NtSetTimerEx

NTSTATUS __stdcall NtSetTimerEx(
        PVOID TimerHandle,
        TIMER_SET_INFORMATION_CLASS TimerSetInformationClass,
        PVOID TimerSetInformation,
        UINT64 TimerSetInformationLength){
  __int128 *v4; 
  KPROCESSOR_MODE v6; 
  char *v7; 
  unsigned int v8; 
  UINT64 v9; 
  BYTE *v10; 
  INT64 v11; 
  volatile INT32 *v12; 
  int v13; 
  _OBJECT_TYPE *v14; 
  int v15; 
  NTSTATUS result; 
  UINT64 v17; 
  UINT64 v18; 
  BOOL v19; 
  _DWORD v20[3]; 
  PVOID Object; 
  __int128 v22; 
  __int128 v23; 
  __int128 v24; 
  v4 = (__int128 *)TimerSetInformation;
  v22 = 0i64;
  v23 = 0i64;
  v24 = 0i64;
  LOBYTE(v19) = 0;
  *(_QWORD *)&v20[1] = 0i64;
  v6 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v6 && (_DWORD)TimerSetInformationLength )
  {
    if( ((unsigned __int8)TimerSetInformation & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v7 = (char *)TimerSetInformation + (unsigned int)TimerSetInformationLength;
    if( (unsigned __int64)v7 > 0x7FFFFFFF0000i64 || v7 < TimerSetInformation )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( TimerSetInformationClass )
    return -1073741821;
  if( (_DWORD)TimerSetInformationLength != 48 )
    return -1073741820;
  if( v6 )
  {
    v22 = *(_OWORD *)TimerSetInformation;
    v23 = *((_OWORD *)TimerSetInformation + 1);
    v24 = *((_OWORD *)TimerSetInformation + 2);
    v4 = &v22;
  }
  v8 = *((_DWORD *)v4 + 8);
  if( v8 > 0x7FFFFFFF )
    return -1073741583;
  v9 = *((_QWORD *)v4 + 3);
  if( !v9 )
  {
LABEL_14:
    v10 = (BYTE *)*((_QWORD *)v4 + 5);
    v20[0] = *((_DWORD *)v4 + 9);
    v11 = *((_QWORD *)v4 + 2);
    v12 = (volatile INT32 *)*((_QWORD *)v4 + 1);
    Object = 0i64;
    v13 = ObReferenceObjectByHandle(TimerHandle, 2u, 0i64, v6, &Object, 0i64);
    if( v13 < 0 )
    {
LABEL_19:
      if( v13 >= 0 && v13 != 1073741861 )
        return v13;
      goto LABEL_36;
    }
    v14 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
    if( v14 == ExpIRTimerObjectType )
    {
      if( !v12 && !v11 && !*(_QWORD *)&v20[1] && !v20[0] && !v10 )
      {
        v15 = ExpSetTimerObject2(Object);
        goto LABEL_18;
      }
      ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      v13 = -1073741811;
    }
    else
    {
      if( v14 == ExTimerObjectType )
      {
        LODWORD(v18) = v20[0];
        LODWORD(v17) = v8;
        v15 = ExpSetTimerObject((UINT64)Object, v6, (INT64 *)v4, v12, v11, *(INT64 *)&v20[1], v19, v17, v18, v10);
LABEL_18:
        v13 = v15;
        goto LABEL_19;
      }
      ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
      v13 = -1073741788;
    }
LABEL_36:
    if( *(_QWORD *)&v20[1] )
      PoDestroyReasonContext(*(PVOID *)&v20[1]);
    return v13;
  }
  result = PoCaptureReasonContext(v9, v6, 0i64, 0, &v19, (INT64 *)&v20[1]);
  if( result >= 0 )
  {
    v8 = *((_DWORD *)v4 + 8);
    goto LABEL_14;
  }
  return result;
}

Referenced by: