ExpSetTimer
NTSTATUS __fastcall ExpSetTimer(
VOID *a1,
KPROCESSOR_MODE a2,
INT64 *a3,
volatile INT32 *a4,
INT64 a5,
INT64 a6,
CHAR a7,
UINT64 a8,
UINT64 a9,
BYTE *a10){
NTSTATUS result;
_OBJECT_TYPE *v14;
UINT64 v15;
UINT64 v16;
PVOID Object;
Object = 0i64;
result = ObReferenceObjectByHandle(a1, 2u, 0i64, a2, &Object, 0i64);
if( result >= 0 )
{
v14 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
if( v14 == ExpIRTimerObjectType )
{
if( a4 || a5 || a6 || (_DWORD)a9 || a10 )
{
ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
return -1073741811;
}
else
{
return ExpSetTimerObject2(Object);
}
}
else if( v14 == ExTimerObjectType )
{
LODWORD(v16) = a9;
LODWORD(v15) = a8;
return ExpSetTimerObject((UINT64)Object, a2, a3, a4, a5, a6, a7, v15, v16, a10);
}
else
{
ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
return -1073741788;
}
}
return result;
}Referenced by:
NtSetTimer