TimerHandle,
            v11,
            (INT64 *)v9,
            (volatile INT32 *)TimerApcRoutine,
            (INT64)TimerContext,
            (INT64)P[0],
            v20,
            v18,
            v19,
            PreviousState);
    v16 = v15;
    if( (v15 < 0 || v15 == 1073741861) && v14 )
      PoDestroyReasonContext(v14);
    if( v16 >= 0 )
    {
      if( v10 )
        return 1073741861;
    }
    return v16;
  }
  return result;
}

Referenced by: