NtCreateTimer2
INT64 __fastcall NtCreateTimer2(
VOID **TimerHandle,
VOID *Reserved1,
VOID *Reserved2,
UINT64 Attributes,
UINT64 DesiredAccess){
unsigned int v5;
__int64 v7;
_DWORD *v8;
char v9;
__int64 v10;
__int64 v11;
int inserted;
PADAPTER_OBJECT v13;
INT64 result;
__int64 v15;
INT64 v16;
INT8 PreviousMode[4];
PADAPTER_OBJECT DmaAdapter;
PVOID Handle;
v5 = Attributes;
Handle = 0i64;
DmaAdapter = 0i64;
if( !ExpExTimerAttributesAreValid((unsigned int)Attributes) )
return 3221225714i64;
if( v7 )
return 3221225713i64;
if( v8 && (v5 & 2) == 0 )
return 3221225712i64;
*(_DWORD *)PreviousMode = 0;
v9 = *((_BYTE *)KeGetCurrentThread() + 562);
if( v9 )
{
v10 = 0x7FFFFFFF0000i64;
v11 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)TimerHandle < 0x7FFFFFFF0000i64 )
v11 = (__int64)TimerHandle;
*(_QWORD *)v11 = *(_QWORD *)v11;
if( v8 )
{
if( (unsigned __int64)v8 < 0x7FFFFFFF0000i64 )
v10 = (__int64)v8;
*(_DWORD *)PreviousMode = *(_DWORD *)v10;
}
}
else if( v8 )
{
*(_DWORD *)PreviousMode = *v8;
}
if( (v5 & 2) == 0 || (LODWORD(result) = ExpCheckIRTimerAccess(PreviousMode[0]), (int)result >= 0) )
{
inserted = ObCreateObjectEx(v9, ExpIRTimerObjectType, 0i64, v9, v15, 168, 0, 0, &DmaAdapter, 0i64);
if( inserted >= 0 )
{
v13 = DmaAdapter;
if( (v5 & 2) != 0 )
{
LODWORD(v16) = v5;
KeInitializeIRTimer((INT64)DmaAdapter, 0i64, 0i64, (UINT8 *)PreviousMode, v16);
}
else
{
KeInitializeTimer2((INT64)DmaAdapter, 0i64, 0i64, v5);
}
v13[8].DmaOperations = 0i64;
*(_DWORD *)&v13[10].Version = v5;
LODWORD(v16) = 0;
inserted = ObInsertObjectEx(v13, 0i64, (unsigned int)DesiredAccess, 0i64, v16, 0i64, &Handle);
*(_DWORD *)PreviousMode = inserted;
if( inserted >= 0 )
*TimerHandle = Handle;
}
return(unsigned int)inserted;
}
return result;
}Referenced by:
NtCreateIRTimer